Create Interactive Tour

Windows Analysis Report
nc64.exe

Overview

General Information

Sample Name:	nc64.exe
Analysis ID:	796100
MD5:	523613a7b9dfa398cbd5ebd2dd0f4f38
SHA1:	3e92f697d642d68bb766cc93e3130b36b2da2bab
SHA256:	3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
Infos:

Detection

Netcat

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Netcat

Found large amount of non-executed APIs

Program does not show much activity (idle)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected potential crypto function

Found potential string decryption / allocating functions

Classification

Process Tree

System is w7x64

nc64.exe (PID: 1144 cmdline: C:\Users\user\Desktop\nc64.exe MD5: 523613A7B9DFA398CBD5EBD2DD0F4F38)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
nc64.exe	JoeSecurity_Netcat	Yara detected Netcat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Netcat	Yara detected Netcat	Joe Security
00000001.00000000.943077974.0000000000409000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Netcat	Yara detected Netcat	Joe Security
Process Memory Space: nc64.exe PID: 1144	JoeSecurity_Netcat	Yara detected Netcat	Joe Security

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nc64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal52.spre.winEXE@1/0@0/0

Source: nc64.exe

Static PE information: certificate valid

Source: C:\Users\user\Desktop\nc64.exe

API coverage: 6.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\nc64.exe	Code function: 1_2_004011B0 Sleep,Sleep,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleHandleA,GetProcAddress,_acmdln,__initenv,GetStartupInfoA,GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetModuleHandleA,		1_2_004011B0
Source: C:\Users\user\Desktop\nc64.exe	Code function: 1_2_00406C60 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_00406C60

Source: C:\Users\user\Desktop\nc64.exe

Code function: 1_2_00406B60 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_00406B60

Source: C:\Users\user\Desktop\nc64.exe	Code function: 1_2_0040425F _errno,listen,getsockname,inet_ntoa,htons,recvfrom,connect,accept,shutdown,closesocket,getsockname,inet_ntoa,htons,inet_ntoa,_errno,_errno,shutdown,closesocket,		1_2_0040425F
Source: C:\Users\user\Desktop\nc64.exe	Code function: 1_2_00403EC7 _errno,WSASetLastError,socket,socket,_dup,setsockopt,htons,bind,_errno,inet_ntoa,_sleep,_errno,inet_ntoa,htons,connect,WSASetLastError,_errno,WSAGetLastError,shutdown,closesocket,_errno,WSASetLastError,		1_2_00403EC7

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
nc64.exe	32%	ReversingLabs	Win64.Hacktool.NetCat
nc64.exe	36%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://secure.globalsign.net/cacert/PrimObject.crt0	0%	URL Reputation	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	URL Reputation	safe
http://www.globalsign.net/repository09	0%	URL Reputation	safe
http://www.globalsign.net/repository/0	0%	URL Reputation	safe
http://www.globalsign.net/repository/03	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://secure.globalsign.net/cacert/PrimObject.crt0	nc64.exe	false	URL Reputation: safe	unknown
http://secure.globalsign.net/cacert/ObjectSign.crt09	nc64.exe	false	URL Reputation: safe	unknown
http://www.globalsign.net/repository09	nc64.exe	false	URL Reputation: safe	unknown
http://eternallybored.org/misc/netcat/	nc64.exe	false		high
http://www.globalsign.net/repository/0	nc64.exe	false	URL Reputation: safe	unknown
http://www.globalsign.net/repository/03	nc64.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	796100
Start date and time:	2023-02-01 16:35:34 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	nc64.exe
Detection:	MAL
Classification:	mal52.spre.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 95.4% (good quality ratio 64.8%) Quality average: 42.1% Quality standard deviation: 41.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 209.197.3.8
Excluded domains from analysis (whitelisted): wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.15395147872826
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	nc64.exe
File size:	45272
MD5:	523613a7b9dfa398cbd5ebd2dd0f4f38
SHA1:	3e92f697d642d68bb766cc93e3130b36b2da2bab
SHA256:	3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
SHA512:	2ca42e21ebc26233c3822851d9fc82f950186820e10d3601c92b648415eb720f0e1a3a6d9d296497a3393a939a9424c47b1e5eaedfd864f96e3ab8986f6b35b5
SSDEEP:	768:gaGHu/aKUAvRCXA/e6PfVVCJrxg/KKjMozd6jSemG0nf2Fcc5C+qLaVp:CuSzAvRCxmNVCgi+IjNmDO15C+qLaVp
TLSH:	52134B7BF21684FED117C6BCA6D65871A4F4BC500A71606E63E68A373F39EB05BB8101
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....sN........../......f...,................@.....................................9......... ............................

File Icon


Icon Hash:	aab2e3e39383aa00

Static PE Info

General

Entrypoint:	0x401710
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x4E73D1B2 [Fri Sep 16 22:46:10 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	567531f08180ab3963b70889578118a3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign ObjectSign CA, OU=ObjectSign CA, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	6/10/2011 7:37:33 AM 6/10/2012 6:56:30 AM
Subject Chain	CN=Jernej Simoncic, C=SI
Version:	3
Thumbprint MD5:	3325943A6BCF2EB101C1CD5474EC7CB1
Thumbprint SHA-1:	ABAC542F13EE0FC3C70B1920FBAA7B3B592915AD
Thumbprint SHA-256:	D135329B2B4E5543CB847E6F0BD7168F137C47EDAD0AC09D0066D79824757F15
Serial:	010000000001307A27872D

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
mov dword ptr [00009A22h], 00000000h
call 00007F684CB95952h
dec eax
add esp, 28h
jmp 00007F684CB8FF99h
nop
nop
nop
nop
push ebp
dec eax
mov ebp, esp
dec eax
mov dword ptr [ebp+10h], ecx
mov dword ptr [ebp+18h], edx
jmp 00007F684CB9052Ch
dec eax
mov eax, dword ptr [ebp+10h]
movzx eax, byte ptr [eax]
movsx eax, al
cmp eax, dword ptr [ebp+18h]
jne 00007F684CB90518h
dec eax
mov eax, dword ptr [ebp+10h]
jmp 00007F684CB90527h
dec eax
add dword ptr [ebp+10h], 01h
dec eax
mov eax, dword ptr [ebp+10h]
movzx eax, byte ptr [eax]
test al, al
jne 00007F684CB904EDh
mov eax, 00000000h
leave
ret
push ebp
dec eax
mov ebp, esp
push esi
push ebx
dec eax
sub esp, 20h
dec eax
mov dword ptr [ebp+10h], ecx
mov eax, dword ptr [000098EBh]
mov dword ptr [ebp-14h], eax
mov eax, dword ptr [000098E6h]
mov dword ptr [ebp-1Ch], eax
mov eax, dword ptr [000098B9h]
mov dword ptr [ebp-18h], eax
jmp 00007F684CB90637h
mov eax, dword ptr [ebp-1Ch]
mov edx, dword ptr [ebp-18h]
mov ecx, edx
sub ecx, eax
mov eax, dword ptr [ebp-14h]
mov edx, dword ptr [ebp-1Ch]
mov ebx, edx
sub ebx, eax
mov eax, ebx
cmp ecx, eax
jng 00007F684CB905A5h
mov eax, dword ptr [ebp-14h]
mov edx, dword ptr [ebp-1Ch]
mov esi, edx
sub esi, eax
mov eax, esi
mov dword ptr [ebp-20h], eax
mov ebx, 00000000h
jmp 00007F684CB9057Eh
mov eax, ebx
add eax, dword ptr [ebp-14h]
dec eax
cwde
dec eax
shl eax, 03h
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc000	0x1130	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9600	0x1ad8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc464	0x400	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6600	0x6600	False	0.5197610294117647	data	5.901700911521572	IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0xf0	0x200	False	0.25	Matlab v4 mat-file (little endian) (UNKNOWN), text, rows 63, columns 0	1.6180650973966408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9000	0x1210	0x1400	False	0.4279296875	data	5.0077462845443765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xb000	0xc00	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc000	0x1130	0x1200	False	0.3092447916666667	data	3.9140315483096777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xe000	0x68	0x200	False	0.0703125	data	0.2592004782599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf000	0x48	0x200	False	0.052734375	data	0.21776995545804623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreatePipe, CreateProcessA, CreateThread, DeleteCriticalSection, DisconnectNamedPipe, DuplicateHandle, EnterCriticalSection, ExitThread, FreeConsole, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetStdHandle, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, PeekNamedPipe, QueryPerformanceCounter, ReadFile, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TerminateThread, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WriteFile
msvcrt.dll	_close, _dup, _itoa, _kbhit, _open, _read, _strcmpi, _strnicmp, _write
msvcrt.dll	__dllonexit, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _errno, _fmode, _initterm, _isatty, _lock, _onexit, _setjmp, _setmode, _sleep, _time64, _unlock, abort, atoi, calloc, exit, fflush, fprintf, fputc, free, fwrite, getenv, gets, longjmp, malloc, memcmp, memcpy, memset, rand, signal, sprintf, srand, strcat, strchr, strcmp, strcpy, strlen, strncmp, strncpy, vfprintf
WSOCK32.dll	WSACleanup, WSAGetLastError, WSASetLastError, WSAStartup, __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, getservbyname, getservbyport, getsockname, htons, inet_addr, inet_ntoa, listen, ntohs, recv, recvfrom, select, send, setsockopt, shutdown, socket

Network Behavior

Report size exceeds maximum size, please checkout the PCAP download to see all network behavior

Statistics

CPU Usage

• nc64.exe

Click to jump to process

Memory Usage

• nc64.exe

Click to jump to process

System Behavior

Analysis Process: nc64.exePID: 1144, Parent PID: 1860

Function Logs

General

Target ID:	1
Start time:	16:36:37
Start date:	01/02/2023
Path:	C:\Users\user\Desktop\nc64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\nc64.exe
Imagebase:	0x400000
File size:	45272 bytes
MD5 hash:	523613A7B9DFA398CBD5EBD2DD0F4F38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Netcat, Description: Yara detected Netcat, Source: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Netcat, Description: Yara detected Netcat, Source: 00000001.00000000.943077974.0000000000409000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Section Activities

Sections loaded by Windows

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Allocated

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

Analysis Process: nc64.exePID: 1144, Parent PID: 1860COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.8%
Total number of Nodes:	180
Total number of Limit Nodes:	5

Callgraph

Hide Legend

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004011B0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 319
sleeplibraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E004011B0(void* __edi, void* __esp, void* __rdi, void* __r12, void* __r13) {
				void* __rbx;
				void* __rsi;
				_Unknown_base(*)()* _t30;
				intOrPtr _t33;
				long long _t34;
				signed int _t43;
				void* _t47;
				signed int _t67;
				signed int _t70;
				signed int _t77;
				void* _t79;
				signed int _t81;
				signed int _t83;
				void* _t84;
				signed int _t87;
				void* _t89;
				intOrPtr _t107;
				signed long long _t108;
				signed char* _t113;
				void* _t114;
				intOrPtr _t116;
				void* _t117;
				void* _t124;
				signed long long _t130;
				void* _t137;
				void* _t144;
				void* _t147;
				void* _t154;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t164;
				void* _t167;
				void* _t168;
				signed long long _t170;

				_t172 = __r13;
				_t169 = __r12;
				_push(__r13);
				_push(__r12);
				_push(_t154);
				_push(_t147);
				_t157 = _t156 - 0x98;
				_t86 = "memcpy";
				_t137 = _t157 + 0x20;
				_t144 = _t137;
				memset(__edi, 0, 0xd << 0);
				_t89 = __esp + 0xc;
				_t79 = __edi + 0xd;
				if("memcpy" != 0) {
					_t124 = _t137;
					GetStartupInfoA(??);
				}
				_t107 =  *[gs:0x30];
				_t116 =  *((intOrPtr*)(_t107 + 8));
				asm("lock dec eax");
				_t81 = 0;
				if(_t107 == 0) {
					L7:
					if( *0x40bbc8 == 1) {
						goto L39;
					} else {
						goto L8;
					}
				} else {
					sil = 1;
					if(_t116 != _t107) {
						_t144 = Sleep;
						while(1) {
							Sleep();
							_t114 = _t147;
							asm("lock dec eax");
							if(_t114 == 0) {
								_t81 = 0;
								goto L7;
							}
							__eflags = _t116 - _t114;
							if(_t116 == _t114) {
								_t81 = 1;
								__eflags =  *0x40bbc8 - 1;
								if( *0x40bbc8 != 1) {
									L8:
									if( *0x40bbc8 == 0) {
										_t137 = 0x40e030;
										_t124 = 0x40e018;
										 *0x40bbc8 = 1;
										L00407420();
									} else {
										 *0x40b028 = 1;
									}
									_t24 =  *0x40bbc8;
									if( *0x40bbc8 == 1) {
										goto L41;
									}
								} else {
									L39:
									L00407418();
									_t24 =  *0x40bbc8;
									__eflags =  *0x40bbc8 - 1;
									if( *0x40bbc8 == 1) {
										L41:
										_t137 = 0x40e010;
										_t124 = 0x40e000;
										L00407420();
										 *0x40bbc8 = 2;
									}
								}
								L82:
							} else {
								continue;
							}
							goto L11;
						}
					}
					goto L7;
				}
				L11:
				if(_t81 == 0) {
					_t24 = 0;
					asm("lock dec eax");
				}
				_t108 =  *0x408070; // 0x406190
				if(_t108 != 0) {
					r8d = 0;
					_t70 = 2;
					_t24 =  *_t108();
				}
				E004065D0(_t24, _t116, _t124, _t144, _t147, _t154, _t164, _t168, _t169);
				SetUnhandledExceptionFilter(??); // executed
				 *0x40b030 = _t108;
				E00406A20(_t47, _t79, _t81, _t86, _t89, 0, _t108, _t116, _t137, _t144, _t147, _t167, _t169, _t172);
				_t117 = GetModuleHandleA; // executed
				GetModuleHandleA(??); // executed
				if(_t108 == 0) {
					GetModuleHandleA();
					__eflags = _t108;
					if(_t108 != 0) {
						goto L16;
					} else {
						GetModuleHandleA();
						__eflags = _t108;
						if(_t108 != 0) {
							goto L16;
						} else {
							_t30 = LoadLibraryA();
							__eflags = _t108;
							if(_t108 == 0) {
								goto L18;
							} else {
								goto L16;
							}
						}
					}
					L33:
					 *((long long*)(_t170 + _t108)) = 0;
					 *0x40b010 = _t170;
					 *__imp____initenv =  *0x40b018;
					_t33 = E00405282(_t87, _t70, _t80, _t89, __imp____initenv, _t117, _t130,  *0x40b010, _t147,  *0x40b018);
					 *0x40b038 = _t33;
					__eflags =  *0x40b024;
					if( *0x40b024 == 0) {
						L00407428();
						_push(_t147);
						_push(_t117);
						_t158 = _t157 - 0x38;
						_t110 =  *_t130;
						_t34 =  *_t110;
						__eflags = _t34 - 0xc0000091;
						if(_t34 > 0xc0000091) {
							__eflags = _t34 - 0xc0000094;
							if(__eflags == 0) {
								_t83 = 0;
								goto L51;
							} else {
								if(__eflags > 0) {
									__eflags = _t34 - 0xc0000095;
									if(_t34 == 0xc0000095) {
										goto L76;
									} else {
										__eflags = _t34 - 0xc0000096;
										if(_t34 != 0xc0000096) {
											goto L59;
										} else {
											goto L70;
										}
									}
								} else {
									__eflags = _t34 - 0xc0000092;
									if(_t34 == 0xc0000092) {
										goto L76;
									} else {
										__eflags = _t34 - 0xc0000093;
										if(_t34 == 0xc0000093) {
											goto L50;
										} else {
											goto L59;
										}
										goto L54;
									}
								}
							}
						} else {
							__eflags = _t34 - 0xc000008d;
							if(_t34 < 0xc000008d) {
								__eflags = _t34 - 0xc0000008;
								if(__eflags == 0) {
									L76:
									return 0xffffffff;
								} else {
									if(__eflags > 0) {
										__eflags = _t34 - 0xc000001d;
										if(_t34 == 0xc000001d) {
											L70:
											L00407430();
											__eflags = _t110 - 1;
											if(_t110 == 1) {
												L00407430();
												_t35 = 0xffffffff;
												goto L54;
											} else {
												__eflags = _t110;
												if(_t110 == 0) {
													goto L59;
												} else {
													 *_t110();
													return 0xffffffff;
												}
											}
										} else {
											__eflags = _t34 - 0xc000008c;
											if(_t34 != 0xc000008c) {
												goto L59;
											} else {
												goto L76;
											}
										}
									} else {
										__eflags = _t34 - 0x80000002;
										if(_t34 == 0x80000002) {
											goto L76;
										} else {
											__eflags = _t34 - 0xc0000005;
											if(_t34 != 0xc0000005) {
												goto L59;
											} else {
												L00407430();
												__eflags = _t110 - 1;
												if(_t110 == 1) {
													L00407430();
													_t35 = 0xffffffff;
													goto L54;
												} else {
													__eflags = _t110;
													if(_t110 == 0) {
														goto L59;
													} else {
														 *_t110();
														return 0xffffffff;
													}
												}
											}
										}
									}
								}
							} else {
								L50:
								_t83 = 1;
								L51:
								L00407430();
								__eflags = _t110 - 1;
								if(_t110 == 1) {
									L00407430();
									__eflags = _t83;
									_t35 = 0xffffffff;
									if(_t83 != 0) {
										 *((intOrPtr*)(_t158 + 0x28)) = 0xffffffff;
										E00406B50(0xffffffff);
										_t35 =  *((intOrPtr*)(_t158 + 0x28));
									}
								} else {
									__eflags = _t110;
									if(_t110 == 0) {
										L59:
										_t110 =  *0x40b030;
										__eflags =  *0x40b030;
										if( *0x40b030 != 0) {
											_t158 = _t158 + 0x38;
											goto __rax;
										}
										_t35 = 0;
									} else {
										 *_t110();
										_t35 = 0xffffffff;
									}
								}
								L54:
								return _t35;
							}
						}
					} else {
						__eflags =  *0x40b028;
						if( *0x40b028 == 0) {
							L00407410();
							_t33 =  *0x40b038;
						}
						return _t33;
					}
					goto L82;
				} else {
					L16:
					_t30 = GetProcAddress();
					if(_t108 != 0) {
						_t30 =  *_t108();
					}
				}
				L18:
				E00406B50(_t30);
				_t80 = "memcpy";
				if("memcpy" != 0) {
					_t67 = 0;
					_t113 =  *__imp___acmdln;
					while(1) {
						_t77 =  *_t113 & 0x000000ff;
						if(_t77 <= 0x20) {
							goto L20;
						}
						_t67 =  ==  ? _t67 ^ 0x00000001 : _t67;
						L22:
						_t113 =  &(_t113[1]);
						continue;
						L20:
						__eflags = _t77;
						_t70 = _t77 & 0xffffff00 | _t77 != 0x00000000;
						__eflags = _t67;
						if(_t67 != 0) {
							__eflags = _t70;
							if(_t70 == 0) {
								goto L26;
							} else {
								goto L22;
							}
							while(1) {
								L26:
								__eflags = _t70;
								if(_t70 == 0) {
									break;
								}
								_t108 =  &(_t113[1]);
								_t70 =  *_t108 & 0x000000ff;
								__eflags = _t70 - 0x20;
								if(_t70 <= 0x20) {
									continue;
								}
								break;
							}
							__eflags =  *(_t157 + 0x5c) & 0x00000001;
							 *0x40ba30 = _t108;
							_t43 = 0xa;
							 *0x40ba40 = 0x400000;
							if(( *(_t157 + 0x5c) & 0x00000001) != 0) {
								_t43 =  *(_t157 + 0x60) & 0x0000ffff;
							}
							 *0x40ba38 = _t43;
							goto L29;
						}
						goto L26;
					}
				}
				L29:
				_t87 =  *0x40b008;
				_t130 = _t154 + 1 << 3;
				L00407400();
				_t170 = _t108;
				__eflags = _t87;
				if(_t87 > 0) {
					_t84 = 0;
					__eflags = 0;
					do {
						_t84 = _t84 + 1;
						L00407408();
						_t13 = _t108 + 1; // 0x1
						r13d = _t13;
						L00407400();
						 *(_t170 + _t117) = _t108;
						_t130 = _t108;
						_t117 = _t117 + 8;
						L004073F8();
						__eflags = _t87 - _t84;
					} while (_t87 > _t84);
					_t108 = _t87 << 3;
					__eflags = _t108;
				}
				goto L33;
			}

0x004011b0
0x004011b0
0x004011b0
0x004011b9
0x004011bb
0x004011bd
0x004011bf
0x004011c6
0x004011cc
0x004011d3
0x004011d6
0x004011d6
0x004011d6
0x004011d9
0x004014a2
0x004014a5
0x004014a5
0x004011df
0x004011e8
0x004011ee
0x004011f7
0x004011fc
0x00401234
0x0040123d
0x00000000
0x00000000
0x00000000
0x00000000
0x004011fe
0x00401201
0x00401204
0x00401206
0x0040121a
0x0040121f
0x00401221
0x00401224
0x00401230
0x00401232
0x00401232
0x00401232
0x00401211
0x00401214
0x00401456
0x0040145b
0x0040145e
0x00401243
0x0040124b
0x004014b0
0x004014b7
0x004014be
0x004014c8
0x00401251
0x00401251
0x00401251
0x0040125b
0x00401264
0x00000000
0x00000000
0x00401464
0x00401464
0x00401469
0x0040146e
0x00401474
0x00401477
0x00401480
0x00401480
0x00401487
0x0040148e
0x00401493
0x00401493
0x00401477
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401214
0x0040121a
0x00000000
0x00401204
0x0040126a
0x0040126c
0x0040126e
0x00401270
0x00401270
0x00401278
0x00401282
0x00401284
0x00401287
0x0040128e
0x0040128e
0x00401290
0x0040129c
0x004012a2
0x004012a9
0x004012b5
0x004012bc
0x004012c1
0x004014d9
0x004014db
0x004014de
0x00000000
0x004014e4
0x004014eb
0x004014ed
0x004014f0
0x00000000
0x004014f6
0x004014fd
0x00401503
0x00401506
0x00000000
0x0040150c
0x00000000
0x0040150c
0x00401506
0x004014f0
0x004013d1
0x004013d1
0x004013e9
0x004013f0
0x00401401
0x0040140c
0x00401412
0x00401414
0x00401513
0x00401520
0x00401521
0x00401525
0x00401529
0x0040152c
0x0040152e
0x00401533
0x00401570
0x00401575
0x00401641
0x00000000
0x0040157b
0x0040157b
0x00401601
0x00401606
0x00000000
0x00401608
0x00401608
0x0040160d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040160d
0x00401581
0x00401581
0x00401586
0x00000000
0x0040158c
0x0040158c
0x00401591
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401591
0x00401586
0x0040157b
0x00401535
0x00401535
0x0040153a
0x004015b0
0x004015b5
0x00401662
0x0040166d
0x004015bb
0x004015bb
0x00401650
0x00401655
0x0040160f
0x00401616
0x0040161b
0x0040161f
0x004016da
0x004016df
0x00000000
0x00401625
0x00401625
0x00401628
0x00000000
0x0040162e
0x00401633
0x00401640
0x00401640
0x00401628
0x00401657
0x00401657
0x0040165c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040165c
0x004015c1
0x004015c1
0x004015c6
0x00000000
0x004015cc
0x004015cc
0x004015d1
0x00000000
0x004015d3
0x004015da
0x004015df
0x004015e3
0x004016ba
0x004016bf
0x00000000
0x004015e9
0x004015e9
0x004015ec
0x00000000
0x004015ee
0x004015f3
0x00401600
0x00401600
0x004015ec
0x004015e3
0x004015d1
0x004015c6
0x004015bb
0x0040153c
0x0040153c
0x0040153c
0x00401541
0x00401548
0x0040154d
0x00401551
0x0040168a
0x0040168f
0x00401691
0x00401696
0x0040169c
0x004016a0
0x004016a5
0x004016a5
0x00401557
0x00401557
0x0040155a
0x00401593
0x00401593
0x0040159a
0x0040159d
0x004015a3
0x004015ac
0x004015ac
0x00401670
0x0040155c
0x00401561
0x00401563
0x00401563
0x0040155a
0x00401568
0x0040156e
0x0040156e
0x0040153a
0x0040141a
0x00401420
0x00401422
0x00401424
0x00401429
0x00401429
0x0040143e
0x0040143e
0x00000000
0x004012c7
0x004012c7
0x004012d1
0x004012da
0x004012e3
0x004012e3
0x004012da
0x004012e5
0x004012e5
0x004012ea
0x004012f2
0x004012fb
0x004012fd
0x00401313
0x00401313
0x00401319
0x00000000
0x00000000
0x00401323
0x0040130f
0x0040130f
0x00000000
0x00401302
0x00401302
0x00401304
0x00401307
0x00401309
0x0040130b
0x0040130d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040133c
0x0040133c
0x0040133c
0x0040133e
0x00000000
0x00000000
0x00401330
0x00401334
0x00401337
0x0040133a
0x00000000
0x00000000
0x00000000
0x0040133a
0x00401340
0x0040134c
0x00401353
0x00401358
0x0040135f
0x00401440
0x00401440
0x00401365
0x00000000
0x00401365
0x00000000
0x00401309
0x00401313
0x0040136b
0x0040136b
0x00401377
0x0040137b
0x00401380
0x00401385
0x0040138e
0x00401392
0x00401392
0x00401394
0x00401398
0x0040139b
0x004013a0
0x004013a0
0x004013aa
0x004013af
0x004013ba
0x004013bd
0x004013c1
0x004013c6
0x004013c6
0x004013cd
0x004013cd
0x004013cd
0x00000000

APIs

Sleep.KERNEL32 ref: 0040121F
SetUnhandledExceptionFilter.KERNEL32 ref: 0040129C
GetModuleHandleA.KERNELBASE ref: 004012BC
GetProcAddress.KERNEL32 ref: 004012D1
GetStartupInfoA.KERNEL32 ref: 004014A5

Strings

_set_invalid_parameter_handler, xrefs: 004012C7
msvcr70.dll, xrefs: 004014D2
msvcr80.dll, xrefs: 004012AE
msvcrt.dll, xrefs: 004014E4, 004014F6

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: AddressExceptionFilterHandleInfoModuleProcSleepStartupUnhandled
String ID: _set_invalid_parameter_handler$msvcr70.dll$msvcr80.dll$msvcrt.dll
API String ID: 2266094942-642542254
Opcode ID: 95dc1078c6b56ec889f4cb7aed6aafb14f038c6ae12b3afb6600c93c28382f31
Instruction ID: 5b6e076c5045b8a0079544a8a1ac6406c7196364995176b67122be39bdec3849
Opcode Fuzzy Hash: 95dc1078c6b56ec889f4cb7aed6aafb14f038c6ae12b3afb6600c93c28382f31
Instruction Fuzzy Hash: 8FC1A17160560086EB259B25AC9036A3361EB89798F88453BDF1DBB3F1DF3CD885878D

Uniqueness

Uniqueness Score: -1.00%

Function 00405282 Relevance: 28.6, APIs: 3, Strings: 13, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00405282(signed int __ecx, void* __edx, void* __edi, void* __esp, long long __rax, signed long long __rbx, void* __rcx, signed long long __rdx, void* __rsi, void* __r8, signed int _a8, void* _a16) {
				void* _v32;
				void* _v40;
				void* _v48;
				signed int _v50;
				signed short _v52;
				signed int _v54;
				signed int _v56;
				signed long long _v64;
				signed int _v68;
				long long _v80;
				signed int _v82;
				long long _v120;
				signed int _t123;
				signed int _t147;
				signed int _t148;
				void* _t163;
				signed int _t166;
				signed int _t173;
				signed int _t175;
				signed int _t177;
				signed int _t206;
				intOrPtr _t212;
				signed int _t226;
				void* _t294;
				signed int _t295;
				signed int _t296;
				void* _t297;
				signed int _t298;
				void* _t299;
				long long _t336;
				signed int* _t338;
				signed long long _t339;
				signed int* _t340;
				signed long long _t344;
				signed long long _t347;
				signed long long _t348;
				intOrPtr _t351;
				signed long long _t355;
				signed long long _t358;
				signed long long _t361;
				signed int _t367;
				signed long long _t369;
				signed int _t376;
				signed int* _t377;
				signed long long _t381;
				intOrPtr* _t383;
				long long _t384;
				long long* _t387;
				signed long long _t407;
				long long _t417;
				long long _t420;
				char* _t421;
				char* _t422;
				long long _t471;
				void* _t473;
				void* _t483;

				_t473 = __rsi;
				_t466 = __rdx;
				_t418 = __rbx;
				_t336 = __rax;
				_t299 = __esp;
				_t294 = __edi;
				_a8 = __ecx;
				_a16 = __rdx;
				E00406E00(__rbx, __rdx, __rsi);
				_v32 = 0;
				_v80 = 0;
				_v40 = 0;
				_v48 = 0;
				_v50 = 0;
				_v52 = 0;
				_v82 = 0;
				_v54 = 0;
				_v56 = 0;
				_v64 = 0;
				_v68 = 0;
				E00402F70();
				E0040371E(0x10, _t336, _t466, __rbx);
				 *0x40b098 = _t336;
				E0040371E(0x10, _t336, _t466, __rsi);
				 *0x40b0a0 = _t336;
				E0040371E(0x2000, _t336, _t466);
				 *0x40bba8 = _t336;
				E0040371E(0x2000, _t336, _t466);
				 *0x40ba90 = _t336;
				E0040371E(0x208, _t336, _t466);
				 *0x40bba0 = _t336;
				E0040371E(0x208, _t336, _t466);
				 *0x40ba88 = _t336;
				E0040371E(0x4a, _t336, _t466);
				 *0x40b0b8 = _t336;
				L00407400();
				 *0x40bbb0 = _t336;
				 *((char*)( *0x40bbb0)) = 1;
				_t338 = __imp___errno;
				 *_t338();
				 *_t338 = 0;
				 *0x408028 = 4;
				goto L3;
				do {
					do {
						L3:
						if(_a8 != 1) {
							goto L25;
						} else {
							_t383 = _a16;
							E0040371E(0x400, _t383, _t466);
							_a16 = _t383;
							_t384 = _a16;
							 *_t384 =  *_t383;
							E0040371E(0x2000, _t384, _t466);
							_t420 = _t384;
							 *((long long*)(_a16 + 8)) = _t420;
							_t387 = __imp____iob_func;
							 *_t387();
							_t19 = _t387 + 0x60; // 0x60
							_t483 = _t19;
							r8d = 0xa;
							L004074E8(); // executed
							_t212 =  *__imp____iob_func();
							L00407490();
							r8d = 0x2000;
							_t471 = _t420;
							L00407368(); // executed
							 *0x40b07c = _t212;
							_t301 =  *0x40b07c;
							if( *0x40b07c == 0) {
								E004035DB(0, _t301, _t420, "wrong", _t471, _t481, _t483);
							}
							_t297 = E0040377B( *0x40b07c, _t420);
							if(_t297 != 0) {
								 *0x40b07c =  *0x40b07c - _t297;
							}
							if( *0x40b07c != 0) {
								L004073F8();
							}
							L004074F0();
							_t421 =  *((intOrPtr*)(_a16 + 8));
							if(_t421 != 0) {
								 *_t421 = 0;
							}
							L004074F0();
							_t422 =  *((intOrPtr*)(_a16 + 8));
							if(_t422 != 0) {
								 *_t422 = 0;
							}
							_t418 =  *((intOrPtr*)(_a16 + 8)) + 1;
							_t298 = 2;
							while(( *_t418 & 0x000000ff) != 0) {
								__eflags = ( *_t418 & 0x000000ff) - 0x20;
								if(( *_t418 & 0x000000ff) != 0x20) {
									_t24 = _t418 - 1; // -2
									__eflags =  *_t24 & 0x000000ff;
									if(( *_t24 & 0x000000ff) == 0) {
										 *((_t298 << 3) + _a16) = _t418;
										_t298 = _t298 + 1;
										__eflags = _t298;
									}
								} else {
									 *_t418 = 0;
								}
								_t418 = _t418 + 1;
								__eflags = _t418;
							}
							_a8 = _t298;
							while(1) {
								L25:
								_t339 = _a16;
								_t480 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
								_t466 = _t339;
								_t260 = _a8;
								_t295 = E00402422(_a8, _t339, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
								if(_t295 == 0xffffffff) {
									break;
								}
								_t27 = _t473 - 0x47; // -71
								__eflags = _t27 - 0x33;
								if(__eflags > 0) {
									_t340 = __imp___errno;
									 *_t340();
									 *_t340 = 0;
									E004035DB(_t260, __eflags, _t418, "nc -h for help", _t466, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t483);
									continue;
								}
								_t466 =  *((intOrPtr*)(0x409b50 + _t339 * 4));
								goto __rax;
							}
							if(( *0x40b0d6 & 0x0000ffff) != 0) {
								L004073A0();
								L004074F8();
								_t261 = 0x10000;
								E0040371E(0x10000, _t339, _t466);
								_v64 = _t339;
							}
							_t344 =  *0x40b0e8;
							if(_t344 != 0) {
								_t261 = 0;
								L00407358();
								 *0x40b0d4 = 0;
								 *0x40b074 = 0;
							}
							_t123 =  *0x40b0d4 & 0x0000ffff;
							if(_t123 != 0) {
								_t344 =  *0x40b0c0;
								r8d = 0x1b4;
								L00407370();
								 *0x40b074 = _t123;
								_t312 =  *0x40b074;
								if( *0x40b074 <= 0) {
									_t344 =  *0x40b0c0;
									_t466 = _t344;
									E004035DB(_t260, _t312, _t418, "can\'t open %s", _t344, _t480, _t483);
								}
								_t261 = 0x64;
								E0040371E(0x64, _t344, _t466);
								 *0x40b0c0 = _t344;
							}
							_t347 =  *((intOrPtr*)((_t344 << 3) + _a16));
							if(_t347 != 0) {
								_t417 =  *((intOrPtr*)((_t347 << 3) + _a16));
								E00403841( *0x40b0d2 & 0xffff, _t417, _t466, _t483);
								_v32 = _t417;
							}
							if(_v32 != 0 && _v32 + 0x1c0 != 0) {
								_v48 = _v32 + 0x1c0;
							}
							if(_v48 != 0) {
								 *0x40b048 =  *0x40b048 + 1;
							}
							_t348 = __imp___errno;
							 *_t348();
							 *_t348 = 0;
							if(( *0x40b0d0 & 0x0000ffff) == 0) {
								L55:
								_t329 = _v48;
								if(_v48 == 0) {
									E004035DB(_t260, _t329, _t418, "no destination", _t466, _t480, _t483);
								}
								_t351 =  *((intOrPtr*)((_t348 << 3) + _a16));
								_t330 = _t351;
								if(_t351 == 0) {
									E004035DB(_t260, _t330, _t418, "no port[s] to connect to", _t466, _t480, _t483);
								}
								_t355 =  *((intOrPtr*)((_t351 + 1 << 3) + _a16));
								if(_t355 != 0) {
									 *0x40802c = 0;
								}
								_v52 = _v50 & 0x0000ffff;
								while(1) {
									_t358 =  *((_t355 << 3) + _a16);
									if(_t358 == 0) {
										goto L97;
									}
									_v82 = 0;
									_v54 = _v82 & 0x0000ffff;
									_t361 =  *((intOrPtr*)((_t358 << 3) + _a16));
									L004074F0();
									_t418 = _t361;
									__eflags = _t418;
									if(_t418 != 0) {
										 *_t418 = 0;
										_t418 = _t418 + 1;
										_v54 = E00403BC0(0, _t418);
										__eflags = _v54;
										if(__eflags == 0) {
											_t466 = _t418;
											E004035DB(_t261, __eflags, _t418, "invalid port %s", _t418, _t481, _t483);
										}
									}
									_t355 =  *((intOrPtr*)((_t361 << 3) + _a16));
									_t427 = _t355;
									_v82 = E00403BC0(0, _t355);
									__eflags = _v82;
									if(_v82 == 0) {
										_t376 = (_t355 << 3) + _a16;
										__eflags = _t376;
										_t355 =  *_t376;
										_t466 = _t355;
										_t427 = "invalid port %s";
										E004035DB(_t261, _t376, _t418, "invalid port %s", _t355, _t481, _t483);
									}
									__eflags = (_v54 & 0x0000ffff) - _v82;
									if((_v54 & 0x0000ffff) <= _v82) {
										_v56 = _v82 & 0x0000ffff;
									} else {
										 *0x40802c = 0;
										_v56 = _v54 & 0x0000ffff;
										__eflags =  *0x40b0d6 & 0x0000ffff;
										if(( *0x40b0d6 & 0x0000ffff) != 0) {
											_t261 = _v54 & 0x0000ffff;
											r8d = _v54 & 0x0000ffff;
											E00403E4E(_v82 & 0x0000ffff, _v64, _v64);
											_t355 = _v64;
											_t427 = _t355;
											_v56 = E00403DCA(_t296, _t355, _t355);
										}
									}
									while(1) {
										__eflags = (_v82 & 0x0000ffff) - _v56;
										if((_v82 & 0x0000ffff) > _v56) {
											break;
										}
										__eflags = _v50;
										if(_v50 == 0) {
											_t175 =  *0x40b0d6 & 0x0000ffff;
											__eflags = _t175;
											if(_t175 != 0) {
												L004074C0();
												_v52 = _t175;
												__eflags = _v52 - 0x1fff;
												if(_v52 <= 0x1fff) {
													_t82 =  &_v52;
													 *_t82 = _v52 + 0x2000;
													__eflags =  *_t82;
												}
											}
										}
										_t261 = 0;
										_v56 = E00403BC0(_v56 & 0x0000ffff, _t427);
										_t364 = _v48;
										r9d = _v52 & 0x0000ffff;
										_t481 = _v40;
										 *0x408010 = E00403EC7(_v56 & 0x0000ffff, _v48, _t466, _v40, _t483);
										_t147 =  *0x408010; // 0xffffffff
										__eflags = _t147;
										if(_t147 > 0) {
											__eflags =  *0x40b0e0 & 0x0000ffff;
											if(( *0x40b0e0 & 0x0000ffff) != 0) {
												__eflags =  *0x40b0d8 & 0x0000ffff;
												if(( *0x40b0d8 & 0x0000ffff) != 0) {
													_t173 =  *0x408010; // 0xffffffff
													_t466 = _v48;
													_t261 = _t173;
													 *0x408010 = E00404773(_t173, _t364, _v48);
												}
											}
										}
										_t148 =  *0x408010; // 0xffffffff
										__eflags = _t148;
										if(_t148 <= 0) {
											_t296 = 1;
											__eflags =  *0x40802c & 0x0000ffff;
											if(( *0x40802c & 0x0000ffff) != 0) {
												L88:
												_t367 = _v32 + 0x100;
												__eflags = _t367;
												_t368 = _v32;
												_v120 =  *0x40b0b8;
												r9d = _v56 & 0x0000ffff;
												_t481 = _t367;
												_t466 = _v32;
												E004034EB("%s [%s] %d (%s)", _v32, _t367, _t483);
												goto L89;
											}
											__eflags = ( *0x40b0da & 0x0000ffff) - 1;
											if(( *0x40b0da & 0x0000ffff) > 1) {
												goto L88;
											}
											_t368 = __imp__WSAGetLastError;
											_t163 =  *__imp__WSAGetLastError();
											__eflags = _t163 - 0x274d;
											if(_t163 == 0x274d) {
												goto L89;
											}
											goto L88;
										} else {
											_t296 = 0;
											_v120 =  *0x40b0b8;
											r9d = _v56 & 0x0000ffff;
											_t481 = _v32 + 0x100;
											_t466 = _v32;
											E004034EB("%s [%s] %d (%s) open", _v32, _v32 + 0x100, _t483);
											_t368 =  *0x40b0e8;
											__eflags = _t368;
											if(_t368 != 0) {
												E004026FD(_t261, _t368, _t368, _t481);
											}
											__eflags =  *0x40b0e0 & 0x0000ffff;
											if(( *0x40b0e0 & 0x0000ffff) == 0) {
												_t368 =  *0x40b0e8;
												__eflags = _t368;
												if(_t368 == 0) {
													_t166 =  *0x408010; // 0xffffffff
													_t261 = _t166;
													_t296 = E00404B7C(_t166, _t294, _t299, _t481, _t483);
												}
											}
											L89:
											_t369 = __imp__shutdown;
											 *_t369();
											_t427 = _t369;
											_t355 = __imp__closesocket;
											 *_t355();
											__eflags =  *0x40b0cc;
											if( *0x40b0cc != 0) {
												_t261 =  *0x40b0cc;
												_t355 = __imp___sleep;
												 *_t355();
											}
											__eflags =  *0x40b0d6 & 0x0000ffff;
											if(( *0x40b0d6 & 0x0000ffff) == 0) {
												_t101 =  &_v56;
												 *_t101 = _v56 - 1;
												__eflags =  *_t101;
											} else {
												_t355 = _v64;
												_t427 = _t355;
												_v56 = E00403DCA(_t296, _t355, _t355);
											}
											continue;
										}
									}
									_t177 =  *0x40b048 + 1;
									__eflags = _t177;
									 *0x40b048 = _t177;
								}
								goto L97;
							} else {
								_v56 = 0;
								_t381 =  *((intOrPtr*)((_t348 << 3) + _a16));
								if(_t381 != 0) {
									_t407 =  *((intOrPtr*)((_t381 << 3) + _a16));
									_v56 = E00403BC0(0, _t407);
									if(_v56 == 0) {
										_t466 =  *((intOrPtr*)((_t407 << 3) + _a16));
										E004035DB(_t260, (_t407 << 3) + _a16, _t418, "invalid port %s",  *((intOrPtr*)((_t407 << 3) + _a16)), _t480, _t483);
									}
								}
								_t348 = _v48;
								r9d = _v50 & 0x0000ffff;
								_t481 = _v40;
								 *0x408010 = E0040425F(_v56 & 0x0000ffff, _t348, _v40, _t483);
								_t206 =  *0x408010; // 0xffffffff
								if(_t206 <= 0) {
									L54:
									E004035DB(_t260, _t328, _t418, "no connection", _t466, _t481, _t483);
									goto L55;
								} else {
									goto L46;
								}
							}
						}
						L46:
						_t382 =  *0x40b0e8;
						if( *0x40b0e8 != 0) {
							E004026FD(_t260, _t382, _t382, _t481);
						}
						_t348 =  *0x40b0e8;
						if(_t348 == 0) {
							_t226 =  *0x408010; // 0xffffffff
							_t295 = E00404B7C(_t226, _t294, _t299, _t481, _t483);
						}
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB(" sent %d, rcvd %d", _t466, _t481, _t483);
						}
						_t328 = _v68 - 1;
					} while (_v68 == 1);
					_t260 = _t295;
					L00407428();
					goto L54;
					L97:
					_t377 = __imp___errno;
					 *_t377();
					 *_t377 = 0;
					if(( *0x40b0da & 0x0000ffff) > 1) {
						r8d =  *0x40b080;
						E004034EB("sent %d, rcvd %d", _t466, _t481, _t483);
					}
					 *__imp__WSACleanup();
				} while (_v68 == 1);
				_t335 =  *0x40802c & 0x0000ffff;
				if(( *0x40802c & 0x0000ffff) != 0) {
					L00407428();
				}
				L00407428();
				 *0x40b0da = 1;
				E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t466, _t481, _t483);
				E004034EB("\t-d\t\tdetach from console, background mode\n", _t466, _t481, _t483);
				E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t466, _t481, _t483);
				E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t466, _t481, _t483);
				E004034EB("\t-t\t\tanswer TELNET negotiation", _t466, _t481, _t483);
				E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t466, _t481, _t483);
				E004035DB(0, _t335, _t418, "port numbers can be individual or ranges: m-n [inclusive]", _t466, _t481, _t483);
				return 0;
			}

0x00405282
0x00405282
0x00405282
0x00405282
0x00405282
0x00405282
0x0040528c
0x0040528f
0x00405293
0x00405298
0x004052a0
0x004052a8
0x004052b0
0x004052b8
0x004052be
0x004052c4
0x004052ca
0x004052d0
0x004052d6
0x004052de
0x004052e5
0x004052ef
0x004052f4
0x00405300
0x00405305
0x00405311
0x00405316
0x00405322
0x00405327
0x00405333
0x00405338
0x00405344
0x00405349
0x00405355
0x0040535a
0x00405366
0x0040536b
0x00405379
0x0040537c
0x00405383
0x00405385
0x0040538b
0x00405395
0x0040539b
0x0040539b
0x0040539b
0x0040539f
0x00000000
0x004053a5
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561
0x00405561
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00000000
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00000000
0x00000000
0x00000000
0x00405abe
0x00405a21
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b21
0x00405b2b
0x00405b2d
0x00000000
0x00405ef7
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f39
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb

APIs

Part of subcall function 00402F70: WSAStartup.WS2_32 ref: 00402F95

_read.MSVCRT ref: 00405426
_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
%s [%s] %d (%s) open, xrefs: 00405D97
%s [%s] %d (%s), xrefs: 00405E47
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
wrong, xrefs: 0040543B
no port[s] to connect to, xrefs: 00405B69
nc -h for help, xrefs: 004058A9
Cmd line: , xrefs: 004053E6
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86, 00405BFF, 00405C4C
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: Startup_close_open_read
String ID: sent %d, rcvd %d$%s [%s] %d (%s)$%s [%s] %d (%s) open$Cmd line: $ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$nc -h for help$no connection$no destination$no port[s] to connect to$sent %d, rcvd %d$wrong
API String ID: 4055665335-2008981751
Opcode ID: 9c19e91a0597be84dd939bf69b1af8a9804bd9bd547b64a0fcf72bda4b7b3b0d
Instruction ID: aa6d466d49ba75014a6fd088382988284f4421623f444755cc5968d3db34c99a
Opcode Fuzzy Hash: 9c19e91a0597be84dd939bf69b1af8a9804bd9bd547b64a0fcf72bda4b7b3b0d
Instruction Fuzzy Hash: 0B425EA5B10B1089EB10DF66E89136A37A0FB44B88F44442AEF5D677E5EB3CC941C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F70 Relevance: 1.5, APIs: 1, Instructions: 26
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00402F95

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: fd50942647596e9adff19615f9acac6174bf98626788d581ad528cc4b900d8f1
Instruction ID: d979e13f101af2de71beeaa6dfad1e31789a9e17aa052920b34001e835b19141
Opcode Fuzzy Hash: fd50942647596e9adff19615f9acac6174bf98626788d581ad528cc4b900d8f1
Instruction Fuzzy Hash: A3F08261B11126DCF7115764D9453F83374A745748F5040A2EE88A67D8D67CCD86DB14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040425F Relevance: 11.6, Strings: 9, Instructions: 307COMMON

Download Yara Rule

Strings

listening on [, xrefs: 00404356
local getsockname failed, xrefs: 0040434A
any, xrefs: 004043C2
post-rcv getsockname failed, xrefs: 004045CF
invalid connection to [%s] from %s [%s] %d, xrefs: 004046E9
UDP listen needs -p arg, xrefs: 004042D7
local listen fuxored, xrefs: 00404300
connect to [%s] from %s [%s] %d, xrefs: 0040471B
] %d ..., xrefs: 004043EA

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _dup
String ID: UDP listen needs -p arg$] %d ...$any$connect to [%s] from %s [%s] %d$invalid connection to [%s] from %s [%s] %d$listening on [$local getsockname failed$local listen fuxored$post-rcv getsockname failed
API String ID: 4290338715-1417769188
Opcode ID: 9814f324597a2c128c250115492104a44e538bf979e0cc934165edc76680b334
Instruction ID: fae62bbe820c3f8e4ccf25578a5d57cd35fb67886a86de2ca3ddb9177e1a32ff
Opcode Fuzzy Hash: 9814f324597a2c128c250115492104a44e538bf979e0cc934165edc76680b334
Instruction Fuzzy Hash: B2D12EA571160489EB50DFA6E8913A937A0E788BC8F44812ADF1DA77A5EF3CC940C758

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC7 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 222COMMON

Download Yara Rule

APIs

_dup.MSVCRT ref: 00403F77

Strings

Can't grab %s:%d with bind, xrefs: 00404108
Can't get socket, xrefs: 00403F59
retrying local %s:%d, xrefs: 004040A8
Warning: source routing unavailable on this machine, ignoring, xrefs: 0040416C
nnetfd reuseaddr failed, xrefs: 00403FBA

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _dup
String ID: Can't get socket$Can't grab %s:%d with bind$Warning: source routing unavailable on this machine, ignoring$nnetfd reuseaddr failed$retrying local %s:%d
API String ID: 4290338715-1629468623
Opcode ID: 95de1cbe713bd5b086f9e09bb79259fde098b71a9abc675131fe53aecc5c68b4
Instruction ID: 796a5e7de7e8b4d4d34cb24cf692fcf8d0d9c0bba1063527440a6a88acc77b97
Opcode Fuzzy Hash: 95de1cbe713bd5b086f9e09bb79259fde098b71a9abc675131fe53aecc5c68b4
Instruction Fuzzy Hash: 4EA1ECA1710605CAEB509F6AEC8436937A0E788B98F14822ADF5DA77B4DF3DC941C74C

Uniqueness

Uniqueness Score: -1.00%

Function 00406C60 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00406C74
SetUnhandledExceptionFilter.KERNEL32 ref: 00406D12
UnhandledExceptionFilter.KERNEL32 ref: 00406D1F
GetCurrentProcess.KERNEL32 ref: 00406D25
TerminateProcess.KERNEL32 ref: 00406D33

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentTerminate
String ID:
API String ID: 4227532867-0
Opcode ID: 922a79e8f92ef13e376e9addc228e49b43fb90e935189d6fa9032d16f4bdae9e
Instruction ID: 806709c38d932ebe020d2be2581943bc65d06b3b3ce8ab5b5d62cd5fcd632005
Opcode Fuzzy Hash: 922a79e8f92ef13e376e9addc228e49b43fb90e935189d6fa9032d16f4bdae9e
Instruction Fuzzy Hash: C62104B5616F04E9EB009B61FC8039933A4F748788F54012ADB8E23B65EF3CD244878C

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00406BC9
GetCurrentProcessId.KERNEL32 ref: 00406BD4
GetCurrentThreadId.KERNEL32 ref: 00406BDC
GetTickCount.KERNEL32 ref: 00406BE6
QueryPerformanceCounter.KERNEL32 ref: 00406BF5

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 67c04eecbba078a7038835ea3813aebdbee4ae9d6fcb65bb677d228f3e40501e
Instruction ID: 028d8ec5365a5601458f3b91cb52c4a4b563417e76bb7ab21696fc452bac0917
Opcode Fuzzy Hash: 67c04eecbba078a7038835ea3813aebdbee4ae9d6fcb65bb677d228f3e40501e
Instruction Fuzzy Hash: AD116A76218F5082E7109B11F94031AB3A4F789BA0F591229EFDE53BA8CF7CD414C704

Uniqueness

Uniqueness Score: -1.00%

Function 004055FF Relevance: 31.8, APIs: 2, Strings: 16, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E004055FF(void* __ecx, void* __edx, void* __edi, void* __esp, signed long long __rbx, signed long long __rdx, void* __rsi, void* __r8, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				long long _v88;
				signed int _t111;
				signed int _t135;
				signed int _t136;
				void* _t151;
				signed int _t154;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t194;
				intOrPtr _t200;
				signed int _t214;
				void* _t277;
				signed int _t278;
				signed int _t279;
				void* _t280;
				signed int _t281;
				void* _t282;
				signed int _t320;
				long long _t321;
				signed long long _t322;
				signed int* _t323;
				signed long long _t327;
				signed long long _t330;
				signed long long _t331;
				intOrPtr _t334;
				signed long long _t338;
				signed long long _t341;
				signed long long _t344;
				signed int _t350;
				signed long long _t352;
				signed int _t359;
				signed int* _t360;
				signed long long _t364;
				intOrPtr* _t366;
				long long _t367;
				long long* _t370;
				signed long long _t390;
				long long _t400;
				long long _t405;
				char* _t406;
				char* _t407;
				long long _t457;
				signed int _t460;
				void* _t462;

				_t473 = __r9;
				_t462 = __rsi;
				_t452 = __rdx;
				_t403 = __rbx;
				_t282 = __esp;
				_t277 = __edi;
				if( *0x40b078 > 8) {
					E004035DB(_t240, __eflags, __rbx, "too many -g hops", __rdx, _t470, __r9);
				}
				_t320 =  *0x40b0a8;
				__eflags = _t320;
				if(_t320 == 0) {
					E0040371E(0x50, _t320, _t452);
					 *0x40b0a8 = _t320;
				}
				_t321 =  *0x40b040;
				E00403841( *0x40b0d2 & 0xffff, _t321, _t452, _t473);
				_v88 = _t321;
				__eflags = _v88;
				if(__eflags != 0) {
					_t460 =  *0x40b078 << 3;
					__eflags = _t460;
					 *((long long*)( *0x40b0a8 + _t460)) = _v88;
				}
				 *0x40b078 =  *0x40b078 + 1;
				while(1) {
					L31:
					_t322 = _a24;
					_t470 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t452 = _t322;
					_t240 = _a16;
					_t278 = E00402422(_a16, _t322, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t278 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t242 = 0x10000;
						E0040371E(0x10000, _t322, _t452);
						_v56 = _t322;
					}
					_t327 =  *0x40b0e8;
					if(_t327 != 0) {
						_t242 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t111 =  *0x40b0d4 & 0x0000ffff;
					if(_t111 != 0) {
						_t327 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t111;
						_t296 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t327 =  *0x40b0c0;
							_t452 = _t327;
							E004035DB(_t240, _t296, _t403, "can\'t open %s", _t327, _t470, _t473);
						}
						_t242 = 0x64;
						E0040371E(0x64, _t327, _t452);
						 *0x40b0c0 = _t327;
					}
					_t330 =  *((intOrPtr*)((_t327 << 3) + _a24));
					if(_t330 != 0) {
						_t400 =  *((intOrPtr*)((_t330 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t400, _t452, _t473);
						_v24 = _t400;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t331 = __imp___errno;
					 *_t331();
					 *_t331 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L61:
						_t313 = _v40;
						if(_v40 == 0) {
							E004035DB(_t240, _t313, _t403, "no destination", _t452, _t470, _t473);
						}
						_t334 =  *((intOrPtr*)((_t331 << 3) + _a24));
						_t314 = _t334;
						if(_t334 == 0) {
							E004035DB(_t240, _t314, _t403, "no port[s] to connect to", _t452, _t470, _t473);
						}
						_t338 =  *((intOrPtr*)((_t334 + 1 << 3) + _a24));
						if(_t338 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t341 =  *((_t338 << 3) + _a24);
							if(_t341 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t344 =  *((intOrPtr*)((_t341 << 3) + _a24));
							L004074F0();
							_t403 = _t344;
							__eflags = _t403;
							if(_t403 != 0) {
								 *_t403 = 0;
								_t403 = _t403 + 1;
								_v46 = E00403BC0(0, _t403);
								__eflags = _v46;
								if(__eflags == 0) {
									_t452 = _t403;
									E004035DB(_t242, __eflags, _t403, "invalid port %s", _t403, _t471, _t473);
								}
							}
							_t338 =  *((intOrPtr*)((_t344 << 3) + _a24));
							_t413 = _t338;
							_v74 = E00403BC0(0, _t338);
							__eflags = _v74;
							if(_v74 == 0) {
								_t359 = (_t338 << 3) + _a24;
								__eflags = _t359;
								_t338 =  *_t359;
								_t452 = _t338;
								_t413 = "invalid port %s";
								E004035DB(_t242, _t359, _t403, "invalid port %s", _t338, _t471, _t473);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t242 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t338 = _v56;
									_t413 = _t338;
									_v48 = E00403DCA(_t279, _t338, _t338);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t163 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t163;
									if(_t163 != 0) {
										L004074C0();
										_v44 = _t163;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t73 =  &_v44;
											 *_t73 = _v44 + 0x2000;
											__eflags =  *_t73;
										}
									}
								}
								_t242 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t413);
								_t347 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t471 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t452, _v32, _t473);
								_t135 =  *0x408010; // 0xffffffff
								__eflags = _t135;
								if(_t135 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t161 =  *0x408010; // 0xffffffff
											_t452 = _v40;
											_t242 = _t161;
											 *0x408010 = E00404773(_t161, _t347, _v40);
										}
									}
								}
								_t136 =  *0x408010; // 0xffffffff
								__eflags = _t136;
								if(_t136 <= 0) {
									_t279 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L94:
										_t350 = _v24 + 0x100;
										__eflags = _t350;
										_t351 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t471 = _t350;
										_t452 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t350, _t473);
										goto L95;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L94;
									}
									_t351 = __imp__WSAGetLastError;
									_t151 =  *__imp__WSAGetLastError();
									__eflags = _t151 - 0x274d;
									if(_t151 == 0x274d) {
										goto L95;
									}
									goto L94;
								} else {
									_t279 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t471 = _v24 + 0x100;
									_t452 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t473);
									_t351 =  *0x40b0e8;
									__eflags = _t351;
									if(_t351 != 0) {
										E004026FD(_t242, _t351, _t351, _t471);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t351 =  *0x40b0e8;
										__eflags = _t351;
										if(_t351 == 0) {
											_t154 =  *0x408010; // 0xffffffff
											_t242 = _t154;
											_t279 = E00404B7C(_t154, _t277, _t282, _t471, _t473);
										}
									}
									L95:
									_t352 = __imp__shutdown;
									 *_t352();
									_t413 = _t352;
									_t338 = __imp__closesocket;
									 *_t338();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t242 =  *0x40b0cc;
										_t338 = __imp___sleep;
										 *_t338();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t92 =  &_v48;
										 *_t92 = _v48 - 1;
										__eflags =  *_t92;
									} else {
										_t338 = _v56;
										_t413 = _t338;
										_v48 = E00403DCA(_t279, _t338, _t338);
									}
									continue;
								}
							}
							_t165 =  *0x40b048 + 1;
							__eflags = _t165;
							 *0x40b048 = _t165;
						}
						_t360 = __imp___errno;
						 *_t360();
						 *_t360 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t452, _t471, _t473);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t319 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t452, _t471, _t473);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t452, _t471, _t473);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t452, _t471, _t473);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t452, _t471, _t473);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t452, _t471, _t473);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t452, _t471, _t473);
							E004035DB(0, _t319, _t403, "port numbers can be individual or ranges: m-n [inclusive]", _t452, _t471, _t473);
							return 0;
						}
					} else {
						_v48 = 0;
						_t364 =  *((intOrPtr*)((_t331 << 3) + _a24));
						if(_t364 != 0) {
							_t390 =  *((intOrPtr*)((_t364 << 3) + _a24));
							_v48 = E00403BC0(0, _t390);
							if(_v48 == 0) {
								_t452 =  *((intOrPtr*)((_t390 << 3) + _a24));
								E004035DB(_t240, (_t390 << 3) + _a24, _t403, "invalid port %s",  *((intOrPtr*)((_t390 << 3) + _a24)), _t470, _t473);
							}
						}
						_t331 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t471 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t331, _v32, _t473);
						_t194 =  *0x408010; // 0xffffffff
						if(_t194 <= 0) {
							L60:
							E004035DB(_t240, _t312, _t403, "no connection", _t452, _t471, _t473);
							goto L61;
						} else {
							_t365 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t240, _t365, _t365, _t471);
							}
							_t331 =  *0x40b0e8;
							if(_t331 == 0) {
								_t214 =  *0x408010; // 0xffffffff
								_t278 = E00404B7C(_t214, _t277, _t282, _t471, _t473);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t452, _t471, _t473);
							}
							_t312 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								if(_a16 == 1) {
									_t366 = _a24;
									E0040371E(0x400, _t366, _t452);
									_a24 = _t366;
									_t367 = _a24;
									 *_t367 =  *_t366;
									E0040371E(0x2000, _t367, _t452);
									_t405 = _t367;
									 *((long long*)(_a24 + 8)) = _t405;
									_t370 = __imp____iob_func;
									 *_t370();
									_t6 = _t370 + 0x60; // 0x60
									_t473 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t200 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t457 = _t405;
									L00407368(); // executed
									 *0x40b07c = _t200;
									_t285 =  *0x40b07c;
									if( *0x40b07c == 0) {
										E004035DB(0, _t285, _t405, "wrong", _t457, _t471, _t473);
									}
									_t280 = E0040377B( *0x40b07c, _t405);
									if(_t280 != 0) {
										 *0x40b07c =  *0x40b07c - _t280;
									}
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t406 =  *((intOrPtr*)(_a24 + 8));
									if(_t406 != 0) {
										 *_t406 = 0;
									}
									L004074F0();
									_t407 =  *((intOrPtr*)(_a24 + 8));
									if(_t407 != 0) {
										 *_t407 = 0;
									}
									_t403 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t281 = 2;
									while(( *_t403 & 0x000000ff) != 0) {
										__eflags = ( *_t403 & 0x000000ff) - 0x20;
										if(( *_t403 & 0x000000ff) != 0x20) {
											_t11 = _t403 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t281 << 3) + _a24) = _t403;
												_t281 = _t281 + 1;
												__eflags = _t281;
											}
										} else {
											 *_t403 = 0;
										}
										_t403 = _t403 + 1;
										__eflags = _t403;
									}
									_a16 = _t281;
								}
								continue;
							} else {
								_t240 = _t278;
								L00407428();
								goto L60;
							}
						}
					}
				}
				_t14 = _t462 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t323 = __imp___errno;
					 *_t323();
					 *_t323 = 0;
					E004035DB(_t240, __eflags, _t403, "nc -h for help", _t452, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t473);
					goto L31;
				}
				_t452 =  *((intOrPtr*)(0x409b50 + _t322 * 4));
				goto __rax;
			}

0x004055ff
0x004055ff
0x004055ff
0x004055ff
0x004055ff
0x004055ff
0x00405608
0x00405611
0x00405611
0x00405616
0x0040561d
0x00405620
0x00405627
0x0040562c
0x0040562c
0x0040563d
0x00405647
0x0040564c
0x00405650
0x00405655
0x00405667
0x00405667
0x00405673
0x00405673
0x0040567f
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
too many -g hops, xrefs: 0040560A
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d$too many -g hops
API String ID: 3007559463-909044548
Opcode ID: 87ca6f6635c9188b87a7fbc92b53bcf131d77999c7084ea5157d1f83321a5bb5
Instruction ID: 8e437f1b80d787de8f8b3079899cb673138f008f2ce05e725b2ae541dc826503
Opcode Fuzzy Hash: 87ca6f6635c9188b87a7fbc92b53bcf131d77999c7084ea5157d1f83321a5bb5
Instruction Fuzzy Hash: 87B12BA1B00A0486EB10EF26E89136A37A0E744798F44442AEB5DA77E5EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 0040568A Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E0040568A(void* __ecx, void* __edx, void* __edi, void* __esp, signed long long __rbx, void* __rsi, void* __r8, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t94;
				signed int _t106;
				signed int _t130;
				signed int _t131;
				void* _t146;
				signed int _t149;
				signed int _t156;
				signed int _t158;
				signed int _t160;
				signed int _t189;
				intOrPtr _t195;
				signed int _t209;
				void* _t269;
				signed int _t270;
				signed int _t271;
				void* _t272;
				signed int _t273;
				void* _t274;
				signed int* _t312;
				signed long long _t314;
				signed int* _t315;
				signed long long _t320;
				signed long long _t323;
				signed long long _t324;
				intOrPtr _t327;
				signed long long _t331;
				signed long long _t334;
				signed long long _t337;
				signed int _t343;
				signed long long _t345;
				signed int _t352;
				signed int* _t353;
				signed long long _t357;
				intOrPtr* _t359;
				long long _t360;
				long long* _t363;
				signed long long _t383;
				long long _t393;
				long long _t396;
				char* _t397;
				char* _t398;
				long long _t450;
				void* _t452;

				_t463 = __r9;
				_t452 = __rsi;
				_t394 = __rbx;
				_t274 = __esp;
				_t269 = __edi;
				_t312 = __imp___errno;
				_t94 =  *_t312();
				 *_t312 = 0;
				L105();
				L004074B0();
				 *0x40b0cc = _t94 & 0x0000ffff;
				 *0x40b0cc =  *0x40b0cc * 0x3e8;
				if( *0x40b0cc == 0) {
					E004035DB(_t235, __eflags, __rbx, "invalid interval time %s",  *0x40b040, _t460, __r9);
				}
				while(1) {
					L27:
					_t314 = _a24;
					_t460 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t443 = _t314;
					_t235 = _a16;
					_t270 = E00402422(_a16, _t314, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t270 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t236 = 0x10000;
						E0040371E(0x10000, _t314, _t443);
						_v56 = _t314;
					}
					_t320 =  *0x40b0e8;
					if(_t320 != 0) {
						_t236 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t106 =  *0x40b0d4 & 0x0000ffff;
					if(_t106 != 0) {
						_t320 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t106;
						_t288 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t320 =  *0x40b0c0;
							_t443 = _t320;
							E004035DB(_t235, _t288, _t394, "can\'t open %s", _t320, _t460, _t463);
						}
						_t236 = 0x64;
						E0040371E(0x64, _t320, _t443);
						 *0x40b0c0 = _t320;
					}
					_t323 =  *((intOrPtr*)((_t320 << 3) + _a24));
					if(_t323 != 0) {
						_t393 =  *((intOrPtr*)((_t323 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t393, _t443, _t463);
						_v24 = _t393;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t324 = __imp___errno;
					 *_t324();
					 *_t324 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L57:
						_t305 = _v40;
						if(_v40 == 0) {
							E004035DB(_t235, _t305, _t394, "no destination", _t443, _t460, _t463);
						}
						_t327 =  *((intOrPtr*)((_t324 << 3) + _a24));
						_t306 = _t327;
						if(_t327 == 0) {
							E004035DB(_t235, _t306, _t394, "no port[s] to connect to", _t443, _t460, _t463);
						}
						_t331 =  *((intOrPtr*)((_t327 + 1 << 3) + _a24));
						if(_t331 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t334 =  *((_t331 << 3) + _a24);
							if(_t334 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t337 =  *((intOrPtr*)((_t334 << 3) + _a24));
							L004074F0();
							_t394 = _t337;
							__eflags = _t394;
							if(_t394 != 0) {
								 *_t394 = 0;
								_t394 = _t394 + 1;
								_v46 = E00403BC0(0, _t394);
								__eflags = _v46;
								if(__eflags == 0) {
									_t443 = _t394;
									E004035DB(_t236, __eflags, _t394, "invalid port %s", _t394, _t461, _t463);
								}
							}
							_t331 =  *((intOrPtr*)((_t337 << 3) + _a24));
							_t404 = _t331;
							_v74 = E00403BC0(0, _t331);
							__eflags = _v74;
							if(_v74 == 0) {
								_t352 = (_t331 << 3) + _a24;
								__eflags = _t352;
								_t331 =  *_t352;
								_t443 = _t331;
								_t404 = "invalid port %s";
								E004035DB(_t236, _t352, _t394, "invalid port %s", _t331, _t461, _t463);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t236 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t331 = _v56;
									_t404 = _t331;
									_v48 = E00403DCA(_t271, _t331, _t331);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t158 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t158;
									if(_t158 != 0) {
										L004074C0();
										_v44 = _t158;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t236 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t404);
								_t340 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t461 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t443, _v32, _t463);
								_t130 =  *0x408010; // 0xffffffff
								__eflags = _t130;
								if(_t130 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t156 =  *0x408010; // 0xffffffff
											_t443 = _v40;
											_t236 = _t156;
											 *0x408010 = E00404773(_t156, _t340, _v40);
										}
									}
								}
								_t131 =  *0x408010; // 0xffffffff
								__eflags = _t131;
								if(_t131 <= 0) {
									_t271 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L90:
										_t343 = _v24 + 0x100;
										__eflags = _t343;
										_t344 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t461 = _t343;
										_t443 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t343, _t463);
										goto L91;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L90;
									}
									_t344 = __imp__WSAGetLastError;
									_t146 =  *__imp__WSAGetLastError();
									__eflags = _t146 - 0x274d;
									if(_t146 == 0x274d) {
										goto L91;
									}
									goto L90;
								} else {
									_t271 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t461 = _v24 + 0x100;
									_t443 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t463);
									_t344 =  *0x40b0e8;
									__eflags = _t344;
									if(_t344 != 0) {
										E004026FD(_t236, _t344, _t344, _t461);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t344 =  *0x40b0e8;
										__eflags = _t344;
										if(_t344 == 0) {
											_t149 =  *0x408010; // 0xffffffff
											_t236 = _t149;
											_t271 = E00404B7C(_t149, _t269, _t274, _t461, _t463);
										}
									}
									L91:
									_t345 = __imp__shutdown;
									 *_t345();
									_t404 = _t345;
									_t331 = __imp__closesocket;
									 *_t331();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t236 =  *0x40b0cc;
										_t331 = __imp___sleep;
										 *_t331();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t331 = _v56;
										_t404 = _t331;
										_v48 = E00403DCA(_t271, _t331, _t331);
									}
									continue;
								}
							}
							_t160 =  *0x40b048 + 1;
							__eflags = _t160;
							 *0x40b048 = _t160;
						}
						_t353 = __imp___errno;
						 *_t353();
						 *_t353 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t443, _t461, _t463);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t311 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t443, _t461, _t463);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t443, _t461, _t463);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t443, _t461, _t463);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t443, _t461, _t463);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t443, _t461, _t463);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t443, _t461, _t463);
							E004035DB(0, _t311, _t394, "port numbers can be individual or ranges: m-n [inclusive]", _t443, _t461, _t463);
							return 0;
						}
					} else {
						_v48 = 0;
						_t357 =  *((intOrPtr*)((_t324 << 3) + _a24));
						if(_t357 != 0) {
							_t383 =  *((intOrPtr*)((_t357 << 3) + _a24));
							_v48 = E00403BC0(0, _t383);
							if(_v48 == 0) {
								_t443 =  *((intOrPtr*)((_t383 << 3) + _a24));
								E004035DB(_t235, (_t383 << 3) + _a24, _t394, "invalid port %s",  *((intOrPtr*)((_t383 << 3) + _a24)), _t460, _t463);
							}
						}
						_t324 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t461 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t324, _v32, _t463);
						_t189 =  *0x408010; // 0xffffffff
						if(_t189 <= 0) {
							L56:
							E004035DB(_t235, _t304, _t394, "no connection", _t443, _t461, _t463);
							goto L57;
						} else {
							_t358 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t235, _t358, _t358, _t461);
							}
							_t324 =  *0x40b0e8;
							if(_t324 == 0) {
								_t209 =  *0x408010; // 0xffffffff
								_t270 = E00404B7C(_t209, _t269, _t274, _t461, _t463);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t443, _t461, _t463);
							}
							_t304 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								if(_a16 == 1) {
									_t359 = _a24;
									E0040371E(0x400, _t359, _t443);
									_a24 = _t359;
									_t360 = _a24;
									 *_t360 =  *_t359;
									E0040371E(0x2000, _t360, _t443);
									_t396 = _t360;
									 *((long long*)(_a24 + 8)) = _t396;
									_t363 = __imp____iob_func;
									 *_t363();
									_t6 = _t363 + 0x60; // 0x60
									_t463 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t195 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t450 = _t396;
									L00407368(); // executed
									 *0x40b07c = _t195;
									_t277 =  *0x40b07c;
									if( *0x40b07c == 0) {
										E004035DB(0, _t277, _t396, "wrong", _t450, _t461, _t463);
									}
									_t272 = E0040377B( *0x40b07c, _t396);
									if(_t272 != 0) {
										 *0x40b07c =  *0x40b07c - _t272;
									}
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t397 =  *((intOrPtr*)(_a24 + 8));
									if(_t397 != 0) {
										 *_t397 = 0;
									}
									L004074F0();
									_t398 =  *((intOrPtr*)(_a24 + 8));
									if(_t398 != 0) {
										 *_t398 = 0;
									}
									_t394 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t273 = 2;
									while(( *_t394 & 0x000000ff) != 0) {
										__eflags = ( *_t394 & 0x000000ff) - 0x20;
										if(( *_t394 & 0x000000ff) != 0x20) {
											_t11 = _t394 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t273 << 3) + _a24) = _t394;
												_t273 = _t273 + 1;
												__eflags = _t273;
											}
										} else {
											 *_t394 = 0;
										}
										_t394 = _t394 + 1;
										__eflags = _t394;
									}
									_a16 = _t273;
								}
								continue;
							} else {
								_t235 = _t270;
								L00407428();
								goto L56;
							}
						}
					}
				}
				_t14 = _t452 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t315 = __imp___errno;
					 *_t315();
					 *_t315 = 0;
					E004035DB(_t235, __eflags, _t394, "nc -h for help", _t443, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t463);
					goto L27;
				}
				goto __rax;
			}

0x0040568a
0x0040568a
0x0040568a
0x0040568a
0x0040568a
0x0040568a
0x00405691
0x00405693
0x00405699
0x004056a8
0x004056b2
0x004056c4
0x004056d2
0x004056e9
0x004056e9
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
invalid interval time %s, xrefs: 004056E2
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid interval time %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 3007559463-4285341050
Opcode ID: 7db0b8ca37dfe16f10ebca187822d17eefff9d87851ab826b924773274c8b7cc
Instruction ID: fc8d50b5f30da4e9a3539b8203064f8c1c5d40110fba828f126db5dd2a13a262
Opcode Fuzzy Hash: 7db0b8ca37dfe16f10ebca187822d17eefff9d87851ab826b924773274c8b7cc
Instruction Fuzzy Hash: 09B121A1711A0486EB10DF26E89136A37A0FB44788F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 0040581F Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E0040581F(intOrPtr __eax, void* __ecx, void* __edx, void* __edi, void* __esp, signed long long __rbx, void* __rsi, void* __r8, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t105;
				signed int _t129;
				signed int _t130;
				void* _t145;
				signed int _t148;
				signed int _t155;
				signed int _t157;
				signed int _t159;
				signed int _t188;
				intOrPtr _t194;
				signed int _t208;
				void* _t271;
				signed int _t272;
				signed int _t273;
				void* _t274;
				signed int _t275;
				void* _t276;
				signed long long _t314;
				signed long long _t316;
				signed int* _t317;
				signed long long _t321;
				signed long long _t324;
				signed long long _t325;
				intOrPtr _t328;
				signed long long _t332;
				signed long long _t335;
				signed long long _t338;
				signed int _t344;
				signed long long _t346;
				signed int _t353;
				signed int* _t354;
				signed long long _t358;
				intOrPtr* _t360;
				long long _t361;
				long long* _t364;
				signed long long _t384;
				long long _t394;
				long long _t397;
				char* _t398;
				char* _t399;
				long long _t450;
				void* _t452;

				_t463 = __r9;
				_t452 = __rsi;
				_t395 = __rbx;
				_t276 = __esp;
				_t271 = __edi;
				_t314 =  *0x40b040;
				L004074B0();
				 *0x40b0dc = __eax;
				if( *0x40b0dc == 0) {
					_t314 =  *0x40b040;
					_t444 = _t314;
					E004035DB(_t236, __eflags, __rbx, "invalid wait-time %s", _t314, _t460, __r9);
				}
				E0040371E(8, _t314, _t444);
				 *0x40b088 = _t314;
				E0040371E(8, _t314, _t444);
				 *0x40b090 = _t314;
				 *( *0x40b088) =  *0x40b0dc;
				while(1) {
					L27:
					_t316 = _a24;
					_t460 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t444 = _t316;
					_t236 = _a16;
					_t272 = E00402422(_a16, _t316, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t272 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t237 = 0x10000;
						E0040371E(0x10000, _t316, _t444);
						_v56 = _t316;
					}
					_t321 =  *0x40b0e8;
					if(_t321 != 0) {
						_t237 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t105 =  *0x40b0d4 & 0x0000ffff;
					if(_t105 != 0) {
						_t321 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t105;
						_t290 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t321 =  *0x40b0c0;
							_t444 = _t321;
							E004035DB(_t236, _t290, _t395, "can\'t open %s", _t321, _t460, _t463);
						}
						_t237 = 0x64;
						E0040371E(0x64, _t321, _t444);
						 *0x40b0c0 = _t321;
					}
					_t324 =  *((intOrPtr*)((_t321 << 3) + _a24));
					if(_t324 != 0) {
						_t394 =  *((intOrPtr*)((_t324 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t394, _t444, _t463);
						_v24 = _t394;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t325 = __imp___errno;
					 *_t325();
					 *_t325 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L57:
						_t307 = _v40;
						if(_v40 == 0) {
							E004035DB(_t236, _t307, _t395, "no destination", _t444, _t460, _t463);
						}
						_t328 =  *((intOrPtr*)((_t325 << 3) + _a24));
						_t308 = _t328;
						if(_t328 == 0) {
							E004035DB(_t236, _t308, _t395, "no port[s] to connect to", _t444, _t460, _t463);
						}
						_t332 =  *((intOrPtr*)((_t328 + 1 << 3) + _a24));
						if(_t332 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t335 =  *((_t332 << 3) + _a24);
							if(_t335 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t338 =  *((intOrPtr*)((_t335 << 3) + _a24));
							L004074F0();
							_t395 = _t338;
							__eflags = _t395;
							if(_t395 != 0) {
								 *_t395 = 0;
								_t395 = _t395 + 1;
								_v46 = E00403BC0(0, _t395);
								__eflags = _v46;
								if(__eflags == 0) {
									_t444 = _t395;
									E004035DB(_t237, __eflags, _t395, "invalid port %s", _t395, _t461, _t463);
								}
							}
							_t332 =  *((intOrPtr*)((_t338 << 3) + _a24));
							_t405 = _t332;
							_v74 = E00403BC0(0, _t332);
							__eflags = _v74;
							if(_v74 == 0) {
								_t353 = (_t332 << 3) + _a24;
								__eflags = _t353;
								_t332 =  *_t353;
								_t444 = _t332;
								_t405 = "invalid port %s";
								E004035DB(_t237, _t353, _t395, "invalid port %s", _t332, _t461, _t463);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t237 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t332 = _v56;
									_t405 = _t332;
									_v48 = E00403DCA(_t273, _t332, _t332);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t157 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t157;
									if(_t157 != 0) {
										L004074C0();
										_v44 = _t157;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t237 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t405);
								_t341 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t461 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t444, _v32, _t463);
								_t129 =  *0x408010; // 0xffffffff
								__eflags = _t129;
								if(_t129 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t155 =  *0x408010; // 0xffffffff
											_t444 = _v40;
											_t237 = _t155;
											 *0x408010 = E00404773(_t155, _t341, _v40);
										}
									}
								}
								_t130 =  *0x408010; // 0xffffffff
								__eflags = _t130;
								if(_t130 <= 0) {
									_t273 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L90:
										_t344 = _v24 + 0x100;
										__eflags = _t344;
										_t345 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t461 = _t344;
										_t444 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t344, _t463);
										goto L91;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L90;
									}
									_t345 = __imp__WSAGetLastError;
									_t145 =  *__imp__WSAGetLastError();
									__eflags = _t145 - 0x274d;
									if(_t145 == 0x274d) {
										goto L91;
									}
									goto L90;
								} else {
									_t273 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t461 = _v24 + 0x100;
									_t444 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t463);
									_t345 =  *0x40b0e8;
									__eflags = _t345;
									if(_t345 != 0) {
										E004026FD(_t237, _t345, _t345, _t461);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t345 =  *0x40b0e8;
										__eflags = _t345;
										if(_t345 == 0) {
											_t148 =  *0x408010; // 0xffffffff
											_t237 = _t148;
											_t273 = E00404B7C(_t148, _t271, _t276, _t461, _t463);
										}
									}
									L91:
									_t346 = __imp__shutdown;
									 *_t346();
									_t405 = _t346;
									_t332 = __imp__closesocket;
									 *_t332();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t237 =  *0x40b0cc;
										_t332 = __imp___sleep;
										 *_t332();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t332 = _v56;
										_t405 = _t332;
										_v48 = E00403DCA(_t273, _t332, _t332);
									}
									continue;
								}
							}
							_t159 =  *0x40b048 + 1;
							__eflags = _t159;
							 *0x40b048 = _t159;
						}
						_t354 = __imp___errno;
						 *_t354();
						 *_t354 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t444, _t461, _t463);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t313 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t444, _t461, _t463);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t444, _t461, _t463);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t444, _t461, _t463);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t444, _t461, _t463);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t444, _t461, _t463);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t444, _t461, _t463);
							E004035DB(0, _t313, _t395, "port numbers can be individual or ranges: m-n [inclusive]", _t444, _t461, _t463);
							return 0;
						}
					} else {
						_v48 = 0;
						_t358 =  *((intOrPtr*)((_t325 << 3) + _a24));
						if(_t358 != 0) {
							_t384 =  *((intOrPtr*)((_t358 << 3) + _a24));
							_v48 = E00403BC0(0, _t384);
							if(_v48 == 0) {
								_t444 =  *((intOrPtr*)((_t384 << 3) + _a24));
								E004035DB(_t236, (_t384 << 3) + _a24, _t395, "invalid port %s",  *((intOrPtr*)((_t384 << 3) + _a24)), _t460, _t463);
							}
						}
						_t325 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t461 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t325, _v32, _t463);
						_t188 =  *0x408010; // 0xffffffff
						if(_t188 <= 0) {
							L56:
							E004035DB(_t236, _t306, _t395, "no connection", _t444, _t461, _t463);
							goto L57;
						} else {
							_t359 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t236, _t359, _t359, _t461);
							}
							_t325 =  *0x40b0e8;
							if(_t325 == 0) {
								_t208 =  *0x408010; // 0xffffffff
								_t272 = E00404B7C(_t208, _t271, _t276, _t461, _t463);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t444, _t461, _t463);
							}
							_t306 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								if(_a16 == 1) {
									_t360 = _a24;
									E0040371E(0x400, _t360, _t444);
									_a24 = _t360;
									_t361 = _a24;
									 *_t361 =  *_t360;
									E0040371E(0x2000, _t361, _t444);
									_t397 = _t361;
									 *((long long*)(_a24 + 8)) = _t397;
									_t364 = __imp____iob_func;
									 *_t364();
									_t6 = _t364 + 0x60; // 0x60
									_t463 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t194 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t450 = _t397;
									L00407368(); // executed
									 *0x40b07c = _t194;
									_t279 =  *0x40b07c;
									if( *0x40b07c == 0) {
										E004035DB(0, _t279, _t397, "wrong", _t450, _t461, _t463);
									}
									_t274 = E0040377B( *0x40b07c, _t397);
									if(_t274 != 0) {
										 *0x40b07c =  *0x40b07c - _t274;
									}
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t398 =  *((intOrPtr*)(_a24 + 8));
									if(_t398 != 0) {
										 *_t398 = 0;
									}
									L004074F0();
									_t399 =  *((intOrPtr*)(_a24 + 8));
									if(_t399 != 0) {
										 *_t399 = 0;
									}
									_t395 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t275 = 2;
									while(( *_t395 & 0x000000ff) != 0) {
										__eflags = ( *_t395 & 0x000000ff) - 0x20;
										if(( *_t395 & 0x000000ff) != 0x20) {
											_t11 = _t395 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t275 << 3) + _a24) = _t395;
												_t275 = _t275 + 1;
												__eflags = _t275;
											}
										} else {
											 *_t395 = 0;
										}
										_t395 = _t395 + 1;
										__eflags = _t395;
									}
									_a16 = _t275;
								}
								continue;
							} else {
								_t236 = _t272;
								L00407428();
								goto L56;
							}
						}
					}
				}
				_t14 = _t452 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t317 = __imp___errno;
					 *_t317();
					 *_t317 = 0;
					E004035DB(_t236, __eflags, _t395, "nc -h for help", _t444, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t463);
					goto L27;
				}
				goto __rax;
			}

0x0040581f
0x0040581f
0x0040581f
0x0040581f
0x0040581f
0x0040581f
0x00405829
0x0040582e
0x0040583c
0x0040583e
0x00405845
0x0040584f
0x0040584f
0x00405859
0x0040585e
0x0040586a
0x0040586f
0x00405883
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
invalid wait-time %s, xrefs: 00405848
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$invalid wait-time %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 3007559463-633440223
Opcode ID: 76f88a5d1358f924b7e8d9898098cb5b8bac9a8561e16428d76b4f049ea4efc6
Instruction ID: 05b4733661cf0231066567cd4c170bdb3769fcc207079a19a1e9e71d0c46e157
Opcode Fuzzy Hash: 76f88a5d1358f924b7e8d9898098cb5b8bac9a8561e16428d76b4f049ea4efc6
Instruction Fuzzy Hash: 4AB11DA1700A0486EB10EF26E89136A37A0F744798F44442AEB5DB77E5EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004055C3 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E004055C3(signed int __eax, void* __edx, void* __edi, void* __esp, signed long long __rbx, void* __rsi, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t104;
				signed int _t128;
				signed int _t129;
				void* _t144;
				signed int _t147;
				signed int _t154;
				signed int _t156;
				signed int _t158;
				signed int _t187;
				intOrPtr _t193;
				signed int _t207;
				void* _t267;
				signed int _t269;
				void* _t270;
				signed int _t271;
				void* _t272;
				signed long long _t311;
				signed int* _t312;
				signed long long _t316;
				signed long long _t319;
				signed long long _t320;
				intOrPtr _t323;
				signed long long _t327;
				signed long long _t330;
				signed long long _t333;
				signed int _t339;
				signed long long _t341;
				signed int _t348;
				signed int* _t349;
				signed long long _t353;
				intOrPtr* _t355;
				long long _t356;
				long long* _t359;
				signed long long _t379;
				long long _t389;
				signed long long _t390;
				long long _t392;
				char* _t393;
				char* _t394;
				long long _t444;
				void* _t446;
				void* _t456;

				_t456 = __r9;
				_t446 = __rsi;
				_t390 = __rbx;
				_t272 = __esp;
				_t267 = __edi;
				L004074B0();
				_t268 = __eax;
				if(__eax == 0) {
					L26:
					E004035DB(_t232, __eflags, _t390, "invalid hop pointer %d, must be multiple of 4 <= 28", _t439, _t453, _t456);
					goto L28;
				} else {
					__eflags = (__eax & 0x0000001c) - __eax;
					if(__eflags != 0) {
						goto L26;
					}
					 *0x408028 = __eax;
					while(1) {
						L28:
						_t311 = _a24;
						_t453 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
						_t439 = _t311;
						_t232 = _a16;
						_t268 = E00402422(_a16, _t311, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
						if(_t268 != 0xffffffff) {
							break;
						}
						if(( *0x40b0d6 & 0x0000ffff) != 0) {
							L004073A0();
							L004074F8();
							_t233 = 0x10000;
							E0040371E(0x10000, _t311, _t439);
							_v56 = _t311;
						}
						_t316 =  *0x40b0e8;
						if(_t316 != 0) {
							_t233 = 0;
							L00407358();
							 *0x40b0d4 = 0;
							 *0x40b074 = 0;
						}
						_t104 =  *0x40b0d4 & 0x0000ffff;
						if(_t104 != 0) {
							_t316 =  *0x40b0c0;
							r8d = 0x1b4;
							L00407370();
							 *0x40b074 = _t104;
							_t286 =  *0x40b074;
							if( *0x40b074 <= 0) {
								_t316 =  *0x40b0c0;
								_t439 = _t316;
								E004035DB(_t232, _t286, _t390, "can\'t open %s", _t316, _t453, _t456);
							}
							_t233 = 0x64;
							E0040371E(0x64, _t316, _t439);
							 *0x40b0c0 = _t316;
						}
						_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
						if(_t319 != 0) {
							_t389 =  *((intOrPtr*)((_t319 << 3) + _a24));
							E00403841( *0x40b0d2 & 0xffff, _t389, _t439, _t456);
							_v24 = _t389;
						}
						if(_v24 != 0 && _v24 + 0x1c0 != 0) {
							_v40 = _v24 + 0x1c0;
						}
						if(_v40 != 0) {
							 *0x40b048 =  *0x40b048 + 1;
						}
						_t320 = __imp___errno;
						 *_t320();
						 *_t320 = 0;
						if(( *0x40b0d0 & 0x0000ffff) == 0) {
							L58:
							_t303 = _v40;
							if(_v40 == 0) {
								E004035DB(_t232, _t303, _t390, "no destination", _t439, _t453, _t456);
							}
							_t323 =  *((intOrPtr*)((_t320 << 3) + _a24));
							_t304 = _t323;
							if(_t323 == 0) {
								E004035DB(_t232, _t304, _t390, "no port[s] to connect to", _t439, _t453, _t456);
							}
							_t327 =  *((intOrPtr*)((_t323 + 1 << 3) + _a24));
							if(_t327 != 0) {
								 *0x40802c = 0;
							}
							_v44 = _v42 & 0x0000ffff;
							while(1) {
								_t330 =  *((_t327 << 3) + _a24);
								if(_t330 == 0) {
									break;
								}
								_v74 = 0;
								_v46 = _v74 & 0x0000ffff;
								_t333 =  *((intOrPtr*)((_t330 << 3) + _a24));
								L004074F0();
								_t390 = _t333;
								__eflags = _t390;
								if(_t390 != 0) {
									 *_t390 = 0;
									_t390 = _t390 + 1;
									_v46 = E00403BC0(0, _t390);
									__eflags = _v46;
									if(__eflags == 0) {
										_t439 = _t390;
										E004035DB(_t233, __eflags, _t390, "invalid port %s", _t390, _t454, _t456);
									}
								}
								_t327 =  *((intOrPtr*)((_t333 << 3) + _a24));
								_t400 = _t327;
								_v74 = E00403BC0(0, _t327);
								__eflags = _v74;
								if(_v74 == 0) {
									_t348 = (_t327 << 3) + _a24;
									__eflags = _t348;
									_t327 =  *_t348;
									_t439 = _t327;
									_t400 = "invalid port %s";
									E004035DB(_t233, _t348, _t390, "invalid port %s", _t327, _t454, _t456);
								}
								__eflags = (_v46 & 0x0000ffff) - _v74;
								if((_v46 & 0x0000ffff) <= _v74) {
									_v48 = _v74 & 0x0000ffff;
								} else {
									 *0x40802c = 0;
									_v48 = _v46 & 0x0000ffff;
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) != 0) {
										_t233 = _v46 & 0x0000ffff;
										r8d = _v46 & 0x0000ffff;
										E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
										_t327 = _v56;
										_t400 = _t327;
										_v48 = E00403DCA(_t269, _t327, _t327);
									}
								}
								while(1) {
									__eflags = (_v74 & 0x0000ffff) - _v48;
									if((_v74 & 0x0000ffff) > _v48) {
										break;
									}
									__eflags = _v42;
									if(_v42 == 0) {
										_t156 =  *0x40b0d6 & 0x0000ffff;
										__eflags = _t156;
										if(_t156 != 0) {
											L004074C0();
											_v44 = _t156;
											__eflags = _v44 - 0x1fff;
											if(_v44 <= 0x1fff) {
												_t69 =  &_v44;
												 *_t69 = _v44 + 0x2000;
												__eflags =  *_t69;
											}
										}
									}
									_t233 = 0;
									_v48 = E00403BC0(_v48 & 0x0000ffff, _t400);
									_t336 = _v40;
									r9d = _v44 & 0x0000ffff;
									_t454 = _v32;
									 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t439, _v32, _t456);
									_t128 =  *0x408010; // 0xffffffff
									__eflags = _t128;
									if(_t128 > 0) {
										__eflags =  *0x40b0e0 & 0x0000ffff;
										if(( *0x40b0e0 & 0x0000ffff) != 0) {
											__eflags =  *0x40b0d8 & 0x0000ffff;
											if(( *0x40b0d8 & 0x0000ffff) != 0) {
												_t154 =  *0x408010; // 0xffffffff
												_t439 = _v40;
												_t233 = _t154;
												 *0x408010 = E00404773(_t154, _t336, _v40);
											}
										}
									}
									_t129 =  *0x408010; // 0xffffffff
									__eflags = _t129;
									if(_t129 <= 0) {
										_t269 = 1;
										__eflags =  *0x40802c & 0x0000ffff;
										if(( *0x40802c & 0x0000ffff) != 0) {
											L91:
											_t339 = _v24 + 0x100;
											__eflags = _t339;
											_t340 = _v24;
											_a32 =  *0x40b0b8;
											r9d = _v48 & 0x0000ffff;
											_t454 = _t339;
											_t439 = _v24;
											E004034EB("%s [%s] %d (%s)", _v24, _t339, _t456);
											goto L92;
										}
										__eflags = ( *0x40b0da & 0x0000ffff) - 1;
										if(( *0x40b0da & 0x0000ffff) > 1) {
											goto L91;
										}
										_t340 = __imp__WSAGetLastError;
										_t144 =  *__imp__WSAGetLastError();
										__eflags = _t144 - 0x274d;
										if(_t144 == 0x274d) {
											goto L92;
										}
										goto L91;
									} else {
										_t269 = 0;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t454 = _v24 + 0x100;
										_t439 = _v24;
										E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t456);
										_t340 =  *0x40b0e8;
										__eflags = _t340;
										if(_t340 != 0) {
											E004026FD(_t233, _t340, _t340, _t454);
										}
										__eflags =  *0x40b0e0 & 0x0000ffff;
										if(( *0x40b0e0 & 0x0000ffff) == 0) {
											_t340 =  *0x40b0e8;
											__eflags = _t340;
											if(_t340 == 0) {
												_t147 =  *0x408010; // 0xffffffff
												_t233 = _t147;
												_t269 = E00404B7C(_t147, _t267, _t272, _t454, _t456);
											}
										}
										L92:
										_t341 = __imp__shutdown;
										 *_t341();
										_t400 = _t341;
										_t327 = __imp__closesocket;
										 *_t327();
										__eflags =  *0x40b0cc;
										if( *0x40b0cc != 0) {
											_t233 =  *0x40b0cc;
											_t327 = __imp___sleep;
											 *_t327();
										}
										__eflags =  *0x40b0d6 & 0x0000ffff;
										if(( *0x40b0d6 & 0x0000ffff) == 0) {
											_t88 =  &_v48;
											 *_t88 = _v48 - 1;
											__eflags =  *_t88;
										} else {
											_t327 = _v56;
											_t400 = _t327;
											_v48 = E00403DCA(_t269, _t327, _t327);
										}
										continue;
									}
								}
								_t158 =  *0x40b048 + 1;
								__eflags = _t158;
								 *0x40b048 = _t158;
							}
							_t349 = __imp___errno;
							 *_t349();
							 *_t349 = 0;
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB("sent %d, rcvd %d", _t439, _t454, _t456);
							}
							 *__imp__WSACleanup();
							if(_v60 == 1) {
								goto L3;
							} else {
								_t309 =  *0x40802c & 0x0000ffff;
								if(( *0x40802c & 0x0000ffff) != 0) {
									L00407428();
								}
								L00407428();
								 *0x40b0da = 1;
								E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t439, _t454, _t456);
								E004034EB("\t-d\t\tdetach from console, background mode\n", _t439, _t454, _t456);
								E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t439, _t454, _t456);
								E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t439, _t454, _t456);
								E004034EB("\t-t\t\tanswer TELNET negotiation", _t439, _t454, _t456);
								E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t439, _t454, _t456);
								E004035DB(0, _t309, _t390, "port numbers can be individual or ranges: m-n [inclusive]", _t439, _t454, _t456);
								return 0;
							}
						} else {
							_v48 = 0;
							_t353 =  *((intOrPtr*)((_t320 << 3) + _a24));
							if(_t353 != 0) {
								_t379 =  *((intOrPtr*)((_t353 << 3) + _a24));
								_v48 = E00403BC0(0, _t379);
								if(_v48 == 0) {
									_t439 =  *((intOrPtr*)((_t379 << 3) + _a24));
									E004035DB(_t232, (_t379 << 3) + _a24, _t390, "invalid port %s",  *((intOrPtr*)((_t379 << 3) + _a24)), _t453, _t456);
								}
							}
							_t320 = _v40;
							r9d = _v42 & 0x0000ffff;
							_t454 = _v32;
							 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t320, _v32, _t456);
							_t187 =  *0x408010; // 0xffffffff
							if(_t187 <= 0) {
								L57:
								E004035DB(_t232, _t302, _t390, "no connection", _t439, _t454, _t456);
								goto L58;
							} else {
								_t354 =  *0x40b0e8;
								if( *0x40b0e8 != 0) {
									E004026FD(_t232, _t354, _t354, _t454);
								}
								_t320 =  *0x40b0e8;
								if(_t320 == 0) {
									_t207 =  *0x408010; // 0xffffffff
									_t268 = E00404B7C(_t207, _t267, _t272, _t454, _t456);
								}
								if(( *0x40b0da & 0x0000ffff) > 1) {
									r8d =  *0x40b080;
									E004034EB(" sent %d, rcvd %d", _t439, _t454, _t456);
								}
								_t302 = _v60 - 1;
								if(_v60 == 1) {
									L3:
									if(_a16 == 1) {
										_t355 = _a24;
										E0040371E(0x400, _t355, _t439);
										_a24 = _t355;
										_t356 = _a24;
										 *_t356 =  *_t355;
										E0040371E(0x2000, _t356, _t439);
										_t392 = _t356;
										 *((long long*)(_a24 + 8)) = _t392;
										_t359 = __imp____iob_func;
										 *_t359();
										_t6 = _t359 + 0x60; // 0x60
										_t456 = _t6;
										r8d = 0xa;
										L004074E8(); // executed
										_t193 =  *__imp____iob_func();
										L00407490();
										r8d = 0x2000;
										_t444 = _t392;
										L00407368(); // executed
										 *0x40b07c = _t193;
										_t275 =  *0x40b07c;
										if( *0x40b07c == 0) {
											E004035DB(0, _t275, _t392, "wrong", _t444, _t454, _t456);
										}
										_t270 = E0040377B( *0x40b07c, _t392);
										if(_t270 != 0) {
											 *0x40b07c =  *0x40b07c - _t270;
										}
										if( *0x40b07c != 0) {
											L004073F8();
										}
										L004074F0();
										_t393 =  *((intOrPtr*)(_a24 + 8));
										if(_t393 != 0) {
											 *_t393 = 0;
										}
										L004074F0();
										_t394 =  *((intOrPtr*)(_a24 + 8));
										if(_t394 != 0) {
											 *_t394 = 0;
										}
										_t390 =  *((intOrPtr*)(_a24 + 8)) + 1;
										_t271 = 2;
										while(( *_t390 & 0x000000ff) != 0) {
											__eflags = ( *_t390 & 0x000000ff) - 0x20;
											if(( *_t390 & 0x000000ff) != 0x20) {
												_t11 = _t390 - 1; // -2
												__eflags =  *_t11 & 0x000000ff;
												if(( *_t11 & 0x000000ff) == 0) {
													 *((_t271 << 3) + _a24) = _t390;
													_t271 = _t271 + 1;
													__eflags = _t271;
												}
											} else {
												 *_t390 = 0;
											}
											_t390 = _t390 + 1;
											__eflags = _t390;
										}
										_a16 = _t271;
									}
									continue;
								} else {
									_t232 = _t268;
									L00407428();
									goto L57;
								}
							}
						}
					}
					_t14 = _t446 - 0x47; // -71
					__eflags = _t14 - 0x33;
					if(__eflags > 0) {
						_t312 = __imp___errno;
						 *_t312();
						 *_t312 = 0;
						E004035DB(_t232, __eflags, _t390, "nc -h for help", _t439, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t456);
						goto L28;
					}
					_t439 =  *((intOrPtr*)(0x409b50 + _t311 * 4));
					goto __rax;
				}
			}

0x004055c3
0x004055c3
0x004055c3
0x004055c3
0x004055c3
0x004055cd
0x004055d2
0x004055d6
0x004055ec
0x004055f5
0x00000000
0x004055d8
0x004055dd
0x004055df
0x00000000
0x00000000
0x004055e1
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
invalid hop pointer %d, must be multiple of 4 <= 28, xrefs: 004055EE
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid hop pointer %d, must be multiple of 4 <= 28$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 3007559463-3941223175
Opcode ID: fe10ccebe754170c8a62fe9969b43f30d820fffeb18aaa36aa2d431ed5819ef3
Instruction ID: b395948c6c4bd3e0e78c5d0e51a79d20c3281f9b485f8eef4a6e79a4afb90c63
Opcode Fuzzy Hash: fe10ccebe754170c8a62fe9969b43f30d820fffeb18aaa36aa2d431ed5819ef3
Instruction Fuzzy Hash: ECB13EA1B00A1486EB10DF25E89136A37A0F744798F44442AEB5DB73E5EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405743 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00405743(void* __ecx, void* __edi, void* __esp, signed long long __rbx, signed long long __rdx, void* __rsi, void* __r8, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t104;
				signed int _t128;
				signed int _t129;
				void* _t144;
				signed int _t147;
				signed int _t154;
				signed int _t156;
				signed int _t158;
				signed int _t187;
				intOrPtr _t193;
				signed int _t207;
				void* _t267;
				signed int _t268;
				signed int _t269;
				void* _t270;
				signed int _t271;
				void* _t272;
				signed long long _t311;
				signed int* _t312;
				signed long long _t317;
				signed long long _t320;
				signed long long _t321;
				intOrPtr _t324;
				signed long long _t328;
				signed long long _t331;
				signed long long _t334;
				signed int _t340;
				signed long long _t342;
				signed int _t349;
				signed int* _t350;
				signed long long _t354;
				intOrPtr* _t356;
				long long _t357;
				long long* _t360;
				signed long long _t380;
				long long _t390;
				long long _t393;
				char* _t394;
				char* _t395;
				long long _t447;
				void* _t449;

				_t460 = __r9;
				_t449 = __rsi;
				_t440 = __rdx;
				_t391 = __rbx;
				_t272 = __esp;
				_t267 = __edi;
				_v42 = E00403BC0(0,  *0x40b040);
				if(_v42 == 0) {
					E004035DB(_t233, __eflags, __rbx, "invalid local port %s",  *0x40b040, _t457, __r9);
				}
				while(1) {
					L27:
					_t311 = _a24;
					_t457 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t440 = _t311;
					_t233 = _a16;
					_t268 = E00402422(_a16, _t311, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t268 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t234 = 0x10000;
						E0040371E(0x10000, _t311, _t440);
						_v56 = _t311;
					}
					_t317 =  *0x40b0e8;
					if(_t317 != 0) {
						_t234 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t104 =  *0x40b0d4 & 0x0000ffff;
					if(_t104 != 0) {
						_t317 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t104;
						_t286 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t317 =  *0x40b0c0;
							_t440 = _t317;
							E004035DB(_t233, _t286, _t391, "can\'t open %s", _t317, _t457, _t460);
						}
						_t234 = 0x64;
						E0040371E(0x64, _t317, _t440);
						 *0x40b0c0 = _t317;
					}
					_t320 =  *((intOrPtr*)((_t317 << 3) + _a24));
					if(_t320 != 0) {
						_t390 =  *((intOrPtr*)((_t320 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t390, _t440, _t460);
						_v24 = _t390;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t321 = __imp___errno;
					 *_t321();
					 *_t321 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L57:
						_t303 = _v40;
						if(_v40 == 0) {
							E004035DB(_t233, _t303, _t391, "no destination", _t440, _t457, _t460);
						}
						_t324 =  *((intOrPtr*)((_t321 << 3) + _a24));
						_t304 = _t324;
						if(_t324 == 0) {
							E004035DB(_t233, _t304, _t391, "no port[s] to connect to", _t440, _t457, _t460);
						}
						_t328 =  *((intOrPtr*)((_t324 + 1 << 3) + _a24));
						if(_t328 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t331 =  *((_t328 << 3) + _a24);
							if(_t331 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t334 =  *((intOrPtr*)((_t331 << 3) + _a24));
							L004074F0();
							_t391 = _t334;
							__eflags = _t391;
							if(_t391 != 0) {
								 *_t391 = 0;
								_t391 = _t391 + 1;
								_v46 = E00403BC0(0, _t391);
								__eflags = _v46;
								if(__eflags == 0) {
									_t440 = _t391;
									E004035DB(_t234, __eflags, _t391, "invalid port %s", _t391, _t458, _t460);
								}
							}
							_t328 =  *((intOrPtr*)((_t334 << 3) + _a24));
							_t401 = _t328;
							_v74 = E00403BC0(0, _t328);
							__eflags = _v74;
							if(_v74 == 0) {
								_t349 = (_t328 << 3) + _a24;
								__eflags = _t349;
								_t328 =  *_t349;
								_t440 = _t328;
								_t401 = "invalid port %s";
								E004035DB(_t234, _t349, _t391, "invalid port %s", _t328, _t458, _t460);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t234 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t328 = _v56;
									_t401 = _t328;
									_v48 = E00403DCA(_t269, _t328, _t328);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t156 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t156;
									if(_t156 != 0) {
										L004074C0();
										_v44 = _t156;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t71 =  &_v44;
											 *_t71 = _v44 + 0x2000;
											__eflags =  *_t71;
										}
									}
								}
								_t234 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t401);
								_t337 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t458 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t440, _v32, _t460);
								_t128 =  *0x408010; // 0xffffffff
								__eflags = _t128;
								if(_t128 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t154 =  *0x408010; // 0xffffffff
											_t440 = _v40;
											_t234 = _t154;
											 *0x408010 = E00404773(_t154, _t337, _v40);
										}
									}
								}
								_t129 =  *0x408010; // 0xffffffff
								__eflags = _t129;
								if(_t129 <= 0) {
									_t269 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L90:
										_t340 = _v24 + 0x100;
										__eflags = _t340;
										_t341 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t458 = _t340;
										_t440 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t340, _t460);
										goto L91;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L90;
									}
									_t341 = __imp__WSAGetLastError;
									_t144 =  *__imp__WSAGetLastError();
									__eflags = _t144 - 0x274d;
									if(_t144 == 0x274d) {
										goto L91;
									}
									goto L90;
								} else {
									_t269 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t458 = _v24 + 0x100;
									_t440 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t460);
									_t341 =  *0x40b0e8;
									__eflags = _t341;
									if(_t341 != 0) {
										E004026FD(_t234, _t341, _t341, _t458);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t341 =  *0x40b0e8;
										__eflags = _t341;
										if(_t341 == 0) {
											_t147 =  *0x408010; // 0xffffffff
											_t234 = _t147;
											_t269 = E00404B7C(_t147, _t267, _t272, _t458, _t460);
										}
									}
									L91:
									_t342 = __imp__shutdown;
									 *_t342();
									_t401 = _t342;
									_t328 = __imp__closesocket;
									 *_t328();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t234 =  *0x40b0cc;
										_t328 = __imp___sleep;
										 *_t328();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t90 =  &_v48;
										 *_t90 = _v48 - 1;
										__eflags =  *_t90;
									} else {
										_t328 = _v56;
										_t401 = _t328;
										_v48 = E00403DCA(_t269, _t328, _t328);
									}
									continue;
								}
							}
							_t158 =  *0x40b048 + 1;
							__eflags = _t158;
							 *0x40b048 = _t158;
						}
						_t350 = __imp___errno;
						 *_t350();
						 *_t350 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t440, _t458, _t460);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t309 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t440, _t458, _t460);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t440, _t458, _t460);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t440, _t458, _t460);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t440, _t458, _t460);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t440, _t458, _t460);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t440, _t458, _t460);
							E004035DB(0, _t309, _t391, "port numbers can be individual or ranges: m-n [inclusive]", _t440, _t458, _t460);
							return 0;
						}
					} else {
						_v48 = 0;
						_t354 =  *((intOrPtr*)((_t321 << 3) + _a24));
						if(_t354 != 0) {
							_t380 =  *((intOrPtr*)((_t354 << 3) + _a24));
							_v48 = E00403BC0(0, _t380);
							if(_v48 == 0) {
								_t440 =  *((intOrPtr*)((_t380 << 3) + _a24));
								E004035DB(_t233, (_t380 << 3) + _a24, _t391, "invalid port %s",  *((intOrPtr*)((_t380 << 3) + _a24)), _t457, _t460);
							}
						}
						_t321 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t458 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t321, _v32, _t460);
						_t187 =  *0x408010; // 0xffffffff
						if(_t187 <= 0) {
							L56:
							E004035DB(_t233, _t302, _t391, "no connection", _t440, _t458, _t460);
							goto L57;
						} else {
							_t355 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t233, _t355, _t355, _t458);
							}
							_t321 =  *0x40b0e8;
							if(_t321 == 0) {
								_t207 =  *0x408010; // 0xffffffff
								_t268 = E00404B7C(_t207, _t267, _t272, _t458, _t460);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t440, _t458, _t460);
							}
							_t302 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								if(_a16 == 1) {
									_t356 = _a24;
									E0040371E(0x400, _t356, _t440);
									_a24 = _t356;
									_t357 = _a24;
									 *_t357 =  *_t356;
									E0040371E(0x2000, _t357, _t440);
									_t393 = _t357;
									 *((long long*)(_a24 + 8)) = _t393;
									_t360 = __imp____iob_func;
									 *_t360();
									_t8 = _t360 + 0x60; // 0x60
									_t460 = _t8;
									r8d = 0xa;
									L004074E8(); // executed
									_t193 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t447 = _t393;
									L00407368(); // executed
									 *0x40b07c = _t193;
									_t275 =  *0x40b07c;
									if( *0x40b07c == 0) {
										E004035DB(0, _t275, _t393, "wrong", _t447, _t458, _t460);
									}
									_t270 = E0040377B( *0x40b07c, _t393);
									if(_t270 != 0) {
										 *0x40b07c =  *0x40b07c - _t270;
									}
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t394 =  *((intOrPtr*)(_a24 + 8));
									if(_t394 != 0) {
										 *_t394 = 0;
									}
									L004074F0();
									_t395 =  *((intOrPtr*)(_a24 + 8));
									if(_t395 != 0) {
										 *_t395 = 0;
									}
									_t391 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t271 = 2;
									while(( *_t391 & 0x000000ff) != 0) {
										__eflags = ( *_t391 & 0x000000ff) - 0x20;
										if(( *_t391 & 0x000000ff) != 0x20) {
											_t13 = _t391 - 1; // -2
											__eflags =  *_t13 & 0x000000ff;
											if(( *_t13 & 0x000000ff) == 0) {
												 *((_t271 << 3) + _a24) = _t391;
												_t271 = _t271 + 1;
												__eflags = _t271;
											}
										} else {
											 *_t391 = 0;
										}
										_t391 = _t391 + 1;
										__eflags = _t391;
									}
									_a16 = _t271;
								}
								continue;
							} else {
								_t233 = _t268;
								L00407428();
								goto L56;
							}
						}
					}
				}
				_t16 = _t449 - 0x47; // -71
				__eflags = _t16 - 0x33;
				if(__eflags > 0) {
					_t312 = __imp___errno;
					 *_t312();
					 *_t312 = 0;
					E004035DB(_t233, __eflags, _t391, "nc -h for help", _t440, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t460);
					goto L27;
				}
				goto __rax;
			}

0x00405743
0x00405743
0x00405743
0x00405743
0x00405743
0x00405743
0x00405757
0x00405760
0x00405777
0x00405777
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x0040545b
0x0040546b
0x0040546b
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
invalid local port %s, xrefs: 00405770
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid local port %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 3007559463-1475400292
Opcode ID: 6dc5251d790861df4746517fb317d590a2c5f166a036c983b1c2d4eae0398727
Instruction ID: 412349e23a80563349d223d5c2fc72623315a500cee4f8d9f13a9d5feb982282
Opcode Fuzzy Hash: 6dc5251d790861df4746517fb317d590a2c5f166a036c983b1c2d4eae0398727
Instruction Fuzzy Hash: AEB13DA1B10A0486EB10EF26E89136A37A0FB44788F44442AEB5D777E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405563 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E00405563(void* __ecx, void* __edx, void* __edi, void* __esp, void* __eflags, signed long long __rbx, void* __rdx, void* __rsi, void* __r8, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t103;
				signed int _t127;
				signed int _t128;
				void* _t143;
				signed int _t146;
				signed int _t153;
				signed int _t155;
				signed int _t157;
				signed int _t186;
				signed int _t192;
				signed int _t206;
				signed int _t241;
				void* _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				void* _t271;
				signed long long _t301;
				signed int* _t302;
				signed long long _t306;
				signed long long _t309;
				signed long long _t310;
				intOrPtr _t313;
				signed long long _t317;
				signed long long _t320;
				signed long long _t323;
				signed int _t329;
				signed long long _t331;
				signed int _t338;
				signed int* _t339;
				signed long long _t343;
				intOrPtr* _t345;
				long long _t346;
				long long* _t349;
				signed long long _t369;
				long long _t379;
				long long _t382;
				char* _t383;
				char* _t384;
				long long _t434;
				void* _t436;

				_t447 = __r9;
				_t436 = __rsi;
				_t380 = __rbx;
				_t271 = __esp;
				_t266 = __edi;
				E004035DB(__ecx, __eflags, __rbx, "all-A-records NIY", __rdx, __r8, __r9);
				 *0x40b0c8 = ( *0x40b0c8 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t301 = _a24;
					_t444 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t429 = _t301;
					_t232 = _a16;
					_t267 = E00402422(_a16, _t301, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t267 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t233 = 0x10000;
						E0040371E(0x10000, _t301, _t429);
						_v56 = _t301;
					}
					_t306 =  *0x40b0e8;
					if(_t306 != 0) {
						_t233 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t103 =  *0x40b0d4 & 0x0000ffff;
					if(_t103 != 0) {
						_t306 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t103;
						_t277 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t306 =  *0x40b0c0;
							_t429 = _t306;
							E004035DB(_t232, _t277, _t380, "can\'t open %s", _t306, _t444, _t447);
						}
						_t233 = 0x64;
						E0040371E(0x64, _t306, _t429);
						 *0x40b0c0 = _t306;
					}
					_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
					if(_t309 != 0) {
						_t379 =  *((intOrPtr*)((_t309 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t379, _t429, _t447);
						_v24 = _t379;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t310 = __imp___errno;
					 *_t310();
					 *_t310 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t294 = _v40;
						if(_v40 == 0) {
							E004035DB(_t232, _t294, _t380, "no destination", _t429, _t444, _t447);
						}
						_t313 =  *((intOrPtr*)((_t310 << 3) + _a24));
						_t295 = _t313;
						if(_t313 == 0) {
							E004035DB(_t232, _t295, _t380, "no port[s] to connect to", _t429, _t444, _t447);
						}
						_t317 =  *((intOrPtr*)((_t313 + 1 << 3) + _a24));
						if(_t317 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t320 =  *((_t317 << 3) + _a24);
							if(_t320 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t323 =  *((intOrPtr*)((_t320 << 3) + _a24));
							L004074F0();
							_t380 = _t323;
							__eflags = _t380;
							if(_t380 != 0) {
								 *_t380 = 0;
								_t380 = _t380 + 1;
								_v46 = E00403BC0(0, _t380);
								__eflags = _v46;
								if(__eflags == 0) {
									_t429 = _t380;
									E004035DB(_t233, __eflags, _t380, "invalid port %s", _t380, _t445, _t447);
								}
							}
							_t317 =  *((intOrPtr*)((_t323 << 3) + _a24));
							_t389 = _t317;
							_v74 = E00403BC0(0, _t317);
							__eflags = _v74;
							if(_v74 == 0) {
								_t338 = (_t317 << 3) + _a24;
								__eflags = _t338;
								_t317 =  *_t338;
								_t429 = _t317;
								_t389 = "invalid port %s";
								E004035DB(_t233, _t338, _t380, "invalid port %s", _t317, _t445, _t447);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t233 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t317 = _v56;
									_t389 = _t317;
									_v48 = E00403DCA(_t268, _t317, _t317);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t155 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t155;
									if(_t155 != 0) {
										L004074C0();
										_v44 = _t155;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t233 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t389);
								_t326 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t445 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t429, _v32, _t447);
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t153 =  *0x408010; // 0xffffffff
											_t429 = _v40;
											_t233 = _t153;
											 *0x408010 = E00404773(_t153, _t326, _v40);
										}
									}
								}
								_t128 =  *0x408010; // 0xffffffff
								__eflags = _t128;
								if(_t128 <= 0) {
									_t268 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t329 = _v24 + 0x100;
										__eflags = _t329;
										_t330 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t445 = _t329;
										_t429 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t329, _t447);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t330 = __imp__WSAGetLastError;
									_t143 =  *__imp__WSAGetLastError();
									__eflags = _t143 - 0x274d;
									if(_t143 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t268 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t445 = _v24 + 0x100;
									_t429 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t447);
									_t330 =  *0x40b0e8;
									__eflags = _t330;
									if(_t330 != 0) {
										E004026FD(_t233, _t330, _t330, _t445);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t330 =  *0x40b0e8;
										__eflags = _t330;
										if(_t330 == 0) {
											_t146 =  *0x408010; // 0xffffffff
											_t233 = _t146;
											_t268 = E00404B7C(_t146, _t266, _t271, _t445, _t447);
										}
									}
									L89:
									_t331 = __imp__shutdown;
									 *_t331();
									_t389 = _t331;
									_t317 = __imp__closesocket;
									 *_t317();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t233 =  *0x40b0cc;
										_t317 = __imp___sleep;
										 *_t317();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t317 = _v56;
										_t389 = _t317;
										_v48 = E00403DCA(_t268, _t317, _t317);
									}
									continue;
								}
							}
							_t157 =  *0x40b048 + 1;
							__eflags = _t157;
							 *0x40b048 = _t157;
						}
						_t339 = __imp___errno;
						 *_t339();
						 *_t339 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t429, _t445, _t447);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t300 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t429, _t445, _t447);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t429, _t445, _t447);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t429, _t445, _t447);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t429, _t445, _t447);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t429, _t445, _t447);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t429, _t445, _t447);
							E004035DB(0, _t300, _t380, "port numbers can be individual or ranges: m-n [inclusive]", _t429, _t445, _t447);
							return 0;
						}
					} else {
						_v48 = 0;
						_t343 =  *((intOrPtr*)((_t310 << 3) + _a24));
						if(_t343 != 0) {
							_t369 =  *((intOrPtr*)((_t343 << 3) + _a24));
							_v48 = E00403BC0(0, _t369);
							if(_v48 == 0) {
								_t429 =  *((intOrPtr*)((_t369 << 3) + _a24));
								E004035DB(_t232, (_t369 << 3) + _a24, _t380, "invalid port %s",  *((intOrPtr*)((_t369 << 3) + _a24)), _t444, _t447);
							}
						}
						_t310 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t445 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t310, _v32, _t447);
						_t186 =  *0x408010; // 0xffffffff
						if(_t186 <= 0) {
							L54:
							E004035DB(_t232, _t293, _t380, "no connection", _t429, _t445, _t447);
							goto L55;
						} else {
							_t344 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t232, _t344, _t344, _t445);
							}
							_t310 =  *0x40b0e8;
							if(_t310 == 0) {
								_t206 =  *0x408010; // 0xffffffff
								_t267 = E00404B7C(_t206, _t266, _t271, _t445, _t447);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t429, _t445, _t447);
							}
							_t293 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t345 = _a24;
									E0040371E(0x400, _t345, _t429);
									_a24 = _t345;
									_t346 = _a24;
									 *_t346 =  *_t345;
									E0040371E(0x2000, _t346, _t429);
									_t382 = _t346;
									 *((long long*)(_a24 + 8)) = _t382;
									_t349 = __imp____iob_func;
									 *_t349();
									_t6 = _t349 + 0x60; // 0x60
									_t447 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t192 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t434 = _t382;
									L00407368(); // executed
									 *0x40b07c = _t192;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t382, "wrong", _t434, _t445, _t447);
									}
									_t269 = E0040377B( *0x40b07c, _t382);
									__eflags = _t269;
									if(_t269 != 0) {
										_t241 =  *0x40b07c - _t269;
										__eflags = _t241;
										 *0x40b07c = _t241;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t383 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t383;
									if(_t383 != 0) {
										 *_t383 = 0;
									}
									L004074F0();
									_t384 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t384;
									if(_t384 != 0) {
										 *_t384 = 0;
									}
									_t380 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t270 = 2;
									while(1) {
										__eflags =  *_t380 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t380 & 0x000000ff) - 0x20;
										if(( *_t380 & 0x000000ff) != 0x20) {
											_t11 = _t380 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t270 << 3) + _a24) = _t380;
												_t270 = _t270 + 1;
												__eflags = _t270;
											}
										} else {
											 *_t380 = 0;
										}
										_t380 = _t380 + 1;
										__eflags = _t380;
									}
									_a16 = _t270;
								}
								continue;
							} else {
								_t232 = _t267;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t436 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t302 = __imp___errno;
					 *_t302();
					 *_t302 = 0;
					E004035DB(_t232, __eflags, _t380, "nc -h for help", _t429, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t447);
					goto L25;
				}
				_t429 =  *((intOrPtr*)(0x409b50 + _t301 * 4));
				goto __rax;
			}

0x00405563
0x00405563
0x00405563
0x00405563
0x00405563
0x0040556a
0x00405579
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
all-A-records NIY, xrefs: 00405563
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$all-A-records NIY$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-2323755471
Opcode ID: 02a9b6737114b9787cf83e46bd712633344938b826b37088b88542a449b2d82e
Instruction ID: 7cabb3e495677b6ded4950639222f7885a430f654292a11837caf2832b9c2118
Opcode Fuzzy Hash: 02a9b6737114b9787cf83e46bd712633344938b826b37088b88542a449b2d82e
Instruction Fuzzy Hash: EEA13FA1B10A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405797 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00405797(void* __ecx, void* __edi, void* __esp, signed long long __rbx, void* __rdx, void* __rsi, void* __r9, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				void* _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				long long _v72;
				signed int _v74;
				signed int _t105;
				signed int _t129;
				signed int _t130;
				void* _t145;
				signed int _t148;
				signed int _t155;
				signed int _t157;
				signed int _t159;
				signed int _t188;
				signed int _t194;
				signed int _t208;
				signed int _t243;
				void* _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				void* _t273;
				long long _t302;
				signed long long _t305;
				signed int* _t306;
				signed long long _t310;
				signed long long _t313;
				signed long long _t314;
				intOrPtr _t317;
				signed long long _t321;
				signed long long _t324;
				signed long long _t327;
				signed int _t333;
				signed long long _t335;
				signed int _t342;
				signed int* _t343;
				signed long long _t347;
				intOrPtr* _t349;
				long long _t350;
				long long* _t353;
				signed long long _t373;
				long long _t383;
				signed long long _t384;
				long long _t386;
				char* _t387;
				char* _t388;
				long long _t438;
				void* _t440;

				_t450 = __r9;
				_t440 = __rsi;
				_t384 = __rbx;
				_t273 = __esp;
				_t268 = __edi;
				_t302 =  *0x40b040;
				E00403841( *0x40b0d2 & 0xffff, _t302, __rdx, __r9);
				_v72 = _t302;
				_v32 = _v72 + 0x1c0;
				while(1) {
					L25:
					_t305 = _a24;
					_t447 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t433 = _t305;
					_t234 = _a16;
					_t269 = E00402422(_a16, _t305, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t269 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t235 = 0x10000;
						E0040371E(0x10000, _t305, _t433);
						_v56 = _t305;
					}
					_t310 =  *0x40b0e8;
					if(_t310 != 0) {
						_t235 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t105 =  *0x40b0d4 & 0x0000ffff;
					if(_t105 != 0) {
						_t310 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t105;
						_t278 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t310 =  *0x40b0c0;
							_t433 = _t310;
							E004035DB(_t234, _t278, _t384, "can\'t open %s", _t310, _t447, _t450);
						}
						_t235 = 0x64;
						E0040371E(0x64, _t310, _t433);
						 *0x40b0c0 = _t310;
					}
					_t313 =  *((intOrPtr*)((_t310 << 3) + _a24));
					if(_t313 != 0) {
						_t383 =  *((intOrPtr*)((_t313 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t383, _t433, _t450);
						_v24 = _t383;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t314 = __imp___errno;
					 *_t314();
					 *_t314 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t295 = _v40;
						if(_v40 == 0) {
							E004035DB(_t234, _t295, _t384, "no destination", _t433, _t447, _t450);
						}
						_t317 =  *((intOrPtr*)((_t314 << 3) + _a24));
						_t296 = _t317;
						if(_t317 == 0) {
							E004035DB(_t234, _t296, _t384, "no port[s] to connect to", _t433, _t447, _t450);
						}
						_t321 =  *((intOrPtr*)((_t317 + 1 << 3) + _a24));
						if(_t321 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t324 =  *((_t321 << 3) + _a24);
							if(_t324 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t327 =  *((intOrPtr*)((_t324 << 3) + _a24));
							L004074F0();
							_t384 = _t327;
							__eflags = _t384;
							if(_t384 != 0) {
								 *_t384 = 0;
								_t384 = _t384 + 1;
								_v46 = E00403BC0(0, _t384);
								__eflags = _v46;
								if(__eflags == 0) {
									_t433 = _t384;
									E004035DB(_t235, __eflags, _t384, "invalid port %s", _t384, _t448, _t450);
								}
							}
							_t321 =  *((intOrPtr*)((_t327 << 3) + _a24));
							_t393 = _t321;
							_v74 = E00403BC0(0, _t321);
							__eflags = _v74;
							if(_v74 == 0) {
								_t342 = (_t321 << 3) + _a24;
								__eflags = _t342;
								_t321 =  *_t342;
								_t433 = _t321;
								_t393 = "invalid port %s";
								E004035DB(_t235, _t342, _t384, "invalid port %s", _t321, _t448, _t450);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t235 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t321 = _v56;
									_t393 = _t321;
									_v48 = E00403DCA(_t270, _t321, _t321);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t157 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t157;
									if(_t157 != 0) {
										L004074C0();
										_v44 = _t157;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t72 =  &_v44;
											 *_t72 = _v44 + 0x2000;
											__eflags =  *_t72;
										}
									}
								}
								_t235 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t393);
								_t330 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t448 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t433, _v32, _t450);
								_t129 =  *0x408010; // 0xffffffff
								__eflags = _t129;
								if(_t129 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t155 =  *0x408010; // 0xffffffff
											_t433 = _v40;
											_t235 = _t155;
											 *0x408010 = E00404773(_t155, _t330, _v40);
										}
									}
								}
								_t130 =  *0x408010; // 0xffffffff
								__eflags = _t130;
								if(_t130 <= 0) {
									_t270 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t333 = _v24 + 0x100;
										__eflags = _t333;
										_t334 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t448 = _t333;
										_t433 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t333, _t450);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t334 = __imp__WSAGetLastError;
									_t145 =  *__imp__WSAGetLastError();
									__eflags = _t145 - 0x274d;
									if(_t145 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t270 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t448 = _v24 + 0x100;
									_t433 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t450);
									_t334 =  *0x40b0e8;
									__eflags = _t334;
									if(_t334 != 0) {
										E004026FD(_t235, _t334, _t334, _t448);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t334 =  *0x40b0e8;
										__eflags = _t334;
										if(_t334 == 0) {
											_t148 =  *0x408010; // 0xffffffff
											_t235 = _t148;
											_t270 = E00404B7C(_t148, _t268, _t273, _t448, _t450);
										}
									}
									L89:
									_t335 = __imp__shutdown;
									 *_t335();
									_t393 = _t335;
									_t321 = __imp__closesocket;
									 *_t321();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t235 =  *0x40b0cc;
										_t321 = __imp___sleep;
										 *_t321();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t91 =  &_v48;
										 *_t91 = _v48 - 1;
										__eflags =  *_t91;
									} else {
										_t321 = _v56;
										_t393 = _t321;
										_v48 = E00403DCA(_t270, _t321, _t321);
									}
									continue;
								}
							}
							_t159 =  *0x40b048 + 1;
							__eflags = _t159;
							 *0x40b048 = _t159;
						}
						_t343 = __imp___errno;
						 *_t343();
						 *_t343 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t433, _t448, _t450);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t301 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t433, _t448, _t450);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t433, _t448, _t450);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t433, _t448, _t450);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t433, _t448, _t450);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t433, _t448, _t450);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t433, _t448, _t450);
							E004035DB(0, _t301, _t384, "port numbers can be individual or ranges: m-n [inclusive]", _t433, _t448, _t450);
							return 0;
						}
					} else {
						_v48 = 0;
						_t347 =  *((intOrPtr*)((_t314 << 3) + _a24));
						if(_t347 != 0) {
							_t373 =  *((intOrPtr*)((_t347 << 3) + _a24));
							_v48 = E00403BC0(0, _t373);
							if(_v48 == 0) {
								_t433 =  *((intOrPtr*)((_t373 << 3) + _a24));
								E004035DB(_t234, (_t373 << 3) + _a24, _t384, "invalid port %s",  *((intOrPtr*)((_t373 << 3) + _a24)), _t447, _t450);
							}
						}
						_t314 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t448 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t314, _v32, _t450);
						_t188 =  *0x408010; // 0xffffffff
						if(_t188 <= 0) {
							L54:
							E004035DB(_t234, _t294, _t384, "no connection", _t433, _t448, _t450);
							goto L55;
						} else {
							_t348 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t234, _t348, _t348, _t448);
							}
							_t314 =  *0x40b0e8;
							if(_t314 == 0) {
								_t208 =  *0x408010; // 0xffffffff
								_t269 = E00404B7C(_t208, _t268, _t273, _t448, _t450);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t433, _t448, _t450);
							}
							_t294 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t349 = _a24;
									E0040371E(0x400, _t349, _t433);
									_a24 = _t349;
									_t350 = _a24;
									 *_t350 =  *_t349;
									E0040371E(0x2000, _t350, _t433);
									_t386 = _t350;
									 *((long long*)(_a24 + 8)) = _t386;
									_t353 = __imp____iob_func;
									 *_t353();
									_t9 = _t353 + 0x60; // 0x60
									_t450 = _t9;
									r8d = 0xa;
									L004074E8(); // executed
									_t194 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t438 = _t386;
									L00407368(); // executed
									 *0x40b07c = _t194;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t386, "wrong", _t438, _t448, _t450);
									}
									_t271 = E0040377B( *0x40b07c, _t386);
									__eflags = _t271;
									if(_t271 != 0) {
										_t243 =  *0x40b07c - _t271;
										__eflags = _t243;
										 *0x40b07c = _t243;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t387 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t387;
									if(_t387 != 0) {
										 *_t387 = 0;
									}
									L004074F0();
									_t388 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t388;
									if(_t388 != 0) {
										 *_t388 = 0;
									}
									_t384 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t272 = 2;
									while(1) {
										__eflags =  *_t384 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t384 & 0x000000ff) - 0x20;
										if(( *_t384 & 0x000000ff) != 0x20) {
											_t14 = _t384 - 1; // -2
											__eflags =  *_t14 & 0x000000ff;
											if(( *_t14 & 0x000000ff) == 0) {
												 *((_t272 << 3) + _a24) = _t384;
												_t272 = _t272 + 1;
												__eflags = _t272;
											}
										} else {
											 *_t384 = 0;
										}
										_t384 = _t384 + 1;
										__eflags = _t384;
									}
									_a16 = _t272;
								}
								continue;
							} else {
								_t234 = _t269;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t17 = _t440 - 0x47; // -71
				__eflags = _t17 - 0x33;
				if(__eflags > 0) {
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					E004035DB(_t234, __eflags, _t384, "nc -h for help", _t433, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t450);
					goto L25;
				}
				_t433 =  *((intOrPtr*)(0x409b50 + _t305 * 4));
				goto __rax;
			}

0x00405797
0x00405797
0x00405797
0x00405797
0x00405797
0x004057a1
0x004057ab
0x004057b0
0x004057be
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 7cb95d333917b75a1f19fc3b667313b740d961bb7bbd8feef2aa009acc712494
Instruction ID: 88e6ff62caf1252c4ffe0d9992e833e06b6c4ec77a96bdd4dfb1b046ccbd3f98
Opcode Fuzzy Hash: 7cb95d333917b75a1f19fc3b667313b740d961bb7bbd8feef2aa009acc712494
Instruction Fuzzy Hash: 96B13DA1B01A1486EB10DF26E89136A37A0FB44788F44442AEB5DB77E5EF3CD941C79C

Uniqueness

Uniqueness Score: -1.00%

Function 0040571F Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E0040571F(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t298;
				signed int* _t299;
				signed long long _t303;
				signed long long _t306;
				signed long long _t307;
				intOrPtr _t310;
				signed long long _t314;
				signed long long _t317;
				signed long long _t320;
				signed int _t326;
				signed long long _t328;
				signed int _t335;
				signed int* _t336;
				signed long long _t340;
				intOrPtr* _t342;
				long long _t343;
				long long* _t346;
				signed long long _t366;
				long long _t376;
				signed long long _t377;
				long long _t379;
				char* _t380;
				char* _t381;
				long long _t429;
				void* _t431;
				void* _t441;

				_t431 = __rsi;
				 *0x40b0c0 =  *0x40b040;
				 *0x40b0d4 = ( *0x40b0d4 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t298 = _a24;
					_t438 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t424 = _t298;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t298, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t298, _t424);
						_v56 = _t298;
					}
					_t303 =  *0x40b0e8;
					if(_t303 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t303 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t303 =  *0x40b0c0;
							_t424 = _t303;
							E004035DB(_t230, _t273, _t377, "can\'t open %s", _t303, _t438, _t441);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t303, _t424);
						 *0x40b0c0 = _t303;
					}
					_t306 =  *((intOrPtr*)((_t303 << 3) + _a24));
					if(_t306 != 0) {
						_t376 =  *((intOrPtr*)((_t306 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t376, _t424, _t441);
						_v24 = _t376;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t307 = __imp___errno;
					 *_t307();
					 *_t307 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t377, "no destination", _t424, _t438, _t441);
						}
						_t310 =  *((intOrPtr*)((_t307 << 3) + _a24));
						_t291 = _t310;
						if(_t310 == 0) {
							E004035DB(_t230, _t291, _t377, "no port[s] to connect to", _t424, _t438, _t441);
						}
						_t314 =  *((intOrPtr*)((_t310 + 1 << 3) + _a24));
						if(_t314 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t317 =  *((_t314 << 3) + _a24);
							if(_t317 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t320 =  *((intOrPtr*)((_t317 << 3) + _a24));
							L004074F0();
							_t377 = _t320;
							__eflags = _t377;
							if(_t377 != 0) {
								 *_t377 = 0;
								_t377 = _t377 + 1;
								_v46 = E00403BC0(0, _t377);
								__eflags = _v46;
								if(__eflags == 0) {
									_t424 = _t377;
									E004035DB(_t231, __eflags, _t377, "invalid port %s", _t377, _t439, _t441);
								}
							}
							_t314 =  *((intOrPtr*)((_t320 << 3) + _a24));
							_t385 = _t314;
							_v74 = E00403BC0(0, _t314);
							__eflags = _v74;
							if(_v74 == 0) {
								_t335 = (_t314 << 3) + _a24;
								__eflags = _t335;
								_t314 =  *_t335;
								_t424 = _t314;
								_t385 = "invalid port %s";
								E004035DB(_t231, _t335, _t377, "invalid port %s", _t314, _t439, _t441);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t314 = _v56;
									_t385 = _t314;
									_v48 = E00403DCA(_t265, _t314, _t314);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t385);
								_t323 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t439 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t424, _v32, _t441);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t424 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t323, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t326 = _v24 + 0x100;
										__eflags = _t326;
										_t327 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t439 = _t326;
										_t424 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t326, _t441);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t327 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t439 = _v24 + 0x100;
									_t424 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t441);
									_t327 =  *0x40b0e8;
									__eflags = _t327;
									if(_t327 != 0) {
										E004026FD(_t231, _t327, _t327, _t439);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t327 =  *0x40b0e8;
										__eflags = _t327;
										if(_t327 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t439, _t441);
										}
									}
									L89:
									_t328 = __imp__shutdown;
									 *_t328();
									_t385 = _t328;
									_t314 = __imp__closesocket;
									 *_t314();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t314 = __imp___sleep;
										 *_t314();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t314 = _v56;
										_t385 = _t314;
										_v48 = E00403DCA(_t265, _t314, _t314);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t336 = __imp___errno;
						 *_t336();
						 *_t336 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t424, _t439, _t441);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t424, _t439, _t441);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t424, _t439, _t441);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t424, _t439, _t441);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t424, _t439, _t441);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t424, _t439, _t441);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t424, _t439, _t441);
							E004035DB(0, _t296, _t377, "port numbers can be individual or ranges: m-n [inclusive]", _t424, _t439, _t441);
							return 0;
						}
					} else {
						_v48 = 0;
						_t340 =  *((intOrPtr*)((_t307 << 3) + _a24));
						if(_t340 != 0) {
							_t366 =  *((intOrPtr*)((_t340 << 3) + _a24));
							_v48 = E00403BC0(0, _t366);
							if(_v48 == 0) {
								_t424 =  *((intOrPtr*)((_t366 << 3) + _a24));
								E004035DB(_t230, (_t366 << 3) + _a24, _t377, "invalid port %s",  *((intOrPtr*)((_t366 << 3) + _a24)), _t438, _t441);
							}
						}
						_t307 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t439 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t307, _v32, _t441);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t377, "no connection", _t424, _t439, _t441);
							goto L55;
						} else {
							_t341 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t341, _t341, _t439);
							}
							_t307 =  *0x40b0e8;
							if(_t307 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t439, _t441);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t424, _t439, _t441);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t342 = _a24;
									E0040371E(0x400, _t342, _t424);
									_a24 = _t342;
									_t343 = _a24;
									 *_t343 =  *_t342;
									E0040371E(0x2000, _t343, _t424);
									_t379 = _t343;
									 *((long long*)(_a24 + 8)) = _t379;
									_t346 = __imp____iob_func;
									 *_t346();
									_t6 = _t346 + 0x60; // 0x60
									_t441 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t429 = _t379;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t379, "wrong", _t429, _t439, _t441);
									}
									_t266 = E0040377B( *0x40b07c, _t379);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									L004074F0();
									_t381 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t381;
									if(_t381 != 0) {
										 *_t381 = 0;
									}
									_t377 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t377 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t377 & 0x000000ff) - 0x20;
										if(( *_t377 & 0x000000ff) != 0x20) {
											_t11 = _t377 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t377;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t377 = 0;
										}
										_t377 = _t377 + 1;
										__eflags = _t377;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t431 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t299 = __imp___errno;
					 *_t299();
					 *_t299 = 0;
					E004035DB(_t230, __eflags, _t377, "nc -h for help", _t424, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t441);
					goto L25;
				}
				_t424 =  *((intOrPtr*)(0x409b50 + _t298 * 4));
				goto __rax;
			}

0x0040571f
0x00405726
0x00405737
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 11986d9d1fb2c3a380ec7fd46836451cb31239c5fdd6edc82d1f490680556fde
Instruction ID: 97f028e474ae15dea11a3c05a44dfeb8e1187850dccbedaa3eb4596c0e0c8f79
Opcode Fuzzy Hash: 11986d9d1fb2c3a380ec7fd46836451cb31239c5fdd6edc82d1f490680556fde
Instruction Fuzzy Hash: 2CA13DA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405598 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E00405598(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				signed int _v60;
				signed int _v74;
				signed int _t103;
				signed int _t127;
				signed int _t128;
				void* _t143;
				signed int _t146;
				signed int _t153;
				signed int _t155;
				signed int _t157;
				signed int _t186;
				signed int _t192;
				signed int _t206;
				signed int _t240;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				void* _t269;
				signed long long _t298;
				signed int* _t299;
				signed long long _t303;
				signed long long _t306;
				signed long long _t307;
				intOrPtr _t310;
				signed long long _t314;
				signed long long _t317;
				signed long long _t320;
				signed int _t326;
				signed long long _t328;
				signed int _t335;
				signed int* _t336;
				signed long long _t340;
				intOrPtr* _t342;
				long long _t343;
				long long* _t346;
				signed long long _t366;
				long long _t376;
				signed long long _t377;
				long long _t379;
				char* _t380;
				char* _t381;
				long long _t429;
				void* _t431;
				void* _t441;

				_t431 = __rsi;
				 *0x40b0d0 = ( *0x40b0d0 & 0x0000ffff) + 1;
				_v60 = 1;
				while(1) {
					L25:
					_t298 = _a24;
					_t438 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t424 = _t298;
					_t231 = _a16;
					_t265 = E00402422(_a16, _t298, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t265 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t232 = 0x10000;
						E0040371E(0x10000, _t298, _t424);
						_v56 = _t298;
					}
					_t303 =  *0x40b0e8;
					if(_t303 != 0) {
						_t232 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t103 =  *0x40b0d4 & 0x0000ffff;
					if(_t103 != 0) {
						_t303 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t103;
						_t274 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t303 =  *0x40b0c0;
							_t424 = _t303;
							E004035DB(_t231, _t274, _t377, "can\'t open %s", _t303, _t438, _t441);
						}
						_t232 = 0x64;
						E0040371E(0x64, _t303, _t424);
						 *0x40b0c0 = _t303;
					}
					_t306 =  *((intOrPtr*)((_t303 << 3) + _a24));
					if(_t306 != 0) {
						_t376 =  *((intOrPtr*)((_t306 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t376, _t424, _t441);
						_v24 = _t376;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t307 = __imp___errno;
					 *_t307();
					 *_t307 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t291 = _v40;
						if(_v40 == 0) {
							E004035DB(_t231, _t291, _t377, "no destination", _t424, _t438, _t441);
						}
						_t310 =  *((intOrPtr*)((_t307 << 3) + _a24));
						_t292 = _t310;
						if(_t310 == 0) {
							E004035DB(_t231, _t292, _t377, "no port[s] to connect to", _t424, _t438, _t441);
						}
						_t314 =  *((intOrPtr*)((_t310 + 1 << 3) + _a24));
						if(_t314 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t317 =  *((_t314 << 3) + _a24);
							if(_t317 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t320 =  *((intOrPtr*)((_t317 << 3) + _a24));
							L004074F0();
							_t377 = _t320;
							__eflags = _t377;
							if(_t377 != 0) {
								 *_t377 = 0;
								_t377 = _t377 + 1;
								_v46 = E00403BC0(0, _t377);
								__eflags = _v46;
								if(__eflags == 0) {
									_t424 = _t377;
									E004035DB(_t232, __eflags, _t377, "invalid port %s", _t377, _t439, _t441);
								}
							}
							_t314 =  *((intOrPtr*)((_t320 << 3) + _a24));
							_t385 = _t314;
							_v74 = E00403BC0(0, _t314);
							__eflags = _v74;
							if(_v74 == 0) {
								_t335 = (_t314 << 3) + _a24;
								__eflags = _t335;
								_t314 =  *_t335;
								_t424 = _t314;
								_t385 = "invalid port %s";
								E004035DB(_t232, _t335, _t377, "invalid port %s", _t314, _t439, _t441);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t232 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t314 = _v56;
									_t385 = _t314;
									_v48 = E00403DCA(_t266, _t314, _t314);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t155 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t155;
									if(_t155 != 0) {
										L004074C0();
										_v44 = _t155;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t70 =  &_v44;
											 *_t70 = _v44 + 0x2000;
											__eflags =  *_t70;
										}
									}
								}
								_t232 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t385);
								_t323 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t439 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t424, _v32, _t441);
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t153 =  *0x408010; // 0xffffffff
											_t424 = _v40;
											_t232 = _t153;
											 *0x408010 = E00404773(_t153, _t323, _v40);
										}
									}
								}
								_t128 =  *0x408010; // 0xffffffff
								__eflags = _t128;
								if(_t128 <= 0) {
									_t266 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t326 = _v24 + 0x100;
										__eflags = _t326;
										_t327 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t439 = _t326;
										_t424 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t326, _t441);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t327 = __imp__WSAGetLastError;
									_t143 =  *__imp__WSAGetLastError();
									__eflags = _t143 - 0x274d;
									if(_t143 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t266 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t439 = _v24 + 0x100;
									_t424 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t441);
									_t327 =  *0x40b0e8;
									__eflags = _t327;
									if(_t327 != 0) {
										E004026FD(_t232, _t327, _t327, _t439);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t327 =  *0x40b0e8;
										__eflags = _t327;
										if(_t327 == 0) {
											_t146 =  *0x408010; // 0xffffffff
											_t232 = _t146;
											_t266 = E00404B7C(_t146, _t264, _t269, _t439, _t441);
										}
									}
									L89:
									_t328 = __imp__shutdown;
									 *_t328();
									_t385 = _t328;
									_t314 = __imp__closesocket;
									 *_t314();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t232 =  *0x40b0cc;
										_t314 = __imp___sleep;
										 *_t314();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t89 =  &_v48;
										 *_t89 = _v48 - 1;
										__eflags =  *_t89;
									} else {
										_t314 = _v56;
										_t385 = _t314;
										_v48 = E00403DCA(_t266, _t314, _t314);
									}
									continue;
								}
							}
							_t157 =  *0x40b048 + 1;
							__eflags = _t157;
							 *0x40b048 = _t157;
						}
						_t336 = __imp___errno;
						 *_t336();
						 *_t336 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t424, _t439, _t441);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t297 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t424, _t439, _t441);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t424, _t439, _t441);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t424, _t439, _t441);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t424, _t439, _t441);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t424, _t439, _t441);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t424, _t439, _t441);
							E004035DB(0, _t297, _t377, "port numbers can be individual or ranges: m-n [inclusive]", _t424, _t439, _t441);
							return 0;
						}
					} else {
						_v48 = 0;
						_t340 =  *((intOrPtr*)((_t307 << 3) + _a24));
						if(_t340 != 0) {
							_t366 =  *((intOrPtr*)((_t340 << 3) + _a24));
							_v48 = E00403BC0(0, _t366);
							if(_v48 == 0) {
								_t424 =  *((intOrPtr*)((_t366 << 3) + _a24));
								E004035DB(_t231, (_t366 << 3) + _a24, _t377, "invalid port %s",  *((intOrPtr*)((_t366 << 3) + _a24)), _t438, _t441);
							}
						}
						_t307 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t439 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t307, _v32, _t441);
						_t186 =  *0x408010; // 0xffffffff
						if(_t186 <= 0) {
							L54:
							E004035DB(_t231, _t290, _t377, "no connection", _t424, _t439, _t441);
							goto L55;
						} else {
							_t341 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t231, _t341, _t341, _t439);
							}
							_t307 =  *0x40b0e8;
							if(_t307 == 0) {
								_t206 =  *0x408010; // 0xffffffff
								_t265 = E00404B7C(_t206, _t264, _t269, _t439, _t441);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t424, _t439, _t441);
							}
							_t290 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t342 = _a24;
									E0040371E(0x400, _t342, _t424);
									_a24 = _t342;
									_t343 = _a24;
									 *_t343 =  *_t342;
									E0040371E(0x2000, _t343, _t424);
									_t379 = _t343;
									 *((long long*)(_a24 + 8)) = _t379;
									_t346 = __imp____iob_func;
									 *_t346();
									_t7 = _t346 + 0x60; // 0x60
									_t441 = _t7;
									r8d = 0xa;
									L004074E8(); // executed
									_t192 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t429 = _t379;
									L00407368(); // executed
									 *0x40b07c = _t192;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t379, "wrong", _t429, _t439, _t441);
									}
									_t267 = E0040377B( *0x40b07c, _t379);
									__eflags = _t267;
									if(_t267 != 0) {
										_t240 =  *0x40b07c - _t267;
										__eflags = _t240;
										 *0x40b07c = _t240;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									L004074F0();
									_t381 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t381;
									if(_t381 != 0) {
										 *_t381 = 0;
									}
									_t377 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t268 = 2;
									while(1) {
										__eflags =  *_t377 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t377 & 0x000000ff) - 0x20;
										if(( *_t377 & 0x000000ff) != 0x20) {
											_t12 = _t377 - 1; // -2
											__eflags =  *_t12 & 0x000000ff;
											if(( *_t12 & 0x000000ff) == 0) {
												 *((_t268 << 3) + _a24) = _t377;
												_t268 = _t268 + 1;
												__eflags = _t268;
											}
										} else {
											 *_t377 = 0;
										}
										_t377 = _t377 + 1;
										__eflags = _t377;
									}
									_a16 = _t268;
								}
								continue;
							} else {
								_t231 = _t265;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t15 = _t431 - 0x47; // -71
				__eflags = _t15 - 0x33;
				if(__eflags > 0) {
					_t299 = __imp___errno;
					 *_t299();
					 *_t299 = 0;
					E004035DB(_t231, __eflags, _t377, "nc -h for help", _t424, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t441);
					goto L25;
				}
				_t424 =  *((intOrPtr*)(0x409b50 + _t298 * 4));
				goto __rax;
			}

0x00405598
0x004055a2
0x004055a9
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: bd0d8fd678dcd62ff55a949ca998d91e37a2f52ad729474c2222c5deef51e314
Instruction ID: 2ced718abb88147c80181c75dd8c69b75c195ba48d33959a02bd4597aa9895b3
Opcode Fuzzy Hash: bd0d8fd678dcd62ff55a949ca998d91e37a2f52ad729474c2222c5deef51e314
Instruction Fuzzy Hash: E5A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB77E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405809 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00405809(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0da = ( *0x40b0da & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x00405809
0x00405813
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 3f84420f88529ff46f892d28b501fa6cc0e7fbb3f46a61c356c1e814d1db33a9
Instruction ID: 5d22e836d81dc684cd68b93662e43c6f5f6a1c427a4cbc473dc87eea764dbb85
Opcode Fuzzy Hash: 3f84420f88529ff46f892d28b501fa6cc0e7fbb3f46a61c356c1e814d1db33a9
Instruction Fuzzy Hash: 05A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405709 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E00405709(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0d2 = ( *0x40b0d2 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x00405709
0x00405713
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 72d83f644af1d587b92f490ff5e22cc670de32f493b5b5125b806490678883c0
Instruction ID: 13f9a44ee06a4180d9e4e87645fcb9b8c050e4a90a022d1ba9c8af33fe448c17
Opcode Fuzzy Hash: 72d83f644af1d587b92f490ff5e22cc670de32f493b5b5125b806490678883c0
Instruction Fuzzy Hash: ACA13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004057C7 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E004057C7(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0f0 = ( *0x40b0f0 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x004057c7
0x004057d1
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 10d93a76a723074bc1ea73b591166d6d6b116f23e5057b24e29fb4e6dd497874
Instruction ID: c99734c4faf20deb3e312f39af979299bc276a7bb6ddd07d05680851355301fe
Opcode Fuzzy Hash: 10d93a76a723074bc1ea73b591166d6d6b116f23e5057b24e29fb4e6dd497874
Instruction Fuzzy Hash: 52A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB77E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004057DD Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E004057DD(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				"fflush" = ("fflush" & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x004057dd
0x004057e7
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: edcbcf9daa62a74caa35f4fc58f72260fe55109df5da429b4ccc0eb52b2585e9
Instruction ID: 2b9f7e0ba8bb8de98284cc66be26ed87c87f879519a41079b020130af3776ea8
Opcode Fuzzy Hash: edcbcf9daa62a74caa35f4fc58f72260fe55109df5da429b4ccc0eb52b2585e9
Instruction Fuzzy Hash: F0A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004056F3 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E004056F3(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0d0 = ( *0x40b0d0 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x004056f3
0x004056fd
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: a0cbd94ab833b5377a21c85ccb85a5987aa83267bc165d54f244e728c7fd89e3
Instruction ID: b209e171abd88e54e660072998be3d337a93ca3cf228b4de89aa67daf5c472ba
Opcode Fuzzy Hash: a0cbd94ab833b5377a21c85ccb85a5987aa83267bc165d54f244e728c7fd89e3
Instruction Fuzzy Hash: 44A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004057F3 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E004057F3(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0d8 = ( *0x40b0d8 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x004057f3
0x004057fd
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: ca32ef9a596dc3f52f2dab401382c3e440302f7bb3ee0b3c3bd24f8a6a9251b7
Instruction ID: 8d424b4d7d049871720d3b4a90c17472bb77e7b16826db6d56e936f330c36256
Opcode Fuzzy Hash: ca32ef9a596dc3f52f2dab401382c3e440302f7bb3ee0b3c3bd24f8a6a9251b7
Instruction Fuzzy Hash: 5EA13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405781 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00405781(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0d6 = ( *0x40b0d6 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x00405781
0x0040578b
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: d15327f1078ff533f86da4e6fbb4fdca3da6d0c53178bc817945293cc8ea8191
Instruction ID: df61f6ffd2cc24baa300273d20d97d9390fc97a82d4a82d33d6cd4f6ff161ba5
Opcode Fuzzy Hash: d15327f1078ff533f86da4e6fbb4fdca3da6d0c53178bc817945293cc8ea8191
Instruction Fuzzy Hash: 5FA13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405887 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00405887(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t102;
				signed int _t126;
				signed int _t127;
				void* _t142;
				signed int _t145;
				signed int _t152;
				signed int _t154;
				signed int _t156;
				signed int _t185;
				signed int _t191;
				signed int _t205;
				signed int _t239;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				void* _t268;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				 *0x40b0e0 = ( *0x40b0e0 & 0x0000ffff) + 1;
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t230 = _a16;
					_t264 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t264 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t231 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t231 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t102 =  *0x40b0d4 & 0x0000ffff;
					if(_t102 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t102;
						_t273 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t230, _t273, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t231 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t290 = _v40;
						if(_v40 == 0) {
							E004035DB(_t230, _t290, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t291 = _t309;
						if(_t309 == 0) {
							E004035DB(_t230, _t291, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t231, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t231, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t231 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t265, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t154 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t154;
									if(_t154 != 0) {
										L004074C0();
										_v44 = _t154;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t231 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t152 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t231 = _t152;
											 *0x408010 = E00404773(_t152, _t322, _v40);
										}
									}
								}
								_t127 =  *0x408010; // 0xffffffff
								__eflags = _t127;
								if(_t127 <= 0) {
									_t265 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t142 =  *__imp__WSAGetLastError();
									__eflags = _t142 - 0x274d;
									if(_t142 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t265 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t231, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t145 =  *0x408010; // 0xffffffff
											_t231 = _t145;
											_t265 = E00404B7C(_t145, _t263, _t268, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t231 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t265, _t313, _t313);
									}
									continue;
								}
							}
							_t156 =  *0x40b048 + 1;
							__eflags = _t156;
							 *0x40b048 = _t156;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t296 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t296, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t230, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t185 =  *0x408010; // 0xffffffff
						if(_t185 <= 0) {
							L54:
							E004035DB(_t230, _t289, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t230, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t205 =  *0x408010; // 0xffffffff
								_t264 = E00404B7C(_t205, _t263, _t268, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t289 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t191 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t191;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t266 = E0040377B( *0x40b07c, _t378);
									__eflags = _t266;
									if(_t266 != 0) {
										_t239 =  *0x40b07c - _t266;
										__eflags = _t239;
										 *0x40b07c = _t239;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t267 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t267 << 3) + _a24) = _t376;
												_t267 = _t267 + 1;
												__eflags = _t267;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t267;
								}
								continue;
							} else {
								_t230 = _t264;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t230, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x00405887
0x00405891
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 64fe301c2b49228a59aea6c5be925c66a4848b408ced80f509f267529d06ab2c
Instruction ID: e70857ff56071e4686d2b734595b1809ffa81c2d574203557aa85be2d0f3298e
Opcode Fuzzy Hash: 64fe301c2b49228a59aea6c5be925c66a4848b408ced80f509f267529d06ab2c
Instruction Fuzzy Hash: 88A13EA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00405585 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 228
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00405585(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t100;
				signed int _t124;
				signed int _t125;
				void* _t140;
				signed int _t143;
				signed int _t150;
				signed int _t152;
				signed int _t154;
				signed int _t183;
				signed int _t189;
				signed int _t203;
				signed int _t237;
				void* _t261;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				void* _t266;
				signed long long _t296;
				signed int* _t297;
				signed long long _t301;
				signed long long _t304;
				signed long long _t305;
				intOrPtr _t308;
				signed long long _t312;
				signed long long _t315;
				signed long long _t318;
				signed int _t324;
				signed long long _t326;
				signed int _t333;
				signed int* _t334;
				signed long long _t338;
				intOrPtr* _t340;
				long long _t341;
				long long* _t344;
				signed long long _t364;
				long long _t374;
				signed long long _t375;
				long long _t377;
				char* _t378;
				char* _t379;
				long long _t427;
				void* _t429;
				void* _t439;

				_t429 = __rsi;
				 *0x40b0e8 =  *0x40b040;
				while(1) {
					L25:
					_t296 = _a24;
					_t436 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t422 = _t296;
					_t228 = _a16;
					_t262 = E00402422(_a16, _t296, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t262 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t229 = 0x10000;
						E0040371E(0x10000, _t296, _t422);
						_v56 = _t296;
					}
					_t301 =  *0x40b0e8;
					if(_t301 != 0) {
						_t229 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t100 =  *0x40b0d4 & 0x0000ffff;
					if(_t100 != 0) {
						_t301 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t100;
						_t271 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t301 =  *0x40b0c0;
							_t422 = _t301;
							E004035DB(_t228, _t271, _t375, "can\'t open %s", _t301, _t436, _t439);
						}
						_t229 = 0x64;
						E0040371E(0x64, _t301, _t422);
						 *0x40b0c0 = _t301;
					}
					_t304 =  *((intOrPtr*)((_t301 << 3) + _a24));
					if(_t304 != 0) {
						_t374 =  *((intOrPtr*)((_t304 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t374, _t422, _t439);
						_v24 = _t374;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t305 = __imp___errno;
					 *_t305();
					 *_t305 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t288 = _v40;
						if(_v40 == 0) {
							E004035DB(_t228, _t288, _t375, "no destination", _t422, _t436, _t439);
						}
						_t308 =  *((intOrPtr*)((_t305 << 3) + _a24));
						_t289 = _t308;
						if(_t308 == 0) {
							E004035DB(_t228, _t289, _t375, "no port[s] to connect to", _t422, _t436, _t439);
						}
						_t312 =  *((intOrPtr*)((_t308 + 1 << 3) + _a24));
						if(_t312 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t315 =  *((_t312 << 3) + _a24);
							if(_t315 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t318 =  *((intOrPtr*)((_t315 << 3) + _a24));
							L004074F0();
							_t375 = _t318;
							__eflags = _t375;
							if(_t375 != 0) {
								 *_t375 = 0;
								_t375 = _t375 + 1;
								_v46 = E00403BC0(0, _t375);
								__eflags = _v46;
								if(__eflags == 0) {
									_t422 = _t375;
									E004035DB(_t229, __eflags, _t375, "invalid port %s", _t375, _t437, _t439);
								}
							}
							_t312 =  *((intOrPtr*)((_t318 << 3) + _a24));
							_t383 = _t312;
							_v74 = E00403BC0(0, _t312);
							__eflags = _v74;
							if(_v74 == 0) {
								_t333 = (_t312 << 3) + _a24;
								__eflags = _t333;
								_t312 =  *_t333;
								_t422 = _t312;
								_t383 = "invalid port %s";
								E004035DB(_t229, _t333, _t375, "invalid port %s", _t312, _t437, _t439);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t229 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t312 = _v56;
									_t383 = _t312;
									_v48 = E00403DCA(_t263, _t312, _t312);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t152 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t152;
									if(_t152 != 0) {
										L004074C0();
										_v44 = _t152;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t229 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t383);
								_t321 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t437 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t422, _v32, _t439);
								_t124 =  *0x408010; // 0xffffffff
								__eflags = _t124;
								if(_t124 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t150 =  *0x408010; // 0xffffffff
											_t422 = _v40;
											_t229 = _t150;
											 *0x408010 = E00404773(_t150, _t321, _v40);
										}
									}
								}
								_t125 =  *0x408010; // 0xffffffff
								__eflags = _t125;
								if(_t125 <= 0) {
									_t263 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t324 = _v24 + 0x100;
										__eflags = _t324;
										_t325 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t437 = _t324;
										_t422 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t324, _t439);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t325 = __imp__WSAGetLastError;
									_t140 =  *__imp__WSAGetLastError();
									__eflags = _t140 - 0x274d;
									if(_t140 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t263 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t437 = _v24 + 0x100;
									_t422 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t439);
									_t325 =  *0x40b0e8;
									__eflags = _t325;
									if(_t325 != 0) {
										E004026FD(_t229, _t325, _t325, _t437);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t325 =  *0x40b0e8;
										__eflags = _t325;
										if(_t325 == 0) {
											_t143 =  *0x408010; // 0xffffffff
											_t229 = _t143;
											_t263 = E00404B7C(_t143, _t261, _t266, _t437, _t439);
										}
									}
									L89:
									_t326 = __imp__shutdown;
									 *_t326();
									_t383 = _t326;
									_t312 = __imp__closesocket;
									 *_t312();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t229 =  *0x40b0cc;
										_t312 = __imp___sleep;
										 *_t312();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t312 = _v56;
										_t383 = _t312;
										_v48 = E00403DCA(_t263, _t312, _t312);
									}
									continue;
								}
							}
							_t154 =  *0x40b048 + 1;
							__eflags = _t154;
							 *0x40b048 = _t154;
						}
						_t334 = __imp___errno;
						 *_t334();
						 *_t334 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t422, _t437, _t439);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t294 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t422, _t437, _t439);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t422, _t437, _t439);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t422, _t437, _t439);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t422, _t437, _t439);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t422, _t437, _t439);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t422, _t437, _t439);
							E004035DB(0, _t294, _t375, "port numbers can be individual or ranges: m-n [inclusive]", _t422, _t437, _t439);
							return 0;
						}
					} else {
						_v48 = 0;
						_t338 =  *((intOrPtr*)((_t305 << 3) + _a24));
						if(_t338 != 0) {
							_t364 =  *((intOrPtr*)((_t338 << 3) + _a24));
							_v48 = E00403BC0(0, _t364);
							if(_v48 == 0) {
								_t422 =  *((intOrPtr*)((_t364 << 3) + _a24));
								E004035DB(_t228, (_t364 << 3) + _a24, _t375, "invalid port %s",  *((intOrPtr*)((_t364 << 3) + _a24)), _t436, _t439);
							}
						}
						_t305 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t437 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t305, _v32, _t439);
						_t183 =  *0x408010; // 0xffffffff
						if(_t183 <= 0) {
							L54:
							E004035DB(_t228, _t287, _t375, "no connection", _t422, _t437, _t439);
							goto L55;
						} else {
							_t339 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t228, _t339, _t339, _t437);
							}
							_t305 =  *0x40b0e8;
							if(_t305 == 0) {
								_t203 =  *0x408010; // 0xffffffff
								_t262 = E00404B7C(_t203, _t261, _t266, _t437, _t439);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t422, _t437, _t439);
							}
							_t287 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t340 = _a24;
									E0040371E(0x400, _t340, _t422);
									_a24 = _t340;
									_t341 = _a24;
									 *_t341 =  *_t340;
									E0040371E(0x2000, _t341, _t422);
									_t377 = _t341;
									 *((long long*)(_a24 + 8)) = _t377;
									_t344 = __imp____iob_func;
									 *_t344();
									_t6 = _t344 + 0x60; // 0x60
									_t439 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t189 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t427 = _t377;
									L00407368(); // executed
									 *0x40b07c = _t189;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t377, "wrong", _t427, _t437, _t439);
									}
									_t264 = E0040377B( *0x40b07c, _t377);
									__eflags = _t264;
									if(_t264 != 0) {
										_t237 =  *0x40b07c - _t264;
										__eflags = _t237;
										 *0x40b07c = _t237;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t378 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t378;
									if(_t378 != 0) {
										 *_t378 = 0;
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									_t375 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t265 = 2;
									while(1) {
										__eflags =  *_t375 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t375 & 0x000000ff) - 0x20;
										if(( *_t375 & 0x000000ff) != 0x20) {
											_t11 = _t375 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t265 << 3) + _a24) = _t375;
												_t265 = _t265 + 1;
												__eflags = _t265;
											}
										} else {
											 *_t375 = 0;
										}
										_t375 = _t375 + 1;
										__eflags = _t375;
									}
									_a16 = _t265;
								}
								continue;
							} else {
								_t228 = _t262;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t429 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t297 = __imp___errno;
					 *_t297();
					 *_t297 = 0;
					E004035DB(_t228, __eflags, _t375, "nc -h for help", _t422, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t439);
					goto L25;
				}
				_t422 =  *((intOrPtr*)(0x409b50 + _t296 * 4));
				goto __rax;
			}

0x00405585
0x0040558c
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 1669b2e5e66dc879dd0d20d4eb66c0b91ee9dd1b7078a8f24d9b467ac99b1e07
Instruction ID: 91497e83ffc2b0f5ee9b8eda1886ff08df82a04189f1f93d419c6693ae7b4ba2
Opcode Fuzzy Hash: 1669b2e5e66dc879dd0d20d4eb66c0b91ee9dd1b7078a8f24d9b467ac99b1e07
Instruction Fuzzy Hash: 39A13DA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5DB73E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 004055B5 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 228
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E004055B5(void* __rsi, signed int _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v32;
				void* _v40;
				signed int _v42;
				signed short _v44;
				signed int _v46;
				signed int _v48;
				signed long long _v56;
				intOrPtr _v60;
				signed int _v74;
				signed int _t101;
				signed int _t125;
				signed int _t126;
				void* _t141;
				signed int _t144;
				signed int _t151;
				signed int _t153;
				signed int _t155;
				signed int _t184;
				signed int _t190;
				signed int _t204;
				signed int _t238;
				void* _t262;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				void* _t267;
				signed long long _t297;
				signed int* _t298;
				signed long long _t302;
				signed long long _t305;
				signed long long _t306;
				intOrPtr _t309;
				signed long long _t313;
				signed long long _t316;
				signed long long _t319;
				signed int _t325;
				signed long long _t327;
				signed int _t334;
				signed int* _t335;
				signed long long _t339;
				intOrPtr* _t341;
				long long _t342;
				long long* _t345;
				signed long long _t365;
				long long _t375;
				signed long long _t376;
				long long _t378;
				char* _t379;
				char* _t380;
				long long _t428;
				void* _t430;
				void* _t440;

				_t430 = __rsi;
				FreeConsole();
				while(1) {
					L25:
					_t297 = _a24;
					_t437 = "ade:g:G:hi:lLno:p:rs:tcuvw:z";
					_t423 = _t297;
					_t229 = _a16;
					_t263 = E00402422(_a16, _t297, "ade:g:G:hi:lLno:p:rs:tcuvw:z");
					if(_t263 != 0xffffffff) {
						break;
					}
					if(( *0x40b0d6 & 0x0000ffff) != 0) {
						L004073A0();
						L004074F8();
						_t230 = 0x10000;
						E0040371E(0x10000, _t297, _t423);
						_v56 = _t297;
					}
					_t302 =  *0x40b0e8;
					if(_t302 != 0) {
						_t230 = 0;
						L00407358();
						 *0x40b0d4 = 0;
						 *0x40b074 = 0;
					}
					_t101 =  *0x40b0d4 & 0x0000ffff;
					if(_t101 != 0) {
						_t302 =  *0x40b0c0;
						r8d = 0x1b4;
						L00407370();
						 *0x40b074 = _t101;
						_t272 =  *0x40b074;
						if( *0x40b074 <= 0) {
							_t302 =  *0x40b0c0;
							_t423 = _t302;
							E004035DB(_t229, _t272, _t376, "can\'t open %s", _t302, _t437, _t440);
						}
						_t230 = 0x64;
						E0040371E(0x64, _t302, _t423);
						 *0x40b0c0 = _t302;
					}
					_t305 =  *((intOrPtr*)((_t302 << 3) + _a24));
					if(_t305 != 0) {
						_t375 =  *((intOrPtr*)((_t305 << 3) + _a24));
						E00403841( *0x40b0d2 & 0xffff, _t375, _t423, _t440);
						_v24 = _t375;
					}
					if(_v24 != 0 && _v24 + 0x1c0 != 0) {
						_v40 = _v24 + 0x1c0;
					}
					if(_v40 != 0) {
						 *0x40b048 =  *0x40b048 + 1;
					}
					_t306 = __imp___errno;
					 *_t306();
					 *_t306 = 0;
					if(( *0x40b0d0 & 0x0000ffff) == 0) {
						L55:
						_t289 = _v40;
						if(_v40 == 0) {
							E004035DB(_t229, _t289, _t376, "no destination", _t423, _t437, _t440);
						}
						_t309 =  *((intOrPtr*)((_t306 << 3) + _a24));
						_t290 = _t309;
						if(_t309 == 0) {
							E004035DB(_t229, _t290, _t376, "no port[s] to connect to", _t423, _t437, _t440);
						}
						_t313 =  *((intOrPtr*)((_t309 + 1 << 3) + _a24));
						if(_t313 != 0) {
							 *0x40802c = 0;
						}
						_v44 = _v42 & 0x0000ffff;
						while(1) {
							_t316 =  *((_t313 << 3) + _a24);
							if(_t316 == 0) {
								break;
							}
							_v74 = 0;
							_v46 = _v74 & 0x0000ffff;
							_t319 =  *((intOrPtr*)((_t316 << 3) + _a24));
							L004074F0();
							_t376 = _t319;
							__eflags = _t376;
							if(_t376 != 0) {
								 *_t376 = 0;
								_t376 = _t376 + 1;
								_v46 = E00403BC0(0, _t376);
								__eflags = _v46;
								if(__eflags == 0) {
									_t423 = _t376;
									E004035DB(_t230, __eflags, _t376, "invalid port %s", _t376, _t438, _t440);
								}
							}
							_t313 =  *((intOrPtr*)((_t319 << 3) + _a24));
							_t384 = _t313;
							_v74 = E00403BC0(0, _t313);
							__eflags = _v74;
							if(_v74 == 0) {
								_t334 = (_t313 << 3) + _a24;
								__eflags = _t334;
								_t313 =  *_t334;
								_t423 = _t313;
								_t384 = "invalid port %s";
								E004035DB(_t230, _t334, _t376, "invalid port %s", _t313, _t438, _t440);
							}
							__eflags = (_v46 & 0x0000ffff) - _v74;
							if((_v46 & 0x0000ffff) <= _v74) {
								_v48 = _v74 & 0x0000ffff;
							} else {
								 *0x40802c = 0;
								_v48 = _v46 & 0x0000ffff;
								__eflags =  *0x40b0d6 & 0x0000ffff;
								if(( *0x40b0d6 & 0x0000ffff) != 0) {
									_t230 = _v46 & 0x0000ffff;
									r8d = _v46 & 0x0000ffff;
									E00403E4E(_v74 & 0x0000ffff, _v56, _v56);
									_t313 = _v56;
									_t384 = _t313;
									_v48 = E00403DCA(_t264, _t313, _t313);
								}
							}
							while(1) {
								__eflags = (_v74 & 0x0000ffff) - _v48;
								if((_v74 & 0x0000ffff) > _v48) {
									break;
								}
								__eflags = _v42;
								if(_v42 == 0) {
									_t153 =  *0x40b0d6 & 0x0000ffff;
									__eflags = _t153;
									if(_t153 != 0) {
										L004074C0();
										_v44 = _t153;
										__eflags = _v44 - 0x1fff;
										if(_v44 <= 0x1fff) {
											_t69 =  &_v44;
											 *_t69 = _v44 + 0x2000;
											__eflags =  *_t69;
										}
									}
								}
								_t230 = 0;
								_v48 = E00403BC0(_v48 & 0x0000ffff, _t384);
								_t322 = _v40;
								r9d = _v44 & 0x0000ffff;
								_t438 = _v32;
								 *0x408010 = E00403EC7(_v48 & 0x0000ffff, _v40, _t423, _v32, _t440);
								_t125 =  *0x408010; // 0xffffffff
								__eflags = _t125;
								if(_t125 > 0) {
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) != 0) {
										__eflags =  *0x40b0d8 & 0x0000ffff;
										if(( *0x40b0d8 & 0x0000ffff) != 0) {
											_t151 =  *0x408010; // 0xffffffff
											_t423 = _v40;
											_t230 = _t151;
											 *0x408010 = E00404773(_t151, _t322, _v40);
										}
									}
								}
								_t126 =  *0x408010; // 0xffffffff
								__eflags = _t126;
								if(_t126 <= 0) {
									_t264 = 1;
									__eflags =  *0x40802c & 0x0000ffff;
									if(( *0x40802c & 0x0000ffff) != 0) {
										L88:
										_t325 = _v24 + 0x100;
										__eflags = _t325;
										_t326 = _v24;
										_a32 =  *0x40b0b8;
										r9d = _v48 & 0x0000ffff;
										_t438 = _t325;
										_t423 = _v24;
										E004034EB("%s [%s] %d (%s)", _v24, _t325, _t440);
										goto L89;
									}
									__eflags = ( *0x40b0da & 0x0000ffff) - 1;
									if(( *0x40b0da & 0x0000ffff) > 1) {
										goto L88;
									}
									_t326 = __imp__WSAGetLastError;
									_t141 =  *__imp__WSAGetLastError();
									__eflags = _t141 - 0x274d;
									if(_t141 == 0x274d) {
										goto L89;
									}
									goto L88;
								} else {
									_t264 = 0;
									_a32 =  *0x40b0b8;
									r9d = _v48 & 0x0000ffff;
									_t438 = _v24 + 0x100;
									_t423 = _v24;
									E004034EB("%s [%s] %d (%s) open", _v24, _v24 + 0x100, _t440);
									_t326 =  *0x40b0e8;
									__eflags = _t326;
									if(_t326 != 0) {
										E004026FD(_t230, _t326, _t326, _t438);
									}
									__eflags =  *0x40b0e0 & 0x0000ffff;
									if(( *0x40b0e0 & 0x0000ffff) == 0) {
										_t326 =  *0x40b0e8;
										__eflags = _t326;
										if(_t326 == 0) {
											_t144 =  *0x408010; // 0xffffffff
											_t230 = _t144;
											_t264 = E00404B7C(_t144, _t262, _t267, _t438, _t440);
										}
									}
									L89:
									_t327 = __imp__shutdown;
									 *_t327();
									_t384 = _t327;
									_t313 = __imp__closesocket;
									 *_t313();
									__eflags =  *0x40b0cc;
									if( *0x40b0cc != 0) {
										_t230 =  *0x40b0cc;
										_t313 = __imp___sleep;
										 *_t313();
									}
									__eflags =  *0x40b0d6 & 0x0000ffff;
									if(( *0x40b0d6 & 0x0000ffff) == 0) {
										_t88 =  &_v48;
										 *_t88 = _v48 - 1;
										__eflags =  *_t88;
									} else {
										_t313 = _v56;
										_t384 = _t313;
										_v48 = E00403DCA(_t264, _t313, _t313);
									}
									continue;
								}
							}
							_t155 =  *0x40b048 + 1;
							__eflags = _t155;
							 *0x40b048 = _t155;
						}
						_t335 = __imp___errno;
						 *_t335();
						 *_t335 = 0;
						if(( *0x40b0da & 0x0000ffff) > 1) {
							r8d =  *0x40b080;
							E004034EB("sent %d, rcvd %d", _t423, _t438, _t440);
						}
						 *__imp__WSACleanup();
						if(_v60 == 1) {
							goto L3;
						} else {
							_t295 =  *0x40802c & 0x0000ffff;
							if(( *0x40802c & 0x0000ffff) != 0) {
								L00407428();
							}
							L00407428();
							 *0x40b0da = 1;
							E004034EB("[v1.12 NT http://eternallybored.org/misc/netcat/]\nconnect to somewhere:\tnc [-options] hostname port[s] [ports] ... \nlisten for inbound:\tnc -l -p port [options] [hostname] [port]\noptions:", _t423, _t438, _t440);
							E004034EB("\t-d\t\tdetach from console, background mode\n", _t423, _t438, _t440);
							E004034EB("\t-e prog\t\tinbound program to exec [dangerous!!]", _t423, _t438, _t440);
							E004034EB("\t-g gateway\tsource-routing hop point[s], up to 8\n\t-G num\t\tsource-routing pointer: 4, 8, 12, ...\n\t-h\t\tthis cruft\n\t-i secs\t\tdelay interval for lines sent, ports scanned\n\t-l\t\tlisten mode, for inbound connects\n\t-L\t\tlisten harder, re-listen on socket close\n\t-n\t\tnumeric-only IP addresses, no DNS\n\t-o file\t\thex dump of traffic\n\t-p port\t\tlocal port number\n\t-r\t\trandomize local and remote ports\n\t-s addr\t\tlocal source address", _t423, _t438, _t440);
							E004034EB("\t-t\t\tanswer TELNET negotiation", _t423, _t438, _t440);
							E004034EB("\t-c\t\tsend CRLF instead of just LF\n\t-u\t\tUDP mode\n\t-v\t\tverbose [use twice to be more verbose]\n\t-w secs\t\ttimeout for connects and final net reads\n\t-z\t\tzero-I/O mode [used for scanning]", _t423, _t438, _t440);
							E004035DB(0, _t295, _t376, "port numbers can be individual or ranges: m-n [inclusive]", _t423, _t438, _t440);
							return 0;
						}
					} else {
						_v48 = 0;
						_t339 =  *((intOrPtr*)((_t306 << 3) + _a24));
						if(_t339 != 0) {
							_t365 =  *((intOrPtr*)((_t339 << 3) + _a24));
							_v48 = E00403BC0(0, _t365);
							if(_v48 == 0) {
								_t423 =  *((intOrPtr*)((_t365 << 3) + _a24));
								E004035DB(_t229, (_t365 << 3) + _a24, _t376, "invalid port %s",  *((intOrPtr*)((_t365 << 3) + _a24)), _t437, _t440);
							}
						}
						_t306 = _v40;
						r9d = _v42 & 0x0000ffff;
						_t438 = _v32;
						 *0x408010 = E0040425F(_v48 & 0x0000ffff, _t306, _v32, _t440);
						_t184 =  *0x408010; // 0xffffffff
						if(_t184 <= 0) {
							L54:
							E004035DB(_t229, _t288, _t376, "no connection", _t423, _t438, _t440);
							goto L55;
						} else {
							_t340 =  *0x40b0e8;
							if( *0x40b0e8 != 0) {
								E004026FD(_t229, _t340, _t340, _t438);
							}
							_t306 =  *0x40b0e8;
							if(_t306 == 0) {
								_t204 =  *0x408010; // 0xffffffff
								_t263 = E00404B7C(_t204, _t262, _t267, _t438, _t440);
							}
							if(( *0x40b0da & 0x0000ffff) > 1) {
								r8d =  *0x40b080;
								E004034EB(" sent %d, rcvd %d", _t423, _t438, _t440);
							}
							_t288 = _v60 - 1;
							if(_v60 == 1) {
								L3:
								__eflags = _a16 - 1;
								if(__eflags == 0) {
									_t341 = _a24;
									E0040371E(0x400, _t341, _t423);
									_a24 = _t341;
									_t342 = _a24;
									 *_t342 =  *_t341;
									E0040371E(0x2000, _t342, _t423);
									_t378 = _t342;
									 *((long long*)(_a24 + 8)) = _t378;
									_t345 = __imp____iob_func;
									 *_t345();
									_t6 = _t345 + 0x60; // 0x60
									_t440 = _t6;
									r8d = 0xa;
									L004074E8(); // executed
									_t190 =  *__imp____iob_func();
									L00407490();
									r8d = 0x2000;
									_t428 = _t378;
									L00407368(); // executed
									 *0x40b07c = _t190;
									__eflags =  *0x40b07c;
									if(__eflags == 0) {
										E004035DB(0, __eflags, _t378, "wrong", _t428, _t438, _t440);
									}
									_t265 = E0040377B( *0x40b07c, _t378);
									__eflags = _t265;
									if(_t265 != 0) {
										_t238 =  *0x40b07c - _t265;
										__eflags = _t238;
										 *0x40b07c = _t238;
									}
									__eflags =  *0x40b07c;
									if( *0x40b07c != 0) {
										L004073F8();
									}
									L004074F0();
									_t379 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t379;
									if(_t379 != 0) {
										 *_t379 = 0;
									}
									L004074F0();
									_t380 =  *((intOrPtr*)(_a24 + 8));
									__eflags = _t380;
									if(_t380 != 0) {
										 *_t380 = 0;
									}
									_t376 =  *((intOrPtr*)(_a24 + 8)) + 1;
									_t266 = 2;
									while(1) {
										__eflags =  *_t376 & 0x000000ff;
										if(__eflags == 0) {
											break;
										}
										__eflags = ( *_t376 & 0x000000ff) - 0x20;
										if(( *_t376 & 0x000000ff) != 0x20) {
											_t11 = _t376 - 1; // -2
											__eflags =  *_t11 & 0x000000ff;
											if(( *_t11 & 0x000000ff) == 0) {
												 *((_t266 << 3) + _a24) = _t376;
												_t266 = _t266 + 1;
												__eflags = _t266;
											}
										} else {
											 *_t376 = 0;
										}
										_t376 = _t376 + 1;
										__eflags = _t376;
									}
									_a16 = _t266;
								}
								continue;
							} else {
								_t229 = _t263;
								L00407428();
								goto L54;
							}
						}
					}
				}
				_t14 = _t430 - 0x47; // -71
				__eflags = _t14 - 0x33;
				if(__eflags > 0) {
					_t298 = __imp___errno;
					 *_t298();
					 *_t298 = 0;
					E004035DB(_t229, __eflags, _t376, "nc -h for help", _t423, "ade:g:G:hi:lLno:p:rs:tcuvw:z", _t440);
					goto L25;
				}
				_t423 =  *((intOrPtr*)(0x409b50 + _t297 * 4));
				goto __rax;
			}

0x004055b5
0x004055bc
0x004058bb
0x004058bb
0x004058bb
0x004058bf
0x004058c6
0x004058c9
0x004058d1
0x004058d6
0x00000000
0x00000000
0x004058e6
0x004058ed
0x004058f4
0x004058f9
0x004058fe
0x00405903
0x00405903
0x00405907
0x00405911
0x00405913
0x00405918
0x0040591d
0x00405926
0x00405926
0x00405930
0x0040593a
0x0040593c
0x00405943
0x00405951
0x00405956
0x00405962
0x00405964
0x00405966
0x0040596d
0x00405977
0x00405977
0x0040597c
0x00405981
0x00405986
0x00405986
0x0040599d
0x004059a3
0x004059bf
0x004059c5
0x004059ca
0x004059ca
0x004059d3
0x004059ee
0x004059ee
0x004059f7
0x00405a02
0x00405a02
0x00405a08
0x00405a0f
0x00405a11
0x00405a21
0x00405b3e
0x00405b3e
0x00405b43
0x00405b4c
0x00405b4c
0x00405b61
0x00405b64
0x00405b67
0x00405b70
0x00405b70
0x00405b89
0x00405b8f
0x00405b91
0x00405b91
0x00405b9e
0x00405edb
0x00405eeb
0x00405ef1
0x00000000
0x00000000
0x00405ba7
0x00405bb1
0x00405bc5
0x00405bd0
0x00405bd5
0x00405bd8
0x00405bdb
0x00405bdd
0x00405be0
0x00405bf1
0x00405bf5
0x00405bfa
0x00405bfc
0x00405c06
0x00405c06
0x00405bfa
0x00405c1b
0x00405c23
0x00405c2b
0x00405c2f
0x00405c34
0x00405c42
0x00405c42
0x00405c46
0x00405c49
0x00405c4c
0x00405c53
0x00405c53
0x00405c5c
0x00405c60
0x00405cb3
0x00405c62
0x00405c62
0x00405c6f
0x00405c7a
0x00405c7d
0x00405c83
0x00405c8f
0x00405c95
0x00405c9a
0x00405c9e
0x00405ca6
0x00405ca6
0x00405c7d
0x00405ebe
0x00405ec2
0x00405ec6
0x00000000
0x00000000
0x00405cbc
0x00405cc1
0x00405cc3
0x00405cca
0x00405ccd
0x00405ccf
0x00405cd4
0x00405cd8
0x00405cde
0x00405ce0
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405ccd
0x00405cec
0x00405cf6
0x00405d06
0x00405d0a
0x00405d0d
0x00405d18
0x00405d1e
0x00405d24
0x00405d26
0x00405d2f
0x00405d32
0x00405d3b
0x00405d3e
0x00405d40
0x00405d46
0x00405d4a
0x00405d51
0x00405d51
0x00405d3e
0x00405d32
0x00405d57
0x00405d5d
0x00405d5f
0x00405dec
0x00405df8
0x00405dfb
0x00405e1a
0x00405e2c
0x00405e2c
0x00405e35
0x00405e39
0x00405e3e
0x00405e41
0x00405e44
0x00405e4e
0x00000000
0x00405e4e
0x00405e04
0x00405e08
0x00000000
0x00000000
0x00405e0a
0x00405e11
0x00405e13
0x00405e18
0x00000000
0x00000000
0x00000000
0x00405d65
0x00405d65
0x00405d89
0x00405d8e
0x00405d91
0x00405d94
0x00405d9e
0x00405da3
0x00405daa
0x00405dad
0x00405dba
0x00405dba
0x00405dc6
0x00405dc9
0x00405dcf
0x00405dd6
0x00405dd9
0x00405ddb
0x00405de1
0x00405de8
0x00405de8
0x00405dd9
0x00405e53
0x00405e63
0x00405e6a
0x00405e74
0x00405e77
0x00405e7e
0x00405e86
0x00405e88
0x00405e90
0x00405e92
0x00405e99
0x00405e99
0x00405ea2
0x00405ea5
0x00405eb9
0x00405eb9
0x00405eb9
0x00405ea7
0x00405ea7
0x00405eab
0x00405eb3
0x00405eb3
0x00000000
0x00405ea5
0x00405d5f
0x00405ed2
0x00405ed2
0x00405ed5
0x00405ed5
0x00405ef7
0x00405efe
0x00405f00
0x00405f11
0x00405f1f
0x00405f2b
0x00405f2b
0x00405f37
0x00405f3d
0x00000000
0x00405f43
0x00405f4a
0x00405f4d
0x00405f51
0x00405f51
0x00405f5b
0x00405f68
0x00405f78
0x00405f84
0x00405f90
0x00405f9c
0x00405fa8
0x00405fb4
0x00405fc0
0x00405fcb
0x00405fcb
0x00405a27
0x00405a27
0x00405a3d
0x00405a43
0x00405a55
0x00405a65
0x00405a6e
0x00405a83
0x00405a8d
0x00405a8d
0x00405a6e
0x00405a9e
0x00405aa2
0x00405aa5
0x00405ab0
0x00405ab6
0x00405abe
0x00405b32
0x00405b39
0x00000000
0x00405ac0
0x00405ac0
0x00405aca
0x00405ad7
0x00405ad7
0x00405adc
0x00405ae6
0x00405ae8
0x00405af5
0x00405af5
0x00405b02
0x00405b10
0x00405b1c
0x00405b1c
0x00405b21
0x00405b25
0x0040539b
0x0040539b
0x0040539f
0x004053a5
0x004053b1
0x004053b6
0x004053ba
0x004053be
0x004053c6
0x004053cb
0x004053d6
0x004053d9
0x004053e0
0x004053e2
0x004053ed
0x004053f0
0x004053fe
0x0040540a
0x00405413
0x00405418
0x0040541e
0x00405426
0x0040542b
0x00405437
0x00405439
0x00405442
0x00405442
0x00405457
0x00405459
0x0040545b
0x00405467
0x00405467
0x0040546b
0x0040546b
0x00405477
0x00405479
0x00405497
0x00405497
0x004054af
0x004054b4
0x004054b7
0x004054ba
0x004054bc
0x004054bc
0x004054d2
0x004054d7
0x004054da
0x004054dd
0x004054df
0x004054df
0x004054ed
0x004054f1
0x00405524
0x00405527
0x00405529
0x00000000
0x00000000
0x004054fb
0x004054fd
0x00405504
0x0040550b
0x0040550d
0x0040551a
0x0040551d
0x0040551d
0x0040551d
0x004054ff
0x004054ff
0x004054ff
0x00405520
0x00405520
0x00405520
0x0040552b
0x0040552b
0x00000000
0x00405b2b
0x00405b2b
0x00405b2d
0x00000000
0x00405b2d
0x00405b25
0x00405abe
0x00405a21
0x00405533
0x00405536
0x00405539
0x0040589a
0x004058a1
0x004058a3
0x004058b0
0x00000000
0x004058b0
0x00405553
0x00405561

APIs

_close.MSVCRT ref: 00405918
_open.MSVCRT ref: 00405951

Part of subcall function 004026FD: _itoa.MSVCRT ref: 0040279C

Strings

ade:g:G:hi:lLno:p:rs:tcuvw:z, xrefs: 004058BF
no destination, xrefs: 00405B45
-ddetach from console, background mode, xrefs: 00405F7D
port numbers can be individual or ranges: m-n [inclusive], xrefs: 00405FB9
[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:, xrefs: 00405F71
-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum, xrefs: 00405F95
sent %d, rcvd %d, xrefs: 00405B15
sent %d, rcvd %d, xrefs: 00405F24
-csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning], xrefs: 00405FAD
no port[s] to connect to, xrefs: 00405B69
no connection, xrefs: 00405B32
invalid port %s, xrefs: 00405A86
-e proginbound program to exec [dangerous!!], xrefs: 00405F89
-tanswer TELNET negotiation, xrefs: 00405FA1
can't open %s, xrefs: 00405970

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close_itoa_open
String ID: -csend CRLF instead of just LF-uUDP mode-vverbose [use twice to be more verbose]-w secstimeout for connects and final net reads-zzero-I/O mode [used for scanning]$-ddetach from console, background mode$-e proginbound program to exec [dangerous!!]$-g gatewaysource-routing hop point[s], up to 8-G numsource-routing pointer: 4, 8, 12, ...-hthis cruft-i secsdelay interval for lines sent, ports scanned-llisten mode, for inbound connects-Llisten harder, re-listen on socket close-nnum$-tanswer TELNET negotiation$ sent %d, rcvd %d$[v1.12 NT http://eternallybored.org/misc/netcat/]connect to somewhere:nc [-options] hostname port[s] [ports] ... listen for inbound:nc -l -p port [options] [hostname] [port]options:$ade:g:G:hi:lLno:p:rs:tcuvw:z$can't open %s$invalid port %s$no connection$no destination$no port[s] to connect to$port numbers can be individual or ranges: m-n [inclusive]$sent %d, rcvd %d
API String ID: 357769857-3526283814
Opcode ID: 3a6a0462b61e22ec1e4e1e08eede510bdf388febeacd1c22725377d6b02288f0
Instruction ID: 32178a147c5a87466c29771b37e4f748e23c356c5c57a27f44acaaec0d940870
Opcode Fuzzy Hash: 3a6a0462b61e22ec1e4e1e08eede510bdf388febeacd1c22725377d6b02288f0
Instruction Fuzzy Hash: A6A13FA1B00A1486EB10DF26E89136A37A0FB44798F44442AEB5D773E1EF3CD945C79C

Uniqueness

Uniqueness Score: -1.00%

Function 00404B7C Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 00404CFA
__WSAFDIsSet.WSOCK32 ref: 00404ECD
_kbhit.MSVCRT ref: 00404FCB
_close.MSVCRT ref: 00405077
_read.MSVCRT ref: 00405093
_close.MSVCRT ref: 004050A3
__WSAFDIsSet.WSOCK32 ref: 00405240

Strings

net timeout, xrefs: 00404E6C
too many output retries, xrefs: 00405112
Preposterous Pointers: %d, %d, xrefs: 004050F2
select fuxored, xrefs: 00404DED

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _close$_kbhit_read
String ID: Preposterous Pointers: %d, %d$net timeout$select fuxored$too many output retries
API String ID: 219334779-2498977472
Opcode ID: b2d1aa071998607e9355e0f092b8a8462de7b19ae197dece79b98469ba2bc168
Instruction ID: cf21e2d091fa6b690a5056ef3650b023c702295b07089b35a35e04ed77456dc2
Opcode Fuzzy Hash: b2d1aa071998607e9355e0f092b8a8462de7b19ae197dece79b98469ba2bc168
Instruction Fuzzy Hash: 0E121BB5B01604CAEB10DF6AE89075A33B1F788B88F54412ADF1DA77A4DB3DD941CB48

Uniqueness

Uniqueness Score: -1.00%

Function 004048CC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004048CC(intOrPtr __ecx, void* __edx, long long __rdx, intOrPtr _a8, void* _a16, intOrPtr _a24) {
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* __rbx;
				intOrPtr _t35;
				intOrPtr _t56;
				intOrPtr _t62;
				intOrPtr _t66;
				char* _t77;
				void* _t80;
				char* _t81;
				char* _t83;
				char* _t84;
				char* _t85;
				char* _t86;
				char* _t87;
				char* _t88;
				char* _t94;
				intOrPtr _t95;
				signed char* _t97;
				void* _t98;
				void* _t99;
				char* _t100;

				_a8 = __ecx;
				_a16 = __rdx;
				_a24 = r8d;
				_t67 =  *0x40b074;
				if( *0x40b074 == 0) {
					E004035DB(__ecx, _t67, _t80, "oprint called with no open fd?!", __rdx, _t98, _t99);
				}
				if(_a24 != 0) {
					_t81 =  *0x40b0c0;
					if(_a8 == 0) {
						 *_t81 = 0x3e;
						_v64 =  *0x40b084;
					} else {
						 *_t81 = 0x3c;
						_v64 =  *0x40b080;
					}
					 *((char*)(_t81 + 1)) = 0x20;
					_t97 = _a16;
					_t35 = _a24;
					_v60 = _t35;
					 *((char*)( *0x40b0c0 + 0x3b)) = 0x23;
					 *((char*)( *0x40b0c0 + 0x3c)) = 0x20;
					while(_v60 != 0) {
						_t62 = 0x10;
						_v68 = 0x4e;
						__eflags = _v60 - 0x10;
						if(_v60 >= 0x10) {
							L12:
							_v60 = _v60 - _t62;
							r8d = _v64;
							_t94 = "%8.8x ";
							L004074B8();
							_v64 = _v64 + _t62;
							_t83 =  *0x40b0c0 + 0xb;
							_t77 =  *0x40b0c0;
							_t100 = _t77 + 0x3d;
							while(1) {
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								r13d = ( *_t97 & 0x000000ff) >> 0x00000004 & 0x000000ff;
								 *_t83 =  *(_t94 + "0123456789abcdef  ") & 0x000000ff;
								_t84 = _t83 + 1;
								r13d =  *_t97 & 0xff;
								r13d = r13d & 0x0000000f;
								_t77 = "0123456789abcdef  ";
								 *_t84 =  *(_t94 + _t77) & 0x000000ff;
								_t85 = _t84 + 1;
								 *_t85 = 0x20;
								_t83 = _t85 + 1;
								__eflags = ( *_t97 & 0x000000ff) - 0x1f;
								if(( *_t97 & 0x000000ff) <= 0x1f) {
									L16:
									 *_t100 = 0x2e;
									L17:
									_t100 = _t100 + 1;
									_t97 =  &(_t97[1]);
									_t62 = _t62 - 1;
									__eflags = _t62;
									continue;
								}
								__eflags = ( *_t97 & 0x000000ff) - 0x7e;
								if(( *_t97 & 0x000000ff) > 0x7e) {
									goto L16;
								}
								 *_t100 =  *_t97 & 0x000000ff;
								goto L17;
							}
							 *_t100 = 0xa;
							_t95 =  *0x40b0c0;
							_t35 =  *0x40b074;
							r8d = _v68;
							_t56 = _t35;
							L00407350();
							__eflags = _t35;
							if(__eflags < 0) {
								_t35 = E004035DB(_t56, __eflags, _t83, "ofd write err", _t95, _t98, _t99);
							}
							continue;
						}
						_v68 = _v68 - 0x10 + _v60;
						_t17 = _t77 + 0xb; // 0xb
						_t86 =  *0x40b0c0 + _t17;
						_t66 = 0x10 - _v60;
						while(1) {
							__eflags = _t66;
							if(_t66 == 0) {
								break;
							}
							 *_t86 = 0x20;
							_t87 = _t86 + 1;
							 *_t87 = 0x20;
							_t88 = _t87 + 1;
							 *_t88 = 0x20;
							_t86 = _t88 + 1;
							_t66 = _t66 - 1;
							__eflags = _t66;
						}
						_t62 = _v60;
						goto L12;
					}
					return _t35;
				}
				return __eax;
			}

0x004048db
0x004048de
0x004048e2
0x004048ec
0x004048ee
0x004048f7
0x004048f7
0x00404900
0x00404906
0x00404911
0x00404921
0x0040492a
0x00404913
0x00404913
0x0040491c
0x0040491c
0x00404931
0x00404934
0x00404938
0x0040493b
0x00404949
0x00404957
0x00404aa1
0x0040495f
0x00404964
0x0040496b
0x0040496e
0x004049c1
0x004049c1
0x004049d9
0x004049dc
0x004049df
0x004049e4
0x004049ee
0x004049f2
0x004049f9
0x00404a6c
0x00404a6c
0x00404a6e
0x00000000
0x00000000
0x00404a05
0x00404a17
0x00404a19
0x00404a23
0x00404a26
0x00404a2d
0x00404a38
0x00404a3a
0x00404a3e
0x00404a41
0x00404a48
0x00404a4a
0x00404a5c
0x00404a5c
0x00404a61
0x00404a61
0x00404a65
0x00404a69
0x00404a69
0x00000000
0x00404a69
0x00404a4f
0x00404a51
0x00000000
0x00000000
0x00404a56
0x00000000
0x00404a56
0x00404a70
0x00404a78
0x00404a7f
0x00404a85
0x00404a88
0x00404a8a
0x00404a91
0x00404a93
0x00404a9c
0x00404a9c
0x00000000
0x00404a93
0x00404979
0x00404985
0x00404992
0x0040499d
0x004049ba
0x004049ba
0x004049bc
0x00000000
0x00000000
0x004049a2
0x004049a5
0x004049a9
0x004049ac
0x004049b0
0x004049b3
0x004049b7
0x004049b7
0x004049b7
0x004049be
0x00000000
0x004049be
0x00000000
0x00404aa1
0x00404aba

APIs

_write.MSVCRT ref: 00404A8A

Strings

%8.8x , xrefs: 004049C4
oprint called with no open fd?!, xrefs: 004048F0
ofd write err, xrefs: 00404A95
0123456789abcdef , xrefs: 00404A0C, 00404A2D

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _write
String ID: %8.8x $0123456789abcdef $ofd write err$oprint called with no open fd?!
API String ID: 4149450435-2525127170
Opcode ID: 8d32f703b86c68e0676f0e28d192fc80949e38d902dbebd8188bc8d52a0953c0
Instruction ID: 753d877037e281a7939baf9683916c7999053b966fcdfa04dcdb03f4a0fd957e
Opcode Fuzzy Hash: 8d32f703b86c68e0676f0e28d192fc80949e38d902dbebd8188bc8d52a0953c0
Instruction Fuzzy Hash: 7E518DB3B456A08AEB02CB39E84039E3BA1F354748F084126EF9967799D73CC901C799

Uniqueness

Uniqueness Score: -1.00%

Function 004026FD Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

_itoa.MSVCRT ref: 0040279C
_itoa.MSVCRT ref: 00402855

Strings

Failed to create ReadShell session thread, error = %s, xrefs: 004027CB, 00402884
WaitForMultipleObjects error: %s, xrefs: 00402A05

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _itoa
String ID: Failed to create ReadShell session thread, error = %s$WaitForMultipleObjects error: %s
API String ID: 2976379300-1286572211
Opcode ID: 2a9cf43e09b0fceb8f74368e5b9e0c26564e1dcfd8b798480aaccd27c0ca2a2e
Instruction ID: 0cf69bf676a791dd5fa2397a66077d321a7da3f5f50b2f4c5f390b80d2b701dc
Opcode Fuzzy Hash: 2a9cf43e09b0fceb8f74368e5b9e0c26564e1dcfd8b798480aaccd27c0ca2a2e
Instruction Fuzzy Hash: 59A1E7B6B00B0889EB50DB6AE89135D2B70F388B98F104626CF5D677B8DF38C5458794

Uniqueness

Uniqueness Score: -1.00%

Function 00402470 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_itoa.MSVCRT ref: 0040251E

Strings

Failed to create shell stdin pipe, error = %s, xrefs: 004025D3
Failed to execute shell, xrefs: 00402655
Failed to create shell stdout pipe, error = %s, xrefs: 0040254D

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _itoa
String ID: Failed to create shell stdin pipe, error = %s$Failed to create shell stdout pipe, error = %s$Failed to execute shell
API String ID: 2976379300-2392963465
Opcode ID: b0f55332e28ff3cb3008e544f4763bc45c2f83d5e1f8347cbdb1f26d53328cae
Instruction ID: 99d4967df45a7bf232336e649b03466fdce5a92ee8dc76b57760f8b5f02a6509
Opcode Fuzzy Hash: b0f55332e28ff3cb3008e544f4763bc45c2f83d5e1f8347cbdb1f26d53328cae
Instruction Fuzzy Hash: DA61E532B11B0498EF10DBA6E8A479D2770B348B98F04422ADE5D6BBE8DF7DC645C744

Uniqueness

Uniqueness Score: -1.00%

Function 00406490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406490(int __eax, signed int __rax, long long __rbx, long long __rcx, long long __rdx, long long __rdi, long long __rsi, long long __rbp, long long __r8, signed long long __r10, long long __r12, long long __r13, long long __r14) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				signed int _v60;
				int _v84;
				void* _v96;
				char _v120;
				long long _v160;
				long long _v168;
				long long _v176;
				long long _v184;
				long long _v192;
				char _v196;
				signed long long _v208;
				int _t61;
				long _t62;
				signed int _t63;
				char _t65;
				signed int _t67;
				signed int _t70;
				signed int _t72;
				signed int _t76;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int* _t105;
				signed int* _t110;
				signed char* _t113;
				signed int* _t114;
				signed int _t122;
				signed long long* _t146;
				void* _t161;
				void* _t164;
				intOrPtr _t165;
				void* _t166;
				signed int _t171;
				signed long long _t175;
				signed int _t177;
				signed int _t181;

				_t189 = __r14;
				_t187 = __r13;
				_t182 = __r12;
				_t175 = __r10;
				_t143 = __rbp;
				_t61 = __eax;
				_v56 = __rbx;
				_v48 = __rsi;
				_t104 = __r8;
				_v40 = __rdi;
				_v32 = __rbp;
				_t138 = __rcx;
				_v24 = __r12;
				_v16 = __r13;
				_t132 = __rdx;
				_v8 = __r14;
				if(__r8 != 0) {
					r8d = 0x30;
					_t62 = VirtualQuery(??, ??, ??);
					__eflags = __rax;
					if(__rax == 0) {
						_t113 = "  VirtualQuery failed for %d bytes at address %p";
						_t159 = __rcx;
						_t63 = E00406430(_t62, _t113,  &_v120, __rdx, __rcx, __rbp, __rcx, _t164, __r10, __r12, __r13, __r14);
						asm("o16 nop [cs:eax+eax]");
						r8d =  *0x40b170;
						_v192 = _t104;
						_v184 = __rcx;
						_v176 = __rdx;
						_v168 = __rbp;
						__eflags = r8d;
						_v160 = __r12;
						if(r8d == 0) {
							_t105 = 0x40a210;
							 *0x40b170 = 1;
							_t122 = 0;
							__eflags = 0x40a210 - 7;
							if(0x40a210 <= 7) {
								goto L11;
							} else {
								__eflags = 0x40a210 - 0xb;
								if(0x40a210 <= 0xb) {
									L23:
									__eflags =  *_t105;
									if( *_t105 != 0) {
										goto L17;
									} else {
										__eflags = _t105[1];
										if(_t105[1] != 0) {
											goto L17;
										} else {
											goto L25;
										}
									}
								} else {
									_t99 =  *0x40a210; // 0x0
									__eflags = _t99;
									if(_t99 != 0) {
										L17:
										__eflags = _t105 - 0x40a210;
										while(_t105 < 0x40a210) {
											r8d = 4;
											_t113 =  &(_t113[0x400000]);
											_t65 =  *_t113 +  *_t105;
											_t105 =  &(_t105[2]);
											_v196 = _t65;
											_t63 = E00406490(_t65, 0x40a210, _t105, _t113,  &_v196,  &_v196, 0x40a210, 0x400000, _t159, _t175, _t182, _t187, _t189);
											__eflags = _t105 - 0x40a210;
										}
										goto L11;
									} else {
										_t97 =  *0x40a214; // 0x0
										__eflags = _t97;
										if(_t97 == 0) {
											_t98 =  *0x40a218; // 0x0
											__eflags = _t98;
											if(_t98 != 0) {
												L25:
												__eflags = _t105[2] - 1;
												if(_t105[2] != 1) {
													_t114 = "  Unknown pseudo relocation protocol version %d.\n";
													E00406430(_t63, _t114, _t122, _t132, _t138, _t143, _t159, _t164, _t175, _t182, _t187, _t189);
													0;
													0;
													0;
													_push(_t105);
													_t67 =  *_t114;
													__eflags = _t67 - 0xc0000091;
													if(_t67 > 0xc0000091) {
														__eflags = _t67 - 0xc0000094;
														if(__eflags == 0) {
															_t76 = 0;
															goto L56;
														} else {
															if(__eflags <= 0) {
																__eflags = _t67 - 0xc0000092;
																if(_t67 == 0xc0000092) {
																	goto L78;
																} else {
																	__eflags = _t67 - 0xc0000093;
																	if(_t67 == 0xc0000093) {
																		goto L55;
																	} else {
																		_t72 = 0;
																		goto L64;
																	}
																}
															} else {
																__eflags = _t67 - 0xc0000095;
																if(_t67 == 0xc0000095) {
																	goto L78;
																} else {
																	__eflags = _t67 - 0xc0000096;
																	if(_t67 == 0xc0000096) {
																		goto L79;
																	} else {
																		goto L63;
																	}
																}
															}
														}
													} else {
														__eflags = _t67 - 0xc000008d;
														if(_t67 < 0xc000008d) {
															__eflags = _t67 - 0xc0000008;
															if(__eflags == 0) {
																goto L78;
															} else {
																if(__eflags > 0) {
																	__eflags = _t67 - 0xc000001d;
																	if(_t67 == 0xc000001d) {
																		L79:
																		L00407430();
																		__eflags = 0x40a210 - 1;
																		if(0x40a210 == 1) {
																			L00407430();
																			_t70 = _t67 | 0xffffffff;
																		} else {
																			__eflags = 0x40a210;
																			_t70 = 1;
																			if(0x40a210 != 0) {
																				 *0x40a210();
																				_t70 = 0xffffffff;
																			}
																		}
																		goto L58;
																	} else {
																		__eflags = _t67 - 0xc000008c;
																		if(_t67 != 0xc000008c) {
																			goto L63;
																		} else {
																			goto L78;
																		}
																	}
																} else {
																	__eflags = _t67 - 0x80000002;
																	if(_t67 == 0x80000002) {
																		goto L78;
																	} else {
																		__eflags = _t67 - 0xc0000005;
																		if(_t67 != 0xc0000005) {
																			L63:
																			_t72 = 0;
																			__eflags = 0;
																			L64:
																			return _t72;
																		} else {
																			L00407430();
																			__eflags = 0x40a210 - 1;
																			if(0x40a210 == 1) {
																				L00407430();
																				_t70 = _t67 | 0xffffffff;
																			} else {
																				__eflags = 0x40a210;
																				_t70 = 1;
																				if(0x40a210 != 0) {
																					 *0x40a210();
																					_t70 = 0xffffffff;
																				}
																			}
																			goto L58;
																		}
																	}
																}
															}
														} else {
															L55:
															_t76 = 1;
															L56:
															L00407430();
															__eflags = 0x40a210 - 1;
															if(0x40a210 == 1) {
																L00407430();
																__eflags = _t76;
																if(_t76 == 0) {
																	L78:
																	return 0xffffffff;
																} else {
																	_t70 = E00406B50(_t67) | 0xffffffff;
																	goto L58;
																}
															} else {
																_t70 = 0;
																__eflags = 0x40a210;
																if(0x40a210 != 0) {
																	 *0x40a210();
																	_t70 = 0xffffffff;
																}
																L58:
																return _t70;
															}
														}
													}
												} else {
													_t110 =  &(_t105[3]);
													__eflags = _t110 - 0x40a210;
													if(_t110 < 0x40a210) {
														_t146 =  &_v208;
														do {
															r8d = _t110[2];
															_t63 = r8b & 0xffffffff;
															_t113 =  &(_t113[0x400000]);
															__eflags = _t63 - 0x10;
															_t165 =  *((intOrPtr*)(0x400000 + _t122));
															if(__eflags == 0) {
																r10d =  *_t113 & 0x0000ffff;
																__eflags = r10d & 0x00008000;
																_t160 = _t175;
																if((r10d & 0x00008000) == 0) {
																	goto L41;
																} else {
																	_t181 = (_t175 | 0xffff0000) - 0x400000;
																	__eflags = _t181;
																	_t175 = _t165 - _t122 + _t181;
																	_v208 = _t175;
																	goto L40;
																}
															} else {
																if(__eflags > 0) {
																	L32:
																	__eflags = _t63 - 0x20;
																	if(_t63 == 0x20) {
																		r10d =  *_t113;
																		__eflags = r10d & 0x80000000;
																		_t160 = _t175;
																		if((r10d & 0x80000000) == 0) {
																			goto L41;
																		} else {
																			_t177 = (_t175 | 0x00000000) - 0x400000;
																			__eflags = _t177;
																			_t175 = _t165 - _t122 + _t177;
																			_v208 = _t175;
																			goto L47;
																		}
																	} else {
																		__eflags = _t63 - 0x40;
																		if(_t63 != 0x40) {
																			goto L31;
																		} else {
																			_t171 = _t165 - _t122 - 0x400000 +  *_t113;
																			__eflags = _t171;
																			_v208 = _t171;
																			goto L35;
																		}
																	}
																} else {
																	__eflags = _t63 - 8;
																	if(_t63 == 8) {
																		r10d =  *_t113 & 0x000000ff;
																		__eflags = r10b & 0x00000080;
																		_t160 = _t175;
																		if((r10b & 0x00000080) == 0) {
																			L41:
																			_t166 = _t165 - _t122;
																			_t161 = _t160 - 0x400000;
																			__eflags = _t63 - 0x10;
																			_t160 = _t166 + _t161;
																			_v208 = _t166 + _t161;
																			if(__eflags == 0) {
																				L40:
																				r8d = 2;
																				_t122 = _t146;
																				_t63 = E00406490(_t63, 0x40a210, _t110, _t113, _t122, 0x40a210, 0x400000, _t146, _t160, _t175, 0, _t187, _t189);
																			} else {
																				if(__eflags > 0) {
																					__eflags = _t63 - 0x20;
																					if(_t63 == 0x20) {
																						L47:
																						r8d = 4;
																						_t122 = _t146;
																						_t63 = E00406490(_t63, 0x40a210, _t110, _t113, _t122, 0x40a210, 0x400000, _t146, _t160, _t175, 0, _t187, _t189);
																					} else {
																						__eflags = _t63 - 0x40;
																						if(_t63 == 0x40) {
																							L35:
																							r8d = 8;
																							_t122 = _t146;
																							_t63 = E00406490(_t63, 0x40a210, _t110, _t113, _t122, 0x40a210, 0x400000, _t146, _t160, _t175, 0, _t187, _t189);
																						}
																					}
																				} else {
																					__eflags = _t63 - 8;
																					if(_t63 == 8) {
																						goto L44;
																					}
																				}
																			}
																		} else {
																			_t175 = _t165 - _t122 + (_t175 | 0xffffff00) - 0x400000;
																			_v208 = _t175;
																			L44:
																			r8d = 1;
																			_t122 = _t146;
																			_t63 = E00406490(_t63, 0x40a210, _t110, _t113, _t122, 0x40a210, 0x400000, _t146, _t160, _t175, 0, _t187, _t189);
																		}
																	} else {
																		L31:
																		_t113 = "  Unknown pseudo relocation bit size %d.\n";
																		_v208 = 0;
																		_t63 = E00406430(_t63, _t113, _t122, 0x40a210, 0x400000, _t146, _t160, _t165, _t175, 0, _t187, _t189);
																		goto L32;
																	}
																}
															}
															_t110 =  &(_t110[3]);
															__eflags = 0x40a210 - _t110;
														} while (0x40a210 > _t110);
													}
													goto L11;
												}
											} else {
												_t105 = 0x40a21c;
												goto L23;
											}
										} else {
											goto L17;
										}
									}
								}
							}
						} else {
							L11:
							return _t63;
						}
					} else {
						_t61 = _v84;
						__eflags = _t61 - 4;
						if(_t61 != 4) {
							__eflags = _t61 - 0x40;
							if(_t61 == 0x40) {
								goto L4;
							} else {
								r8d = 0x40;
								VirtualProtect(??, ??, ??, ??);
								_t61 = _v84;
								__eflags = _t61 - 0x40;
								r13b = _t61 != 0x40;
								__eflags = _t61 - 4;
								r14b = _t61 != 4;
								L004073F8();
								__eflags = r14b;
								if(r14b != 0) {
									__eflags = r13b;
									if(r13b != 0) {
										r8d = _v60;
										_t61 = VirtualProtect(??, ??, ??, ??);
									}
								}
							}
						} else {
							L4:
							L004073F8();
						}
						goto L1;
					}
				} else {
					L1:
					return _t61;
				}
			}

0x00406490
0x00406490
0x00406490
0x00406490
0x00406490
0x00406490
0x0040649a
0x0040649f
0x004064a4
0x004064a7
0x004064ac
0x004064b1
0x004064b4
0x004064bc
0x004064c4
0x004064c7
0x004064cf
0x0040650a
0x00406510
0x00406516
0x00406519
0x004065b1
0x004065b8
0x004065c0
0x004065c5
0x004065d4
0x004065db
0x004065e0
0x004065e5
0x004065ea
0x004065ef
0x004065f2
0x004065f7
0x00406627
0x0040662e
0x0040663b
0x0040663e
0x00406642
0x00000000
0x00406644
0x00406644
0x00406648
0x004066c1
0x004066c3
0x004066c5
0x00000000
0x004066c7
0x004066ca
0x004066cc
0x00000000
0x00000000
0x00000000
0x00000000
0x004066cc
0x0040664a
0x0040664a
0x00406650
0x00406652
0x00406660
0x00406660
0x0040666a
0x00406683
0x0040668c
0x00406691
0x00406693
0x00406697
0x0040669b
0x004066a0
0x004066a0
0x00000000
0x00406654
0x00406654
0x0040665a
0x0040665c
0x004066b0
0x004066b6
0x004066b8
0x004066ce
0x004066d1
0x004066d4
0x00406865
0x0040686c
0x00406877
0x0040687b
0x0040687f
0x00406880
0x00406885
0x00406887
0x0040688c
0x004068c4
0x004068c9
0x00406960
0x00000000
0x004068cf
0x004068cf
0x00406940
0x00406945
0x00000000
0x00406947
0x00406947
0x0040694c
0x00000000
0x00406952
0x00406952
0x00000000
0x00406952
0x0040694c
0x004068d1
0x004068d1
0x004068d6
0x00000000
0x004068dc
0x004068dc
0x004068e1
0x00000000
0x00000000
0x00000000
0x00000000
0x004068e1
0x004068d6
0x004068cf
0x0040688e
0x0040688e
0x00406893
0x004068f0
0x004068f5
0x00000000
0x004068fb
0x004068fb
0x00406970
0x00406975
0x00406990
0x00406997
0x0040699c
0x004069a3
0x00406a07
0x00406a0c
0x004069a5
0x004069a5
0x004069a8
0x004069ad
0x004069b8
0x004069ba
0x004069ba
0x004069ad
0x00000000
0x00406977
0x00406977
0x0040697c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040697c
0x004068fd
0x004068fd
0x00406902
0x00000000
0x00406904
0x00406904
0x00406909
0x004068e7
0x004068e7
0x004068e7
0x004068e9
0x004068ee
0x0040690b
0x00406912
0x00406917
0x0040691e
0x004069f5
0x004069fa
0x00406924
0x00406924
0x00406927
0x0040692c
0x00406933
0x00406935
0x00406935
0x0040692c
0x00000000
0x0040691e
0x00406909
0x00406902
0x004068fb
0x00406895
0x00406895
0x00406895
0x0040689a
0x004068a1
0x004068a6
0x004068ad
0x004069da
0x004069df
0x004069e1
0x00406982
0x0040698c
0x004069e3
0x004069e8
0x00000000
0x004069e8
0x004068b3
0x004068b3
0x004068b5
0x004068b8
0x004069c9
0x004069cb
0x004069cb
0x004068be
0x004068c3
0x004068c3
0x004068ad
0x00406893
0x004066da
0x004066da
0x004066e5
0x004066e8
0x004066f5
0x00406704
0x00406707
0x0040670d
0x00406711
0x00406714
0x00406717
0x0040671b
0x00406780
0x00406784
0x0040678b
0x0040678e
0x00000000
0x00406790
0x0040679a
0x0040679a
0x0040679d
0x004067a1
0x00000000
0x004067a1
0x0040671d
0x0040671d
0x00406741
0x00406741
0x00406744
0x004067f0
0x004067f3
0x004067fa
0x004067fd
0x00000000
0x004067ff
0x00406805
0x00406805
0x00406808
0x0040680c
0x00000000
0x0040680c
0x0040674a
0x0040674a
0x0040674d
0x00000000
0x0040674f
0x00406755
0x00406755
0x00406758
0x00000000
0x00406758
0x0040674d
0x0040671f
0x0040671f
0x00406722
0x00406824
0x00406828
0x0040682c
0x0040682f
0x004067c0
0x004067c0
0x004067c3
0x004067c6
0x004067c9
0x004067cd
0x004067d2
0x004067a6
0x004067a6
0x004067ac
0x004067af
0x004067d4
0x004067d4
0x00406850
0x00406853
0x00406811
0x00406811
0x00406817
0x0040681a
0x00406855
0x00406855
0x00406858
0x0040675d
0x0040675d
0x00406763
0x00406766
0x00406766
0x00406858
0x004067d6
0x004067d6
0x004067d9
0x00000000
0x00000000
0x004067d9
0x004067d4
0x00406831
0x0040683e
0x00406842
0x004067db
0x004067db
0x004067e1
0x004067e4
0x004067e4
0x00406728
0x00406728
0x00406728
0x00406733
0x0040673c
0x00000000
0x0040673c
0x00406722
0x0040671d
0x0040676b
0x0040676f
0x0040676f
0x00406774
0x00000000
0x004066e8
0x004066ba
0x004066ba
0x00000000
0x004066ba
0x00000000
0x00000000
0x00000000
0x0040665c
0x00406652
0x00406648
0x004065f9
0x004065f9
0x00406616
0x00406616
0x0040651f
0x0040651f
0x00406523
0x00406526
0x00406540
0x00406543
0x00000000
0x00406545
0x0040654a
0x00406564
0x00406566
0x00406573
0x00406576
0x0040657a
0x0040657d
0x00406581
0x00406586
0x00406589
0x0040658f
0x00406592
0x0040659b
0x004065aa
0x004065aa
0x00406592
0x00406589
0x00406528
0x00406528
0x00406531
0x00406531
0x00000000
0x00406526
0x004064d1
0x004064d1
0x00406504
0x00406504

APIs

VirtualQuery.KERNEL32 ref: 00406510

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 004065B1

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p
API String ID: 1804819252-2206166143
Opcode ID: 37bdc5911b218e1f3bbe607bee17ffe94384d2fcda080e89025a07e95b95bf67
Instruction ID: 0637fb309ef209699b267df1f0d1f578fe8f7498e289977fe83c24590cb80b55
Opcode Fuzzy Hash: 37bdc5911b218e1f3bbe607bee17ffe94384d2fcda080e89025a07e95b95bf67
Instruction Fuzzy Hash: CC314876618B9086E6209B16B84035BB774F789BC4F584026EF8A63B69CF3CD521CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00402C97 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_itoa.MSVCRT ref: 00402E09
_strnicmp.MSVCRT ref: 00402EB6

Strings

SessionReadShellThreadFn exitted, error = %s, xrefs: 00402E38
exit, xrefs: 00402EAC

Memory Dump Source

Source File: 00000001.00000002.1207620874.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1207614218.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207630724.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207644750.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1207651573.000000000040D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_nc64.jbxd

Yara matches

Similarity

API ID: _itoa_strnicmp
String ID: SessionReadShellThreadFn exitted, error = %s$exit
API String ID: 2283094285-2225757753
Opcode ID: 821976ffd4d3dd39a9abe39c8850d3ccbbf38a04894f7d84bae644aa84c5f3e6
Instruction ID: a910a5ee9e59e8e36ce5f91a2045ce4b3482010477b2b0533805864d1e806828
Opcode Fuzzy Hash: 821976ffd4d3dd39a9abe39c8850d3ccbbf38a04894f7d84bae644aa84c5f3e6
Instruction Fuzzy Hash: 27717872B04B5589EB10CBA9E9947AD37B0B30878CF044566DF4C67BA8DB78CA05CB58

Uniqueness

Uniqueness Score: -1.00%

Source: nc64.exe	ReversingLabs: Detection: 31%
Source: nc64.exe	Virustotal: Detection: 35%			Perma Link

Source: Yara match	File source: nc64.exe, type: SAMPLE
Source: Yara match	File source: 00000001.00000002.1207637190.0000000000409000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.943077974.0000000000409000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nc64.exe PID: 1144, type: MEMORYSTR

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: nc64.exe	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: nc64.exe	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: nc64.exe	String found in binary or memory: http://crl.globalsign.net/Timestamping1.crl0
Source: nc64.exe	String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: nc64.exe	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: nc64.exe	String found in binary or memory: http://eternallybored.org/misc/netcat/
Source: nc64.exe	String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: nc64.exe	String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: nc64.exe	String found in binary or memory: http://www.globalsign.net/repository/0
Source: nc64.exe	String found in binary or memory: http://www.globalsign.net/repository/03
Source: nc64.exe	String found in binary or memory: http://www.globalsign.net/repository09

Source: C:\Users\user\Desktop\nc64.exe	Code function: String function: 004034EB appears 186 times
Source: C:\Users\user\Desktop\nc64.exe	Code function: String function: 004035DB appears 145 times

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nc64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: nc64.exePID: 1144, Parent PID: 1860

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Registry Activities

Key Opened

Windows Analysis Report
nc64.exe

Function 004011B0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 319
sleeplibraryloaderCOMMONCrypto

Function 00405282 Relevance: 28.6, APIs: 3, Strings: 13, Instructions: 581
COMMON

Function 00402F70 Relevance: 1.5, APIs: 1, Instructions: 26
networkCOMMON

Function 004055FF Relevance: 31.8, APIs: 2, Strings: 16, Instructions: 255
COMMON

Function 0040568A Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 247
COMMON

Function 0040581F Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 246
COMMON

Function 004055C3 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 241
COMMON

Function 00405743 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 238
COMMON

Function 00405563 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 231
COMMON

Function 00405797 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 235
COMMON

Function 0040571F Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 231
COMMON

Function 00405598 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 230
COMMON

Function 00405809 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 00405709 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 004057C7 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 004057DD Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 004056F3 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 004057F3 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 00405781 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 00405887 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 229
COMMON

Function 00405585 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 228
COMMON

Function 004055B5 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 228
COMMON

Function 004048CC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142
COMMON

Function 00406490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
COMMON